devframe 0.8.2 → 0.9.0-beta.10

package/dist/server-CD8XmBXl.mjs

@@ -1,167 +0,0 @@
-import { createRpcServer } from "./rpc/server.mjs";
-import { attachWsRpcTransport } from "./rpc/transports/ws-server.mjs";
-import { t as diagnostics } from "./diagnostics-D7wM2cwM.mjs";
-import { t as getInternalContext } from "./context-CBg8iRbQ.mjs";
-import { createServer } from "node:http";
-import { AsyncLocalStorage } from "node:async_hooks";
-import { H3, toNodeHandler } from "h3";
-import { isIP } from "node:net";
-//#region src/node/utils.ts
-function isObject(value) {
-	return Object.prototype.toString.call(value) === "[object Object]";
-}
-const NON_DIALABLE_HOSTS = /* @__PURE__ */ new Set([
-	"0.0.0.0",
-	"127.0.0.1",
-	"::",
-	"0000:0000:0000:0000:0000:0000:0000:0000",
-	""
-]);
-/** Map a bind host to a host a client can actually connect to. */
-function toDialableHost(host) {
-	return NON_DIALABLE_HOSTS.has(host) ? "localhost" : host;
-}
-/** Format a bind host for use in a URL authority (dialable, IPv6-bracketed). */
-function formatHostForUrl(host) {
-	const dialable = toDialableHost(host);
-	return isIP(dialable) === 6 ? `[${dialable}]` : dialable;
-}
-function normalizeHttpServerUrl(host, port) {
-	return `http://${formatHostForUrl(host)}:${port}`;
-}
-//#endregion
-//#region src/node/server.ts
-/**
-* Compose an h3 + WebSocket server for a devframe context. The RPC
-* group is bound to `context.rpc.functions`; the WS endpoint lives on
-* the same port as the HTTP server.
-*/
-async function startHttpAndWs(options) {
-	const { context, port } = options;
-	const bindHost = options.host ?? "localhost";
-	const app = options.app ?? new H3();
-	const ownsHttpServer = !options.server;
-	const httpServer = options.server ?? createServer(toNodeHandler(app));
-	const rpcHost = context.rpc;
-	const asyncStorage = new AsyncLocalStorage();
-	const authHandler = typeof options.auth === "object" ? options.auth : void 0;
-	const effectiveAuthorize = options.authorize ?? authHandler?.authorize;
-	if (authHandler) {
-		for (const fn of authHandler.rpcFunctions) if (!rpcHost.definitions.has(fn.name)) rpcHost.register(fn);
-	}
-	const rpcGroup = createRpcServer(rpcHost.functions, { rpcOptions: {
-		onFunctionError: options.rpcOptions?.onFunctionError,
-		onGeneralError: options.rpcOptions?.onGeneralError,
-		resolver(name, fn) {
-			const rpc = this;
-			if (!fn) return void 0;
-			return async function(...args) {
-				const meta = rpc.$meta;
-				if (effectiveAuthorize && !effectiveAuthorize(name, {
-					meta,
-					rpc
-				})) throw diagnostics.DF0036({ name });
-				return await asyncStorage.run({
-					rpc,
-					meta
-				}, async () => {
-					return (await fn).apply(this, args);
-				});
-			};
-		}
-	} });
-	const separateWsPort = ownsHttpServer && options.wsPort != null && options.wsPort !== port ? options.wsPort : void 0;
-	const { ws, close: closeWs } = attachWsRpcTransport(rpcGroup, {
-		...separateWsPort != null ? {
-			port: separateWsPort,
-			host: bindHost
-		} : { server: httpServer },
-		path: options.path,
-		destroyUnmatched: ownsHttpServer,
-		allowedOrigins: options.allowedOrigins,
-		onConnected: authHandler || options.onPeerConnect ? (peer, meta) => {
-			const session = {
-				meta,
-				rpc: rpcGroup.clients.find((client) => client.$meta === meta)
-			};
-			authHandler?.onConnect(peer, session);
-			options.onPeerConnect?.(peer, session);
-		} : void 0,
-		onDisconnected: (peer, meta) => {
-			options.onPeerDisconnect?.(peer, meta);
-			rpcHost._emitSessionDisconnected(meta);
-		}
-	});
-	rpcHost._rpcGroup = rpcGroup;
-	rpcHost._asyncStorage = asyncStorage;
-	rpcHost._authDisabled = options.auth === false;
