winwin-vault 0.1.0__py3-none-any.whl

winwin_vault/__init__.py

@@ -0,0 +1,20 @@
+"""winwin_vault - A read-only Vault client library."""
+
+from .client import VaultClient
+from .exceptions import (
+    VaultAuthenticationError,
+    VaultClientError,
+    VaultConnectionError,
+    VaultSecretNotFoundError,
+)
+from .model import AlicloudCredential, DatabaseCredential
+
+__all__ = [
+    "VaultClient",
+    "VaultClientError",
+    "VaultAuthenticationError",
+    "VaultConnectionError",
+    "VaultSecretNotFoundError",
+    "DatabaseCredential",
+    "AlicloudCredential",
+]

winwin_vault/auth.py

@@ -0,0 +1,162 @@
+"""Authentication handlers for Vault client."""
+
+import os
+from pathlib import Path
+from typing import Protocol
+from urllib.parse import urlparse
+
+import hvac
+
+from .exceptions import VaultAuthenticationError, VaultClientError
+
+
+class AuthHandler(Protocol):
+    """Protocol for authentication handlers."""
+
+    def authenticate(self) -> hvac.Client:
+        """Authenticate and return an hvac Client instance."""
+        ...
+
+
+K8S_TOKEN_PATH = Path("/var/run/secrets/kubernetes.io/serviceaccount/token")
+VAULT_TOKEN_PATH = Path.home() / ".vault-token"
+# Default timeout for hvac.Client (connect, read) in seconds
+DEFAULT_TIMEOUT = (5, 30)
+
+
+def _is_https(vault_addr: str) -> bool:
+    """Check if vault_addr uses HTTPS scheme."""
+    return urlparse(vault_addr).scheme == "https"
+
+
+def _is_local_agent(vault_addr: str) -> bool:
+    """Check if vault_addr points to a local Vault Agent.
+
+    Vault Agent runs on the same host and handles auth automatically,
+    so we skip HTTPS enforcement and token requirements.
+    """
+    parsed = urlparse(vault_addr)
+    return parsed.scheme == "http" and parsed.hostname in ("localhost", "127.0.0.1")
+
+
+def _create_client(
+    vault_addr: str,
+    timeout: tuple[int, int] = DEFAULT_TIMEOUT,
+    require_https: bool = True,
+) -> hvac.Client:
+    """Create an hvac Client configured with the given address.
+
+    Args:
+        vault_addr: Vault server URL.
+        timeout: Tuple of (connect_timeout, read_timeout) in seconds.
+        require_https: If False, allow HTTP (for Vault Agent on localhost).
+
+    Returns:
+        Configured hvac Client.
+
+    Raises:
+        VaultClientError: if VAULT_ADDR is invalid or uses wrong scheme.
+    """
+    if not vault_addr:
+        raise VaultClientError("VAULT_ADDR must be set")
+    if require_https and not _is_https(vault_addr):
+        raise VaultClientError(f"VAULT_ADDR must use HTTPS scheme, got: {vault_addr}")
+    return hvac.Client(url=vault_addr, timeout=timeout)  # type: ignore[reportArgumentType]
+
+
+class EnvTokenAuth:
+    """Authenticate using VAULT_TOKEN or ~/.vault-token.
+
+    If VAULT_TOKEN is not set, hvac reads ~/.vault-token automatically
+    after a successful `vault login`.
+    """
+
+    def __init__(self, vault_addr: str) -> None:
+        self._vault_addr = vault_addr
+        self._token = os.environ.get("VAULT_TOKEN", "")
+
+    def authenticate(self) -> hvac.Client:
+        client = _create_client(self._vault_addr)
