dotsec 0.9.0 → 0.10.1-alpha.1

package/dist/cli.js

@@ -1,6 +1,8 @@
 var __create = Object.create;
 var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getOwnPropSymbols = Object.getOwnPropertySymbols;
 var __getProtoOf = Object.getPrototypeOf;
@@ -18,6 +20,7 @@ var __spreadValues = (a, b) => {
     }
   return a;
 };
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
 var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
 var __export = (target, all) => {
   __markAsModule(target);
@@ -62,7 +65,6 @@ var commonCliOptions = {
   },
   awsKeyAlias: {
     string: true,
-    default: "alias/top-secret",
     describe: "AWS KMS key alias"
   },
   awsKeyArn: {
@@ -75,8 +77,7 @@ var commonCliOptions = {
   },
   envFile: {
     string: true,
-    describe: ".env file",
-    default: ".env"
+    describe: ".env file"
   },
   ignoreMissingEnvFile: {
     boolean: true,
@@ -99,6 +100,14 @@ var commonCliOptions = {
     boolean: true,
     describe: "Be verbose"
   },
+  encryptedSecretsFile: {
+    string: true,
+    describe: "filename of json file for reading encrypted secrets"
+  },
+  jsonFilter: {
+    string: true,
+    describe: "dot separated filter path, for example a.b.c will return { a: { b: { c: ... }}}"
+  },
   yes: {
     boolean: true,
     describe: "Proceeds without confirmation"
@@ -321,11 +330,11 @@ __export(decryptSecCommand_exports, {
   desc: () => desc2,
   handler: () => handler2
 });
-var import_client_kms = __toModule(require("@aws-sdk/client-kms"));
-var import_chalk2 = __toModule(require("chalk"));
-var import_dotenv = __toModule(require("dotenv"));
 var import_node_fs = __toModule(require("node:fs"));
 var import_node_path = __toModule(require("node:path"));
+var import_client_kms2 = __toModule(require("@aws-sdk/client-kms"));
+var import_chalk2 = __toModule(require("chalk"));
+var import_dotenv = __toModule(require("dotenv"));
 
 // src/utils/io.ts
 var import_promises = __toModule(require("fs/promises"));
@@ -357,6 +366,27 @@ var promptOverwriteIfFileExists = async ({
   return overwriteResponse;
 };
 
+// src/utils/kms.ts
+var import_client_kms = __toModule(require("@aws-sdk/client-kms"));
+var getKMSClient = ({
+  configuration
+}) => {
+  const kmsClient = new import_client_kms.KMSClient(configuration);
+  return kmsClient;
+};
+var getEncryptionAlgorithm = async (kmsClient, awsKeyAlias) => {
+  var _a, _b;
+  const describeKeyCommand = new import_client_kms.DescribeKeyCommand({
+    KeyId: awsKeyAlias
+  });
+  const describeKeyResult = await kmsClient.send(describeKeyCommand);
+  const encryptionAlgorithm = (_b = (_a = describeKeyResult.KeyMetadata) == null ? void 0 : _a.EncryptionAlgorithms) == null ? void 0 : _b[0];
+  if (encryptionAlgorithm === void 0) {
+    throw new Error(`Could not determine encryption algorithm`);
+  }
+  return encryptionAlgorithm;
+};
+
 // src/commands/decryptSecCommand.ts
 var command2 = "decrypt-sec";
 var desc2 = "Decrypts a dotsec file";
@@ -365,7 +395,7 @@ var builder2 = {
   "aws-region": commonCliOptions.awsRegion,
   "aws-key-alias": commonCliOptions.awsKeyAlias,
   "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
-  "env-file": commonCliOptions.envFile,
+  "env-file": __spreadProps(__spreadValues({}, commonCliOptions.envFile), { default: "env" }),
   "sec-file": commonCliOptions.secFile,
   verbose: commonCliOptions.verbose
 };
@@ -381,15 +411,16 @@ var handler2 = async (argv) => {
       return;
     }
     const parsedSec = (0, import_dotenv.parse)(import_node_fs.default.readFileSync(secSource, { encoding: "utf8" }));
-    const kmsClient = new import_client_kms.KMSClient({
+    const kmsClient = new import_client_kms2.KMSClient({
       credentials: credentialsAndOrigin.value,
       region: regionAndOrigin.value
     });
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, argv.awsKeyAlias);
     const envEntries = await Promise.all(Object.entries(parsedSec).map(async ([key, cipherText]) => {
-      const decryptCommand = new import_client_kms.DecryptCommand({
+      const decryptCommand = new import_client_kms2.DecryptCommand({
         KeyId: argv.awsKeyAlias,
