{
  description = "josh-sync: bidirectional monorepo ↔ subrepo sync via josh-proxy";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

  outputs = { self, nixpkgs }:
    let
      forAllSystems = nixpkgs.lib.genAttrs [
        "x86_64-linux"
        "aarch64-linux"
        "x86_64-darwin"
        "aarch64-darwin"
      ];
    in
    {
      packages = forAllSystems (system:
        let
          pkgs = nixpkgs.legacyPackages.${system};
          version = builtins.replaceStrings [ "\n" ] [ "" ] (builtins.readFile ./VERSION);
        in
        {
          default = pkgs.stdenv.mkDerivation {
            pname = "josh-sync";
            inherit version;
            src = ./.;

            nativeBuildInputs = [ pkgs.makeWrapper ];

            installPhase = ''
              mkdir -p $out/{bin,lib}
              cp lib/*.sh $out/lib/
              cp bin/josh-sync $out/bin/
              chmod +x $out/bin/josh-sync

              wrapProgram $out/bin/josh-sync \
                --set JOSH_SYNC_ROOT "$out" \
                --prefix PATH : ${pkgs.lib.makeBinPath [
                  pkgs.bash
                  pkgs.git
                  pkgs.curl
                  pkgs.jq
                  pkgs.yq-go
                  pkgs.openssh
                  pkgs.coreutils
                  pkgs.findutils
                  pkgs.rsync
                ]}
            '';

            meta = {
              description = "Bidirectional monorepo ↔ subrepo sync via josh-proxy";
              license = pkgs.lib.licenses.mit;
              mainProgram = "josh-sync";
            };
          };
        });

      # devenv module for consumers
      devenvModules.default = { pkgs, ... }: {
        packages = [ self.packages.${pkgs.system}.default ];
        dotenv.disableHint = true;
      };

      # Dev shell for library contributors
      devShells = forAllSystems (system:
        let pkgs = nixpkgs.legacyPackages.${system};
        in {
          default = pkgs.mkShell {
            packages = [
              pkgs.bash
              pkgs.git
              pkgs.curl
              pkgs.jq
              pkgs.yq-go
              pkgs.openssh
              pkgs.shellcheck
              pkgs.bats
              pkgs.rsync
            ];
          };
        });
    };
}