TypeScript SDK beta

@kismet-tech/sdk@0.1.0-beta.0 is the release candidate for Developer API v0.7. It models all 20 reviewed operations and keeps Kismet credentials and guest tokens out of branded browser code.

Install

Until the beta tag is published, use the verified tarball from this repository. After publication:

npm install @kismet-tech/sdk@beta
npx kismet init

Published content and availability

import { createKismetClient } from '@kismet-tech/sdk/server';

const client = createKismetClient({
  apiKey: process.env.KISMET_DEVELOPER_API_KEY!,
  collection: 'sand-sea-condos',
  baseUrl: process.env.KISMET_API_BASE!,
});

const rentals = await client.vacationRental.list({ limit: 24 });
const availability = await client.vacationRental.availability.get({
  checkIn: '2026-09-10',
  checkOut: '2026-09-14',
  guests: 4,
});

Use @kismet-tech/sdk/contracts for server-safe DTOs, @kismet-tech/sdk/server for the explicit API client, @kismet-tech/sdk/next for same-origin guest-account handlers, and @kismet-tech/sdk/react for credential-free browser clients.

Branded guest experiences

Guest auth is a same-origin BFF flow. Your site owns every visible screen and cookie presentation; the SDK owns the Kismet token exchange, sealed session envelope, CSRF contract, and request validation.

import {
  createKismetGuestAuthNextHandlers,
  createKismetGuestAuthServerClient,
} from '@kismet-tech/sdk/next';

const client = createKismetGuestAuthServerClient({
  serverKey: process.env.KISMET_SERVER_KEY!,
  baseUrl: process.env.KISMET_API_BASE!,
  origin: process.env.NEXT_PUBLIC_SITE_URL!,
});

export const kismetGuest = createKismetGuestAuthNextHandlers({
  client,
  sessionSecret: process.env.KISMET_GUEST_SESSION_SECRET!,
  allowedOrigins: [process.env.NEXT_PUBLIC_SITE_URL!],
});

The browser then calls only same-origin routes for challenge, verify, session, refresh, logout, /guest/me, saves, and signed-in TEST booking requests.

Release status

The SDK is a legitimate beta candidate because contract coverage, packaging, Node/Edge entry points, auth boundaries, and unit coverage exist. Publishing it does not make the Developer API generally available: credentials, deployment confirmation, live smoke testing, public docs hosting, and support policy remain separate launch gates.

See SDK beta evaluation for the clean-consumer workflow and Developer API v0.7 for the server contract.