dotvault 0.24.0__py3-none-win_amd64.whl

dotvault/__init__.py

@@ -0,0 +1,256 @@
+"""dotvault — Python bindings for the dotvault public client API.
+
+This package lets a Python program read the per-user secrets a dotvault daemon
+enrolled and keeps current, talking to the same Vault, resolving a token the
+same way, and reading from the exact ``kv/users/<user>/...`` path dotvault
+writes to. It is a thin ctypes wrapper over dotvault's Go client compiled to a
+shared library, so the connectivity, token precedence, and identity convention
+all come from the one canonical Go implementation rather than being re-derived
+in Python.
+
+The surface is the read-only + cached-auth subset of the Go facade:
+
+    import dotvault
+
+    with dotvault.Client() as c:           # default config path, OS-user identity
+        c.authenticate_cached(timeout=5)   # env -> token file; never prompts
+        token = c.read_user_secret("gh", "oauth_token")
+
+Authentication never prompts: it resolves ``DOTVAULT_TOKEN`` then the token
+file and validates it. If no usable token is present it raises ``LoginRequired``
+— provision one with ``dotvault login`` (or let the daemon do it). Interactive
+browser/terminal login is deliberately out of scope for these bindings.
+
+Identity is the OS user, not the Vault token: by default the ``<user>`` path
+segment is the OS account the process runs as. A process running as a different
+user (a service, a container) must pass ``identity=`` to read another user's
+secrets. See the package README for the full rationale.
+"""
+
+from __future__ import annotations
+
+from ctypes import byref, c_int, c_longlong, c_void_p
+
+from . import _ffi
+from ._errors import (
+    CAT_OK,
+    AuthFailed,
+    Denied,
+    DotvaultError,
+    LoginRequired,
+    Unreachable,
+    error_for,
+)
+
+__all__ = [
+    "Client",
+    "default_config_path",
+    "DotvaultError",
+    "LoginRequired",
+    "AuthFailed",
+    "Denied",
+    "Unreachable",
+    "__version__",
+]
+
+# Resolve the installed distribution's version (baked in at build time by
+# setuptools-scm from the repo's git tags). Running from an uninstalled source
+# tree — e.g. the test suite, which adds src/ to sys.path without installing —
+# has no metadata, so fall back to a sentinel rather than failing import.
+try:
+    from importlib.metadata import PackageNotFoundError, version as _pkg_version
+
+    __version__ = _pkg_version("dotvault")
+except PackageNotFoundError:
+    __version__ = "0.0.0+unknown"
+
+# Sentinel handle for a closed/never-opened client. The bridge never issues 0.
+_CLOSED = 0
+
+
+def default_config_path() -> str:
+    """Return dotvault's platform default system-config path.
+
+    The same file the daemon loads — ``/etc/xdg/dotvault/config.yaml`` on Linux
+    (honouring ``XDG_CONFIG_DIRS``), ``%ProgramData%\\dotvault\\config.yaml`` on
+    Windows (or the GPO registry when policy keys are present), Application
+    Support on macOS.
+    """
+    return _ffi.take_str(_ffi.lib.dotvault_default_config_path()) or ""
+
+
+def _millis(timeout: float | None) -> int:
+    """Convert a seconds timeout to whole milliseconds.
+
+    ``None`` means no deadline (-> 0). A positive ``timeout`` is truncated to
+    whole milliseconds; note that a sub-millisecond or non-positive value also
+    yields 0, which the bridge treats as "no deadline" — so a 0.0004s timeout
+    is effectively unbounded. Pass at least 0.001 for a real deadline.
+    """
+    if timeout is None:
+        return 0
+    ms = int(timeout * 1000)
+    return ms if ms > 0 else 0
+
+
+def _check(code: int, err_ptr: c_void_p) -> None:
+    """Raise the mapped exception for a non-OK category, consuming the message."""
+    message = _ffi.take_str(err_ptr)
+    if code != CAT_OK:
+        raise error_for(code, message)
+
+
+class Client:
+    """A connection to dotvault's Vault, following dotvault's own conventions.
+
+    Construction loads dotvault's system config and builds the underlying Vault
+    client; it performs no network call and does not authenticate. Call
+    :meth:`authenticate_cached` before reading.
+
+    Args:
+        config_path: Path to dotvault's system config. ``None`` uses
+            :func:`default_config_path`.
+        identity: Override for the ``<user>`` path segment. ``None`` derives it
+            from the OS account (the common case — a per-user daemon). Set it
+            explicitly when the process runs as a different OS user than the
+            dotvault that wrote the secrets.
+
+    Use as a context manager, or call :meth:`close` to release the native
+    handle deterministically. The object is also cleaned up on GC.
+    """
+
+    def __init__(self, config_path: str | None = None, identity: str | None = None) -> None:
+        err = c_void_p()
+        handle = _ffi.lib.dotvault_client_new(
+            _ffi.encode(config_path), _ffi.encode(identity), byref(err)
