partially in-house <nixpkgs/lib>
big day: upcast infra (resources) doesn't need nixpkgs any more