dagger-env 0.6.8 → 1.1.0

package/README.md

@@ -1,6 +1,6 @@
 # dagger-env
 
-A type-safe, reusable environment configuration abstraction for Dagger modules with full Zod v4 validation and 1Password integration.
+A type-safe, reusable environment configuration abstraction for Dagger modules with full Zod v4 validation and Infisical or 1Password integration.
 
 ## Features
 
@@ -9,7 +9,7 @@ A type-safe, reusable environment configuration abstraction for Dagger modules w
 - 🎯 **Consistent**: Standardized API across all Dagger modules
 - 🛡️ **Validated**: Runtime validation of arguments, environment variables, and secrets
 - 📦 **Modular**: Secret presets and derived environment variables
-- 🔐 **1Password Integration**: Built-in command runner with `op run` support
+- 🔐 **Infisical & 1Password Integration**: Built-in command runner backed by `infisical export` or `op run`
 - 🚀 **Easy to use**: Simple configuration-based setup
 
 ## Installation
@@ -18,7 +18,7 @@ A type-safe, reusable environment configuration abstraction for Dagger modules w
 npm install dagger-env zod
 ```
 
-**Note:** The command runner functionality (`dagger-env/run`) requires the 1Password CLI (`op`) to be installed.
+**Note:** The command runner functionality (`dagger-env/run`) requires either the Infisical CLI (`infisical`) or the 1Password CLI (`op`) to be installed and authenticated, depending on which provider you configure.
 
 ## Quick Start
 
@@ -73,9 +73,9 @@ export class MyModule {
 }
 ```
 
-## Command Runner (1Password Integration)
+## Command Runner (Infisical or 1Password Integration)
 
-For projects using 1Password for secret management, `dagger-env` provides a convenient command runner that integrates with `op run`:
+`dagger-env` provides a convenient command runner that fetches secrets from Infisical (via `infisical export`) or 1Password (via `op item get`) and passes them to `dagger call` via the `DAGGER_OPTIONS` environment variable. The provider is selected by the shape of the config you pass to `createDaggerCommandRunner()`:
 
 ```typescript
 import { createDaggerEnv } from 'dagger-env'
@@ -100,16 +100,11 @@ const myDaggerEnv = createDaggerEnv({
   derivedEnvVars: {}
 })
 
-// Create a command runner - simply pass your DaggerEnv instance
+// Create a command runner with Infisical - simply pass your DaggerEnv instance
 const runDaggerCommand = createDaggerCommandRunner({
-  opVault: 'your-vault-id',
-  opItem: 'your-item-id',
-  opSections: [
-    {
-      id: 'your-section-id',
-      label: 'Shared'
-    }
-  ],
+  projectId: 'your-project-id',
+  env: 'prod',
+  path: '/ci/my-repo',
   dockerCommands: ['build', 'deploy', 'test'],
   daggerEnv: myDaggerEnv
 })
@@ -121,18 +116,34 @@ await runDaggerCommand('test', {
 })
 ```
 
-### Advanced Configuration
+### 1Password Integration
+
+To use 1Password instead of Infisical, pass `opVault`/`opItem`/`opSections` instead of `projectId`/`env`/`path`. Secrets are read from the specified sections of a 1Password item, and `dagger call` is wrapped in `op run --no-masking` so that `op://` references in the environment are resolved:
 
 ```typescript
-// Advanced configuration with multiple sections and pre-command setup
 const runDaggerCommand = createDaggerCommandRunner({
   opVault: 'your-vault-id',
   opItem: 'your-item-id',
   opSections: [
-    { id: 'shared-section-id', label: 'Shared' },
-    { id: 'project-section-id', label: 'Project Specific' }
+    {
+      id: 'your-section-id',
+      label: 'Shared'
+    }
   ],
   dockerCommands: ['build', 'deploy', 'test'],
+  daggerEnv: myDaggerEnv
+})
+```
+
+### Advanced Configuration
+
+```typescript
+// Advanced configuration with pre-command setup
+const runDaggerCommand = createDaggerCommandRunner({
+  projectId: 'your-project-id',
+  env: 'prod',
+  path: '/ci/my-repo',
+  dockerCommands: ['build', 'deploy', 'test'],
   beforeCommand: async () => {
     // Setup vendor files, modules, etc.
     console.log('Setting up environment...')
@@ -208,13 +219,22 @@ Returns array of secret names for a specific preset.
 
 #### `createDaggerCommandRunner(config)`
 
-Creates a function to run Dagger commands with 1Password integration.
+Creates a function to run Dagger commands with Infisical or 1Password integration. Pass either the Infisical or 1Password parameters to select the provider.
 
-**Parameters:**
+**Infisical parameters:**
+
+- `config.projectId`: Infisical project ID
+- `config.env`: Infisical environment slug (e.g. `prod`)
+- `config.path`: Infisical folder path to fetch secrets from (e.g. `/ci/my-repo`)
+
+**1Password parameters:**
 
 - `config.opVault`: 1Password vault ID
 - `config.opItem`: 1Password item ID
 - `config.opSections`: Array of 1Password sections to include for secrets
+
+**Shared parameters:**
+
 - `config.dockerCommands`: Optional array of command names that should include Docker socket
 - `config.beforeCommand`: Optional async function to run before executing the command
 - `config.daggerEnv`: DaggerEnv instance for schema validation and type safety

package/dist/run-dagger-cmd.d.ts

@@ -1,8 +1,28 @@
+import { z } from 'zod/v4';
 import type { DaggerEnv, DaggerEnvConfig } from './dagger-env.js';
 /**
- * Configuration for running Dagger commands with 1Password integration
+ * A single secret returned by `infisical export --format=json`
  */
-export interface RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvConfig> {
+export type InfisicalSecret = z.infer<typeof InfisicalSecret>;
+export declare const InfisicalSecret: z.ZodObject<{
+    key: z.ZodString;
+    value: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Infisical secrets provider configuration
+ */
+export interface InfisicalProviderConfig {
+    /** Infisical project ID */
+    projectId: string;
+    /** Infisical environment slug (e.g. `prod`) */
+    env: string;
+    /** Infisical folder path to fetch secrets from (e.g. `/ci/my-repo`) */
+    path: string;
+}
+/**
+ * 1Password secrets provider configuration
+ */
+export interface OnePasswordProviderConfig {
     /** 1Password vault ID */
     opVault: string;
     /** 1Password item ID */
@@ -12,6 +32,11 @@ export interface RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvCon
         label: string;
         id: string;
     }>;
+}
+/**
+ * Configuration shared by all secrets providers
+ */
+export interface RunDaggerCommandBaseConfig<T extends DaggerEnvConfig = DaggerEnvConfig> {
     /** Commands that should include Docker socket if available */
     dockerCommands?: string[];
     /** Hook to run before executing the command (e.g., vendor file setup) */
@@ -19,6 +44,10 @@ export interface RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvCon
     /** DaggerEnv instance for schema validation and type safety */
     daggerEnv: DaggerEnv<T>;
 }
+/**
+ * Configuration for running Dagger commands with Infisical or 1Password integration
+ */
+export type RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvConfig> = RunDaggerCommandBaseConfig<T> & (InfisicalProviderConfig | OnePasswordProviderConfig);
 /**
  * Options for individual command execution
  */
@@ -31,9 +60,10 @@ export interface RunDaggerCommandOptions {
