flake.nix

{
  description = "CDK Flake";

  nixConfig = {
    extra-substituters = [
      "https://cashudevkit.cachix.org"
    ];
    extra-trusted-public-keys = [
      "cashudevkit.cachix.org-1:zFKdvMiTllKWxIFNTjXgisZsOFufmaZXjWJNcmc8r+4="
    ];
  };

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";

    rust-overlay = {
      url = "github:oxalica/rust-overlay";
      inputs = {
        nixpkgs.follows = "nixpkgs";
      };
    };

    fenix = {
      url = "github:nix-community/fenix";
      inputs.nixpkgs.follows = "nixpkgs";
      inputs.rust-analyzer-src.follows = "";
    };

    flake-utils.url = "github:numtide/flake-utils";

    dart-overlay = {
      url = "github:roman-vanesyan/dart-overlay";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    crane = {
      url = "github:ipetkov/crane";
    };
  };

  outputs =
    { self
    , nixpkgs
    , nixpkgs-unstable
    , rust-overlay
    , flake-utils
    , dart-overlay
    , crane
    , ...
    }@inputs:
    flake-utils.lib.eachDefaultSystem (
      system:
      let
        # Architecture-specific configuration for static musl builds
        muslTarget =
          {
            "x86_64-linux" = "x86_64-unknown-linux-musl";
            "aarch64-linux" = "aarch64-unknown-linux-musl";
          }.${system} or null;

        archSuffix =
          {
            "x86_64-linux" = "x86_64";
            "aarch64-linux" = "aarch64";
            "x86_64-darwin" = "x86_64-apple-darwin";
            "aarch64-darwin" = "aarch64-apple-darwin";
          }.${system} or null;

        # Rust host target triple (used by binding derivations)
        hostTarget =
          {
            "x86_64-linux" = "x86_64-unknown-linux-gnu";
            "aarch64-linux" = "aarch64-unknown-linux-gnu";
            "x86_64-darwin" = "x86_64-apple-darwin";
            "aarch64-darwin" = "aarch64-apple-darwin";
          }.${system};

        cargoTargetEnvName =
          {
            "x86_64-linux" = "CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER";
            "aarch64-linux" = "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER";
          }.${system} or null;

        overlays = [ (import rust-overlay) ];

        # Derive version from Cargo.toml so there is a single source of truth
        version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).workspace.package.version;

        lib = pkgs.lib;
        stdenv = pkgs.stdenv;
        isDarwin = stdenv.isDarwin;
        libsDarwin = lib.optionals isDarwin [
          # Additional drwin specific inputs can be set here
          # Note: Security and SystemConfiguration frameworks are provided by the default SDK
        ];

        # Dependencies
        pkgs = import nixpkgs {
          inherit system overlays;
        };

        pkgsUnstable = import nixpkgs-unstable {
          inherit system;
        };

        # Dart SDK from dart-overlay
        dartpkgs = dart-overlay.packages.${system};

        # Static/musl packages for fully static binary builds (Linux only)
        pkgsMusl =
          if muslTarget != null then
            import nixpkgs
              {
                localSystem = system;
                crossSystem = {
                  config = muslTarget;
                  isStatic = true;
                };
              }
          else
            null;

        # Toolchains
        # latest stable
        stable_toolchain = pkgs.rust-bin.stable."1.96.0".default.override {
          targets = [
            "wasm32-unknown-unknown"
            "aarch64-apple-ios"
            "x86_64-apple-ios"
            "aarch64-apple-ios-sim"
            "aarch64-apple-darwin"
            "x86_64-apple-darwin"
          ];
          extensions = [
            "rustfmt"
            "clippy"
            "rust-analyzer"
            "llvm-tools-preview"
          ];
        };

        # MSRV stable
        msrv_toolchain = pkgs.rust-bin.stable."1.85.0".default.override {
          targets = [ "wasm32-unknown-unknown" ]; # wasm
          extensions = [
            "rustfmt"
            "clippy"
            "rust-analyzer"
            "llvm-tools-preview"
          ];
        };

        # Nightly used for formatting
        nightly_toolchain = pkgs.rust-bin.selectLatestNightlyWith (
          toolchain:
          toolchain.default.override {
            extensions = [
              "rustfmt"
              "clippy"
              "rust-analyzer"
              "rust-src"
              "llvm-tools-preview"
            ];
            targets = [ "wasm32-unknown-unknown" ]; # wasm
          }
        );

        # Stable toolchain with musl target for static builds (Linux only)
        static_toolchain =
          if muslTarget != null then
            pkgs.rust-bin.stable."1.96.0".default.override
              {
                targets = [ muslTarget ];
              }
          else
            null;

        # Shim for native_toolchain_rust (Dart package) which requires rustup.
        # Nix provides Rust directly, so this fakes the rustup commands.
        rustupShim = pkgs.writeShellScriptBin "rustup" ''
          case "''${1:-}" in
            show)
              version=$(rustc --version | sed 's/rustc //')
              echo "''${version} (nix)"
              ;;
            run)
              shift  # drop "run"
              shift  # drop channel
              exec "$@"
              ;;
            target)
              # no-op: Nix provides targets via stable_toolchain
              ;;
            *)
              echo "rustup shim: unsupported command '$*'" >&2
              exit 1
              ;;
          esac
        '';

        # ========================================
        # Crane setup for cached builds
        # ========================================
        craneLib = (crane.mkLib pkgs).overrideToolchain stable_toolchain;
        craneLibMsrv = (crane.mkLib pkgs).overrideToolchain msrv_toolchain;
        craneLibStatic =
          if static_toolchain != null then (crane.mkLib pkgs).overrideToolchain static_toolchain else null;
        craneLibNightly = (crane.mkLib pkgs).overrideToolchain nightly_toolchain;

        # Source for crane builds - uses lib.fileset for efficient filtering
        # This is much faster than nix-gitignore when large directories (like target/) exist
        # because it uses a whitelist approach rather than scanning everything first
        src = lib.fileset.toSource {
          root = ./.;
          fileset = lib.fileset.intersection (lib.fileset.fromSource (lib.sources.cleanSource ./.)) (
            lib.fileset.unions [
              ./Cargo.toml
              ./Cargo.lock
              ./Cargo.lock.msrv
              ./.typos.toml
              ./rustfmt.toml
              ./README.md
              ./.cargo
              ./crates
              ./fuzz
              ./bindings
            ]
          );
        };

