release: 0.7.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.6.0"
+  ".": "0.7.0"
 }

.stats.yml

@@ -1 +1 @@
-configured_endpoints: 61
+configured_endpoints: 62

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.7.0](https://github.com/kernel/hypeman-ts/compare/v0.6.0...v0.7.0) (2026-08-17)
+
+
+### Features
+
+* add Python SDK WebSocket primitives ([b038e6f](https://github.com/kernel/hypeman-ts/commit/b038e6f5153fb7311cbefe74d7630ac81f19f12c))
+* Point at pending stlc seal-tracking PRs ([9145d06](https://github.com/kernel/hypeman-ts/commit/9145d064670b4eb38fea6f4bf0f5c9f3b46653d2))
+
 ## [0.6.0](https://github.com/kernel/hypeman-ts/compare/v0.5.1...v0.6.0) (2026-08-12)
 
 

api.md

@@ -14,6 +14,22 @@ Methods:
 
 - <code title="get /health">client.health.<a href="./src/resources/health.ts">check</a>() -> HealthCheckResponse</code>
 
+# Capabilities
+
+Types:
+
+- <code><a href="./src/resources/capabilities.ts">Capabilities</a></code>
+- <code><a href="./src/resources/capabilities.ts">CapabilitiesDefaultRuntime</a></code>
+- <code><a href="./src/resources/capabilities.ts">CapabilitiesHost</a></code>
+- <code><a href="./src/resources/capabilities.ts">CapabilitiesImages</a></code>
+- <code><a href="./src/resources/capabilities.ts">CapabilitiesNetwork</a></code>
+- <code><a href="./src/resources/capabilities.ts">CapabilitiesRuntime</a></code>
+- <code><a href="./src/resources/capabilities.ts">CapabilitiesServer</a></code>
+
+Methods:
+
+- <code title="get /capabilities">client.capabilities.<a href="./src/resources/capabilities.ts">get</a>() -> Capabilities</code>
+
 # Images
 
 Types:

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/hypeman",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "The official TypeScript library for the Hypeman API",
   "author": "Hypeman <>",
   "types": "dist/index.d.ts",

src/client.ts

@@ -37,6 +37,15 @@ import {
   BuildStatus,
   Builds,
 } from './resources/builds';
+import {
+  Capabilities,
+  CapabilitiesDefaultRuntime,
+  CapabilitiesHost,
+  CapabilitiesImages,
+  CapabilitiesNetwork,
+  CapabilitiesRuntime,
+  CapabilitiesServer,
+} from './resources/capabilities';
 import {
   AvailableDevice,
   Device,
@@ -850,6 +859,7 @@ export class Hypeman {
   static toFile = Uploads.toFile;
 
   health: API.Health = new API.Health(this);
+  capabilities: API.Capabilities = new API.Capabilities(this);
   images: API.Images = new API.Images(this);
   instances: API.Instances = new API.Instances(this);
   snapshots: API.Snapshots = new API.Snapshots(this);
@@ -878,6 +888,16 @@ export declare namespace Hypeman {
 
   export { Health as Health, type HealthCheckResponse as HealthCheckResponse };
 
+  export {
+    type Capabilities as Capabilities,
+    type CapabilitiesDefaultRuntime as CapabilitiesDefaultRuntime,
+    type CapabilitiesHost as CapabilitiesHost,
+    type CapabilitiesImages as CapabilitiesImages,
+    type CapabilitiesNetwork as CapabilitiesNetwork,
+    type CapabilitiesRuntime as CapabilitiesRuntime,
+    type CapabilitiesServer as CapabilitiesServer,
+  };
+
   export {
     Images as Images,
     type Image as Image,

