sync-cf-secrets 0.1.0 → 0.3.0

package/README.md

@@ -135,7 +135,7 @@ Create a `.sync-cf-secrets.json` in your project root (all fields optional):
 
 ### Defaults
 
-- **provider** — auto-detected from available CLIs (`op` or `bw`)
+- **provider** — auto-detected (prefers 1Password SDK when `OP_SERVICE_ACCOUNT_TOKEN` is set, then `op` CLI, then `bw` CLI)
 - **vault** — project name from `package.json`
 - **prefix** — same as vault
 - **wranglerConfig** — auto-searches for `wrangler.toml`, `wrangler.jsonc`, or `wrangler.json` (including `apps/web/`)
@@ -148,7 +148,17 @@ Create a `.sync-cf-secrets.json` in your project root (all fields optional):
 
 The easiest way to get started is `sync-cf-secrets init`, which creates Secure Note items with the right fields. You can also create them manually — one Secure Note per environment with custom fields where the **label** is the env var name and the **value** is the secret.
 
-Requires the [1Password CLI](https://developer.1password.com/docs/cli/get-started/) (`op`). Auth is handled via the 1Password desktop app (biometric/Touch ID).
+**Two backends are available:**
+
+**1. JavaScript SDK (recommended for CI/AI agents):** When `OP_SERVICE_ACCOUNT_TOKEN` is set, the tool uses the [@1password/sdk](https://www.npmjs.com/package/@1password/sdk) package directly — no CLI binary needed. This works in sandboxed environments (Claude Code, CI containers, etc.) where the `op` CLI can't run.
+
+```bash
+export OP_SERVICE_ACCOUNT_TOKEN="ops_..."
+```
+
+Create a [service account](https://developer.1password.com/docs/service-accounts/) with read/write access to the vault. Service accounts can only access custom vaults (not Personal/Private).
+
+**2. CLI (`op`):** For interactive use with biometric/Touch ID auth via the [1Password desktop app](https://developer.1password.com/docs/cli/get-started/). Requires `op` CLI version 2.18.0+. Used automatically when no service account token is set.
 
 ### Bitwarden
 
@@ -172,6 +182,24 @@ interface SecretProvider {
 }
 ```
 
+## AI Skill
+
+Installing this package automatically registers a [Claude Code skill](https://docs.anthropic.com/en/docs/claude-code) at `~/.claude/skills/sync-cf-secrets/`. This teaches AI assistants the full command reference and workflow patterns so they can help manage your secrets.
+
+## Contributing
+
+This project uses [changesets](https://github.com/changesets/changesets) for version management.
+
+```bash
+# After making changes, create a changeset
+npm run changeset
+# → interactive prompt: pick patch/minor/major, write a summary
+
+# When ready to release
+npm run version    # bumps package.json version, updates CHANGELOG.md
+npm run release    # builds and publishes to npm
+```
+
 ## Security
 
 - Secret values are piped to wrangler via stdin — never exposed in CLI arguments or process listings

package/dist/commands/diff.js

@@ -1,5 +1,5 @@
 import { error, log, success, warn } from "../utils.js";
-import { listSecrets, validateWrangler } from "../wrangler.js";
+import { getWranglerVars, listSecrets, validateWrangler } from "../wrangler.js";
 export async function diff(provider, config, opts) {
     const envConfig = config.environments[opts.env];
     if (!envConfig) {
@@ -8,11 +8,13 @@ export async function diff(provider, config, opts) {
     }
     validateWrangler();
     log(`Comparing ${provider.name} item "${envConfig.item}" vs Cloudflare ${opts.env}...\n`);
-    // Fetch field names from provider
-    const providerFields = new Set(await provider.listFields({
+    // Fetch field names from provider, excluding wrangler vars
+    const wranglerVars = getWranglerVars(opts.env, config.wranglerConfig);
+    const allFields = await provider.listFields({
         vault: config.vault,
         item: envConfig.item,
-    }));
+    });
+    const providerFields = new Set(allFields.filter((name) => !wranglerVars.has(name)));
     // Fetch deployed secret names from Cloudflare
     const cfSecrets = new Set(listSecrets(opts.env, config.wranglerConfig));
     const missingFromCf = [];

package/dist/commands/diff.js.map

@@ -1 +1 @@
