{
  # devkit is also usable as a `nix flake init` template:
  #
  #   mkdir newthing && cd newthing
  #   nix flake init -t path:/home/btburke/projects/devkit
  #
  # (or `-t git+https://knot.rtw.run/rtw.run/devkit` once published).
  # NOTE: `devenv init` has no template flag (#1718); `--from` only affects
  # `devenv shell`/`test`/`build`, not `init`. Use the flake template above.
  description = "devkit - personal devenv module, the tools it pins, and a new-project template";

  # The tools every project gets, pinned here (flake.lock) and nowhere else: a
  # project declares only devkit, and `devenv update devkit` moves it to these.
  inputs = {
    bug.url = "git+https://knot.rtw.run/rtw.run/bug";
    secrets.url = "git+https://knot.rtw.run/rtw.run/secrets";
    local-code-review.url = "git+https://knot.rtw.run/rtw.run/local-code-review";
  };

  outputs = { self, bug, secrets, local-code-review }:
  let
    # devkit's release: bump with each tag (vX.Y.Z). devenv.nix reads it as
    # inputs.devkit.lib.version and exports it as $DEVKIT_VERSION.
    version = "1.7.3";
    systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
    forAll = f: builtins.listToAttrs (map (system: { name = system; value = f system; }) systems);
  in {
    lib.version = version;

    # What devenv.nix adds to a project's shell (inputs.devkit.packages).
    packages = forAll (system: {
      bug = bug.packages.${system}.bug;
      secrets = secrets.packages.${system}.default;
      local-code-review = local-code-review.packages.${system}.default;
    });

    templates.default = {
      description = "New project wired to devkit (tools + customized bash env)";
      path = ./template;
    };
    templates.devkit = self.templates.default;
  };
}