{
  lib,
  buildNpmPackage,
  fetchzip,
}:

buildNpmPackage rec {
  pname = "romm-mcp";
  version = "1.0.5";

  src = fetchzip {
    url = "https://registry.npmjs.org/${pname}/-/${pname}-${version}.tgz";
    hash = "sha256-SOYzG0CtNSvIrxOYJq3UDXRlXylqbDjo2f5qfpbiYmI=";
  };

  # Upstream publishes no package-lock.json (only package.json), and
  # buildNpmPackage requires one to compute npmDepsHash. This lock is generated
  # from the published tarball itself -- `npm install --package-lock-only
  # --ignore-scripts` inside the extracted 1.0.5 package -- so it locks exactly
  # the dependency tree that shipped with this version.
  npmDepsHash = "sha256-oSlECdIf2ZP8ZZhOUChkcJAmUTj6TFTdeTJLY5RwLGo=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json

    # romm_system action=scan was stubbed out client-side ("Scan endpoint removed in
    # RomM 5.0"), but RomM 5.4 restored POST /api/tasks/scan, so the stub only blocks a
    # working endpoint. Upstream publishes no sources in the npm tarball, so this patches
    # the compiled dist/ directly; drop it once upstream restores runScan().
    patch -p1 < ${./romm-mcp-scan.patch}
  '';

  # dist/*.js (tsc output) ships inside the npm tarball, so there is nothing to
  # compile here -- same arrangement as navidrome-mcp and n8n-mcp.
  dontNpmBuild = true;

  meta = with lib; {
    description = "MCP server for RomM: browse, search and administrate a self-hosted ROM library";
    homepage = "https://github.com/rodrigosiviero/romm-mcp";
    license = licenses.mit;
    mainProgram = pname;
    platforms = platforms.all;
  };
}