@enspirit/emb 0.18.0 → 0.20.0

package/README.md

@@ -14,7 +14,7 @@ $ npm install -g @enspirit/emb
 $ emb COMMAND
 running command...
 $ emb (--version)
-@enspirit/emb/0.18.0 darwin-arm64 node-v22.21.1
+@enspirit/emb/0.20.0 darwin-x64 node-v22.18.0
 $ emb --help [COMMAND]
 USAGE
   $ emb COMMAND
@@ -113,7 +113,7 @@ EXAMPLES
   $ emb clean
 ```
 
-_See code: [src/commands/clean.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/clean.ts)_
+_See code: [src/commands/clean.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/clean.ts)_
 
 ## `emb components`
 
@@ -138,7 +138,7 @@ EXAMPLES
   $ emb components
 ```
 
-_See code: [src/commands/components/index.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/components/index.ts)_
+_See code: [src/commands/components/index.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/components/index.ts)_
 
 ## `emb components logs [COMPONENT]`
 
@@ -169,7 +169,7 @@ EXAMPLES
   $ emb components logs --no-follow backend
 ```
 
-_See code: [src/commands/components/logs.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/components/logs.ts)_
+_See code: [src/commands/components/logs.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/components/logs.ts)_
 
 ## `emb components shell COMPONENT`
 
@@ -197,7 +197,7 @@ EXAMPLES
   $ emb components shell
 ```
 
-_See code: [src/commands/components/shell.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/components/shell.ts)_
+_See code: [src/commands/components/shell.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/components/shell.ts)_
 
 ## `emb config print`
 
@@ -222,7 +222,7 @@ EXAMPLES
   $ emb config print
 ```
 
-_See code: [src/commands/config/print.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/config/print.ts)_
+_See code: [src/commands/config/print.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/config/print.ts)_
 
 ## `emb containers`
 
@@ -247,7 +247,7 @@ EXAMPLES
   $ emb containers
 ```
 
-_See code: [src/commands/containers/index.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/containers/index.ts)_
+_See code: [src/commands/containers/index.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/containers/index.ts)_
 
 ## `emb containers prune`
 
@@ -271,7 +271,7 @@ EXAMPLES
   $ emb containers prune
 ```
 
-_See code: [src/commands/containers/prune.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/containers/prune.ts)_
+_See code: [src/commands/containers/prune.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/containers/prune.ts)_
 
 ## `emb down`
 
@@ -296,7 +296,7 @@ EXAMPLES
   $ emb down
 ```
 
-_See code: [src/commands/down.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/down.ts)_
+_See code: [src/commands/down.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/down.ts)_
 
 ## `emb help [COMMAND]`
 
@@ -342,7 +342,7 @@ EXAMPLES
   $ emb images
 ```
 
-_See code: [src/commands/images/index.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/images/index.ts)_
+_See code: [src/commands/images/index.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/images/index.ts)_
 
 ## `emb images delete`
 
@@ -367,7 +367,7 @@ EXAMPLES
   $ emb images delete
 ```
 
-_See code: [src/commands/images/delete.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/images/delete.ts)_
+_See code: [src/commands/images/delete.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/images/delete.ts)_
 
 ## `emb images prune`
 
@@ -392,7 +392,7 @@ EXAMPLES
   $ emb images prune
 ```
 
-_See code: [src/commands/images/prune.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/images/prune.ts)_
+_See code: [src/commands/images/prune.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/images/prune.ts)_
 
 ## `emb images push`
 
@@ -421,7 +421,7 @@ EXAMPLES
   $ emb images push --registry my.registry.io --retag newtag
 ```
 
-_See code: [src/commands/images/push.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/images/push.ts)_
+_See code: [src/commands/images/push.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/images/push.ts)_
 
 ## `emb kubernetes logs COMPONENT`
 
@@ -447,7 +447,7 @@ EXAMPLES
   $ emb kubernetes logs
 ```
 
-_See code: [src/commands/kubernetes/logs.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/kubernetes/logs.ts)_
+_See code: [src/commands/kubernetes/logs.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/kubernetes/logs.ts)_
 
 ## `emb kubernetes ps`
 
@@ -470,7 +470,7 @@ EXAMPLES
   $ emb kubernetes ps
 ```
 
-_See code: [src/commands/kubernetes/ps.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/kubernetes/ps.ts)_
+_See code: [src/commands/kubernetes/ps.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/kubernetes/ps.ts)_
 