+        # Only set token explicitly if VAULT_TOKEN is set;
+        # otherwise hvac will auto-discover ~/.vault-token
+        if self._token:
+            client.token = self._token
+        return client
+
+
+class VaultAgentAuth:
+    """Authenticate via local Vault Agent sidecar.
+
+    Vault Agent runs on localhost and handles token lifecycle automatically.
+    The client connects over plain HTTP — no HTTPS required, no token needed.
+    """
+
+    def __init__(self, vault_addr: str) -> None:
+        self._vault_addr = vault_addr
+
+    def authenticate(self) -> hvac.Client:
+        # Vault Agent does not require HTTPS — it is the TLS terminator
+        client = _create_client(self._vault_addr, require_https=False)
+        # No token needed — Vault Agent injects it automatically
+        return client
+
+
+class KubernetesAuth:
+    """Authenticate using Kubernetes ServiceAccount token."""
+
+    def __init__(self, vault_addr: str, role: str = "default") -> None:
+        self._vault_addr = vault_addr
+        self._token_path = K8S_TOKEN_PATH
+        self._role = role
+
+    def authenticate(self) -> hvac.Client:
+        token_file = Path(self._token_path)
+        if not token_file.exists():
+            raise VaultAuthenticationError(
+                f"Kubernetes ServiceAccount token not found at {self._token_path}"
+            )
+        token = token_file.read_text().strip()
+        if not token:
+            raise VaultAuthenticationError(
+                f"Kubernetes ServiceAccount token at {self._token_path} is empty"
+            )
+        client = _create_client(self._vault_addr)
+        client.auth.kubernetes.login(role=self._role, jwt=token)
+        return client
+
+
+def detect_auth_method() -> AuthHandler:
+    """Detect the appropriate authentication method from environment.
+
+    Priority:
+    1. Vault Agent — if VAULT_ADDR uses http://localhost/127.0.0.1
+    2. VAULT_TOKEN (explicit) or ~/.vault-token (auto-discovered by hvac)
+    3. Kubernetes ServiceAccount token
+
+    Returns:
+        VaultAgentAuth, EnvTokenAuth, or KubernetesAuth.
+    Raises:
+        VaultAuthenticationError: If no valid auth method is available.
+    """
+    vault_addr = os.environ.get("VAULT_ADDR", "")
+    token = os.environ.get("VAULT_TOKEN", "")
+
+    # Vault Agent takes precedence — it is a local sidecar requiring no token
+    if vault_addr and _is_local_agent(vault_addr):
+        return VaultAgentAuth(vault_addr)
+
+    # EnvTokenAuth handles both explicit VAULT_TOKEN and ~/.vault-token
+    # (hvac auto-discovers ~/.vault-token when token is not set)
+    if token or VAULT_TOKEN_PATH.exists():
+        return EnvTokenAuth(vault_addr)
+
+    # Check for Kubernetes token
+    if K8S_TOKEN_PATH.exists():
+        role = os.environ.get("VAULT_K8S_ROLE", "default")
+        return KubernetesAuth(vault_addr, role=role)
+
+    raise VaultAuthenticationError(
+        "No authentication method available. "
+        "Set VAULT_TOKEN, run `vault login`, use Vault Agent, "
+        "or run inside Kubernetes with ServiceAccount token."
+    )