        # Source for MSRV builds - uses Cargo.lock.msrv with MSRV-compatible deps
        # Use lib.fileset approach (same as src) but substitute Cargo.lock with Cargo.lock.msrv
        # We include both lock files and use cargoLock override to point to MSRV version
        srcMsrv = lib.fileset.toSource {
          root = ./.;
          fileset = lib.fileset.intersection (lib.fileset.fromSource (lib.sources.cleanSource ./.)) (
            lib.fileset.unions [
              ./Cargo.toml
              ./Cargo.lock.msrv
              ./.typos.toml
              ./rustfmt.toml
              ./README.md
              ./.cargo
              ./crates
              ./fuzz
              ./bindings
            ]
          );
        };

        # Vendor cargo dependencies
        cargoVendorDir = craneLib.vendorMultipleCargoDeps {
          inherit (craneLib.findCargoFiles src) cargoConfigs;
          cargoLockList = [
            ./Cargo.lock
          ];
        };

        # Vendor cargo dependencies for MSRV builds (Cargo.lock.msrv has different versions)
        cargoVendorDirMsrv = craneLib.vendorMultipleCargoDeps {
          inherit (craneLib.findCargoFiles srcMsrv) cargoConfigs;
          cargoLockList = [
            ./Cargo.lock.msrv
          ];
        };

        # Common args for all Crane builds
        commonCraneArgs = {
          inherit src version cargoVendorDir;
          pname = "cdk";

          nativeBuildInputs = with pkgs; [
            pkg-config
            protobuf
          ];

          buildInputs =
            with pkgs;
            [
              openssl
              sqlite
              zlib
            ]
            ++ libsDarwin;

          # Environment variables
          PROTOC = "${pkgs.protobuf}/bin/protoc";
          PROTOC_INCLUDE = "${pkgs.protobuf}/include";
        };

        # Common args for MSRV builds - uses srcMsrv with pinned deps
        # Override cargoLock and cargoVendorDir to use Cargo.lock.msrv instead of Cargo.lock
        commonCraneArgsMsrv = commonCraneArgs // {
          src = srcMsrv;
          cargoLock = ./Cargo.lock.msrv;
          cargoVendorDir = cargoVendorDirMsrv;
        };

        # Musl-targeting C compiler for crates that compile bundled C code
        # (libsqlite3-sys, secp256k1-sys, aws-lc-sys, etc.)
        muslCC = if muslTarget != null then pkgs.pkgsStatic.stdenv.cc else null;

        # Common args for static musl builds (Linux only)
        # Produces fully statically-linked binaries that run on any Linux system
        commonCraneArgsStatic =
          if muslTarget != null then
            (
              {
                inherit src version cargoVendorDir;
                pname = "cdk-static";

                # Cross-compile to musl for fully static linking
                CARGO_BUILD_TARGET = muslTarget;
                CARGO_BUILD_RUSTFLAGS = "-C target-feature=+crt-static";

                # Host-side build tools (run on build machine)
                nativeBuildInputs = with pkgs; [
                  pkg-config
                  protobuf
                  muslCC
                ];

                # Target-side libraries (musl static libs linked into the binary)
                buildInputs = with pkgsMusl; [
                  openssl.dev
                  zlib
                ];

                # Tell the cc crate and cargo to use the musl-targeting C compiler/linker
                TARGET_CC = "${muslCC}/bin/${muslCC.targetPrefix}cc";

                # Force static OpenSSL linking (needed by postgres/native-tls)
                OPENSSL_STATIC = "1";
                OPENSSL_DIR = "${pkgsMusl.openssl.dev}";
                OPENSSL_LIB_DIR = "${pkgsMusl.openssl.out}/lib";
                OPENSSL_INCLUDE_DIR = "${pkgsMusl.openssl.dev}/include";

                # Protobuf (build-time code generation, runs on host)
                PROTOC = "${pkgs.protobuf}/bin/protoc";
                PROTOC_INCLUDE = "${pkgs.protobuf}/include";

                # Tell pkg-config to find musl static libraries
                PKG_CONFIG_ALL_STATIC = "1";

                # Use the release-static profile for reproducible, optimized builds
                CARGO_PROFILE = "release-static";
              }
              // {
                # Dynamic attribute name for the cargo linker env var (arch-specific)
                ${cargoTargetEnvName} = "${muslCC}/bin/${muslCC.targetPrefix}cc";
              }
            )
          else
            null;

        # Build ALL dependencies once - this is what gets cached by Cachix
        workspaceDeps = craneLib.buildDepsOnly (
          commonCraneArgs
          // {
            pname = "cdk-deps";
            # Build deps for workspace
            cargoExtraArgs = "--workspace";
          }
        );

        # MSRV dependencies (separate cache due to different toolchain)
        # Exclude cdk-redb (and its dependents) since redb requires a higher MSRV
        workspaceDepsMsrv = craneLibMsrv.buildDepsOnly (
          commonCraneArgsMsrv
          // {
            pname = "cdk-deps-msrv";
            cargoExtraArgs = "--workspace --exclude cdk-redb --exclude cdk-integration-tests --exclude cdk-ffi-dart --exclude cdk-ffi-swift --exclude cdk-ffi-kotlin --exclude cdk-bindings-releaser";
          }
        );

        # Static musl dependencies (separate cache for static builds, Linux only)
        workspaceDepsStatic =
          if muslTarget != null then
            craneLibStatic.buildDepsOnly
              (
                commonCraneArgsStatic
                // {
                  pname = "cdk-deps-static";
                  # Cache only the static release binaries' dependency set. FFI
                  # binding crates build cdylibs, which musl targets do not support.
                  cargoExtraArgs = "-p cdk-mintd -p cdk-cli --features cdk-mintd/ldk-node,cdk-mintd/postgres,cdk-mintd/prometheus,cdk-mintd/redis";
                }
              )
          else
            null;

        # Nightly dependencies (separate cache due to different toolchain)
        workspaceDepsNightly = craneLibNightly.buildDepsOnly (
          commonCraneArgs
          // {
            pname = "cdk-deps-nightly";
            cargoExtraArgs = "--workspace";
          }
        );

        # Helper function to create combined clippy + test checks
        # Runs both in a single derivation to share build artifacts.
        # Now accepts a list of cargoArgs to run multiple checks sequentially.
        mkClippyAndTest =
          name: cargoArgsList:
          craneLib.mkCargoDerivation (
            commonCraneArgs
            // {
              pname = "cdk-check-${name}";
              cargoArtifacts = workspaceDeps;
              buildPhaseCargoCommand = builtins.concatStringsSep "\n" (
                builtins.map
                  (cargoArgs: ''
                    echo "Running check with args: ${cargoArgs}"
                    cargo clippy ${cargoArgs} -- -D warnings
                    cargo test ${if builtins.match ".*cdk-cli.*" cargoArgs != null then "--bins" else "--lib"} ${cargoArgs}
                  '')
                  cargoArgsList
              );
              doCheck = false;
              installPhaseCommand = "mkdir -p $out";
            }
          );

