| 1 | import type * as paymentcryptographydata from "@distilled.cloud/aws/payment-cryptography-data"; |
| 2 | import type * as Effect from "effect/Effect"; |
| 3 | import * as Binding from "../../Binding.ts"; |
| 4 | import type { Key } from "./Key.ts"; |
| 5 | |
| 6 | export interface TranslateKeyMaterialRequest |
| 7 | extends paymentcryptographydata.TranslateKeyMaterialInput {} |
| 8 | |
| 9 | /** |
| 10 | * Runtime binding for `payment-cryptography:TranslateKeyMaterial` — |
| 11 | * translates an ECDH-derived TR-31 wrapped key block into a TR-31 key block |
| 12 | * wrapped under a Key Encryption Key, without importing the short-lived key |
| 13 | * into the service. The key identifiers live in nested request structures |
| 14 | * (`IncomingKeyMaterial.DiffieHellmanTr31KeyBlock.PrivateKeyIdentifier`, |
| 15 | * `OutgoingKeyMaterial.Tr31KeyBlock.WrappingKeyIdentifier`), so the caller |
| 16 | * supplies the full request; bind every {@link Key} the request references |
| 17 | * so the Function is granted the action on each. Provide |
| 18 | * `TranslateKeyMaterialHttp` on the Function to satisfy this service. |
| 19 | * ### Key Material Translation |
| 20 | * **Example:** Translate an ECDH-wrapped key to a KEK-wrapped TR-31 block |
| 21 | * ```typescript |
| 22 | * // init — grant on every key the request references |
| 23 | * const translateKeyMaterial = |
| 24 | * yield* PaymentCryptography.TranslateKeyMaterial(ecdhPrivateKey, caKey, kek); |
| 25 | * const ecdhPrivateKeyArn = yield* ecdhPrivateKey.keyArn; |
| 26 | * const caKeyArn = yield* caKey.keyArn; |
| 27 | * const kekArn = yield* kek.keyArn; |
| 28 | * |
| 29 | * // runtime |
| 30 | * const translated = yield* translateKeyMaterial({ |
| 31 | * IncomingKeyMaterial: { |
| 32 | * DiffieHellmanTr31KeyBlock: { |
| 33 | * PrivateKeyIdentifier: yield* ecdhPrivateKeyArn, |
| 34 | * CertificateAuthorityPublicKeyIdentifier: yield* caKeyArn, |
| 35 | * // ... |
| 36 | * }, |
| 37 | * }, |
| 38 | * OutgoingKeyMaterial: { Tr31KeyBlock: { WrappingKeyIdentifier: yield* kekArn } }, |
| 39 | * }); |
| 40 | * ``` |
| 41 | * |
| 42 | * @binding |
| 43 | */ |
| 44 | export interface TranslateKeyMaterial extends Binding.Service< |
| 45 | TranslateKeyMaterial, |
| 46 | "AWS.PaymentCryptography.TranslateKeyMaterial", |
| 47 | ( |
| 48 | ...keys: readonly [Key, ...Key[]] |
| 49 | ) => Effect.Effect< |
| 50 | ( |
| 51 | request: TranslateKeyMaterialRequest, |
| 52 | ) => Effect.Effect< |
| 53 | paymentcryptographydata.TranslateKeyMaterialOutput, |
| 54 | paymentcryptographydata.TranslateKeyMaterialError |
| 55 | > |
| 56 | > |
| 57 | > {} |
| 58 | |
| 59 | export const TranslateKeyMaterial = Binding.Service<TranslateKeyMaterial>( |
| 60 | "AWS.PaymentCryptography.TranslateKeyMaterial", |
| 61 | ); |