winwin_vault/cache.py

@@ -0,0 +1,95 @@
+"""TTL-based cache for dynamic secrets."""
+
+from __future__ import annotations
+
+import threading
+import time
+from collections import OrderedDict
+from collections.abc import Callable
+from typing import Any
+
+
+class TTLCache:
+    """In-memory TTL cache for dynamic secrets.
+
+    Thread-safe using per-path locks to prevent thundering herd on cache miss.
+    Fetches fresh data before TTL expires to avoid credential expiry gaps.
+
+    The fetch function is provided by the caller and handles all Vault interaction
+    (including retry and token renewal) — TTLCache only handles caching.
+    """
+
+    def __init__(self, max_size: int = 1000, refresh_threshold: float = 0.8) -> None:
+        """Initialize TTLCache.
+
+        Args:
+            max_size: Maximum number of entries before LRU eviction.
+            refresh_threshold: Fraction of TTL at which to refresh (0.8 = 80%).
+        """
+        self._refresh_threshold = refresh_threshold
+        self._max_size = max_size
+        self._cache: OrderedDict[str, dict[str, Any]] = OrderedDict()
+        self._lock = threading.Lock()
+        # Per-path locks to prevent thundering herd: only one fetcher per path
+        self._path_locks: dict[str, threading.Lock] = {}
+        self._path_locks_lock = threading.Lock()
+
+    def _is_expiring_soon(self, cached: dict[str, Any]) -> bool:
+        """Check if a cached entry is within the refresh window."""
+        now = time.time()
+        expires_at = cached.get("expires_at", 0)
+        lease_duration = cached.get("lease_duration", 0)
+        return (expires_at - now) <= (lease_duration * (1 - self._refresh_threshold))
+
+    def _get_path_lock(self, path: str) -> threading.Lock:
+        """Get or create a lock for a specific path."""
+        with self._path_locks_lock:
+            if path not in self._path_locks:
+                self._path_locks[path] = threading.Lock()
+            return self._path_locks[path]
+
+    def get(
+        self, path: str, fetch_func: Callable[[], dict[str, Any]]
+    ) -> dict[str, Any]:
+        """Get a secret, using cache if valid.
+
+        Uses per-path locking to prevent thundering herd: concurrent requests
+        for the same path wait for the first fetcher rather than all fetching.
+
+        Args:
+            path: Full path to the secret, e.g. "database/creds/my-role".
+            fetch_func: A no-arg callable that returns the raw secret data dict
+                (with at least 'lease_duration' and 'expires_at' for cache control).
+
+        Returns:
+            The raw secret data dictionary.
+
+        Raises:
+            VaultClientError: if the secret cannot be read.
+        """
+        # Fast path: return cached value if valid (no lock needed for read-only)
+        with self._lock:
+            cached = self._cache.get(path)
+            if cached and not self._is_expiring_soon(cached):
+                return cached
+
+        # Slow path: acquire per-path lock to prevent thundering herd
+        path_lock = self._get_path_lock(path)
+        with path_lock:
+            # Re-check after acquiring lock — another thread may have fetched
+            with self._lock:
+                cached = self._cache.get(path)
+                if cached and not self._is_expiring_soon(cached):
+                    return cached
+
+            # Fetch fresh (still holding path_lock to serialize concurrent fetchers)
+            data = fetch_func()
+
+            with self._lock:
+                # Evict oldest entry if at capacity
+                if self._max_size > 0 and len(self._cache) >= self._max_size:
+                    oldest_path, _ = self._cache.popitem(last=False)
+                    with self._path_locks_lock:
+                        self._path_locks.pop(oldest_path, None)
+                self._cache[path] = data
+            return data

