cayu.vaults.composite

Public Cayu API. Definitions are grouped by their public source module, and definitions from private implementation modules appear on their package’s page; adding a symbol does not move existing links. The import shown at each entry is a supported public namespace. Read the Python API overview and install the required extra.

ChainVault

from cayu.vaults import ChainVault

Try each vault in order; the first that resolves the secret wins.

A vault that does not have the secret raises SecretNotFound and the chain moves on. Any other error (for example a network failure from a dynamic vault) propagates, so it is not silently masked by a later vault in the chain.

Note that a child which reports a configured but currently unavailable secret as SecretNotFound (for example LocalEnvVault when the mapped environment variable is unset) also triggers fall-through, so a chain will not surface that misconfiguration as an error. Use RoutedVault (or order the authoritative vault so it cannot be skipped) when a specific secret must come from one vault.

Bases: Vault.

get (method)

async ChainVault.get(name: str, *, scope: dict[str, Any] | None=None) -> SecretRef

resolve (method)

async ChainVault.resolve(ref: SecretRef, *, scope: dict[str, Any] | None=None) -> ResolvedSecret

init (method)

ChainVault.__init__(*vaults: Vault) -> None

Release source · Runtime guarantees · Capability guides

RoutedVault

from cayu.vaults import RoutedVault

Route secret names to specific vaults, with an optional fallback for the rest.

Unlike ChainVault, routing is explicit: each name maps to exactly one vault, so a dynamic vault is only called for the names it owns. Names not in routes go to fallback (typically a static vault); with no route and no fallback, the lookup raises SecretNotFound without calling any vault.

Bases: Vault.

get (method)

async RoutedVault.get(name: str, *, scope: dict[str, Any] | None=None) -> SecretRef

resolve (method)

async RoutedVault.resolve(ref: SecretRef, *, scope: dict[str, Any] | None=None) -> ResolvedSecret

init (method)

RoutedVault.__init__(routes: Mapping[str, Vault], *, fallback: Vault | None=None) -> None

Release source · Runtime guarantees · Capability guides