@kazzle/app 0.1.927 → 0.1.930

package/dist/auth-react.d.ts

@@ -0,0 +1,20 @@
+import type { AppUser } from './auth-schema';
+export type { AppUser } from './auth-schema';
+/** Login methods the Kazzle broker supports. Email arrives with the email primitive. */
+export type KazzleLoginMethod = 'google';
+/**
+ * Start sign-in. Redirects the browser through the Kazzle broker to the named
+ * method's login, then back to `callbackURL` (default: the page root).
+ */
+export declare function signInWithKazzle(_method?: KazzleLoginMethod, opts?: {
+    callbackURL?: string;
+}): Promise<unknown>;
+/** Sign the current user out of this app. */
+export declare function signOutOfApp(): Promise<unknown>;
+/**
+ * The signed-in end user, or null. Reactive: re-renders on sign-in/out.
+ * While the session is still loading, returns null (render logged-out UI).
+ */
+export declare function useAppUser(): AppUser | null;
+/** Session loading state, for UIs that want a spinner instead of a flash of logged-out. */
+export declare function useAppUserPending(): boolean;

package/dist/auth-react.js

@@ -0,0 +1,52 @@
+// @kazzle/app/auth/react — app login, browser half.
+//
+// All the agent touches: `useAppUser()` for who's signed in, and
+// `signInWithKazzle()` / `signOutOfApp()` on buttons. The client talks to the
+// app's own /api/auth/* routes (same origin — the UI dev server proxies them
+// to the process; in prod both share one host), so there is no base URL to
+// configure and no auth code to write.
+import { createAuthClient } from 'better-auth/react';
+import { genericOAuthClient } from 'better-auth/client/plugins';
+// Module-private: Better Auth's inferred client type is not portable across
+// d.ts emit. The SDK contract is the functions below, not the raw client.
+const authClient = createAuthClient({
+    plugins: [genericOAuthClient()],
+});
+/**
+ * Start sign-in. Redirects the browser through the Kazzle broker to the named
+ * method's login, then back to `callbackURL` (default: the page root).
+ */
+export function signInWithKazzle(_method = 'google', opts) {
+    // The method is fixed server-side today (authorizationUrlParams). The
+    // parameter exists so login buttons already state their intent — when the
+    // broker gains methods, this maps per-call without app code changing shape.
+    return authClient.signIn.oauth2({
+        providerId: 'kazzle',
+        callbackURL: opts?.callbackURL ?? '/',
+    });
+}
+/** Sign the current user out of this app. */
+export function signOutOfApp() {
+    return authClient.signOut();
+}
+/**
+ * The signed-in end user, or null. Reactive: re-renders on sign-in/out.
+ * While the session is still loading, returns null (render logged-out UI).
+ */
+export function useAppUser() {
+    const { data } = authClient.useSession();
+    const user = data?.user;
+    if (!user)
+        return null;
+    return {
+        id: user.id,
+        email: user.email,
+        emailVerified: user.emailVerified,
+        name: user.name ?? null,
+        image: user.image ?? null,
+    };
+}
+/** Session loading state, for UIs that want a spinner instead of a flash of logged-out. */
+export function useAppUserPending() {
+    return authClient.useSession().isPending;
+}

