{
  description = "sow-tools / Crucible — NWN build/conversion/sync toolchain (self-contained Go devshell)";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

  outputs = { self, nixpkgs }:
    let
      systems = [ "x86_64-linux" "aarch64-linux" ];
      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
    in
    {
      # Self-contained (D8): a host with ONLY nix can enter this shell and run
      # `make check`. ffmpeg is present because the migrated music pipeline needs
      # it; the scaffold itself is pure stdlib Go.
      # Daemonless image build (D8): `nix build .#image` produces an OCI tarball
      # with no docker/podman daemon. CI loads/pushes it with skopeo. This is the
      # Nix-native replacement for `docker build` on the host-mode runner, which
      # has no container runtime. ffmpeg-headless ships the BMU codec path.
      packages = forAllSystems (pkgs:
        let
          version = self.shortRev or self.dirtyShortRev or "unknown";
          crucible = pkgs.buildGoModule {
            pname = "crucible";
            inherit version;
            src = ./.;
            vendorHash = "sha256-hm6mrNAtXv0LidzHUfz4eukTFZouizGtxkZ8gKJFUVI=";
            subPackages = [
              "cmd/crucible"
              "cmd/crucible-depot"
              "cmd/crucible-hak"
              "cmd/crucible-module"
              "cmd/crucible-topdata"
              "cmd/crucible-wiki"
            ];
            env.CGO_ENABLED = 0;
            ldflags = [
              "-s"
              "-w"
              "-X git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/buildinfo.Version=${version}"
            ];
            # Unit tests run in the `test` workflow / `make check`, not here.
            doCheck = false;
          };
        in
        {
          inherit crucible;
          default = crucible;

          image = pkgs.dockerTools.buildLayeredImage {
            name = "registry.westgate.pw/deployment/crucible";
            tag = version;
            contents = [ crucible pkgs.cacert pkgs.ffmpeg-headless pkgs.fakeNss ];
            config = {
              Entrypoint = [ "/bin/crucible" ];
              Cmd = [ "help" ];
              User = "65532:65532";
              Env = [
                "PATH=/bin"
                "SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
              ];
            };
          };
        });

      devShells = forAllSystems (pkgs: {
        default = pkgs.mkShell {
          name = "sow-tools";
          packages = with pkgs; [
            go
            gopls
            gotools
            ffmpeg
            git
            tea
            gnumake
            bashInteractive
            shellcheck
            yamllint
            jq
          ];
          shellHook = ''
            export GOCACHE="$PWD/.cache/go-build"
            echo "sow-tools / Crucible devshell (self-contained). $(go version 2>/dev/null)"
            echo "  make check   go vet + go test + shellcheck + yamllint"
            echo "  make build   build every cmd/* into ./bin"
            echo "  make smoke   build + run the binary smoke test"
          '';
        };
      });
    };
}