@clef-sh/core 0.1.25 → 0.1.27-beta.189

package/dist/artifact/packer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packer.d.ts","sourceRoot":"","sources":["../../src/artifact/packer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAiB,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkB,MAAM,SAAS,CAAC;AAMjE;;;;;;GAMG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAFJ,UAAU,EAAE,iBAAiB,EAC7B,aAAa,EAAE,aAAa,EAC5B,GAAG,CAAC,EAAE,WAAW,YAAA;IAGpC;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CA0I9F"}
+{"version":3,"file":"packer.d.ts","sourceRoot":"","sources":["../../src/artifact/packer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAiB,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkB,MAAM,SAAS,CAAC;AAMjE;;;;;;GAMG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAFJ,UAAU,EAAE,iBAAiB,EAC7B,aAAa,EAAE,aAAa,EAC5B,GAAG,CAAC,EAAE,WAAW,YAAA;IAGpC;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CA+I9F"}

package/dist/dependencies/checker.d.ts

@@ -9,7 +9,7 @@ export declare const REQUIREMENTS: {
 declare function semverSatisfied(installed: string, required: string): boolean;
 /**
  * Extract version from sops output.
- * Format: "sops 3.8.1 (latest)" or "sops 3.9.4"
+ * Format: "sops 3.8.1 (latest)" or "sops 3.12.2"
  */
 declare function parseSopsVersion(stdout: string): string | null;
 /**

package/dist/index.js

@@ -17920,7 +17920,12 @@ var ArtifactPacker = class {
           ciphertext,
           envelope: {
             provider: kmsConfig.provider,
-            keyId: kmsConfig.keyId,
+            // Prefer the provider's resolved key ARN over the manifest input.
+            // The manifest may carry an alias ARN (which `kms:Encrypt` accepts
+            // and silently resolves), but downstream `kms:CreateGrant` calls
+            // reject aliases. Persisting the resolved ARN keeps the envelope
+            // valid for grant minting and stable across alias re-targeting.
+            keyId: wrapped.resolvedKeyId ?? kmsConfig.keyId,
             wrappedKey: wrapped.wrappedKey.toString("base64"),
             algorithm: wrapped.algorithm,
             iv: iv.toString("base64"),