diff --git a/.github/workflows/mirror-sync.yml b/.github/workflows/mirror-sync.yml
new file mode 100644
index 00000000..62a4e139
--- /dev/null
+++ b/.github/workflows/mirror-sync.yml
@@ -0,0 +1,64 @@
+name: Mirror Monorepo Components
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_ref:
+        description: "Monorepo ref to mirror (branch, tag, or SHA)"
+        required: true
+        default: "main"
+      dry_run:
+        description: "Preview only (no pushes)"
+        required: true
+        default: true
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source ref
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.source_ref }}
+
+      - name: Configure mirror remotes
+        env:
+          MIRROR_PUSH_TOKEN: ${{ secrets.MIRROR_PUSH_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "${MIRROR_PUSH_TOKEN}" ]; then
+            echo "MIRROR_PUSH_TOKEN is required"
+            exit 1
+          fi
+
+          git remote add mirror-cli "https://x-access-token:${MIRROR_PUSH_TOKEN}@github.com/kernel/hypeman-cli.git"
+          git remote add mirror-sdk-go "https://x-access-token:${MIRROR_PUSH_TOKEN}@github.com/kernel/hypeman-go.git"
+          git remote add mirror-sdk-ts "https://x-access-token:${MIRROR_PUSH_TOKEN}@github.com/onkernel/hypeman-ts.git"
+
+      - name: Build subtree branches
+        run: |
+          set -euo pipefail
+          git subtree split --prefix=apps/cli -b mirror-cli-branch
+          git subtree split --prefix=sdks/go -b mirror-sdk-go-branch
+          git subtree split --prefix=sdks/ts -b mirror-sdk-ts-branch
+
+      - name: Preview mirror pushes
+        if: ${{ inputs.dry_run == true }}
+        run: |
+          echo "Dry run enabled. Would push:"
+          echo "  mirror-cli-branch -> kernel/hypeman-cli:main"
+          echo "  mirror-sdk-go-branch -> kernel/hypeman-go:main"
+          echo "  mirror-sdk-ts-branch -> onkernel/hypeman-ts:main"
+
+      - name: Push mirrors
+        if: ${{ inputs.dry_run != true }}
+        run: |
+          set -euo pipefail
+          git push mirror-cli mirror-cli-branch:main --force-with-lease
+          git push mirror-sdk-go mirror-sdk-go-branch:main --force-with-lease
+          git push mirror-sdk-ts mirror-sdk-ts-branch:main --force-with-lease
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 22b499b0..4c8a53ab 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,4 @@
-name: Release Hypeman API
+name: Release Hypeman Monorepo
 
 on:
   push:
@@ -9,7 +9,7 @@ permissions:
   contents: write
 
 jobs:
-  release:
+  release-server:
     runs-on: [self-hosted, linux, x64, kvm]
     steps:
       - name: Checkout
@@ -34,3 +34,41 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  release-components:
+    needs: release-server
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.25.4'
+
+      - name: Verify CLI and Go SDK release build
+        run: go test ./...
+        working-directory: ./apps/cli
+
+      - name: Verify Go SDK tests
+        run: go test ./...
+        working-directory: ./sdks/go
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: '10.24.0'
+
+      - name: Verify TypeScript SDK build
+        run: |
+          ./scripts/bootstrap
+          ./scripts/build
+        working-directory: ./sdks/ts
diff --git a/.github/workflows/stainless-sdks.yml b/.github/workflows/stainless-sdks.yml
index b0173fc4..126d672f 100644
--- a/.github/workflows/stainless-sdks.yml
+++ b/.github/workflows/stainless-sdks.yml
@@ -1,4 +1,4 @@
-name: Stainless SDK preview on PRs
+name: Stainless SDK Sync on PRs
 
 on:
   pull_request:
@@ -6,60 +6,198 @@ on:
       - opened
       - synchronize
       - reopened
-      - closed
+    paths:
+      - openapi.yaml
+      - stainless.yaml
+      - .github/workflows/stainless-sdks.yml
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
 env:
-  STAINLESS_ORG: ${{ vars.STAINLESS_ORG }}
   STAINLESS_PROJECT: ${{ vars.STAINLESS_PROJECT }}
   OAS_PATH: openapi.yaml
   CONFIG_PATH: stainless.yaml
 
 jobs:
-  preview:
-    if: github.event.action != 'closed'
+  build-and-sync:
+    if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       pull-requests: write
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
-          fetch-depth: 2
+          fetch-depth: 0
 
-      - name: Run preview builds
-        uses: stainless-api/upload-openapi-spec-action/preview@v1
+      - name: Run Stainless build
+        id: stainless_build
+        uses: stainless-api/upload-openapi-spec-action/build@v1
         with:
           stainless_api_key: ${{ secrets.STAINLESS_API_KEY }}
-          org: ${{ env.STAINLESS_ORG }}
           project: ${{ env.STAINLESS_PROJECT }}
           oas_path: ${{ env.OAS_PATH }}
           config_path: ${{ env.CONFIG_PATH }}
-          make_comment: true
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.event.pull_request.head.ref }}
+          commit_message: "chore(stainless): update SDKs for PR #${{ github.event.pull_request.number }}"
 
-  merge:
-    if: github.event.action == 'closed' && github.event.pull_request.merged == true
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - name: Sync generated SDKs into monorepo
+        id: sync_sdks
+        env:
+          OUTCOMES_JSON: ${{ steps.stainless_build.outputs.outcomes }}
+          STAINLESS_SYNC_GITHUB_TOKEN: ${{ secrets.STAINLESS_SYNC_GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${OUTCOMES_JSON}" ] || [ "${OUTCOMES_JSON}" = "null" ] || [ "${OUTCOMES_JSON}" = "{}" ]; then
+            echo "No Stainless outcomes available (likely no SDK changes)."
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          printf '%s' "${OUTCOMES_JSON}" > /tmp/stainless-outcomes.json
+          GO_SHA="$(jq -r '.go.commit.completed.commit.sha // .go.commit.commit.sha // empty' /tmp/stainless-outcomes.json)"
+          GO_OWNER="$(jq -r '.go.commit.completed.commit.repo.owner // .go.commit.commit.repo.owner // empty' /tmp/stainless-outcomes.json)"
+          GO_REPO="$(jq -r '.go.commit.completed.commit.repo.name // .go.commit.commit.repo.name // empty' /tmp/stainless-outcomes.json)"
+          TS_SHA="$(jq -r '.typescript.commit.completed.commit.sha // .typescript.commit.commit.sha // empty' /tmp/stainless-outcomes.json)"
+          TS_OWNER="$(jq -r '.typescript.commit.completed.commit.repo.owner // .typescript.commit.commit.repo.owner // empty' /tmp/stainless-outcomes.json)"
+          TS_REPO="$(jq -r '.typescript.commit.completed.commit.repo.name // .typescript.commit.commit.repo.name // empty' /tmp/stainless-outcomes.json)"
+          TS_INSTALL_URL="$(jq -r '.typescript.install_url // empty' /tmp/stainless-outcomes.json)"
+
+          if [ -z "${GO_SHA}" ] || [ -z "${GO_OWNER}" ] || [ -z "${GO_REPO}" ]; then
+            echo "No Go commit coordinates found in outcomes; skipping sync."
+            jq . /tmp/stainless-outcomes.json
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [ -z "${TS_INSTALL_URL}" ] && { [ -z "${TS_SHA}" ] || [ -z "${TS_OWNER}" ] || [ -z "${TS_REPO}" ]; }; then
+            echo "No TypeScript source coordinates found in outcomes; skipping sync."
+            jq . /tmp/stainless-outcomes.json
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [ -z "${STAINLESS_SYNC_GITHUB_TOKEN:-}" ]; then
+            echo "STAINLESS_SYNC_GITHUB_TOKEN is required to fetch generated SDK commits."
+            exit 1
+          fi
+
+          sync_from_install_url() {
+            local install_url="$1"
+            local destination="$2"
+            local tmp_archive
+            local tmp_extract
+
+            tmp_archive="$(mktemp)"
+            tmp_extract="$(mktemp -d)"
+
+            curl --fail --location --silent --show-error "${install_url}" --output "${tmp_archive}"
+            tar -xzf "${tmp_archive}" -C "${tmp_extract}"
+
+            rm -rf "${destination}"
+            mkdir -p "${destination}"
+
+            if [ -d "${tmp_extract}/package" ]; then
+              cp -a "${tmp_extract}/package/." "${destination}/"
+            else
+              cp -a "${tmp_extract}/." "${destination}/"
+            fi
+          }
+
+          sync_target() {
+            local owner="$1"
+            local repo="$2"
+            local sha="$3"
+            local monorepo_subpath="$4"
+            local destination="$5"
+            local source_url="https://x-access-token:${STAINLESS_SYNC_GITHUB_TOKEN}@github.com/${owner}/${repo}.git"
+
+            local tmp_repo
+            tmp_repo="$(mktemp -d)"
+
+            git -C "${tmp_repo}" init --quiet
+            git -C "${tmp_repo}" remote add origin "${source_url}"
+            git -C "${tmp_repo}" fetch --depth=1 origin "${sha}"
+
+            rm -rf "${destination}"
+            mkdir -p "${destination}"
+
+            if git -C "${tmp_repo}" cat-file -e "FETCH_HEAD:${monorepo_subpath}" 2>/dev/null; then
+              local strip_components
+              strip_components="$(awk -F/ '{print NF}' <<< "${monorepo_subpath}")"
+              git -C "${tmp_repo}" archive FETCH_HEAD "${monorepo_subpath}" | tar -x -C "${destination}" --strip-components="${strip_components}"
+            else
+              git -C "${tmp_repo}" archive FETCH_HEAD | tar -x -C "${destination}"
+            fi
+          }
+
+          sync_target "${GO_OWNER}" "${GO_REPO}" "${GO_SHA}" "sdks/go" "sdks/go"
+
+          if [ -n "${TS_INSTALL_URL}" ]; then
+            sync_from_install_url "${TS_INSTALL_URL}" "sdks/ts"
+          else
+            if [ "${TS_OWNER}" = "stainless-sdks" ] && [ "${TS_REPO}" = "hypeman-typescript" ]; then
+              TS_REPO="hypeman-ts"
+            fi
+            sync_target "${TS_OWNER}" "${TS_REPO}" "${TS_SHA}" "sdks/ts" "sdks/ts"
+          fi
+
+          if git diff --quiet -- sdks/go sdks/ts; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up Go
+        if: steps.sync_sdks.outputs.changed == 'true'
+        uses: actions/setup-go@v5
         with:
-          fetch-depth: 2
+          go-version: '1.25.4'
+
+      - name: Run Go SDK tests
+        if: steps.sync_sdks.outputs.changed == 'true'
+        run: GOWORK=off go test ./...
+        working-directory: ./sdks/go
+
+      - name: Run CLI tests
+        if: steps.sync_sdks.outputs.changed == 'true'
+        env:
+          GOWORK: ${{ github.workspace }}/go.work
+        run: go test ./...
+        working-directory: ./apps/cli
 
-      - name: Run merge build
-        uses: stainless-api/upload-openapi-spec-action/merge@v1
+      - name: Set up Node
+        if: steps.sync_sdks.outputs.changed == 'true'
+        uses: actions/setup-node@v4
         with:
-          stainless_api_key: ${{ secrets.STAINLESS_API_KEY }}
-          org: ${{ env.STAINLESS_ORG }}
-          project: ${{ env.STAINLESS_PROJECT }}
-          oas_path: ${{ env.OAS_PATH }}
-          make_comment: true
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          node-version: '20'
+
+      - name: Set up pnpm
+        if: steps.sync_sdks.outputs.changed == 'true'
+        uses: pnpm/action-setup@v4
+        with:
+          version: '10.24.0'
+
+      - name: Run TypeScript SDK tests
+        if: steps.sync_sdks.outputs.changed == 'true'
+        run: |
+          ./scripts/bootstrap
+          ./scripts/test
+        working-directory: ./sdks/ts
+
+      - name: Commit synced SDK changes
+        if: steps.sync_sdks.outputs.changed == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add sdks/go sdks/ts
+          git commit -m "chore(stainless): sync SDKs for PR #${{ github.event.pull_request.number }}"
+
+      - name: Push synced SDK changes
+        if: steps.sync_sdks.outputs.changed == 'true'
+        run: git push origin "HEAD:${{ github.event.pull_request.head.ref }}"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1b418ad1..39fe2443 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,34 +2,89 @@ name: Test
 
 on:
   push: {}
+  pull_request: {}
 
 jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      server: ${{ steps.filter.outputs.server }}
+      cli: ${{ steps.filter.outputs.cli }}
+      sdk_go: ${{ steps.filter.outputs.sdk_go }}
+      sdk_ts: ${{ steps.filter.outputs.sdk_ts }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            server:
+              - 'cmd/**'
+              - 'lib/**'
+              - 'integration/**'
+              - 'scripts/**'
+              - 'openapi.yaml'
+              - 'go.mod'
+              - 'go.sum'
+              - 'Makefile'
+              - '.github/workflows/test.yml'
+              - '!apps/cli/**'
+              - '!sdks/**'
+            cli:
+              - 'apps/cli/**'
+              - 'sdks/go/**'
+              - 'openapi.yaml'
+              - 'stainless.yaml'
+              - 'go.work'
+              - '.github/workflows/stainless-sdks.yml'
+              - '.github/workflows/test.yml'
+            sdk_go:
+              - 'sdks/go/**'
+              - 'openapi.yaml'
+              - 'stainless.yaml'
+              - '.github/workflows/stainless-sdks.yml'
+              - '.github/workflows/test.yml'
+            sdk_ts:
+              - 'sdks/ts/**'
+              - 'openapi.yaml'
+              - 'stainless.yaml'
+              - '.github/workflows/stainless-sdks.yml'
+              - '.github/workflows/test.yml'
+
   test:
+    needs: changes
+    if: needs.changes.outputs.server == 'true'
     runs-on: [self-hosted, linux, x64, kvm]
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          # Not necessary to upload cache on self-hosted runner(s)
-          # ~/go/pkg/mod and ~/.cache/go-build stay on disk between runs automatically.
           cache: false
           go-version: '1.25.4'
-      
+
       - name: Install dependencies
         run: |
           set -xe
+          apt_retry() {
+            local attempts=0
+            until sudo "$@"; do
+              attempts=$((attempts + 1))
+              if [ "$attempts" -ge 10 ]; then
+                return 1
+              fi
+              sleep 10
+            done
+          }
           if ! command -v mkfs.erofs &> /dev/null || \
              ! command -v mkfs.ext4 &> /dev/null || \
              ! command -v iptables &> /dev/null; then
-            sudo apt-get update
-            sudo apt-get install -y erofs-utils e2fsprogs iptables
+            apt_retry apt-get update
+            apt_retry apt-get install -y erofs-utils e2fsprogs iptables
           fi
           go mod download
-      
-      # Avoids rate limits when running the tests
-      # Tests includes pulling, then converting to disk images
+
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
@@ -48,7 +103,7 @@ jobs:
       - name: Check gofmt
         run: |
           set -euo pipefail
-          go_files="$(git ls-files '*.go')"
+          go_files="$(git ls-files '*.go' | grep -Ev '^(apps/cli|sdks/)' || true)"
           if [ -z "$go_files" ]; then
             exit 0
           fi
@@ -58,12 +113,10 @@ jobs:
             echo "$unformatted"
             exit 1
           fi
-     
+
       - name: Run tests
         env:
-          # Docker auth for tests running as root (sudo)
           DOCKER_CONFIG: /home/debianuser/.docker
-          # TLS/ACME testing (optional - tests will skip if not configured)
           ACME_EMAIL: ${{ secrets.ACME_EMAIL }}
           ACME_DNS_PROVIDER: "cloudflare"
           ACME_CA: "https://acme-staging-v02.api.letsencrypt.org/directory"
@@ -73,6 +126,8 @@ jobs:
         run: make test
 
   test-darwin:
+    needs: changes
+    if: needs.changes.outputs.server == 'true'
     runs-on: [self-hosted, macos, arm64]
     concurrency:
       group: macos-ci-test-${{ github.ref }}
@@ -101,11 +156,10 @@ jobs:
         run: make oapi-generate
       - name: Build
         run: make build
-
       - name: Check gofmt
         run: |
           set -euo pipefail
-          go_files="$(git ls-files '*.go')"
+          go_files="$(git ls-files '*.go' | grep -Ev '^(apps/cli|sdks/)' || true)"
           if [ -z "$go_files" ]; then
             exit 0
           fi
@@ -115,7 +169,6 @@ jobs:
             echo "$unformatted"
             exit 1
           fi
-
       - name: Run tests
         env:
           DEFAULT_HYPERVISOR: vz
@@ -129,8 +182,9 @@ jobs:
           make clean
 
   e2e-install:
+    needs: [changes, test-darwin]
+    if: needs.changes.outputs.server == 'true'
     runs-on: [self-hosted, macos, arm64]
-    needs: test-darwin
     concurrency:
       group: macos-ci-e2e-${{ github.ref }}
       cancel-in-progress: true
@@ -147,3 +201,55 @@ jobs:
       - name: Cleanup on failure
         if: failure()
         run: bash scripts/uninstall.sh || true
+
+  test-cli:
+    needs: changes
+    if: needs.changes.outputs.cli == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          cache: true
+          go-version: '1.25.4'
+      - name: Run CLI tests
+        env:
+          GOWORK: ${{ github.workspace }}/go.work
+        run: go test ./...
+        working-directory: ./apps/cli
+
+  test-sdk-go:
+    needs: changes
+    if: needs.changes.outputs.sdk_go == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          cache: true
+          go-version: '1.25.4'
+      - name: Run Go SDK tests
+        run: GOWORK=off go test ./...
+        working-directory: ./sdks/go
+
+  test-sdk-ts:
+    needs: changes
+    if: needs.changes.outputs.sdk_ts == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: '10.24.0'
+      - name: Run TypeScript SDK tests
+        run: |
+          ./scripts/bootstrap
+          ./scripts/test
+        working-directory: ./sdks/ts
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index 06807042..466dd2de 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -2,6 +2,38 @@
 
 This document covers development setup, configuration, and contributing to Hypeman.
 