        # Helper function to create example checks (compile only, no network access in sandbox)
        mkExample =
          name:
          craneLib.mkCargoDerivation (
            commonCraneArgs
            // {
              pname = "cdk-example-${name}";
              cargoArtifacts = workspaceDeps;
              buildPhaseCargoCommand = "cargo build --example ${name}";
              # Examples are compiled but not run (no network in Nix sandbox)
              doCheck = false;
              installPhaseCommand = "mkdir -p $out";
            }
          );

        # Helper function to create example packages (outputs binary for running outside sandbox)
        mkExamplePackage =
          name:
          craneLib.mkCargoDerivation (
            commonCraneArgs
            // {
              pname = "cdk-example-${name}";
              cargoArtifacts = workspaceDeps;
              buildPhaseCargoCommand = "cargo build --release --example ${name}";
              doCheck = false;
              installPhaseCommand = ''
                mkdir -p $out/bin
                cp target/release/examples/${name} $out/bin/
              '';
            }
          );

        # Helper function to create MSRV build checks
        mkMsrvBuild =
          name: cargoArgs:
          craneLibMsrv.cargoBuild (
            commonCraneArgsMsrv
            // {
              pname = "cdk-msrv-${name}";
              cargoArtifacts = workspaceDepsMsrv;
              cargoExtraArgs = cargoArgs;
            }
          );

        # Helper function to create WASM build checks
        # WASM builds don't need native libs like openssl
        mkWasmBuild =
          name: cargoArgs:
          craneLib.cargoBuild ({
            inherit src version cargoVendorDir;
            pname = "cdk-wasm-${name}";
            cargoArtifacts = workspaceDeps;
            cargoExtraArgs = "${cargoArgs} --target wasm32-unknown-unknown";
            # WASM doesn't need native build inputs
            nativeBuildInputs = with pkgs; [ pkg-config ];
            buildInputs = [ ];
            # Disable tests for WASM (can't run in sandbox)
            doCheck = false;
          });

        # Doc tests check
        docTests = craneLib.cargoTest (
          commonCraneArgs
          // {
            pname = "cdk-doc-tests";
            cargoArtifacts = workspaceDeps;
            cargoTestExtraArgs = "--doc";
          }
        );

        # Strict docs check - build docs with warnings as errors
        # Uses mkCargoDerivation for custom RUSTDOCFLAGS
        strictDocs = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-strict-docs";
            cargoArtifacts = workspaceDeps;
            buildPhaseCargoCommand = ''
              export RUSTDOCFLAGS="-D warnings"
              cargo doc --no-deps \
                -p cashu \
                -p cdk-common \
                -p cdk-sql-common \
                -p cdk \
                -p cdk-redb \
                -p cdk-sqlite \
                -p cdk-axum \
                -p cdk-cln \
                -p cdk-lnd \
                -p cdk-lnbits \
                -p cdk-fake-wallet \
                -p cdk-mint-rpc \
                -p cdk-payment-processor \
                -p cdk-signatory \
                -p cdk-cli \
                -p cdk-mintd
            '';
            doCheck = false;
            installPhaseCommand = "mkdir -p $out";
          }
        );

        # FFI Python tests
        ffiTests = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-ffi-tests";
            cargoArtifacts = workspaceDeps;
            nativeBuildInputs = commonCraneArgs.nativeBuildInputs ++ [
              pkgs.python311
            ];
            buildPhaseCargoCommand = ''
              # Build the FFI library
              cargo build --release --package cdk-ffi

              # Generate Python bindings
              cargo run -p cdk-ffi --bin uniffi-bindgen generate \
                --library target/release/libcdk_ffi.so \
                --language python \
                --out-dir target/bindings/python

              # Copy library to bindings directory
              cp target/release/libcdk_ffi.so target/bindings/python/

              # Run Python tests
              python3 crates/cdk-ffi/tests/test_transactions.py
              python3 crates/cdk-ffi/tests/test_kvstore.py
            '';
            doCheck = false;
            installPhaseCommand = "mkdir -p $out";
          }
        );

        # ========================================
        # Language binding derivations (cached by Cachix)
        # ========================================

        # Dart FFI bindings: builds cdk-ffi-dart cdylib + generates Dart source
        dartBindings = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-dart-bindings";
            cargoArtifacts = workspaceDeps;
            buildPhaseCargoCommand = ''
              # Build the Dart FFI cdylib
              cargo build --release -p cdk-ffi-dart

              LIB_EXT="${if isDarwin then "dylib" else "so"}"

              # Find the cdk-ffi-dart shared library in deps (contains UniFFI metadata)
              CDK_FFI_LIB="target/release/deps/libcdk_ffi_dart.$LIB_EXT"

              if [ ! -f "$CDK_FFI_LIB" ]; then
                echo "ERROR: Could not find $CDK_FFI_LIB"
                ls -la target/release/deps/libcdk_ffi* || true
                exit 1
              fi

              echo "Using library: $CDK_FFI_LIB"

              # Generate Dart bindings via the custom uniffi-bindgen binary
              # Must run from bindings/dart/rust/ so it finds uniffi.toml
              (cd bindings/dart/rust && \
                cargo run --release -p cdk-ffi-dart --bin uniffi-bindgen -- \
                  "../../../$CDK_FFI_LIB" --out-dir ../../../target/dart-bindings)
            '';
            doCheck = false;
            installPhaseCommand = ''
              LIB_EXT="${if isDarwin then "dylib" else "so"}"
              mkdir -p $out/lib/src/generated
              cp target/dart-bindings/*.dart $out/lib/src/generated/
              cp target/release/libcdk_ffi_dart.$LIB_EXT $out/lib/src/generated/
            '';
          }
        );

        # Kotlin JVM bindings: builds cdk-ffi-kotlin cdylib + generates Kotlin sources
        kotlinBindings = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-kotlin-bindings";
            cargoArtifacts = workspaceDeps;
            buildPhaseCargoCommand = ''
              LIB_EXT="${if isDarwin then "dylib" else "so"}"

              # Build for host target
              cargo build --release -p cdk-ffi-kotlin --target "${hostTarget}"

              # Generate Kotlin bindings
              cargo run --release -p cdk-ffi-kotlin --bin uniffi-bindgen -- generate \
                --library "target/${hostTarget}/release/libcdk_ffi.$LIB_EXT" \
                --language kotlin \
                --out-dir target/kotlin-bindings \
                --no-format
            '';
            doCheck = false;
            installPhaseCommand = ''
              LIB_EXT="${if isDarwin then "dylib" else "so"}"

              mkdir -p $out/cdk-jvm/src/main/kotlin
              mkdir -p $out/cdk-jvm/src/main/resources

