envref 0.1.0__py3-none-any.whl

envref/__init__.py

@@ -0,0 +1,40 @@
+"""envref — a .env where any value can be a reference into a secret store.
+
+    ATTIO_KEY={{ op://vault/Attio/api_key }}
+    DB_PASSWORD={{ keychain://myapp/db }}
+    TLS_KEY={{ file://~/.ssh/server.pem }}
+    REGION=eu-north-1
+
+    >>> import envref
+    >>> envref.load(".env")          # resolves every reference, exports the rest
+
+The scheme of a reference picks the resolver. Four ship built in (`op`,
+`keychain`, `file`, `env`); others register through the `envref.resolvers`
+entry-point group.
+"""
+
+from envref.core import (
+    EnvrefError,
+    Resolver,
+    ResolveError,
+    ResolverUnavailable,
+    UnknownScheme,
+    load,
+    resolve,
+)
+from envref.parse import Entry, parse
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "Entry",
+    "EnvrefError",
+    "ResolveError",
+    "Resolver",
+    "ResolverUnavailable",
+    "UnknownScheme",
+    "__version__",
+    "load",
+    "parse",
+    "resolve",
+]

envref/cli.py

@@ -0,0 +1,166 @@
+"""`envref` command line: run a command with references resolved, export them,
+check a file without printing values, inspect the backends."""
+
+from __future__ import annotations
+
+import argparse
+import getpass
+import json
+import os
+import shlex
+import sys
+from pathlib import Path
+
+from envref import __version__
+from envref.core import EnvrefError, ResolveError, load, resolve
+from envref.parse import parse_file
+
+
+def _files(args: argparse.Namespace) -> list[str]:
+    return args.file or [".env"]
+
+
+def cmd_run(args: argparse.Namespace) -> int:
+    if not args.command:
+        print("envref run: no command given (use `envref run -- cmd args`)", file=sys.stderr)
+        return 2
+    env = dict(os.environ)
+    load(*_files(args), override=args.override, environ=env)
+    os.execvpe(args.command[0], args.command, env)
+    return 0  # unreachable
+
+
+def cmd_export(args: argparse.Namespace) -> int:
+    values = load(*_files(args), export=False)
+    if args.format == "json":
+        print(json.dumps(values, indent=2))
+    elif args.format == "dotenv":
+        for name, value in values.items():
+            print(f"{name}={json.dumps(value)}")
+    else:
+        for name, value in values.items():
+            print(f"export {name}={shlex.quote(value)}")
+    return 0
+
+
+def cmd_check(args: argparse.Namespace) -> int:
+    """Resolve everything and report per key, never printing a value."""
+    from envref.resolvers import registry
+
+    resolvers = registry()
+    failed = False
+    for file in _files(args):
+        path = Path(file).expanduser()
+        if not path.exists():
+            print(f"{file}: not found")
+            failed = True
+            continue
+        entries = parse_file(path)
+        print(f"{file}: {len(entries)} entries")
+        try:
+            resolve(entries, registry=resolvers)
+            failures: dict[str, str] = {}
+        except ResolveError as exc:
+            failures = exc.failures
+            failed = True
+        except EnvrefError as exc:
+            print(f"  error: {exc}")
+            failed = True
+            continue
+        for entry in entries:
+            if entry.ref is None or entry.scheme not in resolvers:
+                kind = "literal"
+                mark = "·"
+            else:
+                kind = f"{entry.scheme}://"
+                mark = "✗" if entry.ref in failures else "✓"
+            line = f"  {mark} {entry.name:<40} {kind}"
+            if entry.ref in failures:
+                line += f"  {failures[entry.ref]}"
+            print(line)
+    return 1 if failed else 0
+
+
+def cmd_doctor(args: argparse.Namespace) -> int:
+    from envref.resolvers import registry
+
+    print(f"envref {__version__}")
+    for scheme, resolver in sorted(registry().items()):
+        status = resolver.doctor() if hasattr(resolver, "doctor") else "ok"
+        print(f"  {scheme + '://':<12} {type(resolver).__module__}.{type(resolver).__name__}  {status}")
+    return 0
+
+
+def cmd_op_save_password(args: argparse.Namespace) -> int:
+    from envref.resolvers import op
+
+    account = args.account or op.resolve_account()
+    if not account:
+        print("no 1Password account found; pass --account <shorthand>", file=sys.stderr)
+        return 1
+    password = getpass.getpass(f"1Password account password for {account}: ")
+    if not password:
+        return 1
+    service, name = op.save_password(account, password)
+    print(f"Stored in Keychain as service={service} account={name}.")
+    print("envref will read it behind Touch ID when a session needs renewing.")
+    return 0
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="envref",
+        description="A .env where any value can be a reference into a secret store.",
+    )
+    parser.add_argument("--version", action="version", version=f"envref {__version__}")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+
+    def add_files(p: argparse.ArgumentParser) -> None:
+        p.add_argument(
+            "-f", "--file", action="append", metavar="FILE",
+            help="env file to load; repeat for several, first to set a name wins (default .env)",
+        )
+
+    run = sub.add_parser("run", help="run a command with the resolved environment")
+    add_files(run)
+    run.add_argument("--override", action="store_true", help="let the file override existing variables")
+    run.add_argument("command", nargs=argparse.REMAINDER, help="command and arguments, after --")
+    run.set_defaults(func=cmd_run)
+
+    export = sub.add_parser("export", help="print the resolved variables")
+    add_files(export)
+    export.add_argument("--format", choices=["shell", "dotenv", "json"], default="shell")
+    export.set_defaults(func=cmd_export)
+
+    check = sub.add_parser("check", help="resolve every reference and report, without printing values")
+    add_files(check)
+    check.set_defaults(func=cmd_check)
+
+    doctor = sub.add_parser("doctor", help="list installed resolvers and whether each can run here")
+    doctor.set_defaults(func=cmd_doctor)
+
+    op = sub.add_parser("op", help="1Password helpers")
+    op_sub = op.add_subparsers(dest="op_cmd", required=True)
+    save = op_sub.add_parser(
+        "save-password", help="store the account password in macOS Keychain for Touch ID sign-in"
+    )
+    save.add_argument("--account", help="account shorthand (default: the only signed-in account)")
+    save.set_defaults(func=cmd_op_save_password)
+
+    return parser
+
+
+def main(argv: list[str] | None = None) -> None:
+    args = build_parser().parse_args(argv)
+    if getattr(args, "command", None) and args.command[0] == "--":
+        args.command = args.command[1:]
+    try:
+        code = args.func(args)
+    except EnvrefError as exc:
+        print(f"envref: {exc}", file=sys.stderr)
+        code = 1
+    sys.exit(code)
+
+
+if __name__ == "__main__":
+    main()