-	if (options.auth === false && !rpcHost.definitions.has("anonymous:devframe:auth")) rpcHost.register({
-		name: "anonymous:devframe:auth",
-		type: "action",
-		handler: () => {
-			const session = rpcHost.getCurrentRpcSession();
-			if (session) session.meta.isTrusted = true;
-			return { isTrusted: true };
-		}
-	});
-	if (ownsHttpServer) {
-		try {
-			await new Promise((resolve, reject) => {
-				const onError = (error) => reject(error);
-				httpServer.once("error", onError);
-				httpServer.listen(port, bindHost, () => {
-					httpServer.removeListener("error", onError);
-					resolve();
-				});
-			});
-		} catch (error) {
-			await closeWs().catch(() => {});
-			throw diagnostics.DF0052({
-				host: bindHost,
-				port,
-				reason: error instanceof Error ? error.message : String(error),
-				cause: error
-			});
-		}
-		if (options.onServerError) httpServer.on("error", options.onServerError);
-	}
-	const address = httpServer.address();
-	const resolvedPort = typeof address === "object" && address ? address.port : port;
-	const origin = normalizeHttpServerUrl(bindHost, resolvedPort);
-	const internal = getInternalContext(context);
-	const wsPortForUrl = separateWsPort ?? resolvedPort;
-	const wsUrl = `ws://${formatHostForUrl(bindHost)}:${wsPortForUrl}${options.path ?? ""}`;
-	internal.wsEndpoint = { url: wsUrl };
-	if (options.onReady) await options.onReady({
-		origin,
-		port: resolvedPort,
-		app
-	});
-	function connectionMeta() {
-		const jsonSerializableMethods = [];
-		for (const def of rpcHost.definitions.values()) if (def.jsonSerializable === true) jsonSerializableMethods.push(def.name);
-		return {
-			backend: "websocket",
-			websocket: separateWsPort != null ? {
-				port: separateWsPort,
-				path: options.path
-			} : { path: options.path },
-			jsonSerializableMethods
-		};
-	}
-	return {
-		origin,
-		port: resolvedPort,
-		app,
-		ws,
-		rpcGroup,
-		connectionMeta,
-		async close() {
-			await closeWs();
-			if (ownsHttpServer) await new Promise((r) => httpServer.close(() => r()));
-			if (getInternalContext(context).wsEndpoint?.url === wsUrl) getInternalContext(context).wsEndpoint = void 0;
-		}
-	};
-}
-//#endregion
-export { toDialableHost as a, normalizeHttpServerUrl as i, formatHostForUrl as n, isObject as r, startHttpAndWs as t };

package/dist/server-UHWae43Q.d.mts

@@ -1,149 +0,0 @@
-import { $ as DevframeRpcServerFunctions, Q as DevframeRpcClientFunctions, W as DevframeNodeRpcSession, _ as ConnectionMeta, b as DevframeNodeContext, p as DevframeAuthHandler } from "./devframe-mQ4qZAuo.mjs";
-import { n as DevframeNodeRpcSessionMeta, r as WsOriginRegistry } from "./ws-server-uKQcClcJ.mjs";
-import "./index-b64Uuhy2.mjs";
-import { Peer } from "crossws";
-import { BirpcGroup, EventOptions } from "birpc";
-import { NodeAdapter } from "crossws/adapters/node";
-import { Server } from "node:http";
-import { H3 } from "h3";
-//#region src/node/server.d.ts
-interface StartHttpAndWsOptions {
-  context: DevframeNodeContext;
-  host?: string;
-  port: number;
-  /**
-   * Optional h3 app to mount on. When omitted a fresh one is created;
-   * when provided, callers can add their own routes (static handlers,
-   * auth middleware, etc.) first.
-   */
-  app?: H3;
-  /**
-   * Bind the WS endpoint to a single upgrade route (e.g. `/__devframe_ws`) instead of
-   * claiming every upgrade on the port. This lets the socket share a server
-   * with other upgrade handlers (Vite HMR, a host framework's own sockets)
-   * and is what the SPA's `__connection.json` points at. When omitted, the WS
-   * server handles every upgrade on the port (legacy behaviour).