 ## `emb kubernetes restart [DEPLOYMENT]`
 
@@ -495,7 +495,7 @@ EXAMPLES
   $ emb kubernetes restart
 ```
 
-_See code: [src/commands/kubernetes/restart.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/kubernetes/restart.ts)_
+_See code: [src/commands/kubernetes/restart.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/kubernetes/restart.ts)_
 
 ## `emb kubernetes shell COMPONENT`
 
@@ -524,7 +524,7 @@ EXAMPLES
   $ emb kubernetes shell
 ```
 
-_See code: [src/commands/kubernetes/shell.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/kubernetes/shell.ts)_
+_See code: [src/commands/kubernetes/shell.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/kubernetes/shell.ts)_
 
 ## `emb logs [COMPONENT]`
 
@@ -555,7 +555,7 @@ EXAMPLES
   $ emb logs --no-follow backend
 ```
 
-_See code: [src/commands/logs/index.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/logs/index.ts)_
+_See code: [src/commands/logs/index.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/logs/index.ts)_
 
 ## `emb logs archive [COMPONENT]`
 
@@ -591,7 +591,7 @@ EXAMPLES
   $ emb logs archive --tail 1000
 ```
 
-_See code: [src/commands/logs/archive.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/logs/archive.ts)_
+_See code: [src/commands/logs/archive.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/logs/archive.ts)_
 
 ## `emb ps`
 
@@ -614,7 +614,7 @@ EXAMPLES
   $ emb ps
 ```
 
-_See code: [src/commands/ps.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/ps.ts)_
+_See code: [src/commands/ps.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/ps.ts)_
 
 ## `emb resources`
 
@@ -639,7 +639,7 @@ EXAMPLES
   $ emb resources
 ```
 
-_See code: [src/commands/resources/index.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/resources/index.ts)_
+_See code: [src/commands/resources/index.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/resources/index.ts)_
 
 ## `emb resources build [COMPONENT]`
 
@@ -669,7 +669,7 @@ EXAMPLES
   $ emb resources build build --flavor development
 ```
 
-_See code: [src/commands/resources/build.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/resources/build.ts)_
+_See code: [src/commands/resources/build.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/resources/build.ts)_
 
 ## `emb restart [COMPONENT]`
 
@@ -697,7 +697,7 @@ EXAMPLES
   $ emb restart
 ```
 
-_See code: [src/commands/restart.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/restart.ts)_
+_See code: [src/commands/restart.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/restart.ts)_
 
 ## `emb run TASK`
 
@@ -755,7 +755,7 @@ EXAMPLES
   $ emb secrets --json
 ```
 
-_See code: [src/commands/secrets/index.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/secrets/index.ts)_
+_See code: [src/commands/secrets/index.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/secrets/index.ts)_
 
 ## `emb secrets providers`
 
@@ -780,7 +780,7 @@ EXAMPLES
   $ emb secrets providers
 ```
 
-_See code: [src/commands/secrets/providers.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/secrets/providers.ts)_
+_See code: [src/commands/secrets/providers.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/secrets/providers.ts)_
 
 ## `emb secrets validate`
 
@@ -810,7 +810,7 @@ EXAMPLES
   $ emb secrets validate --json
 ```
 
-_See code: [src/commands/secrets/validate.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/secrets/validate.ts)_
+_See code: [src/commands/secrets/validate.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/secrets/validate.ts)_
 
 ## `emb shell COMPONENT`
 
@@ -863,7 +863,7 @@ EXAMPLES
   $ emb start
 ```
 
-_See code: [src/commands/start.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/start.ts)_
+_See code: [src/commands/start.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/start.ts)_
 
 ## `emb stop`
 
@@ -888,7 +888,7 @@ EXAMPLES
   $ emb stop
 ```
 
-_See code: [src/commands/stop.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/stop.ts)_
+_See code: [src/commands/stop.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/stop.ts)_
 
 ## `emb tasks`
 
@@ -912,7 +912,7 @@ EXAMPLES
   $ emb tasks
 ```
 
-_See code: [src/commands/tasks/index.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/tasks/index.ts)_
+_See code: [src/commands/tasks/index.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/tasks/index.ts)_
 
 ## `emb tasks run TASK`
 
@@ -945,7 +945,7 @@ EXAMPLES
   $ emb tasks run
 ```
 
-_See code: [src/commands/tasks/run.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/tasks/run.ts)_
+_See code: [src/commands/tasks/run.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/tasks/run.ts)_
 
 ## `emb up [COMPONENT]`
 
@@ -974,7 +974,7 @@ EXAMPLES
   $ emb up
 ```
 
