dotsec 0.9.0 → 0.10.1-alpha.1

package/dist/esm/cli.js

@@ -1,4 +1,6 @@
 var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
 var __getOwnPropSymbols = Object.getOwnPropertySymbols;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __propIsEnum = Object.prototype.propertyIsEnumerable;
@@ -14,6 +16,7 @@ var __spreadValues = (a, b) => {
     }
   return a;
 };
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
 var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
 var __export = (target, all) => {
   __markAsModule(target);
@@ -47,7 +50,6 @@ var commonCliOptions = {
   },
   awsKeyAlias: {
     string: true,
-    default: "alias/top-secret",
     describe: "AWS KMS key alias"
   },
   awsKeyArn: {
@@ -60,8 +62,7 @@ var commonCliOptions = {
   },
   envFile: {
     string: true,
-    describe: ".env file",
-    default: ".env"
+    describe: ".env file"
   },
   ignoreMissingEnvFile: {
     boolean: true,
@@ -84,6 +85,14 @@ var commonCliOptions = {
     boolean: true,
     describe: "Be verbose"
   },
+  encryptedSecretsFile: {
+    string: true,
+    describe: "filename of json file for reading encrypted secrets"
+  },
+  jsonFilter: {
+    string: true,
+    describe: "dot separated filter path, for example a.b.c will return { a: { b: { c: ... }}}"
+  },
   yes: {
     boolean: true,
     describe: "Proceeds without confirmation"
@@ -310,11 +319,11 @@ __export(decryptSecCommand_exports, {
   desc: () => desc2,
   handler: () => handler2
 });
-import { KMSClient, DecryptCommand } from "@aws-sdk/client-kms";
-import { redBright } from "chalk";
-import { parse } from "dotenv";
 import fs from "node:fs";
 import path from "node:path";
+import { KMSClient as KMSClient2, DecryptCommand } from "@aws-sdk/client-kms";
+import { redBright } from "chalk";
+import { parse } from "dotenv";
 
 // src/utils/io.ts
 import { stat } from "fs/promises";
@@ -346,6 +355,30 @@ var promptOverwriteIfFileExists = async ({
   return overwriteResponse;
 };
 
+// src/utils/kms.ts
+import {
+  DescribeKeyCommand,
+  KMSClient
+} from "@aws-sdk/client-kms";
+var getKMSClient = ({
+  configuration
+}) => {
+  const kmsClient = new KMSClient(configuration);
+  return kmsClient;
+};
+var getEncryptionAlgorithm = async (kmsClient, awsKeyAlias) => {
+  var _a, _b;
+  const describeKeyCommand = new DescribeKeyCommand({
+    KeyId: awsKeyAlias
+  });
+  const describeKeyResult = await kmsClient.send(describeKeyCommand);
+  const encryptionAlgorithm = (_b = (_a = describeKeyResult.KeyMetadata) == null ? void 0 : _a.EncryptionAlgorithms) == null ? void 0 : _b[0];
+  if (encryptionAlgorithm === void 0) {
+    throw new Error(`Could not determine encryption algorithm`);
+  }
+  return encryptionAlgorithm;
+};
+
 // src/commands/decryptSecCommand.ts
 var command2 = "decrypt-sec";
 var desc2 = "Decrypts a dotsec file";
@@ -354,7 +387,7 @@ var builder2 = {
   "aws-region": commonCliOptions.awsRegion,
   "aws-key-alias": commonCliOptions.awsKeyAlias,
   "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
-  "env-file": commonCliOptions.envFile,
+  "env-file": __spreadProps(__spreadValues({}, commonCliOptions.envFile), { default: "env" }),
   "sec-file": commonCliOptions.secFile,
   verbose: commonCliOptions.verbose
 };
@@ -370,15 +403,16 @@ var handler2 = async (argv) => {
       return;
     }
     const parsedSec = parse(fs.readFileSync(secSource, { encoding: "utf8" }));
-    const kmsClient = new KMSClient({
+    const kmsClient = new KMSClient2({
       credentials: credentialsAndOrigin.value,
       region: regionAndOrigin.value
     });
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, argv.awsKeyAlias);
     const envEntries = await Promise.all(Object.entries(parsedSec).map(async ([key, cipherText]) => {
       const decryptCommand = new DecryptCommand({
         KeyId: argv.awsKeyAlias,
         CiphertextBlob: Buffer.from(cipherText, "base64"),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const decryptionResult = await kmsClient.send(decryptCommand);
       if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
@@ -405,55 +439,117 @@ __export(decryptSecretsJson_exports, {
   desc: () => desc3,
   handler: () => handler3
