{
  lib,
  buildNpmPackage,
  fetchurl,
  jq,
  nodejs_22,
}:

# REA ("Reverse Engineer Anything", npm `rea-agents`) from the published
# npm tarball, whose `dist/` is prebuilt: building from the git source runs a
# `compile` step that needs `tsrs`, a native compiler with no nix package.
#
# The tarball carries no lockfile, so ./rea-package-lock.json is vendored: a
# `npm install --package-lock-only` over the tarball's `dependencies` alone.
# Regenerate it on a version bump. `postPatch` strips the tarball's
# `package.json` to the same keys, so the install is production dependencies
# only; `frida`, an optional dependency whose install script downloads a
# toolchain, is left out with them, and `--ignore-scripts` keeps every other
# install script from running.
#
# Node must satisfy `^22.23.4 || ^24.22.1 || >=26.12.1`; nixpkgs' `nodejs_22`
# is the one that does.
buildNpmPackage (finalAttrs: {
  pname = "rea-agents";
  version = "6.8.0";
  nodejs = nodejs_22;

  src = fetchurl {
    url = "https://registry.npmjs.org/rea-agents/-/rea-agents-${finalAttrs.version}.tgz";
    hash = "sha256-jVQux2qcs1BYS2CmycCIcG/4EtW7WwlMIMlbbcJWmLs=";
  };
  sourceRoot = "package";

  postPatch = ''
    cp ${./rea-package-lock.json} package-lock.json
    ${lib.getExe jq} '{ name, version, license, bin, dependencies }' package.json > package.json.new
    mv package.json.new package.json
  '';

  npmDepsHash = "sha256-/YMAZNQHaerVCVUlxTkL2WJyb9FXiu8ZpuBah3fW0+w=";
  npmFlags = [ "--ignore-scripts" ];
  dontNpmBuild = true;

  doInstallCheck = true;
  installCheckPhase = ''
    runHook preInstallCheck
    HOME=$(mktemp -d) $out/bin/rea mcp --help
    runHook postInstallCheck
  '';

  meta = {
    description = "Reverse Engineer Anything: an MCP server driving Ghidra and other reverse-engineering tools";
    homepage = "https://github.com/morluto/rea";
    license = lib.licenses.mit;
    mainProgram = "rea";
  };
})