dagger-env 1.0.0 → 1.2.0

package/README.md

@@ -1,6 +1,6 @@
 # dagger-env
 
-A type-safe, reusable environment configuration abstraction for Dagger modules with full Zod v4 validation and Infisical integration.
+A type-safe, reusable environment configuration abstraction for Dagger modules with full Zod v4 validation and Infisical or 1Password integration.
 
 ## Features
 
@@ -9,7 +9,7 @@ A type-safe, reusable environment configuration abstraction for Dagger modules w
 - 🎯 **Consistent**: Standardized API across all Dagger modules
 - 🛡️ **Validated**: Runtime validation of arguments, environment variables, and secrets
 - 📦 **Modular**: Secret presets and derived environment variables
-- 🔐 **Infisical Integration**: Built-in command runner backed by `infisical export`
+- 🔐 **Infisical & 1Password Integration**: Built-in command runner backed by `infisical export` or `op run`
 - 🚀 **Easy to use**: Simple configuration-based setup
 
 ## Installation
@@ -18,7 +18,7 @@ A type-safe, reusable environment configuration abstraction for Dagger modules w
 npm install dagger-env zod
 ```
 
-**Note:** The command runner functionality (`dagger-env/run`) requires the Infisical CLI (`infisical`) to be installed and authenticated.
+**Note:** The command runner functionality (`dagger-env/run`) requires either the Infisical CLI (`infisical`) or the 1Password CLI (`op`) to be installed and authenticated, depending on which provider you configure.
 
 ## Quick Start
 
@@ -73,9 +73,9 @@ export class MyModule {
 }
 ```
 
-## Command Runner (Infisical Integration)
+## Command Runner (Infisical or 1Password Integration)
 
-For projects using Infisical for secret management, `dagger-env` provides a convenient command runner that fetches secrets with `infisical export` and passes them to `dagger call` via the `DAGGER_OPTIONS` environment variable:
+`dagger-env` provides a convenient command runner that fetches secrets from Infisical (via `infisical export`) or 1Password (via `op item get`) and passes them to `dagger call` via the `DAGGER_OPTIONS` environment variable. The provider is selected by the shape of the config you pass to `createDaggerCommandRunner()`:
 
 ```typescript
 import { createDaggerEnv } from 'dagger-env'
@@ -100,7 +100,7 @@ const myDaggerEnv = createDaggerEnv({
   derivedEnvVars: {}
 })
 
-// Create a command runner - simply pass your DaggerEnv instance
+// Create a command runner with Infisical - simply pass your DaggerEnv instance
 const runDaggerCommand = createDaggerCommandRunner({
   projectId: 'your-project-id',
   env: 'prod',
@@ -116,6 +116,25 @@ await runDaggerCommand('test', {
 })
 ```
 
+### 1Password Integration
+
+To use 1Password instead of Infisical, pass `opVault`/`opItem`/`opSections` instead of `projectId`/`env`/`path`. Secrets are read from the specified sections of a 1Password item, and `dagger call` is wrapped in `op run --no-masking` so that `op://` references in the environment are resolved:
+
+```typescript
+const runDaggerCommand = createDaggerCommandRunner({
+  opVault: 'your-vault-id',
+  opItem: 'your-item-id',
+  opSections: [
+    {
+      id: 'your-section-id',
+      label: 'Shared'
+    }
+  ],
+  dockerCommands: ['build', 'deploy', 'test'],
+  daggerEnv: myDaggerEnv
+})
+```
+
 ### Advanced Configuration
 
 ```typescript
@@ -200,13 +219,22 @@ Returns array of secret names for a specific preset.
 
 #### `createDaggerCommandRunner(config)`
 
-Creates a function to run Dagger commands with Infisical integration.
+Creates a function to run Dagger commands with Infisical or 1Password integration. Pass either the Infisical or 1Password parameters to select the provider.
 
-**Parameters:**
+**Infisical parameters:**
 
 - `config.projectId`: Infisical project ID
 - `config.env`: Infisical environment slug (e.g. `prod`)
 - `config.path`: Infisical folder path to fetch secrets from (e.g. `/ci/my-repo`)
+
+**1Password parameters:**
+
+- `config.opVault`: 1Password vault ID
+- `config.opItem`: 1Password item ID
+- `config.opSections`: Array of 1Password sections to include for secrets
+
+**Shared parameters:**
+
 - `config.dockerCommands`: Optional array of command names that should include Docker socket
 - `config.beforeCommand`: Optional async function to run before executing the command
 - `config.daggerEnv`: DaggerEnv instance for schema validation and type safety

package/dist/op.d.ts

@@ -0,0 +1,90 @@
+import { z } from 'zod/v4';
+/**
+ * 1Password vault information
+ */
+export type OPVault = z.infer<typeof OPVault>;
+export declare const OPVault: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+/**
+ * 1Password item section information
+ */
+export type OPSection = z.infer<typeof OPSection>;
+export declare const OPSection: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * 1Password item field
+ */
+export type OPField = z.infer<typeof OPField>;
+export declare const OPField: z.ZodObject<{
+    id: z.ZodString;
+    section: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    type: z.ZodEnum<{
+        STRING: "STRING";
+        CONCEALED: "CONCEALED";
+        MONTH_YEAR: "MONTH_YEAR";
+    }>;
+    purpose: z.ZodOptional<z.ZodEnum<{
+        NOTES: "NOTES";
+    }>>;
+    label: z.ZodString;
+    value: z.ZodString;
+    reference: z.ZodString;
+}, z.core.$strip>;
+/**
+ * 1Password item category
+ */
+export type OPCategory = z.infer<typeof OPCategory>;
+export declare const OPCategory: z.ZodEnum<{
+    SECURE_NOTE: "SECURE_NOTE";
+}>;
+/**
+ * Complete 1Password item structure
+ */
+export type OPItem = z.infer<typeof OPItem>;
+export declare const OPItem: z.ZodObject<{
+    id: z.ZodString;
+    title: z.ZodString;
+    favorite: z.ZodBoolean;
+    version: z.ZodInt;
+    vault: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>;
+    category: z.ZodEnum<{
+        SECURE_NOTE: "SECURE_NOTE";
+    }>;
+    last_edited_by: z.ZodString;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+    additional_information: z.ZodString;
+    sections: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    fields: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        section: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        type: z.ZodEnum<{
+            STRING: "STRING";
+            CONCEALED: "CONCEALED";
+            MONTH_YEAR: "MONTH_YEAR";
+        }>;
+        purpose: z.ZodOptional<z.ZodEnum<{
+            NOTES: "NOTES";
+        }>>;
+        label: z.ZodString;
+        value: z.ZodString;
+        reference: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+//# sourceMappingURL=op.d.ts.map

package/dist/op.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"op.d.ts","sourceRoot":"","sources":["../src/op.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAE1B;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAA;AAC7C,eAAO,MAAM,OAAO;;;iBAGlB,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAA;AACjD,eAAO,MAAM,SAAS;;;iBAGpB,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAA;AAC7C,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;iBAQlB,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAA;AACnD,eAAO,MAAM,UAAU;;EAA0B,CAAA;AAEjD;;GAEG;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAA;AAC3C,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAajB,CAAA"}

package/dist/op.js

@@ -0,0 +1,34 @@
+import { z } from 'zod/v4';
+export const OPVault = z.object({
+    id: z.string(),
+    name: z.string(),
+});
+export const OPSection = z.object({
+    id: z.string(),
+    label: z.string().optional(),
+});
+export const OPField = z.object({
+    id: z.string(),
+    section: OPSection.optional(),
+    type: z.enum(['STRING', 'CONCEALED', 'MONTH_YEAR']),
+    purpose: z.enum(['NOTES']).optional(),
+    label: z.string(),
+    value: z.string(),
+    reference: z.string(),
+});
+export const OPCategory = z.enum(['SECURE_NOTE']);
+export const OPItem = z.object({
+    id: z.string(),
+    title: z.string(),
+    favorite: z.boolean(),
+    version: z.int(),
+    vault: OPVault,
+    category: OPCategory,
+    last_edited_by: z.string(),
+    created_at: z.iso.datetime(),
+    updated_at: z.iso.datetime(),
+    additional_information: z.string(),
+    sections: z.array(OPSection),
+    fields: z.array(OPField),
+});
+//# sourceMappingURL=op.js.map