envref/core.py

@@ -0,0 +1,135 @@
+"""Resolve parsed entries through the resolver each scheme names, and export."""
+
+from __future__ import annotations
+
+import os
+from collections.abc import Iterable, Mapping, Sequence
+from pathlib import Path
+from typing import Protocol, runtime_checkable
+
+from envref.parse import Entry, parse_file
+
+
+class EnvrefError(Exception):
+    """Base class; everything envref raises on purpose derives from it."""
+
+
+class UnknownScheme(EnvrefError):
+    """A `{{ scheme://… }}` reference whose scheme has no resolver installed."""
+
+
+class ResolverUnavailable(EnvrefError):
+    """The resolver exists but cannot run here: no `op` binary, not macOS, no token."""
+
+
+class ResolveError(EnvrefError):
+    """One or more references could not be resolved. `failures` maps ref → reason."""
+
+    def __init__(self, failures: Mapping[str, str], hint: str = "") -> None:
+        self.failures = dict(failures)
+        lines = [f"  {ref}: {reason}" for ref, reason in sorted(self.failures.items())]
+        message = "could not resolve:\n" + "\n".join(lines)
+        if hint:
+            message += f"\n{hint}"
+        super().__init__(message)
+
+
+@runtime_checkable
+class Resolver(Protocol):
+    """What a scheme's backend provides. `resolve` gets every reference of its
+    scheme in one call so backends can batch (one round trip, one unlock)."""
+
+    scheme: str
+
+    def resolve(self, refs: Sequence[str]) -> dict[str, str]:
+        """Map each reference to its value. Raise `ResolveError` for the ones
+        that fail, `ResolverUnavailable` when the backend cannot run at all."""
+        ...
+
+
+def _registry(registry: Mapping[str, Resolver] | None) -> Mapping[str, Resolver]:
+    if registry is not None:
+        return registry
+    from envref.resolvers import registry as default_registry
+
+    return default_registry()
+
+
+def resolve(
+    entries: Iterable[Entry], *, registry: Mapping[str, Resolver] | None = None
+) -> dict[str, str]:
+    """Return name → value for every entry, references resolved.
+
+    References are grouped by scheme and handed to that scheme's resolver in
+    one call. A bare (brace-less) reference whose scheme has no resolver is
+    kept as the literal it probably was; an explicit `{{ }}` one raises.
+    """
+    resolvers = _registry(registry)
+    entries = list(entries)
+
+    by_scheme: dict[str, list[str]] = {}
+    for entry in entries:
+        if entry.ref is None:
+            continue
+        scheme = entry.scheme or ""
+        if scheme not in resolvers:
+            if entry.explicit:
+                known = ", ".join(sorted(resolvers)) or "none"
+                raise UnknownScheme(
+                    f"{entry.name} (line {entry.line}): no resolver for '{scheme}://'. "
+                    f"Installed: {known}."
+                )
+            continue
+        by_scheme.setdefault(scheme, []).append(entry.ref)
+
+    values: dict[str, str] = {}
+    for scheme, refs in by_scheme.items():
+        unique = sorted(set(refs))
+        resolved = resolvers[scheme].resolve(unique)
+        missing = [ref for ref in unique if ref not in resolved]
+        if missing:
+            raise ResolveError({ref: "resolver returned no value" for ref in missing})
+        values.update(resolved)
+
+    result: dict[str, str] = {}
+    for entry in entries:
+        if entry.ref is not None and entry.ref in values:
+            result[entry.name] = values[entry.ref]
+        else:
+            result[entry.name] = entry.value
+    return result
+
+
+def load(
+    *paths: str | Path,
+    export: bool = True,
+    override: bool = False,
+    registry: Mapping[str, Resolver] | None = None,
+    environ: dict[str, str] | None = None,
+) -> dict[str, str]:
+    """Resolve one or more env files and, by default, export into `os.environ`.
+
+    Files are read in order and the first file to set a name wins, so
+    `load(".env.op", ".env")` lets a local `.env` fill in what the references
+    file lacks without overriding it. Missing files are skipped. Variables
+    already in the environment are kept unless `override=True`.
+    """
+    environ = os.environ if environ is None else environ
+    entries: list[Entry] = []
+    seen: set[str] = set()
+    for path in paths or (".env",):
+        file = Path(path).expanduser()
+        if not file.exists():
+            continue
+        for entry in parse_file(file):
+            if entry.name in seen:
+                continue
+            seen.add(entry.name)
+            entries.append(entry)
+
+    values = resolve(entries, registry=registry)
+    if export:
+        for name, value in values.items():
+            if override or name not in environ:
+                environ[name] = value
+    return values

