{ pkgs, ... }: {
  home.stateVersion = "23.11";

  home.username = "matthew.bessette";
  home.homeDirectory = "/Users/matthew.bessette";

  home.packages = with pkgs; [
    # Dev Specs
    python3
    pipenv
    nodejs_22
    yarn
    jdk17
    
    # DB
    postgresql_16 # pgdump/restore
    
    # CLI Tools from your Brewfile
    xz
    ffmpeg
    earthly
    awscli2
    buf
  ];

  # Managed VS Code Extensions (The "Clean" Way)
  programs.vscode = {
    enable = true;
    profiles.default = {
      extensions = with pkgs.vscode-extensions; [
        ms-python.python
        ms-python.vscode-pylance
        ms-python.debugpy
        hashicorp.terraform
        esbenp.prettier-vscode
        dbaeumer.vscode-eslint
        eamodio.gitlens
        redhat.vscode-xml
        mechatroner.rainbow-csv
        bbenoist.nix
        # Note: Some niche extensions might need to be installed manually in VS Code
      ];
    };
  };

  # Automatically load the 1Password agent in your shell
  programs.zsh = {
    enable = true;
    enableCompletion = true;
    autosuggestion.enable = true;
    syntaxHighlighting.enable = true;
    oh-my-zsh.enable = true;
    oh-my-zsh.theme = "robbyrussell";
    oh-my-zsh.plugins = [
      "git"
      "npm"
    ];

    initContent = ''
      export SSH_AUTH_SOCK=~/Library/Group\ Containers/2BU8OCWD5C.com.1password/t/agent.sock
    '';

    shellAliases = {
      ll = "ls -l";
      update = "sudo darwin-rebuild switch --flake ~/nixos#cleo-darwin";
      laws = "aws --endpoint=http://localhost:4566";
      dev = "nix develop -c $SHELL";
      nixos = "code ~/nixos";
    };
  };

  home.sessionVariables = {
    # Points to the Homebrew location mentioned in your caveat
    ANDROID_HOME = "/opt/homebrew/share/android-commandlinetools";
    JAVA_HOME = "${pkgs.jdk17}";
  };
}