     extraArgs?: string[];
 }
 /**
- * Creates a function to run Dagger commands with 1Password integration
+ * Creates a function to run Dagger commands with Infisical or 1Password integration
  * @param config Configuration for the command runner
  * @returns Function to execute Dagger commands
  */
-export declare function createDaggerCommandRunner<T extends DaggerEnvConfig>(config: RunDaggerCommandConfig<T>): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>;
+export declare function createDaggerCommandRunner<T extends DaggerEnvConfig>(config: RunDaggerCommandBaseConfig<T> & InfisicalProviderConfig): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>;
+export declare function createDaggerCommandRunner<T extends DaggerEnvConfig>(config: RunDaggerCommandBaseConfig<T> & OnePasswordProviderConfig): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>;
 //# sourceMappingURL=run-dagger-cmd.d.ts.map

package/dist/run-dagger-cmd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-dagger-cmd.d.ts","sourceRoot":"","sources":["../src/run-dagger-cmd.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjE;;GAEG;AACH,MAAM,WAAW,sBAAsB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe;IAClF,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,gDAAgD;IAChD,UAAU,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChD,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,+DAA+D;IAC/D,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,eAAe,EAClE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC,IAKhC,aAAa,MAAM,EACnB,UAAU,uBAAuB,KAC/B,OAAO,CAAC,IAAI,CAAC,CAuFhB"}
+{"version":3,"file":"run-dagger-cmd.d.ts","sourceRoot":"","sources":["../src/run-dagger-cmd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAK1B,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjE;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAC7D,eAAO,MAAM,eAAe;;;iBAG1B,CAAA;AAEF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACzC,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,gDAAgD;IAChD,UAAU,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe;IACtF,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,+DAA+D;IAC/D,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;CACvB;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAC7E,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,GAAG,yBAAyB,CAAC,CAAA;AAEtF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AA4CD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,eAAe,EAClE,MAAM,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAAG,uBAAuB,GAC7D,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAC5E,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,eAAe,EAClE,MAAM,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAAG,yBAAyB,GAC/D,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA"}

package/dist/run-dagger-cmd.js

@@ -1,24 +1,42 @@
+import { z } from 'zod/v4';
 import { $, fs } from 'zx';
 import { OPItem, OPSection } from './op.js';
+export const InfisicalSecret = z.object({
+    key: z.string(),
+    value: z.string(),
+});
 /**
- * Creates a function to run Dagger commands with 1Password integration
- * @param config Configuration for the command runner
- * @returns Function to execute Dagger commands
+ * Fetches secrets from Infisical via `infisical export`
  */
+async function fetchInfisicalSecrets(config) {
+    const exportedSecrets = InfisicalSecret.array().parse(await $ `infisical export --silent --format=json --projectId ${config.projectId} --env ${config.env} --path ${config.path}`.json());
+    return exportedSecrets.reduce((acc, s) => {
+        acc[s.key] = s.value;
+        return acc;
+    }, {});
+}
+/**
+ * Fetches secrets from a 1Password item, filtered to the configured sections
+ */
+async function fetchOnePasswordSecrets(config) {
+    const opItem = OPItem.parse(await $ `op item get ${config.opItem} --vault ${config.opVault} --format json`.json());
+    const sectionsToInclude = OPSection.array().parse(config.opSections);
+    return opItem.fields
+        .filter((f) => sectionsToInclude.some((s) => s.id === f.section?.id))
+        .reduce((acc, f) => {
+        acc[f.label] = f.value;
+        return acc;
+    }, {});
+}
 export function createDaggerCommandRunner(config) {
-    const opItemUri = `op://${config.opVault}/${config.opItem}`;
     return async function runDaggerCommand(commandName, options) {
         const { args = {}, env = {}, extraArgs = [] } = options ?? {};
         // Run any pre-command setup
         if (config.beforeCommand) {
             await config.beforeCommand();
         }
-        // Environment variables to pass to the `op run` command
+        // Environment variables to pass to the spawned command
         const envVars = {};
-        // Pass dagger cloud token in CI because we don't have user auth
-        if (process.env.CI !== undefined) {
-            envVars.DAGGER_CLOUD_TOKEN = `${opItemUri}/DAGGER_CLOUD_TOKEN`;
-        }
         const commandArgs = [...extraArgs];
         // Add Docker socket for specific commands if available
         if (config.dockerCommands?.includes(commandName)) {
@@ -31,17 +49,23 @@ export function createDaggerCommandRunner(config) {
                 // Ignore if fs is not available or docker socket doesn't exist
             }
         }
-        // Fetch 1Password item
-        const opItem = OPItem.parse(await $ `op item get ${config.opItem} --vault ${config.opVault} --format json`.json());
-        // Parse sections to include
-        const sectionsToInclude = OPSection.array().parse(config.opSections);
-        // Extract secrets from specified sections
-        const secrets = opItem.fields
-            .filter((f) => sectionsToInclude.some((s) => s.id === f.section?.id))
-            .reduce((acc, f) => {
-            acc[f.label] = f.value;
-            return acc;
-        }, {});
+        // Fetch secrets from the configured provider
+        let secrets;
+        if ('opVault' in config) {
+            secrets = await fetchOnePasswordSecrets(config);
+            // Pass dagger cloud token in CI because we don't have user auth.
+            // The op:// reference is resolved by the `op run` wrapper below.
+            if (process.env.CI !== undefined) {
+                envVars.DAGGER_CLOUD_TOKEN = `op://${config.opVault}/${config.opItem}/DAGGER_CLOUD_TOKEN`;
+            }
+        }
+        else {
+            secrets = await fetchInfisicalSecrets(config);
+            // Pass dagger cloud token in CI because we don't have user auth
+            if (process.env.CI !== undefined && secrets.DAGGER_CLOUD_TOKEN !== undefined) {
+                envVars.DAGGER_CLOUD_TOKEN = secrets.DAGGER_CLOUD_TOKEN;
+            }
+        }
         // Build environment variables for Dagger
         const daggerEnv = { ...env };
         if (process.env.CI !== undefined) {
@@ -57,12 +81,10 @@ export function createDaggerCommandRunner(config) {
             secrets,
         });
         envVars.DAGGER_OPTIONS = JSON.stringify(daggerOptions);
-        // Construct the command
+        // Construct the command. 1Password wraps `dagger call` in `op run`
+        // so that op:// references in the environment are resolved.