envref/parse.py

@@ -0,0 +1,76 @@
+"""Read a `.env` file into entries, telling references from literals.
+
+The grammar is the ordinary dotenv one — `KEY=value`, optional `export `,
+`#` comments, single or double quotes — plus one rule: a value that is
+`{{ scheme://… }}` is a *reference*, to be resolved before export. That is
+`op inject`'s mustache syntax, so files written for it are valid as they are.
+
+A bare `scheme://…` without braces is also flagged as a possible reference,
+because the 1Password SDK and `op read` speak that form. Whether it is treated
+as one is decided later, by whether a resolver for that scheme exists: an
+`https://` URL stays a literal, an `op://` without braces resolves.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+_ASSIGNMENT = re.compile(r"^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$")
+_MUSTACHE = re.compile(r"^\{\{\s*([A-Za-z][A-Za-z0-9+.-]*://[^}]*?)\s*\}\}$")
+_BARE = re.compile(r"^([A-Za-z][A-Za-z0-9+.-]*)://\S+$")
+
+
+@dataclass(frozen=True)
+class Entry:
+    name: str
+    value: str
+    """The literal value, or the reference text (`scheme://…`) when `ref` is set."""
+    ref: str | None
+    """`scheme://…` for a reference, None for a literal."""
+    explicit: bool
+    """True when the reference was written with `{{ }}`: an unknown scheme is then an error."""
+    line: int
+
+    @property
+    def scheme(self) -> str | None:
+        return self.ref.partition("://")[0] if self.ref else None
+
+
+def _unquote(value: str) -> str:
+    if len(value) >= 2 and value[0] == value[-1] and value[0] in ("'", '"'):
+        inner = value[1:-1]
+        if value[0] == '"':
+            inner = inner.replace(r"\n", "\n").replace(r"\"", '"').replace(r"\\", "\\")
+        return inner
+    # An unquoted value ends at ` #`, the way dotenv parsers agree it does.
+    head, _sep, _comment = value.partition(" #")
+    return head.rstrip()
+
+
+def parse(text: str) -> list[Entry]:
+    """Every assignment in `text`, in file order. Later duplicates win at load time."""
+    entries: list[Entry] = []
+    for number, raw in enumerate(text.splitlines(), start=1):
+        if not raw.strip() or raw.lstrip().startswith("#"):
+            continue
+        match = _ASSIGNMENT.match(raw)
+        if match is None:
+            continue
+        name, value = match.group(1), match.group(2)
+        mustache = _MUSTACHE.match(value)
+        if mustache:
+            entries.append(Entry(name, mustache.group(1), mustache.group(1), True, number))
+            continue
+        value = _unquote(value)
+        bare = _BARE.match(value)
+        if bare:
+            entries.append(Entry(name, value, value, False, number))
+        else:
+            entries.append(Entry(name, value, None, False, number))
+    return entries
+
+
+def parse_file(path: str | Path) -> list[Entry]:
+    return parse(Path(path).expanduser().read_text())

envref/resolvers/__init__.py

@@ -0,0 +1,33 @@
+"""Find resolvers: the built-in four plus anything installed under the
+`envref.resolvers` entry-point group (name = scheme, value = `module:Class`)."""
+
+from __future__ import annotations
+
+from functools import lru_cache
+from importlib.metadata import entry_points
+
+from envref.core import Resolver
+
+_GROUP = "envref.resolvers"
+
+
+def _builtins() -> dict[str, Resolver]:
+    from envref.resolvers.env import EnvResolver
+    from envref.resolvers.file import FileResolver
+    from envref.resolvers.keychain import KeychainResolver
+    from envref.resolvers.op import OnePasswordResolver
+
+    found = [EnvResolver(), FileResolver(), KeychainResolver(), OnePasswordResolver()]
+    return {r.scheme: r for r in found}
+
+
+@lru_cache(maxsize=1)
+def registry() -> dict[str, Resolver]:
+    """Scheme → resolver instance. Entry points override built-ins of the same name,
+    so a user can swap the 1Password implementation without forking."""
+    found = _builtins()
+    for ep in entry_points(group=_GROUP):
+        if ep.value.startswith("envref.resolvers."):
+            continue  # our own registrations, already instantiated above
+        found[ep.name] = ep.load()()
+    return found

envref/resolvers/env.py

@@ -0,0 +1,29 @@
+"""`env://NAME` — another environment variable. Useful for aliasing a name a
+library insists on (`GITHUB_TOKEN={{ env://GH_TOKEN }}`)."""
+
+from __future__ import annotations
+
+import os
+from collections.abc import Sequence
+
+from envref.core import ResolveError
+
+
+class EnvResolver:
+    scheme = "env"
+
+    def resolve(self, refs: Sequence[str]) -> dict[str, str]:
+        values: dict[str, str] = {}
+        failures: dict[str, str] = {}
+        for ref in refs:
+            name = ref.partition("://")[2]
+            if name in os.environ:
+                values[ref] = os.environ[name]
+            else:
+                failures[ref] = f"{name} is not set"
+        if failures:
+            raise ResolveError(failures)
+        return values
+
+    def doctor(self) -> str:
+        return "ok"

envref/resolvers/file.py

@@ -0,0 +1,33 @@
+"""`file://path` — a file's contents, for keys and certificates that libraries
+want as a string (`TLS_KEY={{ file://~/.ssh/server.pem }}`). `~` expands; a
+relative path is relative to the working directory. One trailing newline is
+dropped, since nothing wants it in an environment variable."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from pathlib import Path
+
+from envref.core import ResolveError
+
+
+class FileResolver:
+    scheme = "file"
+
+    def resolve(self, refs: Sequence[str]) -> dict[str, str]:
+        values: dict[str, str] = {}
+        failures: dict[str, str] = {}
+        for ref in refs:
+            path = Path(ref.partition("://")[2]).expanduser()
+            try:
+                text = path.read_text()
+            except OSError as exc:
+                failures[ref] = exc.strerror or str(exc)
+                continue
+            values[ref] = text[:-1] if text.endswith("\n") else text
+        if failures:
+            raise ResolveError(failures)
+        return values
+
+    def doctor(self) -> str:
+        return "ok"