winwin_vault/client.py

@@ -0,0 +1,290 @@
+"""VaultClient singleton with transparent token renewal."""
+
+import threading
+import time
+from typing import Any
+
+import hvac
+import hvac.exceptions
+import requests
+
+from .auth import detect_auth_method
+from .cache import TTLCache
+from .exceptions import (
+    VaultClientError,
+    VaultConnectionError,
+    VaultSecretNotFoundError,
+)
+from .model import AlicloudCredential, DatabaseCredential
+
+_vault_client_lock = threading.Lock()
+_vault_client_instance: "VaultClient | None" = None
+
+# Exponential backoff between retry attempts (seconds)
+_REAUTH_BACKOFF_BASE = 0.5
+_REAUTH_BACKOFF_MULTIPLIER = 2
+# Buffer seconds — skip lookup_self() call if token has more than this much TTL left
+_TOKEN_TTL_BUFFER = 60
+
+
+class VaultClient:
+    """Singleton Vault client with transparent token renewal.
+
+    Use `VaultClient.from_env()` to get the singleton instance.
+    """
+
+    def __init__(
+        self,
+        kv_mount_point: str = "secret",
+        database_mount_point: str = "database",
+        alicloud_mount_point: str = "alicloud",
+    ) -> None:
+        auth_handler = detect_auth_method()
+        self._client: hvac.Client = auth_handler.authenticate()
+        self._auth_handler = auth_handler
+        self._dynamic_cache: TTLCache = TTLCache()
+        self._reauth_lock = threading.Lock()
+        self._token_expires_at: float = 0.0
+        self._kv_mount_point = kv_mount_point
+        self._database_mount_point = database_mount_point
+        self._alicloud_mount_point = alicloud_mount_point
+
+    def set_kv_mount_point(self, mount_point: str) -> None:
+        """Set the mount point for the KV v2 secrets engine."""
+        self._kv_mount_point = mount_point
+
+    def set_database_mount_point(self, mount_point: str) -> None:
+        """Set the mount point for the database secrets engine."""
+        self._database_mount_point = mount_point
+
+    def set_alicloud_mount_point(self, mount_point: str) -> None:
+        """Set the mount point for the Alicloud secrets engine."""
+        self._alicloud_mount_point = mount_point
+
+    @classmethod
+    def from_env(cls) -> "VaultClient":
+        """Get or create the singleton VaultClient instance.
+
+        Thread-safe lazy initialization.
+        """
+        global _vault_client_instance
+        if _vault_client_instance is not None:
+            return _vault_client_instance
+        with _vault_client_lock:
+            if _vault_client_instance is None:
+                _vault_client_instance = cls()
+            return _vault_client_instance
+
+    def _is_token_valid(self) -> bool:
+        """Return True if the current token has remaining TTL beyond the buffer.
+
+        Checks cached expiry without an API call when TTL is sufficient.
+        Falls back to lookup_self() when cached TTL is low.
+        """
+        now = time.time()
+        if self._token_expires_at > now + _TOKEN_TTL_BUFFER:
+            return True
+
+        # Cached TTL ran out — do a real check and update cache
+        try:
+            result = self._client.auth.token.lookup_self()
+            ttl: int = result.get("data", {}).get("ttl", 0)
+            self._token_expires_at = now + ttl
+            return ttl > 0
+        except hvac.exceptions.VaultError:
+            # Auth error (401/403) — token is invalid, trigger re-auth
+            self._token_expires_at = 0.0
+            return False
+        except (requests.RequestException, OSError) as e:
+            # Network failure — Vault unreachable, fail fast without re-auth loop
+            raise VaultConnectionError(f"Vault is unreachable: {e}") from e
+
+    def _ensure_valid_token(self) -> bool:
+        """Verify token is still valid, re-authenticating if invalid.
+
+        Returns:
+            True if token is valid (or was successfully re-authenticated).
+        """
+        if self._is_token_valid():
+            return True
+        self._reauthenticate()
+        return True
+
+    def _reauthenticate(self) -> None:
+        """Re-authenticate using the stored auth handler.
+
+        Thread-safe: uses a lock to prevent concurrent re-authentication
+        from different threads. Uses double-check pattern to avoid unnecessary
+        re-auth when another thread already re-authed.
+        """
+        with self._reauth_lock:
+            # Re-check after acquiring lock — another thread may have re-authed
+            if self._is_token_valid():
+                return
+            self._client = self._auth_handler.authenticate()
+            # Verify the new token actually works before using it
+            if not self._is_token_valid():
+                raise VaultClientError(
+                    "Re-authentication succeeded but token is still invalid"
+                )
+            # Auth succeeded — refresh token TTL cache
+            self._token_expires_at = 0.0
+
+    def _retry_with_renewal(self, func: Any, *args: Any, **kwargs: Any) -> Any:
+        """Execute a Vault operation with token renewal on expiry.
+
+        Args:
+            func: The function to call.
+            *args: Positional arguments to pass to func.
+            **kwargs: Keyword arguments to pass to func.
+
+        Returns:
+            The result of func(*args, **kwargs).
+
+        Raises:
+            VaultClientError: if the operation fails after token renewal.
+        """
+        max_attempts = 2