+## Monorepo Migration Notes
+
+The monorepo now includes:
+
+- `cmd/`, `lib/`, `integration/` for server code
+- `apps/cli` for CLI code
+- `sdks/go` and `sdks/ts` for Stainless SDK code
+
+History import workflow (path-native, blame-correct):
+
+1. Rewrite source history into a target subdirectory using `git filter-repo` (preferred) or `git filter-branch` fallback.
+2. Prefix imported tags with a namespace (for example `legacy/cli/`, `legacy/sdk-go/`, `legacy/sdk-ts/`).
+3. Merge rewritten histories with `git merge --allow-unrelated-histories --no-ff`.
+4. Anchor non-main imported refs with `git merge -s ours --no-ff <ref>` so all source commits are reachable from the migration branch without changing tree contents.
+5. Verify with:
+   - `git log -- <imported-path>/<file>`
+   - `git blame <imported-path>/<file>`
+
+Rollback commands during migration:
+
+```bash
+# Abort in-progress merge
+git merge --abort
+
+# Reset working tree to last commit on migration branch
+git reset --hard HEAD
+
+# Remove imported refs created during staging
+git for-each-ref --format='%(refname)' refs/heads/import/ | while read -r ref; do git update-ref -d "$ref"; done
+git for-each-ref --format='%(refname)' refs/tags/legacy/ | while read -r ref; do git update-ref -d "$ref"; done
+```
+
 ## Prerequisites
 
 ### Linux (Default)
diff --git a/Makefile b/Makefile
index db88e71b..8b3e1541 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
 SHELL := /bin/bash
-.PHONY: oapi-generate generate-vmm-client generate-wire generate-all dev build build-linux test test-linux test-darwin install-tools gen-jwt download-ch-binaries download-ch-spec ensure-ch-binaries build-caddy-binaries build-caddy ensure-caddy-binaries  release-prep clean build-embedded
+.PHONY: oapi-generate generate-vmm-client generate-wire generate-all dev build build-linux test test-linux test-darwin test-cli test-sdk-go test-sdk-ts test-monorepo install-tools gen-jwt download-ch-binaries download-ch-spec ensure-ch-binaries build-caddy-binaries build-caddy ensure-caddy-binaries release-prep clean build-embedded
 
 # Directory where local binaries will be installed
 BIN_DIR ?= $(CURDIR)/bin
@@ -226,6 +226,21 @@ else
 	$(MAKE) test-linux
 endif
 
+# Run monorepo component tests
+test-monorepo: test test-cli test-sdk-go test-sdk-ts
+
+# Run CLI tests against local workspace dependencies
+test-cli:
+	cd apps/cli && go test ./...
+
+# Run Go SDK tests
+test-sdk-go:
+	cd sdks/go && go test ./...
+
+# Run TypeScript SDK tests
+test-sdk-ts:
+	cd sdks/ts && pnpm install --frozen-lockfile && pnpm test
+
 # Linux tests (as root for network capabilities)
 test-linux: ensure-ch-binaries ensure-caddy-binaries build-embedded
 	@VERBOSE_FLAG=""; \
diff --git a/README.md b/README.md
index 3a1a449f..05d3ade1 100644
--- a/README.md
+++ b/README.md
@@ -60,6 +60,7 @@ curl -fsSL https://get.hypeman.sh/cli | bash
 ```bash
 go install 'github.com/kernel/hypeman-cli/cmd/hypeman@latest'
 ```
+The CLI and SDK source now lives in this monorepo; external package/release identities are mirrored for compatibility.
 
 Then create a CLI config file at `~/.config/hypeman/cli.yaml`:
 
@@ -183,6 +184,13 @@ For all available commands, run `hypeman --help`.
 
 ## Development
 
+Monorepo layout:
+
+- `cmd/`, `lib/`, `integration/`: Hypeman server and API
+- `apps/cli`: Hypeman CLI source
+- `sdks/go`: Stainless-generated Go SDK source
+- `sdks/ts`: Stainless-generated TypeScript SDK source
+
 See [DEVELOPMENT.md](DEVELOPMENT.md) for build instructions, configuration options, and contributing guidelines.
 
