{
  fio,
  jq,
  lib,
  namespace,
  nodejs,
  npmHooks,
  fetchNpmDeps,
  requireFile,
  stdenv,
}:
let
  inherit (lib.trivial) importJSON;
  inherit (lib.${namespace}) mkAllSources selectVariant;

  versionSpec = importJSON ./version.json;
  selected = selectVariant versionSpec null null;
  sources = mkAllSources selected;
  inherit (selected.variables) version;

  # These three packages are published exclusively to GitHub Packages
  # (npm.pkg.github.com) which requires authentication — they cannot be
  # fetched in the Nix sandbox without a token.  Add them to the Nix store
  # manually first:
  #
  #   TOKEN=<your GitHub PAT with read:packages scope>
  #   for pkg in \
  #     "download/@45Drives/cockpit-css/0.1.12/42ecb717da68e4c31454b5bc6019e3a4fe7dcd6c" \
  #     "download/@45Drives/cockpit-helpers/0.1.19/29920cb9a0866220cfda58b9db4f34c8435f8960" \
  #     "download/@45Drives/cockpit-vue-components/0.1.0-beta2/a216666b3e9eb97a30cf47c0b947b4e5661798db"
  #   do
  #     curl -L -u "user:$TOKEN" \
  #       "https://npm.pkg.github.com/$pkg" \
  #       -o "$(basename $pkg).tgz"
  #   done
  #   nix store add-file *.tgz
  cockpitCssTarball = requireFile {
    name = "cockpit-css-0.1.12.tgz";
    # sha512 integrity from yarn.lock
    hash = "sha512-RgyedX/5GuriDvLruvmbqb++cIBqIF5py2E4G8/wMtQfUf6QnJqsRLYNp7uzKcLpE2+kjm9pGASdvwV2I2b/YA==";
    message = ''
      cockpit-benchmark requires @45drives/cockpit-css which is only available
      on GitHub Packages (requires authentication).  Download it manually:

        curl -L -u "user:<GITHUB_PAT>" \
          "https://npm.pkg.github.com/download/@45Drives/cockpit-css/0.1.12/42ecb717da68e4c31454b5bc6019e3a4fe7dcd6c" \
          -o cockpit-css-0.1.12.tgz
        nix store add-file cockpit-css-0.1.12.tgz
    '';
  };

  cockpitHelpersTarball = requireFile {
    name = "cockpit-helpers-0.1.19.tgz";
    hash = "sha512-dyS3V+XG/9rLGGhFJEA2b+ohrZiGsHteOEktJk9mM9c6WsXJywrlnrHm0YrKksoTUPwXtBY44QrXJNd3zKtvKQ==";
    message = ''
      cockpit-benchmark requires @45drives/cockpit-helpers which is only available
      on GitHub Packages (requires authentication).  Download it manually:

        curl -L -u "user:<GITHUB_PAT>" \
          "https://npm.pkg.github.com/download/@45Drives/cockpit-helpers/0.1.19/29920cb9a0866220cfda58b9db4f34c8435f8960" \
          -o cockpit-helpers-0.1.19.tgz
        nix store add-file cockpit-helpers-0.1.19.tgz
    '';
  };

  cockpitVueComponentsTarball = requireFile {
    name = "cockpit-vue-components-0.1.0-beta2.tgz";
    hash = "sha512-QvKCuUlCA9LLrwdGKf1iveiKUvJaExmNZxOUyhxg63BvQwn9rs26uN/MFS2mweCi++Mv6kyN+dJG62L7qCSOXQ==";
    message = ''
      cockpit-benchmark requires @45drives/cockpit-vue-components which is only
      available on GitHub Packages (requires authentication).  Download it manually:

        curl -L -u "user:<GITHUB_PAT>" \
          "https://npm.pkg.github.com/download/@45Drives/cockpit-vue-components/0.1.0-beta2/a216666b3e9eb97a30cf47c0b947b4e5661798db" \
          -o cockpit-vue-components-0.1.0-beta2.tgz
        nix store add-file cockpit-vue-components-0.1.0-beta2.tgz
    '';
  };

  # Rewrite the package-lock.json to point the three GitHub Packages deps at
  # their local store paths so fetchNpmDeps / npm ci can find them offline.
  patchedPackageLock =
    let
      lockFile = "${sources.src}/benchmark/package-lock.json";
    in
    stdenv.mkDerivation {
      name = "cockpit-benchmark-package-lock-patched.json";
      nativeBuildInputs = [ jq ];
      buildCommand = ''
        jq \
          --arg cssPath "${cockpitCssTarball}" \
          --arg helpersPath "${cockpitHelpersTarball}" \
          --arg vuePath "${cockpitVueComponentsTarball}" \
          '
            .packages["node_modules/@45drives/cockpit-css"].resolved      = ("file://" + $cssPath) |
            .packages["node_modules/@45drives/cockpit-helpers"].resolved   = ("file://" + $helpersPath) |
            .packages["node_modules/@45drives/cockpit-vue-components"].resolved = ("file://" + $vuePath)
          ' ${lockFile} > $out
      '';
    };
in
stdenv.mkDerivation (finalAttrs: {
  pname = "cockpit-benchmark";
  inherit version;

  src = sources.src;

  npmDeps = fetchNpmDeps {
    src = "${finalAttrs.src}/benchmark";
    packageLock = patchedPackageLock;
    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
  };

  nativeBuildInputs = [
    jq
    nodejs
    npmHooks.npmConfigHook
    npmHooks.npmBuildHook
  ];

  # fio is the runtime benchmark tool invoked by the plugin's backend script.
  passthru.cockpitPath = [ fio ];

  preConfigure = ''
    # npmConfigHook expects package.json and node_modules in the working dir
    cp -r benchmark/. .
    # replace package-lock.json with the patched version that uses store paths
    cp ${patchedPackageLock} package-lock.json
    chmod u+w package-lock.json
  '';

  preBuild = ''
    # Write version.js before vite build (mirrors what the Makefile does)
    pluginVersion="$(jq -r '.version' ../manifest.json)-$(jq -r '.build_number' ../manifest.json)"
    echo "export const pluginVersion = \"''${pluginVersion}\";" > src/version.js
  '';

  npmBuildScript = "build";

  installPhase = ''
    runHook preInstall

    mkdir -p $out/share/cockpit/benchmark
    cp -r dist/* $out/share/cockpit/benchmark/

    runHook postInstall
  '';

  meta = {
    description = "Cockpit storage benchmark utility using fio";
    homepage = "https://github.com/45Drives/cockpit-benchmark";
    changelog = "https://github.com/45Drives/cockpit-benchmark/releases/tag/v${version}";
    license = lib.licenses.gpl3Plus;
    platforms = lib.platforms.linux;
    maintainers = [ ];
  };
})