-   */
-  path?: string;
-  /**
-   * Bind the WS endpoint on its own port instead of sharing the HTTP server's.
-   * The HTTP/SPA server still listens on `port`; the socket gets a dedicated
-   * `ws` server on `wsPort` (same `host`). Use this for the "different port"
-   * connection scenario. Ignored when a `server` is supplied.
-   */
-  wsPort?: number;
-  /**
-   * Mount the WS endpoint onto an existing HTTP server, sharing its port,
-   * rather than creating and listening on a fresh one. Use this to embed
-   * devframe's RPC socket inside a host server (e.g. a Vite dev server) — pair
-   * it with `path` so it coexists with the host's routes. The caller owns the
-   * server's lifecycle: {@link StartedServer.close} detaches devframe's upgrade
-   * listener but leaves the host server running. When set, `host`/`port` are
-   * only used to report the resolved origin.
-   */
-  server?: Server;
-  /**
-   * Authentication for the server:
-   *
-   *   - `true` (default) — no gate; every registered method is callable
-   *     regardless of trust (today's behavior, unchanged).
-   *   - `false` — the RPC server is started without a trust handshake.
-   *     Intended for single-user localhost tools where an auth round-trip
-   *     would only get in the way. A noop `anonymous:devframe:auth` handler
-   *     is registered so the browser client's unconditional handshake call
-   *     succeeds and auto-trusts.
-   *   - A {@link DevframeAuthHandler} (e.g. from
-   *     `devframe/recipes/interactive-auth`'s `createInteractiveAuth`) —
-   *     registers its `rpcFunctions`, wires its `authorize` as the resolver
-   *     gate, and wires its `onConnect` on every new peer. This is the
-   *     fully-authenticated server: an untrusted caller can only reach
-   *     `anonymous:`-prefixed methods (see `isAnonymousRpcMethod`).
-   */
-  auth?: boolean | DevframeAuthHandler;
-  /**
-   * Lower-level escape hatch: gate individual RPC calls by method name and
-   * session without a full {@link DevframeAuthHandler}. Ignored when `auth`
-   * is a handler object (its own `authorize` is used); combine with `auth:
-   * true` to layer a custom policy on top of an otherwise ungated server.
-   */
-  authorize?: (methodName: string, session: DevframeNodeRpcSession) => boolean;
-  /**
-   * Called once per new WS connection, right after its session is created
-   * (before any RPC call is dispatched). Runs after the auth handler's own
-   * `onConnect` (when `auth` is a {@link DevframeAuthHandler}), so it can
-   * observe — but not override — the connect-time trust decision.
-   */
-  onPeerConnect?: (peer: Peer, session: DevframeNodeRpcSession) => void;
-  /**
-   * Called once per closed WS connection, right after the transport's own
-   * disconnect bookkeeping runs. Unlike {@link onPeerConnect} this receives
-   * the raw session meta, not a wrapped session — by the time a peer
-   * disconnects there is no live RPC client left to attach.
-   */
-  onPeerDisconnect?: (peer: Peer, meta: DevframeNodeRpcSessionMeta) => void;
-  /**
-   * Forwarded verbatim to the internal `createRpcServer`'s birpc
-   * `rpcOptions`, alongside the resolver `startHttpAndWs` installs for
-   * auth/session wiring. Use this so a host that owns its own structured
-   * diagnostics (e.g. a coded error reporter) keeps seeing RPC failures
-   * instead of them being silently absorbed by delegating to
-   * `startHttpAndWs`. Returning `true` from either callback suppresses
-   * birpc's own error response to the caller — see birpc's
-   * `EventOptions` for the full contract.
-   */
-  rpcOptions?: Pick<EventOptions<DevframeRpcClientFunctions, DevframeRpcServerFunctions, false>, 'onFunctionError' | 'onGeneralError'>;
-  /**
-   * Extra origins to accept on the WS upgrade beyond the loopback default
-   * (`localhost`/`127.0.0.1`/`::1` and any `Origin`-less request from a
-   * native client). Add your LAN/tunnel origin here when reaching the tool
-   * from another host. Pass `false` to disable origin checking entirely
-   * (not recommended). Default: loopback-only.
-   */
-  allowedOrigins?: readonly string[] | WsOriginRegistry | false;
-  /**
-   * Called once the WS server is bound so callers can mount static
-   * handlers whose origin depends on the resolved port, or print their
-   * own startup banner. Devframe does not print one itself.