package/dist/auth-schema.d.ts

@@ -0,0 +1,12 @@
+/** Identity claims the app sees for a signed-in end user. */
+export interface AppUser {
+    id: string;
+    email: string;
+    emailVerified: boolean;
+    name: string | null;
+    image: string | null;
+}
+/** Postgres schema the auth tables live in. */
+export declare const AUTH_PG_SCHEMA = "auth";
+/** Idempotent DDL for the auth tables. Run against the app's own database. */
+export declare const AUTH_SCHEMA_SQL = "\nCREATE SCHEMA IF NOT EXISTS auth;\n\nCREATE TABLE IF NOT EXISTS auth.\"user\" (\n  id text PRIMARY KEY,\n  name text,\n  email text NOT NULL UNIQUE,\n  \"emailVerified\" boolean NOT NULL DEFAULT false,\n  image text,\n  \"createdAt\" timestamptz NOT NULL DEFAULT now(),\n  \"updatedAt\" timestamptz NOT NULL DEFAULT now()\n);\n\nCREATE TABLE IF NOT EXISTS auth.\"session\" (\n  id text PRIMARY KEY,\n  \"expiresAt\" timestamptz NOT NULL,\n  token text NOT NULL UNIQUE,\n  \"ipAddress\" text,\n  \"userAgent\" text,\n  \"userId\" text NOT NULL REFERENCES auth.\"user\"(id) ON DELETE CASCADE,\n  \"createdAt\" timestamptz NOT NULL DEFAULT now(),\n  \"updatedAt\" timestamptz NOT NULL DEFAULT now()\n);\nCREATE INDEX IF NOT EXISTS session_user_id_idx ON auth.\"session\"(\"userId\");\n\nCREATE TABLE IF NOT EXISTS auth.\"account\" (\n  id text PRIMARY KEY,\n  \"accountId\" text NOT NULL,\n  \"providerId\" text NOT NULL,\n  \"userId\" text NOT NULL REFERENCES auth.\"user\"(id) ON DELETE CASCADE,\n  \"accessToken\" text,\n  \"refreshToken\" text,\n  \"idToken\" text,\n  \"accessTokenExpiresAt\" timestamptz,\n  \"refreshTokenExpiresAt\" timestamptz,\n  scope text,\n  password text,\n  \"createdAt\" timestamptz NOT NULL DEFAULT now(),\n  \"updatedAt\" timestamptz NOT NULL DEFAULT now()\n);\nCREATE INDEX IF NOT EXISTS account_user_id_idx ON auth.\"account\"(\"userId\");\n\nCREATE TABLE IF NOT EXISTS auth.\"verification\" (\n  id text PRIMARY KEY,\n  identifier text NOT NULL,\n  value text NOT NULL,\n  \"expiresAt\" timestamptz NOT NULL,\n  \"createdAt\" timestamptz NOT NULL DEFAULT now(),\n  \"updatedAt\" timestamptz NOT NULL DEFAULT now()\n);\n";

package/dist/auth-schema.js

@@ -0,0 +1,66 @@
+// @kazzle/app/auth/schema — the app-login auth tables, as SQL.
+//
+// Dependency-free on purpose: the server's login template hook runs this SQL
+// at checkout (and the agent runs it when adding `appLogin` to an existing
+// app) without pulling better-auth/pg into the importer.
+//
+// The tables live in a dedicated `auth` Postgres schema inside the app's own
+// database — Supabase convention: app code never modifies these tables, it
+// extends by referencing `auth."user"(id)` from its own tables in the public
+// schema. Shapes match Better Auth core (user/session/account/verification,
+// camelCase quoted columns); `@kazzle/app/auth` connects with
+// `search_path=auth` so Better Auth's unqualified table names resolve here.
+/** Postgres schema the auth tables live in. */
+export const AUTH_PG_SCHEMA = 'auth';
+/** Idempotent DDL for the auth tables. Run against the app's own database. */
+export const AUTH_SCHEMA_SQL = `
+CREATE SCHEMA IF NOT EXISTS auth;
+
+CREATE TABLE IF NOT EXISTS auth."user" (
+  id text PRIMARY KEY,
+  name text,
+  email text NOT NULL UNIQUE,
+  "emailVerified" boolean NOT NULL DEFAULT false,
+  image text,
+  "createdAt" timestamptz NOT NULL DEFAULT now(),
+  "updatedAt" timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS auth."session" (
+  id text PRIMARY KEY,
+  "expiresAt" timestamptz NOT NULL,
+  token text NOT NULL UNIQUE,
+  "ipAddress" text,
+  "userAgent" text,
+  "userId" text NOT NULL REFERENCES auth."user"(id) ON DELETE CASCADE,
+  "createdAt" timestamptz NOT NULL DEFAULT now(),
+  "updatedAt" timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS session_user_id_idx ON auth."session"("userId");
+
+CREATE TABLE IF NOT EXISTS auth."account" (
+  id text PRIMARY KEY,
+  "accountId" text NOT NULL,
+  "providerId" text NOT NULL,
+  "userId" text NOT NULL REFERENCES auth."user"(id) ON DELETE CASCADE,
+  "accessToken" text,
+  "refreshToken" text,
+  "idToken" text,
+  "accessTokenExpiresAt" timestamptz,
+  "refreshTokenExpiresAt" timestamptz,
+  scope text,
+  password text,
+  "createdAt" timestamptz NOT NULL DEFAULT now(),
+  "updatedAt" timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS account_user_id_idx ON auth."account"("userId");
+
+CREATE TABLE IF NOT EXISTS auth."verification" (
+  id text PRIMARY KEY,
+  identifier text NOT NULL,
+  value text NOT NULL,
+  "expiresAt" timestamptz NOT NULL,
+  "createdAt" timestamptz NOT NULL DEFAULT now(),
+  "updatedAt" timestamptz NOT NULL DEFAULT now()
+);
+`;

