flake.nix

{
  description = "CDK Flake";

  nixConfig = {
    fallback = true;
    extra-substituters = [
      "https://cache.cashudevkit.org"
      "https://cashudevkit.cachix.org"
    ];
    extra-trusted-public-keys = [
      "cashudevkit:Ukc9ltM4674fDHWWay+q4vdHDYKF48QIm6A+0z5/FqQ="
      "cashudevkit.cachix.org-1:zFKdvMiTllKWxIFNTjXgisZsOFufmaZXjWJNcmc8r+4="
    ];
  };

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";

    rust-overlay = {
      url = "github:oxalica/rust-overlay";
      inputs = {
        nixpkgs.follows = "nixpkgs";
      };
    };

    flake-utils.url = "github:numtide/flake-utils";

    dart-overlay = {
      url = "github:roman-vanesyan/dart-overlay";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    crane = {
      url = "github:ipetkov/crane";
    };
  };

  outputs =
    { self
    , nixpkgs
    , nixpkgs-unstable
    , rust-overlay
    , flake-utils
    , dart-overlay
    , crane
    , ...
    }@inputs:
    flake-utils.lib.eachDefaultSystem (
      system:
      let
        # Architecture-specific configuration for static musl builds
        muslTarget =
          {
            "x86_64-linux" = "x86_64-unknown-linux-musl";
            "aarch64-linux" = "aarch64-unknown-linux-musl";
          }.${system} or null;

        archSuffix =
          {
            "x86_64-linux" = "x86_64";
            "aarch64-linux" = "aarch64";
            "x86_64-darwin" = "x86_64-apple-darwin";
            "aarch64-darwin" = "aarch64-apple-darwin";
          }.${system} or null;

        # Rust host target triple (used by binding derivations)
        hostTarget =
          {
            "x86_64-linux" = "x86_64-unknown-linux-gnu";
            "aarch64-linux" = "aarch64-unknown-linux-gnu";
            "x86_64-darwin" = "x86_64-apple-darwin";
            "aarch64-darwin" = "aarch64-apple-darwin";
          }.${system};

        cargoTargetEnvName =
          {
            "x86_64-linux" = "CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER";
            "aarch64-linux" = "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER";
          }.${system} or null;

        overlays = [ (import rust-overlay) ];

        # Derive version from Cargo.toml so there is a single source of truth
        version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).workspace.package.version;

        lib = pkgs.lib;
        stdenv = pkgs.stdenv;
        isDarwin = stdenv.isDarwin;
        libsDarwin = lib.optionals isDarwin [
          # Additional drwin specific inputs can be set here
          # Note: Security and SystemConfiguration frameworks are provided by the default SDK
        ];

        # Dependencies
        pkgs = import nixpkgs {
          inherit system overlays;
        };

        pkgsUnstable = import nixpkgs-unstable {
          inherit system;
        };

        # Dart SDK from dart-overlay
        dartpkgs = dart-overlay.packages.${system};

        # Static/musl packages for fully static binary builds (Linux only)
        pkgsMusl =
          if muslTarget != null then
            import nixpkgs
              {
                localSystem = system;
                crossSystem = {
                  config = muslTarget;
                  isStatic = true;
                };
              }
          else
            null;

        # Toolchains
        # latest stable
        stable_toolchain = pkgs.rust-bin.stable."1.99.0".default.override {
          targets = [
            "wasm32-unknown-unknown"
            "aarch64-apple-ios"
            "x86_64-apple-ios"
            "aarch64-apple-ios-sim"
            "aarch64-apple-darwin"
            "x86_64-apple-darwin"
          ];
          extensions = [
            "rustfmt"
            "clippy"
            "rust-analyzer"
            "llvm-tools-preview"
          ];
        };

        # MSRV stable
        msrv_toolchain = pkgs.rust-bin.stable."1.85.0".default.override {
          targets = [ "wasm32-unknown-unknown" ]; # wasm
          extensions = [
            "rustfmt"
            "clippy"
            "rust-analyzer"
            "llvm-tools-preview"
          ];
        };

        # Nightly used for formatting
        nightly_toolchain = pkgs.rust-bin.selectLatestNightlyWith (
          toolchain:
          toolchain.default.override {
            extensions = [
              "rustfmt"
              "clippy"
              "rust-analyzer"
              "rust-src"
              "llvm-tools-preview"
            ];
            targets = [ "wasm32-unknown-unknown" ]; # wasm
          }
        );

        # Stable toolchain with musl target for static builds (Linux only)
        static_toolchain =
          if muslTarget != null then
            pkgs.rust-bin.stable."1.99.0".default.override
              {
                targets = [ muslTarget ];
              }
          else
            null;

        # Shim for native_toolchain_rust (Dart package) which requires rustup.
        # Nix provides Rust directly, so this fakes the rustup commands.
        rustupShim = pkgs.writeShellScriptBin "rustup" ''
          case "''${1:-}" in
            show)
              version=$(rustc --version | sed 's/rustc //')
              echo "''${version} (nix)"
              ;;
            run)
              shift  # drop "run"
              shift  # drop channel
              exec "$@"
              ;;
            target)
              # no-op: Nix provides targets via stable_toolchain
              ;;
            *)
              echo "rustup shim: unsupported command '$*'" >&2
              exit 1
              ;;
          esac
        '';

        # ========================================
        # Crane setup for cached builds
        # ========================================
        craneLib = (crane.mkLib pkgs).overrideToolchain stable_toolchain;
        craneLibMsrv = (crane.mkLib pkgs).overrideToolchain msrv_toolchain;
        craneLibStatic =
          if static_toolchain != null then (crane.mkLib pkgs).overrideToolchain static_toolchain else null;
        craneLibNightly = (crane.mkLib pkgs).overrideToolchain nightly_toolchain;

        # Include only checked-in fuzzing inputs. Using ./fuzz directly would also
        # copy generated directories such as fuzz/target, corpus, and artifacts.
        fuzzSrc = lib.fileset.unions [
          ./fuzz/Cargo.toml
          ./fuzz/Cargo.lock
          ./fuzz/fuzz_targets
          ./fuzz/seeds
          ./fuzz/src
        ];

        # Source for crane builds - uses lib.fileset for efficient filtering
        # This is much faster than nix-gitignore when large directories (like target/) exist
        # because it uses a whitelist approach rather than scanning everything first
        srcFileset = lib.fileset.intersection (lib.fileset.fromSource (lib.sources.cleanSource ./.)) (
          lib.fileset.unions [
            ./Cargo.toml
            ./Cargo.lock
            ./Cargo.lock.msrv
            ./clippy.toml
            ./.typos.toml
            ./rustfmt.toml
            ./README.md
            ./.cargo
            ./crates
            fuzzSrc
            ./bindings
          ]
        );

        src = lib.fileset.toSource {
          root = ./.;
          fileset = srcFileset;
        };

        # The integration-test harness binaries do not compile the test targets.
        # Keep changes confined to those tests from invalidating their cache keys.
        itestHarnessSrc = lib.fileset.toSource {
          root = ./.;
          fileset = lib.fileset.difference srcFileset ./crates/cdk-integration-tests/tests;
        };

        # Source for MSRV builds - uses Cargo.lock.msrv with MSRV-compatible deps
        # Use lib.fileset approach (same as src) but substitute Cargo.lock with Cargo.lock.msrv
        # We include both lock files and use cargoLock override to point to MSRV version
        srcMsrv = lib.fileset.toSource {
          root = ./.;
          fileset = lib.fileset.intersection (lib.fileset.fromSource (lib.sources.cleanSource ./.)) (
            lib.fileset.unions [
              ./Cargo.toml
              ./Cargo.lock.msrv
              ./clippy.toml
              ./.typos.toml
              ./rustfmt.toml
              ./README.md
              ./.cargo
              ./crates
              fuzzSrc
              ./bindings
            ]
          );
        };

        # Vendor cargo dependencies
        cargoVendorDir = craneLib.vendorMultipleCargoDeps {
          inherit (craneLib.findCargoFiles src) cargoConfigs;
          cargoLockList = [
            ./Cargo.lock
          ];
        };

        # Vendor cargo dependencies for MSRV builds (Cargo.lock.msrv has different versions)
        cargoVendorDirMsrv = craneLib.vendorMultipleCargoDeps {
          inherit (craneLib.findCargoFiles srcMsrv) cargoConfigs;
          cargoLockList = [
            ./Cargo.lock.msrv
          ];
        };