-   */
-  onReady?: (info: {
-    origin: string;
-    port: number;
-    app: H3;
-  }) => void | Promise<void>;
-  /**
-   * Called for any error the HTTP server devframe owns emits after it starts
-   * listening — e.g. a transient `EMFILE` while accepting a connection.
-   * Without it such an error has no listener and crashes the process.
-   *
-   * Applies only to a server devframe created itself. When `server` is
-   * supplied the caller owns that object and attaches to it directly, so
-   * devframe leaves its error handling alone.
-   */
-  onServerError?: (error: Error) => void;
-}
-interface StartedServer {
-  /** Listening origin, e.g. `http://localhost:9999`. */
-  origin: string;
-  port: number;
-  app: H3;
-  /** The crossws node adapter driving the RPC socket (connected peers, pub/sub). */
-  ws: NodeAdapter;
-  rpcGroup: BirpcGroup<DevframeRpcClientFunctions, DevframeRpcServerFunctions, false>;
-  /**
-   * The {@link ConnectionMeta} descriptor for this server — the same shape
-   * a `__connection.json` route should serve so a devframe client's
-   * `resolveWsUrl` can dial back in. Reflects the `path` / `wsPort` this
-   * server was started with and the `jsonSerializable` methods currently
-   * registered on `context.rpc`.
-   */
-  connectionMeta: () => ConnectionMeta;
-  close: () => Promise<void>;
-}
-/**
- * Compose an h3 + WebSocket server for a devframe context. The RPC
- * group is bound to `context.rpc.functions`; the WS endpoint lives on
- * the same port as the HTTP server.
- */
-declare function startHttpAndWs(options: StartHttpAndWsOptions): Promise<StartedServer>;
-//#endregion
-export { StartedServer as n, startHttpAndWs as r, StartHttpAndWsOptions as t };

package/dist/simple-schema-BDzLeJDk.d.mts

@@ -1,102 +0,0 @@
-import { StandardSchemaV1 } from "@standard-schema/spec";
-//#region src/utils/simple-schema.d.ts
-/**
- * A tiny, zero-dependency [Standard Schema](https://standardschema.dev/)
- * builder.
- *
- * ⚠️ **Discouraged for app code.** This is a deliberately minimal,
- * best-effort validator that exists only so devframe's own first-party
- * packages (recipes, built-in plugins) can declare `args`/`returns`/flag
- * schemas without taking on a validator dependency. It implements a small
- * subset of primitives and approximates refinements — it is not a
- * general-purpose validator.
- *
- * For your own code, prefer a real Standard Schema validator — **valibot**,
- * **zod**, or **arktype**. Devframe's RPC and CLI-flag layers accept any of
- * them; install the one you like and use it directly:
- *
- * ```ts
- * import * as v from 'valibot' // npm i valibot
- *
- * defineRpcFunction({
- *   name: 'greet',
- *   args: [v.object({ name: v.string() })],
- *   returns: v.string(),
- *   handler: ({ name }) => `hi ${name}`,
- * })
- * ```
- */
-/**
- * A Standard Schema produced by the {@link s} builder. It carries a
- * duck-typed `type` marker (and `wrapped` for wrappers) alongside the
- * standard `~standard` prop so the CLI-flags adapter can introspect the
- * schema kind without importing any validator.