         CiphertextBlob: Buffer.from(cipherText, "base64"),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const decryptionResult = await kmsClient.send(decryptCommand);
       if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
@@ -416,50 +447,112 @@ __export(decryptSecretsJson_exports, {
   desc: () => desc3,
   handler: () => handler3
 });
+var import_node_fs2 = __toModule(require("node:fs"));
+var import_node_path3 = __toModule(require("node:path"));
 var import_client_kms3 = __toModule(require("@aws-sdk/client-kms"));
 var import_chalk3 = __toModule(require("chalk"));
 var import_flat = __toModule(require("flat"));
-var import_node_fs2 = __toModule(require("node:fs"));
-var import_node_path2 = __toModule(require("node:path"));
 
-// src/utils/kms.ts
-var import_client_kms2 = __toModule(require("@aws-sdk/client-kms"));
-var getKMSClient = ({
-  configuration
-}) => {
-  const kmsClient = new import_client_kms2.KMSClient(configuration);
-  return kmsClient;
+// src/lib/config.ts
+var import_fs = __toModule(require("fs"));
+var import_node_path2 = __toModule(require("node:path"));
+var import_bundle_require = __toModule(require("bundle-require"));
+var import_joycon = __toModule(require("joycon"));
+var defaultConfig = {
+  aws: {
+    keyAlias: "alias/top-secret"
+  }
+};
+function jsoncParse(data) {
+  try {
+    return new Function("return " + data.trim())();
+  } catch {
+    return {};
+  }
+}
+var loadJson = async (filepath) => {
+  try {
+    return jsoncParse(await import_fs.default.promises.readFile(filepath, "utf8"));
+  } catch (error) {
+    if (error instanceof Error) {
+      throw new Error(`Failed to parse ${import_node_path2.default.relative(process.cwd(), filepath)}: ${error.message}`);
+    } else {
+      throw error;
+    }
+  }
+};
+var getConfig = async () => {
+  const cwd = process.cwd();
+  const configJoycon = new import_joycon.default();
+  const configPath = await configJoycon.resolve({
+    files: [
+      "dotsec.config.ts",
+      "dotsec.config.js",
+      "dotsec.config.cjs",
+      "dotsec.config.mjs",
+      "dotsec.config.json",
+      "package.json"
+    ],
+    cwd,
+    stopDir: import_node_path2.default.parse(cwd).root,
+    packageKey: "dotsec"
+  });
+  if (configPath) {
+    if (configPath.endsWith(".json")) {
+      const rawData = await loadJson(configPath);
+      let data;
+      if (configPath.endsWith("package.json") && rawData.dotsec !== void 0) {
+        data = rawData.dotsec;
+      } else {
+        data = rawData;
+      }
+      return __spreadProps(__spreadValues(__spreadValues({}, defaultConfig), data), {
+        aws: __spreadValues(__spreadValues({}, defaultConfig.aws), data.aws)
+      });
+    }
+    const config = await (0, import_bundle_require.bundleRequire)({
+      filepath: configPath
+    });
+    const retrievedConfig = config.mod.dotsec || config.mod.default || config.mod;
+    return __spreadValues(__spreadValues({}, defaultConfig), retrievedConfig);
+  }
+  return __spreadValues({}, defaultConfig);
 };
 
 // src/commands/decryptSecretsJson.ts
 var command3 = "decrypt-secrets-json";
 var desc3 = "Derypts an encrypted file";
 var builder3 = {
-  "aws-profile": commonCliOptions.awsProfile,
-  "aws-region": commonCliOptions.awsRegion,
-  "aws-key-alias": commonCliOptions.awsKeyAlias,
   "secrets-file": {
     string: true,
     describe: "filename of json file writing secrets",
     default: "secrets.json"
   },
-  "encrypted-secrets-file": {
-    string: true,
-    describe: "filename of json file for reading encrypted secrets",
+  "encrypted-secrets-file": __spreadProps(__spreadValues({}, commonCliOptions.encryptedSecretsFile), {
     default: "secrets.encrypted.json"
-  },
-  "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
+  }),
+  "aws-profile": commonCliOptions.awsProfile,
+  "aws-region": commonCliOptions.awsRegion,
+  "aws-key-alias": commonCliOptions.awsKeyAlias,
+  "aws-assume-role-arn": commonCliOptions.awsAssumeRoleArn,
+  "aws-assume-role-session-duration": commonCliOptions.awsAssumeRoleSessionDuration,
   verbose: commonCliOptions.verbose,
   yes: __spreadValues({}, commonCliOptions.yes)
 };
