{ pkgs, lib, inputs, ... }:
let
  ansibleRequired = {
    taps = [
      "fwdcloudsec/granted" # aws sso utility
      "felipeelias/tap"     # claude-statusline
      "f1bonacc1/tap"       # process-compose
      "oven-sh/bun"         # bun
      "sst/tap"             # opencode
    ];
    brews = [
      "allure"
      "aws-sso-util"
      "awscli"
      "ccusage"
      "fd"
      "f1bonacc1/tap/process-compose"
      "felipeelias/tap/claude-statusline"
      "oven-sh/bun/bun"
      "fwdcloudsec/granted/granted"
      "gdal"
      "gh"
      "jq"
      "maven"
      "rg"
      "snyk-cli"
      "sst/tap/opencode"
      
      ## Excluded intentionally
      # "libpq@17"
      # "node@22"
    ];
    casks = [
      "1password-cli"
      "aws-vpn-client"
      "chromedriver"
      "claude-code"       # stable channel; playbook can opt into claude-code@latest
      "copilot-cli"
      "docker-desktop"
      "expo-orbit"
      "zulu@17"
      "ngrok"

      ## Excluded intentionally
      # "visual-studio-code" # app installed by brew; home-manager owns settings + extensions
      # "jetbrains-toolbox"
    ];
  };
in {
  ids.gids.nixbld = 350;
  security.pam.services.sudo_local.touchIdAuth = true;

  # Set vim as default editor
  environment.variables.EDITOR = "vim";
  environment.variables.VISUAL = "vim";
  environment.variables.GIT_EDITOR = "vim";
  environment.variables.HOMEBREW_NO_ANALYTICS = "1";

  environment.systemPackages = with pkgs; [
    vim
    git
    wget
    curl
    python3
    postgresql_17
    home-manager
    ttyd
    xcodes
    xz
    # node 22 pinned to the exact version cleo-app requires (nixpkgs-nodejs in flake.nix)
    pinnedNode.nodejs_22
    pinnedNode.yarn
  ];

  # Add Homebrew to PATH
  environment.systemPath = [ "/opt/homebrew/bin" "/opt/homebrew/sbin" "/Users/matthew.bessette/.local/bin" ];

  system.primaryUser = "matthew.bessette";
  users.users."matthew.bessette" = {
    name = "matthew.bessette";
    home = "/Users/matthew.bessette";
  };

  # Homebrew for Casks and specific binaries
  # In a nix-darwin setup, Homebrew packages are not actually stored inside the Nix store. 
  # Instead, nix-darwin acts as a manager that triggers the standard Homebrew installation 
  # process on your macOS system.
  homebrew = {
    enable = true;
    onActivation.cleanup = "uninstall";
    onActivation.autoUpdate = true;
    onActivation.upgrade = true;
    # global.autoUpdate = true;
    # Each list is (ansible-managed set) ++ (nix-only extras), deduped. With
    # cleanup = "uninstall" above, anything NOT listed here gets removed on
    # activation — so ansibleRequired must be merged in or nix would clobber it.
    taps = lib.unique (ansibleRequired.taps ++ [
      # nix-only taps go here
    ]);
    brews = lib.unique (ansibleRequired.brews ++ [
      "biome"
      "jira-cli"
      "treehouse"
    ]);
    # visual-studio-code is installed by Homebrew (in ansibleRequired.casks) so
    # Homebrew owns the .app; home-manager (cleo.home.nix) owns settings +
    # extensions only (programs.vscode with package = null) — no second copy.
    casks = lib.unique (ansibleRequired.casks ++ [
      "android-commandlinetools"
      "android-platform-tools"
      "bruno"
      "claude"
      "figma"
      "super-productivity"
      "kopiaui"
      "libreoffice"
      "obsidian"
      "postico"
      "sublime-text"
      "spotify"
      "yubico-yubikey-manager"
      "zoom"
    ]);

    masApps = {
      BetterSnapTool = 417375580;
      HiddenBar = 1452453066;
      # "Jamf Trust" = 1608041266;
      MeetingBar = 1518425043;
      Wireguard = 1451685025;
    };
  };

  nix.settings.experimental-features = "nix-command flakes";
  system.stateVersion = 4;
}