{"record":{"id":"a77897a4f771e3be","repo":"JuliusBrussee/caveman","slug":"kms-encode-envelope-w","errorCode":null,"errorMessage":"kms: encode envelope: %w","messagePattern":"kms: encode envelope: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/kms/kms.go","lineNumber":196,"sourceCode":"\t}\n\tif len(plaintext) > maxPlaintextBytes {\n\t\treturn nil, fmt.Errorf(\"kms: plaintext exceeds %d bytes\", maxPlaintextBytes)\n\t}\n\tvar response struct {\n\t\tKeyID      string `json:\"key_id\"`\n\t\tCiphertext string `json:\"ciphertext\"`\n\t}\n\tif err := c.call(ctx, c.region, c.keyID, \"encrypt\", map[string]string{\n\t\t\"plaintext\": base64.StdEncoding.EncodeToString(plaintext),\n\t}, &response); err != nil {\n\t\treturn nil, err\n\t}\n\tif response.KeyID != c.keyID || strings.TrimSpace(response.Ciphertext) == \"\" {\n\t\treturn nil, errors.New(\"kms: invalid encrypt response\")\n\t}\n\tenvelope, err := json.Marshal(Envelope{Provider: c.provider, Region: c.region, KeyID: response.KeyID, Ciphertext: response.Ciphertext})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"kms: encode envelope: %w\", err)\n\t}\n\treturn append([]byte(prefix), envelope...), nil\n}\n\n// Decrypt delegates to configured environment client.\nfunc Decrypt(ctx context.Context, blob []byte) ([]byte, error) {\n\tclient, err := FromEnvironment()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn client.Decrypt(ctx, blob)\n}\n\n// DecryptPayload unwraps an artifact data key with the dedicated payload KEK,\n// while allowing the explicitly configured legacy secrets key during cutover.\nfunc DecryptPayload(ctx context.Context, blob []byte) ([]byte, error) {\n\tclient, err := FromPayloadEnvironment()\n\tif err != nil {","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/kms/kms.go#L178-L214","documentation":"Client.Encrypt wraps the json.Marshal failure while serializing the KMS Envelope (provider, region, key_id, ciphertext) after a successful encrypt call. Marshal of these four plain string fields essentially never fails — this is a defensive wrap for an unexpected marshaling error; the at-fault input would be a malformed value in the client's provider/region/keyID/ciphertext strings.","triggerScenarios":"Thrown at shared/platform/kms/kms.go:196 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Retry the operation; this error is unexpected for string-only envelopes","Inspect the wrapped error to find which envelope field caused the marshal failure","Report as a bug if reproducible — valid provider/region/key/ciphertext strings always marshal"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}