- */
-interface SimpleSchema<Input, Output = Input> extends StandardSchemaV1<Input, Output> {
-  /** Schema kind marker, e.g. `'string'`, `'boolean'`, `'optional'`. */
-  readonly type: string;
-  /** Inner schema for wrapper kinds (`optional` / `nullable`). */
-  readonly wrapped?: StandardSchemaV1;
-  /** Optional human description (surfaced as CLI option help). */
-  readonly description?: string;
-}
-/** Any string. */
-declare function string(): SimpleSchema<string>;
-/** A finite number (rejects `NaN`). */
-declare function number(): SimpleSchema<number>;
-/** A boolean. */
-declare function boolean(): SimpleSchema<boolean>;
-/** `undefined` — mirrors valibot's `void`. */
-declare function voidType(): SimpleSchema<void>;
-/** `null`. */
-declare function nullType(): SimpleSchema<null>;
-/** One of a fixed set of literal values. */
-declare function picklist<const T extends readonly (string | number | boolean)[]>(values: T): SimpleSchema<T[number]>;
-/** A single literal value (string / number / boolean). */
-declare function literal<const T extends string | number | boolean>(value: T): SimpleSchema<T>;
-/** A value matching any one of the given schemas. */
-declare function union<const T extends readonly StandardSchemaV1[]>(options: T): SimpleSchema<StandardSchemaV1.InferInput<T[number]>, StandardSchemaV1.InferOutput<T[number]>>;
-/** A record with string keys whose values each satisfy the value schema. */
-declare function record<V extends StandardSchemaV1>(_key: StandardSchemaV1, value: V): SimpleSchema<Record<string, StandardSchemaV1.InferInput<V>>, Record<string, StandardSchemaV1.InferOutput<V>>>;
-/** An array whose every element satisfies the item schema. */
-declare function array<T extends StandardSchemaV1>(item: T): SimpleSchema<StandardSchemaV1.InferInput<T>[], StandardSchemaV1.InferOutput<T>[]>;
-/** Flatten an intersection into a single object literal for readable types. */
-type Prettify<T> = { [K in keyof T]: T[K]; } & {};
-/**
- * Map a shape to its object type, turning fields whose type includes
- * `undefined` (i.e. `optional()`) into optional keys — mirroring how
- * valibot/zod render `optional` object entries.
- */
-type InferField<T extends StandardSchemaV1, Mode extends 'input' | 'output'> = Mode extends 'input' ? StandardSchemaV1.InferInput<T> : StandardSchemaV1.InferOutput<T>;
-type InferObject<T extends Record<string, StandardSchemaV1>, Mode extends 'input' | 'output'> = Prettify<{ [K in keyof T as undefined extends InferField<T[K], Mode> ? never : K]: InferField<T[K], Mode>; } & { [K in keyof T as undefined extends InferField<T[K], Mode> ? K : never]?: InferField<T[K], Mode>; }>;
-/** An object whose known keys each satisfy their schema (extra keys are kept). */
-declare function object<T extends Record<string, StandardSchemaV1>>(shape: T): SimpleSchema<InferObject<T, 'input'>, InferObject<T, 'output'>>;
-/** Allow `undefined` in addition to the inner schema. */
-declare function optional<T extends StandardSchemaV1>(inner: T): SimpleSchema<StandardSchemaV1.InferInput<T> | undefined, StandardSchemaV1.InferOutput<T> | undefined>;
-/** Allow `null` in addition to the inner schema. */
-declare function nullable<T extends StandardSchemaV1>(inner: T): SimpleSchema<StandardSchemaV1.InferInput<T> | null, StandardSchemaV1.InferOutput<T> | null>;
-/** Attach a human-readable description (used for CLI option help). */
-declare function describe<T extends SimpleSchema<any, any>>(schema: T, description: string): T;
-/**
- * Grouped access to every builder — `s.string()`, `s.object({ ... })`,
- * `s.void()`, etc. Handy for a valibot-like `import { s } from
- * 'devframe/utils/simple-schema'` call site.
- */
-declare const s: {
-  readonly string: typeof string;
-  readonly number: typeof number;
-  readonly boolean: typeof boolean;
-  readonly void: typeof voidType;
-  readonly null: typeof nullType;
-  readonly literal: typeof literal;
-  readonly picklist: typeof picklist;
-  readonly union: typeof union;
-  readonly record: typeof record;
-  readonly array: typeof array;
-  readonly object: typeof object;
-  readonly optional: typeof optional;
-  readonly nullable: typeof nullable;
-  readonly describe: typeof describe;
-};
-//#endregion
-export { literal as a, number as c, picklist as d, record as f, voidType as g, union as h, describe as i, object as l, string as m, array as n, nullType as o, s as p, boolean as r, nullable as s, SimpleSchema as t, optional as u };

package/dist/state-BeUHDDjk.mjs

@@ -1,108 +0,0 @@
-import { DEVFRAME_OTP_URL_PARAM } from "./constants.mjs";
-import { n as randomToken, r as timingSafeEqual, t as randomDigits } from "./crypto-token-XCqTSMg9.mjs";
-//#region src/node/auth/state.ts
-/** Number of decimal digits in a human-typed one-time authentication code. */
-const TEMP_AUTH_CODE_LENGTH = 6;
-/**
-* How long an authentication code stays valid after it is (re)generated. A
-* 6-digit code only has ~20 bits of entropy, so a short lifetime plus the
-* attempt cap below are what keep it brute-force resistant.