src/resources/capabilities.ts

@@ -0,0 +1,180 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../core/resource';
+import { APIPromise } from '../core/api-promise';
+import { RequestOptions } from '../internal/request-options';
+
+export class Capabilities extends APIResource {
+  /**
+   * Returns machine-readable host capabilities: server and API version, host
+   * OS/architecture, every runtime available on this host with its per-runtime
+   * feature IDs, the configured default runtime and whether it is available, guest
+   * networking model and host gateway, supported image platforms, and stable
+   * server-level feature IDs.
+   *
+   * Runtime-derived values reflect the actual host (for example, snapshot and
+   * standby support on macOS is gated on the host OS version), so clients can gate
+   * behavior on capabilities without hard-coding hypervisor knowledge.
+   */
+  get(options?: RequestOptions): APIPromise<Capabilities> {
+    return this._client.get('/capabilities', options);
+  }
+}
+
+export interface Capabilities {
+  default_runtime: CapabilitiesDefaultRuntime;
+
+  /**
+   * Stable server-level feature IDs: API surfaces this server exposes regardless of
+   * which runtime backs an instance. Always present: "instances", "images",
+   * "builds", "volumes", "ingress", "exec", "logs". Host-conditional: "devices"
+   * (device passthrough management, Linux hosts only) and "rosetta-emulation" (Apple
+   * Silicon macOS hosts with Rosetta currently installed, per the same availability
+   * probe launches enforce). Per-runtime features are reported under each runtimes[]
+   * entry.
+   */
+  features: Array<string>;
+
+  host: CapabilitiesHost;
+
+  images: CapabilitiesImages;
+
+  network: CapabilitiesNetwork;
+
+  /**
+   * Every runtime this server build supports on this host platform, each with its
+   * own availability flag and feature IDs. Hosts commonly support several runtimes
+   * at once (for example cloud-hypervisor, firecracker, qemu, and qemu-microvm on
+   * linux/amd64). A listed runtime is only launchable when its "available" flag is
+   * true. Entries are sorted by name.
+   */
+  runtimes: Array<CapabilitiesRuntime>;
+
+  server: CapabilitiesServer;
+}
+
+export interface CapabilitiesDefaultRuntime {
+  /**
+   * Whether the default runtime can launch on this host: it appears in runtimes and
+   * its launch prerequisites are met (matches that entry's "available"). When false,
+   * launches that rely on the default will fail until the server is reconfigured
+   * with an available runtime or the missing prerequisite (for example the QEMU
+   * system binary) is installed.
+   */
+  available: boolean;
+
+  /**
+   * Runtime used for launches that do not name one
+   */
+  name: string;
+}
+
+export interface CapabilitiesHost {
+  /**
+   * Host CPU architecture
+   */
+  arch: string;
+
+  /**
+   * Host operating system
+   */
+  os: string;
+}
+
+export interface CapabilitiesImages {
+  /**
+   * Image platform selected when a create request omits one
+   */
+  default_platform: string;
+
+  /**
+   * Image platforms (os/arch) this host can run. On Apple Silicon macOS this
+   * includes linux/amd64 only when Rosetta is currently installed — probed via the
+   * same Virtualization.framework availability check launches enforce — so a listed
+   * platform is launchable right now. Install Rosetta (softwareupdate
+   * --install-rosetta) to enable it.
+   */
+  platforms: Array<string>;
+}
+
+export interface CapabilitiesNetwork {
+  /**
+   * Whether direct VM-to-VM traffic is permitted on the default network
+   */
+  guest_to_guest: boolean;
+
+  /**
+   * Guest networking model. "bridge" is a Linux bridge with per-VM TAP devices;
+   * "nat" is hypervisor-provided NAT (macOS).
+   */
+  model: 'bridge' | 'nat';
+
+  /**
+   * Guest-visible host gateway IP. Guests reach host services (including host
+   * ingress) through this address. Omitted when no default network has been resolved
+   * on this host yet.
+   */
+  gateway?: string;
+
+  /**
+   * Guest subnet CIDR
+   */
+  subnet?: string;
+}
+
+export interface CapabilitiesRuntime {
+  /**
+   * Whether this runtime's launch prerequisites are currently met on this host.
+   * Listed runtimes are supported by this server build on this platform;
+   * available=false means a host prerequisite is missing (for example qemu requires
+   * a runnable system-installed QEMU binary and the host vhost-vsock device) and
+   * launches naming this runtime will fail until it is installed.
+   */
+  available: boolean;
+
+  /**
+   * Stable feature IDs supported by this runtime on this host: "snapshots"
+   * (snapshot/restore), "standby" (pause + memory snapshot, with later restore),
+   * "fork" (clone an instance from a stopped source; forking a standby or running
+   * source restores/creates snapshots and additionally requires "standby"), "pause"
+   * (pause/resume), "hotplug-memory" (live memory resize), "balloon-control"
+   * (runtime balloon target changes), "vsock" (guest vsock communication),
+   * "gpu-passthrough" (GPU/PCI device passthrough), "disk-io-limit" (disk I/O rate
+   * limiting), "disk-resize" (live disk resize). Values are host- and
+   * configuration-truthful: vz omits snapshots and standby on macOS 13, which lacks
+   * Virtualization.framework VM save/restore, while still advertising fork
+   * (stopped-source clones need no save/restore there), and cloud-hypervisor reports
+   * "disk-resize" only when the configured default version supports it.
+   */
+  features: Array<string>;
+
+  /**
+   * Runtime identifier
+   */
+  name: string;
+}
+
+export interface CapabilitiesServer {
+  /**
+   * API contract version (matches the OpenAPI document info version)
+   */
+  api_version: string;
+
+  /**
+   * Server build version (short git revision, with "-dirty" suffix for uncommitted
+   * builds, or "unknown")
+   */
+  version: string;
+}
+
+export declare namespace Capabilities {
+  export {
+    type Capabilities as Capabilities,
+    type CapabilitiesDefaultRuntime as CapabilitiesDefaultRuntime,
+    type CapabilitiesHost as CapabilitiesHost,
+    type CapabilitiesImages as CapabilitiesImages,
+    type CapabilitiesNetwork as CapabilitiesNetwork,
+    type CapabilitiesRuntime as CapabilitiesRuntime,
+    type CapabilitiesServer as CapabilitiesServer,
+  };
+}

