dotsec 0.8.0 → 0.10.1-alpha.0

package/dist/esm/cli.js

@@ -1,4 +1,6 @@
 var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
 var __getOwnPropSymbols = Object.getOwnPropertySymbols;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __propIsEnum = Object.prototype.propertyIsEnumerable;
@@ -14,6 +16,7 @@ var __spreadValues = (a, b) => {
     }
   return a;
 };
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
 var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
 var __export = (target, all) => {
   __markAsModule(target);
@@ -60,8 +63,7 @@ var commonCliOptions = {
   },
   envFile: {
     string: true,
-    describe: ".env file",
-    default: ".env"
+    describe: ".env file"
   },
   ignoreMissingEnvFile: {
     boolean: true,
@@ -84,6 +86,14 @@ var commonCliOptions = {
     boolean: true,
     describe: "Be verbose"
   },
+  encryptedSecretsFile: {
+    string: true,
+    describe: "filename of json file for reading encrypted secrets"
+  },
+  jsonFilter: {
+    string: true,
+    describe: "dot separated filter path, for example a.b.c will return { a: { b: { c: ... }}}"
+  },
   yes: {
     boolean: true,
     describe: "Proceeds without confirmation"
@@ -310,11 +320,11 @@ __export(decryptSecCommand_exports, {
   desc: () => desc2,
   handler: () => handler2
 });
-import { KMSClient, DecryptCommand } from "@aws-sdk/client-kms";
-import { redBright } from "chalk";
-import { parse } from "dotenv";
 import fs from "node:fs";
 import path from "node:path";
+import { KMSClient as KMSClient2, DecryptCommand } from "@aws-sdk/client-kms";
+import { redBright } from "chalk";
+import { parse } from "dotenv";
 
 // src/utils/io.ts
 import { stat } from "fs/promises";
@@ -346,6 +356,30 @@ var promptOverwriteIfFileExists = async ({
   return overwriteResponse;
 };
 
+// src/utils/kms.ts
+import {
+  DescribeKeyCommand,
+  KMSClient
+} from "@aws-sdk/client-kms";
+var getKMSClient = ({
+  configuration
+}) => {
+  const kmsClient = new KMSClient(configuration);
+  return kmsClient;
+};
+var getEncryptionAlgorithm = async (kmsClient, awsKeyAlias) => {
+  var _a, _b;
+  const describeKeyCommand = new DescribeKeyCommand({
+    KeyId: awsKeyAlias
+  });
+  const describeKeyResult = await kmsClient.send(describeKeyCommand);
+  const encryptionAlgorithm = (_b = (_a = describeKeyResult.KeyMetadata) == null ? void 0 : _a.EncryptionAlgorithms) == null ? void 0 : _b[0];
+  if (encryptionAlgorithm === void 0) {
+    throw new Error(`Could not determine encryption algorithm`);
+  }
+  return encryptionAlgorithm;
+};
+
 // src/commands/decryptSecCommand.ts
 var command2 = "decrypt-sec";
 var desc2 = "Decrypts a dotsec file";
@@ -354,7 +388,7 @@ var builder2 = {
   "aws-region": commonCliOptions.awsRegion,
   "aws-key-alias": commonCliOptions.awsKeyAlias,
   "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
-  "env-file": commonCliOptions.envFile,
+  "env-file": __spreadProps(__spreadValues({}, commonCliOptions.envFile), { default: "env" }),
   "sec-file": commonCliOptions.secFile,
   verbose: commonCliOptions.verbose
 };
@@ -370,15 +404,16 @@ var handler2 = async (argv) => {
       return;
     }
     const parsedSec = parse(fs.readFileSync(secSource, { encoding: "utf8" }));
-    const kmsClient = new KMSClient({
+    const kmsClient = new KMSClient2({
       credentials: credentialsAndOrigin.value,
       region: regionAndOrigin.value
     });
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, argv.awsKeyAlias);
     const envEntries = await Promise.all(Object.entries(parsedSec).map(async ([key, cipherText]) => {
       const decryptCommand = new DecryptCommand({
         KeyId: argv.awsKeyAlias,
         CiphertextBlob: Buffer.from(cipherText, "base64"),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const decryptionResult = await kmsClient.send(decryptCommand);
       if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
@@ -405,22 +440,11 @@ __export(decryptSecretsJson_exports, {
   desc: () => desc3,
   handler: () => handler3
 });
-import { DecryptCommand as DecryptCommand2, DescribeKeyCommand } from "@aws-sdk/client-kms";