-{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/commands/diff.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAO/D,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,QAAwB,EACxB,MAAc,EACd,IAAiB;IAEjB,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,GAAG,KAAK;YACnC,cAAc,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,gBAAgB,EAAE,CAAC;IAEnB,GAAG,CAAC,aAAa,QAAQ,CAAC,IAAI,UAAU,SAAS,CAAC,IAAI,mBAAmB,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IAE1F,kCAAkC;IAClC,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,MAAM,QAAQ,CAAC,UAAU,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,SAAS,CAAC,IAAI;KACrB,CAAC,CACH,CAAC;IAEF,8CAA8C;IAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAExE,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,+BAA+B,QAAQ,CAAC,IAAI,qBAAqB,CAAC,CAAC;QACxE,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;YACxC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,4CAA4C,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;QACpE,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACxC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,CACL,OAAO,QAAQ,CAAC,MAAM,yBAAyB,CAChD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CACH,GAAG,aAAa,CAAC,MAAM,aAAa,SAAS,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,YAAY,CAC3F,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/commands/diff.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAOhF,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,QAAwB,EACxB,MAAc,EACd,IAAiB;IAEjB,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,GAAG,KAAK;YACnC,cAAc,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,gBAAgB,EAAE,CAAC;IAEnB,GAAG,CAAC,aAAa,QAAQ,CAAC,IAAI,UAAU,SAAS,CAAC,IAAI,mBAAmB,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IAE1F,2DAA2D;IAC3D,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,SAAS,CAAC,IAAI;KACrB,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CACpD,CAAC;IAEF,8CAA8C;IAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAExE,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,+BAA+B,QAAQ,CAAC,IAAI,qBAAqB,CAAC,CAAC;QACxE,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;YACxC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,4CAA4C,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;QACpE,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACxC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,CACL,OAAO,QAAQ,CAAC,MAAM,yBAAyB,CAChD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CACH,GAAG,aAAa,CAAC,MAAM,aAAa,SAAS,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,YAAY,CAC3F,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/providers/index.d.ts

@@ -5,7 +5,7 @@ export type { SecretProvider } from "./types.js";
  */
 export declare function getProvider(name: string): SecretProvider;
 /**
- * Auto-detect which provider is available by checking for CLI tools.
+ * Auto-detect which provider is available by checking for CLI tools or env vars.
  */
 export declare function detectProvider(): SecretProvider;
 /**

package/dist/providers/index.js

@@ -1,14 +1,22 @@
 import { cliExists } from "../utils.js";
 import { BitwardenProvider } from "./bitwarden.js";
 import { OnePasswordProvider } from "./onepassword.js";
-const PROVIDERS = [
-    () => new OnePasswordProvider(),
-    () => new BitwardenProvider(),
-];
+import { OnePasswordSDKProvider } from "./onepassword-sdk.js";
+/**
+ * Pick the best 1Password provider:
+ * - SDK (via @1password/sdk) when OP_SERVICE_ACCOUNT_TOKEN is set — works in non-interactive environments
+ * - CLI (via op) as fallback — requires biometric auth or desktop app
+ */
+function onePasswordProvider() {
+    if (process.env.OP_SERVICE_ACCOUNT_TOKEN) {
+        return new OnePasswordSDKProvider();
+    }
+    return new OnePasswordProvider();
+}
 const PROVIDER_MAP = {
-    "1password": () => new OnePasswordProvider(),
-    onepassword: () => new OnePasswordProvider(),
-    op: () => new OnePasswordProvider(),
+    "1password": onePasswordProvider,
+    onepassword: onePasswordProvider,
+    op: onePasswordProvider,
     bitwarden: () => new BitwardenProvider(),
     bw: () => new BitwardenProvider(),
 };
@@ -24,19 +32,25 @@ export function getProvider(name) {
     return factory();
 }
 /**
- * Auto-detect which provider is available by checking for CLI tools.
+ * Auto-detect which provider is available by checking for CLI tools or env vars.