+        last_exception: Exception | None = None
+
+        for attempt in range(max_attempts):
+            self._ensure_valid_token()
+            try:
+                return func(*args, **kwargs)
+            except (
+                VaultClientError,
+                hvac.exceptions.VaultError,
+                requests.RequestException,
+                OSError,
+            ) as e:
+                last_exception = e
+                # If token is still valid, the failure is not auth-related — re-raise.
+                if self._is_token_valid():
+                    raise
+                # Token was invalid — re-authenticate and retry once
+                if attempt < max_attempts - 1:
+                    self._reauthenticate()
+                    time.sleep(
+                        _REAUTH_BACKOFF_BASE * (_REAUTH_BACKOFF_MULTIPLIER**attempt)
+                    )
+                else:
+                    raise last_exception from None
+
+        # Defensive: should not reach here, but raise if it does
+        if last_exception is not None:
+            raise last_exception
+        raise VaultClientError("Unexpected error in retry loop")
+
+    def read_kv(self, path: str) -> dict[str, Any]:
+        """Read a KV v2 secret.
+
+        Args:
+            path: The path of the secret to read.
+
+        Returns:
+            The secret data dictionary from the 'data' field.
+
+        Raises:
+            VaultSecretNotFoundError: if the secret path does not exist.
+            VaultClientError: if the read fails for any other reason.
+        """
+
+        def _do_read() -> dict[str, Any]:
+            try:
+                result = self._client.secrets.kv.v2.read_secret_version(
+                    path=path, mount_point=self._kv_mount_point
+                )
+                return result["data"]["data"]
+            except hvac.exceptions.InvalidPath as e:
+                raise VaultSecretNotFoundError(
+                    f"Secret not found at path '{self._kv_mount_point}/data/{path}': {e}"
+                ) from e
+
+        return self._retry_with_renewal(_do_read)
+
+    def read_database_creds(self, path: str) -> DatabaseCredential:
+        """Read a database dynamic secret with TTL caching.
+
+        Args:
+            path: path to the dynamic secret, e.g. "my-role".
+
+        Returns:
+            A DatabaseCredential dataclass.
+
+        Raises:
+            VaultClientError: if the credential cannot be read.
+        """
+
+        def fetch() -> dict[str, Any]:
+            result = self._client.secrets.database.generate_credentials(
+                path, mount_point=self._database_mount_point
+            )
+            data = result.get("data", {})
+            username = data.get("username", "")
+            password = data.get("password", "")
+            if not username:
+                raise VaultClientError("Database credential response missing username")
+            if not password:
+                raise VaultClientError("Database credential response missing password")
+            lease_duration = result.get("lease_duration", 0)
+            now = time.time()
+            return {
+                "username": username,
+                "password": password,
+                "lease_duration": lease_duration,
+                "expires_at": (now + lease_duration) if lease_duration > 0 else 0.0,
+            }
+
+        cache_key = f"{self._database_mount_point}/{path}"
+        data = self._retry_with_renewal(
+            lambda: self._dynamic_cache.get(cache_key, fetch)
+        )
+        return DatabaseCredential(
+            username=data["username"],
+            password=data["password"],
+            lease_duration=data["lease_duration"],
+        )
+
+    def read_alicloud_creds(self, path: str) -> AlicloudCredential:
+        """Read an Alicloud STS dynamic secret with TTL caching.
+
+        Args:
+            path: The path to the dynamic secret, e.g. "my-role".
+
+        Returns:
+            An AlicloudCredential dataclass.
+
+        Raises:
+            VaultClientError: if the credential cannot be read.
+        """
+
+        def fetch() -> dict[str, Any]:
+            result = self._client.adapter.get(
+                f"v1/{self._alicloud_mount_point}/creds/{path}"
+            )
+            data = result.get("data", {})
+            for field in ("access_key", "secret_key", "security_token"):
+                if field not in data:
+                    raise VaultClientError(
+                        f"alicloud credential missing field: {field}"
+                    )
+            lease_duration = result.get("lease_duration", 0)
+            now = time.time()
+            return {
+                "access_key": data["access_key"],
+                "secret_key": data["secret_key"],
+                "security_token": data["security_token"],
+                "lease_duration": lease_duration,
+                "expires_at": (now + lease_duration) if lease_duration > 0 else 0.0,
+            }
+
+        cache_key = f"{self._alicloud_mount_point}/{path}"
+        data = self._retry_with_renewal(
+            lambda: self._dynamic_cache.get(cache_key, fetch)
+        )
+        return AlicloudCredential(
+            access_key=data["access_key"],
+            secret_key=data["secret_key"],
+            security_token=data["security_token"],
+            lease_duration=data["lease_duration"],
+        )