 ## License
diff --git a/apps/cli/.github/workflows/ci.yml b/apps/cli/.github/workflows/ci.yml
new file mode 100644
index 00000000..697b7ff6
--- /dev/null
+++ b/apps/cli/.github/workflows/ci.yml
@@ -0,0 +1,34 @@
+name: CI
+on:
+  push:
+    branches-ignore:
+      - 'generated'
+      - 'codegen/**'
+      - 'integrated/**'
+      - 'stl-preview-head/**'
+      - 'stl-preview-base/**'
+  pull_request:
+    branches-ignore:
+      - 'stl-preview-head/**'
+      - 'stl-preview-base/**'
+
+jobs:
+  lint:
+    timeout-minutes: 10
+    name: lint
+    runs-on: ${{ github.repository == 'stainless-sdks/hypeman-cli' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: ./go.mod
+
+      - name: Bootstrap
+        run: ./scripts/bootstrap
+
+      - name: Run lints
+        run: ./scripts/lint
diff --git a/apps/cli/.github/workflows/publish-release.yml b/apps/cli/.github/workflows/publish-release.yml
new file mode 100644
index 00000000..5088ad07
--- /dev/null
+++ b/apps/cli/.github/workflows/publish-release.yml
@@ -0,0 +1,40 @@
+---
+name: Publish Release
+permissions:
+  contents: write
+
+concurrency:
+  group: publish
+
+on:
+  push:
+    tags:
+      - "v*"
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Generate app token
+      id: app-token
+      uses: actions/create-github-app-token@v1
+      with:
+        app-id: ${{ secrets.ADMIN_APP_ID }}
+        private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
+        owner: kernel
+        repositories: homebrew-tap
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version-file: "go.mod"
+    - name: Run GoReleaser
+      uses: goreleaser/goreleaser-action@v6.1.0
+      with:
+        version: latest
+        args: release --clean
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
\ No newline at end of file
diff --git a/apps/cli/.github/workflows/release-doctor.yml b/apps/cli/.github/workflows/release-doctor.yml
new file mode 100644
index 00000000..b2931090
--- /dev/null
+++ b/apps/cli/.github/workflows/release-doctor.yml
@@ -0,0 +1,19 @@
+name: Release Doctor
+on:
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  release_doctor:
+    name: release doctor
+    runs-on: ubuntu-latest
+    if: github.repository == 'kernel/hypeman-cli' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check release environment
+        run: |
+          bash ./bin/check-release-environment
diff --git a/apps/cli/.gitignore b/apps/cli/.gitignore
new file mode 100644
index 00000000..12c45084
--- /dev/null
+++ b/apps/cli/.gitignore
@@ -0,0 +1,6 @@
+.prism.log
+dist/
+/hypeman
+.env
+hypeman/**
+bin/hypeman
diff --git a/apps/cli/.goreleaser.yml b/apps/cli/.goreleaser.yml
new file mode 100644
index 00000000..b2f3fb97
--- /dev/null
+++ b/apps/cli/.goreleaser.yml
@@ -0,0 +1,98 @@
+project_name: hypeman
+version: 2
+
+before:
+  hooks:
+    - mkdir -p completions
+    - sh -c "go run ./cmd/hypeman/main.go @completion bash > completions/hypeman.bash"
+    - sh -c "go run ./cmd/hypeman/main.go @completion zsh > completions/hypeman.zsh"
+    - sh -c "go run ./cmd/hypeman/main.go @completion fish > completions/hypeman.fish"
+    - sh -c "go run ./cmd/hypeman/main.go @manpages -o man"
+
+builds:
+  - id: macos
+    goos: [darwin]
+    goarch: [amd64, arm64]
+    binary: '{{ .ProjectName }}'
+    main: ./cmd/hypeman/main.go
+    mod_timestamp: '{{ .CommitTimestamp }}'
+    ldflags:
+      - '-s -w -X github.com/kernel/hypeman-cli/pkg/cmd.version={{.Version}}'
+
+  - id: linux
+    goos: [linux]
+    goarch: ['386', arm, amd64, arm64]
+    env:
+      - CGO_ENABLED=0
+    binary: '{{ .ProjectName }}'
+    main: ./cmd/hypeman/main.go
+    mod_timestamp: '{{ .CommitTimestamp }}'
+    ldflags:
+      - '-s -w -X github.com/kernel/hypeman-cli/pkg/cmd.version={{.Version}}'
+
+  - id: windows
+    goos: [windows]
+    goarch: ['386', amd64, arm64]
+    binary: '{{ .ProjectName }}'
+    main: ./cmd/hypeman/main.go
+    mod_timestamp: '{{ .CommitTimestamp }}'
+    ldflags:
+      - '-s -w -X github.com/kernel/hypeman-cli/pkg/cmd.version={{.Version}}'
+
+archives:
+  - id: linux-archive
+    ids: [linux]
+    name_template: '{{ .ProjectName }}_{{ .Version }}_linux_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}'
+    formats: [tar.gz]
+    files:
+      - completions/*
+      - man/*/*
+  - id: macos-archive
+    ids: [macos]
+    name_template: '{{ .ProjectName }}_{{ .Version }}_macos_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}'
+    formats: [zip]
+    files:
+      - completions/*
+      - man/*/*
+  - id: windows-archive
+    ids: [windows]
+    name_template: '{{ .ProjectName }}_{{ .Version }}_windows_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}'
+    formats: [zip]
+    files:
+      - completions/*
+      - man/*/*
+
+snapshot:
+  version_template: '{{ .Tag }}-next'
+
+nfpms:
+  - license: Apache-2.0
+    maintainer: Kernel <support@kernel.dev>
+    bindir: /usr
+    formats:
+      - apk
+      - deb
+      - rpm
+      - termux.deb
+      - archlinux
+    contents:
+      - src: man/man1/*.1.gz
+        dst: /usr/share/man/man1/
+brews:
+  - name: hypeman
+    repository:
+      owner: kernel
+      name: homebrew-tap
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
+    homepage: https://github.com/kernel/hypeman
+    description: orchestrate cloud-hypervisor VMs
+    license: Apache-2.0
+    directory: Formula
+    install: |
+      bin.install "hypeman"
+      bash_completion.install "completions/hypeman.bash" => "hypeman"
+      zsh_completion.install "completions/hypeman.zsh" => "_hypeman"
+      fish_completion.install "completions/hypeman.fish"
+      man1.install Dir["man/man1/*.1.gz"]
+    test: |
+      system "#{bin}/hypeman", "--version"
diff --git a/apps/cli/.release-please-manifest.json b/apps/cli/.release-please-manifest.json
new file mode 100644
index 00000000..1b77f506
--- /dev/null
+++ b/apps/cli/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "0.7.0"
+}
\ No newline at end of file
diff --git a/apps/cli/CHANGELOG.md b/apps/cli/CHANGELOG.md
new file mode 100644
index 00000000..e1e0a6bf
--- /dev/null
+++ b/apps/cli/CHANGELOG.md
@@ -0,0 +1,119 @@
+# Changelog
+
+## 0.7.0 (2025-12-23)
+
+Full Changelog: [v0.6.1...v0.7.0](https://github.com/onkernel/hypeman-cli/compare/v0.6.1...v0.7.0)
+
+### Features
+
+* add cp command for file copy to/from instances ([#18](https://github.com/onkernel/hypeman-cli/issues/18)) ([f67ad7b](https://github.com/onkernel/hypeman-cli/commit/f67ad7bcb6fbbe0a9409574fababab862da87840))
+
+
+### Chores
+
+* **internal:** codegen related update ([a6c6588](https://github.com/onkernel/hypeman-cli/commit/a6c6588d42a6981b65f5144d033f040afc29a959))
+
+## 0.6.1 (2025-12-11)
+
+Full Changelog: [v0.6.0...v0.6.1](https://github.com/onkernel/hypeman-cli/compare/v0.6.0...v0.6.1)
+
+## 0.6.0 (2025-12-06)
+
+Full Changelog: [v0.5.1...v0.6.0](https://github.com/onkernel/hypeman-cli/compare/v0.5.1...v0.6.0)
+
+### Features
+
+* **cli:** automatic streaming for paginated endpoints ([9af6924](https://github.com/onkernel/hypeman-cli/commit/9af69246d62010c32d39583c8b1eba39a663d3fa))
+
+## 0.5.1 (2025-12-05)
+
+Full Changelog: [v0.5.0...v0.5.1](https://github.com/onkernel/hypeman-cli/compare/v0.5.0...v0.5.1)
+
+### Features
+
+* **api:** manual updates ([a3f2ec1](https://github.com/onkernel/hypeman-cli/commit/a3f2ec15101a6afd6feb1da1addcb3a2589acb53))
+* fix edge cases for sending request data and add YAML support ([3e740a9](https://github.com/onkernel/hypeman-cli/commit/3e740a94698f4704e79cc5c3b6434cbb1bfcb935))
+* Ingress ([bfb79c5](https://github.com/onkernel/hypeman-cli/commit/bfb79c5a160a3b92cac3793ea49da49ddcc7c8c6))
+* Initialize volume with data ([ef9997c](https://github.com/onkernel/hypeman-cli/commit/ef9997cc2c6d0fc14531bdf9d1238f3447e3a454))
+* **push:** add hypeman push command for local image upload ([e120ec6](https://github.com/onkernel/hypeman-cli/commit/e120ec6d96531ab49909a3d55895f5fcc4d43dc2))
+* respect HYPEMAN_BASE_URL environment variable ([17122d7](https://github.com/onkernel/hypeman-cli/commit/17122d7b2d6041c57d4e2d341b52f18697aef5d4))
+
+
+### Bug Fixes
+
+* fix for default flag values ([812e009](https://github.com/onkernel/hypeman-cli/commit/812e0091f73ab5e8992adab5ca1c2cef76b60c63))
+* **run:** wait for image to be ready before creating instance ([048ee73](https://github.com/onkernel/hypeman-cli/commit/048ee7311c39d6c3c7efad9c662fa2a1993ced97))
+* use correct user agent value ([580e468](https://github.com/onkernel/hypeman-cli/commit/580e468e95a11c8c57016954464039af3b0586f1))
+
+
+### Chores
+
+* add scripts ([c3e4955](https://github.com/onkernel/hypeman-cli/commit/c3e4955f932edc7567d929f22f3e93f22ae69e1a))
+* update dependencies ([4ed31f6](https://github.com/onkernel/hypeman-cli/commit/4ed31f6294c1b94ef764bb7959dc99e89af62cfb))
+
+## 0.5.0 (2025-11-26)
+
+Full Changelog: [v0.4.0...v0.5.0](https://github.com/onkernel/hypeman-cli/compare/v0.4.0...v0.5.0)
+
+### Features
+
+* Generate log streaming ([31951c5](https://github.com/onkernel/hypeman-cli/commit/31951c5caf65c008f9811ffd023f54a10c3f1474))
+
+## 0.4.0 (2025-11-26)
+
+Full Changelog: [v0.3.0...v0.4.0](https://github.com/onkernel/hypeman-cli/compare/v0.3.0...v0.4.0)
+
+### Features
+
+* Remove exec from openapi spec ([6bde031](https://github.com/onkernel/hypeman-cli/commit/6bde031264de6cd6b17afe32f73a70bf14c2f36d))
+
+## 0.3.0 (2025-11-26)
+
+Full Changelog: [v0.2.0...v0.3.0](https://github.com/onkernel/hypeman-cli/compare/v0.2.0...v0.3.0)
+
+### Features
+
+* **api:** add exec ([cc1d174](https://github.com/onkernel/hypeman-cli/commit/cc1d17479467b19436346b30256f92d99474d9ed))
+
+## 0.2.0 (2025-11-26)
+
+Full Changelog: [v0.1.2...v0.2.0](https://github.com/onkernel/hypeman-cli/compare/v0.1.2...v0.2.0)
+
+### Features
+
+* Network manager ([cece9ba](https://github.com/onkernel/hypeman-cli/commit/cece9ba6e801a9b29512357060e5642976c8e3ec))
+
+
+### Chores
+
+* **client:** change name of underlying properties for models and params ([27fd97a](https://github.com/onkernel/hypeman-cli/commit/27fd97aa3faa8b436a625783232d36250bbd191a))
+
+## 0.1.2 (2025-11-20)
+
+Full Changelog: [v0.1.1...v0.1.2](https://github.com/onkernel/hypeman-cli/compare/v0.1.1...v0.1.2)
+
+### ⚠ BREAKING CHANGES
+
+* new logic for parsing arguments
+
+### Features
+
+* new logic for parsing arguments ([de05b62](https://github.com/onkernel/hypeman-cli/commit/de05b6274cb3d3c27dcfe9784a331a9762a8dca5))
+
+## 0.1.1 (2025-11-14)
+
+Full Changelog: [v0.1.0...v0.1.1](https://github.com/onkernel/hypeman-cli/compare/v0.1.0...v0.1.1)
+
+### Features
+
+* **api:** manual updates ([1133f94](https://github.com/onkernel/hypeman-cli/commit/1133f94ebcc7e53162d26aa03a265e3520806ebb))
+
+## 0.1.0 (2025-11-14)
+
+Full Changelog: [v0.0.1...v0.1.0](https://github.com/onkernel/hypeman-cli/compare/v0.0.1...v0.1.0)
+
+### Features
+
+* **api:** add homebrew ([489dbc8](https://github.com/onkernel/hypeman-cli/commit/489dbc83126ed1f9c506ec64d7f5291f3adfc0ac))
+* **api:** make public ([a42708e](https://github.com/onkernel/hypeman-cli/commit/a42708e4e7f906d338b2db8da0ef56355e2b6ba8))
+* **api:** manual updates ([2aa453f](https://github.com/onkernel/hypeman-cli/commit/2aa453f3c0cc4191329ade9a8c8b2b328eca97e1))
diff --git a/apps/cli/LICENSE b/apps/cli/LICENSE
new file mode 100644
index 00000000..5e9bf84c
--- /dev/null
+++ b/apps/cli/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2025 Hypeman
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/apps/cli/README.md b/apps/cli/README.md
new file mode 100644
index 00000000..d0a8e905
--- /dev/null
+++ b/apps/cli/README.md
@@ -0,0 +1,255 @@
+# Hypeman CLI
+
+The official CLI for [Hypeman](https://github.com/kernel/hypeman/).
+
+## Installation
+
+### Installing with Homebrew
+
+```sh
+brew install kernel/tap/hypeman
+```
+
+### Installing with Go
+
+<!-- x-release-please-start-version -->
+
+```sh
+go install 'github.com/kernel/hypeman-cli/cmd/hypeman@latest'
+```
+
+### Running Locally
+
+<!-- x-release-please-start-version -->
+
+```sh
+go run cmd/hypeman/main.go
+```
+
+<!-- x-release-please-end -->
+
+## Usage
+
+```sh
+# Pull an image
+hypeman pull nginx:alpine
+
+# Boot a new VM (auto-pulls image if needed)
+hypeman run --name my-app nginx:alpine
+
+# List running VMs
+hypeman ps
+# show all VMs
+hypeman ps -a
+
+# View logs of your app
+# All commands support using VM name, ID, or partial ID
+hypeman logs my-app
+hypeman logs -f my-app
+
+# Execute a command in a running VM
+hypeman exec my-app whoami
+# Shell into the VM
+hypeman exec -it my-app /bin/sh
+
+# VM lifecycle
+# Turn off the VM
+hypeman stop my-app
+# Boot the VM that was turned off
+hypeman start my-app
+# Put the VM to sleep (paused)
+hypeman standby my-app
+# Awaken the VM (resumed)
+hypeman restore my-app
+
+# Create a reverse proxy ("ingress") from the host to your VM
+hypeman ingress create --name my-ingress my-app --hostname my-nginx-app --port 80 --host-port 8081
+
+# List ingresses
+hypeman ingress list
+
+# Curl nginx through your ingress
+curl --header "Host: my-nginx-app" http://127.0.0.1:8081
+
+# Delete an ingress
+hypeman ingress delete my-ingress
+
+# Delete all VMs
+hypeman rm --force --all
+```
+
+More ingress features:
+- Automatic certs
+- Subdomain-based routing
+
+```bash
+# Make your VM if not already present
+hypeman run --name my-app nginx:alpine
+
+# This requires configuring the Hypeman server with DNS credentials
+# Change --hostname to a domain you own
+hypeman ingress create --name my-tls-ingress my-app --hostname hello.hypeman-development.com -p 80 --host-port 7443 --tls
+
+# Curl through your TLS-terminating reverse proxy configuration
+curl \
+  --resolve hello.hypeman-development.com:7443:127.0.0.1 \
+  https://hello.hypeman-development.com:7443
+
+# OR... Ingress also supports subdomain-based routing
+hypeman ingress create --name my-tls-subdomain-ingress '{instance}' --hostname '{instance}.hypeman-development.com' -p 80 --host-port 8443 --tls
+
+# Curling through the subdomain-based routing
+curl \
+  --resolve my-app.hypeman-development.com:8443:127.0.0.1 \
+  https://my-app.hypeman-development.com:8443
+
+# Delete all ingress
+hypeman ingress delete --all
+```
+
+More logging features:
+- Cloud Hypervisor logs
+- Hypeman operational logs
+
+```bash
+# View Cloud Hypervisor logs for your VM
+hypeman logs --source vmm my-app
+# View Hypeman logs for your VM
+hypeman logs --source hypeman my-app
+```
+
+For details about specific commands, use the `--help` flag.
+
+The CLI also provides resource-based commands for more advanced usage:
+
+```sh
+hypeman [resource] [command] [flags]
+```
+
+## Resource Management
+
+### Viewing Server Resources
+
+Check available server capacity, current allocations, and GPU availability:
+
+```bash
+# Show server resource status (CPU, memory, disk, network, GPU)
+hypeman resources
+
+# Show resources as JSON
+hypeman resources --format json
+
+# Show only GPU information
+hypeman resources --transform gpu
+```
+
+### Per-VM Resource Limits
+
+Control resource allocation for instances:
+
+```bash
+# Set disk I/O limit
+hypeman run --disk-io 100MB/s --name io-limited myimage:latest
+
+# Set network bandwidth limits
+hypeman run --bandwidth-down 1Gbps --bandwidth-up 500Mbps --name bw-limited myimage:latest
+
+# Combine multiple resource options
+hypeman run \
+  --cpus 4 \
+  --memory 8GB \
+  --gpu-profile L40S-2Q \
+  --disk-io 200MB/s \
+  --bandwidth-down 10Gbps \
+  --name ml-training \
+  pytorch:latest
+```
+
+## GPU support
+
+
+### GPU Passthrough
+
+For full GPU passthrough (entire GPU dedicated to one VM):
+
+```bash
+# Discover available passthrough-capable devices
+hypeman device available
+
+# Register a GPU for passthrough
+hypeman device register --pci-address 0000:a2:00.0 --name my-gpu
+
+# List registered devices
+hypeman device list
+
+# Run an instance with the GPU attached
+hypeman run --device my-gpu --hypervisor qemu --name gpu-workload cuda:12.0
+
+# When done, unregister the device
+hypeman device delete my-gpu
+```
+
+### Nvidia vGPU
+
+Use NVIDIA vGPU to share a physical GPU across multiple VMs:
+
+```bash
+# Run with a vGPU profile
+hypeman run --gpu-profile L40S-1Q --name ml-workload pytorch:latest
+
+# Run with more vGPU resources
+hypeman run --gpu-profile L40S-4Q --cpus 8 --memory 32GB --name training-job tensorflow:latest
+```
+
+### Hypervisor Selection
+
+Choose between Cloud Hypervisor (default) and QEMU:
+
+```bash
+# Run with QEMU (more compatible with some features like vGPU)
+hypeman run --hypervisor qemu --name qemu-vm myimage:latest
+
+# Run with Cloud Hypervisor (default, faster boot)
+hypeman run --hypervisor cloud-hypervisor --name ch-vm myimage:latest
+```
+
+## Global Flags
+
+- `--debug` - Enable debug logging (includes HTTP request/response details)
+- `--version`, `-v` - Show the CLI version
+
+## Development
+
+### Testing Preview Branches
+
+When developing features in the main [hypeman](https://github.com/kernel/hypeman) repo, Stainless automatically creates preview branches in `stainless-sdks/hypeman-cli` with your API changes. You can check out these branches locally to test the CLI changes:
+
+```bash
+# Checkout preview/<branch> (e.g., if working on "devices" branch in hypeman)
+./scripts/checkout-preview devices
+
+# Checkout an exact branch name
+./scripts/checkout-preview -b main
+./scripts/checkout-preview -b preview/my-feature
+```
+
+The script automatically adds the `stainless` remote if needed and also updates `go.mod` to point the `hypeman-go` SDK dependency to the corresponding preview branch in `stainless-sdks/hypeman-go`.
+
+> **Warning:** The `go.mod` and `go.sum` changes from `checkout-preview` are for local testing only. Do not commit these changes.
+
+After checking out a preview branch, you can build and test the CLI:
+
+```bash
+go build -o hypeman ./cmd/hypeman
+./hypeman --help
+```
+
+You can also point the SDK dependency independently:
+
+```bash
+# Point hypeman-go to a specific branch
+./scripts/use-sdk-preview preview/my-feature
+
+# Point to a specific commit
+./scripts/use-sdk-preview abc1234def567
+```
diff --git a/apps/cli/SECURITY.md b/apps/cli/SECURITY.md
new file mode 100644
index 00000000..94a5b008
--- /dev/null
+++ b/apps/cli/SECURITY.md
@@ -0,0 +1,23 @@
+# Security Policy