              # Copy generated Kotlin sources
              cp -r target/kotlin-bindings/org $out/cdk-jvm/src/main/kotlin/

              # Copy native library
              cp "target/${hostTarget}/release/libcdk_ffi.$LIB_EXT" \
                "$out/cdk-jvm/src/main/resources/libcdk_ffi.$LIB_EXT"

              # Strip debug symbols
              strip -x "$out/cdk-jvm/src/main/resources/libcdk_ffi.$LIB_EXT" 2>/dev/null || true
            '';
          }
        );

        uniffiBindgenGoSrc = pkgs.fetchFromGitHub {
          owner = "NordSecurity";
          repo = "uniffi-bindgen-go";
          rev = "v0.6.0+v0.30.0";
          hash = "sha256-HxcVUJb8DwbOcAP4LeBQPeKYrqR5jvvYJfcY7/gygkk=";
        };

        uniffiBindgenGoPackageSrc = pkgs.runCommand "uniffi-bindgen-go-src" { } ''
          mkdir -p $out
          cp -r ${uniffiBindgenGoSrc}/bindgen/* $out/
          chmod -R u+w $out
          cp ${./nix/uniffi-bindgen-go.Cargo.lock} $out/Cargo.lock
          substituteInPlace $out/Cargo.toml \
            --replace-fail 'uniffi_bindgen.workspace = true' 'uniffi_bindgen = "0.30.0"' \
            --replace-fail 'uniffi_meta.workspace = true' 'uniffi_meta = "0.30.0"' \
            --replace-fail 'uniffi_udl.workspace = true' 'uniffi_udl = "0.30.0"'
        '';

        uniffiBindgenGo = pkgs.rustPlatform.buildRustPackage {
          pname = "uniffi-bindgen-go";
          version = "0.6.0+v0.30.0";

          src = uniffiBindgenGoPackageSrc;
          cargoLock.lockFile = ./nix/uniffi-bindgen-go.Cargo.lock;
          doCheck = false;
        };

        # Go FFI bindings: builds cdk-ffi-go cdylib + generates Go sources
        goBindings = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-go-bindings";
            cargoArtifacts = workspaceDeps;
            nativeBuildInputs = commonCraneArgs.nativeBuildInputs ++ [
              pkgs.go
              uniffiBindgenGo
            ];
            buildPhaseCargoCommand = ''
              cargo build --release -p cdk-ffi-go

              LIB_EXT="${if isDarwin then "dylib" else "so"}"
              CDK_FFI_LIB="target/release/libcdk_ffi_go.$LIB_EXT"
              export GOCACHE="$TMPDIR/go-cache"
              mkdir -p "$GOCACHE"

              if [ ! -f "$CDK_FFI_LIB" ]; then
                echo "ERROR: Could not find $CDK_FFI_LIB"
                ls -la target/release/libcdk_ffi_go.* || true
                exit 1
              fi

              uniffi-bindgen-go \
                "$CDK_FFI_LIB" \
                --library \
                --config bindings/go/uniffi.toml \
                --out-dir target/go-bindings
            '';
            doCheck = false;
            installPhaseCommand = ''
              LIB_EXT="${if isDarwin then "dylib" else "so"}"

              mkdir -p $out/bindings $out/lib
              cp -r target/go-bindings/* $out/bindings/
              cp "target/release/libcdk_ffi_go.$LIB_EXT" $out/lib/
            '';
          }
        );

        # ========================================
        # Example definitions - single source of truth
        # ========================================
        exampleChecks = [
          "mint-token"
          "melt-token"
          "p2pk"
          "proof-selection"
          "wallet"
        ];

        # ========================================
        # Clippy + test check definitions - single source of truth
        # These run both clippy and unit tests in a single derivation
        # ========================================
        clippyAndTestChecks = {
          "core-lib" = [
            "-p cashu"
            "-p cashu --no-default-features"
            "-p cashu --no-default-features --features wallet"
            "-p cashu --no-default-features --features mint"
            "-p cdk-common"
            "-p cdk-common --no-default-features"
            "-p cdk-common --no-default-features --features wallet"
            "-p cdk-common --no-default-features --features mint"
            "-p cdk"
            "-p cdk --no-default-features"
            "-p cdk --no-default-features --features wallet"
            "-p cdk --no-default-features --features mint"
          ];

          "storage-and-cli" = [
            "-p cdk-sql-common"
            "-p cdk-sql-common --no-default-features --features wallet"
            "-p cdk-sql-common --no-default-features --features mint"
            "-p cdk-redb"
            "-p cdk-sqlite"
            "-p cdk-sqlite --features sqlcipher"
            "-p cdk-cli"
            "-p cdk-cli --features sqlcipher"
            "-p cdk-cli --features redb"
          ];

          "lightning-and-api" = [
            "-p cdk-axum"
            "-p cdk-axum --no-default-features"
            "-p cdk-axum --no-default-features --features redis"
            "-p cdk-cln"
            "-p cdk-lnd"
            "-p cdk-lnbits"
            "-p cdk-fake-wallet"
            "-p cdk-payment-processor"
            "-p cdk-ldk-node"
            "-p cdk-npubcash"
          ];

          "mintd-main" = [
            "-p cdk-mintd"
            "-p cdk-mintd --features redis"
            "-p cdk-mintd --features sqlcipher"
            "-p cdk-signatory"
            "-p cdk-mint-rpc"
            "-p cdk-prometheus"
            "-p cdk-ffi"
          ];

          "mintd-backends-sqlite" = [
            "-p cdk-mintd --no-default-features --features lnd,sqlite"
            "-p cdk-mintd --no-default-features --features lnbits,sqlite"
            "-p cdk-mintd --no-default-features --features fakewallet,sqlite"
            "-p cdk-mintd --no-default-features --features grpc-processor,sqlite"
            "-p cdk-mintd --no-default-features --features management-rpc,lnd,sqlite"
            "-p cdk-mintd --no-default-features --features cln,sqlite"
          ];

          "mintd-backends-postgres" = [
            "-p cdk-mintd --no-default-features --features cln,postgres"
            "-p cdk-mintd --no-default-features --features lnd,postgres"
            "-p cdk-mintd --no-default-features --features lnbits,postgres"
            "-p cdk-mintd --no-default-features --features fakewallet,postgres"
            "-p cdk-mintd --no-default-features --features grpc-processor,postgres"
            "-p cdk-mintd --no-default-features --features management-rpc,cln,postgres"
          ];
        };