-_See code: [src/commands/up.ts](https://github.com/enspirit/emb/blob/v0.18.0/src/commands/up.ts)_
+_See code: [src/commands/up.ts](https://github.com/enspirit/emb/blob/v0.20.0/src/commands/up.ts)_
 
 ## `emb update [CHANNEL]`
 

package/dist/src/config/schema.d.ts

@@ -95,6 +95,10 @@ export interface DefaultsConfig {
     docker?: {
         tag?: string;
         target?: Identifier;
+        /**
+         * Target platform for the build (e.g., linux/amd64, linux/arm64)
+         */
+        platform?: string;
         buildArgs?: {
             [k: string]: string;
         };

package/dist/src/config/schema.json

@@ -86,6 +86,10 @@
                         "target": {
                             "$ref": "#/definitions/Identifier"
                         },
+                        "platform": {
+                            "type": "string",
+                            "description": "Target platform for the build (e.g., linux/amd64, linux/arm64)"
+                        },
                         "buildArgs": {
                             "type": "object",
                             "additionalProperties": {
@@ -214,6 +218,10 @@
                     "type": "string",
                     "description": "The stage to target for the build"
                 },
+                "platform": {
+                    "type": "string",
+                    "description": "Target platform for the build (e.g., linux/amd64, linux/arm64)"
+                },
                 "labels": {
                     "type": "object",
                     "additionalProperties": {

package/dist/src/docker/operations/images/BuildImageOperation.d.ts

@@ -12,6 +12,7 @@ export declare const BuildImageOperationInputSchema: z.ZodObject<{
     buildArgs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     target: z.ZodOptional<z.ZodString>;
+    platform: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare class BuildImageOperation extends AbstractOperation<typeof BuildImageOperationInputSchema, void> {
     private out?;

package/dist/src/docker/operations/images/BuildImageOperation.js

@@ -32,6 +32,10 @@ export const BuildImageOperationInputSchema = z.object({
         .optional()
         .describe('Arbitrary key/value labels to set on the image, as a JSON map of string pairs.'),
     target: z.string().optional().describe('Target build stage'),
+    platform: z
+        .string()
+        .optional()
+        .describe('Target platform for the build (e.g., linux/amd64, linux/arm64)'),
 });
 export class BuildImageOperation extends AbstractOperation {
     out;
@@ -55,6 +59,9 @@ export class BuildImageOperation extends AbstractOperation {
         if (input.target) {
             args.push('--target', input.target);
         }
+        if (input.platform) {
+            args.push('--platform', input.platform);
+        }
         Object.entries(input.buildArgs || []).forEach(([key, value]) => {
             args.push('--build-arg', `${key.trim()}=${value.trim()}`);
         });
@@ -99,6 +106,7 @@ export class BuildImageOperation extends AbstractOperation {
             labels: input.labels,
             t: input.tag,
             target: input.target,
+            platform: input.platform,
             version: '2',
         });
         return new Promise((resolve, reject) => {

package/dist/src/docker/resources/DockerImageResource.js

@@ -69,6 +69,7 @@ class DockerImageResourceBuilder extends SentinelFileBasedBuilder {
                 'emb/flavor': this.monorepo.currentFlavor,
             }),
             target: this.config?.target,
+            platform: this.config?.platform || this.monorepo.defaults.docker?.platform,
         };
         return {
             input: buildParams,

package/dist/src/monorepo/plugins/OnePasswordPlugin.d.ts

@@ -0,0 +1,39 @@
+import { AbstractPlugin } from './plugin.js';
+/**
+ * Configuration for the 1Password plugin in .emb.yml
+ */
+export interface OnePasswordPluginConfig {
+    /** Account shorthand or UUID (optional). Defaults to OP_ACCOUNT env var. */
+    account?: string;
+}
+/**
+ * Plugin that integrates 1Password CLI with EMB.
+ *
+ * Usage in .emb.yml:
+ * ```yaml
+ * plugins:
+ *   - name: op
+ *     config:
+ *       account: my-team  # Optional: specific 1Password account
+ * ```
+ *
+ * Then use secrets in templates:
+ * ```yaml
+ * env:
+ *   DB_PASSWORD: ${op:Production/database-credentials#password}
+ *   API_KEY: ${op:Development/api-keys#secret-key}
+ * ```
+ *
+ * Authentication methods:
+ * 1. Pre-authenticated session (interactive) - User runs `op signin` before using EMB
+ * 2. Service account token (CI/CD) - Via `OP_SERVICE_ACCOUNT_TOKEN` env var
+ */
+export declare class OnePasswordPlugin extends AbstractPlugin<OnePasswordPluginConfig> {
+    static name: string;
+    private provider;
+    init(): Promise<void>;
+    /**
+     * Resolve the plugin configuration, filling in defaults from env vars.
+     */
+    private resolveConfig;
+}