+
+## Reporting Security Issues
+
+This SDK is generated by [Stainless Software Inc](http://stainless.com). Stainless takes security seriously, and encourages you to report any security vulnerability promptly so that appropriate action can be taken.
+
+To report a security issue, please contact the Stainless team at security@stainless.com.
+
+## Responsible Disclosure
+
+We appreciate the efforts of security researchers and individuals who help us maintain the security of
+SDKs we generate. If you believe you have found a security vulnerability, please adhere to responsible
+disclosure practices by allowing us a reasonable amount of time to investigate and address the issue
+before making any information public.
+
+## Reporting Non-SDK Related Security Issues
+
+If you encounter security issues that are not directly related to SDKs but pertain to the services
+or products provided by Hypeman, please follow the respective company's security reporting guidelines.
+
+---
+
+Thank you for helping us keep the SDKs and systems they interact with secure.
diff --git a/apps/cli/bin/check-release-environment b/apps/cli/bin/check-release-environment
new file mode 100644
index 00000000..1e951e9a
--- /dev/null
+++ b/apps/cli/bin/check-release-environment
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+errors=()
+
+lenErrors=${#errors[@]}
+
+if [[ lenErrors -gt 0 ]]; then
+  echo -e "Found the following errors in the release environment:\n"
+
+  for error in "${errors[@]}"; do
+    echo -e "- $error\n"
+  done
+
+  exit 1
+fi
+
+echo "The environment is ready to push releases!"
diff --git a/apps/cli/cmd/hypeman/main.go b/apps/cli/cmd/hypeman/main.go
new file mode 100644
index 00000000..23c43b24
--- /dev/null
+++ b/apps/cli/cmd/hypeman/main.go
@@ -0,0 +1,39 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+
+	"github.com/kernel/hypeman-cli/pkg/cmd"
+	"github.com/kernel/hypeman-go"
+	"github.com/tidwall/gjson"
+)
+
+func main() {
+	app := cmd.Command
+	if err := app.Run(context.Background(), os.Args); err != nil {
+		// Handle exec exit codes specially - exit with the command's exit code
+		var execErr *cmd.ExecExitError
+		if errors.As(err, &execErr) {
+			os.Exit(execErr.Code)
+		}
+
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			fmt.Fprintf(os.Stderr, "%s %q: %d %s\n", apierr.Request.Method, apierr.Request.URL, apierr.Response.StatusCode, http.StatusText(apierr.Response.StatusCode))
+			format := app.String("format-error")
+			json := gjson.Parse(apierr.RawJSON())
+			show_err := cmd.ShowJSON(os.Stdout, "Error", json, format, app.String("transform-error"))
+			if show_err != nil {
+				// Just print the original error:
+				fmt.Fprintf(os.Stderr, "%s\n", err.Error())
+			}
+		} else {
+			fmt.Fprintf(os.Stderr, "%s\n", err.Error())
+		}
+		os.Exit(1)
+	}
+}
diff --git a/apps/cli/go.mod b/apps/cli/go.mod
new file mode 100644
index 00000000..f5910038
--- /dev/null
+++ b/apps/cli/go.mod
@@ -0,0 +1,89 @@
+module github.com/kernel/hypeman-cli
+
+go 1.25
+
+require (
+	github.com/charmbracelet/bubbles v0.21.0
+	github.com/charmbracelet/bubbletea v1.3.6
+	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/charmbracelet/x/term v0.2.1
+	github.com/google/go-containerregistry v0.20.7
+	github.com/gorilla/websocket v1.5.3
+	github.com/itchyny/json2yaml v0.1.4
+	github.com/kernel/hypeman-go v0.11.0
+	github.com/knadh/koanf/parsers/yaml v1.1.0
+	github.com/knadh/koanf/providers/file v1.2.1
+	github.com/knadh/koanf/v2 v2.3.2
+	github.com/muesli/reflow v0.3.0
+	github.com/stretchr/testify v1.11.1
+	github.com/tidwall/gjson v1.18.0
+	github.com/tidwall/pretty v1.2.1
+	github.com/tidwall/sjson v1.2.5
+	github.com/urfave/cli-docs/v3 v3.0.0-alpha6
+	github.com/urfave/cli/v3 v3.3.2
+	golang.org/x/sys v0.38.0
+	golang.org/x/term v0.37.0
+)
+
+require (
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
+	github.com/charmbracelet/x/ansi v0.9.3 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/cli v29.0.3+incompatible // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker v28.5.2+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
+	github.com/klauspost/compress v1.18.1 // indirect
+	github.com/knadh/koanf/maps v0.1.2 // indirect
+	github.com/knadh/koanf/providers/env v1.1.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-localereader v0.0.1 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
+	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/vbatts/tar-split v0.12.2 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.38.0 // indirect
+	go.opentelemetry.io/otel/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/trace v1.38.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 // indirect
+	google.golang.org/grpc v1.75.1 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
diff --git a/apps/cli/go.sum b/apps/cli/go.sum
new file mode 100644
index 00000000..9c04859f
--- /dev/null
+++ b/apps/cli/go.sum
@@ -0,0 +1,224 @@
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
+github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
+github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/charmbracelet/bubbles v0.21.0 h1:9TdC97SdRVg/1aaXNVWfFH3nnLAwOXr8Fn6u6mfQdFs=
+github.com/charmbracelet/bubbles v0.21.0/go.mod h1:HF+v6QUR4HkEpz62dx7ym2xc71/KBHg+zKwJtMw+qtg=
+github.com/charmbracelet/bubbletea v1.3.6 h1:VkHIxPJQeDt0aFJIsVxw8BQdh/F/L2KKZGsK6et5taU=
+github.com/charmbracelet/bubbletea v1.3.6/go.mod h1:oQD9VCRQFF8KplacJLo28/jofOI2ToOfGYeFgBBxHOc=
+github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
+github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
+github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
+github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
+github.com/charmbracelet/x/ansi v0.9.3 h1:BXt5DHS/MKF+LjuK4huWrC6NCvHtexww7dMayh6GXd0=
+github.com/charmbracelet/x/ansi v0.9.3/go.mod h1:3RQDQ6lDnROptfpWuUVIUG64bD2g2BgntdxH0Ya5TeE=
+github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
+github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
+github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91 h1:payRxjMjKgx2PaCWLZ4p3ro9y97+TVLZNaRZgJwSVDQ=
+github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
+github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
+github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfNOFMA/c10O1axL69EU7iirO8=
+github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q=
+github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
+github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/cli v29.0.3+incompatible h1:8J+PZIcF2xLd6h5sHPsp5pvvJA+Sr2wGQxHkRl53a1E=
+github.com/docker/cli v29.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
+github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
+github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
+github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-containerregistry v0.20.7 h1:24VGNpS0IwrOZ2ms2P1QE3Xa5X9p4phx0aUgzYzHW6I=
+github.com/google/go-containerregistry v0.20.7/go.mod h1:Lx5LCZQjLH1QBaMPeGwsME9biPeo1lPx6lbGj/UmzgM=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
+github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
+github.com/itchyny/json2yaml v0.1.4 h1:/pErVOXGG5iTyXHi/QKR4y3uzhLjGTEmmJIy97YT+k8=
+github.com/itchyny/json2yaml v0.1.4/go.mod h1:6iudhBZdarpjLFRNj+clWLAkGft+9uCcjAZYXUH9eGI=
+github.com/kernel/hypeman-go v0.11.0 h1:hCXNUHtrhGKswJapzyWyozBOXhKK/oreKvm0AXHuE6c=
+github.com/kernel/hypeman-go v0.11.0/go.mod h1:guRrhyP9QW/ebUS1UcZ0uZLLJeGAAhDNzSi68U4M9hI=
+github.com/klauspost/compress v1.18.1 h1:bcSGx7UbpBqMChDtsF28Lw6v/G94LPrrbMbdC3JH2co=
+github.com/klauspost/compress v1.18.1/go.mod h1:ZQFFVG+MdnR0P+l6wpXgIL4NTtwiKIdBnrBd8Nrxr+0=
+github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo=
+github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI=
+github.com/knadh/koanf/parsers/yaml v1.1.0 h1:3ltfm9ljprAHt4jxgeYLlFPmUaunuCgu1yILuTXRdM4=
+github.com/knadh/koanf/parsers/yaml v1.1.0/go.mod h1:HHmcHXUrp9cOPcuC+2wrr44GTUB0EC+PyfN3HZD9tFg=
+github.com/knadh/koanf/providers/env v1.1.0 h1:U2VXPY0f+CsNDkvdsG8GcsnK4ah85WwWyJgef9oQMSc=
+github.com/knadh/koanf/providers/env v1.1.0/go.mod h1:QhHHHZ87h9JxJAn2czdEl6pdkNnDh/JS1Vtsyt65hTY=
+github.com/knadh/koanf/providers/file v1.2.1 h1:bEWbtQwYrA+W2DtdBrQWyXqJaJSG3KrP3AESOJYp9wM=
+github.com/knadh/koanf/providers/file v1.2.1/go.mod h1:bp1PM5f83Q+TOUu10J/0ApLBd9uIzg+n9UgthfY+nRA=
+github.com/knadh/koanf/v2 v2.3.2 h1:Ee6tuzQYFwcZXQpc2MiVeC6qHMandf5SMUJJNoFp/c4=
+github.com/knadh/koanf/v2 v2.3.2/go.mod h1:gRb40VRAbd4iJMYYD5IxZ6hfuopFcXBpc9bbQpZwo28=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
+github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
+github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
+github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
+github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
+github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/term v0.0.0-20221205130635-1aeaba878587 h1:HfkjXDfhgVaN5rmueG8cL8KKeFNecRCXFhaJ2qZ5SKA=
+github.com/moby/term v0.0.0-20221205130635-1aeaba878587/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
+github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
+github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
+github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
+github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8=
+github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
+github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
+github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
+github.com/urfave/cli-docs/v3 v3.0.0-alpha6 h1:w/l/N0xw1rO/aHRIGXJ0lDwwYFOzilup1qGvIytP3BI=
+github.com/urfave/cli-docs/v3 v3.0.0-alpha6/go.mod h1:p7Z4lg8FSTrPB9GTaNyTrK3ygffHZcK3w0cU2VE+mzU=
+github.com/urfave/cli/v3 v3.3.2 h1:BYFVnhhZ8RqT38DxEYVFPPmGFTEf7tJwySTXsVRrS/o=
+github.com/urfave/cli/v3 v3.3.2/go.mod h1:FJSKtM/9AiiTOJL4fJ6TbMUkxBXn7GO9guZqoZtpYpo=
+github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4=
+github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
+go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.33.0 h1:wpMfgF8E1rkrT1Z6meFh1NDtownE9Ii3n3X2GJYjsaU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.33.0/go.mod h1:wAy0T/dUbs468uOlkT31xjvqQgEVXv58BRFWEgn5v/0=
+go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
+go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
+go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
+go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
+go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
+go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
+go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
+go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
+go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
+go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZtfTpbJLDr/lwfgO53E=
+golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac h1:7zkz7BUtwNFFqcowJ+RIgu2MaV/MapERkDIy+mwPyjs=
+golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 h1:BIRfGDEjiHRrk0QKZe3Xv2ieMhtgRGeLcZQ0mIVn4EY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5/go.mod h1:j3QtIyytwqGr1JUDtYXwtMXWPKsEa5LtzIFN1Wn5WvE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 h1:eaY8u2EuxbRv7c3NiGK0/NedzVsCcV6hDuU5qPX5EGE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5/go.mod h1:M4/wBTSeyLxupu3W3tJtOgB14jILAS/XWPSSa3TAlJc=
+google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
+google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
+gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
diff --git a/apps/cli/pkg/cmd/build.go b/apps/cli/pkg/cmd/build.go
new file mode 100644
index 00000000..21deedb0
--- /dev/null
+++ b/apps/cli/pkg/cmd/build.go
@@ -0,0 +1,492 @@
+package cmd
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/tidwall/gjson"
+	"github.com/urfave/cli/v3"
+)
+
+var buildCmd = cli.Command{
+	Name:      "build",
+	Usage:     "Build an image from a Dockerfile",
+	ArgsUsage: "[path]",
+	Description: `Build an image from a Dockerfile and source context.
+
+The path argument specifies the build context directory containing the
+source code and Dockerfile. If not specified, the current directory is used.
+
+Subcommands are available for managing builds:
+  hypeman build list       List builds
+  hypeman build get <id>   Get build details
+  hypeman build cancel <id> Cancel a build
+
+Examples:
+  # Build from current directory
+  hypeman build
+
+  # Build from a specific directory
+  hypeman build ./myapp
+
+  # Build with a specific Dockerfile
+  hypeman build -f Dockerfile.prod ./myapp
+
+  # Build with custom timeout
+  hypeman build --timeout 1200 ./myapp`,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:    "file",
+			Aliases: []string{"f"},
+			Usage:   "Path to Dockerfile (relative to context or absolute)",
+		},
+		&cli.IntFlag{
+			Name:  "timeout",
+			Usage: "Build timeout in seconds",
+			Value: 600,
+		},
+		&cli.StringFlag{
+			Name:  "base-image-digest",
+			Usage: "Pinned base image digest for reproducible builds",
+		},
+		&cli.StringFlag{
+			Name:  "cache-scope",
+			Usage: "Tenant-specific cache key prefix",
+		},
+		&cli.StringFlag{
+			Name:  "global-cache-key",
+			Usage: `Global cache identifier (e.g., "node", "python", "ubuntu")`,
+		},
+		&cli.StringFlag{
+			Name:  "is-admin-build",
+			Usage: `Set to "true" to grant push access to global cache (operator-only)`,
+		},
+		&cli.StringFlag{
+			Name:  "secrets",
+			Usage: `JSON array of secret references to inject during build (e.g., '[{"id":"npm_token"}]')`,
+		},
+		&cli.StringFlag{
+			Name:  "image-name",
+			Usage: `Custom image name for the build output (pushed to {registry}/{image_name} instead of {registry}/builds/{id})`,
+		},
+	},
+	Commands: []*cli.Command{
+		&buildListCmd,
+		&buildGetCmd,
+		&buildCancelCmd,
+	},
+	Action:          handleBuild,
+	HideHelpCommand: true,
+}
+
+func handleBuild(ctx context.Context, cmd *cli.Command) error {
+	// Get build context path (default to current directory)
+	contextPath := "."
+	args := cmd.Args().Slice()
+	if len(args) > 0 {
+		contextPath = args[0]
+	}
+
+	// Resolve to absolute path
+	absContextPath, err := filepath.Abs(contextPath)
+	if err != nil {
+		return fmt.Errorf("failed to resolve path: %w", err)
+	}
+
+	// Check if context directory exists
+	info, err := os.Stat(absContextPath)
+	if err != nil {
+		return fmt.Errorf("cannot access build context: %w", err)
+	}
+	if !info.IsDir() {
+		return fmt.Errorf("build context must be a directory: %s", absContextPath)
+	}
+
+	// Get Dockerfile path
+	dockerfilePath := cmd.String("file")
+	var dockerfileContent string
+
+	if dockerfilePath != "" {
+		// If dockerfile is specified, read it
+		if !filepath.IsAbs(dockerfilePath) {
+			dockerfilePath = filepath.Join(absContextPath, dockerfilePath)
+		}
+		content, err := os.ReadFile(dockerfilePath)
+		if err != nil {
+			return fmt.Errorf("cannot read Dockerfile: %w", err)
+		}
+		dockerfileContent = string(content)
+	}
+
+	timeout := cmd.Int("timeout")
+
+	fmt.Fprintf(os.Stderr, "Building from %s...\n", contextPath)
+
+	// Create source tarball
+	tarball, err := createSourceTarball(absContextPath)
+	if err != nil {
+		return fmt.Errorf("failed to create source archive: %w", err)
+	}
+
+	// Create client with options
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	// Build params
+	params := hypeman.BuildNewParams{
+		Source:         bytes.NewReader(tarball.Bytes()),
+		TimeoutSeconds: hypeman.Opt(int64(timeout)),
+	}
+
+	if dockerfileContent != "" {
+		params.Dockerfile = hypeman.Opt(dockerfileContent)
+	}
+
+	if v := cmd.String("base-image-digest"); v != "" {
+		params.BaseImageDigest = hypeman.Opt(v)
+	}
+	if v := cmd.String("cache-scope"); v != "" {
+		params.CacheScope = hypeman.Opt(v)
+	}
+	if v := cmd.String("global-cache-key"); v != "" {
+		params.GlobalCacheKey = hypeman.Opt(v)
+	}
+	if v := cmd.String("is-admin-build"); v != "" {
+		params.IsAdminBuild = hypeman.Opt(v)
+	}
+	if v := cmd.String("secrets"); v != "" {
+		params.Secrets = hypeman.Opt(v)
+	}
+	if v := cmd.String("image-name"); v != "" {
+		params.ImageName = hypeman.Opt(v)
+	}
+
+	// Start build
+	build, err := client.Builds.New(ctx, params, opts...)
+	if err != nil {
+		return fmt.Errorf("failed to start build: %w", err)
+	}
+
+	fmt.Fprintf(os.Stderr, "Build started: %s\n", build.ID)
+
+	// Stream build events
+	err = streamBuildEventsSDK(ctx, client, build.ID, opts)
+	if err != nil {
+		return fmt.Errorf("build failed: %w", err)
+	}
+
+	return nil
+}
+
+// streamBuildEventsSDK streams build events using the SDK
+func streamBuildEventsSDK(ctx context.Context, client hypeman.Client, buildID string, opts []option.RequestOption) error {
+	stream := client.Builds.EventsStreaming(
+		ctx,
+		buildID,
+		hypeman.BuildEventsParams{
+			Follow: hypeman.Opt(true),
+		},
+		opts...,
+	)
+	defer stream.Close()
+
+	var finalStatus hypeman.BuildStatus
+	var buildError string
+
+	for stream.Next() {
+		event := stream.Current()
+
+		switch event.Type {
+		case hypeman.BuildEventTypeLog:
+			// Print log content
+			fmt.Println(event.Content)
+
+		case hypeman.BuildEventTypeStatus:
+			finalStatus = event.Status
+			switch event.Status {
+			case hypeman.BuildStatusQueued:
+				fmt.Fprintf(os.Stderr, "Build queued...\n")
+			case hypeman.BuildStatusBuilding:
+				fmt.Fprintf(os.Stderr, "Building...\n")
+			case hypeman.BuildStatusPushing:
+				fmt.Fprintf(os.Stderr, "Pushing image...\n")
+			case hypeman.BuildStatusReady:
+				fmt.Fprintf(os.Stderr, "Build complete!\n")
+				return nil
+			case hypeman.BuildStatusFailed:
+				buildError = "build failed"
+			case hypeman.BuildStatusCancelled:
+				return fmt.Errorf("build was cancelled")
+			}
+
+		case hypeman.BuildEventTypeHeartbeat:
+			// Ignore heartbeat events
+		}
+	}
+
+	if err := stream.Err(); err != nil {
+		return err
+	}
+
+	// Check final status
+	if finalStatus == hypeman.BuildStatusFailed {
+		return fmt.Errorf("%s", buildError)
+	}
+	if finalStatus == hypeman.BuildStatusReady {
+		return nil
+	}
+
+	return fmt.Errorf("build stream ended unexpectedly (status: %s)", finalStatus)
+}
+
+// createSourceTarball creates a gzipped tar archive of the build context
+func createSourceTarball(contextPath string) (*bytes.Buffer, error) {