envref/resolvers/keychain.py

@@ -0,0 +1,80 @@
+"""`keychain://service/account` — a macOS Keychain generic password.
+
+Reads with `security find-generic-password -w`. macOS shows its own
+authorisation dialog when the item's access control asks for one. Set
+`ENVREF_KEYCHAIN_TOUCH_ID=1` to require Touch ID in front of every read via the
+bundled helper (see `envref.touchid`). Store an item with:
+
+    security add-generic-password -U -s <service> -a <account> -w
+"""
+
+from __future__ import annotations
+
+import os
+import platform
+import shutil
+import subprocess
+from collections.abc import Sequence
+
+from envref.core import ResolveError, ResolverUnavailable
+
+
+def read_generic_password(service: str, account: str | None) -> str | None:
+    """The password, or None when the item does not exist or the user declined."""
+    cmd = ["security", "find-generic-password", "-w", "-s", service]
+    if account:
+        cmd += ["-a", account]
+    result = subprocess.run(cmd, capture_output=True, text=True, check=False)
+    if result.returncode != 0:
+        return None
+    return result.stdout.rstrip("\n") or None
+
+
+def save_generic_password(service: str, account: str, password: str) -> None:
+    """Create or update (-U) the item. The creating tool, `security`, is placed on
+    the item's access list, so later reads from it are silent."""
+    subprocess.run(
+        ["security", "add-generic-password", "-U", "-s", service, "-a", account, "-w", password],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+
+
+class KeychainResolver:
+    scheme = "keychain"
+
+    def available(self) -> str | None:
+        """Why this resolver cannot run here, or None when it can."""
+        if platform.system() != "Darwin":
+            return "macOS Keychain is only available on macOS"
+        if not shutil.which("security"):
+            return "the `security` tool is not on PATH"
+        return None
+
+    def resolve(self, refs: Sequence[str]) -> dict[str, str]:
+        reason = self.available()
+        if reason:
+            raise ResolverUnavailable(reason)
+
+        touch_id = os.environ.get("ENVREF_KEYCHAIN_TOUCH_ID", "") not in ("", "0", "false")
+        values: dict[str, str] = {}
+        failures: dict[str, str] = {}
+        for ref in refs:
+            service, _, account = ref.partition("://")[2].partition("/")
+            if touch_id:
+                from envref.touchid import read_password_with_touch_id
+
+                value = read_password_with_touch_id(service, account or None, "unlock the keychain")
+            else:
+                value = read_generic_password(service, account or None)
+            if value is None:
+                failures[ref] = "no such item, or access was denied"
+            else:
+                values[ref] = value
+        if failures:
+            raise ResolveError(failures)
+        return values
+
+    def doctor(self) -> str:
+        return self.available() or "ok"