 var handler3 = async (argv) => {
   const { info, error } = getLogger();
+  const config = await getConfig();
   try {
     const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
-      argv: __spreadValues({}, argv),
+      argv: __spreadProps(__spreadValues({}, argv), {
+        awsRegion: config.aws.region || argv.awsRegion,
+        awsProfile: config.aws.profile || argv.awsProfile,
+        awsAssumeRoleArn: config.aws.assumeRoleArn || argv.awsAssumeRoleArn,
+        awsAssumeRoleSessionDuration: config.aws.assumeRoleSessionDuration || argv.awsAssumeRoleSessionDuration
+      }),
       env: __spreadValues({}, process.env)
     });
-    const encryptedSecretsPath = import_node_path2.default.resolve(process.cwd(), argv.encryptedSecretsFile);
+    const encryptedSecretsPath = import_node_path3.default.resolve(process.cwd(), argv.encryptedSecretsFile);
     if (!await fileExists(encryptedSecretsPath)) {
       error(`Could not open ${(0, import_chalk3.redBright)(encryptedSecretsPath)}`);
       return;
@@ -476,19 +569,21 @@ var handler3 = async (argv) => {
       },
       verbose: argv.verbose
     });
+    const awsKeyAlias = argv.awsKeyAlias || config.aws.keyAlias;
     if (argv.verbose) {
-      info(`Encrypting using key alias ${bold(argv.awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
+      info(`Encrypting using key alias ${bold(awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
       const describeKeyCommand = new import_client_kms3.DescribeKeyCommand({
-        KeyId: argv.awsKeyAlias
+        KeyId: awsKeyAlias
       });
       const describeKeyResult = await kmsClient.send(describeKeyCommand);
-      console.log("describeKeyResult", { describeKeyResult });
+      info("keyMetaData", __spreadValues({}, describeKeyResult.KeyMetadata));
     }
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, awsKeyAlias);
     const flatParameters = Object.fromEntries(await Promise.all(Object.entries(flatEncryptedParameters).map(async ([parameterName, encryptedParameter]) => {
       const decryptCommand = new import_client_kms3.DecryptCommand({
         KeyId: argv.awsKeyAlias,
         CiphertextBlob: Buffer.from(encryptedParameter, "base64"),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const decryptionResult = await kmsClient.send(decryptCommand);
       if (!decryptionResult.Plaintext) {
@@ -501,6 +596,13 @@ var handler3 = async (argv) => {
       if (argv.verbose) {
         info(`Encrypting key ${bold(parameterName)} ${underline("ok")}`);
       }
+      const plaintext = Buffer.from(decryptionResult.Plaintext).toString();
+      try {
+        const jsonObject = JSON.parse(plaintext);
+        return [parameterName, jsonObject];
+      } catch (e) {
+        console.log("NOPES", plaintext);
+      }
       const value = Buffer.from(decryptionResult.Plaintext).toString();
       return [parameterName, value];
     })));
@@ -509,7 +611,7 @@ var handler3 = async (argv) => {
       config: encryptedSecrets.config,
       parameters
     };
-    const secretsPath = import_node_path2.default.resolve(process.cwd(), argv.secretsFile);
+    const secretsPath = import_node_path3.default.resolve(process.cwd(), argv.secretsFile);
     const overwriteResponse = await promptOverwriteIfFileExists({
       filePath: secretsPath,
       skip: argv.yes
@@ -531,11 +633,36 @@ __export(defaultCommand_exports, {
   handler: () => handler4
 });
 var import_node_fs3 = __toModule(require("node:fs"));
-var import_node_path3 = __toModule(require("node:path"));
+var import_node_path4 = __toModule(require("node:path"));
 var import_client_kms4 = __toModule(require("@aws-sdk/client-kms"));
-var import_chalk4 = __toModule(require("chalk"));
+var import_chalk5 = __toModule(require("chalk"));
+var import_constant_case = __toModule(require("constant-case"));
 var import_cross_spawn = __toModule(require("cross-spawn"));
 var import_dotenv2 = __toModule(require("dotenv"));
+var import_flat2 = __toModule(require("flat"));
+
+// src/lib/encryptedSecrets.ts
+var import_fs2 = __toModule(require("fs"));
+var import_path = __toModule(require("path"));
+var import_chalk4 = __toModule(require("chalk"));