+	buf := new(bytes.Buffer)
+	gzWriter := gzip.NewWriter(buf)
+	tarWriter := tar.NewWriter(gzWriter)
+
+	err := filepath.Walk(contextPath, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// Get relative path
+		relPath, err := filepath.Rel(contextPath, path)
+		if err != nil {
+			return err
+		}
+
+		// Skip root directory
+		if relPath == "." {
+			return nil
+		}
+
+		// Skip common build artifacts and version control
+		base := filepath.Base(path)
+		if base == ".git" || base == "node_modules" || base == "__pycache__" ||
+			base == ".venv" || base == "venv" || base == "target" ||
+			base == ".docker" || base == ".dockerignore" {
+			if info.IsDir() {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+
+		// Create tar header
+		header, err := tar.FileInfoHeader(info, "")
+		if err != nil {
+			return err
+		}
+
+		// Use forward slashes for tar paths
+		header.Name = filepath.ToSlash(relPath)
+
+		// Handle symlinks
+		if info.Mode()&os.ModeSymlink != 0 {
+			linkTarget, err := os.Readlink(path)
+			if err != nil {
+				return err
+			}
+			header.Linkname = linkTarget
+		}
+
+		if err := tarWriter.WriteHeader(header); err != nil {
+			return err
+		}
+
+		// Write file content for regular files
+		if info.Mode().IsRegular() {
+			file, err := os.Open(path)
+			if err != nil {
+				return err
+			}
+			defer file.Close()
+
+			if _, err := io.Copy(tarWriter, file); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	if err := tarWriter.Close(); err != nil {
+		return nil, err
+	}
+	if err := gzWriter.Close(); err != nil {
+		return nil, err
+	}
+
+	return buf, nil
+}
+
+var buildListCmd = cli.Command{
+	Name:  "list",
+	Usage: "List builds",
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:    "quiet",
+			Aliases: []string{"q"},
+			Usage:   "Only display build IDs",
+		},
+	},
+	Action:          handleBuildList,
+	HideHelpCommand: true,
+}
+
+var buildGetCmd = cli.Command{
+	Name:      "get",
+	Usage:     "Get build details",
+	ArgsUsage: "<id>",
+	Action:    handleBuildGet,
+	HideHelpCommand: true,
+}
+
+var buildCancelCmd = cli.Command{
+	Name:      "cancel",
+	Usage:     "Cancel a build",
+	ArgsUsage: "<id>",
+	Action:    handleBuildCancel,
+	HideHelpCommand: true,
+}
+
+func handleBuildList(ctx context.Context, cmd *cli.Command) error {
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	if format != "auto" {
+		var res []byte
+		opts = append(opts, option.WithResponseBodyInto(&res))
+		_, err := client.Builds.List(ctx, opts...)
+		if err != nil {
+			return err
+		}
+		obj := gjson.ParseBytes(res)
+		return ShowJSON(os.Stdout, "build list", obj, format, transform)
+	}
+
+	builds, err := client.Builds.List(ctx, opts...)
+	if err != nil {
+		return err
+	}
+
+	quietMode := cmd.Bool("quiet")
+
+	if quietMode {
+		for _, b := range *builds {
+			fmt.Println(b.ID)
+		}
+		return nil
+	}
+
+	if len(*builds) == 0 {
+		fmt.Fprintln(os.Stderr, "No builds found.")
+		return nil
+	}
+
+	table := NewTableWriter(os.Stdout, "ID", "STATUS", "IMAGE", "DURATION", "CREATED")
+	table.TruncOrder = []int{2, 0, 4} // IMAGE first, then ID, CREATED
+	for _, b := range *builds {
+		imageRef := b.ImageRef
+		if imageRef == "" {
+			imageRef = "-"
+		}
+
+		duration := "-"
+		if b.DurationMs > 0 {
+			secs := b.DurationMs / 1000
+			if secs < 60 {
+				duration = fmt.Sprintf("%ds", secs)
+			} else {
+				duration = fmt.Sprintf("%dm%ds", secs/60, secs%60)
+			}
+		}
+
+		table.AddRow(
+			TruncateID(b.ID),
+			string(b.Status),
+			imageRef,
+			duration,
+			FormatTimeAgo(b.CreatedAt),
+		)
+	}
+	table.Render()
+
+	return nil
+}
+
+func handleBuildGet(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("build ID required\nUsage: hypeman build get <id>")
+	}
+
+	id := args[0]
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	var res []byte
+	opts = append(opts, option.WithResponseBodyInto(&res))
+	_, err := client.Builds.Get(ctx, id, opts...)
+	if err != nil {
+		return err
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	obj := gjson.ParseBytes(res)
+	return ShowJSON(os.Stdout, "build get", obj, format, transform)
+}
+
+func handleBuildCancel(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("build ID required\nUsage: hypeman build cancel <id>")
+	}
+
+	id := args[0]
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	err := client.Builds.Cancel(ctx, id, opts...)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "Cancelled build %s\n", id)
+	return nil
+}
diff --git a/apps/cli/pkg/cmd/cmd.go b/apps/cli/pkg/cmd/cmd.go
new file mode 100644
index 00000000..e2614ca3
--- /dev/null
+++ b/apps/cli/pkg/cmd/cmd.go
@@ -0,0 +1,159 @@
+package cmd
+
+import (
+	"compress/gzip"
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	docs "github.com/urfave/cli-docs/v3"
+	"github.com/urfave/cli/v3"
+)
+
+var (
+	Command       *cli.Command
+	OutputFormats = []string{"auto", "explore", "json", "jsonl", "pretty", "raw", "yaml"}
+)
+
+func init() {
+	cli.VersionPrinter = func(cmd *cli.Command) {
+		fmt.Fprintf(os.Stdout, "Hypeman CLI version %s\n", cmd.Root().Version)
+	}
+	Command = &cli.Command{
+		Name:    "hypeman",
+		Usage:   "CLI for the hypeman API",
+		Version: Version,
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:  "debug",
+				Usage: "Enable debug logging",
+			},
+			&cli.StringFlag{
+				Name:        "base-url",
+				DefaultText: "url",
+				Usage:       "Override the base URL for API requests",
+			},
+			&cli.StringFlag{
+				Name:  "format",
+				Usage: "The format for displaying response data (one of: " + strings.Join(OutputFormats, ", ") + ")",
+				Value: "auto",
+				Validator: func(format string) error {
+					if !slices.Contains(OutputFormats, strings.ToLower(format)) {
+						return fmt.Errorf("format must be one of: %s", strings.Join(OutputFormats, ", "))
+					}
+					return nil
+				},
+			},
+			&cli.StringFlag{
+				Name:  "format-error",
+				Usage: "The format for displaying error data (one of: " + strings.Join(OutputFormats, ", ") + ")",
+				Value: "auto",
+				Validator: func(format string) error {
+					if !slices.Contains(OutputFormats, strings.ToLower(format)) {
+						return fmt.Errorf("format must be one of: %s", strings.Join(OutputFormats, ", "))
+					}
+					return nil
+				},
+			},
+			&cli.StringFlag{
+				Name:  "transform",
+				Usage: "The GJSON transformation for data output.",
+			},
+			&cli.StringFlag{
+				Name:  "transform-error",
+				Usage: "The GJSON transformation for errors.",
+			},
+		},
+	Commands: []*cli.Command{
+		&buildCmd,
+		&execCmd,
+		&cpCmd,
+		&pullCmd,
+		&pushCmd,
+		&runCmd,
+		&psCmd,
+		&logsCmd,
+		&rmCmd,
+		&stopCmd,
+		&startCmd,
+		&standbyCmd,
+		&restoreCmd,
+		&imageCmd,
+		&ingressCmd,
+		&volumeCmd,
+		&resourcesCmd,
+		&deviceCmd,
+		{
+				Name:            "@manpages",
+				Usage:           "Generate documentation for 'man'",
+				UsageText:       "hypeman @manpages [-o hypeman.1] [--gzip]",
+				Hidden:          true,
+				Action:          generateManpages,
+				HideHelpCommand: true,
+				Flags: []cli.Flag{
+					&cli.StringFlag{
+						Name:    "output",
+						Aliases: []string{"o"},
+						Usage:   "write manpages to the given folder",
+						Value:   "man",
+					},
+					&cli.BoolFlag{
+						Name:    "gzip",
+						Aliases: []string{"z"},
+						Usage:   "output gzipped manpage files to .gz",
+						Value:   true,
+					},
+					&cli.BoolFlag{
+						Name:    "text",
+						Aliases: []string{"z"},
+						Usage:   "output uncompressed text files",
+						Value:   false,
+					},
+				},
+			},
+		},
+		EnableShellCompletion:      true,
+		ShellCompletionCommandName: "@completion",
+		HideHelpCommand:            true,
+	}
+}
+
+func generateManpages(ctx context.Context, c *cli.Command) error {
+	manpage, err := docs.ToManWithSection(Command, 1)
+	if err != nil {
+		return err
+	}
+	dir := c.String("output")
+	err = os.MkdirAll(filepath.Join(dir, "man1"), 0755)
+	if err != nil {
+		// handle error
+	}
+	if c.Bool("text") {
+		file, err := os.Create(filepath.Join(dir, "man1", "hypeman.1"))
+		if err != nil {
+			return err
+		}
+		defer file.Close()
+		if _, err := file.WriteString(manpage); err != nil {
+			return err
+		}
+	}
+	if c.Bool("gzip") {
+		file, err := os.Create(filepath.Join(dir, "man1", "hypeman.1.gz"))
+		if err != nil {
+			return err
+		}
+		defer file.Close()
+		gzWriter := gzip.NewWriter(file)
+		defer gzWriter.Close()
+		_, err = gzWriter.Write([]byte(manpage))
+		if err != nil {
+			return err
+		}
+	}
+	fmt.Printf("Wrote manpages to %s\n", dir)
+	return nil
+}
diff --git a/apps/cli/pkg/cmd/cmdutil.go b/apps/cli/pkg/cmd/cmdutil.go
new file mode 100644
index 00000000..e50b2e0f
--- /dev/null
+++ b/apps/cli/pkg/cmd/cmdutil.go
@@ -0,0 +1,228 @@
+package cmd
+
+import (
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"net/http/httputil"
+	"os"
+	"os/exec"
+	"os/signal"
+	"strings"
+	"syscall"
+
+	"github.com/kernel/hypeman-cli/pkg/jsonview"
+	"github.com/kernel/hypeman-go/option"
+
+	"github.com/itchyny/json2yaml"
+	"github.com/tidwall/gjson"
+	"github.com/tidwall/pretty"
+	"github.com/urfave/cli/v3"
+	"golang.org/x/term"
+)
+
+func getDefaultRequestOptions(cmd *cli.Command) []option.RequestOption {
+	opts := []option.RequestOption{
+		option.WithHeader("User-Agent", fmt.Sprintf("Hypeman/CLI %s", Version)),
+	}
+
+	if baseURL := resolveBaseURL(cmd); baseURL != "" {
+		opts = append(opts, option.WithBaseURL(baseURL))
+	}
+
+	if apiKey := resolveAPIKey(); apiKey != "" {
+		opts = append(opts, option.WithAPIKey(apiKey))
+	}
+
+	return opts
+}
+
+var debugMiddlewareOption = option.WithMiddleware(
+	func(r *http.Request, mn option.MiddlewareNext) (*http.Response, error) {
+		logger := log.Default()
+
+		if reqBytes, err := httputil.DumpRequest(r, true); err == nil {
+			logger.Printf("Request Content:\n%s\n", reqBytes)
+		}
+
+		resp, err := mn(r)
+		if err != nil {
+			return resp, err
+		}
+
+		if respBytes, err := httputil.DumpResponse(resp, true); err == nil {
+			logger.Printf("Response Content:\n%s\n", respBytes)
+		}
+
+		return resp, err
+	},
+)
+
+func isInputPiped() bool {
+	stat, _ := os.Stdin.Stat()
+	return (stat.Mode() & os.ModeCharDevice) == 0
+}
+
+func isTerminal(w io.Writer) bool {
+	switch v := w.(type) {
+	case *os.File:
+		return term.IsTerminal(int(v.Fd()))
+	default:
+		return false
+	}
+}
+
+func streamOutput(label string, generateOutput func(w *os.File) error) error {
+	// For non-tty output (probably a pipe), write directly to stdout
+	if !isTerminal(os.Stdout) {
+		return streamToStdout(generateOutput)
+	}
+
+	pagerInput, outputFile, isSocketPair, err := createPagerFiles()
+	if err != nil {
+		return err
+	}
+	defer pagerInput.Close()
+	defer outputFile.Close()
+
+	cmd, err := startPagerCommand(pagerInput, label, isSocketPair)
+	if err != nil {
+		return err
+	}
+
+	if err := pagerInput.Close(); err != nil {
+		return err
+	}
+
+	// If the pager exits before reading all input, then generateOutput() will
+	// produce a broken pipe error, which is fine and we don't want to propagate it.
+	if err := generateOutput(outputFile); err != nil && !strings.Contains(err.Error(), "broken pipe") {
+		return err
+	}
+
+	return cmd.Wait()
+}
+
+func streamToStdout(generateOutput func(w *os.File) error) error {
+	signal.Ignore(syscall.SIGPIPE)
+	err := generateOutput(os.Stdout)
+	if err != nil && strings.Contains(err.Error(), "broken pipe") {
+		return nil
+	}
+	return err
+}
+
+func createPagerFiles() (*os.File, *os.File, bool, error) {
+	// We prefer sockets when available because they allow for smaller buffer
+	// sizes, preventing unnecessary data streaming from the backend. Pipes
+	// typically have large buffers but serve as a decent alternative when
+	// sockets aren't available (e.g., on Windows).
+	pagerInput, outputFile, isSocketPair, err := createSocketPair()
+	if err == nil {
+		return pagerInput, outputFile, isSocketPair, nil
+	}
+
+	r, w, err := os.Pipe()
+	return r, w, false, err
+}
+
+// Start a subprocess running the user's preferred pager (or `less` if `$PAGER` is unset)
+func startPagerCommand(pagerInput *os.File, label string, useSocketpair bool) (*exec.Cmd, error) {
+	pagerProgram := os.Getenv("PAGER")
+	if pagerProgram == "" {
+		pagerProgram = "less"
+	}
+
+	if shouldUseColors(os.Stdout) {
+		os.Setenv("FORCE_COLOR", "1")
+	}
+
+	var cmd *exec.Cmd
+	if useSocketpair {
+		cmd = exec.Command(pagerProgram, fmt.Sprintf("/dev/fd/%d", pagerInput.Fd()))
+		cmd.ExtraFiles = []*os.File{pagerInput}
+	} else {
+		cmd = exec.Command(pagerProgram)
+		cmd.Stdin = pagerInput
+	}
+
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	cmd.Env = append(os.Environ(),
+		"LESS=-r -f -P "+label,
+		"MORE=-r -f -P "+label,
+	)
+
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+
+	return cmd, nil
+}
+
+func shouldUseColors(w io.Writer) bool {
+	force, ok := os.LookupEnv("FORCE_COLOR")
+	if ok {
+		if force == "1" {
+			return true
+		}
+		if force == "0" {
+			return false
+		}
+	}
+	return isTerminal(w)
+}
+
+func ShowJSON(out *os.File, title string, res gjson.Result, format string, transform string) error {
+	if format != "raw" && transform != "" {
+		transformed := res.Get(transform)
+		if transformed.Exists() {
+			res = transformed
+		}
+	}
+	switch strings.ToLower(format) {
+	case "auto":
+		return ShowJSON(out, title, res, "json", "")
+	case "explore":
+		return jsonview.ExploreJSON(title, res)
+	case "pretty":
+		_, err := out.WriteString(jsonview.RenderJSON(title, res) + "\n")
+		return err
+	case "json":
+		prettyJSON := pretty.Pretty([]byte(res.Raw))
+		if shouldUseColors(out) {
+			_, err := out.Write(pretty.Color(prettyJSON, pretty.TerminalStyle))
+			return err
+		} else {
+			_, err := out.Write(prettyJSON)
+			return err
+		}
+	case "jsonl":
+		// @ugly is gjson syntax for "no whitespace", so it fits on one line
+		oneLineJSON := res.Get("@ugly").Raw
+		if shouldUseColors(out) {
+			bytes := append(pretty.Color([]byte(oneLineJSON), pretty.TerminalStyle), '\n')
+			_, err := out.Write(bytes)
+			return err
+		} else {
+			_, err := out.Write([]byte(oneLineJSON + "\n"))
+			return err
+		}
+	case "raw":
+		if _, err := out.Write([]byte(res.Raw + "\n")); err != nil {
+			return err
+		}
+		return nil
+	case "yaml":
+		input := strings.NewReader(res.Raw)
+		var yaml strings.Builder
+		if err := json2yaml.Convert(&yaml, input); err != nil {
+			return err
+		}
+		_, err := out.Write([]byte(yaml.String()))
+		return err
+	default:
+		return fmt.Errorf("Invalid format: %s, valid formats are: %s", format, strings.Join(OutputFormats, ", "))
+	}
+}
diff --git a/apps/cli/pkg/cmd/cmdutil_test.go b/apps/cli/pkg/cmd/cmdutil_test.go
new file mode 100644
index 00000000..027f3d46
--- /dev/null
+++ b/apps/cli/pkg/cmd/cmdutil_test.go
@@ -0,0 +1,17 @@
+package cmd
+
+import (
+	"os"
+	"testing"
+)
+
+func TestStreamOutput(t *testing.T) {
+	t.Setenv("PAGER", "cat")
+	err := streamOutput("stream test", func(w *os.File) error {
+		_, writeErr := w.WriteString("Hello world\n")
+		return writeErr
+	})
+	if err != nil {
+		t.Errorf("streamOutput failed: %v", err)
+	}
+}
diff --git a/apps/cli/pkg/cmd/cmdutil_unix.go b/apps/cli/pkg/cmd/cmdutil_unix.go
new file mode 100644
index 00000000..6883c525
--- /dev/null
+++ b/apps/cli/pkg/cmd/cmdutil_unix.go
@@ -0,0 +1,33 @@
+//go:build !windows
+
+package cmd
+
+import (
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+// In order to avoid large buffers on pipes, this function create a pair of
+// files for reading and writing through a barely buffered socket.
+func createSocketPair() (*os.File, *os.File, bool, error) {
+	fds, err := unix.Socketpair(unix.AF_UNIX, unix.SOCK_STREAM, 0)
+	if err != nil {
+		return nil, nil, false, err
+	}
+
+	parentSock, childSock := fds[0], fds[1]
+
+	// Use small buffer sizes so we don't ask the server for more paginated
+	// values than we actually need.
+	if err := unix.SetsockoptInt(parentSock, unix.SOL_SOCKET, unix.SO_SNDBUF, 128); err != nil {
+		return nil, nil, false, err
+	}
+	if err := unix.SetsockoptInt(childSock, unix.SOL_SOCKET, unix.SO_RCVBUF, 128); err != nil {
+		return nil, nil, false, err
+	}
+
+	pagerInput := os.NewFile(uintptr(childSock), "child_socket")
+	outputFile := os.NewFile(uintptr(parentSock), "parent_socket")
+	return pagerInput, outputFile, true, nil
+}
diff --git a/apps/cli/pkg/cmd/cmdutil_windows.go b/apps/cli/pkg/cmd/cmdutil_windows.go
new file mode 100644
index 00000000..48a27b02
--- /dev/null
+++ b/apps/cli/pkg/cmd/cmdutil_windows.go
@@ -0,0 +1,14 @@
+//go:build windows
+
+package cmd
+
+import (
+	"errors"
+	"os"
+)
+
+// createSocketPair is not supported on Windows, so we return an error
+// which causes createPagerFiles to fall back to using pipes.
+func createSocketPair() (*os.File, *os.File, bool, error) {
+	return nil, nil, false, errors.New("socket pairs not supported on Windows")
+}
diff --git a/apps/cli/pkg/cmd/config.go b/apps/cli/pkg/cmd/config.go
new file mode 100644
index 00000000..2cd4146c
--- /dev/null
+++ b/apps/cli/pkg/cmd/config.go
@@ -0,0 +1,74 @@
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/knadh/koanf/parsers/yaml"
+	"github.com/knadh/koanf/providers/env"
+	"github.com/knadh/koanf/providers/file"
+	"github.com/knadh/koanf/v2"
+	"github.com/urfave/cli/v3"
+)
+
+// CLIConfig holds CLI configuration loaded from cli.yaml
+type CLIConfig struct {
+	BaseURL string `koanf:"base_url"`
+	APIKey  string `koanf:"api_key"`
+}
+
+// getCLIConfigPath returns the path to the CLI config file.
+// The CLI uses ~/.config/hypeman/cli.yaml on all platforms.
+func getCLIConfigPath() string {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return ""
+	}
+	return filepath.Join(home, ".config", "hypeman", "cli.yaml")
+}
+
+// loadCLIConfig loads CLI configuration from the config file, then
+// overlays HYPEMAN_-prefixed environment variables (highest precedence).
+// HYPEMAN_BASE_URL -> base_url, HYPEMAN_API_KEY -> api_key.
+// Returns an empty config if the file doesn't exist or can't be parsed.
+func loadCLIConfig() *CLIConfig {
+	cfg := &CLIConfig{}
+	k := koanf.New(".")
+
+	configPath := getCLIConfigPath()
+	if configPath != "" {
+		_ = k.Load(file.Provider(configPath), yaml.Parser())
+	}
+
+	// Overlay HYPEMAN_-prefixed env vars: HYPEMAN_BASE_URL -> base_url