+        )
+        if handle == _CLOSED:
+            # Config-load/validation failures are not facade sentinels; the
+            # bridge returns 0 with the detail in the error string.
+            raise DotvaultError(_ffi.take_str(err) or "dotvault: failed to create client")
+        self._handle = handle
+
+    def authenticate_cached(self, timeout: float | None = None) -> None:
+        """Resolve and validate a cached token; never prompts.
+
+        Resolves ``DOTVAULT_TOKEN`` then the configured token file and validates
+        it against Vault. Returns ``None`` on success.
+
+        Raises:
+            LoginRequired: No usable cached token.
+            Unreachable: Vault could not be reached to validate the token.
+            DotvaultError: The client handle is invalid (use-after-close).
+        """
+        self._require_open()
+        err = c_void_p()
+        code = _ffi.lib.dotvault_authenticate_cached(self._handle, _millis(timeout), byref(err))
+        _check(code, err)
+
+    def identity_name(self) -> str:
+        """Return the ``<user>`` path segment (the OS user, or the override).
+
+        No Vault call — a local OS lookup. This is the value
+        :meth:`read_user_secret` composes paths with.
+        """
+        self._require_open()
+        out = c_void_p()
+        err = c_void_p()
+        code = _ffi.lib.dotvault_identity_name(self._handle, byref(out), byref(err))
+        _check(code, err)
+        return _ffi.take_str(out) or ""
+
+    def token(self) -> str:
+        """Return the Vault token the client currently holds, or ``""``.
+
+        Useful to hand the same token to other Vault-aware tooling. Empty until
+        a successful :meth:`authenticate_cached`.
+        """
+        self._require_open()
+        out = c_void_p()
+        err = c_void_p()
+        code = _ffi.lib.dotvault_token(self._handle, byref(out), byref(err))
+        _check(code, err)
+        return _ffi.take_str(out) or ""
+
+    def read_kv_field(
+        self, mount: str, path: str, field: str, timeout: float | None = None
+    ) -> str | None:
+        """Read one field of a KV v2 secret, or ``None`` if absent.
+
+        Returns the field value, or ``None`` when the secret or the field does
+        not exist (a missing path and a missing field are not distinguished —
+        both are "not there"). A missing or disabled KV mount also reads as
+        ``None`` rather than an error, matching the Go facade.
+
+        Raises:
+            Denied: Vault rejected the read (401/403).
+            Unreachable: Vault could not be reached.
+        """
+        self._require_open()
+        out = c_void_p()
+        found = c_int(0)
+        err = c_void_p()
+        code = _ffi.lib.dotvault_read_kv_field(
+            self._handle,
+            _ffi.encode(mount),
+            _ffi.encode(path),
+            _ffi.encode(field),
+            _millis(timeout),
+            byref(out),
+            byref(found),
+            byref(err),
+        )
+        _check(code, err)
+        return _ffi.take_str(out) if found.value else None
+
+    def read_user_secret(
+        self, service: str, field: str, timeout: float | None = None
+    ) -> str | None:
+        """Read one field of ``kv/users/<identity>/<service>``, or ``None``.
+
+        Composes the path from dotvault's configured KV mount and user prefix,
+        :meth:`identity_name`, and ``service``. Return semantics match
+        :meth:`read_kv_field`.
+
+        Example: ``read_user_secret("gh", "oauth_token")`` reads the
+        ``oauth_token`` field of the github enrolment.
+        """
+        self._require_open()
+        out = c_void_p()
+        found = c_int(0)
+        err = c_void_p()
+        code = _ffi.lib.dotvault_read_user_secret(
+            self._handle,
+            _ffi.encode(service),
+            _ffi.encode(field),
+            _millis(timeout),
+            byref(out),
+            byref(found),
+            byref(err),
+        )
+        _check(code, err)
+        return _ffi.take_str(out) if found.value else None
+
+    def close(self) -> None:
+        """Release the native handle. Idempotent; safe to call more than once."""
+        if getattr(self, "_handle", _CLOSED) != _CLOSED:
+            _ffi.lib.dotvault_client_free(c_longlong(self._handle))
+            self._handle = _CLOSED
+
+    def _require_open(self) -> None:
+        if getattr(self, "_handle", _CLOSED) == _CLOSED:
+            raise DotvaultError("dotvault: client is closed")
+
+    def __enter__(self) -> "Client":
+        return self
+
+    def __exit__(self, *exc: object) -> None:
+        self.close()
+
+    def __del__(self) -> None:
+        # Best-effort cleanup on GC; interpreter teardown may have already
+        # dropped _ffi, so guard against that.
+        try:
+            self.close()
+        except Exception:
+            pass

