{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    flake-utils.url = "github:numtide/flake-utils";
    rust-overlay = {
      url = "github:oxalica/rust-overlay";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { self, nixpkgs, flake-utils, rust-overlay }:
    let
      # NixOS module (system-independent)
      nixosModule = import ./nix/module.nix self;
    in
    flake-utils.lib.eachDefaultSystem (system:
      let
        overlays = [ (import rust-overlay) ];
        pkgs = import nixpkgs { inherit system overlays; };

        rustToolchain = pkgs.rust-bin.stable.latest.default.override {
          extensions = [
            "rust-src"
            "rust-analyzer"
            "clippy"
            "rustfmt"
          ];
        };

        # Dashboard build
        dashboard = pkgs.buildNpmPackage {
          pname = "vault-os-dashboard";
          version = "0.1.0";
          src = ./dashboard;
          npmDepsHash = ""; # placeholder — run nix build once to get the hash
          npmBuildScript = "build";
          installPhase = ''
            mkdir -p $out
            cp -r dist/* $out/
          '';
        };

        # Rust binary build
        vault-os = pkgs.rustPlatform.buildRustPackage {
          pname = "vault-os";
          version = "0.1.0";
          src = pkgs.lib.cleanSourceWith {
            src = ./.;
            filter = path: type:
              let
                relPath = pkgs.lib.removePrefix (toString ./. + "/") (toString path);
              in
              # Include Rust source, Cargo files, but not dashboard/node_modules
              !(pkgs.lib.hasPrefix "dashboard/node_modules" relPath)
              && !(pkgs.lib.hasPrefix "target" relPath)
              && !(pkgs.lib.hasPrefix ".direnv" relPath);
          };
          cargoLock.lockFile = ./Cargo.lock;

          nativeBuildInputs = [ pkgs.pkg-config ];
          buildInputs = [
            pkgs.openssl
          ] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin (
            let sdk = pkgs.apple-sdk_15; in
            [ sdk ]
          );

          # Embed the dashboard dist into the binary's asset directory
          # preBuild = ''
          #   mkdir -p dashboard/dist
          #   cp -r ${dashboard}/* dashboard/dist/
          # '';
        };
      in
      {
        packages = {
          inherit vault-os dashboard;
          default = vault-os;
        };

        devShells.default = pkgs.mkShell {
          buildInputs = [
            rustToolchain
            pkgs.pkg-config
            pkgs.openssl
            pkgs.nodejs_22
            pkgs.nodePackages.npm
            pkgs.cargo-watch
          ] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin (
            let sdk = pkgs.apple-sdk_15; in
            [ sdk ]
          );

          env = {
            RUST_BACKTRACE = "1";
          };
        };
      }) // {
        nixosModules.default = nixosModule;
        nixosModules.vault-os = nixosModule;
      };
}