{
  description = "mykiwi.blog dev shell";

  inputs.multiverse.url = "github:fzakaria/nixpkgs-multiverse";

  outputs = { self, multiverse }:
    let
      system = "x86_64-linux";
      pin = multiverse.multiverse.${system};
      pkgs = pin.tip;
      hugo = pin.version "hugo" "0.166.0";
      dart-sass = pin.version "dart-sass" "1.104.0";
      opentofu = pin.version "opentofu" "1.12.6";
      wrangler = pin.version "wrangler" "4.129.0";
    in
    {
      packages.${system}.default = pkgs.stdenvNoCC.mkDerivation {
        name = "mykiwi.blog";
        src = ./blog;
        nativeBuildInputs = [ hugo dart-sass ];
        buildPhase = ''
          HUGO_PARAMS_NIXSTOREPATH="$out" hugo --minify --destination "$out"
        '';
        dontInstall = true;
      };

      devShells.${system} = {
        default = pkgs.mkShell {
          name = "mykiwi-blog";

          packages = [
            hugo
            dart-sass
          ];

          shellHook = ''
            dim=$'\033[2m'
            reset=$'\033[0m'
            printf '%-11s%-9s%s%s%s\n' "Hugo" "$(hugo version | sed -n 's/.*v\([0-9.]*\)+.*/\1/p')" "$dim" "https://github.com/gohugoio/hugo/releases" "$reset"
            printf '%-11s%-9s%s%s%s\n' "Dart Sass" "$(sass --version)" "$dim" "https://github.com/sass/dart-sass/releases" "$reset"
          '';
        };

        # Cloudflare provisioning (infra/) - kept separate from the default
        # shell so writing a blog post doesn't require pulling in tofu/wrangler.
        infra = pkgs.mkShell {
          name = "mykiwi-blog-infra";

          packages = [
            opentofu
            wrangler
          ];

          shellHook = ''
            dim=$'\033[2m'
            reset=$'\033[0m'
            printf '%-11s%-9s%s%s%s\n' "OpenTofu" "$(tofu version | sed -n 's/OpenTofu v\([0-9.]*\)/\1/p')" "$dim" "https://github.com/opentofu/opentofu/releases" "$reset"
            printf '%-11s%-9s%s%s%s\n' "Wrangler" "$(wrangler --version)" "$dim" "https://github.com/cloudflare/workers-sdk/releases" "$reset"
          '';
        };
      };

      apps.${system} = {
        # `nix run .#infra -- plan` / `nix run .#infra -- apply` (or any
        # other tofu subcommand) against infra/, from wherever in the repo
        # you happen to be.
        infra = {
          type = "app";
          program = "${pkgs.writeShellApplication {
            name = "mykiwi-blog-infra";
            runtimeInputs = [ opentofu pkgs.git ];
            text = ''
              root="$(git rev-parse --show-toplevel)"
              tofu -chdir="$root/infra" init
              tofu -chdir="$root/infra" "$@"
            '';
          }}/bin/mykiwi-blog-infra";
        };

        # `nix run .#deploy -- <lang>` - pushes the already-built `./result/<lang>`
        # folder (built separately via `make build` / `nix build`, the same
        # `packages.default` derivation) to its matching Cloudflare Pages
        # project. Needs CLOUDFLARE_API_TOKEN, same as `infra`. Takes a single
        # language so the Makefile can fan out `make deploy` across languages
        # in parallel via `make -j`.
        deploy = {
          type = "app";
          program = "${pkgs.writeShellApplication {
            name = "mykiwi-blog-deploy";
            runtimeInputs = [ wrangler pkgs.git ];
            text = ''
              lang="''${1:?usage: nix run .#deploy -- <lang>}"
              root="$(git rev-parse --show-toplevel)"
              project="mykiwi-blog-$lang"
              wrangler pages deploy "$root/result/$lang" --project-name="$project" --branch=main --config="$root/wrangler.toml"
            '';
          }}/bin/mykiwi-blog-deploy";
        };
      };
    };
}