envref/resolvers/op.py

@@ -0,0 +1,347 @@
+"""`op://vault/item/field` — 1Password.
+
+Two ways to ask, picked by the environment:
+
+* **Service account** when `OP_SERVICE_ACCOUNT_TOKEN` is set: the `onepassword-sdk`
+  package (`pip install envref[op]`), no binary, no biometrics, nobody present.
+  For containers and scheduled jobs.
+* **CLI** otherwise: the `op` binary on PATH. All references go through one
+  `op inject` call. If that fails for want of a session, `op signin` mints one,
+  the account password coming from macOS Keychain behind Touch ID when
+  `envref op save-password` has stored it there, or from the terminal when not.
+  The session token is cached (see SECURITY.md) so a burst of commands costs one
+  sign-in rather than one each; concurrent processes share it through a lock.
+
+Session caching presumes "biometric unlock for the 1Password CLI" is *off* in
+the 1Password app. With it on, `op signin --raw` returns nothing and `op`
+prompts per invocation; this resolver then degrades to a single `op inject`.
+
+Environment knobs: `OP_ACCOUNT` (shorthand, when several accounts are signed
+in), `ENVREF_OP_SESSION_TTL` (seconds, default 1500, 0 disables the cache),
+`ENVREF_OP_KEYCHAIN_SERVICE` (default `envref-op`), `ENVREF_OP_KEYCHAIN_ACCOUNT`
+(default: the account's email).
+"""
+
+from __future__ import annotations
+
+import asyncio
+import fcntl
+import json
+import os
+import re
+import secrets
+import shutil
+import subprocess
+import time
+from collections.abc import Iterator, Sequence
+from concurrent.futures import ThreadPoolExecutor
+from contextlib import contextmanager
+from pathlib import Path
+
+from envref.core import ResolveError, ResolverUnavailable
+from envref.touchid import cache_dir
+
+KEYCHAIN_SERVICE_DEFAULT = "envref-op"
+_INTEGRATION_NAME = "envref"
+_INTEGRATION_VERSION = "v1.0.0"
+
+
+def session_ttl() -> int:
+    """Buffer under op's ~30-minute sliding timeout, so renewal happens before a
+    mid-run auth failure. 0 disables caching altogether."""
+    return int(os.environ.get("ENVREF_OP_SESSION_TTL", 25 * 60))
+
+
+def session_cache_path() -> Path:
+    return cache_dir() / "op-session.json"
+
+
+def keychain_service() -> str:
+    return os.environ.get("ENVREF_OP_KEYCHAIN_SERVICE", KEYCHAIN_SERVICE_DEFAULT)
+
+
+# --- session cache --------------------------------------------------------
+
+
+def read_cached_session() -> dict | None:
+    path = session_cache_path()
+    if session_ttl() <= 0 or not path.exists():
+        return None
+    try:
+        data = json.loads(path.read_text())
+    except (OSError, json.JSONDecodeError):
+        return None
+    if not (data.get("account") and data.get("token")):
+        return None
+    if time.time() - float(data.get("mtime", 0)) > session_ttl():
+        return None
+    return data
+
+
+def write_cached_session(account: str, token: str) -> None:
+    if session_ttl() <= 0:
+        return
+    path = session_cache_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.parent.chmod(0o700)
+    tmp = path.with_suffix(".json.tmp")
+    tmp.write_text(json.dumps({"account": account, "token": token, "mtime": time.time()}))
+    tmp.chmod(0o600)
+    tmp.replace(path)
+
+
+def touch_cached_session() -> None:
+    """A successful use extends op's sliding window; mirror that in the cache."""
+    path = session_cache_path()
+    if not path.exists():
+        return
+    try:
+        data = json.loads(path.read_text())
+        data["mtime"] = time.time()
+        path.write_text(json.dumps(data))
+        path.chmod(0o600)
+    except (OSError, json.JSONDecodeError):
+        return
+
+
+@contextmanager
+def _signin_lock() -> Iterator[None]:
+    """Serialise sign-ins across processes, so shells that start together on an
+    expired session raise one Touch ID prompt rather than one each."""
+    lock = cache_dir() / "op-signin.lock"
+    lock.parent.mkdir(parents=True, exist_ok=True)
+    with lock.open("w") as handle:
+        fcntl.flock(handle, fcntl.LOCK_EX)
+        try:
+            yield
+        finally:
+            fcntl.flock(handle, fcntl.LOCK_UN)
+
+
+# --- accounts -------------------------------------------------------------
+
+
+def _accounts() -> list[dict]:
+    result = subprocess.run(
+        ["op", "account", "list", "--format=json"], capture_output=True, text=True, check=False
+    )
+    if result.returncode != 0:
+        return []
+    try:
+        return json.loads(result.stdout or "[]")
+    except json.JSONDecodeError:
+        return []
+
+
+def resolve_account(cached: dict | None = None) -> str | None:
+    """The account shorthand to sign in to: `OP_ACCOUNT`, else the cached one,
+    else the only signed-in account. Several accounts with no `OP_ACCOUNT` is an
+    error, since guessing would sign in to the wrong vault."""
+    if os.environ.get("OP_ACCOUNT"):
+        return os.environ["OP_ACCOUNT"]
+    if cached and cached.get("account"):
+        return cached["account"]
+    accounts = _accounts()
+    if len(accounts) == 1:
+        return accounts[0].get("shorthand") or accounts[0].get("account_uuid")
+    if len(accounts) > 1:
+        raise ResolveError(
+            {"op://": "several 1Password accounts are signed in"},
+            "Set OP_ACCOUNT to the shorthand of the one to use.",
+        )
+    return None
+
+
+def account_email(account: str) -> str | None:
+    for acct in _accounts():
+        if account in (
+            acct.get("shorthand"),
+            acct.get("email"),
+            acct.get("account_uuid"),
+            acct.get("user_uuid"),
+        ):
+            return acct.get("email")
+    return None
+
+
+def keychain_account(account: str) -> str:
+    return os.environ.get("ENVREF_OP_KEYCHAIN_ACCOUNT") or account_email(account) or account
+
+
+def signin(account: str) -> str | None:
+    """Mint a session token. The password comes from Keychain (behind Touch ID)
+    when stored; otherwise `op signin` prompts on the terminal."""
+    from envref.touchid import read_password_with_touch_id
+
+    password = read_password_with_touch_id(
+        keychain_service(), keychain_account(account), "unlock the 1Password session"
+    )
+    cmd = ["op", "signin", "--raw", "--account", account]
+    if password is not None:
+        result = subprocess.run(
+            cmd, input=password + "\n", capture_output=True, text=True, check=False
+        )
+    else:
+        result = subprocess.run(cmd, stdout=subprocess.PIPE, text=True, check=False)
+    if result.returncode != 0:
+        return None
+    return result.stdout.strip() or None
+
+
+def save_password(account: str, password: str) -> tuple[str, str]:
+    """Store the account password in Keychain for `signin`. Returns (service, account)."""
+    from envref.resolvers.keychain import save_generic_password
+
+    service, name = keychain_service(), keychain_account(account)
+    save_generic_password(service, name, password)
+    return service, name
+
+
+# --- resolution -----------------------------------------------------------
+
+
+def _template(refs: Sequence[str], marker: str) -> str:
+    """One `op inject` template for every reference. Values are fenced by a
+    per-run random marker, so a multi-line value (a PEM key) survives intact."""
+    return "".join(f"{marker}{i}{marker}{{{{ {ref} }}}}{marker}\n" for i, ref in enumerate(refs))
+
+
+def _parse_injected(output: str, refs: Sequence[str], marker: str) -> dict[str, str]:
+    pattern = re.compile(re.escape(marker) + r"(\d+)" + re.escape(marker) + r"(.*?)" + re.escape(marker), re.S)
+    return {refs[int(index)]: value for index, value in pattern.findall(output)}
+
+
+def _inject(refs: Sequence[str], env: dict[str, str]) -> tuple[dict[str, str] | None, str]:
+    """Resolve via `op inject`. (values, "") on success, (None, stderr) on failure."""
+    # Printable on purpose: `op inject` drops control characters from its output.
+    marker = f"@envref{secrets.token_hex(8)}@"
+    result = subprocess.run(
+        ["op", "inject"],
+        input=_template(refs, marker),
+        capture_output=True,
+        text=True,
+        env=env,
+        check=False,
+    )
+    if result.returncode != 0:
+        return None, result.stderr.strip()
+    return _parse_injected(result.stdout, refs, marker), ""
+
+
+def _looks_like_auth_failure(stderr: str) -> bool:
+    """Only an authentication failure is worth a sign-in and retry; a reference
+    that does not exist would fail again identically."""
+    text = stderr.lower()
+    if not text:
+        return True
+    return any(
+        s in text
+        for s in ("signed in", "sign in", "signin", "session", "unauthori", "authenticat", "401")
+    )
+
+
+class OnePasswordResolver:
+    scheme = "op"
+
+    # -- service account --
+    def _resolve_sdk(self, refs: Sequence[str], token: str) -> dict[str, str]:
+        try:
+            from onepassword.client import Client
+        except ImportError as exc:
+            raise ResolverUnavailable(
+                "OP_SERVICE_ACCOUNT_TOKEN is set but the 1Password SDK is not installed: "
+                "pip install 'envref[op]'"
+            ) from exc
+
+        async def go() -> dict[str, str]:
+            client = await Client.authenticate(
+                auth=token,
+                integration_name=_INTEGRATION_NAME,
+                integration_version=_INTEGRATION_VERSION,
+            )
+            response = await client.secrets.resolve_all(list(refs))
+            values: dict[str, str] = {}
+            failures: dict[str, str] = {}
+            for ref, individual in response.individual_responses.items():
+                if individual.content is not None:
+                    values[ref] = individual.content.secret
+                else:
+                    failures[ref] = str(individual.error)
+            if failures:
+                raise ResolveError(
+                    failures, "Check the service account has read access to that vault."
+                )
+            return values
+
+        # Synchronous by contract (callers load config at import time), but the
+        # SDK is async. Inside a running loop, run it on a worker thread.
+        try:
+            asyncio.get_running_loop()
+        except RuntimeError:
+            return asyncio.run(go())
+        with ThreadPoolExecutor(max_workers=1) as pool:
+            return pool.submit(lambda: asyncio.run(go())).result()
+
+    # -- CLI --
+    def _resolve_cli(self, refs: Sequence[str]) -> dict[str, str]:
+        if not shutil.which("op"):
+            raise ResolverUnavailable(
+                "the `op` CLI is not on PATH and OP_SERVICE_ACCOUNT_TOKEN is not set"
+            )
+        cached = read_cached_session()
+        env = dict(os.environ)
+        if cached:
+            env[f"OP_SESSION_{cached['account']}"] = cached["token"]
+
+        values, stderr = _inject(refs, env)
+        if values is not None:
+            if cached:
+                touch_cached_session()
+            return values
+        if not _looks_like_auth_failure(stderr):
+            raise ResolveError({ref: stderr or "op inject failed" for ref in refs})
+
+        with _signin_lock():
+            # Another process may have signed in while this one waited.
+            fresh = read_cached_session()
+            if fresh and fresh != cached:
+                env[f"OP_SESSION_{fresh['account']}"] = fresh["token"]
+                values, stderr = _inject(refs, env)
+                if values is not None:
+                    return values
+            account = resolve_account(fresh or cached)
+            token = signin(account) if account else None
+            if not (account and token):
+                raise ResolveError(
+                    {ref: stderr or "not signed in" for ref in refs},
+                    "Run `op signin`, or `envref op save-password` to let envref sign in.",
+                )
+            env[f"OP_SESSION_{account}"] = token
+            write_cached_session(account, token)
+            values, stderr = _inject(refs, env)
+            if values is None:
+                raise ResolveError({ref: stderr or "op inject failed" for ref in refs})
+            return values
+
+    def resolve(self, refs: Sequence[str]) -> dict[str, str]:
+        token = os.environ.get("OP_SERVICE_ACCOUNT_TOKEN", "")
+        if token:
+            return self._resolve_sdk(refs, token)
+        return self._resolve_cli(refs)
+
+    def doctor(self) -> str:
+        if os.environ.get("OP_SERVICE_ACCOUNT_TOKEN"):
+            try:
+                import onepassword  # noqa: F401
+            except ImportError:
+                return "service account token set, but SDK missing: pip install 'envref[op]'"
+            return "service account"
+        if not shutil.which("op"):
+            return "`op` CLI not on PATH"
+        cached = read_cached_session()
+        if cached:
+            age = int(time.time() - float(cached.get("mtime", 0)))
+            return f"op CLI, session cached for {cached['account']} ({age}s old)"
+        if session_ttl() <= 0:
+            return "op CLI, session cache disabled"
+        return "op CLI, no cached session (next load signs in)"