 });
-import { DecryptCommand as DecryptCommand2, DescribeKeyCommand } from "@aws-sdk/client-kms";
+import fs3 from "node:fs";
+import path3 from "node:path";
+import { DecryptCommand as DecryptCommand2, DescribeKeyCommand as DescribeKeyCommand2 } from "@aws-sdk/client-kms";
 import { redBright as redBright2 } from "chalk";
 import flat from "flat";
-import fs2 from "node:fs";
-import path2 from "node:path";
 
-// src/utils/kms.ts
-import { KMSClient as KMSClient2 } from "@aws-sdk/client-kms";
-var getKMSClient = ({
-  configuration
-}) => {
-  const kmsClient = new KMSClient2(configuration);
-  return kmsClient;
+// src/lib/config.ts
+import fs2 from "fs";
+import path2 from "node:path";
+import { bundleRequire } from "bundle-require";
+import JoyCon from "joycon";
+var defaultConfig = {
+  aws: {
+    keyAlias: "alias/top-secret"
+  }
+};
+function jsoncParse(data) {
+  try {
+    return new Function("return " + data.trim())();
+  } catch {
+    return {};
+  }
+}
+var loadJson = async (filepath) => {
+  try {
+    return jsoncParse(await fs2.promises.readFile(filepath, "utf8"));
+  } catch (error) {
+    if (error instanceof Error) {
+      throw new Error(`Failed to parse ${path2.relative(process.cwd(), filepath)}: ${error.message}`);
+    } else {
+      throw error;
+    }
+  }
+};
+var getConfig = async () => {
+  const cwd = process.cwd();
+  const configJoycon = new JoyCon();
+  const configPath = await configJoycon.resolve({
+    files: [
+      "dotsec.config.ts",
+      "dotsec.config.js",
+      "dotsec.config.cjs",
+      "dotsec.config.mjs",
+      "dotsec.config.json",
+      "package.json"
+    ],
+    cwd,
+    stopDir: path2.parse(cwd).root,
+    packageKey: "dotsec"
+  });
+  if (configPath) {
+    if (configPath.endsWith(".json")) {
+      const rawData = await loadJson(configPath);
+      let data;
+      if (configPath.endsWith("package.json") && rawData.dotsec !== void 0) {
+        data = rawData.dotsec;
+      } else {
+        data = rawData;
+      }
+      return __spreadProps(__spreadValues(__spreadValues({}, defaultConfig), data), {
+        aws: __spreadValues(__spreadValues({}, defaultConfig.aws), data.aws)
+      });
+    }
+    const config = await bundleRequire({
+      filepath: configPath
+    });
+    const retrievedConfig = config.mod.dotsec || config.mod.default || config.mod;
+    return __spreadValues(__spreadValues({}, defaultConfig), retrievedConfig);
+  }
+  return __spreadValues({}, defaultConfig);
 };
 
 // src/commands/decryptSecretsJson.ts
 var command3 = "decrypt-secrets-json";
 var desc3 = "Derypts an encrypted file";
 var builder3 = {
-  "aws-profile": commonCliOptions.awsProfile,
-  "aws-region": commonCliOptions.awsRegion,
-  "aws-key-alias": commonCliOptions.awsKeyAlias,
   "secrets-file": {
     string: true,
     describe: "filename of json file writing secrets",
     default: "secrets.json"
   },
-  "encrypted-secrets-file": {
-    string: true,
-    describe: "filename of json file for reading encrypted secrets",
+  "encrypted-secrets-file": __spreadProps(__spreadValues({}, commonCliOptions.encryptedSecretsFile), {
     default: "secrets.encrypted.json"
-  },
-  "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
+  }),
+  "aws-profile": commonCliOptions.awsProfile,
+  "aws-region": commonCliOptions.awsRegion,
+  "aws-key-alias": commonCliOptions.awsKeyAlias,
+  "aws-assume-role-arn": commonCliOptions.awsAssumeRoleArn,
+  "aws-assume-role-session-duration": commonCliOptions.awsAssumeRoleSessionDuration,
   verbose: commonCliOptions.verbose,
   yes: __spreadValues({}, commonCliOptions.yes)
 };
 var handler3 = async (argv) => {
   const { info, error } = getLogger();
+  const config = await getConfig();
   try {
     const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
-      argv: __spreadValues({}, argv),
+      argv: __spreadProps(__spreadValues({}, argv), {
+        awsRegion: config.aws.region || argv.awsRegion,
+        awsProfile: config.aws.profile || argv.awsProfile,
+        awsAssumeRoleArn: config.aws.assumeRoleArn || argv.awsAssumeRoleArn,
+        awsAssumeRoleSessionDuration: config.aws.assumeRoleSessionDuration || argv.awsAssumeRoleSessionDuration
