{
  lib,
  pkgs,
  sources ? import ../npins,
  ...
}:
pkgs.stdenv.mkDerivation {
  name = "tf-repo";
  src =
    with lib.fileset;
    toSource {
      root = ../.;
      # don't copy ignored files
      fileset = intersection (gitTracked ../.) ../.;
    };
  buildInputs = [
    (import ./tf.nix { inherit lib pkgs; })
  ];
  buildPhase = ''
    runHook preBuild
    pushd launch/
    # calculated pins
    echo '${lib.strings.toJSON sources}' > .npins.json
    # generate TF lock for nix's TF providers
    tofu init -input=false
    popd
    runHook postBuild
  '';
  installPhase = ''
    runHook preInstall
    cp -r . $out
    runHook postInstall
  '';
}