{
  description = "RadiantWave kiosk application (SDL3, C++17)";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs =
    {
      self,
      nixpkgs,
      flake-utils,
    }:
    nixpkgs.lib.recursiveUpdate
    (
      # nixpkgs dropped x86_64-darwin support, so this is the full set of
      # supported systems: Intel/ARM Linux and Apple Silicon macOS.
      flake-utils.lib.eachSystem
        [
          "x86_64-linux"
          "aarch64-linux"
          "aarch64-darwin"
        ]
        (
          system:
          let
            pkgs = import nixpkgs {
              inherit system;
              # The app itself is proprietary; let it build without the
              # global `allowUnfree = true` in the user's config.
              config.allowUnfreePredicate = pkg:
                (nixpkgs.lib.getName pkg) == "radiantwave";
            };
          in
          {
            packages.default = pkgs.callPackage ./nix/package.nix { };

            devShells.default = pkgs.mkShell {
              inputsFrom = [ self.packages.${system}.default ];
              packages = [ ];
              env = {
                # APP_VERSION and API_KEY are CMake cache variables with no
                # default; on a fresh configure cmake seeds their cache from
                # environment variables of the same name, so a plain
                # `cmake -S . -B build` bakes them into the binary.
                APP_VERSION = "dev";
              };
              shellHook = ''
                # Never commit the real key. Export API_KEY (or the CI name
                # RWT_LIVE_API_KEY) in your ambient environment and this shell
                # picks it up; empty by default (no auth header).
                export API_KEY="''${API_KEY:-''${RWT_LIVE_API_KEY:-}}"

                echo "RadiantWave dev shell (APP_VERSION=dev, API_KEY=$([[ -n "$API_KEY" ]] && echo set || echo unset))"
                echo "  Configure: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug"
                echo "  Bake version+key: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DAPP_VERSION=\"1.2.3\" -DAPI_KEY=\"<key>\""
                echo "  Build:     cmake --build build"
                echo "  Run:       ./build/radiantwave"
                echo "  Tests:     ./build/test_assets && ./build/test_<name>"
              '';
            };

            # `nix flake check` builds this, which runs the offline test suite.
            checks.default = self.packages.${system}.default;
          }
        )
    )
    {
      nixosModules.default = import ./nixos/module.nix self;

      nixosConfigurations.test-vm = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        modules = [
          "${nixpkgs}/nixos/modules/virtualisation/qemu-vm.nix"
          self.nixosModules.default
          ./nixos/vm.nix
        ];
      };

      packages.x86_64-linux.test-vm =
        self.nixosConfigurations.test-vm.config.system.build.vm;
    };
}