+      }),
       env: __spreadValues({}, process.env)
     });
-    const encryptedSecretsPath = path2.resolve(process.cwd(), argv.encryptedSecretsFile);
+    const encryptedSecretsPath = path3.resolve(process.cwd(), argv.encryptedSecretsFile);
     if (!await fileExists(encryptedSecretsPath)) {
       error(`Could not open ${redBright2(encryptedSecretsPath)}`);
       return;
     }
-    const encryptedSecrets = JSON.parse(fs2.readFileSync(encryptedSecretsPath, { encoding: "utf8" }));
+    const encryptedSecrets = JSON.parse(fs3.readFileSync(encryptedSecretsPath, { encoding: "utf8" }));
     if (!encryptedSecrets.encryptedParameters) {
       throw new Error(`Expected 'encryptedParameters' property, but got none`);
     }
@@ -465,19 +561,21 @@ var handler3 = async (argv) => {
       },
       verbose: argv.verbose
     });
+    const awsKeyAlias = argv.awsKeyAlias || config.aws.keyAlias;
     if (argv.verbose) {
-      info(`Encrypting using key alias ${bold(argv.awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
-      const describeKeyCommand = new DescribeKeyCommand({
-        KeyId: argv.awsKeyAlias
+      info(`Encrypting using key alias ${bold(awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
+      const describeKeyCommand = new DescribeKeyCommand2({
+        KeyId: awsKeyAlias
       });
       const describeKeyResult = await kmsClient.send(describeKeyCommand);
-      console.log("describeKeyResult", { describeKeyResult });
+      info("keyMetaData", __spreadValues({}, describeKeyResult.KeyMetadata));
     }
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, awsKeyAlias);
     const flatParameters = Object.fromEntries(await Promise.all(Object.entries(flatEncryptedParameters).map(async ([parameterName, encryptedParameter]) => {
       const decryptCommand = new DecryptCommand2({
         KeyId: argv.awsKeyAlias,
         CiphertextBlob: Buffer.from(encryptedParameter, "base64"),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const decryptionResult = await kmsClient.send(decryptCommand);
       if (!decryptionResult.Plaintext) {
@@ -490,6 +588,13 @@ var handler3 = async (argv) => {
       if (argv.verbose) {
         info(`Encrypting key ${bold(parameterName)} ${underline("ok")}`);
       }
+      const plaintext = Buffer.from(decryptionResult.Plaintext).toString();
+      try {
+        const jsonObject = JSON.parse(plaintext);
+        return [parameterName, jsonObject];
+      } catch (e) {
+        console.log("NOPES", plaintext);
+      }
       const value = Buffer.from(decryptionResult.Plaintext).toString();
       return [parameterName, value];
     })));
@@ -498,13 +603,13 @@ var handler3 = async (argv) => {
       config: encryptedSecrets.config,
       parameters
     };
-    const secretsPath = path2.resolve(process.cwd(), argv.secretsFile);
+    const secretsPath = path3.resolve(process.cwd(), argv.secretsFile);
     const overwriteResponse = await promptOverwriteIfFileExists({
       filePath: secretsPath,
       skip: argv.yes
     });
     if (overwriteResponse === void 0 || overwriteResponse.overwrite === true) {
-      fs2.writeFileSync(secretsPath, JSON.stringify(secrets, null, 4));
+      fs3.writeFileSync(secretsPath, JSON.stringify(secrets, null, 4));
     }
   } catch (e) {
     error(e);
@@ -519,12 +624,37 @@ __export(defaultCommand_exports, {
   desc: () => desc4,
   handler: () => handler4
 });
-import fs3 from "node:fs";
-import path3 from "node:path";
+import fs5 from "node:fs";
+import path5 from "node:path";
 import { KMSClient as KMSClient3, DecryptCommand as DecryptCommand3 } from "@aws-sdk/client-kms";
-import { redBright as redBright3 } from "chalk";
+import { redBright as redBright4 } from "chalk";
+import { constantCase } from "constant-case";
 import { spawn } from "cross-spawn";
 import { parse as parse2 } from "dotenv";
+import flat2 from "flat";
+
+// src/lib/encryptedSecrets.ts
+import fs4 from "fs";
+import path4 from "path";
+import { redBright as redBright3 } from "chalk";
+var loadEncryptedSecrets = async ({
+  encryptedSecretsFile
+}) => {
+  const encryptedSecretsPath = path4.resolve(process.cwd(), encryptedSecretsFile);