        # ========================================
        # MSRV build check definitions
        # ========================================
        msrvChecks = {
          # Core library with all features
          "cdk-all-features" = "-p cdk --features \"mint,wallet\"";

          # Mintd with all backends, databases, and features
          "cdk-mintd-all" =
            "-p cdk-mintd --no-default-features --features \"cln,lnd,lnbits,fakewallet,ldk-node,grpc-processor,sqlite,postgres,redis,management-rpc\"";

          # CLI - default features (excludes redb which breaks MSRV)
          "cdk-cli" = "-p cdk-cli";

          # Minimal builds to ensure no-default-features works
          "cdk-wallet-only" = "-p cdk --no-default-features --features wallet";
        };

        # ========================================
        # WASM build check definitions
        # ========================================
        wasmChecks = {
          "cdk" = "-p cdk";
          "cdk-no-default" = "-p cdk --no-default-features";
          "cdk-wallet" = "-p cdk --no-default-features --features wallet";
        };

        # Common inputs
        envVars = {
          # rust analyzer needs  NIX_PATH for some reason.
          NIX_PATH = "nixpkgs=${inputs.nixpkgs}";
        };

        baseBuildInputs =
          with pkgs;
          [
            # Add additional build inputs here
            git
            pkg-config
            curl
            just
            protobuf
            nixpkgs-fmt
            typos

            cargo-outdated
            cargo-mutants
            cargo-fuzz
            cargo-nextest

            # Database
            postgresql_16
            startPostgres
            stopPostgres
            pgStatus
            pgConnect

            # Needed for github ci
            libz
          ]
          ++ libsDarwin;

        regtestBuildInputs =
          (with pkgsUnstable; [
            lnd
            # Apple Clang treats certain warnings as errors via -Werror, breaking
            # the clightning build on macOS. These are fixed upstream in commit
            # c22538ec (milestone v26.04) but not yet released. The override is
            # Darwin-only so Linux builds still use the binary cache unmodified.
            # TODO: Remove this override once clightning >= 26.04 lands in nixpkgs.
            (
              if pkgs.stdenv.hostPlatform.isDarwin then
                (clightning.overrideAttrs (old: {
                  env = (old.env or { }) // {
                    NIX_CFLAGS_COMPILE =
                      (old.env.NIX_CFLAGS_COMPILE or "")
                      + " -Wno-error=uninitialized-const-pointer"
                      + " -Wno-error=gnu-folding-constant"
                      + " -Wno-error=default-const-init-var-unsafe"
                      + " -Wno-error=sometimes-uninitialized";
                  };
                }))
              else
                clightning
            )
            bitcoind
          ])
          ++ (with pkgs; [
            mprocs
          ]);

        commonShellHook = ''
          # Needed for github ci
          export LD_LIBRARY_PATH=${pkgs.lib.makeLibraryPath [ pkgs.zlib ]}:$LD_LIBRARY_PATH
        '';

        pgShellHook = ''
          # PostgreSQL environment variables
          export CDK_MINTD_DATABASE_URL="postgresql://${postgresConf.pgUser}:${postgresConf.pgPassword}@localhost:${postgresConf.pgPort}/${postgresConf.pgDatabase}"

          # Informational banner goes to stderr so it never corrupts the stdout of
          # commands run via `nix develop --command ... > file` (e.g. CI schema dumps).
          echo "" >&2
          echo "PostgreSQL commands available:" >&2
          echo "  start-postgres  - Initialize and start PostgreSQL" >&2
          echo "  stop-postgres   - Stop PostgreSQL (run before exiting)" >&2
          echo "  pg-status       - Check PostgreSQL status" >&2
          echo "  pg-connect      - Connect to PostgreSQL with psql" >&2
          echo "" >&2
        '';

        # PostgreSQL configuration
        postgresConf = {
          pgUser = "cdk_user";
          pgPassword = "cdk_password";
          pgDatabase = "cdk_mint";
          pgPort = "5432";
        };

        # Script to start PostgreSQL
        startPostgres = pkgs.writeShellScriptBin "start-postgres" ''
          set -e
          PGDATA="$PWD/.pg_data"
          PGPORT="${postgresConf.pgPort}"
          PGUSER="${postgresConf.pgUser}"
          PGPASSWORD="${postgresConf.pgPassword}"
          PGDATABASE="${postgresConf.pgDatabase}"

          # Stop any existing instance first
          if [ -d "$PGDATA" ] && ${pkgs.postgresql_16}/bin/pg_ctl -D "$PGDATA" status > /dev/null 2>&1; then
            echo "Stopping existing PostgreSQL instance..."
            ${pkgs.postgresql_16}/bin/pg_ctl -D "$PGDATA" stop > /dev/null 2>&1
          fi

          if [ ! -d "$PGDATA" ]; then
            echo "Initializing PostgreSQL database..."
            ${pkgs.postgresql_16}/bin/initdb -D "$PGDATA" --auth=trust --no-locale --encoding=UTF8

            # Configure PostgreSQL
            echo "listen_addresses = 'localhost'" >> "$PGDATA/postgresql.conf"
            echo "port = $PGPORT" >> "$PGDATA/postgresql.conf"
            echo "unix_socket_directories = '$PGDATA'" >> "$PGDATA/postgresql.conf"

            # Start temporarily to create user and database
            ${pkgs.postgresql_16}/bin/pg_ctl -D "$PGDATA" -l "$PGDATA/logfile" start
            sleep 2

            # Create user and database
            ${pkgs.postgresql_16}/bin/createuser -h localhost -p $PGPORT -s "$PGUSER" || true
            ${pkgs.postgresql_16}/bin/psql -h localhost -p $PGPORT -c "ALTER USER $PGUSER WITH PASSWORD '$PGPASSWORD';" postgres
            ${pkgs.postgresql_16}/bin/createdb -h localhost -p $PGPORT -O "$PGUSER" "$PGDATABASE" || true

            ${pkgs.postgresql_16}/bin/pg_ctl -D "$PGDATA" stop
            echo "PostgreSQL initialized."
          fi

          echo "Starting PostgreSQL on port $PGPORT..."
          ${pkgs.postgresql_16}/bin/pg_ctl -D "$PGDATA" -l "$PGDATA/logfile" start
          echo "PostgreSQL started. Connection URL: postgresql://$PGUSER:$PGPASSWORD@localhost:$PGPORT/$PGDATABASE"
        '';