package/dist/src/monorepo/plugins/OnePasswordPlugin.js

@@ -0,0 +1,47 @@
+import { getContext } from '../../context.js';
+import { OnePasswordProvider, } from '../../secrets/providers/OnePasswordProvider.js';
+import { AbstractPlugin } from './plugin.js';
+/**
+ * Plugin that integrates 1Password CLI with EMB.
+ *
+ * Usage in .emb.yml:
+ * ```yaml
+ * plugins:
+ *   - name: op
+ *     config:
+ *       account: my-team  # Optional: specific 1Password account
+ * ```
+ *
+ * Then use secrets in templates:
+ * ```yaml
+ * env:
+ *   DB_PASSWORD: ${op:Production/database-credentials#password}
+ *   API_KEY: ${op:Development/api-keys#secret-key}
+ * ```
+ *
+ * Authentication methods:
+ * 1. Pre-authenticated session (interactive) - User runs `op signin` before using EMB
+ * 2. Service account token (CI/CD) - Via `OP_SERVICE_ACCOUNT_TOKEN` env var
+ */
+export class OnePasswordPlugin extends AbstractPlugin {
+    static name = 'op';
+    provider = null;
+    async init() {
+        const resolvedConfig = this.resolveConfig();
+        this.provider = new OnePasswordProvider(resolvedConfig);
+        await this.provider.connect();
+        // Register the provider with the global SecretManager
+        const context = getContext();
+        if (context?.secrets) {
+            context.secrets.register('op', this.provider);
+        }
+    }
+    /**
+     * Resolve the plugin configuration, filling in defaults from env vars.
+     */
+    resolveConfig() {
+        return {
+            account: this.config?.account || process.env.OP_ACCOUNT,
+        };
+    }
+}

package/dist/src/monorepo/plugins/index.d.ts

@@ -2,6 +2,7 @@ import { AbstractPlugin } from './plugin.js';
 export * from './AutoDockerPlugin.js';
 export * from './DotEnvPlugin.js';
 export * from './EmbfileLoaderPlugin.js';
+export * from './OnePasswordPlugin.js';
 export * from './VaultPlugin.js';
 import { Monorepo } from '../index.js';
 export type AbstractPluginConstructor = new <C, P extends AbstractPlugin<C>>(config: C, monorepo: Monorepo) => P;

package/dist/src/monorepo/plugins/index.js

@@ -1,10 +1,12 @@
 export * from './AutoDockerPlugin.js';
 export * from './DotEnvPlugin.js';
 export * from './EmbfileLoaderPlugin.js';
+export * from './OnePasswordPlugin.js';
 export * from './VaultPlugin.js';
 import { AutoDockerPlugin } from './AutoDockerPlugin.js';
 import { DotEnvPlugin } from './DotEnvPlugin.js';
 import { EmbfileLoaderPlugin } from './EmbfileLoaderPlugin.js';
+import { OnePasswordPlugin } from './OnePasswordPlugin.js';
 import { VaultPlugin } from './VaultPlugin.js';
 const PluginRegistry = new Map();
 export const registerPlugin = (plugin) => {
@@ -23,4 +25,5 @@ export const getPlugin = (name) => {
 registerPlugin(AutoDockerPlugin);
 registerPlugin(DotEnvPlugin);
 registerPlugin(EmbfileLoaderPlugin);
+registerPlugin(OnePasswordPlugin);
 registerPlugin(VaultPlugin);

package/dist/src/secrets/providers/OnePasswordError.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Error class for 1Password-specific errors.
+ */
+export declare class OnePasswordError extends Error {
+    code: string;
+    constructor(message: string, code: string);
+}

package/dist/src/secrets/providers/OnePasswordError.js

@@ -0,0 +1,11 @@
+/**
+ * Error class for 1Password-specific errors.
+ */
+export class OnePasswordError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'OnePasswordError';
+    }
+}