+  if (!await fileExists(encryptedSecretsPath)) {
+    throw new Error(`Could not open ${redBright3(encryptedSecretsPath)}`);
+  }
+  const encryptedSecrets = JSON.parse(fs4.readFileSync(encryptedSecretsPath, { encoding: "utf8" }));
+  if (!encryptedSecrets) {
+    throw new Error(`No encrypted secrets found in ${redBright3(encryptedSecretsPath)}`);
+  }
+  if (!encryptedSecrets.encryptedParameters) {
+    throw new Error(`Expected 'encryptedParameters' property, but got none`);
+  }
+  return encryptedSecrets;
+};
+
+// src/commands/defaultCommand.ts
 var command4 = "$0 <command>";
 var desc4 = "Decrypts a .sec file, injects the results into a separate process and runs a command";
 var builder4 = {
@@ -536,6 +666,8 @@ var builder4 = {
   "ignore-missing-env-file": commonCliOptions.ignoreMissingEnvFile,
   "aws-assume-role-arn": commonCliOptions.awsAssumeRoleArn,
   "aws-assume-role-session-duration": commonCliOptions.awsAssumeRoleSessionDuration,
+  "encrypted-secrets-file": commonCliOptions.encryptedSecretsFile,
+  "json-filter": commonCliOptions.jsonFilter,
   verbose: commonCliOptions.verbose,
   command: { string: true, required: true }
 };
@@ -545,21 +677,69 @@ var handleSec = async ({
   regionAndOrigin,
   awsKeyAlias
 }) => {
-  const secSource = path3.resolve(process.cwd(), secFile);
+  const secSource = path5.resolve(process.cwd(), secFile);
   if (!await fileExists(secSource)) {
-    console.error(`Could not open ${redBright3(secSource)}`);
+    console.error(`Could not open ${redBright4(secSource)}`);
     return;
   }
-  const parsedSec = parse2(fs3.readFileSync(secSource, { encoding: "utf8" }));
+  const parsedSec = parse2(fs5.readFileSync(secSource, { encoding: "utf8" }));
   const kmsClient = new KMSClient3({
     credentials: credentialsAndOrigin.value,
     region: regionAndOrigin.value
   });
+  const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, awsKeyAlias);
   const envEntries = await Promise.all(Object.entries(parsedSec).map(async ([key, cipherText]) => {
     const decryptCommand = new DecryptCommand3({
       KeyId: awsKeyAlias,
       CiphertextBlob: Buffer.from(cipherText, "base64"),
-      EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+      EncryptionAlgorithm: encryptionAlgorithm
+    });
+    const decryptionResult = await kmsClient.send(decryptCommand);
+    if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
+      throw new Error(`No: ${JSON.stringify({
+        key,
+        cipherText,
+        decryptCommand
+      })}`);
+    }
+    const value = Buffer.from(decryptionResult.Plaintext).toString();
+    return [key, value];
+  }));
+  const env = Object.fromEntries(envEntries);
+  return env;
+};
+var handleEncryptedJson = async ({
+  encryptedSecretsFile,
+  jsonFilter,
+  credentialsAndOrigin,
+  regionAndOrigin,
+  awsKeyAlias
+}) => {
+  const encryptedSecrets = await loadEncryptedSecrets({
+    encryptedSecretsFile
+  });
+  const flattened = flat2.flatten(encryptedSecrets.encryptedParameters, {
+    delimiter: "__",
+    transformKey: (key) => {
+      return constantCase(key);
+    }
+  });
+  const kmsClient = new KMSClient3({
+    credentials: credentialsAndOrigin.value,
+    region: regionAndOrigin.value
+  });
+  const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, awsKeyAlias);
+  const filterKey = jsonFilter == null ? void 0 : jsonFilter.split(".").map((part) => constantCase(part)).join("__");
+  const envEntries = await Promise.all(Object.entries(flattened).filter(([key]) => {
+    if (filterKey) {
+      return key.indexOf(filterKey) === 0;
+    }
+    return true;
+  }).map(async ([key, cipherText]) => {
+    const decryptCommand = new DecryptCommand3({
+      KeyId: awsKeyAlias,
+      CiphertextBlob: Buffer.from(cipherText, "base64"),
+      EncryptionAlgorithm: encryptionAlgorithm
     });
     const decryptionResult = await kmsClient.send(decryptCommand);
     if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
@@ -576,16 +756,40 @@ var handleSec = async ({
   return env;
 };
 var handler4 = async (argv) => {
+  const config = await getConfig();
   try {
     let env;
     let awsEnv;
