pdum_aiui

Appearance

Interface: TranscriptionKeySourceOptions ​

Defined in: packages/aiui-cf-creds/src/stt.ts:55

@habemus-papadum/aiui-cf-creds — broker-backed ephemeral credentials for aiui apps: adapters from the cf_browser_credentials kit (@habemus-papadum/cf-*) to aiui's existing credential seams. A bridge in the strict sense — it implements one contract against the other and adds no seam of its own. Contract of record: the aiui-cf-creds proposal (pdum_aiui git history).

The target apps are serverless/static aiui deployments behind a broker-fronted origin (a Cloudflare Worker owning /api/credentials/*, both behind Cloudflare Access): a static page that mints its own short-lived credentials with no vendor key existing anywhere.

The bridges live on subpaths so each app pays only for what it uses:

  • aiui-cf-creds/oracle — federatedKeySource: ek_ client secrets minted browser-side over workload identity federation (no parent key).
  • aiui-cf-creds/stt — both STT credential flavors: single-use scribe connect URLs and transcription-type ek_ sources.
  • aiui-cf-creds/mosaic — brokerConnector: the app's Mosaic connector wrapped so every query runs with current credentials installed.

This root holds only what the bridges share: the broker-origin convention, the key-contract key option (kit ≥0.4 — the app names ITSELF and every id rides the broker's mint response), and the app-wide AWS credential manager (create ONE, pass it to each bridge's manager option).

Extends ​

Properties ​

audience? ​

optional audience?: string

Defined in: packages/aiui-cf-creds/src/oracle.ts:76

Must match the audience configured on the identity provider (the kit defaults to the vendor API root). Legacy explicit lane; with key the audience rides the broker's bundle.

Inherited from ​

FederatedMintOptions.audience

brokerUrl? ​

optional brokerUrl?: string

Defined in: packages/aiui-cf-creds/src/shared.ts:31

The broker's origin (e.g. https://app.example.test) for cross-origin dev. Default: absent — routes stay same-origin relative, the zero-config production case. The kit's conventional /api/credentials/* paths are appended; the broker owns that prefix by the kit's own contract.

Inherited from ​

FederatedMintOptions.brokerUrl

client? ​

optional client?: MintClient

Defined in: packages/aiui-cf-creds/src/oracle.ts:80

Inject a ready client (tests, a custom federation). Default: the keyed broker bundle (createBrokeredOpenAI) when key is set, else createFederatedOpenAI over the resolved manager and explicit ids.

Inherited from ​

FederatedMintOptions.client

expiresAfterSeconds? ​

optional expiresAfterSeconds?: number

Defined in: packages/aiui-cf-creds/src/oracle.ts:72

ek_ TTL, seconds; vendor bounds 10–7200. Default 600.

Inherited from ​

FederatedMintOptions.expiresAfterSeconds

identityProviderId? ​

optional identityProviderId?: string

Defined in: packages/aiui-cf-creds/src/oracle.ts:65

From the OpenAI dashboard's provider registration (idp_…).

Deprecated ​

Legacy explicit lane; with key the id rides the broker's bundle — no deployment identity in the composition root at all.

Inherited from ​

FederatedMintOptions.identityProviderId

key? ​

optional key?: string

Defined in: packages/aiui-cf-creds/src/shared.ts:40

The app's OWN name under the broker's key contract (kit ≥0.4): the broker maps (key, identity) to everything the page needs — role, region, and for OpenAI the whole federation config — so no deployment identity is baked anywhere. Rides every route as ?key=. With a key, per-provider ids stop being required; without one, the legacy explicit options still work.

Inherited from ​

FederatedMintOptions.key

manager? ​

optional manager?: CredentialManager<AwsCredentials>

Defined in: packages/aiui-cf-creds/src/oracle.ts:57

Reuse the app's manager (legacy explicit lane only; with key the broker's openai bundle rides its own manager). Default constructs one against brokerUrl.

Inherited from ​

FederatedMintOptions.manager

region? ​

optional region?: string

Defined in: packages/aiui-cf-creds/src/oracle.ts:61

STS region — GetWebIdentityToken exists only on regional endpoints.

Deprecated ​

Legacy explicit lane; with key the region rides the broker's bundle.

Inherited from ​

FederatedMintOptions.region

serviceAccountId? ​

optional serviceAccountId?: string

Defined in: packages/aiui-cf-creds/src/oracle.ts:70

From the OpenAI service account (user-…) — created KEYLESS; federation is the sole way in.

Deprecated ​

Legacy explicit lane; with key the id rides the broker's bundle.

Inherited from ​

FederatedMintOptions.serviceAccountId

transcriptionModel? ​

optional transcriptionModel?: string

Defined in: packages/aiui-cf-creds/src/stt.ts:58

Baked into the minted secret's session config. Default DEFAULT_TRANSCRIPTION_MODEL.