feat: Add 1Password adapter

Summary

Add 1Password as a secret source adapter for project-aware secrets.

Context

The SourceAdapter interface exists in internal/adapters/adapter.go. Vercel is implemented as reference.

Implementation

Files to create

• internal/adapters/onepassword/onepassword.go
• internal/adapters/onepassword/onepassword_test.go

Spec

type OnePasswordAdapter struct {
    binary string // path to op CLI, default "op"
}

func New() *OnePasswordAdapter
func (o *OnePasswordAdapter) Pull(project, scope string) (map[string]string, error)
func (o *OnePasswordAdapter) Name() string // returns "1password"

CLI command

# project = vault name, scope = item name or tag
op item get <scope> --vault <project> --format json
# Parse fields into key=value pairs

Register in cmd/secrets/adapter.go

case "1password":
    return onepassword.New(), nil

Test pattern

Follow internal/adapters/vercel/vercel_test.go - mock the CLI, test JSON parsing.

.secrets.json example

{
  "source": "1password",
  "project": "Development",
  "scope": "my-app-secrets",
  "ttl": "1h"
}

Acceptance

• secrets env works with "source": "1password"
• Tests pass without requiring actual 1Password CLI
• Error message when op CLI not installed

Start with internal/adapters/adapter.go and the Vercel implementation and tests in internal/adapters/vercel. Implement the adapter and tests in internal/adapters/onepassword, then register it in cmd/secrets/adapter.go. Done means secrets env accepts source 1password, JSON parsing is tested without the CLI, and the missing op CLI produces an error.