     try {
       if (argv.envFile) {
-        env = parse2(fs3.readFileSync(argv.envFile, { encoding: "utf8" }));
+        env = parse2(fs5.readFileSync(argv.envFile, { encoding: "utf8" }));
+        if (argv.awsAssumeRoleArn || process.env.AWS_ASSUME_ROLE_ARN || (env == null ? void 0 : env.AWS_ASSUME_ROLE_ARN)) {
+          const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
+            argv: __spreadProps(__spreadValues({}, argv), {
+              awsRegion: config.aws.region || argv.awsRegion,
+              awsProfile: config.aws.profile || argv.awsProfile,
+              awsAssumeRoleArn: config.aws.assumeRoleArn || argv.awsAssumeRoleArn,
+              awsAssumeRoleSessionDuration: config.aws.assumeRoleSessionDuration || argv.awsAssumeRoleSessionDuration
+            }),
+            env: __spreadValues({}, process.env)
+          });
+          awsEnv = {
+            AWS_ACCESS_KEY_ID: credentialsAndOrigin.value.accessKeyId,
+            AWS_SECRET_ACCESS_KEY: credentialsAndOrigin.value.secretAccessKey
+          };
+          if (credentialsAndOrigin.value.sessionToken) {
+            awsEnv.AWS_SESSION_TOKEN = credentialsAndOrigin.value.sessionToken;
+          }
+        }
       } else {
         const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
-          argv: __spreadValues({}, argv),
-          env: __spreadValues(__spreadValues({}, process.env), env)
+          argv: __spreadProps(__spreadValues({}, argv), {
+            awsRegion: config.aws.region || argv.awsRegion,
+            awsProfile: config.aws.profile || argv.awsProfile,
+            awsAssumeRoleArn: config.aws.assumeRoleArn || argv.awsAssumeRoleArn,
+            awsAssumeRoleSessionDuration: config.aws.assumeRoleSessionDuration || argv.awsAssumeRoleSessionDuration
+          }),
+          env: __spreadValues({}, process.env)
         });
         if ((argv.awsAssumeRoleArn || process.env.AWS_ASSUME_ROLE_ARN || (env == null ? void 0 : env.AWS_ASSUME_ROLE_ARN)) && credentialsAndOrigin.value.sessionToken !== void 0) {
           awsEnv = {
@@ -597,12 +801,23 @@ var handler4 = async (argv) => {
         if (argv.verbose) {
           console.log({ credentialsAndOrigin, regionAndOrigin });
         }
-        env = await handleSec({
-          secFile: argv.secFile,
-          credentialsAndOrigin,
-          regionAndOrigin,
-          awsKeyAlias: argv.awsKeyAlias
-        });
+        const awsKeyAlias = argv.awsKeyAlias || config.aws.keyAlias;
+        if (argv.encryptedSecretsFile) {
+          env = await handleEncryptedJson({
+            encryptedSecretsFile: argv.encryptedSecretsFile,
+            jsonFilter: argv.jsonFilter,
+            credentialsAndOrigin,
+            regionAndOrigin,
+            awsKeyAlias
+          });
+        } else {
+          env = await handleSec({
+            secFile: argv.secFile,
+            credentialsAndOrigin,
+            regionAndOrigin,
+            awsKeyAlias
+          });
+        }
       }
     } catch (e) {
       if (argv.ignoreMissingEnvFile !== true) {
@@ -630,18 +845,18 @@ __export(encryptEnvCommand_exports, {
   desc: () => desc5,
   handler: () => handler5
 });
-import { DescribeKeyCommand as DescribeKeyCommand2, EncryptCommand } from "@aws-sdk/client-kms";
-import { redBright as redBright4 } from "chalk";
+import fs6 from "node:fs";
+import path6 from "node:path";
+import { DescribeKeyCommand as DescribeKeyCommand3, EncryptCommand } from "@aws-sdk/client-kms";
+import { redBright as redBright5 } from "chalk";
 import { parse as parse3 } from "dotenv";
-import fs4 from "node:fs";
-import path4 from "node:path";
 var command5 = "encrypt-env";
 var desc5 = "Encrypts a dotenv file";
 var builder5 = {
   "aws-profile": commonCliOptions.awsProfile,
   "aws-region": commonCliOptions.awsRegion,
   "aws-key-alias": commonCliOptions.awsKeyAlias,
-  "env-file": commonCliOptions.envFile,
+  "env-file": __spreadProps(__spreadValues({}, commonCliOptions.envFile), { default: ".env" }),
   "sec-file": commonCliOptions.secFile,
   "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
   verbose: commonCliOptions.verbose
@@ -653,12 +868,12 @@ var handler5 = async (argv) => {