        # Common args for all Crane builds
        commonCraneArgs = {
          inherit src version cargoVendorDir;
          pname = "cdk";

          nativeBuildInputs = with pkgs; [
            pkg-config
            protobuf
          ];

          buildInputs =
            with pkgs;
            [
              openssl
              sqlite
              zlib
            ]
            ++ libsDarwin;

          # Environment variables
          PROTOC = "${pkgs.protobuf}/bin/protoc";
          PROTOC_INCLUDE = "${pkgs.protobuf}/include";
          # reqwest's rustls platform verifier loads the native CA store while
          # building a client. Nix build sandboxes do not provide /etc/ssl.
          SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
        };

        # Common args for MSRV builds - uses srcMsrv with pinned deps
        # Override cargoLock and cargoVendorDir to use Cargo.lock.msrv instead of Cargo.lock
        commonCraneArgsMsrv = commonCraneArgs // {
          src = srcMsrv;
          cargoLock = ./Cargo.lock.msrv;
          cargoVendorDir = cargoVendorDirMsrv;
        };

        # Musl-targeting C compiler for crates that compile bundled C code
        # (libsqlite3-sys, secp256k1-sys, aws-lc-sys, etc.)
        muslCC = if muslTarget != null then pkgs.pkgsStatic.stdenv.cc else null;

        # Common args for static musl builds (Linux only)
        # Produces fully statically-linked binaries that run on any Linux system
        commonCraneArgsStatic =
          if muslTarget != null then
            (
              {
                inherit src version cargoVendorDir;
                pname = "cdk-static";

                # Cross-compile to musl for fully static linking
                CARGO_BUILD_TARGET = muslTarget;
                CARGO_BUILD_RUSTFLAGS = "-C target-feature=+crt-static";

                # Host-side build tools (run on build machine)
                nativeBuildInputs = with pkgs; [
                  pkg-config
                  protobuf
                  muslCC
                ];

                # Target-side libraries (musl static libs linked into the binary)
                buildInputs = with pkgsMusl; [
                  openssl.dev
                  zlib
                ];

                # Tell the cc crate and cargo to use the musl-targeting C compiler/linker
                TARGET_CC = "${muslCC}/bin/${muslCC.targetPrefix}cc";

                # Force static OpenSSL linking (needed by postgres/native-tls)
                OPENSSL_STATIC = "1";
                OPENSSL_DIR = "${pkgsMusl.openssl.dev}";
                OPENSSL_LIB_DIR = "${pkgsMusl.openssl.out}/lib";
                OPENSSL_INCLUDE_DIR = "${pkgsMusl.openssl.dev}/include";

                # Protobuf (build-time code generation, runs on host)
                PROTOC = "${pkgs.protobuf}/bin/protoc";
                PROTOC_INCLUDE = "${pkgs.protobuf}/include";

                # Tell pkg-config to find musl static libraries
                PKG_CONFIG_ALL_STATIC = "1";

                # Use the release-static profile for reproducible, optimized builds
                CARGO_PROFILE = "release-static";
              }
              // {
                # Dynamic attribute name for the cargo linker env var (arch-specific)
                ${cargoTargetEnvName} = "${muslCC}/bin/${muslCC.targetPrefix}cc";
              }
            )
          else
            null;

        # Build ALL dependencies once - this is what gets cached by Cachix
        workspaceDeps = craneLib.buildDepsOnly (
          commonCraneArgs
          // {
            pname = "cdk-deps";
            # Build deps for workspace
            cargoExtraArgs = "--workspace";
          }
        );

        # MSRV dependencies (separate cache due to different toolchain)
        # Exclude cdk-redb (and its dependents) and cdk-cli from MSRV coverage
        workspaceDepsMsrv = craneLibMsrv.buildDepsOnly (
          commonCraneArgsMsrv
          // {
            pname = "cdk-deps-msrv";
            cargoExtraArgs = "--workspace --exclude cdk-redb --exclude cdk-integration-tests --exclude cdk-ffi-dart --exclude cdk-ffi-swift --exclude cdk-ffi-kotlin --exclude cdk-cli";
          }
        );

        # Static musl dependencies (separate cache for static builds, Linux only)
        workspaceDepsStatic =
          if muslTarget != null then
            craneLibStatic.buildDepsOnly
              (
                commonCraneArgsStatic
                // {
                  pname = "cdk-deps-static";
                  # Cache only the static release binaries' dependency set. FFI
                  # binding crates build cdylibs, which musl targets do not support.
                  cargoExtraArgs = "-p cdk-mintd -p cdk-cli --features cdk-mintd/ldk-node,cdk-mintd/postgres,cdk-mintd/prometheus,cdk-mintd/redis";
                }
              )
          else
            null;

        # Nightly dependencies (separate cache due to different toolchain)
        workspaceDepsNightly = craneLibNightly.buildDepsOnly (
          commonCraneArgs
          // {
            pname = "cdk-deps-nightly";
            cargoExtraArgs = "--workspace";
          }
        );

        # Helper function to create combined clippy + test checks
        # Runs both in a single derivation to share build artifacts.
        # Now accepts a list of cargoArgs to run multiple checks sequentially.
        mkClippyAndTest =
          name: cargoArgsList:
          craneLib.mkCargoDerivation (
            commonCraneArgs
            // {
              pname = "cdk-check-${name}";
              cargoArtifacts = workspaceDeps;
              buildPhaseCargoCommand = builtins.concatStringsSep "\n" (
                builtins.map
                  (cargoArgs: ''
                    echo "Running check with args: ${cargoArgs}"
                    cargo clippy ${cargoArgs} -- -D warnings
                    cargo test ${if builtins.match ".*cdk-cli.*" cargoArgs != null then "--bins" else "--lib"} ${cargoArgs}
                  '')
                  cargoArgsList
              );
              doCheck = false;
              installPhaseCommand = "mkdir -p $out";
              # These outputs are success markers; no later derivation consumes
              # their target directories.
              doInstallCargoArtifacts = false;
            }
          );

        # Helper function to create example checks (compile only, no network access in sandbox)
        mkExample =
          name:
          craneLib.mkCargoDerivation (
            commonCraneArgs
            // {
              pname = "cdk-example-${name}";
              cargoArtifacts = workspaceDeps;
              buildPhaseCargoCommand = "cargo build --example ${name}";
              # Examples are compiled but not run (no network in Nix sandbox)
              doCheck = false;
              installPhaseCommand = "mkdir -p $out";
            }
          );

        # Helper function to create example packages (outputs binary for running outside sandbox)
        mkExamplePackage =
          name:
          craneLib.mkCargoDerivation (
            commonCraneArgs
            // {
              pname = "cdk-example-${name}";
              cargoArtifacts = workspaceDeps;
              buildPhaseCargoCommand = "cargo build --release --example ${name}";
              doCheck = false;
              installPhaseCommand = ''
                mkdir -p $out/bin
                cp target/release/examples/${name} $out/bin/
              '';
            }
          );

        # Helper function to create MSRV build checks
        mkMsrvBuild =
          name: cargoArgs:
          craneLibMsrv.cargoBuild (
            commonCraneArgsMsrv
            // {
              pname = "cdk-msrv-${name}";
              cargoArtifacts = workspaceDepsMsrv;
              cargoExtraArgs = cargoArgs;
            }
          );

        # Helper function to create WASM build checks
        # WASM builds don't need native libs like openssl
        mkWasmBuild =
          name: cargoArgs:
          craneLib.cargoBuild ({
            inherit src version cargoVendorDir;
            pname = "cdk-wasm-${name}";
            cargoArtifacts = workspaceDeps;
            cargoExtraArgs = "${cargoArgs} --target wasm32-unknown-unknown";
            # WASM doesn't need native build inputs
            nativeBuildInputs = with pkgs; [ pkg-config ];
            buildInputs = [ ];
            # Disable tests for WASM (can't run in sandbox)
            doCheck = false;
          });

        # Doc tests check
        docTests = craneLib.cargoTest (
          commonCraneArgs
          // {
            pname = "cdk-doc-tests";
            cargoArtifacts = workspaceDeps;
            cargoTestExtraArgs = "--doc";
          }
        );

