vibedata-dlt-studio-secrets

Shared Secret Store registration for the Studio execution units of the VibeData dlt runtime. A dependency package, not a runnable distribution.

A Domain binds one Secret Store — local_toml, azure_key_vault, studio_key_vault, motherduck_flight_secrets, aws_secrets_manager, or databricks_secret_scope — independently of its Data Platform (ADR-0022). dlt reads a local_toml store natively from the mounted secrets.toml; every other kind needs a dlt config provider registered in the same interpreter before the first dlt.secrets read. Every Studio unit (Fabric Lakehouse, Fabric Warehouse, DuckDB/MotherDuck) performs that registration through this package, so the behaviour is identical whichever destination the pipeline targets.

from vibedata.dlt.studio_secrets import register_secret_provider

register_secret_provider()   # reads VD_DOMAIN_SECRET_STORE_KIND; registers what that kind needs

• register_secret_provider() — the kind-gated entry point every unit's setup_environment() calls first. Raises ValueError when the kind is absent or unknown; registers nothing for local_toml. For motherduck_flight_secrets it registers the Flight secrets provider, whose store is a Flight's injected environment: in this container that resolves nothing, so a credential a container run needs fails where dlt names the field rather than here. For databricks_secret_scope it registers nothing: only the Databricks job that runs the pipeline reads the scope (dbutils.secrets).
• register_akv_provider(vault_url=None) — the bare Azure registration, for a process with no destination to configure (source-connection verification). Idempotent: a second call in the same interpreter is a no-op.
• AzureKeyVaultProvider — the dlt provider. Authenticates through Studio's credential broker on the runtime-declared identity lane and maps the dlt key to a vault secret name. A vault answer of 401 or 403 raises KeyVaultAccessDeniedError naming the vault and the secret, so an access problem is never reported as a missing secret.
• register_studio_key_vault_provider(vault_url=None) — registers the Internal Studio Key Vault provider. It reads the IAT from the private credential file for each request and calls Studio's AKV-compatible api-version=7.4 Get Secret endpoint directly; it does not invoke the credential broker.
• register_aws_secrets_manager_provider(location=None, region=None) — registers the AWS Secrets Manager provider (aws_secrets_manager). Reads VD_DOMAIN_SECRET_STORE_LOCATION (the ARN prefix arn:<partition>:secretsmanager:<region>:<account>:secret:<namePrefix>) and VD_DOMAIN_SECRET_STORE_REGION. It builds boto3.Session(profile_name="vd-secrets"), whose credential_process is Studio's vd-aws-credential helper; no credential enters the environment or touches disk, and botocore re-runs the helper before the session expires. GetSecretValue is called by name (<namePrefix> + the dotted dlt key as /-separated segments, case preserved, _ untouched), never by ARN. ResourceNotFoundException (and a secret marked for deletion) is "not found", so the next dlt provider is consulted. AccessDeniedException, KMS decrypt denials, a rejected session and a failed credential_process (including the Broker's aws_secrets_manager_sentinel_missing) raise AwsSecretsManagerConfigurationError carrying the message, never "not found".