+var loadEncryptedSecrets = async ({
+  encryptedSecretsFile
+}) => {
+  const encryptedSecretsPath = import_path.default.resolve(process.cwd(), encryptedSecretsFile);
+  if (!await fileExists(encryptedSecretsPath)) {
+    throw new Error(`Could not open ${(0, import_chalk4.redBright)(encryptedSecretsPath)}`);
+  }
+  const encryptedSecrets = JSON.parse(import_fs2.default.readFileSync(encryptedSecretsPath, { encoding: "utf8" }));
+  if (!encryptedSecrets) {
+    throw new Error(`No encrypted secrets found in ${(0, import_chalk4.redBright)(encryptedSecretsPath)}`);
+  }
+  if (!encryptedSecrets.encryptedParameters) {
+    throw new Error(`Expected 'encryptedParameters' property, but got none`);
+  }
+  return encryptedSecrets;
+};
+
+// src/commands/defaultCommand.ts
 var command4 = "$0 <command>";
 var desc4 = "Decrypts a .sec file, injects the results into a separate process and runs a command";
 var builder4 = {
@@ -547,6 +674,8 @@ var builder4 = {
   "ignore-missing-env-file": commonCliOptions.ignoreMissingEnvFile,
   "aws-assume-role-arn": commonCliOptions.awsAssumeRoleArn,
   "aws-assume-role-session-duration": commonCliOptions.awsAssumeRoleSessionDuration,
+  "encrypted-secrets-file": commonCliOptions.encryptedSecretsFile,
+  "json-filter": commonCliOptions.jsonFilter,
   verbose: commonCliOptions.verbose,
   command: { string: true, required: true }
 };
@@ -556,9 +685,9 @@ var handleSec = async ({
   regionAndOrigin,
   awsKeyAlias
 }) => {
-  const secSource = import_node_path3.default.resolve(process.cwd(), secFile);
+  const secSource = import_node_path4.default.resolve(process.cwd(), secFile);
   if (!await fileExists(secSource)) {
-    console.error(`Could not open ${(0, import_chalk4.redBright)(secSource)}`);
+    console.error(`Could not open ${(0, import_chalk5.redBright)(secSource)}`);
     return;
   }
   const parsedSec = (0, import_dotenv2.parse)(import_node_fs3.default.readFileSync(secSource, { encoding: "utf8" }));
@@ -566,11 +695,59 @@ var handleSec = async ({
     credentials: credentialsAndOrigin.value,
     region: regionAndOrigin.value
   });
+  const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, awsKeyAlias);
   const envEntries = await Promise.all(Object.entries(parsedSec).map(async ([key, cipherText]) => {
     const decryptCommand = new import_client_kms4.DecryptCommand({
       KeyId: awsKeyAlias,
       CiphertextBlob: Buffer.from(cipherText, "base64"),
-      EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+      EncryptionAlgorithm: encryptionAlgorithm
+    });
+    const decryptionResult = await kmsClient.send(decryptCommand);
+    if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
+      throw new Error(`No: ${JSON.stringify({
+        key,
+        cipherText,
+        decryptCommand
+      })}`);
+    }
+    const value = Buffer.from(decryptionResult.Plaintext).toString();
+    return [key, value];
+  }));
+  const env = Object.fromEntries(envEntries);
+  return env;
+};
+var handleEncryptedJson = async ({
+  encryptedSecretsFile,
+  jsonFilter,
+  credentialsAndOrigin,
+  regionAndOrigin,
+  awsKeyAlias
+}) => {
+  const encryptedSecrets = await loadEncryptedSecrets({
+    encryptedSecretsFile
+  });
+  const flattened = import_flat2.default.flatten(encryptedSecrets.encryptedParameters, {
+    delimiter: "__",
+    transformKey: (key) => {
+      return (0, import_constant_case.constantCase)(key);
+    }
+  });
+  const kmsClient = new import_client_kms4.KMSClient({
+    credentials: credentialsAndOrigin.value,
+    region: regionAndOrigin.value
+  });
+  const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, awsKeyAlias);
+  const filterKey = jsonFilter == null ? void 0 : jsonFilter.split(".").map((part) => (0, import_constant_case.constantCase)(part)).join("__");
+  const envEntries = await Promise.all(Object.entries(flattened).filter(([key]) => {
+    if (filterKey) {
+      return key.indexOf(filterKey) === 0;
+    }
+    return true;
+  }).map(async ([key, cipherText]) => {
+    const decryptCommand = new import_client_kms4.DecryptCommand({
+      KeyId: awsKeyAlias,
+      CiphertextBlob: Buffer.from(cipherText, "base64"),
