cayu.vaults.base

Public Cayu API. Definitions are grouped by their public source module, and definitions from private implementation modules appear on their package’s page; adding a symbol does not move existing links. The import shown at each entry is a supported public namespace. Read the Python API overview and install the required extra.

`copy_resolved_secret`

from cayu.vaults import copy_resolved_secret

copy_resolved_secret(secret: ResolvedSecret) -> ResolvedSecret

Release source · Runtime guarantees · Capability guides

`copy_secret_env`

from cayu.vaults import copy_secret_env

copy_secret_env(secret_env: SecretEnv) -> SecretEnv

Release source · Runtime guarantees · Capability guides

`copy_secret_ref`

from cayu.vaults import copy_secret_ref

copy_secret_ref(ref: SecretRef) -> SecretRef

Release source · Runtime guarantees · Capability guides

`resolve_secret_env`

from cayu.vaults import resolve_secret_env

Resolve declared secret environment entries to injection-ready values.

The returned values stay wrapped in ResolvedSecret (SecretStr) so callers unwrap them only at the last moment before injection and can feed the same values into a SecretRedactor for output scrubbing.

async resolve_secret_env(secret_env: Sequence[SecretEnv] | Mapping[str, SecretRef], resolver: SecretResolver, *, scope: dict[str, Any] | None=None) -> dict[str, ResolvedSecret]

Release source · Runtime guarantees · Capability guides

`ResolvedSecret`

from cayu.vaults import ResolvedSecret

Resolved secret value for runtime injection only.

value uses SecretStr so accidental dumps/logs do not reveal the raw secret. Runtime code must explicitly call get_secret_value() at the last possible moment before injecting into a tool/runner environment.

Bases: BaseModel.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
`name`	`str`	`required`
`value`	`SecretStr`	`required`
`metadata`	`dict[str, Any]`	`Field(default_factory=dict)`

copy_metadata (method)

ResolvedSecret.copy_metadata(value: dict[str, Any]) -> dict[str, Any]

validate_nonblank_name (method)

ResolvedSecret.validate_nonblank_name(value: str, info) -> str

validate_nonblank_value (method)

ResolvedSecret.validate_nonblank_value(value: SecretStr, info) -> SecretStr

Release source · Runtime guarantees · Capability guides

`secret_env_refs`

from cayu.vaults import secret_env_refs

Normalize declared secret environment entries to name -> SecretRef.

Accepts either a sequence of SecretEnv entries or a plain {env_var_name: SecretRef} mapping. Duplicate environment variable names are rejected because injection would silently drop one secret.

secret_env_refs(secret_env: Sequence[SecretEnv] | Mapping[str, SecretRef]) -> dict[str, SecretRef]

Release source · Runtime guarantees · Capability guides

`SecretEnv`

from cayu.vaults import SecretEnv

Environment variable whose value must be resolved from a secret ref.

Bases: BaseModel.

Fields and attributes

Name	Type	Default
`name`	`str`	`required`
`ref`	`SecretRef`	`required`
`metadata`	`dict[str, Any]`	`Field(default_factory=dict)`

copy_metadata (method)

SecretEnv.copy_metadata(value: dict[str, Any]) -> dict[str, Any]

validate_nonblank_name (method)

SecretEnv.validate_nonblank_name(value: str, info) -> str

copy_ref (method)

SecretEnv.copy_ref(value: SecretRef) -> SecretRef

Release source · Runtime guarantees · Capability guides

`SecretNotFound`

from cayu.vaults import SecretNotFound

Raised when a vault cannot resolve a requested secret.

Bases: VaultError.

This type’s implementation and inherited behavior are available in the linked release source.

Release source · Runtime guarantees · Capability guides

`SecretRef`

from cayu.vaults import SecretRef

Reference to a secret value.

The raw value should be injected into tools/runners by the runtime and should not be placed in model prompt text.

Bases: BaseModel.

Fields and attributes

Name	Type	Default
`name`	`str`	`required`
`handle`	`str \| None`	`None`
`metadata`	`dict[str, Any]`	`Field(default_factory=dict)`

copy_metadata (method)

SecretRef.copy_metadata(value: dict[str, Any]) -> dict[str, Any]

validate_nonblank_name (method)

SecretRef.validate_nonblank_name(value: str, info) -> str

validate_nonblank_handle (method)

SecretRef.validate_nonblank_handle(value: str | None, info) -> str | None

Release source · Runtime guarantees · Capability guides

`SecretResolver`

from cayu.vaults import SecretResolver

Async credential source shared by Vault and CredentialProxy.

Anything with an async resolve(ref, *, scope=None) -> ResolvedSecret method satisfies this seam, so runners, MCP clients, and providers can consume secrets from a vault directly or through a credential proxy.

Decorators: @runtime_checkable.

Bases: Protocol.

resolve (method)

async SecretResolver.resolve(ref: SecretRef, *, scope: dict[str, Any] | None=None) -> ResolvedSecret

Release source · Runtime guarantees · Capability guides

`validate_secret_resolver`

from cayu.vaults import validate_secret_resolver

Reject objects that cannot asynchronously resolve secret references.

validate_secret_resolver(resolver: object, field_name: str='secret_resolver') -> None

Release source · Runtime guarantees · Capability guides

`Vault`

from cayu.vaults import Vault

Secrets lookup contract.

Bases: ABC.

get (method)

async Vault.get(name: str, *, scope: dict[str, Any] | None=None) -> SecretRef

Resolve a secret reference.

resolve (method)

async Vault.resolve(ref: SecretRef, *, scope: dict[str, Any] | None=None) -> ResolvedSecret

Resolve a secret reference to a masked value for runtime injection.

Release source · Runtime guarantees · Capability guides

`VaultError`

from cayu.vaults import VaultError

Base error for vault resolution failures.

Bases: RuntimeError.

This type’s implementation and inherited behavior are available in the linked release source.

Release source · Runtime guarantees · Capability guides