1import type * as kms from "@distilled.cloud/aws/kms";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4import type { AliasName } from "./Alias.ts";
5import type { Key } from "./Key.ts";
6
7export interface SignRequest extends Omit<kms.SignRequest, "KeyId"> {}
8
9/**
10 * Runtime binding for `kms:Sign`.
11 *
12 * Bind this operation to an asymmetric SIGN_VERIFY KMS {@link Key} (or the
13 * `alias/...` name of a pre-existing key) to get a callable that
14 * automatically injects the `KeyId`. The private key never leaves KMS — the
15 * signature is produced inside the HSM.
16 *
17 * ### Signing
18 * **Example:** Sign a Message
19 * ```typescript
20 * const sign = yield* AWS.KMS.Sign(signingKey);
21 *
22 * const { Signature } = yield* sign({
23 * Message: new TextEncoder().encode("release-manifest-v1"),
24 * SigningAlgorithm: "ECDSA_SHA_256",
25 * });
26 * ```
27 *
28 * **Example:** Sign a Pre-Computed Digest
29 * ```typescript
30 * // For payloads larger than 4096 bytes, hash locally and sign the digest.
31 * const { Signature } = yield* sign({
32 * Message: sha256Digest,
33 * MessageType: "DIGEST",
34 * SigningAlgorithm: "ECDSA_SHA_256",
35 * });
36 * ```
37 *
38 * @binding
39 */
40export interface Sign extends Binding.Service<
41 Sign,
42 "AWS.KMS.Sign",
43 (
44 key: Key | AliasName,
45 ) => Effect.Effect<
46 (request: SignRequest) => Effect.Effect<kms.SignResponse, kms.SignError>
47 >
48> {}
49
50export const Sign = Binding.Service<Sign>("AWS.KMS.Sign");