dotvault/_errors.py

@@ -0,0 +1,74 @@
+"""Exception taxonomy mirroring the Go facade's ``errors.Is``-able sentinels.
+
+The integer category codes here are the SAME values the cgo bridge returns
+across the ABI (see ``cat*`` in ``python/bridge/bridge.go``). The two must be
+extended together — a new sentinel needs a new code on both sides and a new
+exception class below.
+"""
+
+from __future__ import annotations
+
+# Category codes, mirrored verbatim from the Go bridge.
+CAT_OK = 0
+CAT_LOGIN_REQUIRED = 1
+CAT_DENIED = 2
+CAT_UNREACHABLE = 3
+CAT_AUTH_FAILED = 4
+CAT_OTHER = 5
+
+
+class DotvaultError(Exception):
+    """Base class for every error raised by this package.
+
+    Catch this to handle any dotvault failure generically; catch a subclass to
+    distinguish the categories below. An error that matches no specific
+    category (a config-load/validation failure, an unknown handle) is raised as
+    a bare ``DotvaultError``.
+    """
+
+
+class LoginRequired(DotvaultError):
+    """No usable cached token was found and no interactive login was attempted.
+
+    Maps to the facade's ``ErrLoginRequired``. The remedy is to provision a
+    token out of band — run ``dotvault login`` (or let the daemon do it). This
+    package never prompts interactively.
+    """
+
+
+class AuthFailed(DotvaultError):
+    """A login flow ran but did not yield a usable token (``ErrAuthFailed``).
+
+    Read-only callers will rarely see this — it surfaces only if a future
+    interactive path is added — but the category exists so the mapping is total.
+    """
+
+
+class Denied(DotvaultError):
+    """Vault rejected a read with 401/403 (``ErrDenied``).
+
+    The token is valid but lacks the policy for the path, or was revoked
+    between the auth check and the read.
+    """
+
+
+class Unreachable(DotvaultError):
+    """Vault could not be reached or could not service the request now.
+
+    DNS/connection/TLS/timeout, or a 5xx/429 from the server (``ErrUnreachable``).
+    Retryable — back off and try again.
+    """
+
+
+_BY_CATEGORY = {
+    CAT_LOGIN_REQUIRED: LoginRequired,
+    CAT_DENIED: Denied,
+    CAT_UNREACHABLE: Unreachable,
+    CAT_AUTH_FAILED: AuthFailed,
+}
+
+
+def error_for(code: int, message: str | None) -> DotvaultError:
+    """Build the exception for a non-OK category code and message."""
+    cls = _BY_CATEGORY.get(code, DotvaultError)
+    return cls(message or "dotvault: unknown error")

