pulse-proton

Proton Drive adapter for PULSE Protocol.

Store and retrieve secrets in Proton Drive using PULSE semantic messages.

Security model

Two independent encryption layers:

1. AES-256-GCM — applied by the adapter before upload (key derivation: PBKDF2-HMAC-SHA256, 600K iterations)
2. Proton Drive E2E encryption — applied by Proton at the storage layer

A compromised Proton session cannot read secret values in plaintext.

Installation

pip install pulse-proton

Credentials — environment variables only

export PROTON_USERNAME="you@proton.me"
export PROTON_PASSWORD="your-proton-password"
export PULSE_VAULT_KEY="your-strong-master-key"

Quickstart

import os
from pulse_proton import ProtonAdapter
from pulse.message import PulseMessage

adapter = ProtonAdapter(
    username=os.environ["PROTON_USERNAME"],
    password=os.environ["PROTON_PASSWORD"],
    vault_key=os.environ["PULSE_VAULT_KEY"],
)
adapter.connect()

# Store a secret
adapter.send(PulseMessage(
    action="ACT.STORE.SECRET",
    parameters={"key": "openai-api-key", "value": "sk-..."},
))

# Retrieve a secret
response = adapter.send(PulseMessage(
    action="ACT.GET.SECRET",
    parameters={"key": "openai-api-key"},
))
print(response.content["parameters"]["value"])  # sk-...

# List all secrets
response = adapter.send(PulseMessage(action="ACT.LIST.SECRETS", parameters={}))
print(response.content["parameters"]["keys"])  # ["openai-api-key", ...]

# Delete a secret
adapter.send(PulseMessage(
    action="ACT.DELETE.SECRET",
    parameters={"key": "openai-api-key"},
))

adapter.disconnect()

Supported PULSE actions

Storage format

Each secret is stored as <key>.json in a dedicated Drive folder (pulse-secrets by default):

{
  "key": "openai-api-key",
  "value": "<AES-256-GCM encrypted, base64>",
  "created_at": "2026-04-03T12:00:00+00:00",
  "tags": {"env": "prod"}
}

License

Apache 2.0