pulse-proton 0.1.0

Proton Drive adapter for PULSE Protocol — store and retrieve secrets via Proton Drive

pulse-proton

Proton Drive adapter for PULSE Protocol.

Store and retrieve secrets in Proton Drive using PULSE semantic messages.

Security model

Two independent encryption layers:

1. AES-256-GCM — applied by the adapter before upload (key derivation: PBKDF2-HMAC-SHA256, 600K iterations)
2. Proton Drive E2E encryption — applied by Proton at the storage layer

A compromised Proton session cannot read secret values in plaintext.

Installation

pip install pulse-proton

Credentials — environment variables only

export PROTON_USERNAME="[e-mail]"
export PROTON_PASSWORD="your-proton-password"
export PULSE_VAULT_KEY="your-strong-master-key"

Quickstart

import os
from pulse_proton import ProtonAdapter
from pulse.message import PulseMessage

adapter = ProtonAdapter(
    username=os.environ["PROTON_USERNAME"],
    password=os.environ["PROTON_PASSWORD"],
    vault_key=os.environ["PULSE_VAULT_KEY"],
)
adapter.connect()

# Store a secret
adapter.send(PulseMessage(
    action="ACT.STORE.SECRET",
    parameters={"key": "openai-api-key", "value": "sk-..."},
))

# Retrieve a secret
response = adapter.send(PulseMessage(
    action="ACT.GET.SECRET",
    parameters={"key": "openai-api-key"},
))
print(response.content["parameters"]["value"])  # sk-...

# List all secrets
response = adapter.send(PulseMessage(action="ACT.LIST.SECRETS", parameters={}))
print(response.content["parameters"]["keys"])  # ["openai-api-key", ...]

# Delete a secret
adapter.send(PulseMessage(
    action="ACT.DELETE.SECRET",
    parameters={"key": "openai-api-key"},
))

adapter.disconnect()

Supported PULSE actions

Action	Parameters	Description
ACT.STORE.SECRET	key, value, tags?	Encrypt and upload to Proton Drive
ACT.GET.SECRET	key	Download and decrypt from Proton Drive
ACT.DELETE.SECRET	key	Remove secret file from Proton Drive
ACT.LIST.SECRETS	—	List all stored secret keys

Storage format

Each secret is stored as <key>.json in a dedicated Drive folder (pulse-secrets by default):

{
  "key": "openai-api-key",
  "value": "<AES-256-GCM encrypted, base64>",
  "created_at": "2026-04-03T12:00:00+00:00",
  "tags": {"env": "prod"}
}

License

Apache 2.0