@useoneauth/sdk-client

Phase 8 — the untrusted runtime SDK. The limited, client-safe surface over a ServerTransport.

OneAuthClient exposes only signIn, signOut, me, and session.get — it cannot reach admin operations because they are not on the ServerTransport port. It is stateful: after a successful signIn it stores the session and tokens, so me()/signOut()/ session.get() work with no arguments. Clients consume trust; servers define it.

Install

// package.json
{ "dependencies": { "@useoneauth/sdk-client": "workspace:*" } }

Usage

import { OneAuthServer } from "@useoneauth/sdk-server"
import { OneAuthClient, InProcessTransport } from "@useoneauth/sdk-client"

const server = await OneAuthServer.inMemory({ issuer: "...", audience: "..." })
const client = new OneAuthClient(new InProcessTransport(server)) // HttpTransport later — same port

const result = await client.signIn({ identityId, credentialId, secret })
if (result.status === "ok") {
  const me = await client.me()             // uses the stored access token
  const session = await client.session.get()
  await client.signOut()                   // revokes server-side + clears local state
}

Transport boundary

interface ServerTransport {
  signIn(input): Promise<SignInResult>
  signOut(input: { sessionId }): Promise<void>
  me(input: { accessToken }): Promise<Identity | null>
  getSession(input: { sessionId }): Promise<Session | null>
}

• InProcessTransport wraps a OneAuthServer — for embedding OneAuth in the same process (e.g. a server component) and for tests.
• A future HttpTransport implements the same interface over the network and never imports @useoneauth/sdk-server — the production untrusted path.

The client depends on the server (for the OneAuthServer type + shared result types); the server never depends on the client.

See ARCHITECTURE.md.