       argv: __spreadValues({}, argv),
       env: __spreadValues({}, process.env)
     });
-    const envSource = path4.resolve(process.cwd(), argv.envFile);
+    const envSource = path6.resolve(process.cwd(), argv.envFile);
     if (!await fileExists(envSource)) {
-      error(`Could not open ${redBright4(envSource)}`);
+      error(`Could not open ${redBright5(envSource)}`);
       return;
     }
-    const parsedEnv = parse3(fs4.readFileSync(envSource, { encoding: "utf8" }));
+    const parsedEnv = parse3(fs6.readFileSync(envSource, { encoding: "utf8" }));
     const kmsClient = getKMSClient({
       configuration: {
         credentials: credentialsAndOrigin.value,
@@ -666,9 +881,10 @@ var handler5 = async (argv) => {
       },
       verbose: argv.verbose
     });
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, argv.awsKeyAlias);
     if (argv.verbose) {
       info(`Encrypting using key alias ${bold(argv.awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
-      const describeKeyCommand = new DescribeKeyCommand2({
+      const describeKeyCommand = new DescribeKeyCommand3({
         KeyId: argv.awsKeyAlias
       });
       const describeKeyResult = await kmsClient.send(describeKeyCommand);
@@ -678,7 +894,7 @@ var handler5 = async (argv) => {
       const encryptCommand = new EncryptCommand({
         KeyId: argv.awsKeyAlias,
         Plaintext: Buffer.from(value),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const encryptionResult = await kmsClient.send(encryptCommand);
       if (!encryptionResult.CiphertextBlob) {
@@ -694,7 +910,7 @@ var handler5 = async (argv) => {
       const cipherText = Buffer.from(encryptionResult.CiphertextBlob).toString("base64");
       return `${key}="${cipherText}"`;
     }))).join("\n");
-    fs4.writeFileSync(path4.resolve(process.cwd(), argv.secFile), sec);
+    fs6.writeFileSync(path6.resolve(process.cwd(), argv.secFile), sec);
   } catch (e) {
     error(e);
   }
@@ -708,17 +924,14 @@ __export(encryptSecretsJson_exports, {
   desc: () => desc6,
   handler: () => handler6
 });
-import fs5 from "node:fs";
-import path5 from "node:path";
-import { DescribeKeyCommand as DescribeKeyCommand3, EncryptCommand as EncryptCommand2 } from "@aws-sdk/client-kms";
-import { redBright as redBright5 } from "chalk";
-import flat2 from "flat";
+import fs7 from "node:fs";
+import path7 from "node:path";
+import { DescribeKeyCommand as DescribeKeyCommand4, EncryptCommand as EncryptCommand2 } from "@aws-sdk/client-kms";
+import { redBright as redBright6 } from "chalk";
+import flat3 from "flat";
 var command6 = "encrypt-secrets-json";
 var desc6 = "Encrypts an unencrypted file";
 var builder6 = {
-  "aws-profile": commonCliOptions.awsProfile,
-  "aws-region": commonCliOptions.awsRegion,
-  "aws-key-alias": commonCliOptions.awsKeyAlias,
   "secrets-file": {
     string: true,
     describe: "filename of json file reading secrets",
@@ -729,29 +942,39 @@ var builder6 = {
     describe: "filename of json file for writing encrypted secrets",
     default: "secrets.encrypted.json"
   },
-  "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
+  "aws-profile": commonCliOptions.awsProfile,
+  "aws-region": commonCliOptions.awsRegion,
+  "aws-key-alias": commonCliOptions.awsKeyAlias,
+  "aws-assume-role-arn": commonCliOptions.awsAssumeRoleArn,
+  "aws-assume-role-session-duration": commonCliOptions.awsAssumeRoleSessionDuration,
   verbose: commonCliOptions.verbose,
   yes: __spreadValues({}, commonCliOptions.yes)
 };
 var handler6 = async (argv) => {
+  const config = await getConfig();
   const { info, error } = getLogger();
   try {
     const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
-      argv: __spreadValues({}, argv),
+      argv: __spreadProps(__spreadValues({}, argv), {
+        awsRegion: config.aws.region || argv.awsRegion,
+        awsProfile: config.aws.profile || argv.awsProfile,
+        awsAssumeRoleArn: config.aws.assumeRoleArn || argv.awsAssumeRoleArn,
+        awsAssumeRoleSessionDuration: config.aws.assumeRoleSessionDuration || argv.awsAssumeRoleSessionDuration
+      }),
       env: __spreadValues({}, process.env)