dotvault/_ffi.py

@@ -0,0 +1,87 @@
+"""ctypes binding to the cgo c-shared bridge (``_dotvault.<ext>``).
+
+This module owns three things and nothing else: locating and loading the shared
+library that ships inside the package, declaring the C signatures of every
+exported symbol, and the low-level helpers for moving owned C strings across
+the boundary. The ergonomic surface (``Client``) lives in ``__init__``.
+"""
+
+from __future__ import annotations
+
+import ctypes
+import os
+from ctypes import POINTER, c_char_p, c_int, c_longlong, c_void_p
+
+
+def _library_path() -> str:
+    """Locate the bundled shared library next to this module.
+
+    The artifact is named ``_dotvault`` plus the platform extension
+    (``.so`` / ``.dylib`` / ``.dll``) and is dropped into the package directory
+    at build time. We match by prefix rather than hard-coding the extension so
+    the same code loads on every platform.
+    """
+    here = os.path.dirname(os.path.abspath(__file__))
+    for name in sorted(os.listdir(here)):
+        if name.startswith("_dotvault.") and not name.endswith((".py", ".pyi", ".h")):
+            return os.path.join(here, name)
+    raise ImportError(
+        "dotvault: native library not found next to "
+        f"{here!r}; the package was built without its compiled bridge"
+    )
+
+
+_lib = ctypes.CDLL(_library_path())
+
+
+def _declare(name: str, restype, argtypes) -> None:
+    fn = getattr(_lib, name)
+    fn.restype = restype
+    fn.argtypes = argtypes
+
+
+# Owned out-strings are typed as c_void_p (not c_char_p) so ctypes hands back
+# the raw pointer rather than auto-copying-and-dropping it — we need the pointer
+# intact to hand to dotvault_free. take_str() does the read-then-free.
+_declare("dotvault_default_config_path", c_void_p, [])
+_declare("dotvault_free", None, [c_void_p])
+_declare("dotvault_client_new", c_longlong, [c_char_p, c_char_p, POINTER(c_void_p)])
+_declare("dotvault_client_free", None, [c_longlong])
+_declare("dotvault_authenticate_cached", c_int, [c_longlong, c_longlong, POINTER(c_void_p)])
+_declare("dotvault_identity_name", c_int, [c_longlong, POINTER(c_void_p), POINTER(c_void_p)])
+_declare("dotvault_token", c_int, [c_longlong, POINTER(c_void_p), POINTER(c_void_p)])
+_declare(
+    "dotvault_read_kv_field",
+    c_int,
+    [c_longlong, c_char_p, c_char_p, c_char_p, c_longlong, POINTER(c_void_p), POINTER(c_int), POINTER(c_void_p)],
+)
+_declare(
+    "dotvault_read_user_secret",
+    c_int,
+    [c_longlong, c_char_p, c_char_p, c_longlong, POINTER(c_void_p), POINTER(c_int), POINTER(c_void_p)],
+)
+
+lib = _lib
+
+
+def take_str(ptr: int | c_void_p | None) -> str | None:
+    """Decode an owned C string and free it; ``None``/NULL yields ``None``.
+
+    Every string the bridge writes out is malloc'd on the Go side and owned by
+    us. This reads it as UTF-8 and releases it with dotvault_free, so a single
+    call site can't leak. ``ptr`` is whatever a ``c_void_p`` out-param holds
+    (an int) or a NULL.
+    """
+    value = ptr.value if isinstance(ptr, c_void_p) else ptr
+    if not value:
+        return None
+    try:
+        raw = ctypes.cast(value, c_char_p).value
+        return raw.decode("utf-8") if raw is not None else None
+    finally:
+        _lib.dotvault_free(value)
+
+
+def encode(s: str | None) -> bytes | None:
+    """Encode a Python str to NUL-terminable UTF-8 bytes for a c_char_p arg."""
+    return None if s is None else s.encode("utf-8")

