pdum_aiui

Appearance

Interface: BrokerConnectorOptions ​

Defined in: packages/aiui-cf-creds/src/mosaic.ts:30

@habemus-papadum/aiui-cf-creds — broker-backed ephemeral credentials for aiui apps: adapters from the cf_browser_credentials kit (@habemus-papadum/cf-*) to aiui's existing credential seams. A bridge in the strict sense — it implements one contract against the other and adds no seam of its own. Contract of record: the aiui-cf-creds proposal (pdum_aiui git history).

The target apps are serverless/static aiui deployments behind a broker-fronted origin (a Cloudflare Worker owning /api/credentials/*, both behind Cloudflare Access): a static page that mints its own short-lived credentials with no vendor key existing anywhere.

The bridges live on subpaths so each app pays only for what it uses:

  • aiui-cf-creds/oracle — federatedKeySource: ek_ client secrets minted browser-side over workload identity federation (no parent key).
  • aiui-cf-creds/stt — both STT credential flavors: single-use scribe connect URLs and transcription-type ek_ sources.
  • aiui-cf-creds/mosaic — brokerConnector: the app's Mosaic connector wrapped so every query runs with current credentials installed.

This root holds only what the bridges share: the broker-origin convention, the key-contract key option (kit ≥0.4 — the app names ITSELF and every id rides the broker's mint response), and the app-wide AWS credential manager (create ONE, pass it to each bridge's manager option).

Extends ​

Properties ​

brokerUrl? ​

optional brokerUrl?: string

Defined in: packages/aiui-cf-creds/src/shared.ts:31

The broker's origin (e.g. https://app.example.test) for cross-origin dev. Default: absent — routes stay same-origin relative, the zero-config production case. The kit's conventional /api/credentials/* paths are appended; the broker owns that prefix by the kit's own contract.

Inherited from ​

BrokerOptions.brokerUrl

forceRefresh? ​

optional forceRefresh?: () => boolean

Defined in: node_modules/.pnpm/@habemus-papadum+cf-creds-mosaic@0.4.0_@uwdata+mosaic-core@0.28.1/node_modules/@habemus-papadum/cf-creds-mosaic/dist/index.d.ts:30

When it returns true, force a fresh mint on every query.

Returns ​

boolean

Inherited from ​

CredentialAwareOptions.forceRefresh

key? ​

optional key?: string

Defined in: packages/aiui-cf-creds/src/shared.ts:40

The app's OWN name under the broker's key contract (kit ≥0.4): the broker maps (key, identity) to everything the page needs — role, region, and for OpenAI the whole federation config — so no deployment identity is baked anywhere. Rides every route as ?key=. With a key, per-provider ids stop being required; without one, the legacy explicit options still work.

Inherited from ​

BrokerOptions.key

manager? ​

optional manager?: CredentialManager<AwsCredentials>

Defined in: packages/aiui-cf-creds/src/mosaic.ts:33

Reuse the app's manager; default constructs one against brokerUrl (and key, when the broker speaks the key contract).

onInstall? ​

optional onInstall?: (mode, creds) => void

Defined in: node_modules/.pnpm/@habemus-papadum+cf-creds-mosaic@0.4.0_@uwdata+mosaic-core@0.28.1/node_modules/@habemus-papadum/cf-creds-mosaic/dist/index.d.ts:32

Observe each install (mode resolution, rotation counting).

Parameters ​

mode ​

InstallMode

creds ​

AwsCredentials

Returns ​

void

Inherited from ​

CredentialAwareOptions.onInstall

region? ​

optional region?: string

Defined in: packages/aiui-cf-creds/src/mosaic.ts:38

The S3 region installed with each credential set. With key it rides the broker's envelope and this override is unnecessary; without one it stays a baked per-deployment fact (D3), like the bucket endpoint the app already owns.

Overrides ​

CredentialAwareOptions.region