envref/touchid/helper.swift

@@ -0,0 +1,76 @@
+import Foundation
+import LocalAuthentication
+
+// Touch-ID-gated read of a generic-password Keychain item.
+//
+// Items with a biometric access control (kSecAccessControlBiometryCurrentSet)
+// need an Apple-Developer-signed binary with Keychain entitlements, which a
+// helper compiled on the fly does not have. So the responsibility is split:
+//   1. LAContext.evaluatePolicy fires Touch ID (no entitlements needed).
+//   2. Only once that succeeds, /usr/bin/security reads the password.
+//
+// For step 2 to be silent, the item must trust /usr/bin/security. That is the
+// case when `security add-generic-password` created it (envref's
+// `op save-password` does), or when "Always Allow" was clicked once.
+//
+// Usage: envref-touchid get <service> <account> [reason]
+//   exit 0 → password on stdout
+//   exit 2 → user cancelled / Touch ID failed
+//   exit 3 → item not found
+//   exit 1 → other error (message on stderr)
+
+func die(_ msg: String, _ code: Int32 = 1) -> Never {
+    FileHandle.standardError.write(Data((msg + "\n").utf8))
+    exit(code)
+}
+
+let args = CommandLine.arguments
+guard args.count >= 4, args[1] == "get" else {
+    die("usage: \(args[0]) get <service> <account> [reason]")
+}
+let service = args[2]
+let account = args[3]
+let reason = args.count >= 5 && !args[4].isEmpty ? args[4] : "read a secret from the keychain"
+
+let context = LAContext()
+var laError: NSError?
+guard context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &laError) else {
+    die("biometrics unavailable: \(laError?.localizedDescription ?? "unknown")")
+}
+
+let sem = DispatchSemaphore(value: 0)
+var authOK = false
+context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, localizedReason: reason) { success, _ in
+    authOK = success
+    sem.signal()
+}
+sem.wait()
+guard authOK else { exit(2) }
+
+let task = Process()
+task.launchPath = "/usr/bin/security"
+var arguments = ["find-generic-password", "-w", "-s", service]
+if !account.isEmpty {
+    arguments += ["-a", account]
+}
+task.arguments = arguments
+let outPipe = Pipe()
+let errPipe = Pipe()
+task.standardOutput = outPipe
+task.standardError = errPipe
+do {
+    try task.run()
+} catch {
+    die("failed to launch /usr/bin/security: \(error)")
+}
+task.waitUntilExit()
+
+if task.terminationStatus == 44 {  // errSecItemNotFound
+    exit(3)
+}
+if task.terminationStatus != 0 {
+    let errText = String(data: errPipe.fileHandleForReading.readDataToEndOfFile(), encoding: .utf8) ?? ""
+    die("security returned \(task.terminationStatus): \(errText)")
+}
+
+FileHandle.standardOutput.write(outPipe.fileHandleForReading.readDataToEndOfFile())

