{ ... }:
{
  mkBwEnv =
    {
      items,
      pkgs,
      name ? "bw-env",
      exe,
    }:
    let
      assertMsg = pred: msg: pred || builtins.throw msg;
      concatLines = builtins.concatStringsSep "\n";
      itemNames = builtins.attrNames items;
      exports = builtins.map (
        itemName:
        let
          item = items.${itemName};
          varNames = builtins.attrNames item;
          vars = builtins.map (
            varName:
            let
              var = item.${varName};
              script =
                if var == "login.password" || var == "login.username" then
                  "jq -r '.${var}'"
                else
                  "jq -r --arg name '${var}' \"$JQ_FIELD_SCRIPT\"";
            in
            assert assertMsg (builtins.match "^[a-zA-Z0-9_]+$" != null) "Invalid variable name: ${varName}";
            ''
              ${varName}="$(${script} <<< "$item")"
              if [[ "''$${varName}" == "null" ]]; then
                echo "Could not read ${varName} from ${itemName}" 1>&2
                exit 1
              fi
              export ${varName}
            ''
          ) varNames;
        in
        ''
          item="$(bw get item '${itemName}')"
          ${concatLines vars}
        ''
      ) itemNames;
    in
    pkgs.writeShellApplication {
      inherit name;
      runtimeInputs = [
        pkgs.jq
        pkgs.bitwarden-cli
      ];
      meta = {
        mainProgram = name;
      };
      text = ''
        if [ "''${DEBUG:-0}" == "1" ]; then
          set -x
        fi
        if [ -z "''${BW_SESSION+x}" ]; then
        	BW_SESSION="$(bw unlock --raw)"
        	echo "Bitwarden session (export as BW_SESSION to avoid repeating entries): $BW_SESSION" 1>&2
        	export BW_SESSION
        fi

        JQ_FIELD_SCRIPT='.fields | map(select(.name == $'"name))[0].value"
        ${concatLines exports}

        exec "${exe}" "$@"
      '';
    };
}