-import { redBright as redBright2 } from "chalk";
-import flat from "flat";
 import fs2 from "node:fs";
 import path2 from "node:path";
-
-// src/utils/kms.ts
-import { KMSClient as KMSClient2 } from "@aws-sdk/client-kms";
-var getKMSClient = ({
-  configuration
-}) => {
-  const kmsClient = new KMSClient2(configuration);
-  return kmsClient;
-};
-
-// src/commands/decryptSecretsJson.ts
+import { DecryptCommand as DecryptCommand2, DescribeKeyCommand as DescribeKeyCommand2 } from "@aws-sdk/client-kms";
+import { redBright as redBright2 } from "chalk";
+import flat from "flat";
 var command3 = "decrypt-secrets-json";
 var desc3 = "Derypts an encrypted file";
 var builder3 = {
@@ -432,11 +456,9 @@ var builder3 = {
     describe: "filename of json file writing secrets",
     default: "secrets.json"
   },
-  "encrypted-secrets-file": {
-    string: true,
-    describe: "filename of json file for reading encrypted secrets",
+  "encrypted-secrets-file": __spreadProps(__spreadValues({}, commonCliOptions.encryptedSecretsFile), {
     default: "secrets.encrypted.json"
-  },
+  }),
   "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
   verbose: commonCliOptions.verbose,
   yes: __spreadValues({}, commonCliOptions.yes)
@@ -467,17 +489,18 @@ var handler3 = async (argv) => {
     });
     if (argv.verbose) {
       info(`Encrypting using key alias ${bold(argv.awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
-      const describeKeyCommand = new DescribeKeyCommand({
+      const describeKeyCommand = new DescribeKeyCommand2({
         KeyId: argv.awsKeyAlias
       });
       const describeKeyResult = await kmsClient.send(describeKeyCommand);
       console.log("describeKeyResult", { describeKeyResult });
     }
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, argv.awsKeyAlias);
     const flatParameters = Object.fromEntries(await Promise.all(Object.entries(flatEncryptedParameters).map(async ([parameterName, encryptedParameter]) => {
       const decryptCommand = new DecryptCommand2({
         KeyId: argv.awsKeyAlias,
         CiphertextBlob: Buffer.from(encryptedParameter, "base64"),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const decryptionResult = await kmsClient.send(decryptCommand);
       if (!decryptionResult.Plaintext) {
@@ -519,12 +542,37 @@ __export(defaultCommand_exports, {
   desc: () => desc4,
   handler: () => handler4
 });
-import fs3 from "node:fs";
-import path3 from "node:path";
+import fs4 from "node:fs";
+import path4 from "node:path";
 import { KMSClient as KMSClient3, DecryptCommand as DecryptCommand3 } from "@aws-sdk/client-kms";
-import { redBright as redBright3 } from "chalk";
+import { redBright as redBright4 } from "chalk";
+import { constantCase } from "constant-case";
 import { spawn } from "cross-spawn";
 import { parse as parse2 } from "dotenv";
+import flat2 from "flat";
+
+// src/lib/encryptedSecrets.ts
+import fs3 from "fs";
+import path3 from "path";
+import { redBright as redBright3 } from "chalk";
+var loadEncryptedSecrets = async ({
+  encryptedSecretsFile
+}) => {
+  const encryptedSecretsPath = path3.resolve(process.cwd(), encryptedSecretsFile);
+  if (!await fileExists(encryptedSecretsPath)) {
+    throw new Error(`Could not open ${redBright3(encryptedSecretsPath)}`);
+  }
+  const encryptedSecrets = JSON.parse(fs3.readFileSync(encryptedSecretsPath, { encoding: "utf8" }));
+  if (!encryptedSecrets) {
+    throw new Error(`No encrypted secrets found in ${redBright3(encryptedSecretsPath)}`);
+  }
+  if (!encryptedSecrets.encryptedParameters) {
+    throw new Error(`Expected 'encryptedParameters' property, but got none`);
+  }
+  return encryptedSecrets;
+};
+
+// src/commands/defaultCommand.ts
 var command4 = "$0 <command>";
 var desc4 = "Decrypts a .sec file, injects the results into a separate process and runs a command";
 var builder4 = {
@@ -536,6 +584,8 @@ var builder4 = {
   "ignore-missing-env-file": commonCliOptions.ignoreMissingEnvFile,
   "aws-assume-role-arn": commonCliOptions.awsAssumeRoleArn,
   "aws-assume-role-session-duration": commonCliOptions.awsAssumeRoleSessionDuration,