  */
 export function detectProvider() {
-    for (const factory of PROVIDERS) {
-        const provider = factory();
-        if (cliExists(provider.cli)) {
-            return provider;
-        }
+    // Prefer SDK when service account token is available
+    if (process.env.OP_SERVICE_ACCOUNT_TOKEN) {
+        return new OnePasswordSDKProvider();
+    }
+    // Fall back to CLI detection
+    if (cliExists("op")) {
+        return new OnePasswordProvider();
+    }
+    if (cliExists("bw")) {
+        return new BitwardenProvider();
     }
-    throw new Error("No supported password manager CLI found.\n" +
-        "Install one of:\n" +
-        "  - 1Password CLI (op): https://developer.1password.com/docs/cli/\n" +
-        "  - Bitwarden CLI (bw): https://bitwarden.com/help/cli/");
+    throw new Error("No supported password manager found.\n" +
+        "Options:\n" +
+        "  - Set OP_SERVICE_ACCOUNT_TOKEN for 1Password (no CLI needed)\n" +
+        "  - Install 1Password CLI (op): https://developer.1password.com/docs/cli/\n" +
+        "  - Install Bitwarden CLI (bw): https://bitwarden.com/help/cli/");
 }
 /**
  * Resolve a provider from an optional name — explicit lookup or auto-detect.

package/dist/providers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAKvD,MAAM,SAAS,GAAgC;IAC7C,GAAG,EAAE,CAAC,IAAI,mBAAmB,EAAE;IAC/B,GAAG,EAAE,CAAC,IAAI,iBAAiB,EAAE;CAC9B,CAAC;AAEF,MAAM,YAAY,GAAyC;IACzD,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,mBAAmB,EAAE;IAC5C,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,mBAAmB,EAAE;IAC5C,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,mBAAmB,EAAE;IACnC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,iBAAiB,EAAE;IACxC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,iBAAiB,EAAE;CAClC,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,uBAAuB,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC;QAC3B,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4CAA4C;QAC1C,mBAAmB;QACnB,qEAAqE;QACrE,yDAAyD,CAC5D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;AACrD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAK9D;;;;GAIG;AACH,SAAS,mBAAmB;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QACzC,OAAO,IAAI,sBAAsB,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,mBAAmB,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,YAAY,GAAyC;IACzD,WAAW,EAAE,mBAAmB;IAChC,WAAW,EAAE,mBAAmB;IAChC,EAAE,EAAE,mBAAmB;IACvB,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,iBAAiB,EAAE;IACxC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,iBAAiB,EAAE;CAClC,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,uBAAuB,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,qDAAqD;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QACzC,OAAO,IAAI,sBAAsB,EAAE,CAAC;IACtC,CAAC;IAED,6BAA6B;IAC7B,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,mBAAmB,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,iBAAiB,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,KAAK,CACb,wCAAwC;QACtC,YAAY;QACZ,kEAAkE;QAClE,6EAA6E;QAC7E,iEAAiE,CACpE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;AACrD,CAAC"}

package/dist/providers/onepassword-sdk.d.ts

@@ -0,0 +1,10 @@
+import type { FetchOpts, SaveOpts, SecretProvider } from "./types.js";
+export declare class OnePasswordSDKProvider implements SecretProvider {
+    name: string;
+    cli: string;
+    validate(): Promise<void>;
+    fetch(opts: FetchOpts): Promise<Map<string, string>>;
+    exists(opts: FetchOpts): Promise<boolean>;
+    save(opts: SaveOpts): Promise<void>;
+    listFields(opts: FetchOpts): Promise<string[]>;
+}

package/dist/providers/onepassword-sdk.js

@@ -0,0 +1,116 @@
+let sdkModule = null;
+let clientPromise = null;
+async function getSDK() {
+    if (!sdkModule) {
+        sdkModule = await import("@1password/sdk");
+    }
+    return sdkModule;
+}
+async function getClient() {
+    if (!clientPromise) {
+        clientPromise = (async () => {
+            const { createClient } = await getSDK();
+            const token = process.env.OP_SERVICE_ACCOUNT_TOKEN;
+            if (!token) {
+                throw new Error("OP_SERVICE_ACCOUNT_TOKEN not set.\n" +
+                    "Create a service account: https://developer.1password.com/docs/service-accounts/");
+            }
+            return createClient({
+                auth: token,
+                integrationName: "sync-cf-secrets",
+                integrationVersion: "1.0.0",
+            });
+        })();
+    }
+    return clientPromise;
+}
+/**
+ * Resolve a vault name to its ID.
+ */
+async function resolveVaultId(vaultName) {
+    const client = await getClient();
+    const vaults = await client.vaults.list();
+    for await (const vault of vaults) {
+        if (vault.title === vaultName) {
+            return vault.id;
+        }
+    }
+    throw new Error(`Vault "${vaultName}" not found. Check that the service account has access to it.`);
+}
+/**
+ * Find all items matching a title in a vault.
