What it is
kms.
Wrapping and unwrapping a data key is the only thing a KMS does for the harness, so it is the only thing this trait can ask. The cipher that seals a secret, the additional data that binds a ciphertext to its row, and where the wrapped key is stored all belong elsewhere — a wider trait would put those decisions behind a vendor.
The development provider refuses to construct in production. LocalFileKms uses the same real AEAD, but its master key sits on a local disk where anything that can read the file can read the key, so the environment check is in the constructor rather than in a deployment note. Managed providers — AWS KMS, Google Cloud KMS — are not implemented: they need credentials and a nightly job against the real service, and an unexercised vendor integration in this position is worse than an absent one.
Ports
trait — implemented by a provider
History
Changelog.
This crate has no CHANGELOG.md in the harness yet. Every published version is listed on crates.io.
Used by secrets, and by nothing else that has to know what a key is.