+	_ = k.Load(env.ProviderWithValue("HYPEMAN_", ".", func(key string, value string) (string, interface{}) {
+		if value == "" {
+			return "", nil
+		}
+		return strings.ToLower(strings.TrimPrefix(key, "HYPEMAN_")), value
+	}), nil)
+
+	_ = k.Unmarshal("", cfg)
+	return cfg
+}
+
+// resolveBaseURL returns the effective base URL with precedence:
+// CLI flag > HYPEMAN_BASE_URL env > config file > default.
+func resolveBaseURL(cmd *cli.Command) string {
+	if u := cmd.Root().String("base-url"); u != "" {
+		return u
+	}
+	cfg := loadCLIConfig()
+	if cfg.BaseURL != "" {
+		return cfg.BaseURL
+	}
+	return "http://localhost:8080"
+}
+
+// resolveAPIKey returns the effective API key with precedence:
+// HYPEMAN_API_KEY env > config file.
+func resolveAPIKey() string {
+	cfg := loadCLIConfig()
+	return cfg.APIKey
+}
diff --git a/apps/cli/pkg/cmd/cp.go b/apps/cli/pkg/cmd/cp.go
new file mode 100644
index 00000000..43a653b0
--- /dev/null
+++ b/apps/cli/pkg/cmd/cp.go
@@ -0,0 +1,984 @@
+package cmd
+
+import (
+	"archive/tar"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/gorilla/websocket"
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/lib"
+	"github.com/urfave/cli/v3"
+)
+
+// cpRequest represents the JSON body for cp requests
+type cpRequest struct {
+	Direction   string `json:"direction"`
+	GuestPath   string `json:"guest_path"`
+	IsDir       bool   `json:"is_dir,omitempty"`
+	Mode        uint32 `json:"mode,omitempty"`
+	FollowLinks bool   `json:"follow_links,omitempty"`
+	Uid         uint32 `json:"uid"`
+	Gid         uint32 `json:"gid"`
+}
+
+// cpFileHeader is received from the server when copying from guest
+type cpFileHeader struct {
+	Type       string `json:"type"`
+	Path       string `json:"path"`
+	Mode       uint32 `json:"mode"`
+	IsDir      bool   `json:"is_dir"`
+	IsSymlink  bool   `json:"is_symlink"`
+	LinkTarget string `json:"link_target"`
+	Size       int64  `json:"size"`
+	Mtime      int64  `json:"mtime"`
+	Uid        uint32 `json:"uid,omitempty"`
+	Gid        uint32 `json:"gid,omitempty"`
+}
+
+// cpEndMarker signals end of file or transfer
+type cpEndMarker struct {
+	Type  string `json:"type"`
+	Final bool   `json:"final"`
+}
+
+// cpResult is the response from a copy-to operation
+type cpResult struct {
+	Type         string `json:"type"`
+	Success      bool   `json:"success"`
+	Error        string `json:"error,omitempty"`
+	BytesWritten int64  `json:"bytes_written,omitempty"`
+}
+
+// cpError is an error message from the server
+type cpError struct {
+	Type    string `json:"type"`
+	Message string `json:"message"`
+	Path    string `json:"path,omitempty"`
+}
+
+var cpCmd = cli.Command{
+	Name:      "cp",
+	Usage:     "Copy files/folders between an instance and the local filesystem",
+	ArgsUsage: "<src> <dst>",
+	Description: `Copy files between the local filesystem and an instance.
+
+The path format is:
+  - Local path: /path/to/file or ./relative/path
+  - Instance path: <instance>:/path/in/instance
+
+Examples:
+  # Copy file to instance
+  hypeman cp ./local-file.txt myinstance:/app/file.txt
+
+  # Copy file from instance
+  hypeman cp myinstance:/app/output.txt ./local-output.txt
+
+  # Copy directory to instance
+  hypeman cp ./local-dir myinstance:/app/dir
+
+  # Copy directory from instance
+  hypeman cp myinstance:/app/dir ./local-dir`,
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:    "archive",
+			Aliases: []string{"a"},
+			Usage:   "Archive mode (copy all uid/gid information)",
+		},
+		&cli.BoolFlag{
+			Name:    "follow-links",
+			Aliases: []string{"L"},
+			Usage:   "Always follow symbolic links in source",
+		},
+		&cli.BoolFlag{
+			Name:    "quiet",
+			Aliases: []string{"q"},
+			Usage:   "Suppress progress output during copy",
+		},
+	},
+	Action:          handleCp,
+	HideHelpCommand: true,
+}
+
+func handleCp(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) != 2 {
+		return fmt.Errorf("exactly 2 arguments required: source and destination\nUsage: hypeman cp <src> <dst>")
+	}
+
+	srcArg := args[0]
+	dstArg := args[1]
+
+	// Parse source and destination
+	srcInstance, srcPath, srcIsRemote := parseCpPath(srcArg)
+	dstInstance, dstPath, dstIsRemote := parseCpPath(dstArg)
+
+	// Validate: one must be local, one must be remote
+	if srcIsRemote && dstIsRemote {
+		return fmt.Errorf("cannot copy between two instances; one path must be local")
+	}
+	if !srcIsRemote && !dstIsRemote {
+		return fmt.Errorf("at least one path must reference an instance (use instance:/path format)")
+	}
+
+	// Get client and resolve instance
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var instanceID string
+	var err error
+	if srcIsRemote {
+		instanceID, err = ResolveInstance(ctx, &client, srcInstance)
+	} else {
+		instanceID, err = ResolveInstance(ctx, &client, dstInstance)
+	}
+	if err != nil {
+		return err
+	}
+
+	// Get base URL and API key (flag > env > config file)
+	baseURL := resolveBaseURL(cmd)
+
+	apiKey := resolveAPIKey()
+	if apiKey == "" {
+		return fmt.Errorf("API key required: set HYPEMAN_API_KEY or configure api_key in ~/.config/hypeman/cli.yaml")
+	}
+
+	archive := cmd.Bool("archive")
+	followLinks := cmd.Bool("follow-links")
+	quiet := cmd.Bool("quiet")
+
+	if srcIsRemote {
+		// Copy from instance to local (or stdout if dstPath is "-")
+		if dstPath == "-" {
+			return copyFromInstanceToStdout(ctx, baseURL, apiKey, instanceID, srcPath, followLinks, archive)
+		}
+		return copyFromInstance(ctx, &client, baseURL, apiKey, instanceID, srcPath, dstPath, followLinks, quiet, archive)
+	} else {
+		// Copy from local (or stdin if srcPath is "-") to instance
+		if srcPath == "-" {
+			return copyFromStdinToInstance(ctx, baseURL, apiKey, instanceID, dstPath, archive)
+		}
+		return copyToInstance(ctx, &client, baseURL, apiKey, instanceID, srcPath, dstPath, quiet, archive, followLinks)
+	}
+}
+
+// parseCpPath parses a path like "instance:/path" or "/local/path"
+// Following docker cp conventions:
+// - Paths starting with / or ./ or ../ or ~ are always local paths
+// - If a path contains a colon, it's treated as instance:path UNLESS it's an explicit local path
+// - For ambiguous cases (file:name.txt), use explicit paths like ./file:name.txt
+func parseCpPath(path string) (instance, containerPath string, isRemote bool) {
+	// Explicit local paths: absolute path, relative path with ./  or ../, or home directory
+	if strings.HasPrefix(path, "/") ||
+		strings.HasPrefix(path, "./") ||
+		strings.HasPrefix(path, "../") ||
+		strings.HasPrefix(path, "~") ||
+		path == "." ||
+		path == ".." {
+		containerPath = path
+		return
+	}
+
+	// Check for Windows drive path (e.g., C:\...)
+	if isWindowsPath(path) {
+		containerPath = path
+		return
+	}
+
+	// Check for colon separator (instance:path format)
+	colonIdx := strings.Index(path, ":")
+	if colonIdx > 0 {
+		potentialInstance := path[:colonIdx]
+
+		// If the part before colon contains path separators, it's a local path with colon in name
+		// This helps with edge cases like "some/path:with:colons"
+		if strings.ContainsAny(potentialInstance, "/\\") {
+			containerPath = path
+			return
+		}
+
+		// It's a remote path: instance:path
+		instance = potentialInstance
+		containerPath = path[colonIdx+1:]
+		isRemote = true
+		return
+	}
+
+	// No colon found - local path
+	containerPath = path
+	return
+}
+
+// isWindowsPath checks if path looks like a Windows drive path (e.g., C:\...)
+func isWindowsPath(path string) bool {
+	if len(path) >= 2 && path[1] == ':' {
+		c := path[0]
+		return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')
+	}
+	return false
+}
+
+// sanitizeTarPath validates and sanitizes a tar entry path to prevent path traversal attacks.
+// Returns the sanitized target path or an error if the path is malicious.
+// Uses path package (not filepath) because tar paths and guest paths use forward slashes.
+func sanitizeTarPath(basePath, entryName string) (string, error) {
+	// Clean the entry name using path.Clean (forward slashes for guest/tar paths)
+	clean := path.Clean(entryName)
+
+	// Reject absolute paths (Linux paths start with /)
+	if strings.HasPrefix(clean, "/") {
+		return "", fmt.Errorf("invalid tar entry: absolute path not allowed: %s", entryName)
+	}
+
+	// Reject paths that start with .. (escaping destination)
+	if strings.HasPrefix(clean, "..") {
+		return "", fmt.Errorf("invalid tar entry: path escapes destination: %s", entryName)
+	}
+
+	// Join with base path using path.Join (forward slashes for guest paths)
+	targetPath := path.Join(basePath, clean)
+
+	// Verify the result is under the base path
+	// path.Clean removes trailing slashes, so compare cleaned versions
+	cleanBase := path.Clean(basePath)
+	// Special case: if basePath is "/" (root), any absolute path under it is valid
+	if cleanBase == "/" {
+		// For root destination, just ensure the target is an absolute path (which path.Join guarantees)
+		if !strings.HasPrefix(targetPath, "/") {
+			return "", fmt.Errorf("invalid tar entry: path escapes destination: %s", entryName)
+		}
+	} else if !strings.HasPrefix(targetPath, cleanBase+"/") && targetPath != cleanBase {
+		return "", fmt.Errorf("invalid tar entry: path escapes destination: %s", entryName)
+	}
+
+	return targetPath, nil
+}
+
+// statGuestPath queries the guest for information about a path using the SDK's Stat endpoint
+func statGuestPath(ctx context.Context, client *hypeman.Client, instanceID, guestPath string, followLinks bool) (*hypeman.PathInfo, error) {
+	params := hypeman.InstanceStatParams{
+		Path: guestPath,
+	}
+	if followLinks {
+		params.FollowLinks = hypeman.Bool(true)
+	}
+
+	pathInfo, err := client.Instances.Stat(ctx, instanceID, params)
+	if err != nil {
+		return nil, fmt.Errorf("stat path: %w", err)
+	}
+
+	// Check for stat errors (e.g., permission denied)
+	if pathInfo.Error != "" {
+		return nil, fmt.Errorf("stat path %s: %s", guestPath, pathInfo.Error)
+	}
+
+	return pathInfo, nil
+}
+
+// resolveDestPath resolves the destination path following docker cp semantics
+// srcPath is the local source path, dstPath is the guest destination path
+// Returns the resolved guest path
+func resolveDestPath(ctx context.Context, client *hypeman.Client, instanceID, srcPath, dstPath string) (string, error) {
+	srcInfo, err := os.Stat(srcPath)
+	if err != nil {
+		return "", fmt.Errorf("cannot stat source: %w", err)
+	}
+
+	// Check if dstPath ends with /. (copy contents only)
+	// Handle both OS-specific separator and forward slash for cross-platform compatibility
+	copyContentsOnly := strings.HasSuffix(srcPath, string(filepath.Separator)+".") ||
+		strings.HasSuffix(srcPath, "/.")
+	if copyContentsOnly {
+		srcPath = strings.TrimSuffix(srcPath, string(filepath.Separator)+".")
+		srcPath = strings.TrimSuffix(srcPath, "/.")
+	}
+
+	// Check if destination ends with /
+	dstEndsWithSlash := strings.HasSuffix(dstPath, "/")
+
+	// Stat the destination in guest
+	dstStat, err := statGuestPath(ctx, client, instanceID, dstPath, true)
+	if err != nil {
+		return "", fmt.Errorf("stat destination: %w", err)
+	}
+
+	// Use bool fields directly from PathInfo
+	isDir := dstStat.IsDir
+	isFile := dstStat.IsFile
+
+	// Docker cp path resolution rules:
+	// 1. If SRC is a file:
+	//    - DEST doesn't exist: save as DEST
+	//    - DEST doesn't exist and ends with /: error
+	//    - DEST exists and is a file: overwrite
+	//    - DEST exists and is a dir: copy into dir using basename
+	// 2. If SRC is a directory:
+	//    - DEST doesn't exist: create DEST dir
+	//    - DEST exists and is a file: error
+	//    - DEST exists and is a dir:
+	//      - SRC ends with /.: copy contents into DEST
+	//      - SRC doesn't end with /.: copy SRC dir into DEST
+
+	if !srcInfo.IsDir() {
+		// Source is a file
+		if !dstStat.Exists {
+			if dstEndsWithSlash {
+				return "", fmt.Errorf("destination directory %s does not exist", dstPath)
+			}
+			// Save as DEST
+			return dstPath, nil
+		}
+		if isDir {
+			// Copy into directory using basename
+			// Use path.Join for guest paths (always forward slashes)
+			return path.Join(dstPath, filepath.Base(srcPath)), nil
+		}
+		// Overwrite file
+		return dstPath, nil
+	}
+
+	// Source is a directory
+	if dstStat.Exists && isFile {
+		return "", fmt.Errorf("cannot copy a directory to a file")
+	}
+
+	if !dstStat.Exists {
+		// DEST will be created
+		return dstPath, nil
+	}
+
+	// DEST exists and is a directory
+	if copyContentsOnly {
+		// Copy contents into DEST
+		return dstPath, nil
+	}
+
+	// Copy SRC dir into DEST (create subdir)
+	// Use path.Join for guest paths (always forward slashes)
+	return path.Join(dstPath, filepath.Base(srcPath)), nil
+}
+
+// buildCpWsURL builds the WebSocket URL for the cp endpoint
+func buildCpWsURL(baseURL, instanceID string) (string, error) {
+	u, err := url.Parse(baseURL)
+	if err != nil {
+		return "", fmt.Errorf("invalid base URL: %w", err)
+	}
+	u.Path = fmt.Sprintf("/instances/%s/cp", instanceID)
+
+	switch u.Scheme {
+	case "https":
+		u.Scheme = "wss"
+	case "http":
+		u.Scheme = "ws"
+	}
+
+	return u.String(), nil
+}
+
+// copyToInstance copies a local file/directory to the instance
+func copyToInstance(ctx context.Context, client *hypeman.Client, baseURL, apiKey, instanceID, srcPath, dstPath string, quiet, archive, followLinks bool) error {
+	// Check for /. suffix (copy contents only)
+	copyContentsOnly := strings.HasSuffix(srcPath, string(filepath.Separator)+".") || strings.HasSuffix(srcPath, "/.")
+	originalSrcPath := srcPath
+	if copyContentsOnly {
+		srcPath = strings.TrimSuffix(srcPath, string(filepath.Separator)+".")
+		srcPath = strings.TrimSuffix(srcPath, "/.")
+	}
+
+	// Stat the source
+	srcInfo, err := os.Stat(srcPath)
+	if err != nil {
+		return fmt.Errorf("cannot stat source: %w", err)
+	}
+
+	// Resolve destination path using docker cp semantics
+	resolvedDst, err := resolveDestPath(ctx, client, instanceID, originalSrcPath, dstPath)
+	if err != nil {
+		return err
+	}
+
+	if srcInfo.IsDir() {
+		if copyContentsOnly {
+			// Copy contents of srcPath into resolvedDst
+			return copyDirContentsToInstance(ctx, baseURL, apiKey, instanceID, srcPath, resolvedDst, quiet, archive, followLinks)
+		}
+		return copyDirToInstance(ctx, baseURL, apiKey, instanceID, srcPath, resolvedDst, quiet, archive, followLinks)
+	}
+	return copyFileToInstance(ctx, baseURL, apiKey, instanceID, srcPath, resolvedDst, srcInfo.Mode().Perm(), quiet, archive, followLinks)
+}
+
+// copyFileToInstance copies a single file to the instance using the SDK
+func copyFileToInstance(ctx context.Context, baseURL, apiKey, instanceID, srcPath, dstPath string, mode fs.FileMode, quiet, archive, followLinks bool) error {
+	srcInfo, err := os.Stat(srcPath)
+	if err != nil {
+		return fmt.Errorf("stat source: %w", err)
+	}
+
+	cfg := lib.CpConfig{
+		BaseURL: baseURL,
+		APIKey:  apiKey,
+	}
+
+	var callbacks *lib.CpCallbacks
+	if !quiet {
+		callbacks = &lib.CpCallbacks{
+			OnFileEnd: func(path string) {
+				fmt.Printf("Copied %s -> %s (%d bytes)\n", srcPath, dstPath, srcInfo.Size())
+			},
+		}
+	}
+
+	err = lib.CpToInstance(ctx, cfg, lib.CpToInstanceOptions{
+		InstanceID:  instanceID,
+		SrcPath:     srcPath,
+		DstPath:     dstPath,
+		Mode:        mode,
+		Archive:     archive,
+		FollowLinks: followLinks,
+		Callbacks:   callbacks,
+	})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// copyDirToInstance copies a directory recursively to the instance using the SDK
+func copyDirToInstance(ctx context.Context, baseURL, apiKey, instanceID, srcPath, dstPath string, quiet, archive, followLinks bool) error {
+	cfg := lib.CpConfig{
+		BaseURL: baseURL,
+		APIKey:  apiKey,
+	}
+
+	var callbacks *lib.CpCallbacks
+	if !quiet {
+		callbacks = &lib.CpCallbacks{
+			OnFileEnd: func(path string) {
+				fmt.Printf("Copied %s\n", path)
+			},
+		}
+	}
+
+	// First create the destination directory
+	err := lib.CpToInstance(ctx, cfg, lib.CpToInstanceOptions{
+		InstanceID:  instanceID,
+		SrcPath:     srcPath,
+		DstPath:     dstPath,
+		Archive:     archive,
+		FollowLinks: followLinks,
+		Callbacks:   callbacks,
+	})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// copyDirContentsToInstance copies only the contents of a directory (not the directory itself)
+// This implements the /. suffix behavior from docker cp
+func copyDirContentsToInstance(ctx context.Context, baseURL, apiKey, instanceID, srcPath, dstPath string, quiet, archive, followLinks bool) error {
+	entries, err := os.ReadDir(srcPath)
+	if err != nil {
+		return fmt.Errorf("read directory: %w", err)
+	}
+
+	cfg := lib.CpConfig{
+		BaseURL: baseURL,
+		APIKey:  apiKey,
+	}
+
+	var callbacks *lib.CpCallbacks
+	if !quiet {
+		callbacks = &lib.CpCallbacks{
+			OnFileEnd: func(path string) {
+				fmt.Printf("Copied %s\n", path)
+			},
+		}
+	}
+
+	for _, entry := range entries {
+		srcEntryPath := filepath.Join(srcPath, entry.Name())
+		// Use path.Join for guest paths (always forward slashes)
+		dstEntryPath := path.Join(dstPath, entry.Name())
+
+		info, err := entry.Info()
+		if err != nil {
+			return fmt.Errorf("info: %w", err)
+		}
+
+		if err := lib.CpToInstance(ctx, cfg, lib.CpToInstanceOptions{
+			InstanceID:  instanceID,
+			SrcPath:     srcEntryPath,
+			DstPath:     dstEntryPath,
+			Mode:        info.Mode().Perm(),
+			Archive:     archive,
+			FollowLinks: followLinks,
+			Callbacks:   callbacks,
+		}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+
+// createDirOnInstanceWithUidGid creates a directory on the instance with explicit uid/gid
+func createDirOnInstanceWithUidGid(ctx context.Context, baseURL, apiKey, instanceID, dstPath string, mode fs.FileMode, uid, gid uint32) error {
+	wsURL, err := buildCpWsURL(baseURL, instanceID)
+	if err != nil {
+		return err
+	}
+
+	headers := http.Header{}
+	headers.Set("Authorization", fmt.Sprintf("Bearer %s", apiKey))
+
+	dialer := &websocket.Dialer{}
+	ws, resp, err := dialer.DialContext(ctx, wsURL, headers)
+	if err != nil {
+		if resp != nil {
+			defer resp.Body.Close()
+			body, _ := io.ReadAll(resp.Body)
+			return fmt.Errorf("websocket connect failed (HTTP %d): %s", resp.StatusCode, string(body))
+		}
+		return fmt.Errorf("websocket connect failed: %w", err)
+	}
+	defer ws.Close()
+
+	req := cpRequest{
+		Direction: "to",
+		GuestPath: dstPath,
+		IsDir:     true,
