{
  lib,
  buildGoModule,
  buildNpmPackage,
  nodejs,
  stdenv,
}:
let
  # Explicit allowlist: never include live finance/, secrets/, .env, node_modules,
  # generated binaries, or a local DuckDB file in either package derivation.
  root = ../.;
  source = lib.fileset.toSource {
    inherit root;
    fileset = lib.fileset.unions [
      ../go.mod
      ../go.sum
      ../cmd
      ../internal
      ../web/embed.go
    ];
  };
  frontend = buildNpmPackage {
    pname = "finance-duck-frontend";
    version = "0.1.0";
    inherit nodejs;
    src = lib.fileset.toSource {
      root = ../web;
      fileset = lib.fileset.unions [
        ../web/src
        ../web/index.html
        ../web/package.json
        ../web/package-lock.json
        ../web/tsconfig.json
        ../web/vite.config.ts
      ];
    };
    npmDepsHash = "sha256-Sq4qmgNpg8b3fN8v1QHiISMQt5ZHI6oZ8J0M5svV0Ys=";
    npmFlags = [ "--ignore-scripts" ];
    installPhase = ''
      runHook preInstall
      mkdir -p "$out"
      cp -r dist/. "$out/"
      runHook postInstall
    '';
  };
in
buildGoModule {
  pname = "finance-duck";
  version = "0.1.0";
  src = source;
  vendorHash = "sha256-ks/X1pmBjX1BTyQBSpvn1EbbUuv8RMi4n7at+o31mnw=";
  proxyVendor = true;
  env.CGO_ENABLED = "1";
  nativeBuildInputs = [ stdenv.cc ];
  subPackages = [ "cmd/finance-duck" ];
  postConfigure = ''
    mkdir -p web/dist
    cp -r ${frontend}/. web/dist/
  '';
  checkPhase = ''
    runHook preCheck
    go test ./internal/...
    runHook postCheck
  '';
  passthru = { inherit frontend; };
  meta = {
    description = "Private personal finance dashboard with canonical plaintext journals";
    mainProgram = "finance-duck";
    platforms = [ "x86_64-linux" ];
  };
}