package/dist/src/secrets/providers/OnePasswordProvider.d.ts

@@ -0,0 +1,29 @@
+import { AbstractSecretProvider, SecretReference } from '../SecretProvider.js';
+/**
+ * Configuration for the 1Password provider.
+ */
+export interface OnePasswordProviderConfig {
+    /** Account shorthand or UUID (optional) */
+    account?: string;
+}
+/**
+ * 1Password CLI secret provider.
+ * Uses the `op` CLI to fetch secrets from 1Password vaults.
+ *
+ * Supports two authentication methods:
+ * 1. Pre-authenticated session (interactive) - User runs `op signin` before using EMB
+ * 2. Service account token (CI/CD) - Via `OP_SERVICE_ACCOUNT_TOKEN` env var
+ */
+export declare class OnePasswordProvider extends AbstractSecretProvider<OnePasswordProviderConfig> {
+    /**
+     * Execute the `op` CLI command.
+     * Protected to allow mocking in tests.
+     */
+    protected execOp(args: string[]): Promise<{
+        stdout: string;
+        stderr: string;
+    }>;
+    connect(): Promise<void>;
+    disconnect(): Promise<void>;
+    fetchSecret(ref: SecretReference): Promise<Record<string, unknown>>;
+}

package/dist/src/secrets/providers/OnePasswordProvider.js

@@ -0,0 +1,101 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { AbstractSecretProvider } from '../SecretProvider.js';
+import { OnePasswordError } from './OnePasswordError.js';
+/**
+ * 1Password CLI secret provider.
+ * Uses the `op` CLI to fetch secrets from 1Password vaults.
+ *
+ * Supports two authentication methods:
+ * 1. Pre-authenticated session (interactive) - User runs `op signin` before using EMB
+ * 2. Service account token (CI/CD) - Via `OP_SERVICE_ACCOUNT_TOKEN` env var
+ */
+export class OnePasswordProvider extends AbstractSecretProvider {
+    /**
+     * Execute the `op` CLI command.
+     * Protected to allow mocking in tests.
+     */
+    async execOp(args) {
+        const execFileAsync = promisify(execFile);
+        return execFileAsync('op', args);
+    }
+    async connect() {
+        try {
+            const args = ['whoami'];
+            if (this.config.account) {
+                args.push('--account', this.config.account);
+            }
+            await this.execOp(args);
+        }
+        catch (error) {
+            const err = error;
+            if (err.code === 'ENOENT') {
+                throw new OnePasswordError('1Password CLI (op) not found. Install from https://1password.com/downloads/command-line/', 'OP_NOT_FOUND');
+            }
+            // Check for authentication errors
+            const stderr = err.stderr || err.message || '';
+            if (stderr.includes('not signed in') ||
+                stderr.includes('not currently signed in') ||
+                stderr.includes('session expired') ||
+                stderr.includes('authentication required') ||
+                stderr.includes('You are not currently signed in')) {
+                throw new OnePasswordError("Not signed in to 1Password. Run 'op signin' or set OP_SERVICE_ACCOUNT_TOKEN", 'OP_NOT_AUTHENTICATED');
+            }
+            throw new OnePasswordError(`Failed to connect to 1Password: ${stderr || err.message}`, 'OP_CONNECTION_ERROR');
+        }
+    }
+    async disconnect() {
+        this.clearCache();
+    }
+    async fetchSecret(ref) {
+        // Parse path as vault/item
+        const slashIndex = ref.path.indexOf('/');
+        if (slashIndex === -1) {
+            throw new OnePasswordError(`Invalid secret path '${ref.path}'. Expected format: vault/item`, 'OP_INVALID_PATH');
+        }
+        const vault = ref.path.slice(0, slashIndex);
+        const item = ref.path.slice(slashIndex + 1);
+        if (!vault || !item) {
+            throw new OnePasswordError(`Invalid secret path '${ref.path}'. Both vault and item must be specified.`, 'OP_INVALID_PATH');
+        }
+        try {
+            const args = ['item', 'get', item, '--vault', vault, '--format', 'json'];
+            if (this.config.account) {
+                args.push('--account', this.config.account);
+            }
+            const { stdout } = await this.execOp(args);
+            const response = JSON.parse(stdout);
+            // Convert fields to key-value pairs
+            const result = {};
+            if (response.fields) {
+                for (const field of response.fields) {
+                    // Use label as key, fall back to id if no label
+                    const key = field.label || field.id;
+                    result[key] = field.value;
+                }
+            }
+            return result;
+        }
+        catch (error) {
+            // Re-throw OnePasswordError as-is (from path validation or other checks)
+            if (error instanceof OnePasswordError) {
+                throw error;
+            }
+            const err = error;
+            const stderr = err.stderr || err.message || '';
+            // Check for specific error cases
+            if (stderr.includes("isn't a vault")) {
+                throw new OnePasswordError(`Vault '${vault}' not found in 1Password`, 'OP_VAULT_NOT_FOUND');
+            }
+            if (stderr.includes("isn't an item")) {
+                throw new OnePasswordError(`Item '${item}' not found in vault '${vault}'`, 'OP_ITEM_NOT_FOUND');
+            }
+            if (stderr.includes('not signed in') ||
+                stderr.includes('not currently signed in') ||
+                stderr.includes('session expired')) {
+                throw new OnePasswordError("Not signed in to 1Password. Run 'op signin' or set OP_SERVICE_ACCOUNT_TOKEN", 'OP_NOT_AUTHENTICATED');
+            }
+            throw new OnePasswordError(`Failed to fetch secret from 1Password: ${stderr}`, 'OP_FETCH_ERROR');
+        }
+    }
+}