+ */
+async function findItems(vaultId, title) {
+    const client = await getClient();
+    const overviews = await client.items.list(vaultId);
+    const matches = [];
+    for await (const overview of overviews) {
+        if (overview.title === title) {
+            matches.push({ id: overview.id, vaultId: overview.vaultId });
+        }
+    }
+    return matches;
+}
+export class OnePasswordSDKProvider {
+    name = "1Password (SDK)";
+    cli = "op"; // Still report op for detection, but we don't use it
+    async validate() {
+        const client = await getClient();
+        // Quick check — list vaults to confirm auth works
+        const vaults = await client.vaults.list();
+        for await (const _vault of vaults) {
+            break;
+        }
+    }
+    async fetch(opts) {
+        const client = await getClient();
+        const vaultId = await resolveVaultId(opts.vault);
+        const matches = await findItems(vaultId, opts.item);
+        if (matches.length === 0) {
+            throw new Error(`Item "${opts.item}" not found in vault "${opts.vault}".`);
+        }
+        const item = await client.items.get(matches[0].vaultId, matches[0].id);
+        const secrets = new Map();
+        for (const field of item.fields) {
+            if (!field.title || field.value === undefined || field.value === "")
+                continue;
+            secrets.set(field.title, field.value);
+        }
+        return secrets;
+    }
+    async exists(opts) {
+        const vaultId = await resolveVaultId(opts.vault);
+        const matches = await findItems(vaultId, opts.item);
+        return matches.length > 0;
+    }
+    async save(opts) {
+        const client = await getClient();
+        const { ItemFieldType, ItemCategory } = await getSDK();
+        const vaultId = await resolveVaultId(opts.vault);
+        // Delete ALL existing items with this name
+        const existing = await findItems(vaultId, opts.item);
+        for (const item of existing) {
+            await client.items.delete(item.vaultId, item.id);
+        }
+        // Create new Secure Note with all fields
+        const fields = Array.from(opts.secrets.entries()).map(([label, value]) => ({
+            id: label,
+            title: label,
+            fieldType: ItemFieldType.Concealed,
+            value,
+            sectionId: "secrets",
+        }));
+        await client.items.create({
+            title: opts.item,
+            category: ItemCategory.SecureNote,
+            vaultId,
+            fields,
+            sections: [{ id: "secrets", title: "Secrets" }],
+        });
+    }
+    async listFields(opts) {
+        const secrets = await this.fetch(opts);
+        return Array.from(secrets.keys());
+    }
+}
+//# sourceMappingURL=onepassword-sdk.js.map

package/dist/providers/onepassword-sdk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onepassword-sdk.js","sourceRoot":"","sources":["../../src/providers/onepassword-sdk.ts"],"names":[],"mappings":"AAMA,IAAI,SAAS,GAAe,IAAI,CAAC;AACjC,IAAI,aAAa,GAA2B,IAAI,CAAC;AAEjD,KAAK,UAAU,MAAM;IACnB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;YACnD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,qCAAqC;oBACnC,kFAAkF,CACrF,CAAC;YACJ,CAAC;YACD,OAAO,YAAY,CAAC;gBAClB,IAAI,EAAE,KAAK;gBACX,eAAe,EAAE,iBAAiB;gBAClC,kBAAkB,EAAE,OAAO;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAAC,SAAiB;IAC7C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,UAAU,SAAS,+DAA+D,CACnF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CACtB,OAAe,EACf,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,OAAO,GAA2C,EAAE,CAAC;IAC3D,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,sBAAsB;IACjC,IAAI,GAAG,iBAAiB,CAAC;IACzB,GAAG,GAAG,IAAI,CAAC,CAAC,qDAAqD;IAEjE,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,kDAAkD;QAClD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;YAClC,MAAM;QACR,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAe;QACzB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,CAAC,IAAI,yBAAyB,IAAI,CAAC,KAAK,IAAI,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAe;QAC1B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAc;QACvB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEjD,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,yCAAyC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACnD,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACnB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,KAAK;YACL,SAAS,EAAE,SAAS;SACrB,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YACxB,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,QAAQ,EAAE,YAAY,CAAC,UAAU;YACjC,OAAO;YACP,MAAM;YACN,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAe;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/providers/onepassword.js

@@ -18,8 +18,16 @@ export class OnePasswordProvider {
             exec("op whoami", { stdio: ["pipe", "pipe", "pipe"] });
         }
         catch {
-            throw new Error("Not signed in to 1Password.\n" +
-                "Run: eval $(op signin)");
+            const hasServiceToken = !!process.env.OP_SERVICE_ACCOUNT_TOKEN;
+            if (hasServiceToken) {
+                throw new Error("OP_SERVICE_ACCOUNT_TOKEN is set but authentication failed.\n" +
+                    "Check that the token is valid and the service account has vault access.");
+            }
+            throw new Error("Not signed in to 1Password.\n\n" +
+                "Interactive use (biometric):\n" +
+                "  Open the 1Password desktop app and try again.\n\n" +
+                "Non-interactive use (CI, AI agents):\n" +