package/dist/auth.d.ts

@@ -0,0 +1,50 @@
+import { type AppUser } from './auth-schema';
+export type { AppUser } from './auth-schema';
+export { AUTH_SCHEMA_SQL, AUTH_PG_SCHEMA } from './auth-schema';
+/**
+ * Minimal structural view of the Better Auth instance. Kept narrow on purpose:
+ * Better Auth's inferred generics are not portable across d.ts emit, and the
+ * SDK contract is the helpers, not the raw instance.
+ */
+interface AuthInstance {
+    handler(request: Request): Promise<Response>;
+    api: {
+        getSession(opts: {
+            headers: Headers;
+        }): Promise<{
+            user: {
+                id: string;
+                email: string;
+                emailVerified: boolean;
+                name?: string | null;
+                image?: string | null;
+            };
+        } | null>;
+    };
+}
+export interface KazzleAuth {
+    /** The underlying Better Auth instance (escape hatch; prefer the helpers). */
+    auth: AuthInstance;
+    /** Request handler for /api/auth/* — see mountKazzleAuth. */
+    handler(request: Request): Promise<Response>;
+    /** Resolve the signed-in end user from a request's cookies, or null. */
+    getAppUser(request: Request): Promise<AppUser | null>;
+}
+/**
+ * Create the app's login runtime. Reads platform-injected env; no options in
+ * the common case. `databaseUrl` override exists for tests only.
+ */
+export declare function createKazzleAuth(options?: {
+    databaseUrl?: string;
+}): KazzleAuth;
+/**
+ * Mount /api/auth/* on a Hono app. Structural typing on purpose so this
+ * module doesn't depend on hono.
+ */
+export declare function mountKazzleAuth(app: {
+    on(methods: string[], path: string, handler: (c: {
+        req: {
+            raw: Request;
+        };
+    }) => Promise<Response>): unknown;
+}, kazzleAuth: KazzleAuth): void;