+      EncryptionAlgorithm: encryptionAlgorithm
     });
     const decryptionResult = await kmsClient.send(decryptCommand);
     if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
@@ -587,16 +764,40 @@ var handleSec = async ({
   return env;
 };
 var handler4 = async (argv) => {
+  const config = await getConfig();
   try {
     let env;
     let awsEnv;
     try {
       if (argv.envFile) {
         env = (0, import_dotenv2.parse)(import_node_fs3.default.readFileSync(argv.envFile, { encoding: "utf8" }));
+        if (argv.awsAssumeRoleArn || process.env.AWS_ASSUME_ROLE_ARN || (env == null ? void 0 : env.AWS_ASSUME_ROLE_ARN)) {
+          const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
+            argv: __spreadProps(__spreadValues({}, argv), {
+              awsRegion: config.aws.region || argv.awsRegion,
+              awsProfile: config.aws.profile || argv.awsProfile,
+              awsAssumeRoleArn: config.aws.assumeRoleArn || argv.awsAssumeRoleArn,
+              awsAssumeRoleSessionDuration: config.aws.assumeRoleSessionDuration || argv.awsAssumeRoleSessionDuration
+            }),
+            env: __spreadValues({}, process.env)
+          });
+          awsEnv = {
+            AWS_ACCESS_KEY_ID: credentialsAndOrigin.value.accessKeyId,
+            AWS_SECRET_ACCESS_KEY: credentialsAndOrigin.value.secretAccessKey
+          };
+          if (credentialsAndOrigin.value.sessionToken) {
+            awsEnv.AWS_SESSION_TOKEN = credentialsAndOrigin.value.sessionToken;
+          }
+        }
       } else {
         const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
-          argv: __spreadValues({}, argv),
-          env: __spreadValues(__spreadValues({}, process.env), env)
+          argv: __spreadProps(__spreadValues({}, argv), {
+            awsRegion: config.aws.region || argv.awsRegion,
+            awsProfile: config.aws.profile || argv.awsProfile,
+            awsAssumeRoleArn: config.aws.assumeRoleArn || argv.awsAssumeRoleArn,
+            awsAssumeRoleSessionDuration: config.aws.assumeRoleSessionDuration || argv.awsAssumeRoleSessionDuration
+          }),
+          env: __spreadValues({}, process.env)
         });
         if ((argv.awsAssumeRoleArn || process.env.AWS_ASSUME_ROLE_ARN || (env == null ? void 0 : env.AWS_ASSUME_ROLE_ARN)) && credentialsAndOrigin.value.sessionToken !== void 0) {
           awsEnv = {
@@ -608,12 +809,23 @@ var handler4 = async (argv) => {
         if (argv.verbose) {
           console.log({ credentialsAndOrigin, regionAndOrigin });
         }
-        env = await handleSec({
-          secFile: argv.secFile,
-          credentialsAndOrigin,
-          regionAndOrigin,
-          awsKeyAlias: argv.awsKeyAlias
-        });
+        const awsKeyAlias = argv.awsKeyAlias || config.aws.keyAlias;
+        if (argv.encryptedSecretsFile) {
+          env = await handleEncryptedJson({
+            encryptedSecretsFile: argv.encryptedSecretsFile,
+            jsonFilter: argv.jsonFilter,
+            credentialsAndOrigin,
+            regionAndOrigin,
+            awsKeyAlias
+          });
+        } else {
+          env = await handleSec({
+            secFile: argv.secFile,
+            credentialsAndOrigin,
+            regionAndOrigin,
+            awsKeyAlias
+          });
+        }
       }
     } catch (e) {
       if (argv.ignoreMissingEnvFile !== true) {
@@ -641,18 +853,18 @@ __export(encryptEnvCommand_exports, {
   desc: () => desc5,
   handler: () => handler5
 });
+var import_node_fs4 = __toModule(require("node:fs"));
+var import_node_path5 = __toModule(require("node:path"));
 var import_client_kms5 = __toModule(require("@aws-sdk/client-kms"));
-var import_chalk5 = __toModule(require("chalk"));
+var import_chalk6 = __toModule(require("chalk"));
 var import_dotenv3 = __toModule(require("dotenv"));
-var import_node_fs4 = __toModule(require("node:fs"));
-var import_node_path4 = __toModule(require("node:path"));
 var command5 = "encrypt-env";
 var desc5 = "Encrypts a dotenv file";
 var builder5 = {
   "aws-profile": commonCliOptions.awsProfile,
   "aws-region": commonCliOptions.awsRegion,