package/dist/op.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"op.js","sourceRoot":"","sources":["../src/op.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAM1B,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAA;AAMF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAA;AAMF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAA;AAMF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;AAMjD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAChB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC5B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC5B,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;CACxB,CAAC,CAAA","sourcesContent":["import { z } from 'zod/v4'\n\n/**\n * 1Password vault information\n */\nexport type OPVault = z.infer<typeof OPVault>\nexport const OPVault = z.object({\n\tid: z.string(),\n\tname: z.string(),\n})\n\n/**\n * 1Password item section information\n */\nexport type OPSection = z.infer<typeof OPSection>\nexport const OPSection = z.object({\n\tid: z.string(),\n\tlabel: z.string().optional(),\n})\n\n/**\n * 1Password item field\n */\nexport type OPField = z.infer<typeof OPField>\nexport const OPField = z.object({\n\tid: z.string(),\n\tsection: OPSection.optional(),\n\ttype: z.enum(['STRING', 'CONCEALED', 'MONTH_YEAR']),\n\tpurpose: z.enum(['NOTES']).optional(),\n\tlabel: z.string(),\n\tvalue: z.string(),\n\treference: z.string(),\n})\n\n/**\n * 1Password item category\n */\nexport type OPCategory = z.infer<typeof OPCategory>\nexport const OPCategory = z.enum(['SECURE_NOTE'])\n\n/**\n * Complete 1Password item structure\n */\nexport type OPItem = z.infer<typeof OPItem>\nexport const OPItem = z.object({\n\tid: z.string(),\n\ttitle: z.string(),\n\tfavorite: z.boolean(),\n\tversion: z.int(),\n\tvault: OPVault,\n\tcategory: OPCategory,\n\tlast_edited_by: z.string(),\n\tcreated_at: z.iso.datetime(),\n\tupdated_at: z.iso.datetime(),\n\tadditional_information: z.string(),\n\tsections: z.array(OPSection),\n\tfields: z.array(OPField),\n})\n"]}

package/dist/run-dagger-cmd.d.ts

@@ -9,22 +9,52 @@ export declare const InfisicalSecret: z.ZodObject<{
     value: z.ZodString;
 }, z.core.$strip>;
 /**
- * Configuration for running Dagger commands with Infisical integration
+ * Infisical secrets provider configuration
  */
-export interface RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvConfig> {
+export interface InfisicalProviderConfig {
     /** Infisical project ID */
     projectId: string;
     /** Infisical environment slug (e.g. `prod`) */
     env: string;
     /** Infisical folder path to fetch secrets from (e.g. `/ci/my-repo`) */
     path: string;
+}
+/**
+ * 1Password secrets provider configuration
+ */
+export interface OnePasswordProviderConfig {
+    /** 1Password vault ID */
+    opVault: string;
+    /** 1Password item ID */
+    opItem: string;
+    /** 1Password sections to include for secrets */
+    opSections: Array<{
+        label: string;
+        id: string;
+    }>;
+}
+/**
+ * Configuration shared by all secrets providers
+ */
+export interface RunDaggerCommandBaseConfig<T extends DaggerEnvConfig = DaggerEnvConfig> {
     /** Commands that should include Docker socket if available */
     dockerCommands?: string[];
     /** Hook to run before executing the command (e.g., vendor file setup) */
     beforeCommand?: () => Promise<void>;
     /** DaggerEnv instance for schema validation and type safety */
     daggerEnv: DaggerEnv<T>;
+    /**
+     * Secrets to pass to Dagger alongside the ones fetched from the provider,
+     * taking precedence on conflict. Entries with an undefined value are
+     * skipped, so short-lived credentials that only exist in some environments
+     * (e.g. a CI-issued token) can be forwarded without a separate config path.
+     */
+    additionalSecrets?: Record<string, string | undefined>;
 }
+/**
+ * Configuration for running Dagger commands with Infisical or 1Password integration
+ */
+export type RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvConfig> = RunDaggerCommandBaseConfig<T> & (InfisicalProviderConfig | OnePasswordProviderConfig);
 /**
  * Options for individual command execution
  */
@@ -37,9 +67,10 @@ export interface RunDaggerCommandOptions {
     extraArgs?: string[];
 }
 /**
- * Creates a function to run Dagger commands with Infisical integration
+ * Creates a function to run Dagger commands with Infisical or 1Password integration
  * @param config Configuration for the command runner
  * @returns Function to execute Dagger commands
  */
-export declare function createDaggerCommandRunner<T extends DaggerEnvConfig>(config: RunDaggerCommandConfig<T>): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>;
+export declare function createDaggerCommandRunner<T extends DaggerEnvConfig>(config: RunDaggerCommandBaseConfig<T> & InfisicalProviderConfig): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>;
+export declare function createDaggerCommandRunner<T extends DaggerEnvConfig>(config: RunDaggerCommandBaseConfig<T> & OnePasswordProviderConfig): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>;
 //# sourceMappingURL=run-dagger-cmd.d.ts.map

package/dist/run-dagger-cmd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-dagger-cmd.d.ts","sourceRoot":"","sources":["../src/run-dagger-cmd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAG1B,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjE;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAC7D,eAAO,MAAM,eAAe;;;iBAG1B,CAAA;AAEF;;GAEG;AACH,MAAM,WAAW,sBAAsB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe;IAClF,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,+DAA+D;IAC/D,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,eAAe,EAClE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC,IAGhC,aAAa,MAAM,EACnB,UAAU,uBAAuB,KAC/B,OAAO,CAAC,IAAI,CAAC,CA8EhB"}
+{"version":3,"file":"run-dagger-cmd.d.ts","sourceRoot":"","sources":["../src/run-dagger-cmd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAK1B,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjE;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAC7D,eAAO,MAAM,eAAe;;;iBAG1B,CAAA;AAEF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACzC,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,gDAAgD;IAChD,UAAU,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe;IACtF,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,+DAA+D;IAC/D,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;IACvB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CACtD;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAC7E,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,GAAG,yBAAyB,CAAC,CAAA;AAEtF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AA4CD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,eAAe,EAClE,MAAM,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAAG,uBAAuB,GAC7D,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAC5E,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,eAAe,EAClE,MAAM,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAAG,yBAAyB,GAC/D,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA"}

package/dist/run-dagger-cmd.js

@@ -1,14 +1,33 @@
 import { z } from 'zod/v4';
 import { $, fs } from 'zx';
+import { OPItem, OPSection } from './op.js';
 export const InfisicalSecret = z.object({
     key: z.string(),
     value: z.string(),
 });
 /**
- * Creates a function to run Dagger commands with Infisical integration
- * @param config Configuration for the command runner
- * @returns Function to execute Dagger commands
+ * Fetches secrets from Infisical via `infisical export`
  */
+async function fetchInfisicalSecrets(config) {
+    const exportedSecrets = InfisicalSecret.array().parse(await $ `infisical export --silent --format=json --projectId ${config.projectId} --env ${config.env} --path ${config.path}`.json());
+    return exportedSecrets.reduce((acc, s) => {
+        acc[s.key] = s.value;
+        return acc;
+    }, {});
+}
+/**
+ * Fetches secrets from a 1Password item, filtered to the configured sections
+ */
+async function fetchOnePasswordSecrets(config) {
+    const opItem = OPItem.parse(await $ `op item get ${config.opItem} --vault ${config.opVault} --format json`.json());
+    const sectionsToInclude = OPSection.array().parse(config.opSections);
+    return opItem.fields
+        .filter((f) => sectionsToInclude.some((s) => s.id === f.section?.id))
+        .reduce((acc, f) => {
+        acc[f.label] = f.value;
+        return acc;
+    }, {});
+}
 export function createDaggerCommandRunner(config) {
     return async function runDaggerCommand(commandName, options) {
         const { args = {}, env = {}, extraArgs = [] } = options ?? {};
@@ -16,7 +35,7 @@ export function createDaggerCommandRunner(config) {
         if (config.beforeCommand) {
             await config.beforeCommand();
         }
-        // Environment variables to pass to the `dagger` command
+        // Environment variables to pass to the spawned command
         const envVars = {};
         const commandArgs = [...extraArgs];
         // Add Docker socket for specific commands if available
@@ -30,16 +49,27 @@ export function createDaggerCommandRunner(config) {
                 // Ignore if fs is not available or docker socket doesn't exist
             }
         }
-        // Fetch secrets from Infisical
-        const exportedSecrets = InfisicalSecret.array().parse(await $ `infisical export --silent --format=json --projectId ${config.projectId} --env ${config.env} --path ${config.path}`.json());
-        // Extract secrets into a key/value map
-        const secrets = exportedSecrets.reduce((acc, s) => {
-            acc[s.key] = s.value;
-            return acc;
-        }, {});
-        // Pass dagger cloud token in CI because we don't have user auth
-        if (process.env.CI !== undefined && secrets.DAGGER_CLOUD_TOKEN !== undefined) {
-            envVars.DAGGER_CLOUD_TOKEN = secrets.DAGGER_CLOUD_TOKEN;
+        // Fetch secrets from the configured provider
+        let secrets;
+        if ('opVault' in config) {
+            secrets = await fetchOnePasswordSecrets(config);
+            // Pass dagger cloud token in CI because we don't have user auth.