+                "  Set OP_SERVICE_ACCOUNT_TOKEN — see https://developer.1password.com/docs/service-accounts/");
         }
     }
     async fetch(opts) {

package/dist/providers/onepassword.js.map

@@ -1 +1 @@
-{"version":3,"file":"onepassword.js","sourceRoot":"","sources":["../../src/providers/onepassword.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAY,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAG9C,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,UAAU;IACV,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAgBH,MAAM,OAAO,mBAAmB;IAC9B,IAAI,GAAG,WAAW,CAAC;IACnB,GAAG,GAAG,IAAI,CAAC;IAEX,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,iCAAiC;gBAC/B,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,+BAA+B;gBAC7B,wBAAwB,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAe;QACzB,MAAM,IAAI,GAAG,IAAI,CACf,gBAAgB,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,KAAK,iBAAiB,EAClE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;QAEF,MAAM,IAAI,GAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACtC,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC9C,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;gBAAE,SAAS;YACxC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,IAAe;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CACf,yBAAyB,IAAI,CAAC,KAAK,iBAAiB,EACpD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;YACF,MAAM,KAAK,GAAa,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,KAAK;iBACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC;iBACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAe;QAC1B,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAc;QACvB,kFAAkF;QAClF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,EAAE;gBACjB,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK;aAC5C,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,mFAAmF;QACnF,8EAA8E;QAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;aACjD,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,cAAc,KAAK,EAAE,CAAC,CAAC;QAE1D,YAAY,CAAC,IAAI,EAAE;YACjB,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,aAAa;YAC3B,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,GAAG,SAAS;SACb,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAe;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"onepassword.js","sourceRoot":"","sources":["../../src/providers/onepassword.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAY,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAG9C,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,UAAU;IACV,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAgBH,MAAM,OAAO,mBAAmB;IAC9B,IAAI,GAAG,WAAW,CAAC;IACnB,GAAG,GAAG,IAAI,CAAC;IAEX,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,iCAAiC;gBAC/B,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,eAAe,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;YAC/D,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,8DAA8D;oBAC5D,yEAAyE,CAC5E,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iCAAiC;gBAC/B,gCAAgC;gBAChC,qDAAqD;gBACrD,wCAAwC;gBACxC,6FAA6F,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAe;QACzB,MAAM,IAAI,GAAG,IAAI,CACf,gBAAgB,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,KAAK,iBAAiB,EAClE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;QAEF,MAAM,IAAI,GAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACtC,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC9C,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;gBAAE,SAAS;YACxC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,IAAe;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CACf,yBAAyB,IAAI,CAAC,KAAK,iBAAiB,EACpD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC;YACF,MAAM,KAAK,GAAa,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,KAAK;iBACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC;iBACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAe;QAC1B,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAc;QACvB,kFAAkF;QAClF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,EAAE;gBACjB,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK;aAC5C,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,mFAAmF;QACnF,8EAA8E;QAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;aACjD,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,cAAc,KAAK,EAAE,CAAC,CAAC;QAE1D,YAAY,CAAC,IAAI,EAAE;YACjB,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,aAAa;YAC3B,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,GAAG,SAAS;SACb,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAe;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;CACF"}

package/package.json

@@ -1,18 +1,24 @@
 {
   "name": "sync-cf-secrets",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Sync Cloudflare Workers secrets from 1Password or Bitwarden. Push, pull, and diff secrets across environments.",
   "type": "module",
   "bin": {
     "sync-cf-secrets": "./dist/cli.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "skill",
+    "scripts/postinstall.js"
   ],
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "prepublishOnly": "tsc"
+    "postinstall": "node scripts/postinstall.js",
+    "prepublishOnly": "tsc",
+    "changeset": "changeset",
+    "version": "changeset version",
+    "release": "npm run build && changeset publish"
   },
   "keywords": [
     "cloudflare",
@@ -46,7 +52,11 @@
     }
   },
   "devDependencies": {
+    "@changesets/cli": "^2.30.0",
     "@types/node": "^25.5.2",
     "typescript": "^5.7.0"
+  },
+  "dependencies": {
+    "@1password/sdk": "^0.4.0"
   }
 }

package/scripts/postinstall.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+// Copies the skill file to ~/.claude/skills/sync-cf-secrets/
+// so Claude Code auto-discovers it.