         const cmd = [
-            'op',
-            'run',
-            '--no-masking',
-            '--',
+            ...('opVault' in config ? ['op', 'run', '--no-masking', '--'] : []),
             'dagger',
             'call',
             commandName,

package/dist/run-dagger-cmd.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-dagger-cmd.js","sourceRoot":"","sources":["../src/run-dagger-cmd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,IAAI,CAAA;AAE1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAkC3C;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACxC,MAAiC;IAEjC,MAAM,SAAS,GAAG,QAAQ,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAA;IAE3D,OAAO,KAAK,UAAU,gBAAgB,CACrC,WAAmB,EACnB,OAAiC;QAEjC,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAE7D,4BAA4B;QAC5B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,MAAM,CAAC,aAAa,EAAE,CAAA;QAC7B,CAAC;QAED,wDAAwD;QACxD,MAAM,OAAO,GAA2B,EAAE,CAAA;QAE1C,gEAAgE;QAChE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,kBAAkB,GAAG,GAAG,SAAS,qBAAqB,CAAA;QAC/D,CAAC;QAED,MAAM,WAAW,GAAa,CAAC,GAAG,SAAS,CAAC,CAAA;QAE5C,uDAAuD;QACvD,IAAI,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACJ,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;oBAC7C,WAAW,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;gBACzD,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,+DAA+D;YAChE,CAAC;QACF,CAAC;QAED,uBAAuB;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAC1B,MAAM,CAAC,CAAA,eAAe,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,gBAAgB,CAAC,IAAI,EAAE,CACpF,CAAA;QAED,4BAA4B;QAC5B,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAEpE,0CAA0C;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM;aAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;aACpE,MAAM,CACN,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YACV,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;YACtB,OAAO,GAAG,CAAA;QACX,CAAC,EACD,EAA4B,CAC5B,CAAA;QAEF,yCAAyC;QACzC,MAAM,SAAS,GAA2B,EAAE,GAAG,GAAG,EAAE,CAAA;QACpD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAA;QAC9B,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC9C,SAAS,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;QACtD,CAAC;QAED,wCAAwC;QACxC,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC;YAC/D,IAAI;YACJ,GAAG,EAAE,SAAS;YACd,OAAO;SACP,CAAC,CAAA;QACF,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAEtD,wBAAwB;QACxB,MAAM,GAAG,GAAa;YACrB,IAAI;YACJ,KAAK;YACL,cAAc;YACd,IAAI;YACJ,QAAQ;YACR,MAAM;YACN,WAAW;YACX,GAAG,WAAW;YACd,gCAAgC;SAChC,CAAA;QAED,sBAAsB;QACtB,MAAM,CAAC,CAAC;YACP,GAAG,EAAE;gBACJ,GAAG,OAAO,CAAC,GAAG;gBACd,GAAG,OAAO;aACV;YACD,KAAK,EAAE,SAAS;SAChB,CAAC,CAAA,GAAG,GAAG,EAAE,CAAA;IACX,CAAC,CAAA;AACF,CAAC","sourcesContent":["import { $, fs } from 'zx'\n\nimport { OPItem, OPSection } from './op.js'\n\nimport type { DaggerEnv, DaggerEnvConfig } from './dagger-env.js'\n\n/**\n * Configuration for running Dagger commands with 1Password integration\n */\nexport interface RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvConfig> {\n\t/** 1Password vault ID */\n\topVault: string\n\t/** 1Password item ID */\n\topItem: string\n\t/** 1Password sections to include for secrets */\n\topSections: Array<{ label: string; id: string }>\n\t/** Commands that should include Docker socket if available */\n\tdockerCommands?: string[]\n\t/** Hook to run before executing the command (e.g., vendor file setup) */\n\tbeforeCommand?: () => Promise<void>\n\t/** DaggerEnv instance for schema validation and type safety */\n\tdaggerEnv: DaggerEnv<T>\n}\n\n/**\n * Options for individual command execution\n */\nexport interface RunDaggerCommandOptions {\n\t/** Arguments to pass to the Dagger command */\n\targs?: Record<string, any>\n\t/** Additional environment variables */\n\tenv?: Record<string, string>\n\t/** Additional command-line arguments */\n\textraArgs?: string[]\n}\n\n/**\n * Creates a function to run Dagger commands with 1Password integration\n * @param config Configuration for the command runner\n * @returns Function to execute Dagger commands\n */\nexport function createDaggerCommandRunner<T extends DaggerEnvConfig>(\n\tconfig: RunDaggerCommandConfig<T>\n) {\n\tconst opItemUri = `op://${config.opVault}/${config.opItem}`\n\n\treturn async function runDaggerCommand(\n\t\tcommandName: string,\n\t\toptions?: RunDaggerCommandOptions\n\t): Promise<void> {\n\t\tconst { args = {}, env = {}, extraArgs = [] } = options ?? {}\n\n\t\t// Run any pre-command setup\n\t\tif (config.beforeCommand) {\n\t\t\tawait config.beforeCommand()\n\t\t}\n\n\t\t// Environment variables to pass to the `op run` command\n\t\tconst envVars: Record<string, string> = {}\n\n\t\t// Pass dagger cloud token in CI because we don't have user auth\n\t\tif (process.env.CI !== undefined) {\n\t\t\tenvVars.DAGGER_CLOUD_TOKEN = `${opItemUri}/DAGGER_CLOUD_TOKEN`\n\t\t}\n\n\t\tconst commandArgs: string[] = [...extraArgs]\n\n\t\t// Add Docker socket for specific commands if available\n\t\tif (config.dockerCommands?.includes(commandName)) {\n\t\t\ttry {\n\t\t\t\tif (await fs.exists('/var/run/docker.sock')) {\n\t\t\t\t\tcommandArgs.push('--docker-socket=/var/run/docker.sock')\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t// Ignore if fs is not available or docker socket doesn't exist\n\t\t\t}\n\t\t}\n\n\t\t// Fetch 1Password item\n\t\tconst opItem = OPItem.parse(\n\t\t\tawait $`op item get ${config.opItem} --vault ${config.opVault} --format json`.json()\n\t\t)\n\n\t\t// Parse sections to include\n\t\tconst sectionsToInclude = OPSection.array().parse(config.opSections)\n\n\t\t// Extract secrets from specified sections\n\t\tconst secrets = opItem.fields\n\t\t\t.filter((f) => sectionsToInclude.some((s) => s.id === f.section?.id))\n\t\t\t.reduce(\n\t\t\t\t(acc, f) => {\n\t\t\t\t\tacc[f.label] = f.value\n\t\t\t\t\treturn acc\n\t\t\t\t},\n\t\t\t\t{} as Record<string, string>\n\t\t\t)\n\n\t\t// Build environment variables for Dagger\n\t\tconst daggerEnv: Record<string, string> = { ...env }\n\t\tif (process.env.CI !== undefined) {\n\t\t\tdaggerEnv.CI = process.env.CI\n\t\t}\n\t\tif (process.env.GITHUB_ACTIONS !== undefined) {\n\t\t\tdaggerEnv.GITHUB_ACTIONS = process.env.GITHUB_ACTIONS\n\t\t}\n\n\t\t// Validate and serialize dagger options\n\t\tconst daggerOptions = config.daggerEnv.getOptionsSchema().parse({\n\t\t\targs,\n\t\t\tenv: daggerEnv,\n\t\t\tsecrets,\n\t\t})\n\t\tenvVars.DAGGER_OPTIONS = JSON.stringify(daggerOptions)\n\n\t\t// Construct the command\n\t\tconst cmd: string[] = [\n\t\t\t'op',\n\t\t\t'run',\n\t\t\t'--no-masking',\n\t\t\t'--',\n\t\t\t'dagger',\n\t\t\t'call',\n\t\t\tcommandName,\n\t\t\t...commandArgs,\n\t\t\t'--options=env://DAGGER_OPTIONS',\n\t\t]\n\n\t\t// Execute the command\n\t\tawait $({\n\t\t\tenv: {\n\t\t\t\t...process.env,\n\t\t\t\t...envVars,\n\t\t\t},\n\t\t\tstdio: 'inherit',\n\t\t})`${cmd}`\n\t}\n}\n"]}
