{
  description = "Maestro — unified terminal-session orchestrator: reproducible dev shell";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    rust-overlay.url = "github:oxalica/rust-overlay";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs =
    {
      self,
      nixpkgs,
      rust-overlay,
      flake-utils,
    }:
    flake-utils.lib.eachDefaultSystem (
      system:
      let
        pkgs = import nixpkgs {
          inherit system;
          overlays = [ rust-overlay.overlays.default ];
        };

        # Honor the repo's own pin (`rust-toolchain.toml` → stable + rustfmt +
        # clippy) so a contributor builds the project as declared, independent of
        # whatever toolchain happens to be installed via rustup.
        rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
      in
      {
        devShells.default = pkgs.mkShell {
          packages = [
            rustToolchain
            pkgs.rust-analyzer

            # Fast linker the project's cargo config expects (clang driver +
            # `-fuse-ld=mold`). Shipped here so the shell is self-contained and
            # does not depend on a personal ~/.cargo/config.toml.
            pkgs.clang
            pkgs.mold

            # Web frontend (web/ pins pnpm@9.15.4 via package.json#packageManager).
            pkgs.nodejs_22
            pkgs.pnpm_9

            # Integration tests drive real tmux + git (see CLAUDE.md).
            pkgs.tmux
            pkgs.git

            # Task runner for the Justfile (just web / web-dev / test / fmt).
            pkgs.just
          ];

          # Make linking self-contained and hermetic. Cargo picks the FIRST
          # matching rustflags source (env > target.<triple> > target.<cfg> >
          # build.rustflags) — it does NOT merge them. Setting the per-target
          # rustflags here therefore *replaces* any `[build] rustflags` coming
          # from a global ~/.cargo/config.toml — in particular the nightly-only
          # `-Z threads=8` that would otherwise break this stable toolchain —
          # while keeping the fast mold link.
          CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER = "clang";
          CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS = "-C link-arg=-fuse-ld=mold";

          shellHook = ''
            # Use the pnpm pinned in web/package.json (corepack) if present;
            # otherwise fall back to the nixpkgs pnpm_9 on PATH.
            export RUST_BACKTRACE=1
            echo "maestro dev shell"
            echo "  rust  $(rustc --version 2>/dev/null | cut -d' ' -f2)"
            echo "  node  $(node --version 2>/dev/null)"
            echo "  pnpm  $(pnpm --version 2>/dev/null)"
            echo "  tmux  $(tmux -V 2>/dev/null | cut -d' ' -f2)"
            echo "Run the web stack:  just web-dev   (Vite → /api proxied to a local registry/daemon)"
          '';
        };
      }
    );
}