{
  description = "Asepharyana Tools — document scanner & media processing tools (Rust gateway/workers + Next.js frontend)";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, flake-utils }:
    flake-utils.lib.eachSystem [ "x86_64-linux" ] (system:
      let
        pkgs = import nixpkgs {
          inherit system;
          config.allowUnfree = true;
        };

        # ── mkApp generator ──
        mkApp = { name, src, buildScript, installScript, nativeBuildInputs ? [], buildInputs ? [] }:
          pkgs.stdenv.mkDerivation {
            inherit name src;

            nativeBuildInputs = with pkgs; [
              cacert curl gcc gnumake openssl pkg-config python3 libclang
            ] ++ nativeBuildInputs;

            buildInputs = with pkgs; [
              nodejs openssl stdenv.cc.cc.lib libffi
            ] ++ buildInputs;

            LIBCLANG_PATH = "${pkgs.libclang.lib}/lib";
            LD_LIBRARY_PATH = "${pkgs.libclang.lib}/lib:${pkgs.stdenv.cc.cc.lib}/lib:${pkgs.libffi}/lib";
            NIX_ENFORCE_PURITY = "0";

            SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
            NODE_EXTRA_CA_CERTS = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
            NODE_ENV = "production";

            phases = [ "unpackPhase" "buildPhase" "installPhase" ];
            buildPhase = ''
              export HOME="$TMPDIR" CARGO_HOME="$TMPDIR/.cargo-${name}"
              SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
            '' + buildScript;
            installPhase = installScript;
          };

        cargoDeps = with pkgs; [ rustc cargo clang cmake pkg-config openssl.dev zlib ];

        tools-gateway = mkApp {
          name = "tools-gateway-0.1.0";
          src = ./.;
          nativeBuildInputs = cargoDeps ++ [ pkgs.tesseract ];

          buildScript = ''
            cd backend
            echo "=== Building tools-gateway ==="
            cargo build --release --features tesseract --bin tools-gateway 2>&1
          '';

          installScript = ''
            mkdir -p $out/bin
            cp target/release/tools-gateway $out/bin/tools-gateway
          '';
        };

        tools-workers = mkApp {
          name = "tools-workers-0.1.0";
          src = ./.;
          nativeBuildInputs = cargoDeps ++ [ pkgs.tesseract pkgs.leptonica ];

          buildScript = ''
            cd backend
            echo "=== Building tools-workers ==="
            cargo build --release --features tesseract --bin tools-workers 2>&1
          '';

          installScript = ''
            mkdir -p $out/bin
            cp target/release/tools-workers $out/bin/tools-workers
          '';
        };

        tools-frontend = mkApp {
          name = "tools-frontend-0.1.0";
          src = ./.;
          nativeBuildInputs = with pkgs; [ bun ];

          buildScript = ''
            cd frontend
            echo "=== Installing dependencies ==="
            bun install 2>&1
            echo "=== Building Next.js ==="
            bun run build 2>&1
          '';

          installScript = ''
            mkdir -p $out/share/tools-frontend $out/bin
            cp -r .next $out/share/tools-frontend/
            cp -r public $out/share/tools-frontend/ 2>/dev/null || true
            cp package.json $out/share/tools-frontend/
            cp -r node_modules $out/share/tools-frontend/
            cat > $out/bin/tools-frontend << WRAPPER
#!${pkgs.runtimeShell}
exec ${pkgs.bun}/bin/bun run --cwd $out/share/tools-frontend start
WRAPPER
            chmod +x $out/bin/tools-frontend
          '';
        };
      in
      {
        packages = {
          inherit tools-gateway tools-workers tools-frontend;
          default = tools-gateway;
        };

        devShells.default = pkgs.mkShell {
          buildInputs = with pkgs; [ nodejs-slim_22 bun rustc cargo tesseract leptonica ];
        };
      });
}