{
  lib,
  stdenv,
  pkgs,
  myCommitId,
  myDirtyFingerprint,
  withDebug? false,
  withAsan? false,
  ...
}:

stdenv.mkDerivation {

  pname = "xcecore";
  version = "0.0.1";

  src = ./..;

  nativeBuildInputs = with pkgs; [
    meson
    ninja
    capnproto
    pkg-config
    cmake
    go
    go-swag     # swagger doc generation: swag init
    gotools     # goimports, godoc
    gopls       # Go language server
    delve       # Go debugger
    (openssl.overrideAttrs (oldAttrs: {
      separateDebugInfo = true;
    }))
    libtirpc
    # BSD-licensed readline replacement (task 12.1, scheduler-core spec):
    # GNU readline is GPL and would encumber xce_scheduler/xce_test's own
    # licensing once linked into a production/shipped binary; libedit's
    # editline/readline.h header is API-compatible (readline()/add_history())
    # so callers change only their #include, not their calls.
    libedit
    struct2json
    (capnpc.overrideAttrs (oldAttrs: {
      separateDebugInfo = true;
      # bug-918: upstream xbuild's capnpc package.nix pins src to the
      # MUTABLE `main` ref of shen390s/c-capnproto with a hardcoded sha256,
      # so it hard-breaks (fixed-output hash mismatch) every time that
      # branch moves. Pin to an immutable commit here instead so this repo
      # stops depending on upstream's moving target.
      src = pkgs.fetchFromGitHub {
        owner = "shen390s";
        repo = "c-capnproto";
        rev = "e45ff682c4756ac5067cbac6d0f282a8ea5f0155";
        sha256 = "sha256-9rTlcTia+s9ARGeTi+8auGvM0RkS+wZK7aIkzecaeSk=";
      };
    }))
    which
    findutils
    # NOTE: `cacert` was previously required so the Go build could make TLS
    # requests to the module proxy (goproxy.cn) during the build phase. The
    # Go builds are now fully offline against each module's committed vendor/
    # tree (tools/go_build sets GOFLAGS=-mod=vendor, GOPROXY=off), so no TLS /
    # network happens in the build phase and cacert is no longer needed here.
    (libuv.overrideAttrs (oldAttrs: {
      separateDebugInfo = true;
    }))
    (elogind.overrideAttrs (oldAttrs: {
      separateDebugInfo = true;
    }))
    (sqlite.overrideAttrs (oldAttrs: {
      separateDebugInfo = true;
    }))
    (hwloc.overrideAttrs (oldAttrs: {
      separateDebugInfo = true;
    }))
    linux-pam
    tinylog
    unity_test_with_color
    libcyaml
    libyaml
    libcgroup
    packcc
    # Python — for xceadmin (admin config tool, src/xceadmin/). pycapnp links
    # against the capnproto C++ runtime above; nix's python3Packages.pycapnp
    # handles that link correctly, unlike a plain `pip install pycapnp`.
    # See .kiro/specs/admin-config-tool/brief.md "Nix Environment".
    python3
    python3Packages.pip
    # setuptools + wheel: xceadmin (src/xceadmin) is a PEP 517 package with
    # build-backend = setuptools.build_meta. Its meson-build.sh installs it
    # with `pip install --no-build-isolation` (offline, see that script), so
    # the build backend must already be present in the environment rather
    # than fetched from PyPI at build time (no network in the Nix sandbox).
    python3Packages.setuptools
    python3Packages.wheel
    python3Packages.pycapnp
    python3Packages.pyyaml
    python3Packages.jsonschema
    python3Packages.click
    python3Packages.pytest
    python3Packages.ruff
    # cacert intentionally removed -- see comment above libuv override.
  ]  ++ (if withDebug then [
    (librtti_debug.overrideAttrs (oldattrs: {
      separateDebugInfo = true;
    }))
  ] else [
    librtti
  ]);

  build-system = [ pkgs.meson ];

  dontStrip = (withDebug || withAsan);
  separateDebugInfo = (withDebug || withAsan);

  # impureEnvVars = [ "HOME" ] was previously needed so the Go build could
  # reuse the host module cache / credentials while fetching from goproxy.cn.
  # The Go builds are now fully offline (vendored, GOPROXY=off) and
  # tools/go_build sets its own HOME=$TMPDIR, so no host env is needed --
  # dropping it keeps the derivation pure/reproducible.

  # build-time-versioning task 2.2 (remediation round): build_time is
  # computed HERE, in the build phase, not at flake-evaluation time --
  # builtins.currentTime is unavailable under flake pure-eval (see
  # flake.nix's note), so `nix build .#xcecore_debug` with no --impure
  # would fail at evaluation if it were used. `date` (stdenv's bundled
  # coreutils) is always available inside the build sandbox regardless of
  # pure-eval -- no --impure, no git, no network needed. Matches
  # xce-build.sh's (task 2.1) exact ISO-8601 format. mesonConfigurePhase
  # (nixpkgs meson setup-hook.sh) runs `runHook preConfigure` before it
  # reads mesonFlags/mesonFlagsArray to build the `meson setup` command
  # line, so appending to mesonFlagsArray here is picked up at configure
  # time.
  preConfigure = ''
    buildTime="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
    if [ -z "$buildTime" ]; then
      echo "xce.nix: date -u produced an empty build time -- the -Dbuild_time= meson option would not reach the binary" >&2
      exit 1
    fi
    mesonFlagsArray+=("-Dbuild_time=$buildTime")
  '';

  mesonFlags =[
    (lib.optional withDebug "--buildtype=debug")
    (lib.optional withAsan "-Db_sanitize=address")
    ("-Dcommit_id=" + myCommitId)
    # dirty-content-fingerprint task 2.2: eval-time, plain mesonFlags entry
    # -- mirrors -Dcommit_id= above, NOT the preConfigure/mesonFlagsArray
    # build-phase mechanism reserved for build_time (see preConfigure above).
    ("-Ddirty_fingerprint=" + myDirtyFingerprint)
    "-Dcomponent=xcecore"
  ];
}