{"record":{"id":"7d04f9018deb5785","repo":"BoundaryML/baml","slug":"baml-internal-error-credential-provider-bridges-not","errorCode":null,"errorMessage":"BAML internal error - credential provider bridges not initialized","messagePattern":"BAML internal error - credential provider bridges not initialized","errorType":"exception","errorClass":"RuntimeCallbackError","httpStatus":null,"severity":"error","filePath":"engine/baml-runtime/src/types/js_callback_provider.rs","lineNumber":38,"sourceCode":"}\n\n#[derive(Debug, Error, Clone)]\n/// For baml-src-reader and aws-cred-provider, provide a statically defined type which is Send + Sync\n/// anyhow::Error is not Send + Sync, so it's convoluted to use it in this callback context\npub enum RuntimeCallbackError {\n    #[error(\"Failed to send cred request across WASM bridge: {0}\")]\n    SendError(String),\n\n    #[error(\"Failed to recv cred response across WASM bridge: {0}\")]\n    RecvError(String),\n\n    #[error(\"Type error in JS callback: {0}\")]\n    JsCallbackTypeError(String),\n\n    #[error(\"JS callback error: {name}: {message}\")]\n    JsCallbackRuntimeError { name: String, message: String },\n\n    #[error(\"BAML internal error - credential provider bridges not initialized\")]\n    NoCredProviderBridge,\n}\n\nstatic_assertions::assert_impl_all!(RuntimeCallbackError: Send, Sync);\n\npub type RuntimeCallbackResult<T> = Result<T, RuntimeCallbackError>;\n\nstatic JS_CALLBACK_PROVIDER_SINGLETON: OnceLock<JsCallbackProvider> = OnceLock::new();\n\npub fn get_js_callback_provider() -> Result<&'static JsCallbackProvider, RuntimeCallbackError> {\n    JS_CALLBACK_PROVIDER_SINGLETON\n        .get()\n        .ok_or(RuntimeCallbackError::NoCredProviderBridge)\n}\n\npub fn set_js_callback_provider(aws_cred_provider: JsCallbackProvider) {\n    match JS_CALLBACK_PROVIDER_SINGLETON.set(aws_cred_provider) {\n        Ok(_) => {","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/engine/baml-runtime/src/types/js_callback_provider.rs#L20-L56","documentation":"RuntimeCallbackError::NoCredProviderBridge is returned by `get_js_callback_provider` (js_callback_provider.rs:48-52) when the `JS_CALLBACK_PROVIDER_SINGLETON` OnceLock has not been initialized via `set_js_callback_provider`. It signals that the Rust runtime tried to fetch AWS/GCP credentials through the JS callback bridge, but no bridge was ever registered - an initialization-order/lifecycle problem in the WASM host.","triggerScenarios":"Calling a BAML function whose AWS or GCP credential provider requires the JS bridge (aws_req/gcp_req) before the host called `set_js_callback_provider`; the OnceLock `.get()` returns None and `ok_or(RuntimeCallbackError::NoCredProviderBridge)` fires (js_callback_provider.rs:49-51).","commonSituations":"Using the WASM/Node build of BAML with an `aws-profile` or GCP auth BAML provider config but never calling the JS-side setup (e.g. `b.setupJsCallbackProvider`) at startup, or the setup running after the first LLM call, or a separate runtime instance missing the registration.","solutions":["Call the JS setup API that registers the credential provider bridge (which internally invokes set_js_callback_provider) before making any BAML function calls.","Move the provider initialization to application startup, before instantiating/invoking BAML functions.","Verify you are not creating a second runtime instance that lacks the singleton registration; the provider is process-global (OnceLock).","If you don't need AWS/GCP bridged credentials, change the BAML provider config to use env/static credentials instead of the JS callback provider."],"exampleFix":"// before\nconst result = await b.GenerateSummary(input); // NoCredProviderBridge\n\n// after\nawait b.setupJsCallbackProvider({ awsCredentialProvider: defaultProvider() });\nconst result = await b.GenerateSummary(input);","handlingStrategy":"validation","validationCode":"// ensure the bridge is registered before any BAML call\nlet bridgeReady = false;\nexport async function initBaml() {\n  await b.setupJsCallbackProvider({ awsCredentialProvider: defaultProvider() });\n  bridgeReady = true;\n}\nexport function assertBamlReady() {\n  if (!bridgeReady) throw new Error('Call initBaml() before any BAML function');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Call the JS provider setup at application startup, before the first BAML invocation","Enforce an init-once bootstrap module that all entry points import","Don't spawn multiple runtime instances that bypass the global provider singleton","If the bridge isn't needed, configure BAML providers with static/env credentials instead"],"tags":["wasm","initialization","credentials","aws","lifecycle"],"backgroundTag":"module-init-failed","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}