persistTwoFactorSetupToken (src/twoFactor.ts)

Persists, reads, and clears two‑factor setup tokens across tabs using sessionStorage and in‑memory mirror.

// Source: https://github.com/danny-avila/librechat | License: MIT | Copyright 2026 LibreChat
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Hand-off channel for the required-enrollment setup token.
 *
 * The token is a bearer credential in its own right: it can generate a TOTP secret of the
 * holder's choosing and then drive confirm, acknowledge, and finalize into a real session, with
 * no victim secret involved. Carrying it in the query string would leave it in browser history,
 * in access and reverse-proxy logs, and potentially in a Referer header, so it is handed to the
 * setup screen out of band instead.
 *
 * Session storage survives the hard navigation the response interceptor performs and is scoped to
 * the one tab. The in-memory mirror keeps the flow 

... (truncated -- full source via MCP)