{
  lib,
  stdenv,
  cmake,
  ninja,
  pkg-config,
  gtest,
  makeWrapper,
  sdl3,
  sdl3-ttf,
  sdl3-image,
  sdl3-mixer,
  sdl3-net,
  sqlite,
  curl,
  openssl,
  systemdLibs,
  # Portal API key baked into the binary. Keep it out of the flake; pass it
  # when calling callPackage from CI/your own config (see README "App version").
  apiKey ? "",
  # App version baked into the Home footer's Version row. CI overrides this
  # per branch (git tag on main, commit hash on dev); local/pure builds keep
  # the 0.1.0 default.
  version ? "0.1.0",
}:

stdenv.mkDerivation (finalAttrs: {
  pname = "radiantwave";
  inherit version;

  src = lib.cleanSourceWith {
    filter =
      name: type:
      let
        base = baseNameOf name;
      in
      !(builtins.elem base [
        ".git"
        ".github"
        ".vscode"
        ".DS_Store"
        "build"
        "archive"
      ]);
    src = ../.;
  };

  nativeBuildInputs = [
    cmake
    ninja
    pkg-config
    makeWrapper
  ];

  # Bake the package version into the binary so the Home footer's Version row
  # shows it (CMake passes APP_VERSION through as a compile definition).
  # API_KEY is only added when a non-empty key is supplied to callPackage.
  cmakeFlags =
    [ "-DAPP_VERSION=${finalAttrs.version}" ]
    ++ lib.optionals (apiKey != "") [ "-DAPI_KEY=${apiKey}" ];

  # gtest is a buildInput, not native: nixpkgs builds it shared, so the
  # check-phase test binaries need its lib dir baked into their RPATH.
  buildInputs = [
    gtest
    sdl3
    sdl3-ttf
    sdl3-image
    sdl3-mixer
    sdl3-net
    sqlite
    curl
    openssl
  ] ++ lib.optionals stdenv.isLinux [
    # libsystemd provides the sd-bus client used by the NetworkManager code.
    # It is only linked on Linux (guarded in network_manager.cpp).
    systemdLibs
  ];

  # nixpkgs disables tests by default; our checkPhase runs the offline suite.
  doCheck = true;

  checkPhase = ''
    runHook preCheck

    # The nixpkgs cmake hook runs this phase from inside ./build; the test
    # binaries resolve `assets/...` relative to the source root.
    cd ..

    # No audio/video hardware exists in the build sandbox.
    export SDL_VIDEODRIVER=dummy
    export SDL_AUDIODRIVER=dummy

    # Offline-safe suite. test_api_client and test_license_service are
    # excluded: their "Live" tests hit the portal unconditionally and belong
    # on a dev machine, not in a hermetic build sandbox.
    for t in \
      tests \
      test_assets \
      test_provisioning \
      test_network_unit \
      test_nm_device \
      test_config \
      test_db \
      test_proclamation_sync \
      test_license_status \
      test_validation \
      test_date_format \
      test_timezone \
      test_logger \
      test_audio \
      test_audio_downloader \
      test_fibonacci_pattern \
      test_scroller_streams \
      test_fibonacci_scrambler \
      test_color_palettes
    do
      echo "==> running $t"
      ./build/$t
    done

    runHook postCheck

    # The cmake install phase runs ninja from the build dir; the test loop
    # above left us in the source root.
    cd "$cmakeBuildDir"
  '';

  postInstall = ''
    # The app resolves `assets/...` relative to its working directory, so the
    # wrapper chdirs into a read-only share directory before exec. The cmake
    # hook leaves the CWD inside ./build; assets live in the source root.
    cd ..
    mkdir -p "$out/share/radiantwave"
    cp -r assets "$out/share/radiantwave/assets"

    mv "$out/bin/radiantwave" "$out/bin/.radiantwave-unwrapped"
    makeWrapper "$out/bin/.radiantwave-unwrapped" "$out/bin/radiantwave" \
      --chdir "$out/share/radiantwave"
  '';

  meta = with lib; {
    description = "RadiantWave wellness kiosk application";
    license = licenses.unfree;
    platforms = platforms.linux ++ platforms.darwin;
    mainProgram = "radiantwave";
  };
})