        # Workspace-wide clippy check for all targets. This preserves the quick
        # check coverage while reusing the warmed Crane dependency derivation.
        workspaceClippyAllTargets = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-workspace-clippy-all-targets";
            cargoArtifacts = workspaceDeps;
            buildPhaseCargoCommand = "cargo clippy --workspace --all-targets -- -D warnings";
            doCheck = false;
            installPhaseCommand = "mkdir -p $out";
          }
        );

        # Strict docs check - build docs with warnings as errors
        # Uses mkCargoDerivation for custom RUSTDOCFLAGS
        strictDocs = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-strict-docs";
            cargoArtifacts = workspaceDeps;
            buildPhaseCargoCommand = ''
              export RUSTDOCFLAGS="-D warnings"
              cargo doc --no-deps \
                -p cashu \
                -p cdk-common \
                -p cdk-sql-common \
                -p cdk \
                -p cdk-redb \
                -p cdk-sqlite \
                -p cdk-axum \
                -p cdk-cln \
                -p cdk-lnd \
                -p cdk-fake-wallet \
                -p cdk-mint-rpc \
                -p cdk-payment-processor \
                -p cdk-signatory \
                -p cdk-cli \
                -p cdk-mintd
            '';
            doCheck = false;
            installPhaseCommand = "mkdir -p $out";
          }
        );

        # FFI Python tests
        ffiTests = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-ffi-tests";
            cargoArtifacts = workspaceDeps;
            nativeBuildInputs = commonCraneArgs.nativeBuildInputs ++ [
              pkgs.python311
            ];
            buildPhaseCargoCommand = ''
              # Build the FFI library
              cargo build --release --package cdk-ffi

              # Generate Python bindings
              cargo run -p cdk-ffi --bin uniffi-bindgen generate \
                --library target/release/libcdk_ffi.so \
                --language python \
                --out-dir target/bindings/python

              # Copy library to bindings directory
              cp target/release/libcdk_ffi.so target/bindings/python/

              # Run Python tests
              python3 crates/cdk-ffi/tests/test_transactions.py
              python3 crates/cdk-ffi/tests/test_kvstore.py
              python3 crates/cdk-ffi/tests/test_rate_limit.py
            '';
            doCheck = false;
            installPhaseCommand = "mkdir -p $out";
          }
        );

        # ========================================
        # Language binding derivations (cached by Cachix)
        # ========================================

        # Dart FFI bindings: builds cdk-ffi-dart cdylib + generates Dart source
        dartBindings = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-dart-bindings";
            cargoArtifacts = workspaceDeps;
            buildPhaseCargoCommand = ''
              # Build the Dart FFI cdylib
              cargo build --release -p cdk-ffi-dart

              LIB_EXT="${if isDarwin then "dylib" else "so"}"

              # Find the cdk-ffi-dart shared library in deps (contains UniFFI metadata)
              CDK_FFI_LIB="target/release/deps/libcdk_ffi_dart.$LIB_EXT"

              if [ ! -f "$CDK_FFI_LIB" ]; then
                echo "ERROR: Could not find $CDK_FFI_LIB"
                ls -la target/release/deps/libcdk_ffi* || true
                exit 1
              fi

              echo "Using library: $CDK_FFI_LIB"

              # Generate Dart bindings via the custom uniffi-bindgen binary
              # Must run from bindings/dart/rust/ so it finds uniffi.toml
              (cd bindings/dart/rust && \
                cargo run --release -p cdk-ffi-dart --bin uniffi-bindgen-dart -- \
                  "../../../$CDK_FFI_LIB" --out-dir ../../../target/dart-bindings)
            '';
            doCheck = false;
            installPhaseCommand = ''
              LIB_EXT="${if isDarwin then "dylib" else "so"}"
              mkdir -p $out/lib/src/generated
              cp target/dart-bindings/*.dart $out/lib/src/generated/
              cp target/release/libcdk_ffi_dart.$LIB_EXT $out/lib/src/generated/
            '';
          }
        );

        # Kotlin JVM bindings: builds cdk-ffi-kotlin cdylib + generates Kotlin sources
        kotlinBindings = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-kotlin-bindings";
            cargoArtifacts = workspaceDeps;
            buildPhaseCargoCommand = ''
              LIB_EXT="${if isDarwin then "dylib" else "so"}"

              # Build for host target
              cargo build --release -p cdk-ffi-kotlin --target "${hostTarget}"

              # Generate Kotlin bindings
              cargo run --release -p cdk-ffi-kotlin --bin uniffi-bindgen-kotlin -- generate \
                --library "target/${hostTarget}/release/libcdk_ffi_kotlin.$LIB_EXT" \
                --language kotlin \
                --config bindings/kotlin/rust/uniffi.toml \
                --out-dir target/kotlin-bindings \
                --no-format
            '';
            doCheck = false;
            installPhaseCommand = ''
              LIB_EXT="${if isDarwin then "dylib" else "so"}"

              mkdir -p $out/cdk-jvm/src/main/kotlin
              mkdir -p $out/cdk-jvm/src/main/resources

              # Copy generated Kotlin sources
              cp -r target/kotlin-bindings/org $out/cdk-jvm/src/main/kotlin/

              # Copy native library
              cp "target/${hostTarget}/release/libcdk_ffi_kotlin.$LIB_EXT" \
                "$out/cdk-jvm/src/main/resources/libcdk_ffi_kotlin.$LIB_EXT"

              # Strip debug symbols
              strip -x "$out/cdk-jvm/src/main/resources/libcdk_ffi_kotlin.$LIB_EXT" 2>/dev/null || true
            '';
          }
        );

        uniffiBindgenGoSrc = pkgs.fetchFromGitHub {
          owner = "NordSecurity";
          repo = "uniffi-bindgen-go";
          rev = "v0.6.0+v0.30.0";
          hash = "sha256-HxcVUJb8DwbOcAP4LeBQPeKYrqR5jvvYJfcY7/gygkk=";
        };

        uniffiBindgenGoPackageSrc = pkgs.runCommand "uniffi-bindgen-go-src" { } ''
          mkdir -p $out
          cp -r ${uniffiBindgenGoSrc}/bindgen/* $out/
          chmod -R u+w $out
          cp ${./nix/uniffi-bindgen-go.Cargo.lock} $out/Cargo.lock
          substituteInPlace $out/Cargo.toml \
            --replace-fail 'uniffi_bindgen.workspace = true' 'uniffi_bindgen = "0.30.0"' \
            --replace-fail 'uniffi_meta.workspace = true' 'uniffi_meta = "0.30.0"' \
            --replace-fail 'uniffi_udl.workspace = true' 'uniffi_udl = "0.30.0"'
        '';

        uniffiBindgenGo = pkgs.rustPlatform.buildRustPackage {
          pname = "uniffi-bindgen-go";
          version = "0.6.0+v0.30.0";

          src = uniffiBindgenGoPackageSrc;
          cargoLock.lockFile = ./nix/uniffi-bindgen-go.Cargo.lock;
          doCheck = false;
        };

        # Go FFI bindings: builds cdk-ffi-go cdylib + generates Go sources
        goBindings = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-go-bindings";
            cargoArtifacts = workspaceDeps;
            nativeBuildInputs = commonCraneArgs.nativeBuildInputs ++ [
              pkgs.go
              uniffiBindgenGo
            ];
            buildPhaseCargoCommand = ''
              cargo build --release -p cdk-ffi-go

              LIB_EXT="${if isDarwin then "dylib" else "so"}"
              CDK_FFI_LIB="target/release/libcdk_ffi_go.$LIB_EXT"
              export GOCACHE="$TMPDIR/go-cache"
              mkdir -p "$GOCACHE"

              if [ ! -f "$CDK_FFI_LIB" ]; then
                echo "ERROR: Could not find $CDK_FFI_LIB"
                ls -la target/release/libcdk_ffi_go.* || true
                exit 1
              fi

              uniffi-bindgen-go \
                "$CDK_FFI_LIB" \
                --library \
                --config bindings/go/uniffi.toml \
                --out-dir target/go-bindings
            '';
            doCheck = false;
            installPhaseCommand = ''
              LIB_EXT="${if isDarwin then "dylib" else "so"}"

              mkdir -p $out/bindings $out/lib
              cp -r target/go-bindings/* $out/bindings/
              cp "target/release/libcdk_ffi_go.$LIB_EXT" $out/lib/
            '';
          }
        );