dotvault-0.24.0.dist-info/METADATA

@@ -0,0 +1,133 @@
+Metadata-Version: 2.4
+Name: dotvault
+Version: 0.24.0
+Summary: Python bindings for the dotvault public client API (read per-user Vault secrets dotvault enrols)
+Author: dotvault authors
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/goodtune/dotvault
+Project-URL: Repository, https://github.com/goodtune/dotvault
+Keywords: vault,secrets,dotvault,hashicorp
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+
+# dotvault — Python bindings
+
+Python bindings for [dotvault](https://github.com/goodtune/dotvault)'s public client API. They let a Python program read the per-user secrets a dotvault daemon enrolled and keeps current — talking to the same Vault, resolving a token the same way, and reading from the exact `kv/users/<user>/...` path dotvault writes to.
+
+The package is a thin [ctypes](https://docs.python.org/3/library/ctypes.html) wrapper over dotvault's Go `client` package compiled to a shared library with `go build -buildmode=c-shared`. Connectivity, token precedence, the OS-user identity convention, and the path layout all come from the one canonical Go implementation rather than being re-derived in Python, so a consumer can't silently diverge from the daemon. The native bridge imports only the public Go `client` package — never dotvault's internals.
+
+## Scope
+
+This first release exposes the **read-only + cached-auth** subset of the Go facade:
+
+- `Client(config_path=None, identity=None)` — load config, build the client.
+- `authenticate_cached(timeout=None)` — resolve a token (`DOTVAULT_TOKEN` → token file) and validate it. **Never prompts.**
+- `identity_name()`, `token()`.
+- `read_user_secret(service, field, timeout=None)`, `read_kv_field(mount, path, field, timeout=None)`.
+
+Interactive login (OIDC browser pop, LDAP password + MFA terminal prompts) is **deliberately out of scope** — driving it across an FFI boundary from inside a Python process is awkward and not what a library caller wants. Provision a token out of band (`dotvault login`, or the daemon) and these bindings consume it.
+
+## Install
+
+Released wheels are published to PyPI (Linux `manylinux_2_28`, macOS arm64, Windows x86_64):
+
+```sh
+pip install dotvault          # or: uv pip install dotvault
+```
+
+The wheel is tagged `py3-none-<platform>`: it carries a native shared library (so it is platform-specific) but contains no CPython C-extension — it is pure ctypes — so a single wheel per OS installs on **any** Python ≥ 3.9, not one wheel per interpreter version. Its version is derived from the repo's git tags by `setuptools-scm` (the same tags that version the daemon); `dotvault.__version__` reports it.
+
+Wheels are built for glibc Linux x86_64 (`manylinux_2_28`), Apple-Silicon macOS, and Windows x86_64. There are currently no wheels for Linux aarch64, musl/Alpine, Intel macOS, or Windows arm64 — `pip install` on those reports "no matching distribution"; build from a checkout instead.
+
+To build from a checkout instead — the tooling is [uv](https://docs.astral.dev/uv/):
+
+```sh
+make python-wheel               # -> python/dist/dotvault-*.whl  (runs `uv build`)
+uv pip install python/dist/dotvault-*.whl
+```
+
+or an editable install (requires Go on `PATH`, since the bridge is compiled on install):
+
+```sh
+cd python && uv pip install -e .
+```
+
+Building from source needs the Go toolchain and a C compiler — `go build -buildmode=c-shared` is the one place dotvault uses cgo (`CGO_ENABLED=1`). The main dotvault binaries remain pure-Go static builds; only this binding links libc. On Windows the C compiler must be a mingw-w64 gcc (the `c-shared` build does not work with MSVC); GitHub's `windows-latest` runners ship one, but a local Windows build needs it on `PATH`.
+
+Concurrency note: set `DOTVAULT_TOKEN` before the first use of a `Client`, not concurrently with reads from another thread. The bridge re-reads the facade's env vars from libc on each token-resolving call; that read/write is serialised internally, but it cannot be made safe against the host process mutating its own environment from another thread.
+
+## Quick start
+
+```python
+import dotvault
+
+# Defaults: dotvault's system config path, identity = the OS user.
+with dotvault.Client() as c:
+    try:
+        c.authenticate_cached(timeout=5)          # env -> token file; no prompt
+    except dotvault.LoginRequired:
+        raise SystemExit("run `dotvault login` first")
+    except dotvault.Unreachable:
+        raise SystemExit("vault is unreachable; retry later")
+
+    token = c.read_user_secret("gh", "oauth_token")   # -> str | None
+    if token is None:
+        raise SystemExit("github enrolment not present")
+    use(token)
+```
+
+A read returns the field value, or `None` when the secret or field is absent — a missing path and a missing field are not distinguished (both are "not there"), matching the Go facade. Transport/authorisation failures raise instead.
+
+## Identity is the OS user, not the Vault token
+
+dotvault derives the `<user>` segment of `kv/users/<user>/...` from the **OS account the process runs as** (with any `DOMAIN\` prefix stripped), *not* from the Vault token's `display_name` or entity. By default a consumer must therefore run as the **same OS user** as the dotvault that populated the secrets — normally true for a per-user daemon.
+
+If your process runs as a different user (a service account, a container), pass `identity=` to read that user's secrets:
+
+```python
+dotvault.Client(identity="alice")
+```
+
+A wrong identity reads a non-existent path, which surfaces as a `None` read — not an error.
+
+## Errors
+
+Every failure is a `DotvaultError` or a subclass:
+
+| Exception | Meaning | What to do |
+| --- | --- | --- |
+| `LoginRequired` | No usable cached token. | Provision a token (`dotvault login`). |
+| `Unreachable` | Vault down / 5xx / timeout. | Retry, back off. |
+| `Denied` | Vault rejected the read (401/403). | Fail closed; the token lacks the policy. |
+| `AuthFailed` | A login ran but failed. | Surface the auth problem (rare on this surface). |
+| `DotvaultError` | Anything else (config load, closed client). | Fail closed. |
+
+A not-found read is `None`, never an exception.
+
+## Environment variables
+
+The bindings honour the same variables as dotvault: `DOTVAULT_TOKEN` (a token supplied via the environment) and `VAULT_NAMESPACE`. `VAULT_TOKEN` is **deliberately ignored** — it belongs to the `vault` CLI and must not leak into dotvault's session; use `DOTVAULT_TOKEN`.
+
+The Go runtime snapshots its environment at load time, so the bridge re-reads these two variables from the live process environment on each call. That means setting `os.environ["DOTVAULT_TOKEN"]` after `import dotvault` works as you'd expect.
+
+## Development
+
+```sh
+make python-lib     # build the native bridge into the package for local use
+make python-test    # build the bridge + run the Python test suite (via `uv run`)
+go test ./python/bridge/...   # the Go-side bridge unit tests
+```
+
+`make python-test` and `make python-wheel` shell out to `uv`, which provisions Python and the test/build dependencies; only the Go toolchain and a C compiler need to be present beforehand.
+
+The Python tests run fully offline — they point at a closed Vault port and assert the error categorisation — so no live Vault is needed.
+
+## Releasing
+
+Publishing a GitHub Release with a `vX.Y.Z` tag drives both the Go release (`release.yml`) and the Python wheels: the `.github/workflows/python.yml` `publish` job builds the per-OS wheels and uploads them to PyPI via the official `pypa/gh-action-pypi-publish` action using **Trusted Publishing** (OIDC — no stored token). One-time setup before the first release: register a [pending publisher](https://docs.pypi.org/trusted-publishers/) on PyPI for project `dotvault` pointing at this repository, workflow `python.yml`, and environment `pypi`. A dev/untagged build produces a PEP 440 local version that PyPI rejects, so only exact tagged releases publish. Consider a one-off TestPyPI dry run (temporarily pointing the action at TestPyPI) before the first real release to validate the OIDC/publisher wiring.

