{
  description = "vault CLI + Librarian tooling for Ryan's R/J/F/I Obsidian vault";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
  };

  outputs = { self, nixpkgs }:
    let
      systems = [ "x86_64-linux" "aarch64-linux" ];
      forAllSystems = nixpkgs.lib.genAttrs systems;
    in
    {
      packages = forAllSystems (system:
        let
          pkgs = nixpkgs.legacyPackages.${system};
          vault-cli = pkgs.callPackage ./package.nix { };
        in
        {
          default = vault-cli;
          vault-cli = vault-cli;
        });

      # Convenience module for consumers (e.g. nixos-config) that just want
      # `vault` on $PATH for hosts playing a vault role. Mirrors the shape
      # nixos-config's modules/hosts/core/vault.nix expects: import this and
      # add `environment.systemPackages = [ pkgs.vault-cli ]` (or reference
      # `self.packages.${system}.default` directly via a flake input).
      nixosModules.default = { pkgs, ... }: {
        environment.systemPackages = [ self.packages.${pkgs.system}.default ];
      };
    };
}