envref/touchid.py

@@ -0,0 +1,66 @@
+"""A Touch ID gate in front of a Keychain read.
+
+Keychain items with a biometric access control (`kSecAccessControlBiometryCurrentSet`)
+need a Developer-signed binary with entitlements, which a script compiled on
+the fly does not have. So the helper splits the job: `LAContext` asks for the
+fingerprint (no entitlements needed), and only on success does it call
+`/usr/bin/security` to read an ordinary generic-password item. The item must
+let `security` read it silently, which is the case when `security` created it.
+
+The helper is compiled from `touchid/helper.swift` on first use into the cache
+directory. Its file name is what macOS shows in the dialog ("envref wants to
+authenticate"). Without `swiftc` or biometrics the caller falls back to a plain
+`security` read, which shows the system's own authorisation dialog instead.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+from pathlib import Path
+
+HELPER_SOURCE = Path(__file__).with_name("touchid") / "helper.swift"
+
+
+def cache_dir() -> Path:
+    base = os.environ.get("XDG_CACHE_HOME") or str(Path.home() / ".cache")
+    return Path(base).expanduser() / "envref"
+
+
+def helper_binary() -> Path | None:
+    """Path to the compiled helper, building it if missing or stale. None when
+    the source is missing or `swiftc` is not installed."""
+    if not HELPER_SOURCE.exists() or not shutil.which("swiftc"):
+        return None
+    binary = cache_dir() / "touchid" / "envref"
+    if binary.exists() and binary.stat().st_mtime >= HELPER_SOURCE.stat().st_mtime:
+        return binary
+    binary.parent.mkdir(parents=True, exist_ok=True)
+    result = subprocess.run(
+        ["swiftc", str(HELPER_SOURCE), "-o", str(binary)],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        return None
+    return binary
+
+
+def read_password_with_touch_id(service: str, account: str | None, reason: str) -> str | None:
+    """Touch ID, then the Keychain item. Falls back to `security` alone when the
+    helper cannot be built. None when the item is missing or the user declined."""
+    binary = helper_binary()
+    if binary is None:
+        from envref.resolvers.keychain import read_generic_password
+
+        return read_generic_password(service, account)
+    result = subprocess.run(
+        [str(binary), "get", service, account or "", reason],
+        capture_output=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        return None
+    return result.stdout.decode("utf-8", "replace").rstrip("\n") or None

envref-0.1.0.dist-info/METADATA

@@ -0,0 +1,188 @@
+Metadata-Version: 2.5
+Name: envref
+Version: 0.1.0
+Summary: A .env where any value can be a reference into a secret store, resolved at load time. op://, keychain://, file://, env://, and your own.
+Project-URL: Homepage, https://github.com/sebaheg/envref
+Project-URL: Repository, https://github.com/sebaheg/envref
+Project-URL: Issues, https://github.com/sebaheg/envref/issues
+Project-URL: Changelog, https://github.com/sebaheg/envref/blob/main/CHANGELOG.md
+Author: Sebastian Haglund
+License: MIT
+License-File: LICENSE
+Keywords: 1password,dotenv,environment,keychain,secrets,twelve-factor
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Topic :: Utilities
+Requires-Python: >=3.11
+Provides-Extra: op
+Requires-Dist: onepassword-sdk>=0.3; (python_version < '3.14') and extra == 'op'
+Description-Content-Type: text/markdown
+
+# envref
+
+A `.env` where any value can be a reference into a secret store, resolved
+when the file is loaded.
+
+```dotenv
+# .env
+ATTIO_KEY={{ op://work/Attio/api_key }}          # 1Password
+DB_PASSWORD={{ keychain://myapp/postgres }}      # macOS Keychain
+TLS_KEY={{ file://~/.ssh/server.pem }}           # a file's contents
+GITHUB_TOKEN={{ env://GH_TOKEN }}                # another variable
+REGION=eu-north-1                                # a plain literal
+```
+
+```bash
+envref run -- python app.py       # app.py sees ATTIO_KEY=<the real key>
+```
+
+```python
+import envref
+envref.load(".env")               # same thing, into os.environ
+```
+
+The file holds no secrets, so it can be committed. The scheme of each
+reference picks the backend. Four ship built in, and your own takes one class
+and one entry point.
+
+## Why
+
+`op run`, `berglas exec`, `chamber exec` and friends each do this for one
+store. Teams rarely have one store. A laptop has 1Password and Keychain, a
+container has a service account, a CI job has its own vault, and the same
+`.env` should work in all three with the same names. `envref` keeps the file
+format (plain dotenv, plus `{{ scheme://… }}`), and makes the backend a plugin.
+
+## Install
+
+```bash
+uv tool install envref            # CLI
+pip install envref                # library, zero dependencies
+pip install 'envref[op]'          # + 1Password service-account support (SDK)
+```
+
+The `op://` CLI path needs only the [`op`](https://developer.1password.com/docs/cli/)
+binary on PATH, no extra.
+
+## Resolvers
+
+| Scheme | Resolves to | Needs |
+| --- | --- | --- |
+| `op://vault/item/field` | a 1Password field | `op` CLI, or `OP_SERVICE_ACCOUNT_TOKEN` + `envref[op]` |
+| `keychain://service/account` | a macOS Keychain generic password | macOS |
+| `file://path` | the file's contents, one trailing newline dropped | — |
+| `env://NAME` | another environment variable | — |
+
+A value written as `{{ scheme://… }}` is always a reference, and an unknown
+scheme is an error. A bare `scheme://…` without braces is resolved only when a
+resolver for that scheme is installed, so `URL=https://example.com` stays a
+literal and `KEY=op://vault/item/field` still works for files written for
+`op read`.
+
+### 1Password in detail
+
+Two modes, chosen by the environment:
+
+- **Service account** when `OP_SERVICE_ACCOUNT_TOKEN` is set. The SDK resolves
+  every reference in one round trip. No binary, no biometrics. For containers.
+- **CLI** otherwise. Every reference goes through one `op inject`. If `op` has
+  no session, `envref` signs in: the account password comes from Keychain
+  behind Touch ID if you stored it with `envref op save-password`, or from the
+  terminal if not. The session token is cached in `~/.cache/envref/` so a
+  burst of commands costs one sign-in; concurrent processes share it through
+  a lock. See [SECURITY.md](SECURITY.md) for what that cache means.
+
+Session caching presumes "biometric unlock for the CLI" is off in the
+1Password app. With it on, `op` prompts per invocation and `envref` holds no
+token.
+
+Knobs: `OP_ACCOUNT` (shorthand, when several accounts are signed in),
+`ENVREF_OP_SESSION_TTL` (seconds, default 1500, `0` disables the cache),
+`ENVREF_OP_KEYCHAIN_SERVICE` / `ENVREF_OP_KEYCHAIN_ACCOUNT` (where the
+password is stored, default `envref-op` / the account's email).
+
+## CLI
+
+```bash
+envref run [-f FILE]... [--override] -- cmd args   # exec cmd with the resolved environment
+envref export [-f FILE]... [--format shell|dotenv|json]
+envref check [-f FILE]...                          # resolve and report per key; never prints a value
+envref doctor                                      # installed resolvers and whether each can run here
+envref op save-password [--account SHORTHAND]      # store the 1Password password in Keychain for Touch ID sign-in
+```
+
+`-f` repeats. The first file to set a name wins, so `-f .env.refs -f .env`
+lets a local `.env` fill in what the shared references file lacks without
+overriding it. Default is `.env`.
+
+## Library
+
+```python
+import envref
+
+values = envref.load(".env.refs", ".env")        # dict, also exported into os.environ
+values = envref.load(".env", export=False)       # dict only
+envref.load(".env", override=True)               # let the file win over existing variables
+
+entries = envref.parse(text)                     # list[Entry], refs identified
+envref.resolve(entries, registry={"op": ...})    # bring your own resolvers
+```
+
+Errors are typed: `UnknownScheme`, `ResolverUnavailable` (the backend cannot
+run here: no `op`, not macOS, no token) and `ResolveError` (which references
+failed and why, in `.failures`). All derive from `EnvrefError`.
+
+## Writing a resolver
+
+```python
+# myenvref/aws.py
+class SecretsManagerResolver:
+    scheme = "awssm"
+
+    def resolve(self, refs: list[str]) -> dict[str, str]:
+        # refs are every awssm:// reference in the file, deduplicated: batch them.
+        ...
+        return {ref: value for ref, value in ...}
+
+    def doctor(self) -> str:          # optional, shown by `envref doctor`
+        return "ok"
+```
+
+```toml
+# pyproject.toml
+[project.entry-points."envref.resolvers"]
+awssm = "myenvref.aws:SecretsManagerResolver"
+```
+
+Installed next to `envref`, `{{ awssm://… }}` now resolves. An entry point
+with a built-in's name replaces it.
+
+## Prior art
+
+[`teller`](https://github.com/tellerops/teller) and
+[`novops`](https://github.com/PierreBeucher/novops) are multi-provider too,
+with the mapping in a YAML config rather than inline in the `.env`.
+[`berglas`](https://github.com/GoogleCloudPlatform/berglas) has inline
+`sm://` references, for Google Cloud only. [`dotenvx`](https://dotenvx.com)
+encrypts the values rather than referencing them. `op inject` is what the
+`{{ }}` syntax comes from, and any `.env.op` written for it is a valid
+`envref` file.
+
+## Status
+
+Extracted in November 2026 from a private automation repository where the
+1Password path had run daily for a year, on a laptop and in scheduled
+containers. The other resolvers are new. macOS and Linux; Keychain and Touch
+ID are macOS only.
+
+MIT.