        # Script to stop PostgreSQL
        stopPostgres = pkgs.writeShellScriptBin "stop-postgres" ''
          PGDATA="$PWD/.pg_data"
          if [ -d "$PGDATA" ]; then
            echo "Stopping PostgreSQL..."
            ${pkgs.postgresql_16}/bin/pg_ctl -D "$PGDATA" stop || echo "PostgreSQL was not running."
          else
            echo "No PostgreSQL data directory found."
          fi
        '';

        # Script to check PostgreSQL status
        pgStatus = pkgs.writeShellScriptBin "pg-status" ''
          PGDATA="$PWD/.pg_data"
          if [ -d "$PGDATA" ]; then
            ${pkgs.postgresql_16}/bin/pg_ctl -D "$PGDATA" status
          else
            echo "No PostgreSQL data directory found. Run 'start-postgres' first."
          fi
        '';

        # Script to connect to PostgreSQL
        pgConnect = pkgs.writeShellScriptBin "pg-connect" ''
          ${pkgs.postgresql_16}/bin/psql "postgresql://${postgresConf.pgUser}:${postgresConf.pgPassword}@localhost:${postgresConf.pgPort}/${postgresConf.pgDatabase}"
        '';

        # Helper to build a statically-linked binary package (Linux only)
        # bin: the cargo binary name (e.g. "cdk-mintd")
        # name: the output binary name prefix (e.g. "cdk-mintd-ldk")
        # cargoExtraArgs: additional cargo args (e.g. "--bin cdk-mintd --features ldk-node")
        staticVersion = if commonCraneArgsStatic != null then commonCraneArgsStatic.version else version;
        mkStaticPackage =
          if muslTarget != null then
            (
              { bin
              , name
              , cargoExtraArgs
              ,
              }:
              craneLibStatic.buildPackage (
                commonCraneArgsStatic
                // {
                  pname = name;
                  cargoArtifacts = workspaceDepsStatic;
                  inherit cargoExtraArgs;
                  nativeBuildInputs = commonCraneArgsStatic.nativeBuildInputs ++ [
                    pkgs.removeReferencesTo
                  ];
                  installPhaseCommand = ''
                    mkdir -p $out/bin
                    cp target/${muslTarget}/release-static/${bin} $out/bin/${name}-${staticVersion}-${archSuffix}
                  '';
                  # Strip Nix store references from binaries for reproducibility
                  postFixup = ''
                    find "$out" -type f -executable -exec remove-references-to -t ${static_toolchain} '{}' +
                  '';
                }
              )
            )
          else
            null;

        # Helper to build a macOS release binary package
        # Uses the same release-static Cargo profile for consistent optimization settings
        # Non-system libraries (openssl, sqlite, zlib, libiconv) are statically linked
        # to avoid embedding Nix store dylib paths in the distributed binary.
        # A postFixup safety net rewrites any remaining Nix store refs to system paths.
        # bin: the cargo binary name (e.g. "cdk-mintd")
        # name: the output binary name prefix (e.g. "cdk-mintd-ldk")
        # cargoExtraArgs: additional cargo args (e.g. "--bin cdk-mintd --features ldk-node")
        mkDarwinPackage =
          { bin
          , name
          , cargoExtraArgs
          ,
          }:
          craneLib.buildPackage (
            commonCraneArgs
            // {
              pname = name;
              cargoArtifacts = workspaceDeps;
              inherit cargoExtraArgs;
              CARGO_PROFILE = "release-static";

              # Static-link non-system libraries so the binary doesn't reference
              # Nix store paths for openssl, sqlite, zlib, libiconv, etc.
              OPENSSL_STATIC = "1";
              PKG_CONFIG_ALL_STATIC = "1";

              installPhaseCommand = ''
                mkdir -p $out/bin
                cp target/release-static/${bin} $out/bin/${name}-${version}-${archSuffix}
              '';

              # Safety net: rewrite any remaining Nix store dylib references to
              # their macOS system equivalents so the binary is fully portable.
              # We unconditionally rewrite to /usr/lib/ without checking file existence
              # because macOS 11+ stores system dylibs in a shared cache (dyld resolves
              # them at runtime even though the individual .dylib files may not be on disk).
              postFixup = ''
                for f in $out/bin/*; do
                  otool -L "$f" | tail -n +2 | grep '/nix/store' | awk '{print $1}' | while read -r lib; do
                    base=$(basename "$lib")
                    echo "Rewriting Nix store dylib ref: $lib -> /usr/lib/$base"
                    install_name_tool -change "$lib" "/usr/lib/$base" "$f"
                  done

                  otool -l "$f" | awk '
                    $1 == "cmd" && $2 == "LC_RPATH" { in_rpath = 1; next }
                    in_rpath && $1 == "path" {
                      print $2
                      in_rpath = 0
                    }
                  ' | grep '^/nix/store' | while read -r rpath; do
                    echo "Removing Nix store rpath: $rpath"
                    install_name_tool -delete_rpath "$rpath" "$f"
                  done

                  # Fail the build if any runtime Mach-O references still point into the Nix store.
                  # This prevents silently shipping binaries that depend on Nix-specific loader paths.
                  remaining_libs=$(otool -L "$f" | tail -n +2 | grep '/nix/store' || true)
                  remaining_rpaths=$(otool -l "$f" | awk '
                    $1 == "cmd" && $2 == "LC_RPATH" { in_rpath = 1; next }
                    in_rpath && $1 == "path" {
                      print $2
                      in_rpath = 0
                    }
                  ' | grep '^/nix/store' || true)

                  if [ -n "$remaining_libs$remaining_rpaths" ]; then
                    echo "ERROR: Binary still references Nix store paths after fixup:"
                    if [ -n "$remaining_libs" ]; then
                      echo "$remaining_libs"
                    fi
                    if [ -n "$remaining_rpaths" ]; then
                      echo "$remaining_rpaths"
                    fi
                    echo "The binary would fail on systems without Nix installed."
                    exit 1
                  fi
                done
              '';
            }
          );

        # ========================================
        # Integration test harness binaries (pre-built via Crane, cached by Cachix)
        # These are used by CI integration test scripts instead of cargo build/run
        # ========================================
        mkItestBinary =
          name: cargoExtraArgs:
          craneLib.buildPackage (
            commonCraneArgs
            // {
              pname = "cdk-itest-${name}";
              cargoArtifacts = workspaceDeps;
              inherit cargoExtraArgs;
              # Only install the specific binary, not the entire workspace
              doCheck = false;
            }
          );

        itestBinaries = {
          start-fake-mint = mkItestBinary "start-fake-mint" "--bin start_fake_mint";
          start-regtest-mints = mkItestBinary "start-regtest-mints" "--bin start_regtest_mints";
          start-fake-auth-mint = mkItestBinary "start-fake-auth-mint" "--bin start_fake_auth_mint";
          start-regtest = mkItestBinary "start-regtest" "--bin start_regtest";
          signatory = mkItestBinary "signatory" "--bin signatory";
          cdk-payment-processor = mkItestBinary "cdk-payment-processor" "--bin cdk-payment-processor";
          cdk-mintd-grpc = mkItestBinary "cdk-mintd-grpc" "--bin cdk-mintd --no-default-features --features grpc-processor";
        };