        # ========================================
        # Example definitions - single source of truth
        # ========================================
        exampleChecks = [
          "mint-token"
          "melt-token"
          "p2pk"
          "proof-selection"
          "wallet"
        ];

        # ========================================
        # Clippy + test check definitions - single source of truth
        # These run both clippy and unit tests in a single derivation
        # ========================================
        clippyAndTestChecks = {
          "core-cashu" = [
            "-p cashu"
            "-p cashu --no-default-features"
            "-p cashu --no-default-features --features wallet"
            "-p cashu --no-default-features --features mint"
          ];

          "core-common-http" = [
            "-p cdk-http-client"
            "-p cdk-http-client --no-default-features --features reqwest"
            "-p cdk-common"
            "-p cdk-common --no-default-features"
            "-p cdk-common --no-default-features --features wallet"
            "-p cdk-common --no-default-features --features mint"
            "-p cdk-common -p cdk-http-client --no-default-features --features cdk-common/wallet,cdk-common/http,cdk-http-client/bitreq"
            "-p cdk-common -p cdk-http-client --no-default-features --features cdk-common/wallet,cdk-common/http,cdk-http-client/reqwest"
            "-p cdk-common -p cdk-http-client --no-default-features --features cdk-common/mint,cdk-common/http,cdk-http-client/bitreq"
            "-p cdk-common -p cdk-http-client --no-default-features --features cdk-common/mint,cdk-common/http,cdk-http-client/reqwest"
          ];

          "core-sdk-baseline" = [
            "-p cdk -p cdk-http-client"
            "-p cdk --no-default-features"
          ];

          "core-sdk-wallet" = [
            "-p cdk --no-default-features --features bip353"
            "-p cdk -p cdk-http-client --no-default-features --features cdk/wallet,cdk-http-client/bitreq"
            "-p cdk -p cdk-http-client --no-default-features --features cdk/wallet,cdk-http-client/reqwest"
            "-p cdk -p cdk-http-client --no-default-features --features cdk/wallet,cdk/tor,cdk-http-client/bitreq"
            "-p cdk -p cdk-http-client --no-default-features --features cdk/wallet,cdk/npubcash,cdk-http-client/reqwest"
          ];

          "core-sdk-mint" = [
            "-p cdk -p cdk-http-client --no-default-features --features cdk/mint,cdk-http-client/bitreq"
            "-p cdk -p cdk-http-client --no-default-features --features cdk/mint,cdk-http-client/reqwest"
          ];

          "storage-and-cli" = [
            "-p cdk-sql-common"
            "-p cdk-sql-common --no-default-features --features wallet"
            "-p cdk-sql-common --no-default-features --features mint"
            "-p cdk-redb"
            "-p cdk-sqlite"
            "-p cdk-sqlite --features sqlcipher"
            "-p cdk-cli"
            "-p cdk-cli --features sqlcipher"
            "-p cdk-cli --features redb"
          ];

          "lightning-and-api" = [
            "-p cdk-axum"
            "-p cdk-axum --no-default-features"
            "-p cdk-axum --no-default-features --features redis"
            "-p cdk-bdk"
            "-p cdk-cln"
            "-p cdk-lnd"
            "-p cdk-fake-wallet -p cdk-http-client --no-default-features --features cdk-http-client/bitreq"
            "-p cdk-payment-processor"
            "-p cdk-ldk-node"
            "-p cdk-nostr -p cdk-http-client --no-default-features --features cdk-nostr/npubcash,cdk-http-client/bitreq"
          ];

          "mintd-main" = [
            "-p cdk-mintd"
            "-p cdk-mintd --features redis"
            "-p cdk-mintd --features sqlcipher"
            "-p cdk-signatory"
            "-p cdk-mint-rpc"
            "-p cdk-prometheus"
            "-p cdk-ffi"
          ];

          "mintd-backends-sqlite" = [
            "-p cdk-mintd --no-default-features --features lnd,sqlite"
            "-p cdk-mintd --no-default-features --features fakewallet,sqlite"
            "-p cdk-mintd --no-default-features --features grpc-processor,sqlite"
            "-p cdk-mintd --no-default-features --features management-rpc,lnd,sqlite"
            "-p cdk-mintd --no-default-features --features cln,sqlite"
          ];

          "mintd-backends-postgres" = [
            "-p cdk-mintd --no-default-features --features cln,postgres"
            "-p cdk-mintd --no-default-features --features lnd,postgres"
            "-p cdk-mintd --no-default-features --features fakewallet,postgres"
            "-p cdk-mintd --no-default-features --features grpc-processor,postgres"
            "-p cdk-mintd --no-default-features --features management-rpc,cln,postgres"
          ];
        };

        # ========================================
        # MSRV build check definitions
        # ========================================
        msrvChecks = {
          # Core library with all features
          "cdk-all-features" = "-p cdk --features \"mint,wallet\"";

          # Mintd with all backends, databases, and features
          "cdk-mintd-all" =
            "-p cdk-mintd --no-default-features --features \"cln,lnd,fakewallet,ldk-node,grpc-processor,sqlite,postgres,redis,management-rpc\"";

          # Minimal builds to ensure no-default-features works
          "cdk-wallet-only" = "-p cdk -p cdk-http-client --no-default-features --features cdk/wallet,cdk-http-client/bitreq";
        };

        # ========================================
        # WASM build check definitions
        # ========================================
        wasmChecks = {
          "cdk" = "-p cdk";
          "cdk-no-default" = "-p cdk --no-default-features";
          "cdk-wallet" = "-p cdk --no-default-features --features wallet";
        };

        # Common inputs
        envVars = {
          # rust analyzer needs  NIX_PATH for some reason.
          NIX_PATH = "nixpkgs=${inputs.nixpkgs}";
        };

        baseBuildInputs =
          with pkgs;
          [
            # Add additional build inputs here
            git
            pkg-config
            curl
            cachix
            jq
            just
            protobuf
            buf
            nixpkgs-fmt
            typos
            tokei

            cargo-outdated
            cargo-mutants
            cargo-fuzz
            cargo-nextest

            # Database
            postgresql_16
            startPostgres
            stopPostgres
            pgStatus
            pgConnect

            # Redis
            redis
            startRedisSingle
            stopRedisSingle
            startRedisCluster
            stopRedisCluster

            # Needed for github ci
            libz
          ]
          ++ libsDarwin;

        regtestBuildInputs =
          (with pkgsUnstable; [
            lnd
            # TODO: Drop this override once nixpkgs ships CLN >= 26.06.7.
            (clightning.overrideAttrs (finalAttrs: old: {
              version = "26.06.7";
              src = fetchurl {
                url = "https://github.com/ElementsProject/lightning/releases/download/v${finalAttrs.version}/clightning-v${finalAttrs.version}.zip";
                hash = "sha256-sxPSB+U/Hi2/n7rHnVr0jDUuh0plM5C924G1J5WhU9w=";
              };
              # The release archive omits the executable bit on this doc helper.
              postPatch = (old.postPatch or "") + ''
                chmod +x devtools/blockreplace.py
                patchShebangs devtools/blockreplace.py
              '';
            }))
            bitcoind
          ])
          ++ (with pkgs; [
            mprocs
            nostr-rs-relay
          ])
          # Integration-test cleanup starts the regtest process tree in a
          # dedicated session on Linux and uses procps to catch any child that
          # daemonizes out of that group. Bash job control is the portable
          # fallback on Darwin, where these Linux tools are unavailable.
          ++ lib.optionals pkgs.stdenv.hostPlatform.isLinux [
            pkgs.procps
            pkgs.util-linux
          ];

        commonShellHook = ''
          # Needed for github ci
          export LD_LIBRARY_PATH=${pkgs.lib.makeLibraryPath [ pkgs.zlib ]}:$LD_LIBRARY_PATH
        '';

        dockerShellHook = ''
          # Ensure Docker is available
          if ! command -v docker &> /dev/null; then
            echo "Docker is not installed or not in PATH"
            echo "Please install Docker to run integration tests"
            exit 1
          fi
          echo "Docker is available at $(command -v docker)"
          echo "Docker version: $(docker --version)"
        '';

        pgShellHook = ''
          # PostgreSQL environment variables
          export CDK_MINTD_DATABASE_URL="postgresql://${postgresConf.pgUser}:${postgresConf.pgPassword}@localhost:${postgresConf.pgPort}/${postgresConf.pgDatabase}"