package/dist/auth.js

@@ -0,0 +1,87 @@
+// @kazzle/app/auth — app login, server half.
+//
+// One provider, `kazzle`: the app's Better Auth does standard OIDC against
+// Kazzle's app-login broker, which runs Google (and later other methods)
+// behind it. App code never touches Google — no secrets, no callbacks, no
+// consent config. The platform injects everything this module reads:
+//
+//   DATABASE_URL           the app's own Postgres (users live HERE, not at Kazzle)
+//   KAZZLE_LOGIN_ID        the app's broker client id (= its app id)
+//   KAZZLE_LOGIN_SECRET    the app's broker client secret (server-only)
+//   KAZZLE_APP_PUBLIC_URL  the app's browser-facing origin (preview tunnel or prod host)
+//   KAZZLE_API_URL         Kazzle platform API base (the broker lives under /app-login)
+//
+// Auth rides the app's UI origin: the browser only ever calls relative
+// /api/auth/* paths (the UI dev server proxies them to this process; in prod
+// both surfaces share one host), so cookies are plain same-origin.
+//
+// The auth tables live in the `auth` Postgres schema (see ./auth-schema.ts);
+// this module connects with search_path=auth so Better Auth's unqualified
+// table names resolve there. App tables in the public schema reference
+// auth."user"(id) — never add columns to the auth tables themselves.
+import { betterAuth } from 'better-auth';
+import { genericOAuth } from 'better-auth/plugins';
+import { Pool } from 'pg';
+import { AUTH_PG_SCHEMA } from './auth-schema';
+export { AUTH_SCHEMA_SQL, AUTH_PG_SCHEMA } from './auth-schema';
+function requiredEnv(name) {
+    const value = process.env[name];
+    if (!value) {
+        throw new Error(`${name} is not set — app login requires the platform-injected env (is appLogin enabled for this app?)`);
+    }
+    return value;
+}
+/**
+ * Create the app's login runtime. Reads platform-injected env; no options in
+ * the common case. `databaseUrl` override exists for tests only.
+ */
+export function createKazzleAuth(options) {
+    const databaseUrl = options?.databaseUrl ?? requiredEnv('DATABASE_URL');
+    const publicUrl = requiredEnv('KAZZLE_APP_PUBLIC_URL');
+    const apiUrl = requiredEnv('KAZZLE_API_URL');
+    const clientId = requiredEnv('KAZZLE_LOGIN_ID');
+    const clientSecret = requiredEnv('KAZZLE_LOGIN_SECRET');
+    const pool = new Pool({
+        connectionString: databaseUrl,
+        options: `-c search_path=${AUTH_PG_SCHEMA}`,
+    });
+    const auth = betterAuth({
+        database: pool,
+        secret: clientSecret,
+        baseURL: publicUrl,
+        basePath: '/api/auth',
+        trustedOrigins: [publicUrl],
+        plugins: [
+            genericOAuth({
+                config: [{
+                        providerId: 'kazzle',
+                        clientId,
+                        clientSecret,
+                        discoveryUrl: `${apiUrl}/app-login/.well-known/openid-configuration`,
+                        scopes: ['openid', 'email', 'profile'],
+                        pkce: true,
+                        // The app states the method; the broker executes it. Today: google.
+                        authorizationUrlParams: { method: 'google' },
+                    }],
+            }),
+        ],
+    });
+    return {
+        auth,
+        handler: (request) => auth.handler(request),
+        getAppUser: async (request) => {
+            const session = await auth.api.getSession({ headers: request.headers });
+            if (!session?.user)
+                return null;
+            const { id, email, emailVerified, name, image } = session.user;
+            return { id, email, emailVerified, name: name ?? null, image: image ?? null };
+        },
+    };
+}
+/**
+ * Mount /api/auth/* on a Hono app. Structural typing on purpose so this
+ * module doesn't depend on hono.
+ */
+export function mountKazzleAuth(app, kazzleAuth) {
+    app.on(['GET', 'POST'], '/api/auth/*', (c) => kazzleAuth.handler(c.req.raw));
+}

package/dist/connections.d.ts

@@ -0,0 +1,11 @@
+export declare class ConnectionNotConnectedError extends Error {
+    readonly connectionId: string;
+    constructor(connectionId: string, message?: string);
+}
+/**
+ * A fresh vendor access token for a connection, e.g.
+ * `new Stripe(await getConnectionToken('8f2a…'))`.
+ */
+export declare function getConnectionToken(connectionId: string): Promise<string>;
+/** Forget cached tokens (tests, or after a reconnect). */
+export declare function clearConnectionTokenCache(): void;

