1import type * as kms from "@distilled.cloud/aws/kms";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4import type { AliasName } from "./Alias.ts";
5import type { Key } from "./Key.ts";
6
7export interface DeriveSharedSecretRequest extends Omit<
8 kms.DeriveSharedSecretRequest,
9 "KeyId"
10> {}
11
12/**
13 * Runtime binding for `kms:DeriveSharedSecret`.
14 *
15 * Bind this operation to a KEY_AGREEMENT KMS {@link Key} (or the `alias/...`
16 * name of a pre-existing key) to get a callable that automatically injects
17 * the `KeyId`. Runs ECDH between the bound key's private key (inside KMS)
18 * and a peer's public key, returning the raw shared secret for use with a
19 * key-derivation function.
20 *
21 * The `SharedSecret` in the response is wrapped in `Redacted` so it never
22 * leaks into logs — unwrap with `Redacted.value(...)` at the point of use.
23 *
24 * ### Key Agreement
25 * **Example:** Derive a Shared Secret
26 * ```typescript
27 * const deriveSharedSecret = yield* AWS.KMS.DeriveSharedSecret(agreementKey);
28 *
29 * const { SharedSecret } = yield* deriveSharedSecret({
30 * KeyAgreementAlgorithm: "ECDH",
31 * PublicKey: peerPublicKeyDer, // DER-encoded SubjectPublicKeyInfo
32 * });
33 * ```
34 *
35 * @binding
36 */
37export interface DeriveSharedSecret extends Binding.Service<
38 DeriveSharedSecret,
39 "AWS.KMS.DeriveSharedSecret",
40 (
41 key: Key | AliasName,
42 ) => Effect.Effect<
43 (
44 request: DeriveSharedSecretRequest,
45 ) => Effect.Effect<
46 kms.DeriveSharedSecretResponse,
47 kms.DeriveSharedSecretError
48 >
49 >
50> {}
51
52export const DeriveSharedSecret = Binding.Service<DeriveSharedSecret>(
53 "AWS.KMS.DeriveSharedSecret",
54);