          # Informational banner goes to stderr so it never corrupts the stdout of
          # commands run via `nix develop --command ... > file` (e.g. CI schema dumps).
          echo "" >&2
          echo "PostgreSQL commands available:" >&2
          echo "  start-postgres  - Initialize and start PostgreSQL" >&2
          echo "  stop-postgres   - Stop PostgreSQL (run before exiting)" >&2
          echo "  pg-status       - Check PostgreSQL status" >&2
          echo "  pg-connect      - Connect to PostgreSQL with psql" >&2
          echo "" >&2
        '';

        redisShellHook = ''
          # Redis environment variables (single-node defaults)
          export CDK_MINTD_CACHE_REDIS_URL="redis://127.0.0.1:6379"
          export CDK_MINTD_CACHE_REDIS_CLUSTER_NODES="redis://127.0.0.1:7001,redis://127.0.0.1:7002,redis://127.0.0.1:7003"

          echo "" >&2
          echo "Redis commands available:" >&2
          echo "  start-redis-single   - Start a single-node Redis on port 6379" >&2
          echo "  stop-redis-single    - Stop the single-node Redis" >&2
          echo "  start-redis-cluster  - Start a 3-node Redis cluster on ports 7001-7003" >&2
          echo "  stop-redis-cluster   - Stop the Redis cluster" >&2
          echo "" >&2
        '';

        # PostgreSQL configuration
        postgresConf = {
          pgUser = "cdk_user";
          pgPassword = "cdk_password";
          pgDatabase = "cdk_mint";
          pgPort = "5432";
        };

        # Script to start PostgreSQL
        startPostgres = pkgs.writeShellScriptBin "start-postgres" ''
          set -e
          PGDATA="$PWD/.pg_data"
          PGPORT="${postgresConf.pgPort}"
          PGUSER="${postgresConf.pgUser}"
          PGPASSWORD="${postgresConf.pgPassword}"
          PGDATABASE="${postgresConf.pgDatabase}"

          start_postgres_server() {
            # Override old clusters too: a .pg_data created before this fix can
            # still contain an absolute Unix-socket directory that is no longer
            # valid after moving the workspace.
            if ! ${pkgs.postgresql_16}/bin/pg_ctl \
              -D "$PGDATA" \
              -l "$PGDATA/logfile" \
              -o "-c unix_socket_directories=" \
              start; then
              echo "PostgreSQL failed to start. Server log:" >&2
              if [ -f "$PGDATA/logfile" ]; then
                cat "$PGDATA/logfile" >&2
              else
                echo "No PostgreSQL logfile was created." >&2
              fi
              return 1
            fi
          }

          # Stop any existing instance first
          if [ -d "$PGDATA" ] && ${pkgs.postgresql_16}/bin/pg_ctl -D "$PGDATA" status > /dev/null 2>&1; then
            echo "Stopping existing PostgreSQL instance..."
            ${pkgs.postgresql_16}/bin/pg_ctl -D "$PGDATA" stop > /dev/null 2>&1
          fi

          if [ ! -d "$PGDATA" ]; then
            echo "Initializing PostgreSQL database..."
            ${pkgs.postgresql_16}/bin/initdb -D "$PGDATA" --auth=trust --no-locale --encoding=UTF8

            # Configure PostgreSQL
            echo "listen_addresses = 'localhost'" >> "$PGDATA/postgresql.conf"
            echo "port = $PGPORT" >> "$PGDATA/postgresql.conf"
            # All clients use TCP. Disabling Unix sockets avoids PostgreSQL's
            # short Unix-socket pathname limit in deeply nested CI workspaces.
            printf "unix_socket_directories = '%s'\n" "" >> "$PGDATA/postgresql.conf"

            # Start temporarily to create user and database
            start_postgres_server
            sleep 2

            # Create user and database
            ${pkgs.postgresql_16}/bin/createuser -h localhost -p $PGPORT -s "$PGUSER" || true
            ${pkgs.postgresql_16}/bin/psql -h localhost -p $PGPORT -c "ALTER USER $PGUSER WITH PASSWORD '$PGPASSWORD';" postgres
            ${pkgs.postgresql_16}/bin/createdb -h localhost -p $PGPORT -O "$PGUSER" "$PGDATABASE" || true

            ${pkgs.postgresql_16}/bin/pg_ctl -D "$PGDATA" stop
            echo "PostgreSQL initialized."
          fi

          echo "Starting PostgreSQL on port $PGPORT..."
          start_postgres_server
          echo "PostgreSQL started. Connection URL: postgresql://$PGUSER:$PGPASSWORD@localhost:$PGPORT/$PGDATABASE"
        '';

        # Script to stop PostgreSQL
        stopPostgres = pkgs.writeShellScriptBin "stop-postgres" ''
          PGDATA="$PWD/.pg_data"
          if [ -d "$PGDATA" ]; then
            echo "Stopping PostgreSQL..."
            ${pkgs.postgresql_16}/bin/pg_ctl -D "$PGDATA" stop || echo "PostgreSQL was not running."
          else
            echo "No PostgreSQL data directory found."
          fi
        '';

        # Script to check PostgreSQL status
        pgStatus = pkgs.writeShellScriptBin "pg-status" ''
          PGDATA="$PWD/.pg_data"
          if [ -d "$PGDATA" ]; then
            ${pkgs.postgresql_16}/bin/pg_ctl -D "$PGDATA" status
          else
            echo "No PostgreSQL data directory found. Run 'start-postgres' first."
          fi
        '';

        # Script to connect to PostgreSQL
        pgConnect = pkgs.writeShellScriptBin "pg-connect" ''
          ${pkgs.postgresql_16}/bin/psql "postgresql://${postgresConf.pgUser}:${postgresConf.pgPassword}@localhost:${postgresConf.pgPort}/${postgresConf.pgDatabase}"
        '';

        # Script to start a 3-node Redis cluster (ports 7001-7003)
        startRedisCluster = pkgs.writeShellScriptBin "start-redis-cluster" ''
          set -e
          REDIS_DIR="$PWD/.redis_cluster"
          mkdir -p "$REDIS_DIR"

          _start_node() {
            local port=$1
            local pidfile="$REDIS_DIR/redis-$port.pid"

            # Skip if already running
            _pid=""
            [ -f "$pidfile" ] && _pid=$(cat "$pidfile" 2>/dev/null || true)
            if [ -n "$_pid" ] && kill -0 "$_pid" 2>/dev/null; then
              echo "Redis node on port $port already running (pid $_pid)"
              return
            fi

            ${pkgs.redis}/bin/redis-server \
              --port $port \
              --cluster-enabled yes \
              --cluster-config-file "$REDIS_DIR/nodes-$port.conf" \
              --cluster-node-timeout 5000 \
              --cluster-announce-ip 127.0.0.1 \
              --appendonly no \
              --save "" \
              --daemonize yes \
              --logfile "$REDIS_DIR/redis-$port.log" \
              --pidfile "$pidfile"

            echo "Started Redis node on port $port"
          }

          echo "Starting Redis cluster nodes..."
          _start_node 7001
          _start_node 7002
          _start_node 7003

          # Wait for all nodes to be ready
          echo "Waiting for nodes to be ready..."
          for port in 7001 7002 7003; do
            ready=0
            for i in $(seq 1 20); do
              if ${pkgs.redis}/bin/redis-cli -p $port ping 2>/dev/null | grep -q PONG; then
                ready=1
                break
              fi
              sleep 0.5
            done
            if [ "$ready" -eq 0 ]; then
              echo "ERROR: Redis node on port $port failed to start within 10 seconds" >&2
              exit 1
            fi
          done

          # Create the cluster if not already formed
          CLUSTER_STATE=$(${pkgs.redis}/bin/redis-cli -p 7001 cluster info 2>/dev/null | grep cluster_state | cut -d: -f2 | tr -d '[:space:]')
          if [ "$CLUSTER_STATE" = "ok" ]; then
            echo "Redis cluster already initialized"
          else
            echo "Forming Redis cluster..."
            ${pkgs.redis}/bin/redis-cli --cluster create \
              127.0.0.1:7001 127.0.0.1:7002 127.0.0.1:7003 \
              --cluster-replicas 0 --cluster-yes
          fi

          echo "Redis cluster ready. Nodes: redis://127.0.0.1:7001, redis://127.0.0.1:7002, redis://127.0.0.1:7003"
        '';