package/dist/connections.js

@@ -0,0 +1,56 @@
+// @kazzle/app/connections — use the accounts a person connected in Kazzle
+// (Stripe, Gmail, Slack, …) from app code.
+//
+// Kazzle keeps the OAuth tokens; this asks Kazzle for a fresh one and caches it
+// until it expires. Identify the connection by its vault secret id (the AI that
+// built the app has it from the vault). Requires KAZZLE_API_KEY and
+// KAZZLE_API_URL, both injected into every component at deploy and `kazzle run`.
+//
+// Dependency-free on purpose (uses global fetch). Do not add zod/vite here.
+import { kazzleApiUrl } from './client';
+export class ConnectionNotConnectedError extends Error {
+    connectionId;
+    constructor(connectionId, message) {
+        super(message ?? `Connection ${connectionId} is not connected. Connect it on the Integrations page in Kazzle.`);
+        this.connectionId = connectionId;
+        this.name = 'ConnectionNotConnectedError';
+    }
+}
+const DEFAULT_TTL_MS = 60 * 60_000;
+const REFRESH_MARGIN_MS = 60_000;
+const cache = new Map();
+function apiKey() {
+    const key = process.env['KAZZLE_API_KEY'];
+    if (!key) {
+        throw new Error('KAZZLE_API_KEY is not set — connection tokens are only available to deployed Kazzle app components.');
+    }
+    return key;
+}
+/**
+ * A fresh vendor access token for a connection, e.g.
+ * `new Stripe(await getConnectionToken('8f2a…'))`.
+ */
+export async function getConnectionToken(connectionId) {
+    const hit = cache.get(connectionId);
+    if (hit && hit.expiresAt - Date.now() > REFRESH_MARGIN_MS)
+        return hit.token;
+    const res = await fetch(`${kazzleApiUrl()}/connections/${encodeURIComponent(connectionId)}/token`, {
+        headers: { authorization: `Bearer ${apiKey()}` },
+    });
+    if (res.status === 404 || res.status === 409) {
+        const body = await res.json().catch(() => ({}));
+        cache.delete(connectionId);
+        throw new ConnectionNotConnectedError(connectionId, body.message);
+    }
+    if (!res.ok) {
+        throw new Error(`Kazzle connection token request failed: HTTP ${res.status}`);
+    }
+    const body = await res.json();
+    const expiresAt = body.expiresAt ? Date.parse(body.expiresAt) : Date.now() + DEFAULT_TTL_MS;
+    cache.set(connectionId, { token: body.token, expiresAt: Number.isFinite(expiresAt) ? expiresAt : Date.now() + DEFAULT_TTL_MS });
+    return body.token;
+}
+/** Forget cached tokens (tests, or after a reconnect). */
+export function clearConnectionTokenCache() {
+    cache.clear();
+}

package/dist/index.d.ts

@@ -89,6 +89,13 @@ export interface KazzleConfig {
     target?: 'local' | 'remote';
     /** Path to the app icon file (png, jpg, svg, webp, ico) */
     icon?: string;
+    /**
+     * End-user login for this app (via @kazzle/app/auth — Google today).
+     * Distinct from `kazzleAuth`, which gates the launch surface by Kazzle
+     * account; appLogin is the app's OWN users, stored in its own database.
+     * Requires a process + database.
+     */
+    appLogin?: boolean;
     /** Executable components — UI frontends or background processes */
     components?: KazzleComponent[];
     /** AI skill definitions — markdown files the AI reads for domain knowledge */

package/dist/sdk.d.ts

@@ -0,0 +1 @@
+export * from './vendor/kazzle/index.js';