envref-0.1.0.dist-info/RECORD

@@ -0,0 +1,16 @@
+envref/__init__.py,sha256=aU9gMYe-w38M6TpkNpKpDXfgJoDNNAKKngeGTS_Itdw,902
+envref/cli.py,sha256=dJRsW90LdLXGmLqM78A43p7zb4fjfgJCCHhlCX8yVCI,5840
+envref/core.py,sha256=jXElmR2d1NTHc-PAy1vCKWkZzkLVAy5F6ejnrDCvk7Y,4660
+envref/parse.py,sha256=XWOrAlQ4NXZ1D0NxIuuk65VHQe_LaQgeWuTWzXhLMgg,2892
+envref/touchid.py,sha256=2tSggug_818Rmr6sbulNALHkpC6cNSFbqUal30EkZTQ,2565
+envref/resolvers/__init__.py,sha256=g-v8xRhuwjccWdqoJfuWWcG2YNXkueGHFRMgdUI-lfU,1182
+envref/resolvers/env.py,sha256=Cyf9Q7yi3PVQlrqjgRY_EMq1TMoVk9NaLpzdFrMD7uk,794
+envref/resolvers/file.py,sha256=iNcncTZw3mlTHe0xwNQUaDrc3F0fM8arVJUbQT0wh_I,1076
+envref/resolvers/keychain.py,sha256=BE1Wjer0PvA4pH4_Ur1Zksu4OYzMnLD_NJzaitQurio,2888
+envref/resolvers/op.py,sha256=eXmS8-d8UOz85RRQWETFkaPdhnAMQBDp8LlhOq49hG4,12892
+envref/touchid/helper.swift,sha256=cxyENwSNBU5CCsfeYYmjxpJ6Nfrz7Wi5dq7HpeGVlhs,2606
+envref-0.1.0.dist-info/METADATA,sha256=utLrMrmcu1AZ2j5M4pyVwJq1dUD86S0ts_E-O6hAC1g,7402
+envref-0.1.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+envref-0.1.0.dist-info/entry_points.txt,sha256=7ZJ460W344J4aZva_VPPWVwTylrSmdbiGqsKJ49aWeA,243
+envref-0.1.0.dist-info/licenses/LICENSE,sha256=o5WVEWoP8tX5UUasTJYNUjsu0mj7zz78nHT-iGmN1j0,1074
+envref-0.1.0.dist-info/RECORD,,

envref-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

envref-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,8 @@
+[console_scripts]
+envref = envref.cli:main
+
+[envref.resolvers]
+env = envref.resolvers.env:EnvResolver
+file = envref.resolvers.file:FileResolver
+keychain = envref.resolvers.keychain:KeychainResolver
+op = envref.resolvers.op:OnePasswordResolver

envref-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sebastian Haglund
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.