   "aws-key-alias": commonCliOptions.awsKeyAlias,
-  "env-file": commonCliOptions.envFile,
+  "env-file": __spreadProps(__spreadValues({}, commonCliOptions.envFile), { default: ".env" }),
   "sec-file": commonCliOptions.secFile,
   "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
   verbose: commonCliOptions.verbose
@@ -664,9 +876,9 @@ var handler5 = async (argv) => {
       argv: __spreadValues({}, argv),
       env: __spreadValues({}, process.env)
     });
-    const envSource = import_node_path4.default.resolve(process.cwd(), argv.envFile);
+    const envSource = import_node_path5.default.resolve(process.cwd(), argv.envFile);
     if (!await fileExists(envSource)) {
-      error(`Could not open ${(0, import_chalk5.redBright)(envSource)}`);
+      error(`Could not open ${(0, import_chalk6.redBright)(envSource)}`);
       return;
     }
     const parsedEnv = (0, import_dotenv3.parse)(import_node_fs4.default.readFileSync(envSource, { encoding: "utf8" }));
@@ -677,6 +889,7 @@ var handler5 = async (argv) => {
       },
       verbose: argv.verbose
     });
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, argv.awsKeyAlias);
     if (argv.verbose) {
       info(`Encrypting using key alias ${bold(argv.awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
       const describeKeyCommand = new import_client_kms5.DescribeKeyCommand({
@@ -689,7 +902,7 @@ var handler5 = async (argv) => {
       const encryptCommand = new import_client_kms5.EncryptCommand({
         KeyId: argv.awsKeyAlias,
         Plaintext: Buffer.from(value),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const encryptionResult = await kmsClient.send(encryptCommand);
       if (!encryptionResult.CiphertextBlob) {
@@ -705,7 +918,7 @@ var handler5 = async (argv) => {
       const cipherText = Buffer.from(encryptionResult.CiphertextBlob).toString("base64");
       return `${key}="${cipherText}"`;
     }))).join("\n");
-    import_node_fs4.default.writeFileSync(import_node_path4.default.resolve(process.cwd(), argv.secFile), sec);
+    import_node_fs4.default.writeFileSync(import_node_path5.default.resolve(process.cwd(), argv.secFile), sec);
   } catch (e) {
     error(e);
   }
@@ -720,16 +933,13 @@ __export(encryptSecretsJson_exports, {
   handler: () => handler6
 });
 var import_node_fs5 = __toModule(require("node:fs"));
-var import_node_path5 = __toModule(require("node:path"));
+var import_node_path6 = __toModule(require("node:path"));
 var import_client_kms6 = __toModule(require("@aws-sdk/client-kms"));
-var import_chalk6 = __toModule(require("chalk"));
-var import_flat2 = __toModule(require("flat"));
+var import_chalk7 = __toModule(require("chalk"));
+var import_flat3 = __toModule(require("flat"));
 var command6 = "encrypt-secrets-json";
 var desc6 = "Encrypts an unencrypted file";
 var builder6 = {
-  "aws-profile": commonCliOptions.awsProfile,
-  "aws-region": commonCliOptions.awsRegion,
-  "aws-key-alias": commonCliOptions.awsKeyAlias,
   "secrets-file": {
     string: true,
     describe: "filename of json file reading secrets",
@@ -740,29 +950,39 @@ var builder6 = {
     describe: "filename of json file for writing encrypted secrets",
     default: "secrets.encrypted.json"
   },
-  "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
+  "aws-profile": commonCliOptions.awsProfile,
+  "aws-region": commonCliOptions.awsRegion,
+  "aws-key-alias": commonCliOptions.awsKeyAlias,
+  "aws-assume-role-arn": commonCliOptions.awsAssumeRoleArn,
+  "aws-assume-role-session-duration": commonCliOptions.awsAssumeRoleSessionDuration,
   verbose: commonCliOptions.verbose,
   yes: __spreadValues({}, commonCliOptions.yes)
 };
 var handler6 = async (argv) => {
+  const config = await getConfig();
   const { info, error } = getLogger();
   try {
     const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
-      argv: __spreadValues({}, argv),
+      argv: __spreadProps(__spreadValues({}, argv), {
+        awsRegion: config.aws.region || argv.awsRegion,
+        awsProfile: config.aws.profile || argv.awsProfile,
+        awsAssumeRoleArn: config.aws.assumeRoleArn || argv.awsAssumeRoleArn,