package/dist/sdk.js

@@ -0,0 +1,13 @@
+// @kazzle/app/sdk — the Kazzle REST API client, re-exported for app code.
+//
+// Deployed app components get KAZZLE_API_KEY and KAZZLE_API_URL injected
+// (server/apps/apps.runtime-env.ts), so `new Kazzle()` needs no arguments
+// there: the key scopes every call to the app's space.
+//
+// The implementation lives in the `kazzle` package (packages/kazzle-sdk). In
+// the monorepo this resolves to the workspace package; the PUBLISHED build
+// vendors the SDK's dist under dist/vendor/kazzle and rewrites this entry to
+// point at it (scripts/build.ts), so app code installed from npm never needs a
+// separate `kazzle` install.
+// Published build: the SDK is vendored (see scripts/build.ts).
+export * from './vendor/kazzle/index.js';

package/dist/vendor/kazzle/browsers.d.ts

@@ -0,0 +1,56 @@
+import { type KazzleHttp } from './http';
+import { TabsApi } from './browsers.tabs';
+import { ProfilesApi } from './browsers.profiles';
+import type { ActionResult, BrowserCreateOptions, BrowserCreateResponse, BrowserRow, BrowserState, ListResponse, TabOpenResponse, TabRow } from './sdk.types';
+/**
+ * Handle for one browser session, bound to the first tab from the create
+ * response. Use `kazzle.browsers.tabs.*` with other tab ids for multi-tab work.
+ */
+export declare class Browser {
+    private readonly api;
+    /** Browser session id. */
+    readonly id: string;
+    /** The session's first tab — the target of nav()/screenshot() below. */
+    readonly tabId: string;
+    /** Host computer, or null for a stealth cloud browser. */
+    readonly computerId: string | null;
+    readonly provider: string;
+    /** Open this URL in a browser of your own to watch the session live. */
+    readonly liveViewUrl: string | null;
+    constructor(api: BrowsersApi, created: BrowserCreateResponse);
+    /** Navigate the first tab. */
+    nav(url: string): Promise<ActionResult>;
+    /** Screenshot the first tab. Returns PNG (or JPEG) bytes. */
+    screenshot(): Promise<Uint8Array>;
+    /** Any tab action on the first tab by its URL segment, e.g. action('click', { ref }). */
+    action(segment: string, body?: Record<string, unknown>): Promise<ActionResult>;
+    /** List the session's open tabs. */
+    tabs(): Promise<ListResponse<TabRow>>;
+    /** Open another tab. The new tab id is the response's tab_id. */
+    openTab(options?: {
+        url?: string;
+    }): Promise<TabOpenResponse>;
+    /** Close the browser session. The profile (logins, cookies) survives. */
+    close(): Promise<ActionResult>;
+}
+export declare class BrowsersApi {
+    private readonly http;
+    readonly tabs: TabsApi;
+    readonly profiles: ProfilesApi;
+    constructor(http: KazzleHttp);
+    /**
+     * Open a browser session. No options means a stealth cloud browser
+     * (anti-bot, proxies) for the real web; pass computerId for that computer's
+     * built-in browser (its own pages: app previews, localhost). Returns a
+     * Browser handle bound to the first tab.
+     */
+    create(options?: BrowserCreateOptions): Promise<Browser>;
+    /** List browser sessions in the API key's space. */
+    list(options?: {
+        computerId?: string;
+    }): Promise<ListResponse<BrowserRow>>;
+    /** State of a browser session plus its live_view_url and tabs. */
+    get(browserId: string): Promise<BrowserState>;
+    /** Close the browser session and delete its tabs. The profile survives. */
+    close(browserId: string): Promise<ActionResult>;
+}