+            // The op:// reference is resolved by the `op run` wrapper below.
+            if (process.env.CI !== undefined) {
+                envVars.DAGGER_CLOUD_TOKEN = `op://${config.opVault}/${config.opItem}/DAGGER_CLOUD_TOKEN`;
+            }
+        }
+        else {
+            secrets = await fetchInfisicalSecrets(config);
+            // Pass dagger cloud token in CI because we don't have user auth
+            if (process.env.CI !== undefined && secrets.DAGGER_CLOUD_TOKEN !== undefined) {
+                envVars.DAGGER_CLOUD_TOKEN = secrets.DAGGER_CLOUD_TOKEN;
+            }
+        }
+        for (const [name, value] of Object.entries(config.additionalSecrets ?? {})) {
+            if (value !== undefined) {
+                secrets[name] = value;
+            }
         }
         // Build environment variables for Dagger
         const daggerEnv = { ...env };
@@ -56,8 +86,10 @@ export function createDaggerCommandRunner(config) {
             secrets,
         });
         envVars.DAGGER_OPTIONS = JSON.stringify(daggerOptions);
-        // Construct the command
+        // Construct the command. 1Password wraps `dagger call` in `op run`
+        // so that op:// references in the environment are resolved.
         const cmd = [
+            ...('opVault' in config ? ['op', 'run', '--no-masking', '--'] : []),
             'dagger',
             'call',
             commandName,

package/dist/run-dagger-cmd.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-dagger-cmd.js","sourceRoot":"","sources":["../src/run-dagger-cmd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAC1B,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,IAAI,CAAA;AAQ1B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAA;AAgCF;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACxC,MAAiC;IAEjC,OAAO,KAAK,UAAU,gBAAgB,CACrC,WAAmB,EACnB,OAAiC;QAEjC,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAE7D,4BAA4B;QAC5B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,MAAM,CAAC,aAAa,EAAE,CAAA;QAC7B,CAAC;QAED,wDAAwD;QACxD,MAAM,OAAO,GAA2B,EAAE,CAAA;QAE1C,MAAM,WAAW,GAAa,CAAC,GAAG,SAAS,CAAC,CAAA;QAE5C,uDAAuD;QACvD,IAAI,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACJ,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;oBAC7C,WAAW,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;gBACzD,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,+DAA+D;YAChE,CAAC;QACF,CAAC;QAED,+BAA+B;QAC/B,MAAM,eAAe,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,KAAK,CACpD,MAAM,CAAC,CAAA,uDAAuD,MAAM,CAAC,SAAS,UAAU,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CACjI,CAAA;QAED,uCAAuC;QACvC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CACrC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YACV,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;YACpB,OAAO,GAAG,CAAA;QACX,CAAC,EACD,EAA4B,CAC5B,CAAA;QAED,gEAAgE;QAChE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC9E,OAAO,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAA;QACxD,CAAC;QAED,yCAAyC;QACzC,MAAM,SAAS,GAA2B,EAAE,GAAG,GAAG,EAAE,CAAA;QACpD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAA;QAC9B,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC9C,SAAS,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;QACtD,CAAC;QAED,wCAAwC;QACxC,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC;YAC/D,IAAI;YACJ,GAAG,EAAE,SAAS;YACd,OAAO;SACP,CAAC,CAAA;QACF,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAEtD,wBAAwB;QACxB,MAAM,GAAG,GAAa;YACrB,QAAQ;YACR,MAAM;YACN,WAAW;YACX,GAAG,WAAW;YACd,gCAAgC;SAChC,CAAA;QAED,sBAAsB;QACtB,MAAM,CAAC,CAAC;YACP,GAAG,EAAE;gBACJ,GAAG,OAAO,CAAC,GAAG;gBACd,GAAG,OAAO;aACV;YACD,KAAK,EAAE,SAAS;SAChB,CAAC,CAAA,GAAG,GAAG,EAAE,CAAA;IACX,CAAC,CAAA;AACF,CAAC","sourcesContent":["import { z } from 'zod/v4'\nimport { $, fs } from 'zx'\n\nimport type { DaggerEnv, DaggerEnvConfig } from './dagger-env.js'\n\n/**\n * A single secret returned by `infisical export --format=json`\n */\nexport type InfisicalSecret = z.infer<typeof InfisicalSecret>\nexport const InfisicalSecret = z.object({\n\tkey: z.string(),\n\tvalue: z.string(),\n})\n\n/**\n * Configuration for running Dagger commands with Infisical integration\n */\nexport interface RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvConfig> {\n\t/** Infisical project ID */\n\tprojectId: string\n\t/** Infisical environment slug (e.g. `prod`) */\n\tenv: string\n\t/** Infisical folder path to fetch secrets from (e.g. `/ci/my-repo`) */\n\tpath: string\n\t/** Commands that should include Docker socket if available */\n\tdockerCommands?: string[]\n\t/** Hook to run before executing the command (e.g., vendor file setup) */\n\tbeforeCommand?: () => Promise<void>\n\t/** DaggerEnv instance for schema validation and type safety */\n\tdaggerEnv: DaggerEnv<T>\n}\n\n/**\n * Options for individual command execution\n */\nexport interface RunDaggerCommandOptions {\n\t/** Arguments to pass to the Dagger command */\n\targs?: Record<string, any>\n\t/** Additional environment variables */\n\tenv?: Record<string, string>\n\t/** Additional command-line arguments */\n\textraArgs?: string[]\n}\n\n/**\n * Creates a function to run Dagger commands with Infisical integration\n * @param config Configuration for the command runner\n * @returns Function to execute Dagger commands\n */\nexport function createDaggerCommandRunner<T extends DaggerEnvConfig>(\n\tconfig: RunDaggerCommandConfig<T>\n) {\n\treturn async function runDaggerCommand(\n\t\tcommandName: string,\n\t\toptions?: RunDaggerCommandOptions\n\t): Promise<void> {\n\t\tconst { args = {}, env = {}, extraArgs = [] } = options ?? {}\n\n\t\t// Run any pre-command setup\n\t\tif (config.beforeCommand) {\n\t\t\tawait config.beforeCommand()\n\t\t}\n\n\t\t// Environment variables to pass to the `dagger` command\n\t\tconst envVars: Record<string, string> = {}\n\n\t\tconst commandArgs: string[] = [...extraArgs]\n\n\t\t// Add Docker socket for specific commands if available\n\t\tif (config.dockerCommands?.includes(commandName)) {\n\t\t\ttry {\n\t\t\t\tif (await fs.exists('/var/run/docker.sock')) {\n\t\t\t\t\tcommandArgs.push('--docker-socket=/var/run/docker.sock')\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t// Ignore if fs is not available or docker socket doesn't exist\n\t\t\t}\n\t\t}\n\n\t\t// Fetch secrets from Infisical\n\t\tconst exportedSecrets = InfisicalSecret.array().parse(\n\t\t\tawait $`infisical export --silent --format=json --projectId ${config.projectId} --env ${config.env} --path ${config.path}`.json()\n\t\t)\n\n\t\t// Extract secrets into a key/value map\n\t\tconst secrets = exportedSecrets.reduce(\n\t\t\t(acc, s) => {\n\t\t\t\tacc[s.key] = s.value\n\t\t\t\treturn acc\n\t\t\t},\n\t\t\t{} as Record<string, string>\n\t\t)\n\n\t\t// Pass dagger cloud token in CI because we don't have user auth\n\t\tif (process.env.CI !