+        awsAssumeRoleSessionDuration: config.aws.assumeRoleSessionDuration || argv.awsAssumeRoleSessionDuration
+      }),
       env: __spreadValues({}, process.env)
     });
-    const secretsPath = import_node_path5.default.resolve(process.cwd(), argv.secretsFile);
+    const secretsPath = import_node_path6.default.resolve(process.cwd(), argv.secretsFile);
     if (!await fileExists(secretsPath)) {
-      error(`Could not open ${(0, import_chalk6.redBright)(secretsPath)}`);
+      error(`Could not open ${(0, import_chalk7.redBright)(secretsPath)}`);
       return;
     }
     const secrets = JSON.parse(import_node_fs5.default.readFileSync(secretsPath, { encoding: "utf8" }));
     if (!secrets.parameters) {
       throw new Error(`Expected 'parameters' property, but got none`);
     }
-    const flatParameters = (0, import_flat2.default)(secrets.parameters, { delimiter: "/" });
+    const flatParameters = (0, import_flat3.default)(secrets.parameters, { delimiter: "/", maxDepth: config.maxDepth });
     if (argv.verbose) {
-      console.log(flatParameters);
+      info(flatParameters);
     }
     const kmsClient = getKMSClient({
       configuration: {
@@ -771,19 +991,25 @@ var handler6 = async (argv) => {
       },
       verbose: argv.verbose
     });
+    const awsKeyAlias = argv.awsKeyAlias || config.aws.keyAlias;
     if (argv.verbose) {
-      info(`Encrypting using key alias ${bold(argv.awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
+      info(`Encrypting using key alias ${bold(awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
       const describeKeyCommand = new import_client_kms6.DescribeKeyCommand({
-        KeyId: argv.awsKeyAlias
+        KeyId: awsKeyAlias
       });
       const describeKeyResult = await kmsClient.send(describeKeyCommand);
-      console.log("describeKeyResult", { describeKeyResult });
+      info("keyMetaData", __spreadValues({}, describeKeyResult.KeyMetadata));
     }
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, awsKeyAlias);
     const encryptedFlatParameters = Object.fromEntries(await Promise.all(Object.entries(flatParameters).map(async ([parameterName, parameter]) => {
+      let parameterCopy = parameter;
+      if (typeof parameter !== "string" && typeof parameter !== "number" && typeof parameter !== "boolean") {
+        parameterCopy = JSON.stringify(parameter);
+      }
       const encryptCommand = new import_client_kms6.EncryptCommand({
-        KeyId: argv.awsKeyAlias,
-        Plaintext: Buffer.from(parameter),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        KeyId: awsKeyAlias,
+        Plaintext: Buffer.from(String(parameterCopy)),
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const encryptionResult = await kmsClient.send(encryptCommand);
       if (!encryptionResult.CiphertextBlob) {
@@ -799,12 +1025,12 @@ var handler6 = async (argv) => {
       const cipherText = Buffer.from(encryptionResult.CiphertextBlob).toString("base64");
       return [parameterName, cipherText];
     })));
-    const encryptedParameters = import_flat2.default.unflatten(encryptedFlatParameters, { delimiter: "/" });
+    const encryptedParameters = import_flat3.default.unflatten(encryptedFlatParameters, { delimiter: "/" });
     const encryptedSecrets = {
       config: secrets.config,
       encryptedParameters
     };
-    const encryptedSecretsPath = import_node_path5.default.resolve(process.cwd(), argv.encryptedSecretsFile);
+    const encryptedSecretsPath = import_node_path6.default.resolve(process.cwd(), argv.encryptedSecretsFile);
     const overwriteResponse = await promptOverwriteIfFileExists({
       filePath: encryptedSecretsPath,
       skip: argv.yes
@@ -825,44 +1051,51 @@ __export(offloadToSSMCommand_exports, {
   desc: () => desc7,
   handler: () => handler7
 });
+var import_node_fs6 = __toModule(require("node:fs"));
+var import_node_path7 = __toModule(require("node:path"));
 var import_client_kms7 = __toModule(require("@aws-sdk/client-kms"));
 var import_client_ssm3 = __toModule(require("@aws-sdk/client-ssm"));
-var import_chalk7 = __toModule(require("chalk"));
-var import_flat3 = __toModule(require("flat"));
