{
  lib,
  newScope,
  makeDesktopItem,
  writeShellScript,
  writeShellScriptBin,
}:

lib.makeScope newScope (self: {
  # Scope-level configuration for adapters
  useSessionUnits = true; # use --user units, instead of system units
  vmUnitPrefix = "uvm@";
  vmSshPrefix = if self.useSessionUnits then "uuvm/" else "uvm/";
  vmUser = "user";
  waylandProxyUnit = "wayland-proxy.service"; # could be sommelier
  oomScoreAdjust = -200;

  # Helper scripts
  mkRunInVM = vmName: lib.getExe (self.mkRunInVMPkg vmName);
  mkRunInVMPkg =
    vmName:
    lib.warn "Use `\${runInVM} foobar` instead of `\${mkRunInVMPkg foobar}`" (
      writeShellScriptBin "run-in-${vmName}" "${lib.getExe self.runInVM} ${vmName} $@"
    );
  runInVM = writeShellScriptBin "run-in" ''
    vmName=$1
    shift
    localArgs=(
    ${lib.optionalString self.useSessionUnits "--user"}
    --property=Requires="${self.vmUnitPrefix}$vmName".service
    --property=After="${self.vmUnitPrefix}$vmName".service
    --property=SyslogIdentifier="$1 ($vmName)"
    )
    remoteArgs=(
    systemd-run
    --user
    --property=StandardError="journal+console"
    --property=StandardOutput="journal+console"
    --property=OOMScoreAdjust=${toString self.oomScoreAdjust}
    ${lib.optionalString (self.waylandProxyUnit != null) ''
      --property=Requires=${self.waylandProxyUnit}
      --property=After=${self.waylandProxyUnit}
    ''}
    )
    systemd-run \
      "''${localArgs[@]}" \
      ssh "${self.vmUser}@${self.vmSshPrefix}$vmName" \
          "''${remoteArgs[@]}" $@
  '';

  # Actual .desktop item adapters
  toVM =
    vmName: attrs:
    attrs
    // {
      exec = "${self.mkRunInVM vmName} ${attrs.exec}";
    };
  toBrowser =
    attrs:
    attrs
    // {
      categories = attrs.categories or [ ] ++ [
        "WebBrowser"
        "Network"
      ];
      mimeTypes = attrs.mimeTypes or [ ] ++ [
        "x-scheme-handler/http"
        "x-scheme-handler/https"
      ];
    };
})