        # Nextest archive for integration tests (pre-compiled test binaries)
        itestArchive = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-itest-archive";
            cargoArtifacts = workspaceDeps;
            nativeBuildInputs = commonCraneArgs.nativeBuildInputs ++ [
              pkgs.cargo-nextest
            ];
            buildPhaseCargoCommand = ''
              mkdir -p $out
              cargo nextest archive \
                -p cdk-integration-tests \
                --archive-file $out/itest-archive.tar.zst
            '';
            doCheck = false;
            installPhaseCommand = "";
          }
        );

        # Common arguments can be set here to avoid repeating them later
        nativeBuildInputs = [
          #Add additional build inputs here
        ]
        ++ lib.optionals isDarwin [
          # Additional darwin specific native inputs can be set here
        ];
      in
      {
        # Expose deps for explicit cache warming
        packages = {
          deps = workspaceDeps;
          deps-msrv = workspaceDepsMsrv;
          # Language bindings (cached cdylib + uniffi codegen)
          dart-bindings = dartBindings;
          kotlin-bindings = kotlinBindings;
          go-bindings = goBindings;
        }
        # Static build deps (Linux only)
        // lib.optionalAttrs (muslTarget != null) {
          deps-static = workspaceDepsStatic;
        }
        # Static binary packages (fully statically-linked, Linux only)
        // lib.optionalAttrs (muslTarget != null) {
          cdk-mintd-static = mkStaticPackage {
            bin = "cdk-mintd";
            name = "cdk-mintd";
            cargoExtraArgs = "--bin cdk-mintd --features postgres,prometheus,redis";
          };

          cdk-mintd-ldk-static = mkStaticPackage {
            bin = "cdk-mintd";
            name = "cdk-mintd-ldk";
            cargoExtraArgs = "--bin cdk-mintd --features ldk-node,postgres,prometheus,redis";
          };

          cdk-cli-static = mkStaticPackage {
            bin = "cdk-cli";
            name = "cdk-cli";
            cargoExtraArgs = "--bin cdk-cli";
          };
        }
        # macOS release binary packages (dynamically linked, Apple Silicon only)
        // lib.optionalAttrs isDarwin {
          cdk-mintd-darwin = mkDarwinPackage {
            bin = "cdk-mintd";
            name = "cdk-mintd";
            cargoExtraArgs = "--bin cdk-mintd --features postgres,prometheus,redis";
          };

          cdk-mintd-ldk-darwin = mkDarwinPackage {
            bin = "cdk-mintd";
            name = "cdk-mintd-ldk";
            cargoExtraArgs = "--bin cdk-mintd --features ldk-node,postgres,prometheus,redis";
          };

          cdk-cli-darwin = mkDarwinPackage {
            bin = "cdk-cli";
            name = "cdk-cli";
            cargoExtraArgs = "--bin cdk-cli";
          };
        }
        # Integration test harness binaries (pre-built for CI)
        // itestBinaries
        // {
          itest-archive = itestArchive;
        }
        # Example packages (binaries that can be run outside sandbox with network access)
        // (builtins.listToAttrs (
          map
            (name: {
              name = "example-${name}";
              value = mkExamplePackage name;
            })
            exampleChecks
        ));
        checks =
          # Generate clippy + test checks from clippyAndTestChecks attrset
          (builtins.mapAttrs (name: args: mkClippyAndTest name args) clippyAndTestChecks)
          # Generate MSRV build checks (prefixed with msrv-)
          // (builtins.listToAttrs (
            map
              (name: {
                name = "msrv-${name}";
                value = mkMsrvBuild name msrvChecks.${name};
              })
              (builtins.attrNames msrvChecks)
          ))
          // (builtins.listToAttrs (
            map
              (name: {
                name = "msrv-${name}";
                value = mkMsrvBuild name msrvChecks.${name};
              })
              (builtins.attrNames msrvChecks)
          ))
          # Generate WASM build checks (prefixed with wasm-)
          // (builtins.listToAttrs (
            map
              (name: {
                name = "wasm-${name}";
                value = mkWasmBuild name wasmChecks.${name};
              })
              (builtins.attrNames wasmChecks)
          ))
          // (builtins.listToAttrs (
            map
              (name: {
                name = "wasm-${name}";
                value = mkWasmBuild name wasmChecks.${name};
              })
              (builtins.attrNames wasmChecks)
          ))
          // (builtins.listToAttrs (
            map
              (name: {
                name = "example-${name}";
                value = mkExample name;
              })
              exampleChecks
          ))
          // (builtins.listToAttrs (
            map
              (name: {
                name = "example-${name}";
                value = mkExample name;
              })
              exampleChecks
          ))
          // {
            # Doc tests
            doc-tests = docTests;

            # Strict docs check
            strict-docs = strictDocs;

            # FFI Python tests
            ffi-tests = ffiTests;
          };

        devShells =
          let
            # devShells
            msrv = pkgs.mkShell (
              {
                shellHook = "
                  cargo update
                  cargo update home --precise 0.5.11
                  cargo update typed-index-collections --precise 3.3.0
                  cargo update simple_asn1 --precise 0.6.3
                  cargo update cookie_store --precise 0.22.0
                  cargo update serde_with --precise 3.17.0
                  cargo update time --precise 0.3.44
                  cargo update unicode-segmentation --precise 1.12.0
                  cargo update idna_adapter --precise 1.2.1
                  cargo update icu_normalizer --precise 2.0.1
                  cargo update icu_provider --precise 2.1.1
                  cargo update icu_locale_core --precise 2.1.1
                  cargo update tonic-prost@0.14.6 --precise 0.14.5
                  cargo update tonic-prost-build@0.14.6 --precise 0.14.5
                  cargo update tonic-build@0.14.6 --precise 0.14.5
                  cargo update tonic@0.14.6 --precise 0.14.5
               ";
                buildInputs = baseBuildInputs ++ [ msrv_toolchain ];
                inherit nativeBuildInputs;
              }
              // envVars
            );

            stable = pkgs.mkShell (
              {
                shellHook = commonShellHook + pgShellHook;
                buildInputs = baseBuildInputs ++ [
                  stable_toolchain
                ];
                inherit nativeBuildInputs;

