# TypeScript SDK beta

> Install and evaluate the typed Kismet client, branded guest account helpers, and framework entry points.


`@kismet-tech/sdk@0.1.0-beta.0` is the release candidate for Developer API v0.7. It models all 20 reviewed operations and keeps Kismet credentials and guest tokens out of branded browser code.

## Install

Until the beta tag is published, use the verified tarball from this repository. After publication:

```sh
npm install @kismet-tech/sdk@beta
npx kismet init
```

## Published content and availability

```ts
import { createKismetClient } from '@kismet-tech/sdk/server';

const client = createKismetClient({
  apiKey: process.env.KISMET_DEVELOPER_API_KEY!,
  collection: 'sand-sea-condos',
  baseUrl: process.env.KISMET_API_BASE!,
});

const rentals = await client.vacationRental.list({ limit: 24 });
const availability = await client.vacationRental.availability.get({
  checkIn: '2026-09-10',
  checkOut: '2026-09-14',
  guests: 4,
});
```

Use `@kismet-tech/sdk/contracts` for server-safe DTOs, `@kismet-tech/sdk/server` for the explicit API client, `@kismet-tech/sdk/next` for same-origin guest-account handlers, and `@kismet-tech/sdk/react` for credential-free browser clients.

## Branded guest experiences

Guest auth is a same-origin BFF flow. Your site owns every visible screen and cookie presentation; the SDK owns the Kismet token exchange, sealed session envelope, CSRF contract, and request validation.

```ts
import {
  createKismetGuestAuthNextHandlers,
  createKismetGuestAuthServerClient,
} from '@kismet-tech/sdk/next';

const client = createKismetGuestAuthServerClient({
  serverKey: process.env.KISMET_SERVER_KEY!,
  baseUrl: process.env.KISMET_API_BASE!,
  origin: process.env.NEXT_PUBLIC_SITE_URL!,
});

export const kismetGuest = createKismetGuestAuthNextHandlers({
  client,
  sessionSecret: process.env.KISMET_GUEST_SESSION_SECRET!,
  allowedOrigins: [process.env.NEXT_PUBLIC_SITE_URL!],
});
```

The browser then calls only same-origin routes for challenge, verify, session, refresh, logout, `/guest/me`, saves, and signed-in TEST booking requests.

## Release status

The SDK is a legitimate beta candidate because contract coverage, packaging, Node/Edge entry points, auth boundaries, and unit coverage exist. Publishing it does **not** make the Developer API generally available: credentials, deployment confirmation, live smoke testing, public docs hosting, and support policy remain separate launch gates.

See [SDK beta evaluation](https://developers.kismet.travel/guides/private-evaluation.md) for the clean-consumer workflow and [Developer API v0.7](https://developers.kismet.travel/api.md) for the server contract.