kms

What it is

kms.

Wrapping and unwrapping a data key is the only thing a KMS does for the harness, so it is the only thing this trait can ask. The cipher that seals a secret, the additional data that binds a ciphertext to its row, and where the wrapped key is stored all belong elsewhere — a wider trait would put those decisions behind a vendor.

The development provider refuses to construct in production. LocalFileKms uses the same real AEAD, but its master key sits on a local disk where anything that can read the file can read the key, so the environment check is in the constructor rather than in a deployment note. Managed providers — AWS KMS, Google Cloud KMS — are not implemented: they need credentials and a nightly job against the real service, and an unexercised vendor integration in this position is worse than an absent one.