1import type * as kms from "@distilled.cloud/aws/kms";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4import type { AliasName } from "./Alias.ts";
5import type { Key } from "./Key.ts";
6
7export interface GenerateDataKeyWithoutPlaintextRequest extends Omit<
8 kms.GenerateDataKeyWithoutPlaintextRequest,
9 "KeyId"
10> {}
11
12/**
13 * Runtime binding for `kms:GenerateDataKeyWithoutPlaintext`.
14 *
15 * Bind this operation to a KMS {@link Key} (or the `alias/...` name of a
16 * pre-existing key) to get a callable that automatically injects the
17 * `KeyId`. Returns ONLY the encrypted copy of a fresh data key — use it in
18 * the component that provisions envelope keys but must never see key
19 * material; the consumer decrypts the blob later with the `Decrypt` binding.
20 *
21 * ### Envelope Encryption
22 * **Example:** Provision a Data Key Without Seeing It
23 * ```typescript
24 * const generateDataKeyWithoutPlaintext =
25 * yield* AWS.KMS.GenerateDataKeyWithoutPlaintext(key);
26 *
27 * const { CiphertextBlob } = yield* generateDataKeyWithoutPlaintext({
28 * KeySpec: "AES_256",
29 * });
30 * // store CiphertextBlob next to the data; no plaintext ever existed here
31 * ```
32 *
33 * ### Pre-Existing Keys
34 * **Example:** Bind by Alias Name
35 * ```typescript
36 * const generate = yield* AWS.KMS.GenerateDataKeyWithoutPlaintext("alias/app-key");
37 * ```
38 *
39 * @binding
40 */
41export interface GenerateDataKeyWithoutPlaintext extends Binding.Service<
42 GenerateDataKeyWithoutPlaintext,
43 "AWS.KMS.GenerateDataKeyWithoutPlaintext",
44 (
45 key: Key | AliasName,
46 ) => Effect.Effect<
47 (
48 request: GenerateDataKeyWithoutPlaintextRequest,
49 ) => Effect.Effect<
50 kms.GenerateDataKeyWithoutPlaintextResponse,
51 kms.GenerateDataKeyWithoutPlaintextError
52 >
53 >
54> {}
55
56export const GenerateDataKeyWithoutPlaintext =
57 Binding.Service<GenerateDataKeyWithoutPlaintext>(
58 "AWS.KMS.GenerateDataKeyWithoutPlaintext",
59 );