+
+import { existsSync, mkdirSync, copyFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const skillSource = join(__dirname, "..", "skill", "SKILL.md");
+const skillTarget = join(homedir(), ".claude", "skills", "sync-cf-secrets", "SKILL.md");
+
+try {
+  if (!existsSync(skillSource)) {
+    // Silently skip if skill file not found (e.g. in CI)
+    process.exit(0);
+  }
+
+  const targetDir = dirname(skillTarget);
+  mkdirSync(targetDir, { recursive: true });
+  copyFileSync(skillSource, skillTarget);
+  console.log("sync-cf-secrets: Installed Claude Code skill");
+} catch {
+  // Don't fail the install if skill copy fails
+}

package/skill/SKILL.md

@@ -0,0 +1,202 @@
+---
+name: sync-cf-secrets
+version: 0.1.0
+description: Sync Cloudflare Workers secrets from a password manager (1Password, Bitwarden). Use when the user asks about managing, pushing, pulling, or diffing Cloudflare secrets, or setting up environment variables for Cloudflare Workers.
+requires:
+  bins: ["sync-cf-secrets"]
+  auth: true
+---
+
+# Cloudflare Secrets Manager
+
+Help users manage Cloudflare Workers secrets using the `sync-cf-secrets` CLI, which syncs secrets between a password manager (1Password or Bitwarden) and Cloudflare Workers environments.
+
+## Agent Guidance
+
+### Key Principles
+
+- **Always use `--dry-run` first** — preview any destructive operation before committing
+- **Never log or display secret values** — only show field names
+- **Confirm before `init` or `copy`** — these delete and recreate password manager items
+- **The password manager is the source of truth** — Cloudflare is the deployment target; Cloudflare does not expose secret values
+- **Wrangler vars are excluded automatically** — variables defined as `vars` in the wrangler config are non-secret config; `init`, `copy`, and `push` skip them
+
+### Design Principles
+
+- Auto-discovers environments from the wrangler config (`wrangler.toml` / `wrangler.jsonc`)
+- Auto-detects the password manager (1Password SDK when `OP_SERVICE_ACCOUNT_TOKEN` is set, `op` CLI, or `bw` CLI)
+- Config is optional — sensible defaults from `package.json` and wrangler config
+- Secret values are piped via stdin to wrangler, never exposed in CLI arguments
+
+### Safety Rules
+
+- Always use `--dry-run` before `push`, `init`, or `copy` to preview changes
+- Never run `init` without the user confirming they want to replace existing items
+- Never display secret values in output — only field names
+- Verify the correct vault and environment before pushing
+
+### Workflow Patterns
+
+#### First-time Setup
+
+```bash
+# 1. Create password manager items from existing .dev.vars
+sync-cf-secrets init --dry-run    # preview first
+sync-cf-secrets init
+
+# 2. Copy local values to staging (most are the same)
+sync-cf-secrets copy local staging
+
+# 3. User edits staging item in password manager (change AUTH_SECRET, etc.)
+
+# 4. Push to Cloudflare
+sync-cf-secrets push staging --dry-run
+sync-cf-secrets push staging
+
+# 5. Repeat for production
+sync-cf-secrets copy staging production
+# User edits production item (swap test keys for live keys)
+sync-cf-secrets push production
+```
+
+#### Onboarding a New Developer
+
+```bash
+# Pull local dev secrets from the shared password manager vault
+sync-cf-secrets pull local
+```
+
+#### Adding a New Secret
+
+```bash
+# 1. Add the field to the password manager item(s) manually
+# 2. Push the updated secrets
+sync-cf-secrets push staging
+sync-cf-secrets push production
+```
+
+#### Auditing After a Deployment
+
+```bash
+sync-cf-secrets diff staging
+sync-cf-secrets diff production
+```
+
+---
+
+## Command Reference
+
+### `init`
+
+Create password manager items for all environments discovered from the wrangler config. Reads field names and values from `.dev.vars`. The `local` item gets actual values; other environments get `CHANGE_ME` placeholders. Excludes wrangler `vars`. Prompts before replacing existing items.