-*/
-const TEMP_AUTH_CODE_TTL = 5 * 6e4;
-/** Failed attempts allowed against a single code before it is rotated. */
-const TEMP_AUTH_MAX_ATTEMPTS = 5;
-let tempAuthCode = generateTempCode();
-let tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
-let tempAuthFailedAttempts = 0;
-function generateTempCode() {
-	return randomDigits(TEMP_AUTH_CODE_LENGTH);
-}
-/**
-* The current one-time authentication code. Display this to the user (e.g. in
-* the dev-server terminal) so they can type it into the browser to authenticate.
-*/
-function getTempAuthCode() {
-	return tempAuthCode;
-}
-/**
-* Rotate the authentication code, resetting its expiry window and failed-attempt
-* counter. Call this when a new authentication flow begins (e.g. when an
-* untrusted client starts authenticating) so the displayed code is freshly
-* valid for its full TTL.
-*/
-function refreshTempAuthCode() {
-	tempAuthCode = generateTempCode();
-	tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
-	tempAuthFailedAttempts = 0;
-	return tempAuthCode;
-}
-/**
-* Build a "magic link" authentication URL that embeds a one-time code (OTP) in
-* the URL **fragment**. Opening it authenticates the client without typing —
-* print it on startup (devframe stays headless, so the host prints its own
-* banner). Defaults to the current code; the link is subject to the same TTL.
-*
-* The code rides the fragment (`#devframe_otp=…`), not the query string, so it
-* is never sent to the server, written to an access log, or leaked in a
-* `Referer` header — the browser client reads it locally (see
-* `consumeOtpFromUrl`). Any existing fragment parameters are preserved.
-*/
-function buildOtpAuthUrl(baseUrl, code = tempAuthCode) {
-	const url = new URL(baseUrl);
-	const fragment = new URLSearchParams(url.hash.replace(/^#/, ""));
-	fragment.set(DEVFRAME_OTP_URL_PARAM, code);
-	url.hash = fragment.toString();
-	return url.href;
-}
-/**
-* Re-authenticate a connection that presents a previously-issued bearer token.
-* Returns `true` and marks the session trusted when the token is known.
-*
-* Used by the `anonymous:devframe:auth` handler so a client that already
-* authenticated (token persisted in the browser) is trusted on reconnect
-* without entering the code again.
-*/
-function verifyAuthToken(token, session, storage) {
-	if (!token || !storage.value().trusted[token]) return false;
-	session.meta.clientAuthToken = token;
-	session.meta.isTrusted = true;
-	return true;
-}
-/**
-* Exchange a one-time authentication code for a fresh, node-issued bearer token.
-*
-* On success this mints a high-entropy token, records it in the trusted store,
-* marks the calling session trusted, rotates the code, and returns the token
-* for the client to persist. Returns `null` on any failure.
-*
-* Because the code is short and human-typed, verification is hardened against
-* brute force: it enforces a time-to-live, compares in constant time, and
-* rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
-* attacker cannot keep guessing against the same code.
-*/
-function exchangeTempAuthCode(code, session, info, storage) {
-	if (Date.now() > tempAuthCodeExpiresAt) {
-		refreshTempAuthCode();
-		return null;
-	}
-	if (!timingSafeEqual(code, tempAuthCode)) {
-		tempAuthFailedAttempts += 1;
-		if (tempAuthFailedAttempts >= TEMP_AUTH_MAX_ATTEMPTS) refreshTempAuthCode();
-		return null;
-	}
-	const authToken = randomToken();
-	storage.mutate((state) => {
-		state.trusted[authToken] = {
-			authToken,
-			ua: info.ua,
-			origin: info.origin,
-			timestamp: Date.now()
-		};
-	});
-	session.meta.clientAuthToken = authToken;
-	session.meta.isTrusted = true;
-	refreshTempAuthCode();
-	return authToken;
-}
-//#endregion
-export { verifyAuthToken as a, refreshTempAuthCode as i, exchangeTempAuthCode as n, getTempAuthCode as r, buildOtpAuthUrl as t };