+		Mode:      uint32(mode),
+		Uid:       uid,
+		Gid:       gid,
+	}
+	reqJSON, _ := json.Marshal(req)
+	if err := ws.WriteMessage(websocket.TextMessage, reqJSON); err != nil {
+		return fmt.Errorf("send request: %w", err)
+	}
+
+	// Send end marker
+	endMsg, _ := json.Marshal(map[string]string{"type": "end"})
+	if err := ws.WriteMessage(websocket.TextMessage, endMsg); err != nil {
+		return fmt.Errorf("send end: %w", err)
+	}
+
+	// Wait for result
+	_, message, err := ws.ReadMessage()
+	if err != nil {
+		return fmt.Errorf("read result: %w", err)
+	}
+
+	var result cpResult
+	if err := json.Unmarshal(message, &result); err != nil {
+		return fmt.Errorf("parse result: %w", err)
+	}
+
+	if !result.Success {
+		return fmt.Errorf("create directory failed: %s", result.Error)
+	}
+
+	return nil
+}
+
+// copyFromInstance copies a file/directory from the instance to local using the SDK
+func copyFromInstance(ctx context.Context, client *hypeman.Client, baseURL, apiKey, instanceID, srcPath, dstPath string, followLinks, quiet, archive bool) error {
+	// Check for /. suffix (copy contents only) on guest source path
+	copyContentsOnly := strings.HasSuffix(srcPath, "/.")
+	if copyContentsOnly {
+		srcPath = strings.TrimSuffix(srcPath, "/.")
+	}
+
+	// Check if destination ends with /
+	dstEndsWithSlash := strings.HasSuffix(dstPath, "/") || strings.HasSuffix(dstPath, string(filepath.Separator))
+
+	// Stat the guest source to check if it's file or directory
+	srcStat, err := statGuestPath(ctx, client, instanceID, srcPath, followLinks)
+	if err != nil {
+		return fmt.Errorf("stat source: %w", err)
+	}
+	if !srcStat.Exists {
+		return fmt.Errorf("source path %s does not exist in guest", srcPath)
+	}
+
+	// Use bool field directly from PathInfo
+	srcIsDir := srcStat.IsDir
+
+	// Stat the local destination
+	dstInfo, dstErr := os.Stat(dstPath)
+	dstExists := dstErr == nil
+	dstIsDir := dstExists && dstInfo.IsDir()
+
+	// Apply docker cp path resolution for "from" direction
+	resolvedDst := dstPath
+	if !srcIsDir {
+		// Source is a file
+		if !dstExists {
+			if dstEndsWithSlash {
+				return fmt.Errorf("destination directory %s does not exist", dstPath)
+			}
+			// Will create file at dstPath
+		} else if dstIsDir {
+			// Copy into directory using basename
+			// Use path.Base for guest srcPath (always forward slashes)
+			resolvedDst = filepath.Join(dstPath, path.Base(srcPath))
+		}
+		// else: overwrite existing file
+	} else {
+		// Source is a directory
+		if dstExists && !dstIsDir {
+			return fmt.Errorf("cannot copy a directory to a file")
+		}
+		if !dstExists {
+			// Create destination directory - will be created by SDK
+		} else if !copyContentsOnly {
+			// Copy SRC dir into DST - create source directory inside destination
+			// Use path.Base for guest srcPath (always forward slashes)
+			resolvedDst = filepath.Join(dstPath, path.Base(srcPath))
+		}
+		// else: copyContentsOnly=true - contents go directly into dstPath
+	}
+	dstPath = resolvedDst
+
+	cfg := lib.CpConfig{
+		BaseURL: baseURL,
+		APIKey:  apiKey,
+	}
+
+	var fileCount int
+	var totalBytes int64
+	var callbacks *lib.CpCallbacks
+	if !quiet {
+		callbacks = &lib.CpCallbacks{
+			OnFileEnd: func(path string) {
+				fileCount++
+			},
+			OnProgress: func(bytesCopied int64) {
+				totalBytes = bytesCopied
+			},
+		}
+	}
+
+	err = lib.CpFromInstance(ctx, cfg, lib.CpFromInstanceOptions{
+		InstanceID:  instanceID,
+		SrcPath:     srcPath,
+		DstPath:     dstPath,
+		FollowLinks: followLinks,
+		Archive:     archive,
+		Callbacks:   callbacks,
+	})
+	if err != nil {
+		return err
+	}
+
+	if !quiet {
+		fmt.Printf("Copied %s -> %s (%d files, %d bytes)\n", srcPath, dstPath, fileCount, totalBytes)
+	}
+
+	return nil
+}
+
+// copyFromStdinToInstance reads a tar archive from stdin and extracts it to the instance
+func copyFromStdinToInstance(ctx context.Context, baseURL, apiKey, instanceID, dstPath string, archive bool) error {
+	tr := tar.NewReader(os.Stdin)
+
+	for {
+		header, err := tr.Next()
+		if err == io.EOF {
+			break // End of tar archive
+		}
+		if err != nil {
+			return fmt.Errorf("read tar header: %w", err)
+		}
+
+		// Sanitize tar entry path to prevent path traversal attacks
+		targetPath, err := sanitizeTarPath(dstPath, header.Name)
+		if err != nil {
+			return err
+		}
+
+		// Extract uid/gid from tar header if archive mode
+		var uid, gid uint32
+		if archive {
+			uid = uint32(header.Uid)
+			gid = uint32(header.Gid)
+		}
+
+		switch header.Typeflag {
+		case tar.TypeDir:
+			// Create directory
+			if err := createDirOnInstanceWithUidGid(ctx, baseURL, apiKey, instanceID, targetPath, fs.FileMode(header.Mode), uid, gid); err != nil {
+				return fmt.Errorf("create directory %s: %w", targetPath, err)
+			}
+
+		case tar.TypeReg:
+			// Copy file by reading from tar and streaming to instance
+			if err := copyTarFileToInstance(ctx, baseURL, apiKey, instanceID, tr, targetPath, fs.FileMode(header.Mode), header.Size, uid, gid); err != nil {
+				return fmt.Errorf("copy file %s: %w", targetPath, err)
+			}
+
+		case tar.TypeSymlink:
+			// TODO: Handle symlinks if needed
+			fmt.Fprintf(os.Stderr, "Warning: skipping symlink %s -> %s\n", header.Name, header.Linkname)
+		}
+	}
+
+	return nil
+}
+
+// copyTarFileToInstance copies a single file from a tar reader to the instance
+func copyTarFileToInstance(ctx context.Context, baseURL, apiKey, instanceID string, reader io.Reader, dstPath string, mode fs.FileMode, size int64, uid, gid uint32) error {
+	wsURL, err := buildCpWsURL(baseURL, instanceID)
+	if err != nil {
+		return err
+	}
+
+	headers := http.Header{}
+	headers.Set("Authorization", fmt.Sprintf("Bearer %s", apiKey))
+
+	dialer := &websocket.Dialer{}
+	ws, resp, err := dialer.DialContext(ctx, wsURL, headers)
+	if err != nil {
+		if resp != nil {
+			defer resp.Body.Close()
+			body, _ := io.ReadAll(resp.Body)
+			return fmt.Errorf("websocket connect failed (HTTP %d): %s", resp.StatusCode, string(body))
+		}
+		return fmt.Errorf("websocket connect failed: %w", err)
+	}
+	defer ws.Close()
+
+	// Send initial request
+	req := cpRequest{
+		Direction: "to",
+		GuestPath: dstPath,
+		IsDir:     false,
+		Mode:      uint32(mode),
+		Uid:       uid,
+		Gid:       gid,
+	}
+	reqJSON, _ := json.Marshal(req)
+	if err := ws.WriteMessage(websocket.TextMessage, reqJSON); err != nil {
+		return fmt.Errorf("send request: %w", err)
+	}
+
+	// Stream file content from tar reader
+	buf := make([]byte, 32*1024)
+	for {
+		n, err := reader.Read(buf)
+		if n > 0 {
+			if sendErr := ws.WriteMessage(websocket.BinaryMessage, buf[:n]); sendErr != nil {
+				return fmt.Errorf("send data: %w", sendErr)
+			}
+		}
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return fmt.Errorf("read: %w", err)
+		}
+	}
+
+	// Send end marker
+	endMsg, _ := json.Marshal(map[string]string{"type": "end"})
+	if err := ws.WriteMessage(websocket.TextMessage, endMsg); err != nil {
+		return fmt.Errorf("send end: %w", err)
+	}
+
+	// Wait for result
+	_, message, err := ws.ReadMessage()
+	if err != nil {
+		return fmt.Errorf("read result: %w", err)
+	}
+
+	var result cpResult
+	if err := json.Unmarshal(message, &result); err != nil {
+		return fmt.Errorf("parse result: %w", err)
+	}
+
+	if !result.Success {
+		return fmt.Errorf("copy failed: %s", result.Error)
+	}
+
+	return nil
+}
+
+// copyFromInstanceToStdout copies files from the instance and writes a tar archive to stdout
+func copyFromInstanceToStdout(ctx context.Context, baseURL, apiKey, instanceID, srcPath string, followLinks, archive bool) error {
+	wsURL, err := buildCpWsURL(baseURL, instanceID)
+	if err != nil {
+		return err
+	}
+
+	headers := http.Header{}
+	headers.Set("Authorization", fmt.Sprintf("Bearer %s", apiKey))
+
+	dialer := &websocket.Dialer{}
+	ws, resp, err := dialer.DialContext(ctx, wsURL, headers)
+	if err != nil {
+		if resp != nil {
+			defer resp.Body.Close()
+			body, _ := io.ReadAll(resp.Body)
+			return fmt.Errorf("websocket connect failed (HTTP %d): %s", resp.StatusCode, string(body))
+		}
+		return fmt.Errorf("websocket connect failed: %w", err)
+	}
+	defer ws.Close()
+
+	// Send initial request
+	req := cpRequest{
+		Direction:   "from",
+		GuestPath:   srcPath,
+		FollowLinks: followLinks,
+	}
+	reqJSON, _ := json.Marshal(req)
+	if err := ws.WriteMessage(websocket.TextMessage, reqJSON); err != nil {
+		return fmt.Errorf("send request: %w", err)
+	}
+
+	// Create tar writer for stdout
+	tw := tar.NewWriter(os.Stdout)
+	defer tw.Close()
+
+	var currentHeader *cpFileHeader
+	var bytesWritten int64
+	var receivedFinal bool
+
+	for {
+		msgType, message, err := ws.ReadMessage()
+		if err != nil {
+			if websocket.IsCloseError(err, websocket.CloseNormalClosure, websocket.CloseGoingAway) {
+				break
+			}
+			return fmt.Errorf("read message: %w", err)
+		}
+
+		if msgType == websocket.TextMessage {
+			var msgMap map[string]interface{}
+			if err := json.Unmarshal(message, &msgMap); err != nil {
+				return fmt.Errorf("parse message: %w", err)
+			}
+
+			msgTypeStr, _ := msgMap["type"].(string)
+
+			switch msgTypeStr {
+			case "header":
+				// Verify previous file was completely written
+				if currentHeader != nil && !currentHeader.IsDir && !currentHeader.IsSymlink {
+					if bytesWritten != currentHeader.Size {
+						return fmt.Errorf("file %s: expected %d bytes, got %d", currentHeader.Path, currentHeader.Size, bytesWritten)
+					}
+				}
+
+				var header cpFileHeader
+				if err := json.Unmarshal(message, &header); err != nil {
+					return fmt.Errorf("parse header: %w", err)
+				}
+				currentHeader = &header
+				bytesWritten = 0
+
+				if header.IsDir {
+					// Write directory entry to tar
+					tarHeader := &tar.Header{
+						Typeflag: tar.TypeDir,
+						Name:     header.Path + "/",
+						Mode:     int64(header.Mode),
+						ModTime:  time.Unix(header.Mtime, 0),
+					}
+					// Only preserve UID/GID in archive mode
+					if archive {
+						tarHeader.Uid = int(header.Uid)
+						tarHeader.Gid = int(header.Gid)
+					}
+					if err := tw.WriteHeader(tarHeader); err != nil {
+						return fmt.Errorf("write tar dir header: %w", err)
+					}
+				} else if header.IsSymlink {
+					// Write symlink entry to tar
+					tarHeader := &tar.Header{
+						Typeflag: tar.TypeSymlink,
+						Name:     header.Path,
+						Linkname: header.LinkTarget,
+						Mode:     int64(header.Mode),
+						ModTime:  time.Unix(header.Mtime, 0),
+					}
+					// Only preserve UID/GID in archive mode
+					if archive {
+						tarHeader.Uid = int(header.Uid)
+						tarHeader.Gid = int(header.Gid)
+					}
+					if err := tw.WriteHeader(tarHeader); err != nil {
+						return fmt.Errorf("write tar symlink header: %w", err)
+					}
+				} else {
+					// Write regular file header with known size - enables streaming
+					tarHeader := &tar.Header{
+						Typeflag: tar.TypeReg,
+						Name:     header.Path,
+						Size:     header.Size,
+						Mode:     int64(header.Mode),
+						ModTime:  time.Unix(header.Mtime, 0),
+					}
+					// Only preserve UID/GID in archive mode
+					if archive {
+						tarHeader.Uid = int(header.Uid)
+						tarHeader.Gid = int(header.Gid)
+					}
+					if err := tw.WriteHeader(tarHeader); err != nil {
+						return fmt.Errorf("write tar header: %w", err)
+					}
+				}
+
+			case "end":
+				// Verify file was completely written
+				if currentHeader != nil && !currentHeader.IsDir && !currentHeader.IsSymlink {
+					if bytesWritten != currentHeader.Size {
+						return fmt.Errorf("file %s: expected %d bytes, got %d", currentHeader.Path, currentHeader.Size, bytesWritten)
+					}
+				}
+				currentHeader = nil
+
+				var endMarker cpEndMarker
+				json.Unmarshal(message, &endMarker)
+				if endMarker.Final {
+					receivedFinal = true
+					return nil
+				}
+
+			case "error":
+				var cpErr cpError
+				json.Unmarshal(message, &cpErr)
+				return fmt.Errorf("copy error at %s: %s", cpErr.Path, cpErr.Message)
+			}
+		} else if msgType == websocket.BinaryMessage {
+			// Stream file data directly to tar archive
+			n, err := tw.Write(message)
+			if err != nil {
+				return fmt.Errorf("write tar data: %w", err)
+			}
+			bytesWritten += int64(n)
+		}
+	}
+
+	// If connection closed without receiving final marker, the transfer was incomplete
+	if !receivedFinal {
+		return fmt.Errorf("copy stream ended without completion marker")
+	}
+	return nil
+}
+
+
diff --git a/apps/cli/pkg/cmd/devicecmd.go b/apps/cli/pkg/cmd/devicecmd.go
new file mode 100644
index 00000000..5b102de9
--- /dev/null
+++ b/apps/cli/pkg/cmd/devicecmd.go
@@ -0,0 +1,357 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/tidwall/gjson"
+	"github.com/urfave/cli/v3"
+)
+
+var deviceCmd = cli.Command{
+	Name:  "device",
+	Usage: "Manage PCI/GPU devices for passthrough",
+	Description: `Manage PCI devices for passthrough to virtual machines.
+
+This command allows you to discover available passthrough-capable devices,
+register them for use with instances, and manage registered devices.
+
+Examples:
+  # Discover available devices on the host
+  hypeman device available
+
+  # Register a GPU for passthrough
+  hypeman device register --pci-address 0000:a2:00.0 --name my-gpu
+
+  # List registered devices
+  hypeman device list
+
+  # Delete a registered device
+  hypeman device delete my-gpu`,
+	Commands: []*cli.Command{
+		&deviceAvailableCmd,
+		&deviceRegisterCmd,
+		&deviceListCmd,
+		&deviceGetCmd,
+		&deviceDeleteCmd,
+	},
+	HideHelpCommand: true,
+}
+
+var deviceAvailableCmd = cli.Command{
+	Name:  "available",
+	Usage: "Discover passthrough-capable devices on host",
+	Description: `List all PCI devices on the host that are capable of passthrough.
+
+Shows devices with their PCI address, vendor/device info, IOMMU group,
+and current driver binding.`,
+	Action:          handleDeviceAvailable,
+	HideHelpCommand: true,
+}
+
+var deviceRegisterCmd = cli.Command{
+	Name:      "register",
+	Usage:     "Register a device for passthrough",
+	ArgsUsage: "[pci-address]",
+	Description: `Register a PCI device for use with VM passthrough.
+
+The device must be in an IOMMU group that supports passthrough.
+Once registered, the device can be attached to instances using
+the --device flag with 'hypeman run'.
+
+Examples:
+  # Register by PCI address
+  hypeman device register 0000:a2:00.0
+
+  # Register with a custom name
+  hypeman device register --pci-address 0000:a2:00.0 --name my-gpu`,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:  "pci-address",
+			Usage: "PCI address of the device (e.g., 0000:a2:00.0)",
+		},
+		&cli.StringFlag{
+			Name:  "name",
+			Usage: "Optional name for the device (auto-generated if not provided)",
+		},
+	},
+	Action:          handleDeviceRegister,
+	HideHelpCommand: true,
+}
+
+var deviceListCmd = cli.Command{
+	Name:            "list",
+	Usage:           "List registered devices",
+	Action:          handleDeviceList,
+	HideHelpCommand: true,
+}
+
+var deviceGetCmd = cli.Command{
+	Name:      "get",
+	Usage:     "Get device details",
+	ArgsUsage: "<device-id-or-name>",
+	Action:    handleDeviceGet,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:  "id",
+			Usage: "Device ID or name",
+		},
+	},
+	HideHelpCommand: true,
+}
+
+var deviceDeleteCmd = cli.Command{
+	Name:      "delete",
+	Aliases:   []string{"rm", "unregister"},
+	Usage:     "Unregister a device",
+	ArgsUsage: "<device-id-or-name>",
+	Action:    handleDeviceDelete,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:  "id",
+			Usage: "Device ID or name",
+		},
+	},
+	HideHelpCommand: true,
+}
+
+func handleDeviceAvailable(ctx context.Context, cmd *cli.Command) error {
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	var res []byte
+	opts = append(opts, option.WithResponseBodyInto(&res))
+	_, err := client.Devices.ListAvailable(ctx, opts...)
+	if err != nil {
+		return err
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	// If format is "auto", use our custom table format
+	if format == "auto" || format == "" {
+		return showAvailableDevicesTable(res)
+	}
+
+	obj := gjson.ParseBytes(res)
+	return ShowJSON(os.Stdout, "devices available", obj, format, transform)
+}
+
+func showAvailableDevicesTable(data []byte) error {
+	devices := gjson.ParseBytes(data)
+
+	if !devices.IsArray() || len(devices.Array()) == 0 {
+		fmt.Println("No passthrough-capable devices found.")
+		return nil
+	}
+
+	table := NewTableWriter(os.Stdout, "PCI ADDRESS", "VENDOR", "DEVICE", "IOMMU", "DRIVER")
+	table.TruncOrder = []int{2, 1} // DEVICE first, then VENDOR
+
+	devices.ForEach(func(key, value gjson.Result) bool {
+		pciAddr := value.Get("pci_address").String()
+		vendorID := value.Get("vendor_id").String()
+		deviceID := value.Get("device_id").String()
+		vendorName := value.Get("vendor_name").String()
+		deviceName := value.Get("device_name").String()
+		iommuGroup := fmt.Sprintf("%d", value.Get("iommu_group").Int())
+		driver := value.Get("current_driver").String()
+
+		vendor := vendorName
+		if vendor == "" {
+			vendor = vendorID
+		}
+
+		device := deviceName
+		if device == "" {
+			device = deviceID
+		}
+
+		if driver == "" {
+			driver = "-"
+		}
+
+		table.AddRow(pciAddr, vendor, device, iommuGroup, driver)
+		return true
+	})
+
+	table.Render()
+	return nil
+}
+
+func handleDeviceRegister(ctx context.Context, cmd *cli.Command) error {
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	// Get PCI address from flag or first argument
+	pciAddress := cmd.String("pci-address")
+	args := cmd.Args().Slice()
+	if pciAddress == "" && len(args) > 0 {
+		pciAddress = args[0]
+	}
+
+	if pciAddress == "" {
+		return fmt.Errorf("PCI address required\nUsage: hypeman device register [--pci-address] <pci-address> [--name <name>]")
+	}
+
+	params := hypeman.DeviceNewParams{
+		PciAddress: pciAddress,
+	}
+
+	if name := cmd.String("name"); name != "" {
+		params.Name = hypeman.Opt(name)
+	}
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	var res []byte
+	opts = append(opts, option.WithResponseBodyInto(&res))
+	_, err := client.Devices.New(ctx, params, opts...)
+	if err != nil {
+		return err
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	if format == "auto" || format == "" {
+		device := gjson.ParseBytes(res)
