{
  lib,
  buildNpmPackage,
  nodejs_22,
  makeWrapper,
  sources,
}:

buildNpmPackage {
  pname = "auth2api";
  version = "${sources.auth2api.version}-thinking3";
  src = sources.auth2api.src;

  nodejs = nodejs_22;

  npmDepsHash = "sha256-lHwY5MQ0nRoOPcURzmJCiXiUxEx9ZwZJSWKbkD4ZuIA=";

  # Patch to allow running with an empty api-keys list (unauthenticated).
  # Safe because the service binds to 127.0.0.1 by default.
  patches = [
    ./no-auth.patch
    ./thinking.patch
  ];

  # auth2api's build script is `tsc` (TypeScript compile → dist/)
  # devDeps (typescript, tsx) are needed for the build; buildNpmPackage
  # prunes them automatically after the build step completes.
  npmBuildScript = "build";

  nativeBuildInputs = [ makeWrapper ];

  # buildNpmPackage installs the package under $out/lib/node_modules/auth2api/.
  # Wire up a $out/bin/auth2api wrapper pointing at the compiled entry-point.
  postInstall = ''
    makeWrapper ${nodejs_22}/bin/node $out/bin/auth2api \
      --add-flags "$out/lib/node_modules/auth2api/dist/index.js"
  '';

  meta = {
    description = "Lightweight Claude OAuth to OpenAI-compatible API proxy";
    homepage = "https://github.com/AmazingAng/auth2api";
    license = lib.licenses.mit;
    maintainers = [ ];
    platforms = lib.platforms.linux;
    mainProgram = "auth2api";
  };
}