{
  pkgs,
  lib,
  sources,
}:
pkgs.writeScriptBin "setup" ''
  # calculated pins
  echo '${lib.strings.toJSON sources}' > ./.npins.json
  # generate TF lock for nix's TF providers
  for category in deployment/check/data-model-tf; do
    pushd "$category"
    rm -rf .terraform/
    rm -f .terraform.lock.hcl
    # suppress warning on architecture-specific generated lock file:
    # `Warning: Incomplete lock file information for providers`.
    tofu init -input=false 1>/dev/null
    popd
  done
''