package/dist/vendor/kazzle/browsers.js

@@ -0,0 +1,88 @@
+// kazzle.browsers.* — browser sessions (/browsers). A browser id is a session
+// id; the durable identity is the profile. create() returns a Browser handle
+// bound to the session's first tab for the common drive-one-page flow.
+import { apiPath } from './http';
+import { TabsApi } from './browsers.tabs';
+import { ProfilesApi } from './browsers.profiles';
+/**
+ * Handle for one browser session, bound to the first tab from the create
+ * response. Use `kazzle.browsers.tabs.*` with other tab ids for multi-tab work.
+ */
+export class Browser {
+    api;
+    /** Browser session id. */
+    id;
+    /** The session's first tab — the target of nav()/screenshot() below. */
+    tabId;
+    /** Host computer, or null for a stealth cloud browser. */
+    computerId;
+    provider;
+    /** Open this URL in a browser of your own to watch the session live. */
+    liveViewUrl;
+    constructor(api, created) {
+        this.api = api;
+        this.id = created.id;
+        this.tabId = created.tab_id;
+        this.computerId = created.computer_id;
+        this.provider = created.provider;
+        this.liveViewUrl = created.live_view_url;
+    }
+    /** Navigate the first tab. */
+    nav(url) {
+        return this.api.tabs.nav(this.id, this.tabId, { url });
+    }
+    /** Screenshot the first tab. Returns PNG (or JPEG) bytes. */
+    screenshot() {
+        return this.api.tabs.screenshot(this.id, this.tabId);
+    }
+    /** Any tab action on the first tab by its URL segment, e.g. action('click', { ref }). */
+    action(segment, body = {}) {
+        return this.api.tabs.action(this.id, this.tabId, segment, body);
+    }
+    /** List the session's open tabs. */
+    tabs() {
+        return this.api.tabs.list(this.id);
+    }
+    /** Open another tab. The new tab id is the response's tab_id. */
+    openTab(options = {}) {
+        return this.api.tabs.open(this.id, options);
+    }
+    /** Close the browser session. The profile (logins, cookies) survives. */
+    close() {
+        return this.api.close(this.id);
+    }
+}
+export class BrowsersApi {
+    http;
+    tabs;
+    profiles;
+    constructor(http) {
+        this.http = http;
+        this.tabs = new TabsApi(http);
+        this.profiles = new ProfilesApi(http);
+    }
+    /**
+     * Open a browser session. No options means a stealth cloud browser
+     * (anti-bot, proxies) for the real web; pass computerId for that computer's
+     * built-in browser (its own pages: app previews, localhost). Returns a
+     * Browser handle bound to the first tab.
+     */
+    async create(options = {}) {
+        const created = await this.http.json('POST', '/browsers', options);
+        return new Browser(this, created);
+    }
+    /** List browser sessions in the API key's space. */
+    list(options = {}) {
+        return this.http.json('GET', '/browsers', undefined, {
+            computer_id: options.computerId,
+        });
+    }
+    /** State of a browser session plus its live_view_url and tabs. */
+    get(browserId) {
+        return this.http.json('GET', apiPath `/browsers/${browserId}`);
+    }
+    /** Close the browser session and delete its tabs. The profile survives. */
+    close(browserId) {
+        return this.http.json('DELETE', apiPath `/browsers/${browserId}`);
+    }
+}

package/dist/vendor/kazzle/browsers.profiles.d.ts

@@ -0,0 +1,16 @@
+import { type KazzleHttp } from './http';
+import type { ListResponse, OkResponse, ProfileCreateOptions, ProfileCreateResponse, ProfileRow } from './sdk.types';
+export declare class ProfilesApi {
+    private readonly http;
+    constructor(http: KazzleHttp);
+    /**
+     * Ensure the durable profile for a browser backend. No computerId means the
+     * space's stealth profile. Idempotent: an existing profile comes back with
+     * `created: false`.
+     */
+    create(options?: ProfileCreateOptions): Promise<ProfileCreateResponse>;
+    /** List the browser profiles in the API key's space. */
+    list(): Promise<ListResponse<ProfileRow>>;
+    /** Delete a profile. Cascades its sessions and tabs; saved logins and cookies are gone. */
+    delete(profileId: string): Promise<OkResponse>;
+}