== undefined && secrets.DAGGER_CLOUD_TOKEN !== undefined) {\n\t\t\tenvVars.DAGGER_CLOUD_TOKEN = secrets.DAGGER_CLOUD_TOKEN\n\t\t}\n\n\t\t// Build environment variables for Dagger\n\t\tconst daggerEnv: Record<string, string> = { ...env }\n\t\tif (process.env.CI !== undefined) {\n\t\t\tdaggerEnv.CI = process.env.CI\n\t\t}\n\t\tif (process.env.GITHUB_ACTIONS !== undefined) {\n\t\t\tdaggerEnv.GITHUB_ACTIONS = process.env.GITHUB_ACTIONS\n\t\t}\n\n\t\t// Validate and serialize dagger options\n\t\tconst daggerOptions = config.daggerEnv.getOptionsSchema().parse({\n\t\t\targs,\n\t\t\tenv: daggerEnv,\n\t\t\tsecrets,\n\t\t})\n\t\tenvVars.DAGGER_OPTIONS = JSON.stringify(daggerOptions)\n\n\t\t// Construct the command\n\t\tconst cmd: string[] = [\n\t\t\t'dagger',\n\t\t\t'call',\n\t\t\tcommandName,\n\t\t\t...commandArgs,\n\t\t\t'--options=env://DAGGER_OPTIONS',\n\t\t]\n\n\t\t// Execute the command\n\t\tawait $({\n\t\t\tenv: {\n\t\t\t\t...process.env,\n\t\t\t\t...envVars,\n\t\t\t},\n\t\t\tstdio: 'inherit',\n\t\t})`${cmd}`\n\t}\n}\n"]}
+{"version":3,"file":"run-dagger-cmd.js","sourceRoot":"","sources":["../src/run-dagger-cmd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAC1B,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,IAAI,CAAA;AAE1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAQ3C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAA;AA+DF;;GAEG;AACH,KAAK,UAAU,qBAAqB,CACnC,MAA+B;IAE/B,MAAM,eAAe,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,KAAK,CACpD,MAAM,CAAC,CAAA,uDAAuD,MAAM,CAAC,SAAS,UAAU,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CACjI,CAAA;IAED,OAAO,eAAe,CAAC,MAAM,CAC5B,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACV,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;QACpB,OAAO,GAAG,CAAA;IACX,CAAC,EACD,EAA4B,CAC5B,CAAA;AACF,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,uBAAuB,CACrC,MAAiC;IAEjC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAC1B,MAAM,CAAC,CAAA,eAAe,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,gBAAgB,CAAC,IAAI,EAAE,CACpF,CAAA;IAED,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAEpE,OAAO,MAAM,CAAC,MAAM;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;SACpE,MAAM,CACN,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACV,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;QACtB,OAAO,GAAG,CAAA;IACX,CAAC,EACD,EAA4B,CAC5B,CAAA;AACH,CAAC;AAaD,MAAM,UAAU,yBAAyB,CACxC,MAAiC;IAEjC,OAAO,KAAK,UAAU,gBAAgB,CACrC,WAAmB,EACnB,OAAiC;QAEjC,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAE7D,4BAA4B;QAC5B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,MAAM,CAAC,aAAa,EAAE,CAAA;QAC7B,CAAC;QAED,uDAAuD;QACvD,MAAM,OAAO,GAA2B,EAAE,CAAA;QAE1C,MAAM,WAAW,GAAa,CAAC,GAAG,SAAS,CAAC,CAAA;QAE5C,uDAAuD;QACvD,IAAI,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACJ,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;oBAC7C,WAAW,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;gBACzD,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,+DAA+D;YAChE,CAAC;QACF,CAAC;QAED,6CAA6C;QAC7C,IAAI,OAA+B,CAAA;QACnC,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAA;YAE/C,iEAAiE;YACjE,iEAAiE;YACjE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,CAAC,kBAAkB,GAAG,QAAQ,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,qBAAqB,CAAA;YAC1F,CAAC;QACF,CAAC;aAAM,CAAC;YACP,OAAO,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAA;YAE7C,gEAAgE;YAChE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBAC9E,OAAO,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAA;YACxD,CAAC;QACF,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YACtB,CAAC;QACF,CAAC;QAED,yCAAyC;QACzC,MAAM,SAAS,GAA2B,EAAE,GAAG,GAAG,EAAE,CAAA;QACpD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAA;QAC9B,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC9C,SAAS,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;QACtD,CAAC;QAED,wCAAwC;QACxC,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC;YAC/D,IAAI;YACJ,GAAG,EAAE,SAAS;YACd,OAAO;SACP,CAAC,CAAA;QACF,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAEtD,mEAAmE;QACnE,4DAA4D;QAC5D,MAAM,GAAG,GAAa;YACrB,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,QAAQ;YACR,MAAM;YACN,WAAW;YACX,GAAG,WAAW;YACd,gCAAgC;SAChC,CAAA;QAED,sBAAsB;QACtB,MAAM,CAAC,CAAC;YACP,GAAG,EAAE;gBACJ,GAAG,OAAO,CAAC,GAAG;gBACd,GAAG,OAAO;aACV;YACD,KAAK,EAAE,SAAS;SAChB,CAAC,CAAA,GAAG,GAAG,EAAE,CAAA;IACX,CAAC,CAAA;AACF,CAAC","sourcesContent":["import { z } from 'zod/v4'\nimport { $, fs } from 'zx'\n\nimport { OPItem, OPSection } from './op.js'\n\nimport type { DaggerEnv, DaggerEnvConfig } from './dagger-env.js'\n\n/**\n * A single secret returned by `infisical export --format=json`\n */\nexport type InfisicalSecret = z.infer<typeof InfisicalSecret>\nexport const InfisicalSecret = z.object({\n\tkey: z.string(),\n\tvalue: z.string(),\n})\n\n/**\n * Infisical secrets provider configuration\n */\nexport interface InfisicalProviderConfig {\n\t/** Infisical project ID */\n\tprojectId: string\n\t/** Infisical environment slug (e.g. `prod`) */\n\tenv: string\n\t/** Infisical folder path to fetch secrets from (e.g. `/ci/my-repo`) */\n\tpath: string\n}\n\n/**\n * 1Password secrets provider configuration\n */\nexport interface OnePasswordProviderConfig {\n\t/** 1Password vault ID */\n\topVault: string\n\t/** 1Password item ID */\n\topItem: string\n\t/** 1Password sections to include for secrets */\n\topSections: Array<{ label: string; id: string }>\n}\n\n/**\n * Configuration shared by all secrets providers\n */\nexport interface RunDaggerCommandBaseConfig<T extends DaggerEnvConfig = DaggerEnvConfig> {\n\t/** Commands that should include Docker socket if available */\n\tdockerCommands?: string[]\n\t/** Hook to run before executing the command (e.g., vendor file setup) */\n\tbeforeCommand?: () => Promise<void>\n\t/** DaggerEnv instance for schema validation and type safety */\n\tdaggerEnv: DaggerEnv<T>\n\t/**\n\t * Secrets to pass to Dagger alongside the ones fetched from the provider,\n\t * taking precedence on conflict. Entries with an undefined value are\n\t * skipped, so short-lived credentials that only exist in some environments\n\t * (e.g. a CI-issued token) can be forwarded without a separate config path.