-var import_node_fs6 = __toModule(require("node:fs"));
-var import_node_path6 = __toModule(require("node:path"));
+var import_chalk8 = __toModule(require("chalk"));
+var import_flat4 = __toModule(require("flat"));
 var command7 = "offload-secrets-json-to-ssm";
 var desc7 = "Sends decrypted values of secrets.encrypted.json file to SSM parameter store";
 var builder7 = {
-  "aws-profile": commonCliOptions.awsProfile,
-  "aws-region": commonCliOptions.awsRegion,
-  "aws-key-alias": commonCliOptions.awsKeyAlias,
   "encrypted-secrets-file": {
     string: true,
-    describe: "filename of json file for reading encrypted secrets",
+    describe: "filename of json file for writing encrypted secrets",
     default: "secrets.encrypted.json"
   },
-  "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
+  "aws-profile": commonCliOptions.awsProfile,
+  "aws-region": commonCliOptions.awsRegion,
+  "aws-key-alias": commonCliOptions.awsKeyAlias,
+  "aws-assume-role-arn": commonCliOptions.awsAssumeRoleArn,
+  "aws-assume-role-session-duration": commonCliOptions.awsAssumeRoleSessionDuration,
   verbose: commonCliOptions.verbose,
   yes: __spreadValues({}, commonCliOptions.yes)
 };
 var handler7 = async (argv) => {
+  const config = await getConfig();
   const { info, error } = getLogger();
   try {
     const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
-      argv: __spreadValues({}, argv),
+      argv: __spreadProps(__spreadValues({}, argv), {
+        awsRegion: config.aws.region || argv.awsRegion,
+        awsProfile: config.aws.profile || argv.awsProfile,
+        awsAssumeRoleArn: config.aws.assumeRoleArn || argv.awsAssumeRoleArn,
+        awsAssumeRoleSessionDuration: config.aws.assumeRoleSessionDuration || argv.awsAssumeRoleSessionDuration
+      }),
       env: __spreadValues({}, process.env)
     });
-    const encryptedSecretsPath = import_node_path6.default.resolve(process.cwd(), argv.encryptedSecretsFile);
+    const encryptedSecretsPath = import_node_path7.default.resolve(process.cwd(), argv.encryptedSecretsFile);
     if (!await fileExists(encryptedSecretsPath)) {
-      error(`Could not open ${(0, import_chalk7.redBright)(encryptedSecretsPath)}`);
+      error(`Could not open ${(0, import_chalk8.redBright)(encryptedSecretsPath)}`);
       return;
     }
     const encryptedSecrets = JSON.parse(import_node_fs6.default.readFileSync(encryptedSecretsPath, { encoding: "utf8" }));
     if (!encryptedSecrets.encryptedParameters) {
       throw new Error(`Expected 'encryptedParameters' property, but got none`);
     }
-    const flatEncryptedParameters = (0, import_flat3.default)(encryptedSecrets.encryptedParameters, { delimiter: "/" });
+    const flatEncryptedParameters = (0, import_flat4.default)(encryptedSecrets.encryptedParameters, { delimiter: "/" });
     const kmsClient = getKMSClient({
       configuration: {
         credentials: credentialsAndOrigin.value,
@@ -870,19 +1103,16 @@ var handler7 = async (argv) => {
       },
       verbose: argv.verbose
     });
+    const awsKeyAlias = argv.awsKeyAlias || config.aws.keyAlias;
     if (argv.verbose) {
-      info(`Encrypting using key alias ${bold(argv.awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
-      const describeKeyCommand = new import_client_kms7.DescribeKeyCommand({
-        KeyId: argv.awsKeyAlias
-      });
-      const describeKeyResult = await kmsClient.send(describeKeyCommand);
-      console.log("describeKeyResult", { describeKeyResult });
+      info(`Encrypting using key alias ${bold(awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
     }
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, awsKeyAlias);
     const flatParameters = Object.fromEntries(await Promise.all(Object.entries(flatEncryptedParameters).map(async ([parameterName, encryptedParameter]) => {
       const decryptCommand = new import_client_kms7.DecryptCommand({
         KeyId: argv.awsKeyAlias,
         CiphertextBlob: Buffer.from(encryptedParameter, "base64"),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const decryptionResult = await kmsClient.send(decryptCommand);
       if (!decryptionResult.Plaintext) {