+
+```bash
+sync-cf-secrets init
+sync-cf-secrets init --dry-run
+```
+
+### `copy <from> <to>`
+
+Copy secrets from one environment's password manager item to another. Excludes wrangler `vars` for the target environment. Prompts before replacing the target.
+
+```bash
+sync-cf-secrets copy local staging
+sync-cf-secrets copy staging production
+sync-cf-secrets copy local staging --dry-run
+```
+
+### `push <env>`
+
+Push secrets from the password manager to Cloudflare via `wrangler secret put`. Skips wrangler `vars`. Reports progress per secret and continues on individual failures.
+
+```bash
+sync-cf-secrets push staging
+sync-cf-secrets push production
+sync-cf-secrets push staging --dry-run
+```
+
+### `pull <env>`
+
+Fetch secrets from the password manager and write a `.dev.vars` file.
+
+```bash
+sync-cf-secrets pull local
+sync-cf-secrets pull staging --dry-run
+```
+
+### `list <env>`
+
+List secret names deployed to a Cloudflare Workers environment. Values are never exposed.
+
+```bash
+sync-cf-secrets list staging
+sync-cf-secrets list production
+```
+
+### `diff <env>`
+
+Compare secret names in the password manager vs what's deployed to Cloudflare. Shows missing, extra, and matching secrets.
+
+```bash
+sync-cf-secrets diff staging
+sync-cf-secrets diff production --verbose
+```
+
+### Global Options
+
+| Option | Description |
+|---|---|
+| `--provider <name>` | Force a provider: `1password`, `bitwarden` |
+| `--vault <name>` | Override the vault name |
+| `--dry-run` | Preview without making changes |
+| `--verbose` | Show more detail |
+
+---
+
+## Configuration
+
+Optional `.sync-cf-secrets.json` in project root:
+
+```json
+{
+  "provider": "1password",
+  "vault": "myproject",
+  "prefix": "myproject",
+  "wranglerConfig": "apps/web/wrangler.jsonc",
+  "devVarsPath": "apps/web/.dev.vars"
+}
+```
+
+All fields have defaults: `provider` auto-detected, `vault`/`prefix` from `package.json` name, `wranglerConfig` auto-searched, `devVarsPath` next to wrangler config, environments auto-discovered from wrangler config `env` block.
+
+## Authentication
+
+### For AI agents (non-interactive)
+
+When `OP_SERVICE_ACCOUNT_TOKEN` is set, the tool uses the 1Password JavaScript SDK directly — no CLI binary needed. This works in sandboxed environments (Claude Code, CI containers) where the `op` CLI can't run.
+
+1. Ask the user to create a service account at https://my.1password.com/ (Developer → Service Accounts)
+2. The service account needs **read and write** access to the vault used for secrets
+3. The user sets the token as an environment variable:
+   ```bash
+   export OP_SERVICE_ACCOUNT_TOKEN="ops_..."
+   ```
+4. Once set, all `sync-cf-secrets` commands work without biometric prompts or the `op` CLI
+
+**Important limitations of service accounts:**
+- Cannot access Personal, Private, or the default Shared vault — only custom vaults
+- The vault must be explicitly granted to the service account during creation
+- The token is shown once at creation — it must be saved immediately
+
+If `OP_SERVICE_ACCOUNT_TOKEN` is not set and `op whoami` fails, guide the user through this setup.
+
+### For interactive use
+
+- **1Password**: `op` CLI installed, authenticated via the desktop app (biometric/Touch ID)
+- **Bitwarden**: `bw` CLI installed, `bw login` + `export BW_SESSION=$(bw unlock --raw)`
+
+### Prerequisites
+
+- **1Password**: Either `OP_SERVICE_ACCOUNT_TOKEN` set (uses JS SDK, no CLI needed) or `op` CLI (>= 2.18.0) installed
+- **Bitwarden**: `bw` CLI installed
+- `wrangler` installed (for `push`, `list`, `diff` commands)