{
  system ? builtins.currentSystem,
  sources ? import ../npins,
  inputs ? import sources.flake-inputs {
    root = ../.;
  },
  # match the same version of opentofu that is deployed by the root flake
  pkgs ? import inputs.nixpkgs {
    inherit system;
  },
}:
let
  inherit (pkgs) lib;
in
{
  shell = pkgs.mkShellNoCC {
    packages = [
      pkgs.npins
      pkgs.jq # implicit dep of nixos-anywhere TF: https://github.com/nix-community/nixos-anywhere/issues/416
      (import ./tf.nix { inherit lib pkgs; })
    ];
  };

  # re-export inputs so they can be overridden granularly
  # (they can't be accessed from the outside any other way)
  inherit
    sources
    system
    pkgs
    ;
}