Metadata-Version: 2.5
Name: vibedata-dlt-studio-secrets
Version: 0.1.0
Summary: VibeData dlt runtime — the Studio execution units' shared Secret Store registration: the broker-authenticated Azure Key Vault dlt provider and the store-kind dispatch every Studio unit (Fabric Lakehouse, Fabric Warehouse, DuckDB/MotherDuck) performs before its first secret read. A dependency of the Studio units; never installed to run a pipeline on its own.
Author-email: Vibedata <eng@acceleratedata.ai>
License: MIT
Requires-Python: >=3.11
Requires-Dist: azure-core>=1.30.0
Requires-Dist: azure-keyvault-secrets>=4.8.0
Requires-Dist: dlt>=1.0.0
Requires-Dist: vibedata-dlt-core
Requires-Dist: vibedata-studio-azure-cred-broker>=0.1.4
Provides-Extra: dev
Requires-Dist: pytest-mock>=3.12; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Description-Content-Type: text/markdown

# vibedata-dlt-studio-secrets

Shared Secret Store registration for the **Studio execution units** of the
VibeData dlt runtime. A dependency package, not a runnable distribution.

A Domain binds one Secret Store — `local_toml` or `azure_key_vault` —
independently of its Data Platform (ADR-0022). dlt reads a `local_toml` store
natively from the mounted `secrets.toml`; an `azure_key_vault` store needs a dlt
config provider registered **in the same interpreter** before the first
`dlt.secrets` read. Every Studio unit (Fabric Lakehouse, Fabric Warehouse,
DuckDB/MotherDuck) performs that registration through this package, so the
behaviour is identical whichever destination the pipeline targets.

```python
from vibedata.dlt.studio_secrets import register_secret_provider

register_secret_provider()   # reads VD_DOMAIN_SECRET_STORE_KIND; registers Key Vault when bound
```

- `register_secret_provider()` — the kind-gated entry point every unit's
  `setup_environment()` calls first. Raises `ValueError` when the kind is
  absent or unknown; registers nothing for `local_toml`.
- `register_akv_provider(vault_url=None)` — the bare registration, for a
  process with no destination to configure (source-connection verification).
  Idempotent: a second call in the same interpreter is a no-op.
- `AzureKeyVaultProvider` — the dlt provider. Authenticates through Studio's
  credential broker on the runtime-declared identity lane and maps the dlt key
  to a vault secret name. A vault answer of 401 or 403 raises
  `KeyVaultAccessDeniedError` naming the vault and the secret, so an access
  problem is never reported as a missing secret.