     });
-    const secretsPath = path5.resolve(process.cwd(), argv.secretsFile);
+    const secretsPath = path7.resolve(process.cwd(), argv.secretsFile);
     if (!await fileExists(secretsPath)) {
-      error(`Could not open ${redBright5(secretsPath)}`);
+      error(`Could not open ${redBright6(secretsPath)}`);
       return;
     }
-    const secrets = JSON.parse(fs5.readFileSync(secretsPath, { encoding: "utf8" }));
+    const secrets = JSON.parse(fs7.readFileSync(secretsPath, { encoding: "utf8" }));
     if (!secrets.parameters) {
       throw new Error(`Expected 'parameters' property, but got none`);
     }
-    const flatParameters = flat2(secrets.parameters, { delimiter: "/" });
+    const flatParameters = flat3(secrets.parameters, { delimiter: "/", maxDepth: config.maxDepth });
     if (argv.verbose) {
-      console.log(flatParameters);
+      info(flatParameters);
     }
     const kmsClient = getKMSClient({
       configuration: {
@@ -760,19 +983,25 @@ var handler6 = async (argv) => {
       },
       verbose: argv.verbose
     });
+    const awsKeyAlias = argv.awsKeyAlias || config.aws.keyAlias;
     if (argv.verbose) {
-      info(`Encrypting using key alias ${bold(argv.awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
-      const describeKeyCommand = new DescribeKeyCommand3({
-        KeyId: argv.awsKeyAlias
+      info(`Encrypting using key alias ${bold(awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
+      const describeKeyCommand = new DescribeKeyCommand4({
+        KeyId: awsKeyAlias
       });
       const describeKeyResult = await kmsClient.send(describeKeyCommand);
-      console.log("describeKeyResult", { describeKeyResult });
+      info("keyMetaData", __spreadValues({}, describeKeyResult.KeyMetadata));
     }
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, awsKeyAlias);
     const encryptedFlatParameters = Object.fromEntries(await Promise.all(Object.entries(flatParameters).map(async ([parameterName, parameter]) => {
+      let parameterCopy = parameter;
+      if (typeof parameter !== "string" && typeof parameter !== "number" && typeof parameter !== "boolean") {
+        parameterCopy = JSON.stringify(parameter);
+      }
       const encryptCommand = new EncryptCommand2({
-        KeyId: argv.awsKeyAlias,
-        Plaintext: Buffer.from(parameter),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        KeyId: awsKeyAlias,
+        Plaintext: Buffer.from(String(parameterCopy)),
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const encryptionResult = await kmsClient.send(encryptCommand);
       if (!encryptionResult.CiphertextBlob) {
@@ -788,18 +1017,18 @@ var handler6 = async (argv) => {
       const cipherText = Buffer.from(encryptionResult.CiphertextBlob).toString("base64");
       return [parameterName, cipherText];
     })));
-    const encryptedParameters = flat2.unflatten(encryptedFlatParameters, { delimiter: "/" });
+    const encryptedParameters = flat3.unflatten(encryptedFlatParameters, { delimiter: "/" });
     const encryptedSecrets = {
       config: secrets.config,
       encryptedParameters
     };
-    const encryptedSecretsPath = path5.resolve(process.cwd(), argv.encryptedSecretsFile);
+    const encryptedSecretsPath = path7.resolve(process.cwd(), argv.encryptedSecretsFile);
     const overwriteResponse = await promptOverwriteIfFileExists({
       filePath: encryptedSecretsPath,
       skip: argv.yes
     });
     if (overwriteResponse === void 0 || overwriteResponse.overwrite === true) {
-      fs5.writeFileSync(encryptedSecretsPath, JSON.stringify(encryptedSecrets, null, 4));
+      fs7.writeFileSync(encryptedSecretsPath, JSON.stringify(encryptedSecrets, null, 4));
     }
   } catch (e) {
     error(e);
@@ -814,44 +1043,51 @@ __export(offloadToSSMCommand_exports, {
   desc: () => desc7,
   handler: () => handler7
 });
-import { DecryptCommand as DecryptCommand4, DescribeKeyCommand as DescribeKeyCommand4 } from "@aws-sdk/client-kms";
+import fs8 from "node:fs";
+import path8 from "node:path";
+import { DecryptCommand as DecryptCommand4 } from "@aws-sdk/client-kms";
 import { PutParameterCommand } from "@aws-sdk/client-ssm";