+{"version":3,"file":"run-dagger-cmd.js","sourceRoot":"","sources":["../src/run-dagger-cmd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAC1B,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,IAAI,CAAA;AAE1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAQ3C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAA;AAwDF;;GAEG;AACH,KAAK,UAAU,qBAAqB,CACnC,MAA+B;IAE/B,MAAM,eAAe,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,KAAK,CACpD,MAAM,CAAC,CAAA,uDAAuD,MAAM,CAAC,SAAS,UAAU,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CACjI,CAAA;IAED,OAAO,eAAe,CAAC,MAAM,CAC5B,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACV,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;QACpB,OAAO,GAAG,CAAA;IACX,CAAC,EACD,EAA4B,CAC5B,CAAA;AACF,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,uBAAuB,CACrC,MAAiC;IAEjC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAC1B,MAAM,CAAC,CAAA,eAAe,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,gBAAgB,CAAC,IAAI,EAAE,CACpF,CAAA;IAED,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAEpE,OAAO,MAAM,CAAC,MAAM;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;SACpE,MAAM,CACN,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACV,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;QACtB,OAAO,GAAG,CAAA;IACX,CAAC,EACD,EAA4B,CAC5B,CAAA;AACH,CAAC;AAaD,MAAM,UAAU,yBAAyB,CACxC,MAAiC;IAEjC,OAAO,KAAK,UAAU,gBAAgB,CACrC,WAAmB,EACnB,OAAiC;QAEjC,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAE7D,4BAA4B;QAC5B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,MAAM,CAAC,aAAa,EAAE,CAAA;QAC7B,CAAC;QAED,uDAAuD;QACvD,MAAM,OAAO,GAA2B,EAAE,CAAA;QAE1C,MAAM,WAAW,GAAa,CAAC,GAAG,SAAS,CAAC,CAAA;QAE5C,uDAAuD;QACvD,IAAI,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACJ,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;oBAC7C,WAAW,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;gBACzD,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,+DAA+D;YAChE,CAAC;QACF,CAAC;QAED,6CAA6C;QAC7C,IAAI,OAA+B,CAAA;QACnC,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAA;YAE/C,iEAAiE;YACjE,iEAAiE;YACjE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,CAAC,kBAAkB,GAAG,QAAQ,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,qBAAqB,CAAA;YAC1F,CAAC;QACF,CAAC;aAAM,CAAC;YACP,OAAO,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAA;YAE7C,gEAAgE;YAChE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBAC9E,OAAO,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAA;YACxD,CAAC;QACF,CAAC;QAED,yCAAyC;QACzC,MAAM,SAAS,GAA2B,EAAE,GAAG,GAAG,EAAE,CAAA;QACpD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAA;QAC9B,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC9C,SAAS,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;QACtD,CAAC;QAED,wCAAwC;QACxC,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC;YAC/D,IAAI;YACJ,GAAG,EAAE,SAAS;YACd,OAAO;SACP,CAAC,CAAA;QACF,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAEtD,mEAAmE;QACnE,4DAA4D;QAC5D,MAAM,GAAG,GAAa;YACrB,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,QAAQ;YACR,MAAM;YACN,WAAW;YACX,GAAG,WAAW;YACd,gCAAgC;SAChC,CAAA;QAED,sBAAsB;QACtB,MAAM,CAAC,CAAC;YACP,GAAG,EAAE;gBACJ,GAAG,OAAO,CAAC,GAAG;gBACd,GAAG,OAAO;aACV;YACD,KAAK,EAAE,SAAS;SAChB,CAAC,CAAA,GAAG,GAAG,EAAE,CAAA;IACX,CAAC,CAAA;AACF,CAAC","sourcesContent":["import { z } from 'zod/v4'\nimport { $, fs } from 'zx'\n\nimport { OPItem, OPSection } from './op.js'\n\nimport type { DaggerEnv, DaggerEnvConfig } from './dagger-env.js'\n\n/**\n * A single secret returned by `infisical export --format=json`\n */\nexport type InfisicalSecret = z.infer<typeof InfisicalSecret>\nexport const InfisicalSecret = z.object({\n\tkey: z.string(),\n\tvalue: z.string(),\n})\n\n/**\n * Infisical secrets provider configuration\n */\nexport interface InfisicalProviderConfig {\n\t/** Infisical project ID */\n\tprojectId: string\n\t/** Infisical environment slug (e.g. `prod`) */\n\tenv: string\n\t/** Infisical folder path to fetch secrets from (e.g. `/ci/my-repo`) */\n\tpath: string\n}\n\n/**\n * 1Password secrets provider configuration\n */\nexport interface OnePasswordProviderConfig {\n\t/** 1Password vault ID */\n\topVault: string\n\t/** 1Password item ID */\n\topItem: string\n\t/** 1Password sections to include for secrets */\n\topSections: Array<{ label: string; id: string }>\n}\n\n/**\n * Configuration shared by all secrets providers\n */\nexport interface RunDaggerCommandBaseConfig<T extends DaggerEnvConfig = DaggerEnvConfig> {\n\t/** Commands that should include Docker socket if available */\n\tdockerCommands?: string[]\n\t/** Hook to run before executing the command (e.g., vendor file setup) */\n\tbeforeCommand?: () => Promise<void>\n\t/** DaggerEnv instance for schema validation and type safety */\n\tdaggerEnv: DaggerEnv<T>\n}\n\n/**\n * Configuration for running Dagger commands with Infisical or 1Password integration\n */\nexport type RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvConfig> =\n\tRunDaggerCommandBaseConfig<T> & (InfisicalProviderConfig | OnePasswordProviderConfig)\n\n/**\n * Options for individual command execution\n */\nexport interface RunDaggerCommandOptions {\n\t/** Arguments to pass to the Dagger command */\n\targs?: Record<string, any>\n\t/** Additional environment variables */\n\tenv?: Record<string, string>\n\t/** Additional command-line arguments */\n\textraArgs?: string[]\n}\n\n/**\n * Fetches secrets from Infisical via `infisical export`\n */\nasync function fetchInfisicalSecrets(\n\tconfig: InfisicalProviderConfig\n): Promise<Record<string, string>> {\n\tconst exportedSecrets = InfisicalSecret.array().parse(\n\t\tawait $`infisical export --silent --format=json --projectId ${config.projectId} --env ${config.env} --path ${config.path}`.json()\n\t)\n\n\treturn exportedSecrets.reduce(\n\t\t(acc, s) => {\n\t\t\tacc[s.key] = s.value\n\t\t\treturn acc\n\t\t},\n\t\t{} as Record<string, string>\n\t)\n}\n\n/**\n * Fetches secrets from a 1Password item, filtered to the configured sections\n */\nasync function fetchOnePasswordSecrets(\n\tconfig: OnePasswordProviderConfig\n): Promise<Record<string, string>> {\n\tconst opItem = OPItem.parse(\n\t\tawait $`op item get ${config.opItem} --vault ${config.opVault} --format json`.json()\n\t)\n\n\tconst sectionsToInclude = OPSection.array().parse(config.opSections)\n\n\treturn opItem.fields\n\t\t.filter((f) => sectionsToInclude.some((s) => s.id === f.section?.id))\n\t\t.reduce(\n\t\t\t(acc, f) => {\n\t\t\t\tacc[f.label] = f.value\n\t\t\t\treturn acc\n\t\t\t},\n\t\t\t{} as Record<string, string>\n\t\t)\n}\n\n/**\n * Creates a function to run Dagger commands with Infisical or 1Password integration\n * @param config Configuration for the command runner\n * @returns Function to execute Dagger commands\n */\nexport function createDaggerCommandRunner<T extends DaggerEnvConfig>(\n\tconfig: RunDaggerCommandBaseConfig<T> & InfisicalProviderConfig\n): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>\nexport function createDaggerCommandRunner<T extends DaggerEnvConfig>(\n\tconfig: RunDaggerCommandBaseConfig<T> & OnePasswordProviderConfig\n): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>\nexport function createDaggerCommandRunner<T extends DaggerEnvConfig>(\n\tconfig: RunDaggerCommandConfig<T>\n) {\n\treturn async function runDaggerCommand(\n\t\tcommandName: string,\n\t\toptions?: RunDaggerCommandOptions\n\t): Promise<void> {\n\t\tconst { args = {}, env = {}, extraArgs = [] } = options ?? {}\n\n\t\t// Run any pre-command setup\n\t\tif (config.beforeCommand) {\n\t\t\tawait config.beforeCommand()\n\t\t}\n\n\t\t// Environment variables to pass to the spawned command\n\t\tconst envVars: Record<string, string> = {}\n\n\t\tconst commandArgs: string[] = [...extraArgs]\n\n\t\t// Add Docker socket for specific commands if available\n\t\tif (config.dockerCommands?.includes(commandName)) {\n\t\t\ttry {\n\t\t\t\tif (await fs.exists('/var/run/docker.sock')) {\n\t\t\t\t\tcommandArgs.push('--docker-socket=/var/run/docker.sock')\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t// Ignore if fs is not available or docker socket doesn't exist\n\t\t\t}\n\t\t}\n\n\t\t// Fetch secrets from the configured provider\n\t\tlet secrets: Record<string, string>\n\t\tif ('opVault' in config) {\n\t\t\tsecrets = await fetchOnePasswordSecrets(config)\n\n\t\t\t// Pass dagger cloud token in CI because we don't have user auth.\n\t\t\t// The op:// reference is resolved by the `op run` wrapper below.\n\t\t\tif (process.env.CI !== undefined) {\n\t\t\t\tenvVars.DAGGER_CLOUD_TOKEN = `op://${config.opVault}/${config.opItem}/DAGGER_CLOUD_TOKEN`\n\t\t\t}\n\t\t} else {\n\t\t\tsecrets = await fetchInfisicalSecrets(config)\n\n\t\t\t// Pass dagger cloud token in CI because we don't have user auth\n\t\t\tif (process.env.CI !== undefined && secrets.DAGGER_CLOUD_TOKEN !== undefined) {\n\t\t\t\tenvVars.DAGGER_CLOUD_TOKEN = secrets.DAGGER_CLOUD_TOKEN\n\t\t\t}\n\t\t}\n\n\t\t// Build environment variables for Dagger\n\t\tconst daggerEnv: Record<string, string> = { ...env }\n\t\tif (process.env.CI !== undefined) {\n\t\t\tdaggerEnv.CI = process.env.CI\n\t\t}\n\t\tif (process.env.GITHUB_ACTIONS !== undefined) {\n\t\t\tdaggerEnv.GITHUB_ACTIONS = process.env.GITHUB_ACTIONS\n\t\t}\n\n\t\t// Validate and serialize dagger options\n\t\tconst daggerOptions = config.daggerEnv.getOptionsSchema().parse({\n\t\t\targs,\n\t\t\tenv: daggerEnv,\n\t\t\tsecrets,\n\t\t})\n\t\tenvVars.DAGGER_OPTIONS = JSON.stringify(daggerOptions)\n\n\t\t// Construct the command. 1Password wraps `dagger call` in `op run`\n\t\t// so that op:// references in the environment are resolved.\n\t\tconst cmd: string[] = [\n\t\t\t...('opVault' in config ? ['op', 'run', '--no-masking', '--'] : []),\n\t\t\t'dagger',\n\t\t\t'call',\n\t\t\tcommandName,\n\t\t\t...commandArgs,\n\t\t\t'--options=env://DAGGER_OPTIONS',\n\t\t]\n\n\t\t// Execute the command\n\t\tawait $({\n\t\t\tenv: {\n\t\t\t\t...process.env,\n\t\t\t\t...envVars,\n\t\t\t},\n\t\t\tstdio: 'inherit',\n\t\t})`${cmd}`\n\t}\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dagger-env",
-  "version": "0.6.8",
+  "version": "1.1.0",
   "private": false,
   "description": "A type-safe, reusable environment configuration abstraction for Dagger modules.",
   "keywords": [

package/src/examples/run-dagger-cmd-usage.ts

@@ -2,7 +2,7 @@
  * Example usage of the runDaggerCommand abstraction
  *
  * This example shows a realistic configuration for a project that uses Dagger
- * with 1Password integration for secret management.
+ * with Infisical or 1Password integration for secret management.
  *
  * Import pattern:
  * - Main DaggerEnv functionality: import { createDaggerEnv } from 'dagger-env'
@@ -56,8 +56,27 @@ const daggerEnv = createDaggerEnv({
 	derivedEnvVars: {} as const,
 })
 
-// Create the command runner with 1Password configuration
+// Create the command runner with Infisical configuration
 export const runDaggerCommand = createDaggerCommandRunner({
+	// Infisical configuration
+	projectId: 'your-project-id', // Replace with your actual Infisical project ID
+	env: 'prod', // Infisical environment slug
+	path: '/ci/my-repo', // Infisical folder path to fetch secrets from
+	// Commands that need Docker socket access
+	dockerCommands: ['build', 'test', 'deploy', 'migrate', 'seed'],
+	// Optional: Run setup before executing commands
+	beforeCommand: async () => {
+		// Example: Set up vendor files, download dependencies, etc.