package/dist/src/secrets/providers/index.d.ts

@@ -1,2 +1,4 @@
+export * from './OnePasswordError.js';
+export * from './OnePasswordProvider.js';
 export * from './VaultProvider.js';
 export * from './VaultTokenCache.js';

package/dist/src/secrets/providers/index.js

@@ -1,2 +1,4 @@
+export * from './OnePasswordError.js';
+export * from './OnePasswordProvider.js';
 export * from './VaultProvider.js';
 export * from './VaultTokenCache.js';

package/oclif.manifest.json

@@ -1231,21 +1231,18 @@
         "shell.js"
       ]
     },
-    "logs:archive": {
+    "resources:build": {
       "aliases": [],
       "args": {
         "component": {
-          "description": "The component(s) to archive logs for (all if omitted)",
+          "description": "List of resources to build (defaults to all)",
           "name": "component",
           "required": false
         }
       },
-      "description": "Archive docker compose logs to files (one file per component).",
+      "description": "Build the resources of the monorepo",
       "examples": [
-        "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> backend frontend",
-        "<%= config.bin %> <%= command.id %> --timestamps",
-        "<%= config.bin %> <%= command.id %> --tail 1000"
+        "<%= config.bin %> <%= command.id %> build --flavor development"
       ],
       "flags": {
         "json": {
@@ -1269,32 +1266,33 @@
           "multiple": false,
           "type": "option"
         },
-        "timestamps": {
-          "char": "t",
-          "description": "Include timestamps in logs",
-          "name": "timestamps",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "tail": {
-          "description": "Number of lines to show from the end of the logs",
-          "name": "tail",
+        "flavor": {
+          "description": "Specify the flavor to use.",
+          "name": "flavor",
+          "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "output": {
-          "char": "o",
-          "description": "Output directory for log files (defaults to .emb/<flavor>/logs/docker/compose)",
-          "name": "output",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
+        "dry-run": {
+          "description": "Do not build the resources but only produce build meta information",
+          "name": "dry-run",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "force": {
+          "char": "f",
+          "description": "Bypass the cache and force the build",
+          "name": "force",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "logs:archive",
+      "id": "resources:build",
       "pluginAlias": "@enspirit/emb",
       "pluginName": "@enspirit/emb",
       "pluginType": "core",
@@ -1306,27 +1304,25 @@
         "src",
         "cli",
         "commands",
-        "logs",
-        "archive.js"
+        "resources",
+        "build.js"
       ]
     },
-    "logs": {
+    "resources": {
       "aliases": [],
-      "args": {
-        "component": {
-          "description": "The component(s) you want to see the logs of (all if omitted)",
-          "name": "component",
-          "required": false
-        }
-      },
-      "description": "Get components logs.",
+      "args": {},
+      "description": "List resources.",
       "examples": [
-        "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> backend",
-        "<%= config.bin %> <%= command.id %> backend frontend",
-        "<%= config.bin %> <%= command.id %> --no-follow backend"
+        "<%= config.bin %> <%= command.id %>"
       ],
       "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "verbose": {
           "name": "verbose",
           "allowNo": true,
@@ -1341,44 +1337,48 @@
           "multiple": false,
           "type": "option"
         },
-        "follow": {
-          "char": "f",
-          "description": "Follow log output",
-          "name": "follow",
-          "allowNo": true,
-          "type": "boolean"
+        "flavor": {
+          "description": "Specify the flavor to use.",
+          "name": "flavor",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "logs",
+      "id": "resources",
       "pluginAlias": "@enspirit/emb",
       "pluginName": "@enspirit/emb",
       "pluginType": "core",
-      "strict": false,
-      "enableJsonFlag": false,
+      "strict": true,
+      "enableJsonFlag": true,
       "isESM": true,
       "relativePath": [
         "dist",
         "src",
         "cli",
         "commands",
-        "logs",
+        "resources",
         "index.js"
       ]
     },
-    "resources:build": {
+    "logs:archive": {
       "aliases": [],
       "args": {
         "component": {
-          "description": "List of resources to build (defaults to all)",
+          "description": "The component(s) to archive logs for (all if omitted)",
           "name": "component",
           "required": false
         }
       },
-      "description": "Build the resources of the monorepo",
+      "description": "Archive docker compose logs to files (one file per component).",
       "examples": [
-        "<%= config.bin %> <%= command.id %> build --flavor development"
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> backend frontend",
