{
  "slug": "safe/sdk",
  "title": "Safe SDK",
  "description": "The @cuitty/safe package shape, client and server halves, and framework subpaths.",
  "url": "https://cuitty.com/docs/safe/sdk",
  "markdown_url": "https://cuitty.com/docs/safe/sdk.md",
  "json_url": "https://cuitty.com/docs/safe/sdk.json",
  "frontmatter": {
    "title": "Safe SDK",
    "description": "The @cuitty/safe package shape, client and server halves, and framework subpaths.",
    "order": 7,
    "section": "Safe",
    "updatedAt": "2026-06-09"
  },
  "headings": [
    {
      "depth": 1,
      "slug": "safe-sdk",
      "text": "Safe SDK"
    },
    {
      "depth": 2,
      "slug": "client-half",
      "text": "Client half"
    },
    {
      "depth": 2,
      "slug": "server-half",
      "text": "Server half"
    },
    {
      "depth": 2,
      "slug": "core-integration",
      "text": "Core integration"
    },
    {
      "depth": 2,
      "slug": "framework-subpaths",
      "text": "Framework subpaths"
    }
  ],
  "body_markdown": "# Safe SDK\n\nSafe follows the Cuitty SDK initiative: one package per product, with subpath exports for each runtime surface.\n\n```text\n@cuitty/safe\n@cuitty/safe/client\n@cuitty/safe/server\n@cuitty/safe/types\n@cuitty/safe/react\n@cuitty/safe/solid\n@cuitty/safe/dsl\n@cuitty/safe/connectors\n@cuitty/safe/crypto\n@cuitty/safe/css\n```\n\nDo not create dash packages such as `@cuitty/safe-client`.\n\n## Client half\n\nThe client is a typed HTTP consumer generated from the root wire protocol.\n\n```ts\nimport { createSafeClient } from \"@cuitty/safe/client\";\n\nconst safe = createSafeClient({\n  baseUrl: \"http://localhost:4361\",\n  auth,\n});\n\nawait safe.resolve(\"acme/dev/database-url\");\nawait safe.secrets.put(\"acme/dev/github-token\", { value: tokenFromShell });\nawait safe.safes.create({ account: \"acme\", safe: \"dev\", provider: \"local\" });\n```\n\nUse `POST /api/safe/resolve` for resolution so references and values do not end up in URL paths or access logs.\n\n## Server half\n\nThe server half owns product logic and can be embedded instead of calling REST routes.\n\n```ts\nimport { createSafeServer } from \"@cuitty/safe/server\";\n\nconst safe = await createSafeServer({\n  indexPath: \".cuitty/safe/index.json\",\n});\n\nawait safe.resolve(\"acme/dev/database-url\");\n```\n\nProvider implementations must redact values before throwing or logging.\n\n## Core integration\n\n`@cuitty/core` remains a thin aggregator. It may lazy-load Safe and pass shared auth, transport, endpoint discovery, and mock mode into `createSafeClient`, but it must not implement resolving, crypto, provider mapping, 1Password auth, or Store writes.\n\n```ts\nconst cuitty = createCuitty({\n  products: [\"safe\"],\n  endpoints: { safe: \"http://localhost:4361\" },\n  auth,\n});\n\nawait cuitty.safe?.resolve(\"acme/dev/database-url\");\n```\n\n## Framework subpaths\n\nReact and Solid components should be functionally equivalent. Components may display refs, provider status, audit metadata, scan findings, and connector health. They must not receive decrypted values unless the user explicitly enters reveal mode.",
  "links_out": []
}