{
  description = "Sausage: grow a system of WASI actors by talking to it";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    flake-utils.url = "github:numtide/flake-utils";
    rust-overlay.url = "github:oxalica/rust-overlay";
    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
    crane.url = "github:ipetkov/crane";
  };

  outputs = { nixpkgs, flake-utils, rust-overlay, crane, ... }:
    flake-utils.lib.eachSystem flake-utils.lib.allSystems (system:
      let
        pkgs = import nixpkgs {
          inherit system;
          overlays = [ rust-overlay.overlays.default ];
        };
        # The toolchain that builds the host and, at runtime, the actors.
        rust = pkgs.rust-bin.stable.latest.default.override {
          targets = [ "wasm32-wasip2" ];
          extensions = [ "rust-src" ];
        };
        # The runtime cargo actor needs Cargo, rustc (with wasm32-wasip2), and
        # the native linker, even when the host itself is started with a bare
        # PATH. Keep this same runtime path in the packaged host and exercise
        # the installed binary below with PATH deliberately empty.
        runtimePath = pkgs.lib.makeBinPath [ rust pkgs.stdenv.cc ];
        craneLib = (crane.mkLib pkgs).overrideToolchain rust;
        common = {
          pname = "sausage";
          version = "0.1.0";
          src = ./.;
        };
        # The test packages for `checks.tests`.
        testPackages = "-p sausage -p sausage-actor -p agent";
        cargoArtifacts = craneLib.buildDepsOnly (common // {
          doCheck = false;
          # The dependencies of the host binary and of the tests.
          buildPhaseCargoCommand = ''
            cargoWithProfile build --locked -p sausage
            cargoWithProfile test --locked --no-run ${testPackages}
          '';
        });
        sausage = craneLib.buildPackage (common // {
          inherit cargoArtifacts;
          cargoExtraArgs = "--locked -p sausage";
          doCheck = false;
          nativeBuildInputs = [ pkgs.makeWrapper ];
          # The `cargo` actor runs cargo at runtime. Build scripts need a C linker.
          postInstall = ''
            wrapProgram $out/bin/sausage --prefix PATH : ${runtimePath}
          '';
          meta.mainProgram = "sausage";
        });
        # `nix run .#loop -- <world>` runs the newest `sausage run <world>`
        # (without a folder: bare `sausage`, i.e. ./world, created if needed)
        # from the public repo, again and again: after a crash or a broker
        # `exit` request it refreshes the flake and starts the host again,
        # so the world updates itself. `/quit` (exit code 0) ends the loop.
        # SAUSAGE_FLAKE overrides where it fetches from (any flake URL,
        # e.g. a fork or a local checkout).
        repoUrl = "git+https://gitea.surma.technology/surma/sausage";
        loop = pkgs.writeShellScriptBin "sausage-loop" ''
          url="''${SAUSAGE_FLAKE:-${repoUrl}}"
          # No folder: bare `sausage` (creates ./world first if needed).
          if [ $# -gt 0 ]; then set -- run "$@"; fi
          while true; do
            nix run --refresh "$url#default" -- "$@"
            code=$?
            if [ "$code" -eq 0 ]; then exit 0; fi
            echo "sausage-loop: sausage exited with $code, starting the newest version in 2 s …" >&2
            sleep 2
          done
        '';
      in
      {
        packages.default = sausage;

        # `nix flake check` runs every test of the host, the SDK, and the
        # agent. The tests build WASM actors with cargo, offline, from the
        # vendored crates of Cargo.lock.
        # The binary the host loop runs (`nix run`), built from the same
        # cached dependencies as the tests.
        checks.package = sausage;
        checks.tests = craneLib.cargoTest (common // {
          inherit cargoArtifacts;
          cargoExtraArgs = "--locked ${testPackages}";
          # Nothing builds on the test run's target folder: don't store it.
          doInstallCargoArtifacts = false;
          preCheck = ''
            # Its own lock file pins crates that the vendored set may lack.
            rm -f cli/tests/actors/toolbox/Cargo.lock
          '';
        });
        # Exercise the installed host exactly as the loop launches it: the
        # caller has no Cargo on PATH, so only the packaged runtime toolchain
        # can run the native tests and the wasm32-wasip2 build.
        checks.runtime-toolchain = pkgs.runCommand "sausage-runtime-toolchain" { } ''
          set -eu
          root="$TMPDIR/runtime-toolchain"
          world="$root/world"
          emptyPath="$root/empty-bin"
          mkdir -p "$emptyPath" "$root/home" "$root/cargo-home"
          for actor in broker console cargo fs; do
            mkdir -p "$world/actor/$actor/public" "$world/actor/$actor/data"
          done
          source="$world/actor/console/public/probe"
          mkdir -p "$source/src" "$source/tests"
          cat > "$source/Cargo.toml" <<'TOML'
          [package]
          name = "runtime-probe"
          version = "0.1.0"
          edition = "2024"
          TOML
          printf 'fn main() {}\n' > "$source/src/main.rs"
          cat > "$source/tests/probe.rs" <<'RUST'
          #[test]
          fn native_test_harness_runs() {
              assert_eq!(2 + 2, 4);
          }
          RUST
          echo "runtime-check: run packaged host with an empty PATH"
          coproc host {
            ${pkgs.coreutils}/bin/env -i PATH="$emptyPath" HOME="$root/home" TMPDIR="$root" \
              CARGO_HOME="$root/cargo-home" ${sausage}/bin/sausage run "$world"
          }
          hostInput=''${host[1]}
          hostOutput=''${host[0]}
          hostPid=$host_PID
          trap 'kill "$hostPid" 2>/dev/null || true' EXIT
          printf '%s\n' '@cargo {"type":"build","source":"/actor/console/public/probe"}' >&"$hostInput"
          built=0
          while IFS= read -r -t 300 line <&"$hostOutput"; do
            echo "$line"
            case "$line" in
              *'"type":"build_failed"'*)
                echo "packaged cargo actor build failed with an empty caller PATH" >&2
                exit 1
                ;;
              *'"type":"built"'*)
                case "$line" in
                  *'"passed":1'*) built=1 ;;
                  *) echo "native test did not pass" >&2; exit 1 ;;
                esac
                break
                ;;
            esac
          done
          if [ "$built" -ne 1 ]; then
            echo "packaged host did not build the probe" >&2
            exit 1
          fi
          printf '%s\n' '/quit' >&"$hostInput"
          wait "$hostPid"
          mkdir -p "$out"
          touch "$out/passed"
        '';

        apps.default = { type = "app"; program = "${sausage}/bin/sausage"; };
        apps.loop = { type = "app"; program = "${loop}/bin/sausage-loop"; };

        devShells.default = pkgs.mkShell {
          packages = [ rust pkgs.wasmtime pkgs.wasm-tools ];
          shellHook = ''
            export CARGO_HOME="$PWD/.cargo-home"
          '';
        };
      });
}