-import { redBright as redBright6 } from "chalk";
-import flat3 from "flat";
-import fs6 from "node:fs";
-import path6 from "node:path";
+import { redBright as redBright7 } from "chalk";
+import flat4 from "flat";
 var command7 = "offload-secrets-json-to-ssm";
 var desc7 = "Sends decrypted values of secrets.encrypted.json file to SSM parameter store";
 var builder7 = {
-  "aws-profile": commonCliOptions.awsProfile,
-  "aws-region": commonCliOptions.awsRegion,
-  "aws-key-alias": commonCliOptions.awsKeyAlias,
   "encrypted-secrets-file": {
     string: true,
-    describe: "filename of json file for reading encrypted secrets",
+    describe: "filename of json file for writing encrypted secrets",
     default: "secrets.encrypted.json"
   },
-  "assume-role-arn": commonCliOptions.awsAssumeRoleArn,
+  "aws-profile": commonCliOptions.awsProfile,
+  "aws-region": commonCliOptions.awsRegion,
+  "aws-key-alias": commonCliOptions.awsKeyAlias,
+  "aws-assume-role-arn": commonCliOptions.awsAssumeRoleArn,
+  "aws-assume-role-session-duration": commonCliOptions.awsAssumeRoleSessionDuration,
   verbose: commonCliOptions.verbose,
   yes: __spreadValues({}, commonCliOptions.yes)
 };
 var handler7 = async (argv) => {
+  const config = await getConfig();
   const { info, error } = getLogger();
   try {
     const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({
-      argv: __spreadValues({}, argv),
+      argv: __spreadProps(__spreadValues({}, argv), {
+        awsRegion: config.aws.region || argv.awsRegion,
+        awsProfile: config.aws.profile || argv.awsProfile,
+        awsAssumeRoleArn: config.aws.assumeRoleArn || argv.awsAssumeRoleArn,
+        awsAssumeRoleSessionDuration: config.aws.assumeRoleSessionDuration || argv.awsAssumeRoleSessionDuration
+      }),
       env: __spreadValues({}, process.env)
     });
-    const encryptedSecretsPath = path6.resolve(process.cwd(), argv.encryptedSecretsFile);
+    const encryptedSecretsPath = path8.resolve(process.cwd(), argv.encryptedSecretsFile);
     if (!await fileExists(encryptedSecretsPath)) {
-      error(`Could not open ${redBright6(encryptedSecretsPath)}`);
+      error(`Could not open ${redBright7(encryptedSecretsPath)}`);
       return;
     }
-    const encryptedSecrets = JSON.parse(fs6.readFileSync(encryptedSecretsPath, { encoding: "utf8" }));
+    const encryptedSecrets = JSON.parse(fs8.readFileSync(encryptedSecretsPath, { encoding: "utf8" }));
     if (!encryptedSecrets.encryptedParameters) {
       throw new Error(`Expected 'encryptedParameters' property, but got none`);
     }
-    const flatEncryptedParameters = flat3(encryptedSecrets.encryptedParameters, { delimiter: "/" });
+    const flatEncryptedParameters = flat4(encryptedSecrets.encryptedParameters, { delimiter: "/" });
     const kmsClient = getKMSClient({
       configuration: {
         credentials: credentialsAndOrigin.value,
@@ -859,19 +1095,16 @@ var handler7 = async (argv) => {
       },
       verbose: argv.verbose
     });
+    const awsKeyAlias = argv.awsKeyAlias || config.aws.keyAlias;
     if (argv.verbose) {
-      info(`Encrypting using key alias ${bold(argv.awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
-      const describeKeyCommand = new DescribeKeyCommand4({
-        KeyId: argv.awsKeyAlias
-      });
-      const describeKeyResult = await kmsClient.send(describeKeyCommand);
-      console.log("describeKeyResult", { describeKeyResult });
+      info(`Encrypting using key alias ${bold(awsKeyAlias)} in ${bold(await kmsClient.config.region())}`);
     }
+    const encryptionAlgorithm = await getEncryptionAlgorithm(kmsClient, awsKeyAlias);
     const flatParameters = Object.fromEntries(await Promise.all(Object.entries(flatEncryptedParameters).map(async ([parameterName, encryptedParameter]) => {
       const decryptCommand = new DecryptCommand4({
         KeyId: argv.awsKeyAlias,
         CiphertextBlob: Buffer.from(encryptedParameter, "base64"),
-        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        EncryptionAlgorithm: encryptionAlgorithm
       });
       const decryptionResult = await kmsClient.send(decryptCommand);
       if (!decryptionResult.Plaintext) {