              }
              // envVars
            );

            regtest = pkgs.mkShell (
              {
                shellHook = commonShellHook + pgShellHook;
                buildInputs =
                  baseBuildInputs
                  ++ regtestBuildInputs
                  ++ [
                    stable_toolchain
                  ]
                  ++ builtins.attrValues itestBinaries;
                inherit nativeBuildInputs;
              }
              // envVars
            );

            nightly = pkgs.mkShell (
              {
                shellHook = commonShellHook + pgShellHook;
                buildInputs = baseBuildInputs ++ [
                  nightly_toolchain
                ];
                inherit nativeBuildInputs;
              }
              // envVars
            );

            nightly-regtest = pkgs.mkShell (
              {
                shellHook = commonShellHook + pgShellHook;
                buildInputs =
                  baseBuildInputs
                  ++ regtestBuildInputs
                  ++ [
                    nightly_toolchain
                  ];
                inherit nativeBuildInputs;
              }
              // envVars
            );

            # Shell with Docker for integration tests
            integration = pkgs.mkShell (
              {
                shellHook = ''
                  # Ensure Docker is available
                  if ! command -v docker &> /dev/null; then
                    echo "Docker is not installed or not in PATH"
                    echo "Please install Docker to run integration tests"
                    exit 1
                  fi
                  echo "Docker is available at $(which docker)"
                  echo "Docker version: $(docker --version)"
                ''
                + commonShellHook
                + pgShellHook;
                buildInputs =
                  baseBuildInputs
                  ++ regtestBuildInputs
                  ++ [
                    stable_toolchain
                    pkgs.docker-client
                    pkgs.python311
                    pkgsUnstable.cargo-llvm-cov
                  ]
                  ++ builtins.attrValues itestBinaries;
                inherit nativeBuildInputs;
              }
              // envVars
            );

            # Shell for FFI development (Python bindings)
            ffi = pkgs.mkShell (
              {
                shellHook =
                  commonShellHook
                  + pgShellHook
                  + ''
                    echo "FFI development shell"
                    echo "  just ffi-test        - Run Python FFI tests"
                    echo "  just ffi-dev-python  - Launch Python REPL with CDK FFI"
                  '';
                buildInputs = baseBuildInputs ++ [
                  stable_toolchain
                  pkgs.python311
                ];
                inherit nativeBuildInputs;
              }
              // envVars
            );

            # Shell for bindings development (Dart + Swift + Kotlin + Go FFI)
            bindings = pkgs.mkShell (
              {
                shellHook = commonShellHook;
                buildInputs = baseBuildInputs ++ [
                  stable_toolchain
                  rustupShim
                  dartpkgs.default
                  pkgs.openssl
                  pkgs.jdk17
                  pkgs.go
                ];
                nativeBuildInputs = [
                  pkgs.pkg-config
                ];
                OPENSSL_DIR = "${pkgs.openssl.dev}";
                OPENSSL_LIB_DIR = "${pkgs.openssl.out}/lib";
                OPENSSL_INCLUDE_DIR = "${pkgs.openssl.dev}/include";
              }
              // envVars
            );

            # Shell for building Kotlin native libraries (Rust + Android NDK)
            kotlin-build =
              let
                pkgsAndroid = import nixpkgs {
                  inherit system;
                  config = {
                    android_sdk.accept_license = true;
                    allowUnfree = true;
                  };
                };
                androidComposition = pkgsAndroid.androidenv.composeAndroidPackages {
                  platformVersions = [ "34" ];
                  buildToolsVersions = [ "34.0.0" ];
                  includeNDK = true;
                  ndkVersions = [ "27.0.12077973" ];
                  includeEmulator = false;
                  includeSystemImages = false;
                };
                androidSdk = androidComposition.androidsdk;
                ndkHome = "${androidSdk}/libexec/android-sdk/ndk/27.0.12077973";
                toolchainBin = "${ndkHome}/toolchains/llvm/prebuilt/linux-x86_64/bin";
                buildToolchain = pkgs.rust-bin.stable."1.96.0".default.override {
                  targets = [
                    "aarch64-linux-android"
                    "armv7-linux-androideabi"
                    "x86_64-linux-android"
                    "aarch64-apple-ios"
                    "aarch64-apple-darwin"
                  ];
                };
              in
              pkgs.mkShell {
                buildInputs = [
                  buildToolchain
                ];
                ANDROID_HOME = "${androidSdk}/libexec/android-sdk";
                ANDROID_NDK_HOME = ndkHome;
                CARGO_TARGET_AARCH64_LINUX_ANDROID_LINKER = "${toolchainBin}/aarch64-linux-android24-clang";
                CARGO_TARGET_ARMV7_LINUX_ANDROIDEABI_LINKER = "${toolchainBin}/armv7a-linux-androideabi24-clang";
                CARGO_TARGET_X86_64_LINUX_ANDROID_LINKER = "${toolchainBin}/x86_64-linux-android24-clang";
                CC_aarch64_linux_android = "${toolchainBin}/aarch64-linux-android24-clang";
                CC_armv7_linux_androideabi = "${toolchainBin}/armv7a-linux-androideabi24-clang";
                CC_x86_64_linux_android = "${toolchainBin}/x86_64-linux-android24-clang";
                AR_aarch64_linux_android = "${toolchainBin}/llvm-ar";
                AR_armv7_linux_androideabi = "${toolchainBin}/llvm-ar";
                AR_x86_64_linux_android = "${toolchainBin}/llvm-ar";
              };

            # Shell for Kotlin publishing (JDK 17 + Android SDK for Gradle)
            kotlin-publish =
              let
                pkgsAndroid = import nixpkgs {
                  inherit system;
                  config = {
                    android_sdk.accept_license = true;
                    allowUnfree = true;
                  };
                };
                androidComposition = pkgsAndroid.androidenv.composeAndroidPackages {
                  platformVersions = [ "34" ];
                  buildToolsVersions = [ "34.0.0" ];
                  includeNDK = false;
                  includeEmulator = false;
                  includeSystemImages = false;
                };
              in
              pkgs.mkShell {
                buildInputs = [
                  pkgs.jdk17
                  androidComposition.androidsdk
                ];
                ANDROID_HOME = "${androidComposition.androidsdk}/libexec/android-sdk";
                JAVA_HOME = "${pkgs.jdk17}";
              };

          in
          {
            inherit
              msrv
              stable
              regtest
              nightly
              nightly-regtest
              integration
              ffi
              bindings
              kotlin-build
              kotlin-publish
              ;
            default = stable;
          };
      }
    );
}