{
  system ? builtins.currentSystem,
  sources ? import ../npins,
  # match the same versions we deploy locally
  inputs ? import sources.flake-inputs {
    root = ../.;
  },
  # match the same version of opentofu that is deployed by the root flake
  pkgs ? import inputs.nixpkgs {
    inherit system;
  },
}:
let
  inherit (pkgs) lib;
  setup = pkgs.writeScriptBin "setup" ''
    echo '${lib.strings.toJSON sources}' > .npins.json
    rm -f .terraform.lock.hcl
    rm -rf .terraform/
    tofu init
  '';
in
{
  # shell for testing TF directly
  shell = pkgs.mkShellNoCC {
    packages = [
      (import ./tf.nix { inherit lib pkgs; })
      pkgs.jaq
      setup
    ];
  };

  tests = pkgs.callPackage ./tests.nix { };

  # re-export inputs so they can be overridden granularly
  # (they can't be accessed from the outside any other way)
  inherit
    sources
    system
    pkgs
    ;
}