+  "encrypted-secrets-file": commonCliOptions.encryptedSecretsFile,
+  "json-filter": commonCliOptions.jsonFilter,
   verbose: commonCliOptions.verbose,
   command: { string: true, required: true }
 };
@@ -545,21 +595,69 @@ var handleSec = async ({
   regionAndOrigin,
   awsKeyAlias
 }) => {
-  const secSource = path3.resolve(process.cwd(), secFile);
+  const secSource = path4.resolve(process.cwd(), secFile);
   if (!await fileExists(secSource)) {
-    console.error(`Could not open ${redBright3(secSource)}`);
+    console.error(`Could not open ${redBright4(secSource)}`);
     return;
   }
-  const parsedSec = parse2(fs3.readFileSync(secSource, { encoding: "utf8" }));
+  const parsedSec = parse2(fs4.readFileSync(secSource, { encoding: "utf8" }));
   const kmsClient = new KMSClient3({
     credentials: credentialsAndOrigin.value,
     region: regionAndOrigin.value
   });
+  const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, awsKeyAlias);
   const envEntries = await Promise.all(Object.entries(parsedSec).map(async ([key, cipherText]) => {
     const decryptCommand = new DecryptCommand3({
       KeyId: awsKeyAlias,
       CiphertextBlob: Buffer.from(cipherText, "base64"),
-      EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+      EncryptionAlgorithm: encryptionAlgorithm
+    });
+    const decryptionResult = await kmsClient.send(decryptCommand);
+    if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
+      throw new Error(`No: ${JSON.stringify({
+        key,
+        cipherText,
+        decryptCommand
+      })}`);
+    }
+    const value = Buffer.from(decryptionResult.Plaintext).toString();
+    return [key, value];
+  }));
+  const env = Object.fromEntries(envEntries);
+  return env;
+};
+var handleEncryptedJson = async ({
+  encryptedSecretsFile,
+  jsonFilter,
+  credentialsAndOrigin,
+  regionAndOrigin,
+  awsKeyAlias
+}) => {
+  const encryptedSecrets = await loadEncryptedSecrets({
+    encryptedSecretsFile
+  });
+  const flattened = flat2.flatten(encryptedSecrets.encryptedParameters, {
+    delimiter: "__",
+    transformKey: (key) => {
+      return constantCase(key);
+    }
+  });
+  const kmsClient = new KMSClient3({
+    credentials: credentialsAndOrigin.value,
+    region: regionAndOrigin.value
+  });
+  const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, awsKeyAlias);
+  const filterKey = jsonFilter == null ? void 0 : jsonFilter.split(".").map((part) => constantCase(part)).join("__");
+  const envEntries = await Promise.all(Object.entries(flattened).filter(([key]) => {
+    if (filterKey) {
+      return key.indexOf(filterKey) === 0;
+    }
+    return true;
+  }).map(async ([key, cipherText]) => {
+    const decryptCommand = new DecryptCommand3({
+      KeyId: awsKeyAlias,
+      CiphertextBlob: Buffer.from(cipherText, "base64"),
+      EncryptionAlgorithm: encryptionAlgorithm
     });
     const decryptionResult = await kmsClient.send(decryptCommand);
     if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
@@ -578,38 +676,60 @@ var handleSec = async ({
 var handler4 = async (argv) => {
   try {
     let env;
+    let awsEnv;
     try {
       if (argv.envFile) {
-        env = parse2(fs3.readFileSync(argv.envFile, { encoding: "utf8" }));
+        env = parse2(fs4.readFileSync(argv.envFile, { encoding: "utf8" }));
+        if (argv.awsAssumeRoleArn || process.env.AWS_ASSUME_ROLE_ARN || (env == null ? void 0 : env.AWS_ASSUME_ROLE_ARN)) {
+          const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
+            argv: __spreadValues({}, argv),
+            env: __spreadValues(__spreadValues({}, process.env), env)
+          });
+          awsEnv = {
+            AWS_ACCESS_KEY_ID: credentialsAndOrigin.value.accessKeyId,
+            AWS_SECRET_ACCESS_KEY: credentialsAndOrigin.value.secretAccessKey
+          };
+          if (credentialsAndOrigin.value.sessionToken) {
+            awsEnv.AWS_SESSION_TOKEN = credentialsAndOrigin.value.sessionToken;
+          }
+        }
+      } else {
+        const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
