{
  buildGoModule,
  go,
}: let
  wasmExecJs =
    if builtins.pathExists "${go}/share/go/lib/wasm/wasm_exec.js"
    then "${go}/share/go/lib/wasm/wasm_exec.js"
    else if builtins.pathExists "${go}/lib/wasm/wasm_exec.js"
    then "${go}/lib/wasm/wasm_exec.js"
    else "${go}/share/go/misc/wasm/wasm_exec.js";
in
  buildGoModule {
    pname = "headplane-ssh-wasm";
    version = (builtins.fromJSON (builtins.readFile ../package.json)).version;
    src = ../.;
    subPackages = ["cmd/hp_ssh"];
    vendorHash = "sha256-MvrqKMD+A+qBZmzQv+T9920U5uJop+pjfJpZdm2ZqEA=";
    env.CGO_ENABLED = 0;

    nativeBuildInputs = [go];

    buildPhase = ''
      export GOOS=js
      export GOARCH=wasm

      # Patch Tailscale's derphttp to include DERPPort in WebSocket URLs.
      # Without this, DERP servers on non-443 ports fail in WASM builds.
      if [ -f patches/tailscale-derp-port.patch ]; then
        chmod -R +w vendor/tailscale.com
        patch -d vendor/tailscale.com -p1 < patches/tailscale-derp-port.patch
      fi

      go build -mod=vendor -o hp_ssh.wasm ./cmd/hp_ssh
    '';

    installPhase = ''
      mkdir -p $out
      cp hp_ssh.wasm $out/
      cp ${wasmExecJs} $out/wasm_exec.js
    '';
  }