feat(onepassword): support service account datasource

[siisee11]

One-Line Summary

1Password data sources can now connect with Service Account tokens for read-only vault, item, and secret-reference access.

User-Facing Changes

• 1Password credentials can use authMethod: "service_account" with serviceAccountToken instead of requiring a Connect Server URL.
• Service Account sources expose list_vaults, list_items, get_item, and resolve_secret source API operations.
• Existing Connect Server credentials still work with authMethod: "connect", apiBaseUrl, and accessToken.

Why This Changed

The previous 1Password provider only modeled the self-hosted Connect Server REST API. 1Password Service Accounts authenticate through the official SDK/CLI flow rather than a Connect-style cloud apiBaseUrl, so users could not add the cloud Service Account datasource without standing up Connect Server.

How It Changed

• Added a union credential schema for Connect Server and Service Account modes.
• Kept the existing Connect Server simple REST adapter path for backwards compatibility.
• Added an SDK-backed Service Account adapter with read-only structured operations and test-injectable client creation.
• Updated connection guide metadata to default to Service Account setup while documenting Connect Server as the REST fallback.

Extra Context / Decisions

• The Service Account adapter intentionally rejects raw fetch_api requests, request bodies, and custom headers so the token only enables the supported read-only operations.

Verification

• bun run typecheck in packages/server
• bun run test src/source-api/adapters/simple-rest-providers.test.ts in packages/server
• bun run test src/credentials.test.ts in packages/db
• bunx turbo typecheck --filter=@onequery/server --filter=@onequery/db --filter=@velen/web --filter=@velen/db --json from Velen root
• bunx turbo test --filter=@onequery/server --filter=@onequery/db --filter=@velen/web --filter=@velen/db --json from Velen root

Video / Screenshot (Optional)

• N/A

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	onequery-landing	935314b	Commit Preview URL Branch Preview URL	Jun 12 2026, 08:37 AM