{
  lib,
  buildGoModule,
  buildNpmPackage,
  fetchFromGitHub,
}:

let
  version = "1.5.10";

  src = fetchFromGitHub {
    owner = "skyhook-io";
    repo = "radar";
    rev = "v${version}";
    hash = "sha256-Xvn1dDqCaBlXY/XD2GoWBDECMhxFlYCGlnVinLR/c1A=";
  };

  # Build the frontend as a separate derivation.
  # The lockfile has some workspace packages without resolved URLs,
  # so we patch them in postPatch before fetching dependencies.
  frontend = buildNpmPackage {
    pname = "radar-frontend";
    inherit version src;
    sourceRoot = "source";

    postPatch = ''
      # Fix missing resolved URLs for packages under web/node_modules/
      # that are actually external npm packages (not workspace links).
      # Insert "resolved" and "integrity" after the "version" field
      # for each affected package using sed.
      sed -i \
        -e '/"web\/node_modules\/@vitejs\/plugin-react"/,/^[[:space:]]*}/{
            /"version"/a\
        "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.0.1.tgz",\
        "integrity": "sha512-l9X/E3cDb+xY3SWzlG1MOGt2usfEHGMNIaegaUGFsLkb3RCn/k8/TOXBcab+OndDI4TBtktT8/9BwwW8Vi9KUQ==",
          }' \
        -e '/"web\/node_modules\/@rolldown\/pluginutils"/,/^[[:space:]]*}/{
            /"version"/a\
        "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.7.tgz",\
        "integrity": "sha512-qujRfC8sFVInYSPPMLQByRh7zhwkGFS4+tyMQ83srV1qrxL4g8E2tyxVVyxd0+8QeBM1mIk9KbWxkegRr76XzA==",
          }' \
        -e '/"web\/node_modules\/@types\/diff"/,/^[[:space:]]*}/{
            /"version"/a\
        "resolved": "https://registry.npmjs.org/@types/diff/-/diff-8.0.0.tgz",\
        "integrity": "sha512-o7jqJM04gfaYrdCecCVMbZhNdG6T1MHg/oQoRFdERLV+4d+V7FijhiEAbFu0Usww84Yijk9yH58U4Jk4HbtzZw==",
          }' \
        package-lock.json
    '';

    npmDepsHash = "sha256-qOODkgvCeHIcMUMOQpjlrDgnyqjooqQ7NmQH0vE8VQk=";
    npmDepsFetcherVersion = 2;
    makeCacheWritable = true;

    doCheck = false;

    # Build the web workspace and install its output
    buildPhase = ''
      runHook preBuild
      cd web
      HOME=$TMPDIR ../node_modules/.bin/vite build
      cd ..
      runHook postBuild
    '';

    installPhase = ''
      runHook preInstall
      mkdir -p $out
      cp -r web/dist/* $out/
      runHook postInstall
    '';
  };
in

buildGoModule {
  pname = "radar";
  inherit version src;

  vendorHash = "sha256-bmS4nRzVG4ZmpV3kq2Ih8uerRWL5weq0KP54jT3sh5I=";

  # Copy pre-built frontend assets before Go compilation for go:embed
  preBuild = ''
    mkdir -p internal/static/dist
    cp -r ${frontend}/* internal/static/dist/
  '';

  env.CGO_ENABLED = 0;

  subPackages = [ "cmd/explorer" ];

  doCheck = false;

  postInstall = ''
    ln -s $out/bin/explorer $out/bin/radar
  '';

  passthru = {
    category = "Kubernetes";
    inherit frontend;
    updateScript = [
      "nix-update"
      "--flake"
      ".#radar"
    ];
  };

  meta = with lib; {
    description = "Modern Kubernetes visibility — topology, event timeline, service traffic, resource browsing, Helm management, and GitOps support";
    homepage = "https://github.com/skyhook-io/radar";
    changelog = "https://github.com/skyhook-io/radar/releases/tag/v${version}";
    license = licenses.asl20;
    mainProgram = "radar";
    platforms = platforms.linux;
  };
}