\n\t */\n\tadditionalSecrets?: Record<string, string | undefined>\n}\n\n/**\n * Configuration for running Dagger commands with Infisical or 1Password integration\n */\nexport type RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvConfig> =\n\tRunDaggerCommandBaseConfig<T> & (InfisicalProviderConfig | OnePasswordProviderConfig)\n\n/**\n * Options for individual command execution\n */\nexport interface RunDaggerCommandOptions {\n\t/** Arguments to pass to the Dagger command */\n\targs?: Record<string, any>\n\t/** Additional environment variables */\n\tenv?: Record<string, string>\n\t/** Additional command-line arguments */\n\textraArgs?: string[]\n}\n\n/**\n * Fetches secrets from Infisical via `infisical export`\n */\nasync function fetchInfisicalSecrets(\n\tconfig: InfisicalProviderConfig\n): Promise<Record<string, string>> {\n\tconst exportedSecrets = InfisicalSecret.array().parse(\n\t\tawait $`infisical export --silent --format=json --projectId ${config.projectId} --env ${config.env} --path ${config.path}`.json()\n\t)\n\n\treturn exportedSecrets.reduce(\n\t\t(acc, s) => {\n\t\t\tacc[s.key] = s.value\n\t\t\treturn acc\n\t\t},\n\t\t{} as Record<string, string>\n\t)\n}\n\n/**\n * Fetches secrets from a 1Password item, filtered to the configured sections\n */\nasync function fetchOnePasswordSecrets(\n\tconfig: OnePasswordProviderConfig\n): Promise<Record<string, string>> {\n\tconst opItem = OPItem.parse(\n\t\tawait $`op item get ${config.opItem} --vault ${config.opVault} --format json`.json()\n\t)\n\n\tconst sectionsToInclude = OPSection.array().parse(config.opSections)\n\n\treturn opItem.fields\n\t\t.filter((f) => sectionsToInclude.some((s) => s.id === f.section?.id))\n\t\t.reduce(\n\t\t\t(acc, f) => {\n\t\t\t\tacc[f.label] = f.value\n\t\t\t\treturn acc\n\t\t\t},\n\t\t\t{} as Record<string, string>\n\t\t)\n}\n\n/**\n * Creates a function to run Dagger commands with Infisical or 1Password integration\n * @param config Configuration for the command runner\n * @returns Function to execute Dagger commands\n */\nexport function createDaggerCommandRunner<T extends DaggerEnvConfig>(\n\tconfig: RunDaggerCommandBaseConfig<T> & InfisicalProviderConfig\n): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>\nexport function createDaggerCommandRunner<T extends DaggerEnvConfig>(\n\tconfig: RunDaggerCommandBaseConfig<T> & OnePasswordProviderConfig\n): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>\nexport function createDaggerCommandRunner<T extends DaggerEnvConfig>(\n\tconfig: RunDaggerCommandConfig<T>\n) {\n\treturn async function runDaggerCommand(\n\t\tcommandName: string,\n\t\toptions?: RunDaggerCommandOptions\n\t): Promise<void> {\n\t\tconst { args = {}, env = {}, extraArgs = [] } = options ?? {}\n\n\t\t// Run any pre-command setup\n\t\tif (config.beforeCommand) {\n\t\t\tawait config.beforeCommand()\n\t\t}\n\n\t\t// Environment variables to pass to the spawned command\n\t\tconst envVars: Record<string, string> = {}\n\n\t\tconst commandArgs: string[] = [...extraArgs]\n\n\t\t// Add Docker socket for specific commands if available\n\t\tif (config.dockerCommands?.includes(commandName)) {\n\t\t\ttry {\n\t\t\t\tif (await fs.exists('/var/run/docker.sock')) {\n\t\t\t\t\tcommandArgs.push('--docker-socket=/var/run/docker.sock')\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t// Ignore if fs is not available or docker socket doesn't exist\n\t\t\t}\n\t\t}\n\n\t\t// Fetch secrets from the configured provider\n\t\tlet secrets: Record<string, string>\n\t\tif ('opVault' in config) {\n\t\t\tsecrets = await fetchOnePasswordSecrets(config)\n\n\t\t\t// Pass dagger cloud token in CI because we don't have user auth.\n\t\t\t// The op:// reference is resolved by the `op run` wrapper below.\n\t\t\tif (process.env.CI !== undefined) {\n\t\t\t\tenvVars.DAGGER_CLOUD_TOKEN = `op://${config.opVault}/${config.opItem}/DAGGER_CLOUD_TOKEN`\n\t\t\t}\n\t\t} else {\n\t\t\tsecrets = await fetchInfisicalSecrets(config)\n\n\t\t\t// Pass dagger cloud token in CI because we don't have user auth\n\t\t\tif (process.env.CI !== undefined && secrets.DAGGER_CLOUD_TOKEN !== undefined) {\n\t\t\t\tenvVars.DAGGER_CLOUD_TOKEN = secrets.DAGGER_CLOUD_TOKEN\n\t\t\t}\n\t\t}\n\n\t\tfor (const [name, value] of Object.entries(config.additionalSecrets ?? {})) {\n\t\t\tif (value !== undefined) {\n\t\t\t\tsecrets[name] = value\n\t\t\t}\n\t\t}\n\n\t\t// Build environment variables for Dagger\n\t\tconst daggerEnv: Record<string, string> = { ...env }\n\t\tif (process.env.CI !== undefined) {\n\t\t\tdaggerEnv.CI = process.env.CI\n\t\t}\n\t\tif (process.env.GITHUB_ACTIONS !== undefined) {\n\t\t\tdaggerEnv.GITHUB_ACTIONS = process.env.GITHUB_ACTIONS\n\t\t}\n\n\t\t// Validate and serialize dagger options\n\t\tconst daggerOptions = config.daggerEnv.getOptionsSchema().parse({\n\t\t\targs,\n\t\t\tenv: daggerEnv,\n\t\t\tsecrets,\n\t\t})\n\t\tenvVars.DAGGER_OPTIONS = JSON.stringify(daggerOptions)\n\n\t\t// Construct the command. 1Password wraps `dagger call` in `op run`\n\t\t// so that op:// references in the environment are resolved.\n\t\tconst cmd: string[] = [\n\t\t\t...('opVault' in config ? ['op', 'run', '--no-masking', '--'] : []),\n\t\t\t'dagger',\n\t\t\t'call',\n\t\t\tcommandName,\n\t\t\t...commandArgs,\n\t\t\t'--options=env://DAGGER_OPTIONS',\n\t\t]\n\n\t\t// Execute the command\n\t\tawait $({\n\t\t\tenv: {\n\t\t\t\t...process.env,\n\t\t\t\t...envVars,\n\t\t\t},\n\t\t\tstdio: 'inherit',\n\t\t})`${cmd}`\n\t}\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dagger-env",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "private": false,
   "description": "A type-safe, reusable environment configuration abstraction for Dagger modules.",
   "keywords": [
@@ -28,6 +28,12 @@
         "default": "./dist/index.js"
       }
     },
+    "./op": {
+      "import": {
+        "types": "./dist/op.d.ts",
+        "default": "./dist/op.js"
+      }
+    },
     "./run": {
       "import": {
         "types": "./dist/run-dagger-cmd.d.ts",
@@ -59,7 +65,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "runx build tsc ./src/index.ts ./src/run-dagger-cmd.ts",
+    "build": "runx build tsc ./src/index.ts ./src/op.ts ./src/run-dagger-cmd.ts",
     "check:exports": "runx check --exports",
     "check:lint": "run-eslint",
     "check:types": "run-tsc",

package/src/examples/run-dagger-cmd-usage.ts

@@ -2,7 +2,7 @@
  * Example usage of the runDaggerCommand abstraction
  *
  * This example shows a realistic configuration for a project that uses Dagger
- * with Infisical integration for secret management.
+ * with Infisical or 1Password integration for secret management.