        # Script to stop the Redis cluster
        stopRedisCluster = pkgs.writeShellScriptBin "stop-redis-cluster" ''
          REDIS_DIR="$PWD/.redis_cluster"
          for port in 7001 7002 7003; do
            pidfile="$REDIS_DIR/redis-$port.pid"
            if [ -f "$pidfile" ]; then
              pid=$(cat "$pidfile")
              if kill -0 "$pid" 2>/dev/null; then
                echo "Stopping Redis node on port $port (pid $pid)..."
                kill "$pid"
              else
                echo "Redis node on port $port not running (stale pid file)"
              fi
              rm -f "$pidfile"
            else
              echo "No pid file for Redis node on port $port"
            fi
          done
          echo "Redis cluster stopped."
        '';

        # Script to start a single-node Redis (port 6379)
        startRedisSingle = pkgs.writeShellScriptBin "start-redis-single" ''
          set -e
          REDIS_DIR="$PWD/.redis_single"
          mkdir -p "$REDIS_DIR"
          PIDFILE="$REDIS_DIR/redis-6379.pid"

          # Skip if already running
          _pid=""
          [ -f "$PIDFILE" ] && _pid=$(cat "$PIDFILE" 2>/dev/null || true)
          if [ -n "$_pid" ] && kill -0 "$_pid" 2>/dev/null; then
            echo "Single-node Redis already running (pid $_pid)"
            exit 0
          fi

          ${pkgs.redis}/bin/redis-server \
            --port 6379 \
            --appendonly no \
            --save "" \
            --daemonize yes \
            --logfile "$REDIS_DIR/redis-6379.log" \
            --pidfile "$PIDFILE"

          # Wait for the node to be ready
          ready=0
          for i in $(seq 1 20); do
            if ${pkgs.redis}/bin/redis-cli -p 6379 ping 2>/dev/null | grep -q PONG; then
              ready=1
              break
            fi
            sleep 0.5
          done
          if [ "$ready" -eq 0 ]; then
            echo "ERROR: Single-node Redis failed to start within 10 seconds" >&2
            exit 1
          fi

          echo "Single-node Redis ready at redis://127.0.0.1:6379"
        '';

        # Script to stop the single-node Redis
        stopRedisSingle = pkgs.writeShellScriptBin "stop-redis-single" ''
          REDIS_DIR="$PWD/.redis_single"
          PIDFILE="$REDIS_DIR/redis-6379.pid"
          if [ -f "$PIDFILE" ]; then
            pid=$(cat "$PIDFILE")
            if kill -0 "$pid" 2>/dev/null; then
              echo "Stopping single-node Redis (pid $pid)..."
              kill "$pid"
            else
              echo "Single-node Redis not running (stale pid file)"
            fi
            rm -f "$PIDFILE"
          else
            echo "No pid file for single-node Redis"
          fi
          echo "Single-node Redis stopped."
        '';

        # Helper to build a statically-linked binary package (Linux only)
        # bin: the cargo binary name (e.g. "cdk-mintd")
        # name: the output binary name prefix (e.g. "cdk-mintd-ldk")
        # cargoExtraArgs: additional cargo args (e.g. "--bin cdk-mintd --features ldk-node")
        staticVersion = if commonCraneArgsStatic != null then commonCraneArgsStatic.version else version;
        mkStaticPackage =
          if muslTarget != null then
            (
              { bin
              , name
              , cargoExtraArgs
              ,
              }:
              craneLibStatic.buildPackage (
                commonCraneArgsStatic
                // {
                  pname = name;
                  cargoArtifacts = workspaceDepsStatic;
                  inherit cargoExtraArgs;
                  nativeBuildInputs = commonCraneArgsStatic.nativeBuildInputs ++ [
                    pkgs.removeReferencesTo
                  ];
                  installPhaseCommand = ''
                    mkdir -p $out/bin
                    cp target/${muslTarget}/release-static/${bin} $out/bin/${name}-${staticVersion}-${archSuffix}
                  '';
                  # Strip Nix store references from binaries for reproducibility
                  postFixup = ''
                    find "$out" -type f -executable -exec remove-references-to -t ${static_toolchain} '{}' +
                  '';
                }
              )
            )
          else
            null;

        # Helper to build a macOS release binary package
        # Uses the same release-static Cargo profile for consistent optimization settings
        # Non-system libraries (openssl, sqlite, zlib, libiconv) are statically linked
        # to avoid embedding Nix store dylib paths in the distributed binary.
        # A postFixup safety net rewrites any remaining Nix store refs to system paths.
        # bin: the cargo binary name (e.g. "cdk-mintd")
        # name: the output binary name prefix (e.g. "cdk-mintd-ldk")
        # cargoExtraArgs: additional cargo args (e.g. "--bin cdk-mintd --features ldk-node")
        mkDarwinPackage =
          { bin
          , name
          , cargoExtraArgs
          ,
          }:
          craneLib.buildPackage (
            commonCraneArgs
            // {
              pname = name;
              cargoArtifacts = workspaceDeps;
              inherit cargoExtraArgs;
              CARGO_PROFILE = "release-static";

              # Static-link non-system libraries so the binary doesn't reference
              # Nix store paths for openssl, sqlite, zlib, libiconv, etc.
              OPENSSL_STATIC = "1";
              PKG_CONFIG_ALL_STATIC = "1";
              doNotSign = true;
              darwinDontCodeSign = true;

              installPhaseCommand = ''
                mkdir -p $out/bin
                cp target/release-static/${bin} $out/bin/${name}-${version}-${archSuffix}
              '';

              # Safety net: rewrite any remaining Nix store dylib references to
              # their macOS system equivalents so the binary is fully portable.
              # We unconditionally rewrite to /usr/lib/ without checking file existence
              # because macOS 11+ stores system dylibs in a shared cache (dyld resolves
              # them at runtime even though the individual .dylib files may not be on disk).
              postFixup = ''
                for f in $out/bin/*; do
                  nix_store_libs="$(
                    otool -L "$f" | tail -n +2 | awk '/\/nix\/store/ { print $1 }'
                  )"
                  if [ -n "$nix_store_libs" ]; then
                    echo "$nix_store_libs" | while IFS= read -r lib; do
                      base=$(basename "$lib")
                      echo "Rewriting Nix store dylib ref: $lib -> /usr/lib/$base"
                      install_name_tool -change "$lib" "/usr/lib/$base" "$f"
                    done
                  fi

                  nix_store_rpaths="$(
                    otool -l "$f" | awk '
                      $1 == "cmd" && $2 == "LC_RPATH" { in_rpath = 1; next }
                      in_rpath && $1 == "path" {
                        print $2
                        in_rpath = 0
                      }
                    ' | awk '/^\/nix\/store/ { print }'
                  )"
                  if [ -n "$nix_store_rpaths" ]; then
                    echo "$nix_store_rpaths" | while IFS= read -r rpath; do
                      echo "Removing Nix store rpath: $rpath"
                      install_name_tool -delete_rpath "$rpath" "$f"
                    done
                  fi

                  # Fail the build if any runtime Mach-O references still point into the Nix store.
                  # This prevents silently shipping binaries that depend on Nix-specific loader paths.
                  remaining_libs=$(otool -L "$f" | tail -n +2 | grep '/nix/store' || true)
                  remaining_rpaths=$(otool -l "$f" | awk '
                    $1 == "cmd" && $2 == "LC_RPATH" { in_rpath = 1; next }
                    in_rpath && $1 == "path" {
                      print $2
                      in_rpath = 0
                    }
                  ' | grep '^/nix/store' || true)

                  if [ -n "$remaining_libs$remaining_rpaths" ]; then
                    echo "ERROR: Binary still references Nix store paths after fixup:"
                    if [ -n "$remaining_libs" ]; then
                      echo "$remaining_libs"
                    fi
                    if [ -n "$remaining_rpaths" ]; then
                      echo "$remaining_rpaths"
                    fi
                    echo "The binary would fail on systems without Nix installed."
                    exit 1
                  fi

                  # The install_name_tool changes happen after the usual
                  # signing hooks, so refresh the ad-hoc signature.
                  signIfRequired "$f"
                done
              '';
            }
          );

