[freshtonic]

Summary

Each key vendor client wrote its vendor's name again as a string constant ("aws-kms", …), although KeyVendor::name() is the one spelling. The backend errors took any &'static str, so the Go guest could, and did, report an invented vendor called "none". The Go SDK kept its own copy of the names too. This PR makes the vendor a typed value everywhere, so a name cannot drift or be invented.

Changes

• stack-kms: Error::Backend now holds backend: KeyBackend (was vendor: &'static str), and Error::ZeroKmsOnly holds a KeyVendor. New KeyVendor::from_name and From<KeyVendor> for KeyBackend.
• The five vendor clients use KeyVendor for their VENDOR constant.
• Go guest config reads vendor names with from_name.
• Go SDK: one keyVendorNames table. New TestKeyVendorNamesMatchTheGuest pins each name and byte to the guest, so drift on either side fails the test.
• Changeset: @cipherstash/auth patch.

Behaviour changes

• The vendor field in error payloads and the message text do not change.
• Breaking (Rust API, unpublished): the Error::Backend field rename and type change.
• The guest's call into its empty vendor (unreachable) is now Error::Unexpected (STATUS_KMS_OTHER), not a backend error that named "none".

Verification

Run on the top branch of this stack (james/kms-vendor-dispatch), on macOS:

• cargo fmt --all --check and cargo clippy --workspace --all-features --all-targets -- -D warnings: pass.
• mise x --env test -- cargo nextest run --workspace --all-features: 1401 of 1402 pass. The one failure is stack-encrypt::ui derive_diagnostics (trybuild). It fails on every snapshot because of a local rustc wrapper that changes the paths in the compiler output. This stack does not touch stack-encrypt. CI is the check for it.
• mise run wasm:guest:test: 80 of 80 pass.
• All four Go guests rebuilt, then go vet ./... and go test -count=1 ./... in languages/golang: pass.
• pnpm --filter @cipherstash/auth test: 92 pass. pnpm --filter stash test: 1667 pass.
• Biome on the changed TypeScript and script files: no errors.
• cargo check of the workspace and the guest (native and wasm32-wasip1) on each branch of the stack: pass.

Related

Refs #1541. Code-smell follow-up to the key vendor backend stack.

[changeset-bot]

🦋 Changeset detected

Latest commit: 30c45f2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 19 packages

Name	Type
@cipherstash/auth	Patch
stash	Patch
@cipherstash/stack	Patch
@cipherstash/wizard	Patch
@cipherstash/ffi-integration-tests	Patch
@cipherstash/basic-example	Patch
@cipherstash/e2e	Patch
@cipherstash/bench	Patch
@cipherstash/stack-drizzle	Patch
@cipherstash/stack-prisma	Patch
@cipherstash/stack-supabase	Patch
@cipherstash/test-kit	Patch
@cipherstash/prisma-example	Patch
@cipherstash/auth-darwin-arm64	Patch
@cipherstash/auth-darwin-x64	Patch
@cipherstash/auth-linux-arm64-gnu	Patch
@cipherstash/auth-linux-x64-gnu	Patch
@cipherstash/auth-linux-x64-musl	Patch
@cipherstash/auth-win32-x64-msvc	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

[github-actions]

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

No mutants were generated for the changed lines.

[freshtonic]

Folded into #1522 (the typed KeyVendor in Error::Backend) and into each vendor PR.

The plan is docs/plans/2026-11-12-key-vendor-backends-scope-reduction.md, and the decision log (docs/plans/2026-11-05-key-vendor-backends-decisions.md, "Scope reduction") records what changed. The old branch tip is kept locally as refs/backup/2026-11-12/<branch>.