Metadata-Version: 2.4
Name: daz-secrets
Version: 0.1.0a1
Summary: Strict process-isolated client SDK for the daz-secrets protocol
Project-URL: Homepage, https://github.com/darrenoakey/daz-secrets
Project-URL: Repository, https://github.com/darrenoakey/daz-secrets
Project-URL: Issues, https://github.com/darrenoakey/daz-secrets/issues
Author-email: Darren Oakey <darren@insidemind.com.au>
License-Expression: MIT
License-File: LICENSE
Keywords: cbor,credentials,process-isolation,secrets
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: POSIX
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Typing :: Typed
Requires-Python: >=3.11
Provides-Extra: dev
Requires-Dist: build<2,>=1.3; extra == 'dev'
Requires-Dist: mypy<2,>=1.17; extra == 'dev'
Requires-Dist: pytest<10,>=8.4; extra == 'dev'
Requires-Dist: ruff<1,>=0.12; extra == 'dev'
Requires-Dist: twine<7,>=6; extra == 'dev'
Description-Content-Type: text/markdown

# daz-secrets Python SDK

`daz-secrets` is the typed synchronous Python client for daz-secrets protocol
v1.0. Each operation launches one explicitly configured provider executable,
exchanges one canonical CBOR frame over standard input/output, and terminates.
Secret values are always `bytes`; revisions are opaque strings used unchanged
for compare-and-set operations.

Python 3.11 or newer is required. The package has no runtime dependencies.

```python
from daz_secrets import Client, DazSecretsError, ErrorCode

client = Client()
created = client.set("service", "account", b"binary value")
current = client.get("service", "account")
client.delete("service", "account", expected_revision=created.revision)
```

The default client reads only
`.config/daz-secrets/provider.toml` beneath the home directory returned by the
OS account database. It ignores `HOME`, `PATH`, and every provider/config
override from the environment. An explicit `ClientConfig` is intended for
isolated integrations.

Cancellation is supported with a `threading.Event` passed as `cancel=`. The
configured timeout remains the shared upper bound across primary and fallback
attempts.

Development uses only the package-local virtual environment:

```console
./run format
./run lint
./run typecheck
./run test
./run build
./run check
```

`check` runs formatting verification, lint, strict type checking, the complete
real-provider conformance suite, and source/wheel builds with warnings promoted
to errors.
