vibedata-dlt-studio-secrets

Shared Secret Store registration for the Studio execution units of the VibeData dlt runtime. A dependency package, not a runnable distribution.

A Domain binds one Secret Store — local_toml, azure_key_vault, studio_key_vault, or motherduck_flight_secrets — independently of its Data Platform (ADR-0022). dlt reads a local_toml store natively from the mounted secrets.toml; every other kind needs a dlt config provider registered in the same interpreter before the first dlt.secrets read. Every Studio unit (Fabric Lakehouse, Fabric Warehouse, DuckDB/MotherDuck) performs that registration through this package, so the behaviour is identical whichever destination the pipeline targets.

from vibedata.dlt.studio_secrets import register_secret_provider

register_secret_provider()   # reads VD_DOMAIN_SECRET_STORE_KIND; registers what that kind needs

• register_secret_provider() — the kind-gated entry point every unit's setup_environment() calls first. Raises ValueError when the kind is absent or unknown; registers nothing for local_toml. For motherduck_flight_secrets it registers the Flight secrets provider, whose store is a Flight's injected environment: in this container that resolves nothing, so a credential a container run needs fails where dlt names the field rather than here.
• register_akv_provider(vault_url=None) — the bare Azure registration, for a process with no destination to configure (source-connection verification). Idempotent: a second call in the same interpreter is a no-op.
• AzureKeyVaultProvider — the dlt provider. Authenticates through Studio's credential broker on the runtime-declared identity lane and maps the dlt key to a vault secret name. A vault answer of 401 or 403 raises KeyVaultAccessDeniedError naming the vault and the secret, so an access problem is never reported as a missing secret.
• register_studio_key_vault_provider(vault_url=None) — registers the Internal Studio Key Vault provider. It reads the IAT from the private credential file for each request and calls Studio's AKV-compatible api-version=7.4 Get Secret endpoint directly; it does not invoke the credential broker.