        # ========================================
        # Integration test harness binaries (pre-built via Crane, cached by Cachix)
        # These are used by CI integration test scripts instead of cargo build/run
        # ========================================
        mkItestBinary =
          name: cargoExtraArgs:
          craneLib.buildPackage (
            commonCraneArgs
            // {
              pname = "cdk-itest-${name}";
              src = itestHarnessSrc;
              cargoArtifacts = workspaceDeps;
              inherit cargoExtraArgs;
              # Only install the specific binary, not the entire workspace
              doCheck = false;
            }
          );

        itestBinaries = {
          start-fake-mint = mkItestBinary "start-fake-mint" "--bin start_fake_mint";
          start-regtest-mints = mkItestBinary "start-regtest-mints" "--bin start_regtest_mints";
          start-fake-auth-mint = mkItestBinary "start-fake-auth-mint" "--bin start_fake_auth_mint";
          start-regtest = mkItestBinary "start-regtest" "--bin start_regtest";
          signatory = mkItestBinary "signatory" "--bin signatory";
          cdk-payment-processor = mkItestBinary "cdk-payment-processor" "--bin cdk-payment-processor";
          cdk-mintd-grpc = mkItestBinary "cdk-mintd-grpc" "--bin cdk-mintd --no-default-features --features grpc-processor";
        };

        # Nextest archive for integration tests (pre-compiled test binaries)
        itestArchive = craneLib.mkCargoDerivation (
          commonCraneArgs
          // {
            pname = "cdk-itest-archive";
            cargoArtifacts = workspaceDeps;
            nativeBuildInputs = commonCraneArgs.nativeBuildInputs ++ [
              pkgs.cargo-nextest
            ];
            buildPhaseCargoCommand = ''
              mkdir -p $out
              cargo nextest archive \
                -p cdk-integration-tests \
                --archive-file $out/itest-archive.tar.zst
            '';
            doCheck = false;
            installPhaseCommand = "";
            # mkCargoDerivation would otherwise also compress the whole cargo
            # target dir into $out/target.tar.zst (crane's cargoArtifacts
            # mechanism). Nothing consumes this package's artifacts and the
            # extra tarball (~4.7 GB) nearly doubles the store path that binary
            # caches have to push and every runner has to pull, so skip it.
            doInstallCargoArtifacts = false;
          }
        );

        # Common arguments can be set here to avoid repeating them later
        nativeBuildInputs = [
          #Add additional build inputs here
        ]
        ++ lib.optionals isDarwin [
          # Additional darwin specific native inputs can be set here
        ];

        defaultPackage =
          if muslTarget != null then
            mkStaticPackage
              {
                bin = "cdk-mintd";
                name = "cdk-mintd";
                cargoExtraArgs = "--bin cdk-mintd --features postgres,prometheus,redis";
              }
          else
            mkDarwinPackage {
              bin = "cdk-mintd";
              name = "cdk-mintd";
              cargoExtraArgs = "--bin cdk-mintd --features postgres,prometheus,redis";
            };
      in
      {
        # Expose deps for explicit cache warming
        packages = {
          default = defaultPackage;
          attic-client = pkgs.attic-client;
          deps = workspaceDeps;
          deps-msrv = workspaceDepsMsrv;
          # Language bindings (cached cdylib + uniffi codegen)
          dart-bindings = dartBindings;
          kotlin-bindings = kotlinBindings;
          go-bindings = goBindings;
        }
        # Static build deps (Linux only)
        // lib.optionalAttrs (muslTarget != null) {
          deps-static = workspaceDepsStatic;
        }
        # Static binary packages (fully statically-linked, Linux only)
        // lib.optionalAttrs (muslTarget != null) {
          cdk-mintd-static = defaultPackage;

          cdk-mintd-ldk-static = mkStaticPackage {
            bin = "cdk-mintd";
            name = "cdk-mintd-ldk";
            cargoExtraArgs = "--bin cdk-mintd --features ldk-node,postgres,prometheus,redis";
          };

          cdk-cli-static = mkStaticPackage {
            bin = "cdk-cli";
            name = "cdk-cli";
            cargoExtraArgs = "--bin cdk-cli";
          };
        }
        # macOS release binary packages (dynamically linked, Apple Silicon only)
        // lib.optionalAttrs isDarwin {
          cdk-mintd-darwin = defaultPackage;

          cdk-mintd-ldk-darwin = mkDarwinPackage {
            bin = "cdk-mintd";
            name = "cdk-mintd-ldk";
            cargoExtraArgs = "--bin cdk-mintd --features ldk-node,postgres,prometheus,redis";
          };

          cdk-cli-darwin = mkDarwinPackage {
            bin = "cdk-cli";
            name = "cdk-cli";
            cargoExtraArgs = "--bin cdk-cli";
          };
        }
        # Integration test harness binaries (pre-built for CI)
        // itestBinaries
        // {
          itest-archive = itestArchive;
        }
        # Example packages (binaries that can be run outside sandbox with network access)
        // (builtins.listToAttrs (
          map
            (name: {
              name = "example-${name}";
              value = mkExamplePackage name;
            })
            exampleChecks
        ));
        checks =
          # Generate clippy + test checks from clippyAndTestChecks attrset
          (builtins.mapAttrs (name: args: mkClippyAndTest name args) clippyAndTestChecks)
          # Generate MSRV build checks (prefixed with msrv-)
          // (builtins.listToAttrs (
            map
              (name: {
                name = "msrv-${name}";
                value = mkMsrvBuild name msrvChecks.${name};
              })
              (builtins.attrNames msrvChecks)
          ))
          // (builtins.listToAttrs (
            map
              (name: {
                name = "msrv-${name}";
                value = mkMsrvBuild name msrvChecks.${name};
              })
              (builtins.attrNames msrvChecks)
          ))
          # Generate WASM build checks (prefixed with wasm-)
          // (builtins.listToAttrs (
            map
              (name: {
                name = "wasm-${name}";
                value = mkWasmBuild name wasmChecks.${name};
              })
              (builtins.attrNames wasmChecks)
          ))
          // (builtins.listToAttrs (
            map
              (name: {
                name = "wasm-${name}";
                value = mkWasmBuild name wasmChecks.${name};
              })
              (builtins.attrNames wasmChecks)
          ))
          // (builtins.listToAttrs (
            map
              (name: {
                name = "example-${name}";
                value = mkExample name;
              })
              exampleChecks
          ))
          // (builtins.listToAttrs (
            map
              (name: {
                name = "example-${name}";
                value = mkExample name;
              })
              exampleChecks
          ))
          // {
            # PRs run the default unit suite once; alternate feature combinations
            # remain in the full matrix. PostgreSQL has a separate service job.
            pr-unit-tests = craneLib.mkCargoDerivation (
              commonCraneArgs
              // {
                pname = "cdk-pr-unit-tests";
                cargoArtifacts = workspaceDeps;
                buildPhaseCargoCommand = ''
                  cargo test --lib --workspace --exclude cdk-postgres --exclude cdk-integration-tests
                  cargo test --bins -p cdk-cli
                  cargo test --lib -p cdk-nostr --all-features
                '';
                doCheck = false;
                installPhaseCommand = "mkdir -p $out";
                doInstallCargoArtifacts = false;
              }
            );

            # Keep optional features and minimal package builds covered on PRs.
            # The full matrix already covers these configurations separately.
            pr-feature-tests = craneLib.mkCargoDerivation (
              commonCraneArgs
              // {
                pname = "cdk-pr-feature-tests";
                cargoArtifacts = workspaceDeps;
                buildPhaseCargoCommand = ''
                  cargo test --lib -p cdk-sqlite --features sqlcipher
                  cargo test --bins -p cdk-cli --features redb
                  cargo check -p cdk-mintd --features redis
                  cargo test --lib -p cdk-common --no-default-features --features wallet
                  cargo test --lib -p cdk-common --no-default-features --features mint
                  cargo test --lib -p cdk-sql-common --no-default-features --features wallet
                  cargo test --lib -p cdk-sql-common --no-default-features --features mint
                '';
                doCheck = false;
                installPhaseCommand = "mkdir -p $out";
                doInstallCargoArtifacts = false;
              }
            );