  *
  * Import pattern:
  * - Main DaggerEnv functionality: import { createDaggerEnv } from 'dagger-env'
@@ -74,3 +74,24 @@ export const runDaggerCommand = createDaggerCommandRunner({
 	// Pass the DaggerEnv instance directly
 	daggerEnv,
 })
+
+// Alternatively, create a command runner with 1Password configuration
+export const runDaggerCommandWithOnePassword = createDaggerCommandRunner({
+	// 1Password configuration
+	opVault: 'your-vault-id', // Replace with your actual vault ID
+	opItem: 'your-item-id', // Replace with your actual item ID
+	opSections: [
+		{
+			id: 'shared-section-id',
+			label: 'Shared',
+		},
+		{
+			id: 'production-section-id',
+			label: 'Production',
+		},
+	],
+	// Commands that need Docker socket access
+	dockerCommands: ['build', 'test', 'deploy', 'migrate', 'seed'],
+	// Pass the DaggerEnv instance directly
+	daggerEnv,
+})

package/src/op.ts

@@ -0,0 +1,58 @@
+import { z } from 'zod/v4'
+
+/**
+ * 1Password vault information
+ */
+export type OPVault = z.infer<typeof OPVault>
+export const OPVault = z.object({
+	id: z.string(),
+	name: z.string(),
+})
+
+/**
+ * 1Password item section information
+ */
+export type OPSection = z.infer<typeof OPSection>
+export const OPSection = z.object({
+	id: z.string(),
+	label: z.string().optional(),
+})
+
+/**
+ * 1Password item field
+ */
+export type OPField = z.infer<typeof OPField>
+export const OPField = z.object({
+	id: z.string(),
+	section: OPSection.optional(),
+	type: z.enum(['STRING', 'CONCEALED', 'MONTH_YEAR']),
+	purpose: z.enum(['NOTES']).optional(),
+	label: z.string(),
+	value: z.string(),
+	reference: z.string(),
+})
+
+/**
+ * 1Password item category
+ */
+export type OPCategory = z.infer<typeof OPCategory>
+export const OPCategory = z.enum(['SECURE_NOTE'])
+
+/**
+ * Complete 1Password item structure
+ */
+export type OPItem = z.infer<typeof OPItem>
+export const OPItem = z.object({
+	id: z.string(),
+	title: z.string(),
+	favorite: z.boolean(),
+	version: z.int(),
+	vault: OPVault,
+	category: OPCategory,
+	last_edited_by: z.string(),
+	created_at: z.iso.datetime(),
+	updated_at: z.iso.datetime(),
+	additional_information: z.string(),
+	sections: z.array(OPSection),
+	fields: z.array(OPField),
+})

package/src/run-dagger-cmd.spec.ts

@@ -4,13 +4,14 @@ import { z } from 'zod/v4'
 import { createDaggerEnv } from './dagger-env'
 import { createDaggerCommandRunner } from './run-dagger-cmd'
 
+import type { OPItem } from './op'
 import type { RunDaggerCommandConfig } from './run-dagger-cmd'
 
 const mocks = vi.hoisted(() => ({
-	/** Resolves the JSON payload returned by `infisical export` */
-	exportJson: vi.fn(),
-	/** Records the rendered `infisical export` command string */
-	exportCmd: vi.fn(),
+	/** Resolves the JSON payload returned by the secrets CLI (`infisical export` / `op item get`) */
+	fetchJson: vi.fn(),
+	/** Records the rendered secrets fetch command string */
+	fetchCmd: vi.fn(),
 	/** Records the final command execution: (options, argv) */
 	spawn: vi.fn(
 		async (_opts: { env: Record<string, string | undefined> }, _argv: string[]) => undefined
@@ -22,14 +23,14 @@ const mocks = vi.hoisted(() => ({
 vi.mock('zx', () => {
 	const $ = (firstArg: unknown, ...vals: unknown[]) => {
 		if (Array.isArray(firstArg)) {
-			// Direct template call: $`infisical export ...`
+			// Direct template call: $`infisical export ...` / $`op item get ...`
 			const pieces = firstArg as readonly string[]
 			const cmd = pieces.reduce(
 				(acc, piece, i) => acc + piece + (i < vals.length ? String(vals[i]) : ''),
 				''
 			)
-			mocks.exportCmd(cmd)
-			return { json: mocks.exportJson }
+			mocks.fetchCmd(cmd)
+			return { json: mocks.fetchJson }
 		}
 		// Options call: $({ env, stdio }) returns a template executor
 		return (_pieces: TemplateStringsArray, ...templateVals: unknown[]) =>
@@ -56,8 +57,8 @@ function getSpawnCall(): { env: SpawnEnv; argv: string[] } {
 	return { env: opts.env, argv }
 }
 
-function createRunner(overrides?: Partial<Pick<RunDaggerCommandConfig, 'dockerCommands'>>) {
-	const daggerEnv = createDaggerEnv({
+function createTestDaggerEnv() {
+	return createDaggerEnv({
 		args: z.object({
 			push: z.string().optional(),
 		}),
@@ -68,89 +69,274 @@ function createRunner(overrides?: Partial<Pick<RunDaggerCommandConfig, 'dockerCo
 		}),
 		secrets: z.object({
 			API_TOKEN: z.string(),
+			FORWARDED_TOKEN: z.string().optional(),
 		}),
 		secretPresets: {
 			api: ['API_TOKEN'],
 		},
 		derivedEnvVars: {},
 	})
+}
 
+function createRunner(
+	overrides?: Partial<Pick<RunDaggerCommandConfig, 'dockerCommands' | 'additionalSecrets'>>
+) {
 	return createDaggerCommandRunner({
 		projectId: 'test-project-id',
 		env: 'prod',
 		path: '/ci/test',
-		daggerEnv,
+		daggerEnv: createTestDaggerEnv(),
 		...overrides,
 	})
 }
 
+function createOnePasswordRunner(
+	overrides?: Partial<Pick<RunDaggerCommandConfig, 'dockerCommands' | 'additionalSecrets'>>
+) {
+	return createDaggerCommandRunner({
+		opVault: 'test-vault-id',
+		opItem: 'test-item-id',
+		opSections: [{ id: 'shared-section-id', label: 'Shared' }],
+		daggerEnv: createTestDaggerEnv(),
+		...overrides,
+	})
+}
+
+/**
+ * A realistic `op item get --format json` payload with one field in the
+ * configured section and one field in an excluded section
+ */
+const testOPItem: OPItem = {
+	id: 'test-item-id',
+	title: 'Test Item',
+	favorite: false,
+	version: 1,
+	vault: { id: 'test-vault-id', name: 'Test Vault' },
+	category: 'SECURE_NOTE',
+	last_edited_by: 'test-user',
+	created_at: '2024-01-01T00:00:00Z',
+	updated_at: '2024-01-01T00:00:00Z',
+	additional_information: '',
+	sections: [
+		{ id: 'shared-section-id', label: 'Shared' },
+		{ id: 'other-section-id', label: 'Other' },
+	],
+	fields: [
+		{
+			id: 'field-1',
+			section: { id: 'shared-section-id', label: 'Shared' },
+			type: 'CONCEALED',
+			label: 'API_TOKEN',
+			value: 'test-api-token',
+			reference: 'op://test-vault-id/test-item-id/API_TOKEN',
+		},
+		{
+			id: 'field-2',
+			section: { id: 'other-section-id', label: 'Other' },
+			type: 'CONCEALED',
+			label: 'EXCLUDED_SECRET',
+			value: 'excluded-value',
+			reference: 'op://test-vault-id/test-item-id/EXCLUDED_SECRET',
+		},
+	],
+}
+
 describe('createDaggerCommandRunner()', () => {
 	beforeEach(() => {
 		vi.clearAllMocks()
 		vi.stubEnv('CI', undefined)
 		vi.stubEnv('GITHUB_ACTIONS', undefined)
 		vi.stubEnv('DAGGER_CLOUD_TOKEN', undefined)
-		mocks.exportJson.mockResolvedValue([
-			{ key: 'API_TOKEN', value: 'test-api-token', comment: '' },
-			{ key: 'DAGGER_CLOUD_TOKEN', value: 'test-dagger-cloud-token', comment: '' },
-		])
 	})
 
 	afterEach(() => {
 		vi.unstubAllEnvs()
 	})
 
-	it('builds the expected DAGGER_OPTIONS payload from the infisical export', async () => {
-		const runDaggerCommand = createRunner()
-		await runDaggerCommand('test-cmd', {
-			args: { push: 'true' },
-			env: { NODE_ENV: 'production' },
+	describe('infisical', () => {
+		beforeEach(() => {
+			mocks.fetchJson.mockResolvedValue([
