modules.trusted

User-space client for the trusted → user call bridge. Lets scene / library / code-mode scripts trigger orchestration that lives in the engine's trusted VM — auth, connection, and service flows we author in trusted Luau — without exposing the trusted source or the privileged primitives those flows use (auth.*, egress credentials, …).

Auto-injected by the prelude as the global trusted, so scripts just call:

local who = trusted.call("session.whoami")  -- { linked = true, issuer = "https://…" }

trusted.call(name, ...) marshals the args into the trusted VM, runs the named handler against its __TRUSTED_EXPORTS registry, and marshals the single return value back as plain data (nil / boolean / number / string / table). It raises a Luau error if the method is not registered, the trusted VM is not ready, or the trusted handler errors. The handler must not yield. On the engine VM it runs synchronously in the call's frame. On a worker VM the call is queued for the engine thread, which runs the handler in the trusted VM; the calling task waits until the answer arrives and the call then returns it, so the call site reads the same.

Backed by the single generic __trustedBridge.invoke Rust transport (__trustedBridge.invokeQueued on a worker VM, crates/zero_scripting/src/ffi/bindings/trusted_bridge.rs). Trusted methods are registered on the other side via the trusted module /zero/trusted/exports (expose(name, handler)). See docs/specs/trusted-user-bridge.md for the full design and the steps to add a new method (no Rust required).