+        "<%= config.bin %> <%= command.id %> --timestamps",
+        "<%= config.bin %> <%= command.id %> --tail 1000"
       ],
       "flags": {
         "json": {
@@ -1402,33 +1402,32 @@
           "multiple": false,
           "type": "option"
         },
-        "flavor": {
-          "description": "Specify the flavor to use.",
-          "name": "flavor",
-          "required": false,
+        "timestamps": {
+          "char": "t",
+          "description": "Include timestamps in logs",
+          "name": "timestamps",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "tail": {
+          "description": "Number of lines to show from the end of the logs",
+          "name": "tail",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "dry-run": {
-          "description": "Do not build the resources but only produce build meta information",
-          "name": "dry-run",
-          "required": false,
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "force": {
-          "char": "f",
-          "description": "Bypass the cache and force the build",
-          "name": "force",
-          "required": false,
-          "allowNo": false,
-          "type": "boolean"
+        "output": {
+          "char": "o",
+          "description": "Output directory for log files (defaults to .emb/<flavor>/logs/docker/compose)",
+          "name": "output",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "resources:build",
+      "id": "logs:archive",
       "pluginAlias": "@enspirit/emb",
       "pluginName": "@enspirit/emb",
       "pluginType": "core",
@@ -1440,25 +1439,27 @@
         "src",
         "cli",
         "commands",
-        "resources",
-        "build.js"
+        "logs",
+        "archive.js"
       ]
     },
-    "resources": {
+    "logs": {
       "aliases": [],
-      "args": {},
-      "description": "List resources.",
+      "args": {
+        "component": {
+          "description": "The component(s) you want to see the logs of (all if omitted)",
+          "name": "component",
+          "required": false
+        }
+      },
+      "description": "Get components logs.",
       "examples": [
-        "<%= config.bin %> <%= command.id %>"
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> backend",
+        "<%= config.bin %> <%= command.id %> backend frontend",
+        "<%= config.bin %> <%= command.id %> --no-follow backend"
       ],
       "flags": {
-        "json": {
-          "description": "Format output as json.",
-          "helpGroup": "GLOBAL",
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
-        },
         "verbose": {
           "name": "verbose",
           "allowNo": true,
@@ -1473,39 +1474,39 @@
           "multiple": false,
           "type": "option"
         },
-        "flavor": {
-          "description": "Specify the flavor to use.",
-          "name": "flavor",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
+        "follow": {
+          "char": "f",
+          "description": "Follow log output",
+          "name": "follow",
+          "allowNo": true,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "resources",
+      "id": "logs",
       "pluginAlias": "@enspirit/emb",
       "pluginName": "@enspirit/emb",
       "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": true,
+      "strict": false,
+      "enableJsonFlag": false,
       "isESM": true,
       "relativePath": [
         "dist",
         "src",
         "cli",
         "commands",
-        "resources",
+        "logs",
         "index.js"
       ]
     },
-    "tasks": {
+    "secrets": {
       "aliases": [],
       "args": {},
-      "description": "List tasks.",
+      "description": "List all secret references in the configuration.",
       "examples": [
-        "<%= config.bin %> <%= command.id %>"
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --json"
       ],
       "flags": {
         "json": {
@@ -1528,11 +1529,19 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "flavor": {
+          "description": "Specify the flavor to use.",
+          "name": "flavor",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "tasks",
+      "id": "secrets",
       "pluginAlias": "@enspirit/emb",
       "pluginName": "@enspirit/emb",
       "pluginType": "core",
@@ -1544,22 +1553,14 @@
         "src",
         "cli",
         "commands",
-        "tasks",
+        "secrets",
         "index.js"
       ]
     },
-    "tasks:run": {
-      "aliases": [
-        "run"
-      ],
-      "args": {
-        "task": {
-          "description": "List of tasks to run. You can provide either ids or names (eg: component:task or task)",
-          "name": "task",
-          "required": true
-        }
-      },
-      "description": "Run tasks.",
+    "secrets:providers": {
+      "aliases": [],
+      "args": {},
+      "description": "Show configured secret providers and their status.",
       "examples": [
         "<%= config.bin %> <%= command.id %>"
       ],
@@ -1585,33 +1586,22 @@
           "multiple": false,
           "type": "option"
         },
-        "executor": {
-          "char": "x",
-          "description": "Where to run the task. (experimental!)",
