{
  description = "fin-tracker — personal finance + investment analytics";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

  outputs = { self, nixpkgs }:
    let
      system = "x86_64-linux";
      pkgs = import nixpkgs { inherit system; };
      python = pkgs.python312;

      # manylinux wheels pulled by uv (grpcio for T-Invest, asyncpg, polars, …)
      # dlopen these at runtime. nix-ld is enabled system-wide; we only extend
      # its search path (never overwrite — keeps direnv diffs sane).
      runtimeLibs = pkgs.lib.makeLibraryPath [
        pkgs.stdenv.cc.cc.lib # libstdc++.so.6
        pkgs.zlib
        pkgs.openssl
      ];

      backendTools = [
        python
        pkgs.uv
        pkgs.just
        pkgs.postgresql_17 # local dev cluster (`just db-start`) and psql
        pkgs.openapi-generator-cli # `just gen-client`
        pkgs.jq # `just app-web-assets` reads package_config.json / pub deps
        pkgs.curl # `just app-web-assets` fetches sqlite3.wasm from GitHub releases
      ];

      commonHook = ''
        export UV_PYTHON="${python}/bin/python3"
        export UV_PYTHON_DOWNLOADS=never
        export NIX_LD_LIBRARY_PATH="${runtimeLibs}''${NIX_LD_LIBRARY_PATH:+:$NIX_LD_LIBRARY_PATH}"
        export LD_LIBRARY_PATH="${runtimeLibs}''${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
        # T-Invest gRPC must not go through a local SOCKS/HTTP proxy
        export no_proxy="invest-public-api.tbank.ru,.tbank.ru,invest-public-api.tinkoff.ru,.tinkoff.ru,localhost,127.0.0.1''${no_proxy:+,$no_proxy}"
        export NO_PROXY="$no_proxy"
        export PGDATA="$PWD/.pgdata"
        export PGHOST="$PWD/.pgdata"
        export PGPORT=54329
      '';
    in {
      devShells.${system} = {
        # backend only — fast to enter
        default = pkgs.mkShell {
          packages = backendTools;
          shellHook = commonHook + ''
            echo "fin-tracker: 'just --list' for recipes; 'nix develop .#app' adds Flutter"
          '';
        };
        # backend + Flutter toolchain (large download on first use)
        app = pkgs.mkShell {
          packages = backendTools ++ [
            pkgs.flutter
            # Linux desktop build: flutter_secure_storage_linux links libsecret via pkg-config
            pkgs.pkg-config
            pkgs.libsecret
          ];
          shellHook = commonHook;
        };
      };
    };
}