1import type * as kms from "@distilled.cloud/aws/kms";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4import type { AliasName } from "./Alias.ts";
5import type { Key } from "./Key.ts";
6
7export interface ReEncryptRequest extends Omit<
8 kms.ReEncryptRequest,
9 "DestinationKeyId" | "SourceKeyId"
10> {}
11
12/**
13 * Runtime binding for `kms:ReEncrypt`.
14 *
15 * Re-encrypts a ciphertext under a new key (or a new encryption context)
16 * entirely inside KMS — the plaintext never leaves the service. Bind the
17 * destination KMS {@link Key} (or `alias/...` name), and optionally the
18 * source key when migrating ciphertexts between keys:
19 *
20 * - `ReEncrypt(key)` — same-key re-encryption (e.g. rotating the encryption
21 * context). Grants `kms:ReEncryptFrom` + `kms:ReEncryptTo` on the key.
22 * - `ReEncrypt(destination, source)` — cross-key migration. Grants
23 * `kms:ReEncryptTo` on the destination and `kms:ReEncryptFrom` on the
24 * source, and pins `SourceKeyId` in every request.
25 *
26 * ### Re-Encryption
27 * **Example:** Rotate the Encryption Context In Place
28 * ```typescript
29 * const reEncrypt = yield* AWS.KMS.ReEncrypt(key);
30 *
31 * const { CiphertextBlob } = yield* reEncrypt({
32 * CiphertextBlob: ciphertext,
33 * SourceEncryptionContext: { tenant: "alpha" },
34 * DestinationEncryptionContext: { tenant: "beta" },
35 * });
36 * ```
37 *
38 * **Example:** Migrate Ciphertexts to a New Key
39 * ```typescript
40 * const reEncrypt = yield* AWS.KMS.ReEncrypt(newKey, oldKey);
41 *
42 * const { CiphertextBlob } = yield* reEncrypt({
43 * CiphertextBlob: legacyCiphertext,
44 * });
45 * ```
46 *
47 * @binding
48 */
49export interface ReEncrypt extends Binding.Service<
50 ReEncrypt,
51 "AWS.KMS.ReEncrypt",
52 (
53 destination: Key | AliasName,
54 source?: Key | AliasName,
55 ) => Effect.Effect<
56 (
57 request: ReEncryptRequest,
58 ) => Effect.Effect<kms.ReEncryptResponse, kms.ReEncryptError>
59 >
60> {}
61
62export const ReEncrypt = Binding.Service<ReEncrypt>("AWS.KMS.ReEncrypt");