package/dist/vendor/kazzle/browsers.profiles.js

@@ -0,0 +1,26 @@
+// kazzle.browsers.profiles.* — durable browsing identities (/browsers/profiles).
+// Profiles hold logins and cookies; they outlive browser sessions and are
+// shared across them.
+import { apiPath } from './http';
+export class ProfilesApi {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    /**
+     * Ensure the durable profile for a browser backend. No computerId means the
+     * space's stealth profile. Idempotent: an existing profile comes back with
+     * `created: false`.
+     */
+    create(options = {}) {
+        return this.http.json('POST', '/browsers/profiles', options);
+    }
+    /** List the browser profiles in the API key's space. */
+    list() {
+        return this.http.json('GET', '/browsers/profiles');
+    }
+    /** Delete a profile. Cascades its sessions and tabs; saved logins and cookies are gone. */
+    delete(profileId) {
+        return this.http.json('DELETE', apiPath `/browsers/profiles/${profileId}`);
+    }
+}

package/dist/vendor/kazzle/browsers.tabs.d.ts

@@ -0,0 +1,62 @@
+import { type KazzleHttp } from './http';
+import type { ActionResult, ListResponse, TabOpenResponse, TabRow } from './sdk.types';
+type Body = Record<string, unknown>;
+export declare class TabsApi {
+    private readonly http;
+    constructor(http: KazzleHttp);
+    /** List the open tabs of a browser session. */
+    list(browserId: string): Promise<ListResponse<TabRow>>;
+    /** Open a new tab. The new tab id is the response's tab_id. */
+    open(browserId: string, options?: {
+        url?: string;
+    }): Promise<TabOpenResponse>;
+    /** POST one tab action by its URL segment. The named methods below all funnel through this. */
+    action(browserId: string, tabId: string, segment: string, body?: Body): Promise<ActionResult>;
+    private binary;
+    nav(browserId: string, tabId: string, body: {
+        url: string;
+    }): Promise<ActionResult>;
+    back(browserId: string, tabId: string): Promise<ActionResult>;
+    forward(browserId: string, tabId: string): Promise<ActionResult>;
+    reload(browserId: string, tabId: string): Promise<ActionResult>;
+    /** Returns PNG (or JPEG) bytes. */
+    screenshot(browserId: string, tabId: string, body?: Body): Promise<Uint8Array>;
+    /** Returns PDF bytes. */
+    pdf(browserId: string, tabId: string, body?: Body): Promise<Uint8Array>;
+    /** Accessibility snapshot. Element refs from it target later click/type calls. */
+    snapshot(browserId: string, tabId: string, body?: Body): Promise<ActionResult>;
+    eval(browserId: string, tabId: string, body: {
+        function: string;
+        arguments?: unknown[];
+        timeoutSeconds?: number;
+    }): Promise<ActionResult>;
+    click(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    type(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    select(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    fillForm(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    check(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    uncheck(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    hover(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    drag(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    upload(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    dialog(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    key(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    scroll(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    content(browserId: string, tabId: string, body?: Body): Promise<ActionResult>;
+    dom(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    extract(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    find(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    options(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    console(browserId: string, tabId: string, body?: Body): Promise<ActionResult>;
+    network(browserId: string, tabId: string, body?: Body): Promise<ActionResult>;
+    wait(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    status(browserId: string, tabId: string, body?: Body): Promise<ActionResult>;
+    download(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    /** Live view URL for the tab. */
+    live(browserId: string, tabId: string, body?: Body): Promise<ActionResult>;
+    focus(browserId: string, tabId: string): Promise<ActionResult>;
+    move(browserId: string, tabId: string, body: Body): Promise<ActionResult>;
+    /** Close the tab (DELETE /browsers/{id}/tabs/{tid}; POST .../close does the same). */
+    close(browserId: string, tabId: string): Promise<ActionResult>;
+}
+export {};