1import type * as kms from "@distilled.cloud/aws/kms";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4import type { AliasName } from "./Alias.ts";
5import type { Key } from "./Key.ts";
6
7export interface GenerateDataKeyPairWithoutPlaintextRequest extends Omit<
8 kms.GenerateDataKeyPairWithoutPlaintextRequest,
9 "KeyId"
10> {}
11
12/**
13 * Runtime binding for `kms:GenerateDataKeyPairWithoutPlaintext`.
14 *
15 * Bind this operation to a symmetric-encryption KMS {@link Key} (or the
16 * `alias/...` name of a pre-existing key) to get a callable that
17 * automatically injects the `KeyId`. Returns the public key and the private
18 * key encrypted under the bound symmetric key — the plaintext private key
19 * never exists in this process; decrypt the blob later with the `Decrypt`
20 * binding where it is actually needed.
21 *
22 * ### Data Key Pairs
23 * **Example:** Provision a Key Pair Without the Private Key
24 * ```typescript
25 * const generatePair = yield* AWS.KMS.GenerateDataKeyPairWithoutPlaintext(key);
26 *
27 * const pair = yield* generatePair({ KeyPairSpec: "ECC_NIST_P256" });
28 * // pair.PublicKey — hand out for encryption/verification
29 * // pair.PrivateKeyCiphertextBlob — persist for the consuming service
30 * ```
31 *
32 * @binding
33 */
34export interface GenerateDataKeyPairWithoutPlaintext extends Binding.Service<
35 GenerateDataKeyPairWithoutPlaintext,
36 "AWS.KMS.GenerateDataKeyPairWithoutPlaintext",
37 (
38 key: Key | AliasName,
39 ) => Effect.Effect<
40 (
41 request: GenerateDataKeyPairWithoutPlaintextRequest,
42 ) => Effect.Effect<
43 kms.GenerateDataKeyPairWithoutPlaintextResponse,
44 kms.GenerateDataKeyPairWithoutPlaintextError
45 >
46 >
47> {}
48
49export const GenerateDataKeyPairWithoutPlaintext =
50 Binding.Service<GenerateDataKeyPairWithoutPlaintext>(
51 "AWS.KMS.GenerateDataKeyPairWithoutPlaintext",
52 );