daz-secrets Python SDK

daz-secrets is the typed synchronous Python client for daz-secrets protocol v1.0. Each operation launches one explicitly configured provider executable, exchanges one canonical CBOR frame over standard input/output, and terminates. Secret values are always bytes; revisions are opaque strings used unchanged for compare-and-set operations.

Python 3.11 or newer is required. The package has no runtime dependencies.

from daz_secrets import Client, DazSecretsError, ErrorCode

client = Client()
created = client.set("service", "account", b"binary value")
current = client.get("service", "account")
client.delete("service", "account", expected_revision=created.revision)

The default client reads only .config/daz-secrets/provider.toml beneath the home directory returned by the OS account database. It ignores HOME, PATH, and every provider/config override from the environment. An explicit ClientConfig is intended for isolated integrations.

Cancellation is supported with a threading.Event passed as cancel=. The configured timeout remains the shared upper bound across primary and fallback attempts.

Development uses only the package-local virtual environment:

./run format
./run lint
./run typecheck
./run test
./run build
./run check

check runs formatting verification, lint, strict type checking, the complete real-provider conformance suite, and source/wheel builds with warnings promoted to errors.