dotvault-0.24.0.dist-info/RECORD

@@ -0,0 +1,9 @@
+dotvault/__init__.py,sha256=adEqLW4IlgiPoj365CN8J_6QxISUQawzow17NAa-cDA,9784
+dotvault/_dotvault.dll,sha256=vSEXIzxNJig-rmi4UbX9QlLalNraHVcQOrAA1z9f67Y,30686808
+dotvault/_errors.py,sha256=Fr9F94TnmPsaBamOp3ao2vqVYN4XXAOvFxH7GUoyCq0,2418
+dotvault/_ffi.py,sha256=DnrfKApxGbICuV7jsvpP6Lrtc2_pjD0d7thk5a1OTYE,3445
+dotvault/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+dotvault-0.24.0.dist-info/METADATA,sha256=XK33JZJUk33_Cs-7GUrjIQVSkYIct4a4buwM5_dqQfo,8459
+dotvault-0.24.0.dist-info/WHEEL,sha256=GjDPPQwEcripVP6P2r3RxLa-h5Lb9ifGB7FYYtbLDT0,98
+dotvault-0.24.0.dist-info/top_level.txt,sha256=6kZ7eYVAly2rbAaWemF8nBQ1Fm2Oi-LU-SRblxeqYyA,9
+dotvault-0.24.0.dist-info/RECORD,,

dotvault-0.24.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: false
+Tag: py3-none-win_amd64
+

dotvault-0.24.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+dotvault