1import type * as kms from "@distilled.cloud/aws/kms";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4import type { AliasName } from "./Alias.ts";
5import type { Key } from "./Key.ts";
6
7export interface GenerateDataKeyPairRequest extends Omit<
8 kms.GenerateDataKeyPairRequest,
9 "KeyId"
10> {}
11
12/**
13 * Runtime binding for `kms:GenerateDataKeyPair`.
14 *
15 * Bind this operation to a symmetric-encryption KMS {@link Key} (or the
16 * `alias/...` name of a pre-existing key) to get a callable that
17 * automatically injects the `KeyId`. Returns a fresh asymmetric key pair:
18 * the public key and plaintext private key for immediate local use, plus
19 * the private key encrypted under the bound symmetric key for storage.
20 *
21 * The `PrivateKeyPlaintext` in the response is wrapped in `Redacted` so it
22 * never leaks into logs — unwrap with `Redacted.value(...)` at the point of
23 * use and discard it as soon as the local operation is done.
24 *
25 * ### Data Key Pairs
26 * **Example:** Generate an RSA Key Pair
27 * ```typescript
28 * const generateDataKeyPair = yield* AWS.KMS.GenerateDataKeyPair(key);
29 *
30 * const pair = yield* generateDataKeyPair({ KeyPairSpec: "RSA_2048" });
31 * // pair.PublicKey — DER-encoded public key
32 * // pair.PrivateKeyPlaintext — Redacted; use locally then discard
33 * // pair.PrivateKeyCiphertextBlob — persist; recover via the Decrypt binding
34 * ```
35 *
36 * @binding
37 */
38export interface GenerateDataKeyPair extends Binding.Service<
39 GenerateDataKeyPair,
40 "AWS.KMS.GenerateDataKeyPair",
41 (
42 key: Key | AliasName,
43 ) => Effect.Effect<
44 (
45 request: GenerateDataKeyPairRequest,
46 ) => Effect.Effect<
47 kms.GenerateDataKeyPairResponse,
48 kms.GenerateDataKeyPairError
49 >
50 >
51> {}
52
53export const GenerateDataKeyPair = Binding.Service<GenerateDataKeyPair>(
54 "AWS.KMS.GenerateDataKeyPair",
55);