{
  stdenv,

  buf,
  fetchPnpmDeps,
  nodejs,
  pnpm_10,
  pnpmConfigHook,

  protoImage,
  version,
  zitadelRepo,
}:

let
  pnpm = pnpm_10;

  # The workspace packages the console needs out of the repository-wide
  # pnpm-lock.yaml.
  pnpmDeps = fetchPnpmDeps {
    pname = "zitadel";
    inherit version pnpm;
    src = zitadelRepo;
    fetcherVersion = 4;
    pnpmWorkspaces = [
      "@zitadel/client"
      "@zitadel/console"
      "@zitadel/proto"
    ];
    hash = "sha256-8eW45vFB295KGIxdGIu+gpC9YDwZj0V+CTBZjx3i8aU=";
  };

  # packages/zitadel-proto, generated by @bufbuild/protoc-gen-es from its npm
  # dev dependencies against protoImage instead of the proto tree.
  protoPackageGenerated = stdenv.mkDerivation {
    pname = "zitadel-proto-buf-generated";
    inherit version;

    src = zitadelRepo;

    inherit pnpmDeps;
    pnpmWorkspaces = [ "@zitadel/proto" ];

    nativeBuildInputs = [
      buf
      nodejs
      pnpm
      pnpmConfigHook
    ];

    buildPhase = ''
      runHook preBuild
      cd packages/zitadel-proto
      export PATH="$PWD/node_modules/.bin:$PATH"
      HOME=$TMPDIR buf generate ${protoImage}#format=binpb
      runHook postBuild
    '';

    installPhase = ''
      runHook preInstall
      mkdir -p $out
      cp -r es cjs types $out/
      runHook postInstall
    '';
  };
in
{
  inherit pnpm pnpmDeps protoPackageGenerated;
}