{
  description = "kitchen — the KitchenMD CLI, packaged as a Nix flake";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";

    # The single pinned Bun, used to compile the binary and to develop against.
    # It is held apart from `nixpkgs` so a `nixpkgs` update cannot pull in a Bun
    # release that emits empty binaries under sandboxed native compilation.
    nixpkgs-bun.url = "github:nixos/nixpkgs/241313f4e8e508cb9b13278c2b0fa25b9ca27163";

    flake-parts.url = "github:hercules-ci/flake-parts";

    systems.url = "github:nix-systems/x86_64-linux";

    bun2nix = {
      url = "github:nix-community/bun2nix?ref=2.1.2";
      # Compile against the pinned Bun rather than `nixpkgs`'s.
      inputs.nixpkgs.follows = "nixpkgs-bun";
      inputs.systems.follows = "systems";
    };

    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    inputs:
    inputs.flake-parts.lib.mkFlake { inherit inputs; } {
      systems = import inputs.systems;

      imports = [ inputs.treefmt-nix.flakeModule ];

      perSystem =
        { system, ... }:
        let
          pkgs = import inputs.nixpkgs {
            inherit system;
            overlays = [ inputs.bun2nix.overlays.default ];
          };

          # The Bun from the same pinned `nixpkgs-bun` the build compiles with.
          bun = inputs.nixpkgs-bun.legacyPackages.${system}.bun;

          kitchen = pkgs.callPackage ./package.nix { };

          bunDeps = pkgs.bun2nix.fetchBunDeps { bunNix = ./bun.nix; };
        in
        {
          # Share the overlaid package set with the imported modules.
          _module.args.pkgs = pkgs;

          packages.default = kitchen;

          apps.default = {
            type = "app";
            program = "${kitchen}/bin/kitchen";
          };

          devShells.default = pkgs.mkShell {
            packages = [
              bun
              pkgs.biome
              pkgs.bun2nix
            ];
          };

          treefmt = {
            projectRootFile = "flake.nix";
            programs.biome = {
              enable = true;
              # Reuse the repo's biome configuration as the single source.
              # The sandboxed check has no git tree, so biome's VCS-ignore
              # lookup must be off.
              settings = pkgs.lib.recursiveUpdate (pkgs.lib.importJSON ./biome.json) {
                vcs.enabled = false;
              };
              # Skip re-validating the config; biome consumes it directly.
              validate.enable = false;
            };
          };

          checks = {
            tests = pkgs.bun2nix.mkDerivation {
              pname = "kitchen-tests";
              inherit (kitchen) version;
              src = ./.;
              inherit bunDeps;
              dontRunLifecycleScripts = true;
              dontUseBunBuild = true;
              doCheck = true;
              installPhase = "touch $out";
            };

            smoke = pkgs.runCommand "kitchen-smoke" { } ''
              ${kitchen}/bin/kitchen --help
              touch $out
            '';
          };
        };
    };
}