+          argv: __spreadValues({}, argv),
+          env: __spreadValues(__spreadValues({}, process.env), env)
+        });
+        if ((argv.awsAssumeRoleArn || process.env.AWS_ASSUME_ROLE_ARN || (env == null ? void 0 : env.AWS_ASSUME_ROLE_ARN)) && credentialsAndOrigin.value.sessionToken !== void 0) {
+          awsEnv = {
+            AWS_ACCESS_KEY_ID: credentialsAndOrigin.value.accessKeyId,
+            AWS_SECRET_ACCESS_KEY: credentialsAndOrigin.value.secretAccessKey,
+            AWS_SESSION_TOKEN: credentialsAndOrigin.value.sessionToken
+          };
+        }
+        if (argv.verbose) {
+          console.log({ credentialsAndOrigin, regionAndOrigin });
+        }
+        if (argv.encryptedSecretsFile) {
+          env = await handleEncryptedJson({
+            encryptedSecretsFile: argv.encryptedSecretsFile,
+            jsonFilter: argv.jsonFilter,
+            credentialsAndOrigin,
+            regionAndOrigin,
+            awsKeyAlias: argv.awsKeyAlias
+          });
+        } else {
+          env = await handleSec({
+            secFile: argv.secFile,
+            credentialsAndOrigin,
+            regionAndOrigin,
+            awsKeyAlias: argv.awsKeyAlias
+          });
+        }
       }
     } catch (e) {
       if (argv.ignoreMissingEnvFile !== true) {
         throw e;
       }
     }
-    let awsEnv;
-    const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
-      argv: __spreadValues({}, argv),
-      env: __spreadValues(__spreadValues({}, process.env), env)
-    });
-    if ((argv.awsAssumeRoleArn || process.env.AWS_ASSUME_ROLE_ARN || (env == null ? void 0 : env.AWS_ASSUME_ROLE_ARN)) && credentialsAndOrigin.value.sessionToken !== void 0) {
-      awsEnv = {
-        AWS_ACCESS_KEY_ID: credentialsAndOrigin.value.accessKeyId,
-        AWS_SECRET_ACCESS_KEY: credentialsAndOrigin.value.secretAccessKey,
-        AWS_SESSION_TOKEN: credentialsAndOrigin.value.sessionToken
-      };
-    }
-    if (argv.verbose) {
-      console.log({ credentialsAndOrigin, regionAndOrigin });
-    }
-    if (!argv.envFile && argv.secFile) {
-      env = await handleSec({
-        secFile: argv.secFile,
-        credentialsAndOrigin,
-        regionAndOrigin,
-        awsKeyAlias: argv.awsKeyAlias
-      });
-    }
     const userCommandArgs = process.argv.slice(process.argv.indexOf(argv.command) + 1);
     if (argv.command) {
       spawn(argv.command, [...userCommandArgs], {
@@ -631,18 +751,18 @@ __export(encryptEnvCommand_exports, {
   desc: () => desc5,
   handler: () => handler5
 });
-import { DescribeKeyCommand as DescribeKeyCommand2, EncryptCommand } from "@aws-sdk/client-kms";
-import { redBright as redBright4 } from "chalk";
+import fs5 from "node:fs";
+import path5 from "node:path";
+import { DescribeKeyCommand as DescribeKeyCommand3, EncryptCommand } from "@aws-sdk/client-kms";
+import { redBright as redBright5 } from "chalk";
 import { parse as parse3 } from "dotenv";
-import fs4 from "node:fs";
-import path4 from "node:path";
 var command5 = "encrypt-env";
 var desc5 = "Encrypts a dotenv file";
 var builder5 = {
   "aws-profile": commonCliOptions.awsProfile,
   "aws-region": commonCliOptions.awsRegion,
   "aws-key-alias": commonCliOptions.awsKeyAlias,
-  "env-file": commonCliOptions.envFile,
+  "env-file": __spreadProps(__spreadValues({}, commonCliOptions.envFile), { default: ".env" }),
   "sec-file": commonCliOptions.secFile,
   "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
   verbose: commonCliOptions.verbose
@@ -654,12 +774,12 @@ var handler5 = async (argv) => {
       argv: __spreadValues({}, argv),
       env: __spreadValues({}, process.env)
     });
-    const envSource = path4.resolve(process.cwd(), argv.envFile);
+    const envSource = path5.resolve(process.cwd(), argv.envFile);
     if (!await fileExists(envSource)) {
-      error(`Could not open ${redBright4(envSource)}`);
+      error(`Could not open ${redBright5(envSource)}`);
       return;
     }
-    const parsedEnv = parse3(fs4.readFileSync(envSource, { encoding: "utf8" }));
+    const parsedEnv = parse3(fs5.readFileSync(envSource, { encoding: "utf8" }));