src/resources/images.ts

@@ -1,6 +1,7 @@
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 import { APIResource } from '../core/resource';
+import * as PushesAPI from './pushes';
 import { APIPromise } from '../core/api-promise';
 import { buildHeaders } from '../internal/headers';
 import { RequestOptions } from '../internal/request-options';
@@ -139,6 +140,14 @@ export interface ImageCreateParams {
    */
   name: string;
 
+  /**
+   * Docker-style registry credentials borrowed for one image pull or push request.
+   * They remain in memory and are never persisted or logged. When omitted or empty,
+   * the server's own registry credentials are used. An interrupted credentialed
+   * operation must be retried with fresh credentials.
+   */
+  credentials?: PushesAPI.PushCredentials;
+
   /**
    * Target platform as os/arch[/variant] (e.g. "linux/amd64"), matching Docker
    * --platform. Omit for the host platform. Not a fixed enum: the os/arch[/variant]

src/resources/index.ts

@@ -21,6 +21,15 @@ export {
   type BuildListParams,
   type BuildEventsParams,
 } from './builds';
+export {
+  Capabilities,
+  type CapabilitiesDefaultRuntime,
+  type CapabilitiesHost,
+  type CapabilitiesImages,
+  type CapabilitiesNetwork,
+  type CapabilitiesRuntime,
+  type CapabilitiesServer,
+} from './capabilities';
 export {
   Devices,
   type AvailableDevice,

src/resources/pushes.ts

@@ -61,8 +61,10 @@ export interface CreatePushRequest {
   target: string;
 
   /**
-   * Registry credentials borrowed for this push only. When omitted, the server's own
-   * registry credentials are used.
+   * Docker-style registry credentials borrowed for one image pull or push request.
+   * They remain in memory and are never persisted or logged. When omitted or empty,
+   * the server's own registry credentials are used. An interrupted credentialed
+   * operation must be retried with fresh credentials.
    */
   credentials?: PushCredentials;
 
@@ -121,8 +123,10 @@ export interface Push {
 }
 
 /**
- * Registry credentials borrowed for this push only. When omitted, the server's own
- * registry credentials are used.
+ * Docker-style registry credentials borrowed for one image pull or push request.
+ * They remain in memory and are never persisted or logged. When omitted or empty,
+ * the server's own registry credentials are used. An interrupted credentialed
+ * operation must be retried with fresh credentials.
  */
 export interface PushCredentials {
   /**
@@ -157,8 +161,10 @@ export interface PushCreateParams {
   target: string;
 
   /**
-   * Registry credentials borrowed for this push only. When omitted, the server's own
-   * registry credentials are used.
+   * Docker-style registry credentials borrowed for one image pull or push request.
+   * They remain in memory and are never persisted or logged. When omitted or empty,
+   * the server's own registry credentials are used. An interrupted credentialed
+   * operation must be retried with fresh credentials.
    */
   credentials?: PushCredentials;
 

src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.6.0'; // x-release-please-version
+export const VERSION = '0.7.0'; // x-release-please-version

tests/api-resources/capabilities.test.ts

@@ -0,0 +1,22 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  apiKey: 'My API Key',
+  baseURL: process.env['TEST_API_BASE_URL'] ?? 'http://127.0.0.1:4010',
+});
+
+describe('resource capabilities', () => {
+  // Mock server tests are disabled
+  test.skip('get', async () => {
+    const responsePromise = client.capabilities.get();
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+});