+				{ key: 'API_TOKEN', value: 'test-api-token', comment: '' },
+				{ key: 'DAGGER_CLOUD_TOKEN', value: 'test-dagger-cloud-token', comment: '' },
+			])
 		})
 
-		expect(mocks.exportCmd).toHaveBeenCalledWith(
-			'infisical export --silent --format=json --projectId test-project-id --env prod --path /ci/test'
-		)
+		it('builds the expected DAGGER_OPTIONS payload from the infisical export', async () => {
+			const runDaggerCommand = createRunner()
+			await runDaggerCommand('test-cmd', {
+				args: { push: 'true' },
+				env: { NODE_ENV: 'production' },
+			})
 
-		const { env } = getSpawnCall()
-		expect(JSON.parse(env.DAGGER_OPTIONS as string)).toStrictEqual({
-			args: { push: 'true' },
-			env: { NODE_ENV: 'production' },
-			secrets: { API_TOKEN: 'test-api-token' },
+			expect(mocks.fetchCmd).toHaveBeenCalledWith(
+				'infisical export --silent --format=json --projectId test-project-id --env prod --path /ci/test'
+			)
+
+			const { env } = getSpawnCall()
+			expect(JSON.parse(env.DAGGER_OPTIONS as string)).toStrictEqual({
+				args: { push: 'true' },
+				env: { NODE_ENV: 'production' },
+				secrets: { API_TOKEN: 'test-api-token' },
+			})
+			expect(env.DAGGER_CLOUD_TOKEN).toBeUndefined()
+		})
+
+		it('passes DAGGER_CLOUD_TOKEN to the runner env (but not DAGGER_OPTIONS) in CI', async () => {
+			vi.stubEnv('CI', 'true')
+			vi.stubEnv('GITHUB_ACTIONS', 'true')
+
+			const runDaggerCommand = createRunner()
+			await runDaggerCommand('test-cmd')
+
+			const { env } = getSpawnCall()
+			const daggerOptions = JSON.parse(env.DAGGER_OPTIONS as string)
+			expect(daggerOptions.secrets).not.toHaveProperty('DAGGER_CLOUD_TOKEN')
+			expect(daggerOptions.env).toStrictEqual({ CI: 'true', GITHUB_ACTIONS: 'true' })
+			expect(env.DAGGER_CLOUD_TOKEN).toBe('test-dagger-cloud-token')
+		})
+
+		it('spawns dagger directly without an op wrapper', async () => {
+			const runDaggerCommand = createRunner()
+			await runDaggerCommand('test-cmd', { extraArgs: ['--verbose'] })
+
+			const { argv } = getSpawnCall()
+			expect(argv[0]).toBe('dagger')
+			expect(argv).not.toContain('op')
+			expect(argv).toStrictEqual([
+				'dagger',
+				'call',
+				'test-cmd',
+				'--verbose',
+				'--options=env://DAGGER_OPTIONS',
+			])
 		})
-		expect(env.DAGGER_CLOUD_TOKEN).toBeUndefined()
 	})
 
-	it('passes DAGGER_CLOUD_TOKEN to the runner env (but not DAGGER_OPTIONS) in CI', async () => {
-		vi.stubEnv('CI', 'true')
-		vi.stubEnv('GITHUB_ACTIONS', 'true')
+	describe('1password', () => {
+		beforeEach(() => {
+			mocks.fetchJson.mockResolvedValue(testOPItem)
+		})
+
+		it('builds the expected DAGGER_OPTIONS payload from the op item sections', async () => {
+			const runDaggerCommand = createOnePasswordRunner()
+			await runDaggerCommand('test-cmd', {
+				args: { push: 'true' },
+				env: { NODE_ENV: 'production' },
+			})
+
+			expect(mocks.fetchCmd).toHaveBeenCalledWith(
+				'op item get test-item-id --vault test-vault-id --format json'
+			)
+
+			const { env } = getSpawnCall()
+			expect(JSON.parse(env.DAGGER_OPTIONS as string)).toStrictEqual({
+				args: { push: 'true' },
+				env: { NODE_ENV: 'production' },
+				secrets: { API_TOKEN: 'test-api-token' },
+			})
+			expect(env.DAGGER_CLOUD_TOKEN).toBeUndefined()
+		})
 
-		const runDaggerCommand = createRunner()
-		await runDaggerCommand('test-cmd')
+		it('wraps dagger call in op run --no-masking', async () => {
+			const runDaggerCommand = createOnePasswordRunner()
+			await runDaggerCommand('test-cmd', { extraArgs: ['--verbose'] })
 
-		const { env } = getSpawnCall()
-		const daggerOptions = JSON.parse(env.DAGGER_OPTIONS as string)
-		expect(daggerOptions.secrets).not.toHaveProperty('DAGGER_CLOUD_TOKEN')
-		expect(daggerOptions.env).toStrictEqual({ CI: 'true', GITHUB_ACTIONS: 'true' })
-		expect(env.DAGGER_CLOUD_TOKEN).toBe('test-dagger-cloud-token')
+			const { argv } = getSpawnCall()
+			expect(argv).toStrictEqual([
+				'op',
+				'run',
+				'--no-masking',
+				'--',
+				'dagger',
+				'call',
+				'test-cmd',
+				'--verbose',
+				'--options=env://DAGGER_OPTIONS',
+			])
+		})
+
+		it('passes DAGGER_CLOUD_TOKEN as an op:// reference in CI', async () => {
+			vi.stubEnv('CI', 'true')
+			vi.stubEnv('GITHUB_ACTIONS', 'true')
+
+			const runDaggerCommand = createOnePasswordRunner()
+			await runDaggerCommand('test-cmd')
+
+			const { env } = getSpawnCall()
+			const daggerOptions = JSON.parse(env.DAGGER_OPTIONS as string)
+			expect(daggerOptions.secrets).not.toHaveProperty('DAGGER_CLOUD_TOKEN')
+			expect(daggerOptions.env).toStrictEqual({ CI: 'true', GITHUB_ACTIONS: 'true' })
+			expect(env.DAGGER_CLOUD_TOKEN).toBe('op://test-vault-id/test-item-id/DAGGER_CLOUD_TOKEN')
+		})
 	})
 
-	it('spawns dagger directly without an op wrapper', async () => {
-		const runDaggerCommand = createRunner()
-		await runDaggerCommand('test-cmd', { extraArgs: ['--verbose'] })
-
-		const { argv } = getSpawnCall()
-		expect(argv[0]).toBe('dagger')
-		expect(argv).not.toContain('op')
-		expect(argv).toStrictEqual([
-			'dagger',
-			'call',
-			'test-cmd',
-			'--verbose',
-			'--options=env://DAGGER_OPTIONS',
-		])
+	describe('additionalSecrets', () => {
+		beforeEach(() => {
+			mocks.fetchJson.mockResolvedValue([
+				{ key: 'API_TOKEN', value: 'test-api-token', comment: '' },
+			])
+		})
+
+		it('merges additional secrets into the provider secrets', async () => {
+			const runDaggerCommand = createRunner({
+				additionalSecrets: { FORWARDED_TOKEN: 'test-forwarded-token' },
+			})
+			await runDaggerCommand('test-cmd')
+
+			const { env } = getSpawnCall()
+			expect(JSON.parse(env.DAGGER_OPTIONS as string).secrets).toStrictEqual({
+				API_TOKEN: 'test-api-token',
+				FORWARDED_TOKEN: 'test-forwarded-token',
+			})
+		})
+
+		it('skips additional secrets with an undefined value', async () => {
+			const runDaggerCommand = createRunner({
+				additionalSecrets: { FORWARDED_TOKEN: undefined },
+			})
+			await runDaggerCommand('test-cmd')
+
+			const { env } = getSpawnCall()
+			expect(JSON.parse(env.DAGGER_OPTIONS as string).secrets).toStrictEqual({
+				API_TOKEN: 'test-api-token',
+			})
+		})
+
+		it('takes precedence over a provider secret of the same name', async () => {
+			const runDaggerCommand = createRunner({
+				additionalSecrets: { API_TOKEN: 'test-override-token' },
+			})
+			await runDaggerCommand('test-cmd')
+
+			const { env } = getSpawnCall()
+			expect(JSON.parse(env.DAGGER_OPTIONS as string).secrets).toStrictEqual({
+				API_TOKEN: 'test-override-token',
+			})
+		})
+
+		it('merges additional secrets for the 1password provider', async () => {
+			mocks.fetchJson.mockResolvedValue(testOPItem)
+
+			const runDaggerCommand = createOnePasswordRunner({
+				additionalSecrets: { FORWARDED_TOKEN: 'test-forwarded-token' },
+			})
+			await runDaggerCommand('test-cmd')
+
+			const { env } = getSpawnCall()
+			expect(JSON.parse(env.DAGGER_OPTIONS as string).secrets).toStrictEqual({
+				API_TOKEN: 'test-api-token',
+				FORWARDED_TOKEN: 'test-forwarded-token',