     const kmsClient = getKMSClient({
       configuration: {
         credentials: credentialsAndOrigin.value,
@@ -667,9 +787,10 @@ var handler5 = async (argv) => {
       },
       verbose: argv.verbose
     });
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, argv.awsKeyAlias);
     if (argv.verbose) {
       info(`Encrypting using key alias ${bold(argv.awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
-      const describeKeyCommand = new DescribeKeyCommand2({
+      const describeKeyCommand = new DescribeKeyCommand3({
         KeyId: argv.awsKeyAlias
       });
       const describeKeyResult = await kmsClient.send(describeKeyCommand);
@@ -679,7 +800,7 @@ var handler5 = async (argv) => {
       const encryptCommand = new EncryptCommand({
         KeyId: argv.awsKeyAlias,
         Plaintext: Buffer.from(value),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const encryptionResult = await kmsClient.send(encryptCommand);
       if (!encryptionResult.CiphertextBlob) {
@@ -695,7 +816,7 @@ var handler5 = async (argv) => {
       const cipherText = Buffer.from(encryptionResult.CiphertextBlob).toString("base64");
       return `${key}="${cipherText}"`;
     }))).join("\n");
-    fs4.writeFileSync(path4.resolve(process.cwd(), argv.secFile), sec);
+    fs5.writeFileSync(path5.resolve(process.cwd(), argv.secFile), sec);
   } catch (e) {
     error(e);
   }
@@ -709,11 +830,11 @@ __export(encryptSecretsJson_exports, {
   desc: () => desc6,
   handler: () => handler6
 });
-import fs5 from "node:fs";
-import path5 from "node:path";
-import { DescribeKeyCommand as DescribeKeyCommand3, EncryptCommand as EncryptCommand2 } from "@aws-sdk/client-kms";
-import { redBright as redBright5 } from "chalk";
-import flat2 from "flat";
+import fs6 from "node:fs";
+import path6 from "node:path";
+import { DescribeKeyCommand as DescribeKeyCommand4, EncryptCommand as EncryptCommand2 } from "@aws-sdk/client-kms";
+import { redBright as redBright6 } from "chalk";
+import flat3 from "flat";
 var command6 = "encrypt-secrets-json";
 var desc6 = "Encrypts an unencrypted file";
 var builder6 = {
@@ -741,16 +862,16 @@ var handler6 = async (argv) => {
       argv: __spreadValues({}, argv),
       env: __spreadValues({}, process.env)
     });
-    const secretsPath = path5.resolve(process.cwd(), argv.secretsFile);
+    const secretsPath = path6.resolve(process.cwd(), argv.secretsFile);
     if (!await fileExists(secretsPath)) {
-      error(`Could not open ${redBright5(secretsPath)}`);
+      error(`Could not open ${redBright6(secretsPath)}`);
       return;
     }
-    const secrets = JSON.parse(fs5.readFileSync(secretsPath, { encoding: "utf8" }));
+    const secrets = JSON.parse(fs6.readFileSync(secretsPath, { encoding: "utf8" }));
     if (!secrets.parameters) {
       throw new Error(`Expected 'parameters' property, but got none`);
     }
-    const flatParameters = flat2(secrets.parameters, { delimiter: "/" });
+    const flatParameters = flat3(secrets.parameters, { delimiter: "/" });
     if (argv.verbose) {
       console.log(flatParameters);
     }
@@ -763,17 +884,18 @@ var handler6 = async (argv) => {
     });
     if (argv.verbose) {
       info(`Encrypting using key alias ${bold(argv.awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
-      const describeKeyCommand = new DescribeKeyCommand3({
+      const describeKeyCommand = new DescribeKeyCommand4({
         KeyId: argv.awsKeyAlias
       });
       const describeKeyResult = await kmsClient.send(describeKeyCommand);
       console.log("describeKeyResult", { describeKeyResult });
     }
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, argv.awsKeyAlias);
     const encryptedFlatParameters = Object.fromEntries(await Promise.all(Object.entries(flatParameters).map(async ([parameterName, parameter]) => {
       const encryptCommand = new EncryptCommand2({
         KeyId: argv.awsKeyAlias,
         Plaintext: Buffer.from(parameter),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const encryptionResult = await kmsClient.send(encryptCommand);
       if (!encryptionResult.CiphertextBlob) {
