{
  description = "gtg — Gleam CLI client for Tangled (git forge on atproto)";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
  };

  outputs =
    { self, nixpkgs }:
    let
      systems = [
        "x86_64-linux"
        "aarch64-linux"
        "x86_64-darwin"
        "aarch64-darwin"
      ];
      forAllSystems = nixpkgs.lib.genAttrs systems;
    in
    {
      # nix develop
      devShells = forAllSystems (
        system:
        let
          pkgs = nixpkgs.legacyPackages.${system};
        in
        {
          default = pkgs.mkShell {
            name = "gtg";

            packages = [
              pkgs.gleam
              pkgs.beamPackages.erlang
              pkgs.rebar3
              pkgs.beamPackages.hex
              pkgs.git
            ];

            shellHook = ''
              echo "gtg dev shell"
              echo "  gleam $(gleam --version 2>/dev/null || echo '?')"
              echo "  erl   OTP $(erl -eval 'io:format("~s", [erlang:system_info(otp_release)]), halt().' -noshell 2>/dev/null || echo '?')"
              echo ""
              echo "  gleam run -- --help"
              echo "  gleam run -- auth login <handle>"
              echo "  gleam test"
            '';
          };
        }
      );

      # nix run . -- --help
      # Copies sources to a writable temp dir (store paths are read-only; gleam
      # needs to write build/ and download hex packages).
      apps = forAllSystems (
        system:
        let
          pkgs = nixpkgs.legacyPackages.${system};
          gtg = pkgs.writeShellApplication {
            name = "gtg";
            runtimeInputs = [
              pkgs.gleam
              pkgs.beamPackages.erlang
              pkgs.rebar3
              pkgs.beamPackages.hex
              pkgs.rsync
              pkgs.coreutils
            ];
            text = ''
              root="${self}"
              if [[ ! -f "$root/gleam.toml" ]]; then
                echo "gtg: flake source not found at $root" >&2
                exit 1
              fi
              work=$(mktemp -d)
              trap 'rm -rf "$work"' EXIT
              # Nix store files are mode 444; gleam must write build/ here.
              rsync -a --chmod=u+w --exclude build --exclude result \
                --exclude .direnv --exclude .git \
                "$root"/ "$work"/
              chmod -R u+w "$work"
              cd "$work"
              exec gleam run --no-print-progress -- "$@"
            '';
          };
        in
        {
          default = {
            type = "app";
            program = "${gtg}/bin/gtg";
          };
        }
      );

      formatter = forAllSystems (system: nixpkgs.legacyPackages.${system}.nixfmt-rfc-style);
    };
}