{ config, lib, pkgs, pkgs-unstable, artifacts, ... }:
with artifacts;
{
  vnc-display = mkBoundLauncher {
    name = "vnc-display";
    runtimeInputs = [ pkgs.xorg.xorgserver pkgs.x11vnc pkgs.xorg.xdpyinfo ];
    script = ''
      display_num="1000"
      port="5900"
      # Desktop 0 intentionally stays in the original portrait layout for
      # operational reasons; do not "normalize" this to landscape.
      res="1080x1920"
      width="''${res%x*}"
      height="''${res#*x}"
      x_display=":$display_num"

      cleanup() {
        if [[ -n "''${xvfb_pid:-}" ]]; then
          kill "$xvfb_pid" 2>/dev/null || true
          wait "$xvfb_pid" 2>/dev/null || true
        fi
      }
      trap cleanup EXIT

      Xvfb "$x_display" -screen 0 "''${width}x''${height}x24" -nolisten tcp -ac &
      xvfb_pid=$!

      for _ in $(seq 1 200); do
        [[ -S "/tmp/.X11-unix/X''${display_num}" ]] && break
        kill -0 "$xvfb_pid" 2>/dev/null || { echo "[vnc-display] Xvfb died" >&2; exit 1; }
        sleep 0.1
      done
      [[ -S "/tmp/.X11-unix/X''${display_num}" ]] || { echo "[vnc-display] Xvfb socket timeout" >&2; exit 1; }
      kill -0 "$xvfb_pid" 2>/dev/null || { echo "[vnc-display] Xvfb died after socket" >&2; exit 1; }

      for _ in $(seq 1 200); do
        xdpyinfo -display "$x_display" >/dev/null 2>&1 && break
        kill -0 "$xvfb_pid" 2>/dev/null || { echo "[vnc-display] Xvfb died before display became ready" >&2; exit 1; }
        sleep 0.1
      done
      xdpyinfo -display "$x_display" >/dev/null 2>&1 || { echo "[vnc-display] X display not ready" >&2; exit 1; }

      echo "[vnc-display] Xvfb ready on $x_display (''${width}x''${height})" >&2
      echo "[vnc-display] x11vnc on $bind_host:$port" >&2

      listen_args=()
      case "$bind_host" in
        127.0.0.1|localhost|::1)
          # Keep the listener on loopback without enforcing loopback-only clients.
          listen_args=(-listen "$bind_host_v4" -no6 -noipv6)
          ;;
        0.0.0.0)
          listen_args=(-no6 -noipv6)
          ;;
        *)
          listen_args=(-listen "$bind_host" -no6 -noipv6)
          ;;
      esac

      exec x11vnc -display "$x_display" -rfbport "$port" "''${listen_args[@]}" \
        -rfbportv6 -1 \
        -nopw -forever -shared -noxdamage
    '';
  };
}