+		console.log('Preparing Dagger environment...')
+		// const modules = await getDaggerModules()
+		// await setupDaggerVendorFiles(modules)
+	},
+	// Pass the DaggerEnv instance directly
+	daggerEnv,
+})
+
+// Alternatively, create a command runner with 1Password configuration
+export const runDaggerCommandWithOnePassword = createDaggerCommandRunner({
 	// 1Password configuration
 	opVault: 'your-vault-id', // Replace with your actual vault ID
 	opItem: 'your-item-id', // Replace with your actual item ID
@@ -73,13 +92,6 @@ export const runDaggerCommand = createDaggerCommandRunner({
 	],
 	// Commands that need Docker socket access
 	dockerCommands: ['build', 'test', 'deploy', 'migrate', 'seed'],
-	// Optional: Run setup before executing commands
-	beforeCommand: async () => {
-		// Example: Set up vendor files, download dependencies, etc.
-		console.log('Preparing Dagger environment...')
-		// const modules = await getDaggerModules()
-		// await setupDaggerVendorFiles(modules)
-	},
 	// Pass the DaggerEnv instance directly
 	daggerEnv,
 })

package/src/run-dagger-cmd.spec.ts

@@ -0,0 +1,314 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { z } from 'zod/v4'
+
+import { createDaggerEnv } from './dagger-env'
+import { createDaggerCommandRunner } from './run-dagger-cmd'
+
+import type { OPItem } from './op'
+import type { RunDaggerCommandConfig } from './run-dagger-cmd'
+
+const mocks = vi.hoisted(() => ({
+	/** Resolves the JSON payload returned by the secrets CLI (`infisical export` / `op item get`) */
+	fetchJson: vi.fn(),
+	/** Records the rendered secrets fetch command string */
+	fetchCmd: vi.fn(),
+	/** Records the final command execution: (options, argv) */
+	spawn: vi.fn(
+		async (_opts: { env: Record<string, string | undefined> }, _argv: string[]) => undefined
+	),
+	/** Mock for fs.exists() (docker socket probe) */
+	exists: vi.fn(async () => false),
+}))
+
+vi.mock('zx', () => {
+	const $ = (firstArg: unknown, ...vals: unknown[]) => {
+		if (Array.isArray(firstArg)) {
+			// Direct template call: $`infisical export ...` / $`op item get ...`
+			const pieces = firstArg as readonly string[]
+			const cmd = pieces.reduce(
+				(acc, piece, i) => acc + piece + (i < vals.length ? String(vals[i]) : ''),
+				''
+			)
+			mocks.fetchCmd(cmd)
+			return { json: mocks.fetchJson }
+		}
+		// Options call: $({ env, stdio }) returns a template executor
+		return (_pieces: TemplateStringsArray, ...templateVals: unknown[]) =>
+			mocks.spawn(
+				firstArg as { env: Record<string, string | undefined> },
+				templateVals[0] as string[]
+			)
+	}
+	return { $, fs: { exists: mocks.exists } }
+})
+
+/**
+ * Environment variables passed to the spawned process
+ */
+type SpawnEnv = Record<string, string | undefined>
+
+function getSpawnCall(): { env: SpawnEnv; argv: string[] } {
+	expect(mocks.spawn).toHaveBeenCalledTimes(1)
+	const call = mocks.spawn.mock.calls.at(0)
+	if (!call) {
+		throw new Error('spawn was not called')
+	}
+	const [opts, argv] = call
+	return { env: opts.env, argv }
+}
+
+function createTestDaggerEnv() {
+	return createDaggerEnv({
+		args: z.object({
+			push: z.string().optional(),
+		}),
+		env: z.object({
+			CI: z.string().optional(),
+			GITHUB_ACTIONS: z.string().optional(),
+			NODE_ENV: z.string().optional(),
+		}),
+		secrets: z.object({
+			API_TOKEN: z.string(),
+		}),
+		secretPresets: {
+			api: ['API_TOKEN'],
+		},
+		derivedEnvVars: {},
+	})
+}
+
+function createRunner(overrides?: Partial<Pick<RunDaggerCommandConfig, 'dockerCommands'>>) {
+	return createDaggerCommandRunner({
+		projectId: 'test-project-id',
+		env: 'prod',
+		path: '/ci/test',
+		daggerEnv: createTestDaggerEnv(),
+		...overrides,
+	})
+}
+
+function createOnePasswordRunner(
+	overrides?: Partial<Pick<RunDaggerCommandConfig, 'dockerCommands'>>
+) {
+	return createDaggerCommandRunner({
+		opVault: 'test-vault-id',
+		opItem: 'test-item-id',
+		opSections: [{ id: 'shared-section-id', label: 'Shared' }],
+		daggerEnv: createTestDaggerEnv(),
+		...overrides,
+	})
+}
+
+/**
+ * A realistic `op item get --format json` payload with one field in the
+ * configured section and one field in an excluded section
+ */
+const testOPItem: OPItem = {
+	id: 'test-item-id',
+	title: 'Test Item',
+	favorite: false,
+	version: 1,
+	vault: { id: 'test-vault-id', name: 'Test Vault' },
+	category: 'SECURE_NOTE',
+	last_edited_by: 'test-user',
+	created_at: '2024-01-01T00:00:00Z',
+	updated_at: '2024-01-01T00:00:00Z',
+	additional_information: '',
+	sections: [
+		{ id: 'shared-section-id', label: 'Shared' },
+		{ id: 'other-section-id', label: 'Other' },
+	],
+	fields: [
+		{
+			id: 'field-1',
+			section: { id: 'shared-section-id', label: 'Shared' },
+			type: 'CONCEALED',
+			label: 'API_TOKEN',
+			value: 'test-api-token',
+			reference: 'op://test-vault-id/test-item-id/API_TOKEN',
+		},
+		{
+			id: 'field-2',
+			section: { id: 'other-section-id', label: 'Other' },
+			type: 'CONCEALED',
+			label: 'EXCLUDED_SECRET',
+			value: 'excluded-value',
+			reference: 'op://test-vault-id/test-item-id/EXCLUDED_SECRET',
+		},
+	],
+}
+
+describe('createDaggerCommandRunner()', () => {
+	beforeEach(() => {
+		vi.clearAllMocks()
+		vi.stubEnv('CI', undefined)
+		vi.stubEnv('GITHUB_ACTIONS', undefined)
+		vi.stubEnv('DAGGER_CLOUD_TOKEN', undefined)
+	})
+
+	afterEach(() => {
+		vi.unstubAllEnvs()
+	})
+
+	describe('infisical', () => {
+		beforeEach(() => {
+			mocks.fetchJson.mockResolvedValue([
+				{ key: 'API_TOKEN', value: 'test-api-token', comment: '' },
+				{ key: 'DAGGER_CLOUD_TOKEN', value: 'test-dagger-cloud-token', comment: '' },
+			])
+		})
+
+		it('builds the expected DAGGER_OPTIONS payload from the infisical export', async () => {
+			const runDaggerCommand = createRunner()