winwin_vault/exceptions.py

@@ -0,0 +1,25 @@
+"""Vault client exceptions."""
+
+
+class VaultClientError(Exception):
+    """Base exception for all VaultClient errors."""
+
+    pass
+
+
+class VaultAuthenticationError(VaultClientError):
+    """Raised when authentication fails."""
+
+    pass
+
+
+class VaultConnectionError(VaultClientError):
+    """Raised when connection to Vault fails."""
+
+    pass
+
+
+class VaultSecretNotFoundError(VaultClientError):
+    """Raised when a secret is not found."""
+
+    pass

winwin_vault/model.py

@@ -0,0 +1,22 @@
+"""Domain models for Vault credentials."""
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class DatabaseCredential:
+    """A dynamic database credential returned from Vault."""
+
+    username: str
+    password: str
+    lease_duration: int
+
+
+@dataclass(frozen=True)
+class AlicloudCredential:
+    """A dynamic Alicloud STS credential returned from Vault."""
+
+    access_key: str
+    secret_key: str
+    security_token: str
+    lease_duration: int

winwin_vault-0.1.0.dist-info/METADATA

@@ -0,0 +1,92 @@
+Metadata-Version: 2.3
+Name: winwin-vault
+Version: 0.1.0
+Summary: Add your description here
+Author: Ye Wenbin
+Author-email: Ye Wenbin <yewenbin@brandct.com>
+Requires-Dist: hvac>=2.0,<3.0
+Requires-Dist: pytest>=8.0 ; extra == 'dev'
+Requires-Dist: ruff>=0.15 ; extra == 'dev'
+Requires-Python: >=3.11
+Provides-Extra: dev
+Description-Content-Type: text/markdown
+
+# winwin-vault
+
+[![PyPI version](https://img.shields.io/pypi/v/winwin-vault)](https://pypi.org/project/winwin-vault/)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+A read-only Python client for HashiCorp Vault, with automatic token renewal and dynamic secret caching.
+
+## Installation
+
+```bash
+pip install winwin-vault
+```
+
+## Quick Start
+
+```python
+from winwin_vault import VaultClient
+
+# Uses VAULT_ADDR and auth method from environment
+client = VaultClient.from_env()
+
+# Read a KV v2 secret
+secret = client.read_kv("config")
+print(secret["api_key"])
+
+# Read database credentials (cached with TTL)
+creds = client.read_database_creds("my-role")
+print(creds.username, creds.password)
+
+# Read Alicloud STS credentials (cached with TTL)
+alicreds = client.read_alicloud_creds("my-role")
+print(alicreds.access_key, alicreds.secret_key, alicreds.security_token)
+```
+
+## Authentication
+
+`VaultClient.from_env()` auto-detects the auth method:
+
+| Environment | Auth Method |
+|------------|-------------|
+| `VAULT_TOKEN` set | `EnvTokenAuth` |
+| `~/.vault-token` present | `EnvTokenAuth` |
+| Kubernetes ServiceAccount | `KubernetesAuth` |
+| Vault Agent socket | `VaultAgentAuth` |
+
+TLS is enforced for all auth methods except `VaultAgentAuth` (which communicates over a local Unix socket).
+
+## Mount Points
+
+Default mount points:
+
+- KV v2: `secret`
+- Database: `database`
+- Alicloud: `alicloud`
+
+Change via setters:
+
+```python
+client.set_kv_mount_point("internal")
+client.set_database_mount_point("database")
+client.set_alicloud_mount_point("alicloud")
+```
+
+## Exception Handling
+
+```python
+from winwin_vault import VaultClient, VaultClientError, VaultSecretNotFoundError
+
+try:
+    secret = client.read_kv("config")
+except VaultSecretNotFoundError:
+    print("Secret not found")
+except VaultClientError as e:
+    print(f"Vault error: {e}")
+```
+
+## License
+
+MIT License — see [LICENSE](LICENSE) file to be added.

winwin_vault-0.1.0.dist-info/RECORD

@@ -0,0 +1,10 @@
+winwin_vault/__init__.py,sha256=pkR7Bo5iISW4NwSgvplA9Y5gCES_1zZgZH3hRj-x320,484
+winwin_vault/auth.py,sha256=GTr3JcnR12wIdAsgOrcJiCBiLoyv-vScmriG16WL0Ro,5471
+winwin_vault/cache.py,sha256=OPMH0csD2xZCMLv6V4EziXoQBeimTlXb7_L0llWxPqQ,3793
+winwin_vault/client.py,sha256=O2FYkYv8593cfuTBHZ50TM-NI-KCmLG7pgLZpPM2rk8,10629
+winwin_vault/exceptions.py,sha256=wX83n5SNgyDnciOPKOWao2fRphK4sECqxjut-ds-9rc,451
+winwin_vault/model.py,sha256=1VdimvOmIC1P2LoIbgqgeOYmKud9jCaJ-w8xg3cv8t4,458
+winwin_vault/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+winwin_vault-0.1.0.dist-info/WHEEL,sha256=s_zqWxHFEH8b58BCtf46hFCqPaISurdB9R1XJ8za6XI,80
+winwin_vault-0.1.0.dist-info/METADATA,sha256=QwBMdk98uqEg2olsGO4CVLDekGOb7Smo7wAMZRXQwfE,2291
+winwin_vault-0.1.0.dist-info/RECORD,,

winwin_vault-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: uv 0.11.6
+Root-Is-Purelib: true
+Tag: py3-none-any