{
  lib,
  buildNpmPackage,
  fetchzip,
}:

buildNpmPackage rec {
  pname = "romm-mcp";
  version = "1.0.5";

  src = fetchzip {
    url = "https://registry.npmjs.org/${pname}/-/${pname}-${version}.tgz";
    hash = "sha256-Cg4Pa2jxwmMyuc2LyFJA1uNjFgaLaPgMXyvpY2HrPFM=";
  };

  # Upstream publishes no package-lock.json (only package.json), and
  # buildNpmPackage requires one to compute npmDepsHash. This lock is generated
  # from the published tarball itself -- `npm install --package-lock-only
  # --ignore-scripts` inside the extracted 1.0.5 package -- so it locks exactly
  # the dependency tree that shipped with this version.
  npmDepsHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
  '';

  # dist/*.js (tsc output) ships inside the npm tarball, so there is nothing to
  # compile here -- same arrangement as navidrome-mcp and n8n-mcp.
  dontNpmBuild = true;

  meta = with lib; {
    description = "MCP server for RomM: browse, search and administrate a self-hosted ROM library";
    homepage = "https://github.com/rodrigosiviero/romm-mcp";
    license = licenses.mit;
    mainProgram = pname;
    platforms = platforms.all;
  };
}