-          "name": "executor",
+        "flavor": {
+          "description": "Specify the flavor to use.",
+          "name": "flavor",
+          "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
-          "options": [
-            "container",
-            "local"
-          ],
           "type": "option"
-        },
-        "all-matching": {
-          "char": "a",
-          "description": "Run all tasks matching (when multiple matches)",
-          "name": "all-matching",
-          "allowNo": false,
-          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "tasks:run",
+      "id": "secrets:providers",
       "pluginAlias": "@enspirit/emb",
       "pluginName": "@enspirit/emb",
       "pluginType": "core",
-      "strict": false,
+      "strict": true,
       "enableJsonFlag": true,
       "isESM": true,
       "relativePath": [
@@ -1619,16 +1609,17 @@
         "src",
         "cli",
         "commands",
-        "tasks",
-        "run.js"
+        "secrets",
+        "providers.js"
       ]
     },
-    "secrets": {
+    "secrets:validate": {
       "aliases": [],
       "args": {},
-      "description": "List all secret references in the configuration.",
+      "description": "Validate that all secret references can be resolved (without showing values).",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --fail-fast",
         "<%= config.bin %> <%= command.id %> --json"
       ],
       "flags": {
@@ -1660,11 +1651,17 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "fail-fast": {
+          "description": "Stop on first validation error",
+          "name": "fail-fast",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "secrets",
+      "id": "secrets:validate",
       "pluginAlias": "@enspirit/emb",
       "pluginName": "@enspirit/emb",
       "pluginType": "core",
@@ -1677,13 +1674,13 @@
         "cli",
         "commands",
         "secrets",
-        "index.js"
+        "validate.js"
       ]
     },
-    "secrets:providers": {
+    "tasks": {
       "aliases": [],
       "args": {},
-      "description": "Show configured secret providers and their status.",
+      "description": "List tasks.",
       "examples": [
         "<%= config.bin %> <%= command.id %>"
       ],
@@ -1708,19 +1705,11 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        },
-        "flavor": {
-          "description": "Specify the flavor to use.",
-          "name": "flavor",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "secrets:providers",
+      "id": "tasks",
       "pluginAlias": "@enspirit/emb",
       "pluginName": "@enspirit/emb",
       "pluginType": "core",
@@ -1732,18 +1721,24 @@
         "src",
         "cli",
         "commands",
-        "secrets",
-        "providers.js"
+        "tasks",
+        "index.js"
       ]
     },
-    "secrets:validate": {
-      "aliases": [],
-      "args": {},
-      "description": "Validate that all secret references can be resolved (without showing values).",
+    "tasks:run": {
+      "aliases": [
+        "run"
+      ],
+      "args": {
+        "task": {
+          "description": "List of tasks to run. You can provide either ids or names (eg: component:task or task)",
+          "name": "task",
+          "required": true
+        }
+      },
+      "description": "Run tasks.",
       "examples": [
-        "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> --fail-fast",
-        "<%= config.bin %> <%= command.id %> --json"
+        "<%= config.bin %> <%= command.id %>"
       ],
       "flags": {
         "json": {
@@ -1767,28 +1762,33 @@
           "multiple": false,
           "type": "option"
         },
-        "flavor": {
-          "description": "Specify the flavor to use.",
-          "name": "flavor",
-          "required": false,
+        "executor": {
+          "char": "x",
+          "description": "Where to run the task. (experimental!)",
+          "name": "executor",
           "hasDynamicHelp": false,
           "multiple": false,
+          "options": [
+            "container",
+            "local"
+          ],
           "type": "option"
         },
-        "fail-fast": {
-          "description": "Stop on first validation error",
-          "name": "fail-fast",
+        "all-matching": {
+          "char": "a",
+          "description": "Run all tasks matching (when multiple matches)",
+          "name": "all-matching",
           "allowNo": false,
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "secrets:validate",
+      "id": "tasks:run",
       "pluginAlias": "@enspirit/emb",
       "pluginName": "@enspirit/emb",
       "pluginType": "core",
-      "strict": true,
+      "strict": false,
       "enableJsonFlag": true,
       "isESM": true,
       "relativePath": [
@@ -1796,10 +1796,10 @@
         "src",
         "cli",
         "commands",
-        "secrets",
-        "validate.js"
+        "tasks",
+        "run.js"
       ]
     }
   },
-  "version": "0.18.0"
+  "version": "0.20.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@enspirit/emb",
   "type": "module",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "keywords": [
     "monorepo",
     "docker",