+			await runDaggerCommand('test-cmd', {
+				args: { push: 'true' },
+				env: { NODE_ENV: 'production' },
+			})
+
+			expect(mocks.fetchCmd).toHaveBeenCalledWith(
+				'infisical export --silent --format=json --projectId test-project-id --env prod --path /ci/test'
+			)
+
+			const { env } = getSpawnCall()
+			expect(JSON.parse(env.DAGGER_OPTIONS as string)).toStrictEqual({
+				args: { push: 'true' },
+				env: { NODE_ENV: 'production' },
+				secrets: { API_TOKEN: 'test-api-token' },
+			})
+			expect(env.DAGGER_CLOUD_TOKEN).toBeUndefined()
+		})
+
+		it('passes DAGGER_CLOUD_TOKEN to the runner env (but not DAGGER_OPTIONS) in CI', async () => {
+			vi.stubEnv('CI', 'true')
+			vi.stubEnv('GITHUB_ACTIONS', 'true')
+
+			const runDaggerCommand = createRunner()
+			await runDaggerCommand('test-cmd')
+
+			const { env } = getSpawnCall()
+			const daggerOptions = JSON.parse(env.DAGGER_OPTIONS as string)
+			expect(daggerOptions.secrets).not.toHaveProperty('DAGGER_CLOUD_TOKEN')
+			expect(daggerOptions.env).toStrictEqual({ CI: 'true', GITHUB_ACTIONS: 'true' })
+			expect(env.DAGGER_CLOUD_TOKEN).toBe('test-dagger-cloud-token')
+		})
+
+		it('spawns dagger directly without an op wrapper', async () => {
+			const runDaggerCommand = createRunner()
+			await runDaggerCommand('test-cmd', { extraArgs: ['--verbose'] })
+
+			const { argv } = getSpawnCall()
+			expect(argv[0]).toBe('dagger')
+			expect(argv).not.toContain('op')
+			expect(argv).toStrictEqual([
+				'dagger',
+				'call',
+				'test-cmd',
+				'--verbose',
+				'--options=env://DAGGER_OPTIONS',
+			])
+		})
+	})
+
+	describe('1password', () => {
+		beforeEach(() => {
+			mocks.fetchJson.mockResolvedValue(testOPItem)
+		})
+
+		it('builds the expected DAGGER_OPTIONS payload from the op item sections', async () => {
+			const runDaggerCommand = createOnePasswordRunner()
+			await runDaggerCommand('test-cmd', {
+				args: { push: 'true' },
+				env: { NODE_ENV: 'production' },
+			})
+
+			expect(mocks.fetchCmd).toHaveBeenCalledWith(
+				'op item get test-item-id --vault test-vault-id --format json'
+			)
+
+			const { env } = getSpawnCall()
+			expect(JSON.parse(env.DAGGER_OPTIONS as string)).toStrictEqual({
+				args: { push: 'true' },
+				env: { NODE_ENV: 'production' },
+				secrets: { API_TOKEN: 'test-api-token' },
+			})
+			expect(env.DAGGER_CLOUD_TOKEN).toBeUndefined()
+		})
+
+		it('wraps dagger call in op run --no-masking', async () => {
+			const runDaggerCommand = createOnePasswordRunner()
+			await runDaggerCommand('test-cmd', { extraArgs: ['--verbose'] })
+
+			const { argv } = getSpawnCall()
+			expect(argv).toStrictEqual([
+				'op',
+				'run',
+				'--no-masking',
+				'--',
+				'dagger',
+				'call',
+				'test-cmd',
+				'--verbose',
+				'--options=env://DAGGER_OPTIONS',
+			])
+		})
+
+		it('passes DAGGER_CLOUD_TOKEN as an op:// reference in CI', async () => {
+			vi.stubEnv('CI', 'true')
+			vi.stubEnv('GITHUB_ACTIONS', 'true')
+
+			const runDaggerCommand = createOnePasswordRunner()
+			await runDaggerCommand('test-cmd')
+
+			const { env } = getSpawnCall()
+			const daggerOptions = JSON.parse(env.DAGGER_OPTIONS as string)
+			expect(daggerOptions.secrets).not.toHaveProperty('DAGGER_CLOUD_TOKEN')
+			expect(daggerOptions.env).toStrictEqual({ CI: 'true', GITHUB_ACTIONS: 'true' })
+			expect(env.DAGGER_CLOUD_TOKEN).toBe('op://test-vault-id/test-item-id/DAGGER_CLOUD_TOKEN')
+		})
+	})
+
+	describe('docker socket', () => {
+		beforeEach(() => {
+			mocks.fetchJson.mockResolvedValue([
+				{ key: 'API_TOKEN', value: 'test-api-token', comment: '' },
+			])
+		})
+
+		it('appends --docker-socket for dockerCommands when the socket exists', async () => {
+			mocks.exists.mockResolvedValue(true)
+
+			const runDaggerCommand = createRunner({ dockerCommands: ['build'] })
+			await runDaggerCommand('build')
+
+			const { argv } = getSpawnCall()
+			expect(argv).toStrictEqual([
+				'dagger',
+				'call',
+				'build',
+				'--docker-socket=/var/run/docker.sock',
+				'--options=env://DAGGER_OPTIONS',
+			])
+		})
+
+		it('does not append --docker-socket for non-docker commands', async () => {
+			mocks.exists.mockResolvedValue(true)
+
+			const runDaggerCommand = createRunner({ dockerCommands: ['build'] })
+			await runDaggerCommand('test-cmd')
+
+			const { argv } = getSpawnCall()
+			expect(argv).not.toContain('--docker-socket=/var/run/docker.sock')
+			expect(mocks.exists).not.toHaveBeenCalled()
+		})
+
+		it('does not append --docker-socket when the socket does not exist', async () => {
+			mocks.exists.mockResolvedValue(false)
+
+			const runDaggerCommand = createRunner({ dockerCommands: ['build'] })
+			await runDaggerCommand('build')
+
+			const { argv } = getSpawnCall()
+			expect(argv).not.toContain('--docker-socket=/var/run/docker.sock')
+		})
+	})
+})

package/src/run-dagger-cmd.ts

@@ -1,3 +1,4 @@
+import { z } from 'zod/v4'
 import { $, fs } from 'zx'
 
 import { OPItem, OPSection } from './op.js'
@@ -5,15 +6,42 @@ import { OPItem, OPSection } from './op.js'
 import type { DaggerEnv, DaggerEnvConfig } from './dagger-env.js'
 
 /**
- * Configuration for running Dagger commands with 1Password integration
+ * A single secret returned by `infisical export --format=json`
  */
-export interface RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvConfig> {
+export type InfisicalSecret = z.infer<typeof InfisicalSecret>
+export const InfisicalSecret = z.object({
+	key: z.string(),
+	value: z.string(),
+})
+
+/**
+ * Infisical secrets provider configuration
+ */
+export interface InfisicalProviderConfig {
+	/** Infisical project ID */
+	projectId: string
+	/** Infisical environment slug (e.g. `prod`) */
+	env: string
+	/** Infisical folder path to fetch secrets from (e.g. `/ci/my-repo`) */
+	path: string
+}
+
+/**