@@ -789,18 +911,18 @@ var handler6 = async (argv) => {
       const cipherText = Buffer.from(encryptionResult.CiphertextBlob).toString("base64");
       return [parameterName, cipherText];
     })));
-    const encryptedParameters = flat2.unflatten(encryptedFlatParameters, { delimiter: "/" });
+    const encryptedParameters = flat3.unflatten(encryptedFlatParameters, { delimiter: "/" });
     const encryptedSecrets = {
       config: secrets.config,
       encryptedParameters
     };
-    const encryptedSecretsPath = path5.resolve(process.cwd(), argv.encryptedSecretsFile);
+    const encryptedSecretsPath = path6.resolve(process.cwd(), argv.encryptedSecretsFile);
     const overwriteResponse = await promptOverwriteIfFileExists({
       filePath: encryptedSecretsPath,
       skip: argv.yes
     });
     if (overwriteResponse === void 0 || overwriteResponse.overwrite === true) {
-      fs5.writeFileSync(encryptedSecretsPath, JSON.stringify(encryptedSecrets, null, 4));
+      fs6.writeFileSync(encryptedSecretsPath, JSON.stringify(encryptedSecrets, null, 4));
     }
   } catch (e) {
     error(e);
@@ -815,12 +937,12 @@ __export(offloadToSSMCommand_exports, {
   desc: () => desc7,
   handler: () => handler7
 });
-import { DecryptCommand as DecryptCommand4, DescribeKeyCommand as DescribeKeyCommand4 } from "@aws-sdk/client-kms";
+import fs7 from "node:fs";
+import path7 from "node:path";
+import { DecryptCommand as DecryptCommand4 } from "@aws-sdk/client-kms";
 import { PutParameterCommand } from "@aws-sdk/client-ssm";
-import { redBright as redBright6 } from "chalk";
-import flat3 from "flat";
-import fs6 from "node:fs";
-import path6 from "node:path";
+import { redBright as redBright7 } from "chalk";
+import flat4 from "flat";
 var command7 = "offload-secrets-json-to-ssm";
 var desc7 = "Sends decrypted values of secrets.encrypted.json file to SSM parameter store";
 var builder7 = {
@@ -843,16 +965,16 @@ var handler7 = async (argv) => {
       argv: __spreadValues({}, argv),
       env: __spreadValues({}, process.env)
     });
-    const encryptedSecretsPath = path6.resolve(process.cwd(), argv.encryptedSecretsFile);
+    const encryptedSecretsPath = path7.resolve(process.cwd(), argv.encryptedSecretsFile);
     if (!await fileExists(encryptedSecretsPath)) {
-      error(`Could not open ${redBright6(encryptedSecretsPath)}`);
+      error(`Could not open ${redBright7(encryptedSecretsPath)}`);
       return;
     }
-    const encryptedSecrets = JSON.parse(fs6.readFileSync(encryptedSecretsPath, { encoding: "utf8" }));
+    const encryptedSecrets = JSON.parse(fs7.readFileSync(encryptedSecretsPath, { encoding: "utf8" }));
     if (!encryptedSecrets.encryptedParameters) {
       throw new Error(`Expected 'encryptedParameters' property, but got none`);
     }
-    const flatEncryptedParameters = flat3(encryptedSecrets.encryptedParameters, { delimiter: "/" });
+    const flatEncryptedParameters = flat4(encryptedSecrets.encryptedParameters, { delimiter: "/" });
     const kmsClient = getKMSClient({
       configuration: {
         credentials: credentialsAndOrigin.value,
@@ -862,17 +984,13 @@ var handler7 = async (argv) => {
     });
     if (argv.verbose) {
       info(`Encrypting using key alias ${bold(argv.awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
-      const describeKeyCommand = new DescribeKeyCommand4({
-        KeyId: argv.awsKeyAlias
-      });
-      const describeKeyResult = await kmsClient.send(describeKeyCommand);
-      console.log("describeKeyResult", { describeKeyResult });
     }
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, argv.awsKeyAlias);
     const flatParameters = Object.fromEntries(await Promise.all(Object.entries(flatEncryptedParameters).map(async ([parameterName, encryptedParameter]) => {
       const decryptCommand = new DecryptCommand4({
         KeyId: argv.awsKeyAlias,
         CiphertextBlob: Buffer.from(encryptedParameter, "base64"),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const decryptionResult = await kmsClient.send(decryptCommand);
       if (!decryptionResult.Plaintext) {