{
  description = "Flake for NEXA xce";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
    xbuild.url  = "github:shen390s/my-nix-channel?ref=master";
    extralib.url = "git+ssh://forgejo@gitea.shenrs.eu/nexa/extralibs?ref=main";
    librtti.url = "git+ssh://forgejo@gitea.shenrs.eu/rshen/librtti?ref=master";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, xbuild, extralib, librtti, flake-utils }: 
    let
      supportedSystems = [ "x86_64-linux" ];
      myCommitId =
        if builtins.hasAttr "shortRev" self
        then self.shortRev
        else self.dirtyShortRev;
      # NOTE (build-time-versioning task 2.2, remediation round): unlike
      # myCommitId (a genuinely flake-level, eval-time concept sourced from
      # self.shortRev/self.dirtyShortRev), the build timestamp is NOT
      # computed here. An earlier attempt used `builtins.toString
      # builtins.currentTime` at this exact spot -- but builtins.currentTime
      # is stripped entirely under a flake's default pure evaluation
      # ("error: attribute 'currentTime' missing"), so `nix build
      # .#xcecore_debug` (no --impure, the documented canonical command)
      # failed at evaluation. Fixed by moving the build-time computation
      # into each derivation's own build phase instead (xce.nix/xcecli.nix
      # `preConfigure`, via stdenv's bundled `date -u`) -- see those files.
      # Nothing build-time-related needs to be threaded through the flake
      # or nixSupport/default.nix any more; only myCommitId still does.
      # dirty-content-fingerprint task 2.2: myDirtyFingerprint is a new,
      # independent eval-time value alongside myCommitId (myCommitId's own
      # computation above, including its self.dirtyShortRev-derived -dirty
      # suffix, is NOT touched by this addition). Unlike build_time
      # (builtins.currentTime, stripped under pure-eval -- see the note
      # above), self.narHash is a genuine flake self-introspection field
      # with no pure-eval trap: it is reachable and content-sensitive with
      # no --impure needed (empirically re-confirmed live: editing a
      # tracked file changes it, reverting reproduces the original value
      # exactly). self.narHash's own string form is SRI-style base64
      # ("sha256-<base64>="), not hex, so it is rehashed via
      # builtins.hashString "sha256" (which DOES return a base16/hex
      # digest) and truncated to 8 hex chars to match the dev-loop path's
      # format (xce-build.sh task 2.1's `sha256sum | cut -c1-8`). Resolves
      # to empty on a clean tree, mirroring myCommitId's own
      # hasAttr "shortRev" branch immediately above (a clean tree only has
      # self.shortRev; a dirty tree also has self.dirtyShortRev).
      # KNOWN, ACCEPTED LIMITATION (see research.md "Nix path accepts the
      # untracked-file blind spot"): self.narHash does not reflect
      # brand-new untracked files unless they are git-add-staged first --
      # deliberately not engineered around here (would require adding git
      # as a nix sandbox dependency, an explicit prior architectural
      # decision this feature does not revisit).
      myDirtyFingerprint =
        if builtins.hasAttr "shortRev" self
        then ""
        else builtins.substring 0 8 (builtins.hashString "sha256" self.narHash);
    in
      flake-utils.lib.eachSystem supportedSystems (
        system: let
          mypkgs = xbuild.packages.${system} // extralib.packages.${system} // librtti.packages.${system};
          overlays = [
            (final: prev: mypkgs // prev)
          ];
          pkgs = import nixpkgs { inherit overlays system;};
          xpkgs = import ./nixSupport/default.nix {
            inherit pkgs myCommitId myDirtyFingerprint;
          };
          appImageScriptContent = builtins.readFile ./tools/appimage/entry.sh;
          appImageEntryPackage = pkgs.writeShellApplication {
            name = "xce";
            runtimeInputs = with pkgs; [
              xpkgs.xcecore
              glibcLocales
              coreutils-full
              which
              bash
              gzip
              glow
              less
              haproxy
            ];
            text = appImageScriptContent;

            runtimeEnv = {
              LOCALE_ARCHIVE="${pkgs.glibcLocales}/lib/locale/locale-archive";
              LANG="en_US.UTF-8";
              LESS="-R";
            };

            meta = {
              mainProgram = "xce";
            };
          };
        in rec {
          packages = pkgs // xpkgs // { xce = appImageEntryPackage; };
          defaultPackage = xpkgs.xcecore_debug;
          devShells.default = pkgs.mkShell {
            nativeBuildInputs = xpkgs.xcecore.nativeBuildInputs;
            GOROOT = "${pkgs.go}/share/go";
          };

          devShell = self.devShells.${system}.default;
        }
      );
}