+ * 1Password secrets provider configuration
+ */
+export interface OnePasswordProviderConfig {
 	/** 1Password vault ID */
 	opVault: string
 	/** 1Password item ID */
 	opItem: string
 	/** 1Password sections to include for secrets */
 	opSections: Array<{ label: string; id: string }>
+}
+
+/**
+ * Configuration shared by all secrets providers
+ */
+export interface RunDaggerCommandBaseConfig<T extends DaggerEnvConfig = DaggerEnvConfig> {
 	/** Commands that should include Docker socket if available */
 	dockerCommands?: string[]
 	/** Hook to run before executing the command (e.g., vendor file setup) */
@@ -22,6 +50,12 @@ export interface RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvCon
 	daggerEnv: DaggerEnv<T>
 }
 
+/**
+ * Configuration for running Dagger commands with Infisical or 1Password integration
+ */
+export type RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvConfig> =
+	RunDaggerCommandBaseConfig<T> & (InfisicalProviderConfig | OnePasswordProviderConfig)
+
 /**
  * Options for individual command execution
  */
@@ -35,15 +69,61 @@ export interface RunDaggerCommandOptions {
 }
 
 /**
- * Creates a function to run Dagger commands with 1Password integration
+ * Fetches secrets from Infisical via `infisical export`
+ */
+async function fetchInfisicalSecrets(
+	config: InfisicalProviderConfig
+): Promise<Record<string, string>> {
+	const exportedSecrets = InfisicalSecret.array().parse(
+		await $`infisical export --silent --format=json --projectId ${config.projectId} --env ${config.env} --path ${config.path}`.json()
+	)
+
+	return exportedSecrets.reduce(
+		(acc, s) => {
+			acc[s.key] = s.value
+			return acc
+		},
+		{} as Record<string, string>
+	)
+}
+
+/**
+ * Fetches secrets from a 1Password item, filtered to the configured sections
+ */
+async function fetchOnePasswordSecrets(
+	config: OnePasswordProviderConfig
+): Promise<Record<string, string>> {
+	const opItem = OPItem.parse(
+		await $`op item get ${config.opItem} --vault ${config.opVault} --format json`.json()
+	)
+
+	const sectionsToInclude = OPSection.array().parse(config.opSections)
+
+	return opItem.fields
+		.filter((f) => sectionsToInclude.some((s) => s.id === f.section?.id))
+		.reduce(
+			(acc, f) => {
+				acc[f.label] = f.value
+				return acc
+			},
+			{} as Record<string, string>
+		)
+}
+
+/**
+ * Creates a function to run Dagger commands with Infisical or 1Password integration
  * @param config Configuration for the command runner
  * @returns Function to execute Dagger commands
  */
+export function createDaggerCommandRunner<T extends DaggerEnvConfig>(
+	config: RunDaggerCommandBaseConfig<T> & InfisicalProviderConfig
+): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>
+export function createDaggerCommandRunner<T extends DaggerEnvConfig>(
+	config: RunDaggerCommandBaseConfig<T> & OnePasswordProviderConfig
+): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>
 export function createDaggerCommandRunner<T extends DaggerEnvConfig>(
 	config: RunDaggerCommandConfig<T>
 ) {
-	const opItemUri = `op://${config.opVault}/${config.opItem}`
-
 	return async function runDaggerCommand(
 		commandName: string,
 		options?: RunDaggerCommandOptions
@@ -55,14 +135,9 @@ export function createDaggerCommandRunner<T extends DaggerEnvConfig>(
 			await config.beforeCommand()
 		}
 
-		// Environment variables to pass to the `op run` command
+		// Environment variables to pass to the spawned command
 		const envVars: Record<string, string> = {}
 
-		// Pass dagger cloud token in CI because we don't have user auth
-		if (process.env.CI !== undefined) {
-			envVars.DAGGER_CLOUD_TOKEN = `${opItemUri}/DAGGER_CLOUD_TOKEN`
-		}
-
 		const commandArgs: string[] = [...extraArgs]
 
 		// Add Docker socket for specific commands if available
@@ -76,24 +151,24 @@ export function createDaggerCommandRunner<T extends DaggerEnvConfig>(
 			}
 		}
 
-		// Fetch 1Password item
-		const opItem = OPItem.parse(
-			await $`op item get ${config.opItem} --vault ${config.opVault} --format json`.json()
-		)
+		// Fetch secrets from the configured provider
+		let secrets: Record<string, string>
+		if ('opVault' in config) {
+			secrets = await fetchOnePasswordSecrets(config)
 
-		// Parse sections to include
-		const sectionsToInclude = OPSection.array().parse(config.opSections)
+			// Pass dagger cloud token in CI because we don't have user auth.
+			// The op:// reference is resolved by the `op run` wrapper below.
+			if (process.env.CI !== undefined) {
+				envVars.DAGGER_CLOUD_TOKEN = `op://${config.opVault}/${config.opItem}/DAGGER_CLOUD_TOKEN`
+			}
+		} else {
+			secrets = await fetchInfisicalSecrets(config)
 
-		// Extract secrets from specified sections
-		const secrets = opItem.fields
-			.filter((f) => sectionsToInclude.some((s) => s.id === f.section?.id))
-			.reduce(
-				(acc, f) => {
-					acc[f.label] = f.value
-					return acc
-				},
-				{} as Record<string, string>
-			)
+			// Pass dagger cloud token in CI because we don't have user auth
+			if (process.env.CI !== undefined && secrets.DAGGER_CLOUD_TOKEN !== undefined) {
+				envVars.DAGGER_CLOUD_TOKEN = secrets.DAGGER_CLOUD_TOKEN
+			}
+		}
 
 		// Build environment variables for Dagger
 		const daggerEnv: Record<string, string> = { ...env }
@@ -112,12 +187,10 @@ export function createDaggerCommandRunner<T extends DaggerEnvConfig>(
 		})
 		envVars.DAGGER_OPTIONS = JSON.stringify(daggerOptions)
 
-		// Construct the command
+		// Construct the command. 1Password wraps `dagger call` in `op run`
+		// so that op:// references in the environment are resolved.
 		const cmd: string[] = [
-			'op',
-			'run',
-			'--no-masking',
-			'--',
+			...('opVault' in config ? ['op', 'run', '--no-masking', '--'] : []),
 			'dagger',
 			'call',
 			commandName,