            # Workspace-wide all-targets clippy check
            workspace-clippy-all-targets = workspaceClippyAllTargets;

            # Doc tests
            doc-tests = docTests;

            # Strict docs check
            strict-docs = strictDocs;

            # FFI Python tests
            ffi-tests = ffiTests;
          };

        devShells =
          let
            # devShells
            msrv = pkgs.mkShell (
              {
                buildInputs = baseBuildInputs ++ [ msrv_toolchain ];
                inherit nativeBuildInputs;
              }
              // envVars
            );

            stable = pkgs.mkShell (
              {
                shellHook = commonShellHook + pgShellHook + redisShellHook;
                buildInputs = baseBuildInputs ++ [
                  stable_toolchain
                ];
                inherit nativeBuildInputs;

              }
              // envVars
            );

            regtest = pkgs.mkShell (
              {
                shellHook = commonShellHook + pgShellHook + redisShellHook;
                buildInputs =
                  baseBuildInputs
                  ++ regtestBuildInputs
                  ++ [
                    stable_toolchain
                  ]
                  ++ builtins.attrValues itestBinaries;
                inherit nativeBuildInputs;
              }
              // envVars
            );

            nightly = pkgs.mkShell (
              {
                shellHook = commonShellHook + pgShellHook;
                buildInputs = baseBuildInputs ++ [
                  nightly_toolchain
                ];
                inherit nativeBuildInputs;
              }
              // envVars
            );

            nightly-regtest = pkgs.mkShell (
              {
                shellHook = commonShellHook + pgShellHook;
                buildInputs =
                  baseBuildInputs
                  ++ regtestBuildInputs
                  ++ [
                    nightly_toolchain
                  ];
                inherit nativeBuildInputs;
              }
              // envVars
            );

            # Shell with Docker for integration tests
            integration = pkgs.mkShell (
              {
                shellHook = dockerShellHook + commonShellHook + pgShellHook;
                buildInputs =
                  baseBuildInputs
                  ++ regtestBuildInputs
                  ++ [
                    stable_toolchain
                    pkgs.docker-client
                    pkgs.python311
                    pkgsUnstable.cargo-llvm-cov
                  ]
                  ++ builtins.attrValues itestBinaries;
                inherit nativeBuildInputs;
              }
              // envVars
            );

            # Minimal shell for the Nutshell interoperability tests. These tests
            # compile their own binaries with Cargo and do not use the pre-built
            # integration-test harnesses from the full integration shell.
            nutshell = pkgs.mkShell (
              {
                shellHook = dockerShellHook + commonShellHook;
                buildInputs = baseBuildInputs ++ [
                  stable_toolchain
                  pkgs.docker-client
                ];
                inherit nativeBuildInputs;
              }
              // envVars
            );

            # Shell for FFI development (Python bindings)
            ffi = pkgs.mkShell (
              {
                shellHook =
                  commonShellHook
                  + pgShellHook
                  + ''
                    echo "FFI development shell"
                    echo "  just ffi-test        - Run Python FFI tests"
                    echo "  just ffi-dev-python  - Launch Python REPL with CDK FFI"
                  '';
                buildInputs = baseBuildInputs ++ [
                  stable_toolchain
                  pkgs.python311
                ];
                inherit nativeBuildInputs;
              }
              // envVars
            );

            # Shell for bindings development (Dart + Swift + Kotlin + Go FFI)
            bindings = pkgs.mkShell (
              {
                shellHook = commonShellHook;
                buildInputs = baseBuildInputs ++ [
                  stable_toolchain
                  rustupShim
                  dartpkgs.default
                  pkgs.openssl
                  pkgs.jdk17
                  pkgs.go
                ];
                nativeBuildInputs = [
                  pkgs.pkg-config
                ];
                OPENSSL_DIR = "${pkgs.openssl.dev}";
                OPENSSL_LIB_DIR = "${pkgs.openssl.out}/lib";
                OPENSSL_INCLUDE_DIR = "${pkgs.openssl.dev}/include";
              }
              // envVars
            );

            # Shell for building Kotlin native libraries (Rust + Android NDK)
            kotlin-build =
              let
                pkgsAndroid = import nixpkgs {
                  inherit system;
                  config = {
                    android_sdk.accept_license = true;
                    allowUnfree = true;
                  };
                };
                androidComposition = pkgsAndroid.androidenv.composeAndroidPackages {
                  platformVersions = [ "34" ];
                  buildToolsVersions = [ "34.0.0" ];
                  includeNDK = true;
                  ndkVersions = [ "27.0.12077973" ];
                  includeEmulator = false;
                  includeSystemImages = false;
                };
                androidSdk = androidComposition.androidsdk;
                ndkHome = "${androidSdk}/libexec/android-sdk/ndk/27.0.12077973";
                toolchainBin = "${ndkHome}/toolchains/llvm/prebuilt/linux-x86_64/bin";
                androidRustFlags = "-C link-arg=-Wl,-z,max-page-size=16384 -C link-arg=-Wl,-z,common-page-size=16384";
                buildToolchain = pkgs.rust-bin.stable."1.99.0".default.override {
                  targets = [
                    "aarch64-linux-android"
                    "armv7-linux-androideabi"
                    "i686-linux-android"
                    "x86_64-linux-android"
                    "aarch64-apple-ios"
                    "aarch64-apple-darwin"
                  ];
                };
              in
              pkgs.mkShell {
                buildInputs = [
                  buildToolchain
                ];
                ANDROID_HOME = "${androidSdk}/libexec/android-sdk";
                ANDROID_NDK_HOME = ndkHome;
                CARGO_TARGET_AARCH64_LINUX_ANDROID_LINKER = "${toolchainBin}/aarch64-linux-android24-clang";
                CARGO_TARGET_ARMV7_LINUX_ANDROIDEABI_LINKER = "${toolchainBin}/armv7a-linux-androideabi24-clang";
                CARGO_TARGET_I686_LINUX_ANDROID_LINKER = "${toolchainBin}/i686-linux-android24-clang";
                CARGO_TARGET_X86_64_LINUX_ANDROID_LINKER = "${toolchainBin}/x86_64-linux-android24-clang";
                CARGO_TARGET_AARCH64_LINUX_ANDROID_RUSTFLAGS = androidRustFlags;
                CARGO_TARGET_ARMV7_LINUX_ANDROIDEABI_RUSTFLAGS = androidRustFlags;
                CARGO_TARGET_I686_LINUX_ANDROID_RUSTFLAGS = androidRustFlags;
                CARGO_TARGET_X86_64_LINUX_ANDROID_RUSTFLAGS = androidRustFlags;
                CC_aarch64_linux_android = "${toolchainBin}/aarch64-linux-android24-clang";
                CC_armv7_linux_androideabi = "${toolchainBin}/armv7a-linux-androideabi24-clang";
                CC_i686_linux_android = "${toolchainBin}/i686-linux-android24-clang";
                CC_x86_64_linux_android = "${toolchainBin}/x86_64-linux-android24-clang";
                AR_aarch64_linux_android = "${toolchainBin}/llvm-ar";
                AR_armv7_linux_androideabi = "${toolchainBin}/llvm-ar";
                AR_i686_linux_android = "${toolchainBin}/llvm-ar";
                AR_x86_64_linux_android = "${toolchainBin}/llvm-ar";
              };

            # Shell for Kotlin publishing (JDK 17 + Android SDK for Gradle)
            kotlin-publish =
              let
                pkgsAndroid = import nixpkgs {
                  inherit system;
                  config = {
                    android_sdk.accept_license = true;
                    allowUnfree = true;
                  };
                };
                androidComposition = pkgsAndroid.androidenv.composeAndroidPackages {
                  platformVersions = [ "34" ];
                  buildToolsVersions = [ "34.0.0" ];
                  includeNDK = false;
                  includeEmulator = false;
                  includeSystemImages = false;
                };
              in
              pkgs.mkShell {
                buildInputs = [
                  pkgs.jdk17
                  androidComposition.androidsdk
                ];
                ANDROID_HOME = "${androidComposition.androidsdk}/libexec/android-sdk";
                JAVA_HOME = "${pkgs.jdk17}";
              };

          in
          {
            inherit
              msrv
              stable
              regtest
              nightly
              nightly-regtest
              integration
              nutshell
              ffi
              bindings
              kotlin-build
              kotlin-publish
              ;
            default = stable;
          };
      }
    );
}