+			})
+		})
 	})
 
 	describe('docker socket', () => {
+		beforeEach(() => {
+			mocks.fetchJson.mockResolvedValue([
+				{ key: 'API_TOKEN', value: 'test-api-token', comment: '' },
+			])
+		})
+
 		it('appends --docker-socket for dockerCommands when the socket exists', async () => {
 			mocks.exists.mockResolvedValue(true)
 

package/src/run-dagger-cmd.ts

@@ -1,6 +1,8 @@
 import { z } from 'zod/v4'
 import { $, fs } from 'zx'
 
+import { OPItem, OPSection } from './op.js'
+
 import type { DaggerEnv, DaggerEnvConfig } from './dagger-env.js'
 
 /**
@@ -13,23 +15,54 @@ export const InfisicalSecret = z.object({
 })
 
 /**
- * Configuration for running Dagger commands with Infisical integration
+ * Infisical secrets provider configuration
  */
-export interface RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvConfig> {
+export interface InfisicalProviderConfig {
 	/** Infisical project ID */
 	projectId: string
 	/** Infisical environment slug (e.g. `prod`) */
 	env: string
 	/** Infisical folder path to fetch secrets from (e.g. `/ci/my-repo`) */
 	path: string
+}
+
+/**
+ * 1Password secrets provider configuration
+ */
+export interface OnePasswordProviderConfig {
+	/** 1Password vault ID */
+	opVault: string
+	/** 1Password item ID */
+	opItem: string
+	/** 1Password sections to include for secrets */
+	opSections: Array<{ label: string; id: string }>
+}
+
+/**
+ * Configuration shared by all secrets providers
+ */
+export interface RunDaggerCommandBaseConfig<T extends DaggerEnvConfig = DaggerEnvConfig> {
 	/** Commands that should include Docker socket if available */
 	dockerCommands?: string[]
 	/** Hook to run before executing the command (e.g., vendor file setup) */
 	beforeCommand?: () => Promise<void>
 	/** DaggerEnv instance for schema validation and type safety */
 	daggerEnv: DaggerEnv<T>
+	/**
+	 * Secrets to pass to Dagger alongside the ones fetched from the provider,
+	 * taking precedence on conflict. Entries with an undefined value are
+	 * skipped, so short-lived credentials that only exist in some environments
+	 * (e.g. a CI-issued token) can be forwarded without a separate config path.
+	 */
+	additionalSecrets?: Record<string, string | undefined>
 }
 
+/**
+ * Configuration for running Dagger commands with Infisical or 1Password integration
+ */
+export type RunDaggerCommandConfig<T extends DaggerEnvConfig = DaggerEnvConfig> =
+	RunDaggerCommandBaseConfig<T> & (InfisicalProviderConfig | OnePasswordProviderConfig)
+
 /**
  * Options for individual command execution
  */
@@ -43,10 +76,58 @@ export interface RunDaggerCommandOptions {
 }
 
 /**
- * Creates a function to run Dagger commands with Infisical integration
+ * Fetches secrets from Infisical via `infisical export`
+ */
+async function fetchInfisicalSecrets(
+	config: InfisicalProviderConfig
+): Promise<Record<string, string>> {
+	const exportedSecrets = InfisicalSecret.array().parse(
+		await $`infisical export --silent --format=json --projectId ${config.projectId} --env ${config.env} --path ${config.path}`.json()
+	)
+
+	return exportedSecrets.reduce(
+		(acc, s) => {
+			acc[s.key] = s.value
+			return acc
+		},
+		{} as Record<string, string>
+	)
+}
+
+/**
+ * Fetches secrets from a 1Password item, filtered to the configured sections
+ */
+async function fetchOnePasswordSecrets(
+	config: OnePasswordProviderConfig
+): Promise<Record<string, string>> {
+	const opItem = OPItem.parse(
+		await $`op item get ${config.opItem} --vault ${config.opVault} --format json`.json()
+	)
+
+	const sectionsToInclude = OPSection.array().parse(config.opSections)
+
+	return opItem.fields
+		.filter((f) => sectionsToInclude.some((s) => s.id === f.section?.id))
+		.reduce(
+			(acc, f) => {
+				acc[f.label] = f.value
+				return acc
+			},
+			{} as Record<string, string>
+		)
+}
+
+/**
+ * Creates a function to run Dagger commands with Infisical or 1Password integration
  * @param config Configuration for the command runner
  * @returns Function to execute Dagger commands
  */
+export function createDaggerCommandRunner<T extends DaggerEnvConfig>(
+	config: RunDaggerCommandBaseConfig<T> & InfisicalProviderConfig
+): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>
+export function createDaggerCommandRunner<T extends DaggerEnvConfig>(
+	config: RunDaggerCommandBaseConfig<T> & OnePasswordProviderConfig
+): (commandName: string, options?: RunDaggerCommandOptions) => Promise<void>
 export function createDaggerCommandRunner<T extends DaggerEnvConfig>(
 	config: RunDaggerCommandConfig<T>
 ) {
@@ -61,7 +142,7 @@ export function createDaggerCommandRunner<T extends DaggerEnvConfig>(
 			await config.beforeCommand()
 		}
 
-		// Environment variables to pass to the `dagger` command
+		// Environment variables to pass to the spawned command
 		const envVars: Record<string, string> = {}
 
 		const commandArgs: string[] = [...extraArgs]
@@ -77,23 +158,29 @@ export function createDaggerCommandRunner<T extends DaggerEnvConfig>(
 			}
 		}
 
-		// Fetch secrets from Infisical
-		const exportedSecrets = InfisicalSecret.array().parse(
-			await $`infisical export --silent --format=json --projectId ${config.projectId} --env ${config.env} --path ${config.path}`.json()
-		)
+		// Fetch secrets from the configured provider
+		let secrets: Record<string, string>
+		if ('opVault' in config) {
+			secrets = await fetchOnePasswordSecrets(config)
 
-		// Extract secrets into a key/value map
-		const secrets = exportedSecrets.reduce(
-			(acc, s) => {
-				acc[s.key] = s.value
-				return acc
-			},
-			{} as Record<string, string>
-		)
+			// Pass dagger cloud token in CI because we don't have user auth.
+			// The op:// reference is resolved by the `op run` wrapper below.
+			if (process.env.CI !== undefined) {
+				envVars.DAGGER_CLOUD_TOKEN = `op://${config.opVault}/${config.opItem}/DAGGER_CLOUD_TOKEN`
+			}
+		} else {
+			secrets = await fetchInfisicalSecrets(config)
 
-		// Pass dagger cloud token in CI because we don't have user auth
-		if (process.env.CI !== undefined && secrets.DAGGER_CLOUD_TOKEN !== undefined) {
-			envVars.DAGGER_CLOUD_TOKEN = secrets.DAGGER_CLOUD_TOKEN
+			// Pass dagger cloud token in CI because we don't have user auth
+			if (process.env.CI !== undefined && secrets.DAGGER_CLOUD_TOKEN !== undefined) {
+				envVars.DAGGER_CLOUD_TOKEN = secrets.DAGGER_CLOUD_TOKEN
+			}
+		}
+
+		for (const [name, value] of Object.entries(config.additionalSecrets ?? {})) {
+			if (value !== undefined) {
+				secrets[name] = value
+			}
 		}
 
 		// Build environment variables for Dagger
@@ -113,8 +200,10 @@ export function createDaggerCommandRunner<T extends DaggerEnvConfig>(
 		})
 		envVars.DAGGER_OPTIONS = JSON.stringify(daggerOptions)
 
-		// Construct the command
+		// Construct the command. 1Password wraps `dagger call` in `op run`
+		// so that op:// references in the environment are resolved.
 		const cmd: string[] = [
+			...('opVault' in config ? ['op', 'run', '--no-masking', '--'] : []),
 			'dagger',
 			'call',
 			commandName,