import type * as kms from "@distilled.cloud/aws/kms";
import type * as Effect from "effect/Effect";
import * as Binding from "../../Binding.ts";
import type { AliasName } from "./Alias.ts";
import type { Key } from "./Key.ts";
export interface GenerateDataKeyPairRequest extends Omit<kms.GenerateDataKeyPairRequest, "KeyId"> {
}
/**
 * Runtime binding for `kms:GenerateDataKeyPair`.
 *
 * Bind this operation to a symmetric-encryption KMS {@link Key} (or the
 * `alias/...` name of a pre-existing key) to get a callable that
 * automatically injects the `KeyId`. Returns a fresh asymmetric key pair:
 * the public key and plaintext private key for immediate local use, plus
 * the private key encrypted under the bound symmetric key for storage.
 *
 * The `PrivateKeyPlaintext` in the response is wrapped in `Redacted` so it
 * never leaks into logs — unwrap with `Redacted.value(...)` at the point of
 * use and discard it as soon as the local operation is done.
 *
 * ### Data Key Pairs
 * **Example:** Generate an RSA Key Pair
 * ```typescript
 * const generateDataKeyPair = yield* AWS.KMS.GenerateDataKeyPair(key);
 *
 * const pair = yield* generateDataKeyPair({ KeyPairSpec: "RSA_2048" });
 * // pair.PublicKey            — DER-encoded public key
 * // pair.PrivateKeyPlaintext  — Redacted; use locally then discard
 * // pair.PrivateKeyCiphertextBlob — persist; recover via the Decrypt binding
 * ```
 *
 * @binding
 */
export interface GenerateDataKeyPair extends Binding.Service<GenerateDataKeyPair, "AWS.KMS.GenerateDataKeyPair", (key: Key | AliasName) => Effect.Effect<(request: GenerateDataKeyPairRequest) => Effect.Effect<kms.GenerateDataKeyPairResponse, kms.GenerateDataKeyPairError>>> {
}
export declare const GenerateDataKeyPair: GenerateDataKeyPair;
//# sourceMappingURL=GenerateDataKeyPair.d.ts.map