+		fmt.Printf("Registered device %s (%s)\n", device.Get("name").String(), device.Get("id").String())
+		return nil
+	}
+
+	obj := gjson.ParseBytes(res)
+	return ShowJSON(os.Stdout, "device register", obj, format, transform)
+}
+
+func handleDeviceList(ctx context.Context, cmd *cli.Command) error {
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	var res []byte
+	opts = append(opts, option.WithResponseBodyInto(&res))
+	_, err := client.Devices.List(ctx, opts...)
+	if err != nil {
+		return err
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	if format == "auto" || format == "" {
+		return showDeviceListTable(res)
+	}
+
+	obj := gjson.ParseBytes(res)
+	return ShowJSON(os.Stdout, "devices list", obj, format, transform)
+}
+
+func showDeviceListTable(data []byte) error {
+	devices := gjson.ParseBytes(data)
+
+	if !devices.IsArray() || len(devices.Array()) == 0 {
+		fmt.Println("No registered devices.")
+		return nil
+	}
+
+	table := NewTableWriter(os.Stdout, "ID", "NAME", "TYPE", "PCI ADDRESS", "VFIO", "ATTACHED TO")
+	table.TruncOrder = []int{0, 1, 5} // ID first, then NAME, ATTACHED TO
+
+	devices.ForEach(func(key, value gjson.Result) bool {
+		id := value.Get("id").String()
+		name := value.Get("name").String()
+		deviceType := value.Get("type").String()
+		pciAddr := value.Get("pci_address").String()
+
+		vfio := "no"
+		if value.Get("bound_to_vfio").Bool() {
+			vfio = "yes"
+		}
+
+		attachedTo := value.Get("attached_to").String()
+		if attachedTo == "" {
+			attachedTo = "-"
+		}
+
+		table.AddRow(id, name, deviceType, pciAddr, vfio, attachedTo)
+		return true
+	})
+
+	table.Render()
+	return nil
+}
+
+func handleDeviceGet(ctx context.Context, cmd *cli.Command) error {
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	// Get device ID from flag or first argument
+	id := cmd.String("id")
+	args := cmd.Args().Slice()
+	if id == "" && len(args) > 0 {
+		id = args[0]
+	}
+
+	if id == "" {
+		return fmt.Errorf("device ID or name required\nUsage: hypeman device get <device-id-or-name>")
+	}
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	var res []byte
+	opts = append(opts, option.WithResponseBodyInto(&res))
+	_, err := client.Devices.Get(ctx, id, opts...)
+	if err != nil {
+		return err
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	obj := gjson.ParseBytes(res)
+	return ShowJSON(os.Stdout, "device get", obj, format, transform)
+}
+
+func handleDeviceDelete(ctx context.Context, cmd *cli.Command) error {
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	// Get device ID from flag or first argument
+	id := cmd.String("id")
+	args := cmd.Args().Slice()
+	if id == "" && len(args) > 0 {
+		id = args[0]
+	}
+
+	if id == "" {
+		return fmt.Errorf("device ID or name required\nUsage: hypeman device delete <device-id-or-name>")
+	}
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	err := client.Devices.Delete(ctx, id, opts...)
+	if err != nil {
+		return err
+	}
+
+	fmt.Printf("Deleted device %s\n", id)
+	return nil
+}
diff --git a/apps/cli/pkg/cmd/devicecmd_test.go b/apps/cli/pkg/cmd/devicecmd_test.go
new file mode 100644
index 00000000..a6108e3c
--- /dev/null
+++ b/apps/cli/pkg/cmd/devicecmd_test.go
@@ -0,0 +1,50 @@
+package cmd
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDeviceCommandStructure(t *testing.T) {
+	// Test that deviceCmd has the expected subcommands
+	assert.Equal(t, "device", deviceCmd.Name)
+	assert.Equal(t, "Manage PCI/GPU devices for passthrough", deviceCmd.Usage)
+
+	// Verify subcommands exist
+	subcommandNames := make([]string, len(deviceCmd.Commands))
+	for i, cmd := range deviceCmd.Commands {
+		subcommandNames[i] = cmd.Name
+	}
+
+	assert.Contains(t, subcommandNames, "available")
+	assert.Contains(t, subcommandNames, "register")
+	assert.Contains(t, subcommandNames, "list")
+	assert.Contains(t, subcommandNames, "get")
+	assert.Contains(t, subcommandNames, "delete")
+}
+
+func TestDeviceAvailableCmdStructure(t *testing.T) {
+	assert.Equal(t, "available", deviceAvailableCmd.Name)
+	assert.Equal(t, "Discover passthrough-capable devices on host", deviceAvailableCmd.Usage)
+}
+
+func TestDeviceRegisterCmdStructure(t *testing.T) {
+	assert.Equal(t, "register", deviceRegisterCmd.Name)
+	assert.Equal(t, "Register a device for passthrough", deviceRegisterCmd.Usage)
+
+	// Check flags exist
+	flagNames := make([]string, 0)
+	for _, flag := range deviceRegisterCmd.Flags {
+		flagNames = append(flagNames, flag.Names()...)
+	}
+
+	assert.Contains(t, flagNames, "pci-address")
+	assert.Contains(t, flagNames, "name")
+}
+
+func TestDeviceDeleteCmdAliases(t *testing.T) {
+	// Verify delete has aliases
+	assert.Contains(t, deviceDeleteCmd.Aliases, "rm")
+	assert.Contains(t, deviceDeleteCmd.Aliases, "unregister")
+}
diff --git a/apps/cli/pkg/cmd/exec.go b/apps/cli/pkg/cmd/exec.go
new file mode 100644
index 00000000..d53efe5c
--- /dev/null
+++ b/apps/cli/pkg/cmd/exec.go
@@ -0,0 +1,361 @@
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"os/signal"
+	"strings"
+	"sync"
+
+	"github.com/gorilla/websocket"
+	"github.com/kernel/hypeman-go"
+	"github.com/urfave/cli/v3"
+	"golang.org/x/term"
+)
+
+// ExecExitError is returned when exec completes with a non-zero exit code
+type ExecExitError struct {
+	Code int
+}
+
+func (e *ExecExitError) Error() string {
+	return fmt.Sprintf("exec exited with code %d", e.Code)
+}
+
+// execRequest represents the JSON body for exec requests
+type execRequest struct {
+	Command []string          `json:"command"`
+	TTY     bool              `json:"tty"`
+	Env     map[string]string `json:"env,omitempty"`
+	Cwd     string            `json:"cwd,omitempty"`
+	Timeout int32             `json:"timeout,omitempty"`
+	Rows    uint32            `json:"rows,omitempty"`
+	Cols    uint32            `json:"cols,omitempty"`
+}
+
+var execCmd = cli.Command{
+	Name:      "exec",
+	Usage:     "Execute a command in a running instance",
+	ArgsUsage: "<instance-id> [-- command...]",
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:    "it",
+			Aliases: []string{"i", "t"},
+			Usage:   "Enable interactive TTY mode",
+		},
+		&cli.BoolFlag{
+			Name:    "no-tty",
+			Aliases: []string{"T"},
+			Usage:   "Disable TTY allocation",
+		},
+		&cli.StringSliceFlag{
+			Name:    "env",
+			Aliases: []string{"e"},
+			Usage:   "Set environment variable (KEY=VALUE, can be repeated)",
+		},
+		&cli.StringFlag{
+			Name:  "cwd",
+			Usage: "Working directory inside the instance",
+		},
+		&cli.IntFlag{
+			Name:  "timeout",
+			Usage: "Execution timeout in seconds (0 = no timeout)",
+		},
+	},
+	Action:          handleExec,
+	HideHelpCommand: true,
+}
+
+func handleExec(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("instance ID required\nUsage: hypeman exec [flags] <instance-id> [-- command...]")
+	}
+
+	// Resolve instance by ID, partial ID, or name
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+	instanceID, err := ResolveInstance(ctx, &client, args[0])
+	if err != nil {
+		return err
+	}
+
+	var command []string
+
+	// Parse command after -- separator or remaining args
+	if len(args) > 1 {
+		command = args[1:]
+	}
+
+	// Determine TTY mode
+	tty := true // default
+	if cmd.Bool("no-tty") {
+		tty = false
+	} else if cmd.Bool("it") {
+		tty = true
+	} else {
+		// Auto-detect: enable TTY if stdin and stdout are terminals
+		tty = term.IsTerminal(int(os.Stdin.Fd())) && term.IsTerminal(int(os.Stdout.Fd()))
+	}
+
+	// Parse environment variables
+	env := make(map[string]string)
+	for _, e := range cmd.StringSlice("env") {
+		parts := strings.SplitN(e, "=", 2)
+		if len(parts) == 2 {
+			env[parts[0]] = parts[1]
+		} else {
+			fmt.Fprintf(os.Stderr, "Warning: ignoring malformed env var: %s\n", e)
+		}
+	}
+
+	// Build exec request
+	execReq := execRequest{
+		Command: command,
+		TTY:     tty,
+	}
+	if len(env) > 0 {
+		execReq.Env = env
+	}
+	if cwd := cmd.String("cwd"); cwd != "" {
+		execReq.Cwd = cwd
+	}
+	if timeout := cmd.Int("timeout"); timeout > 0 {
+		execReq.Timeout = int32(timeout)
+	}
+
+	// Get terminal size for TTY mode (only if stdout is actually a terminal)
+	if tty && term.IsTerminal(int(os.Stdout.Fd())) {
+		cols, rows, _ := term.GetSize(int(os.Stdout.Fd()))
+		if rows > 0 {
+			execReq.Rows = uint32(rows)
+		}
+		if cols > 0 {
+			execReq.Cols = uint32(cols)
+		}
+	}
+
+	reqBody, err := json.Marshal(execReq)
+	if err != nil {
+		return fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	// Get base URL and API key (flag > env > config file)
+	baseURL := resolveBaseURL(cmd)
+
+	apiKey := resolveAPIKey()
+	if apiKey == "" {
+		return fmt.Errorf("API key required: set HYPEMAN_API_KEY or configure api_key in ~/.config/hypeman/cli.yaml")
+	}
+
+	// Build WebSocket URL
+	u, err := url.Parse(baseURL)
+	if err != nil {
+		return fmt.Errorf("invalid base URL: %w", err)
+	}
+	u.Path = fmt.Sprintf("/instances/%s/exec", instanceID)
+
+	// Convert scheme to WebSocket
+	switch u.Scheme {
+	case "https":
+		u.Scheme = "wss"
+	case "http":
+		u.Scheme = "ws"
+	}
+
+	// Connect WebSocket with auth header
+	headers := http.Header{}
+	headers.Set("Authorization", fmt.Sprintf("Bearer %s", apiKey))
+
+	dialer := &websocket.Dialer{}
+	ws, resp, err := dialer.DialContext(ctx, u.String(), headers)
+	if err != nil {
+		if resp != nil {
+			body, _ := io.ReadAll(resp.Body)
+			return fmt.Errorf("websocket connect failed (HTTP %d): %s", resp.StatusCode, string(body))
+		}
+		return fmt.Errorf("websocket connect failed: %w", err)
+	}
+	defer ws.Close()
+
+	// Send JSON request as first message
+	if err := ws.WriteMessage(websocket.TextMessage, reqBody); err != nil {
+		return fmt.Errorf("failed to send exec request: %w", err)
+	}
+
+	// Run interactive or non-interactive mode
+	var exitCode int
+	if tty {
+		exitCode, err = runExecInteractive(ws)
+	} else {
+		exitCode, err = runExecNonInteractive(ws)
+	}
+
+	if err != nil {
+		return err
+	}
+
+	if exitCode != 0 {
+		return &ExecExitError{Code: exitCode}
+	}
+
+	return nil
+}
+
+func runExecInteractive(ws *websocket.Conn) (int, error) {
+	// Put terminal in raw mode
+	oldState, err := term.MakeRaw(int(os.Stdin.Fd()))
+	if err != nil {
+		return 255, fmt.Errorf("failed to set raw mode: %w", err)
+	}
+	defer term.Restore(int(os.Stdin.Fd()), oldState)
+
+	// Handle signals gracefully (os.Interrupt is cross-platform)
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, os.Interrupt)
+	defer signal.Stop(sigCh)
+
+	// Mutex to protect WebSocket writes from concurrent access
+	var wsMu sync.Mutex
+
+	// Handle terminal resize events (Unix only, no-op on Windows)
+	cleanupResize := setupResizeHandler(ws, &wsMu)
+	defer cleanupResize()
+
+	errCh := make(chan error, 2)
+	exitCodeCh := make(chan int, 1)
+
+	// Forward stdin to WebSocket
+	go func() {
+		buf := make([]byte, 32*1024)
+		for {
+			n, err := os.Stdin.Read(buf)
+			if err != nil {
+				if err != io.EOF {
+					errCh <- fmt.Errorf("stdin read error: %w", err)
+				}
+				return
+			}
+			if n > 0 {
+				wsMu.Lock()
+				err := ws.WriteMessage(websocket.BinaryMessage, buf[:n])
+				wsMu.Unlock()
+				if err != nil {
+					errCh <- fmt.Errorf("websocket write error: %w", err)
+					return
+				}
+			}
+		}
+	}()
+
+	// Forward WebSocket to stdout
+	go func() {
+		for {
+			msgType, message, err := ws.ReadMessage()
+			if err != nil {
+				if !websocket.IsUnexpectedCloseError(err, websocket.CloseNormalClosure, websocket.CloseGoingAway) {
+					exitCodeCh <- 0
+				}
+				return
+			}
+
+			// Check for exit code message
+			if msgType == websocket.TextMessage && bytes.Contains(message, []byte("exitCode")) {
+				var exitMsg struct {
+					ExitCode int `json:"exitCode"`
+				}
+				if json.Unmarshal(message, &exitMsg) == nil {
+					exitCodeCh <- exitMsg.ExitCode
+					return
+				}
+			}
+
+			// Write binary messages to stdout (actual output)
+			if msgType == websocket.BinaryMessage {
+				os.Stdout.Write(message)
+			}
+		}
+	}()
+
+	select {
+	case err := <-errCh:
+		return 255, err
+	case exitCode := <-exitCodeCh:
+		return exitCode, nil
+	case <-sigCh:
+		return 130, nil // 128 + SIGINT
+	}
+}
+
+func runExecNonInteractive(ws *websocket.Conn) (int, error) {
+	errCh := make(chan error, 2)
+	exitCodeCh := make(chan int, 1)
+	doneCh := make(chan struct{})
+
+	// Forward stdin to WebSocket
+	go func() {
+		buf := make([]byte, 32*1024)
+		for {
+			n, err := os.Stdin.Read(buf)
+			if err != nil {
+				if err != io.EOF {
+					errCh <- fmt.Errorf("stdin read error: %w", err)
+				}
+				return
+			}
+			if n > 0 {
+				if err := ws.WriteMessage(websocket.BinaryMessage, buf[:n]); err != nil {
+					errCh <- fmt.Errorf("websocket write error: %w", err)
+					return
+				}
+			}
+		}
+	}()
+
+	// Forward WebSocket to stdout
+	go func() {
+		defer close(doneCh)
+		for {
+			msgType, message, err := ws.ReadMessage()
+			if err != nil {
+				if websocket.IsCloseError(err, websocket.CloseNormalClosure, websocket.CloseGoingAway, websocket.CloseAbnormalClosure) ||
+					err == io.EOF {
+					exitCodeCh <- 0
+					return
+				}
+				errCh <- fmt.Errorf("websocket read error: %w", err)
+				return
+			}
+
+			// Check for exit code message
+			if msgType == websocket.TextMessage && bytes.Contains(message, []byte("exitCode")) {
+				var exitMsg struct {
+					ExitCode int `json:"exitCode"`
+				}
+				if json.Unmarshal(message, &exitMsg) == nil {
+					exitCodeCh <- exitMsg.ExitCode
+					return
+				}
+			}
+
+			// Write to stdout (binary messages contain actual output)
+			if msgType == websocket.BinaryMessage {
+				os.Stdout.Write(message)
+			}
+		}
+	}()
+
+	select {
+	case err := <-errCh:
+		return 255, err
+	case exitCode := <-exitCodeCh:
+		return exitCode, nil
+	case <-doneCh:
+		return 0, nil
+	}
+}
diff --git a/apps/cli/pkg/cmd/exec_unix.go b/apps/cli/pkg/cmd/exec_unix.go
new file mode 100644
index 00000000..43d0c6ba
--- /dev/null
+++ b/apps/cli/pkg/cmd/exec_unix.go
@@ -0,0 +1,35 @@
+//go:build unix
+
+package cmd
+
+import (
+	"fmt"
+	"os"
+	"os/signal"
+	"sync"
+	"syscall"
+
+	"github.com/gorilla/websocket"
+	"golang.org/x/term"
+)
+
+// setupResizeHandler listens for SIGWINCH signals and sends resize messages over the WebSocket.
+// Returns a cleanup function that should be deferred.
+func setupResizeHandler(ws *websocket.Conn, wsMu *sync.Mutex) (cleanup func()) {
+	sigwinch := make(chan os.Signal, 1)
+	signal.Notify(sigwinch, syscall.SIGWINCH)
+
+	go func() {
+		for range sigwinch {
+			cols, rows, _ := term.GetSize(int(os.Stdout.Fd()))
+			if rows > 0 && cols > 0 {
+				msg := fmt.Sprintf(`{"resize":{"rows":%d,"cols":%d}}`, rows, cols)
+				wsMu.Lock()
+				ws.WriteMessage(websocket.TextMessage, []byte(msg))
+				wsMu.Unlock()
+			}
+		}
+	}()
+
+	return func() { signal.Stop(sigwinch) }
+}
diff --git a/apps/cli/pkg/cmd/exec_windows.go b/apps/cli/pkg/cmd/exec_windows.go
new file mode 100644
index 00000000..678cfb28
--- /dev/null
+++ b/apps/cli/pkg/cmd/exec_windows.go
@@ -0,0 +1,16 @@
+//go:build windows
+
+package cmd
+
+import (
+	"sync"
+
+	"github.com/gorilla/websocket"
+)
+
+// setupResizeHandler is a no-op on Windows since SIGWINCH doesn't exist.
+// Terminal resize events are not supported on native Windows.
+// The initial terminal size is still sent in the exec request.
+func setupResizeHandler(ws *websocket.Conn, wsMu *sync.Mutex) (cleanup func()) {
+	return func() {}
+}
diff --git a/apps/cli/pkg/cmd/format.go b/apps/cli/pkg/cmd/format.go
new file mode 100644
index 00000000..9d74e4dc
--- /dev/null
+++ b/apps/cli/pkg/cmd/format.go
@@ -0,0 +1,299 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/kernel/hypeman-go"
+	"golang.org/x/term"
+)
+
+// TableWriter provides simple table formatting for CLI output with
+// terminal-width-aware column sizing.
+type TableWriter struct {
+	w       io.Writer
+	headers []string
+	widths  []int // natural widths (max of header and cell values)
+	rows    [][]string
+
+	// TruncOrder specifies column indices in truncation priority order.
+	// The first index in the slice is truncated first when the table is
+	// too wide for the terminal. Columns not listed are never truncated.
+	TruncOrder []int
+}
+
+const columnGap = 2 // spaces between columns
+
+// NewTableWriter creates a new table writer
+func NewTableWriter(w io.Writer, headers ...string) *TableWriter {
+	widths := make([]int, len(headers))
+	for i, h := range headers {
+		widths[i] = len(h)
+	}
+	return &TableWriter{
+		w:       w,
+		headers: headers,
+		widths:  widths,
+	}
+}
+
+// AddRow adds a row to the table
+func (t *TableWriter) AddRow(cells ...string) {
+	// Pad or truncate to match header count
+	row := make([]string, len(t.headers))
+	for i := range row {
+		if i < len(cells) {
+			row[i] = cells[i]
+		}
+		if len(row[i]) > t.widths[i] {
+			t.widths[i] = len(row[i])
+		}
+	}
+	t.rows = append(t.rows, row)
+}
+
+// getTerminalWidth returns the terminal width. It tries the stdout
+// file descriptor first, then falls back to stderr (which remains
+// connected to the terminal even when stdout is piped), then the
+// COLUMNS env var, then defaults to 80.
+func getTerminalWidth() int {
+	if w, _, err := term.GetSize(int(os.Stdout.Fd())); err == nil && w > 0 {
+		return w
+	}
+	if w, _, err := term.GetSize(int(os.Stderr.Fd())); err == nil && w > 0 {
+		return w
+	}
+	if cols := os.Getenv("COLUMNS"); cols != "" {
+		if w, err := strconv.Atoi(cols); err == nil && w > 0 {
+			return w
+		}
+	}
+	return 80
+}
+
+// renderWidths computes the final column widths, shrinking columns in
+// TruncOrder as needed to fit within the terminal width.
+func (t *TableWriter) renderWidths() []int {
+	n := len(t.headers)
+	widths := make([]int, n)
+	copy(widths, t.widths)
+
+	termWidth := getTerminalWidth()
+
+	// Total space: column widths + gaps (no trailing gap on last column)
+	total := func() int {
+		s := 0
+		for _, w := range widths {
+			s += w
+		}
+		s += columnGap * (n - 1)
+		return s
+	}
+
+	if total() <= termWidth {
+		return widths
+	}
+
+	// Shrink columns in TruncOrder until the table fits
+	for _, col := range t.TruncOrder {
+		if col < 0 || col >= n {
+			continue
+		}
+		excess := total() - termWidth
+		if excess <= 0 {
+			break
+		}
+		// Minimum width: at least the header length, but no less than 5
+		minW := len(t.headers[col])
+		if minW < 5 {
+			minW = 5
+		}
+		canShrink := widths[col] - minW
+		if canShrink <= 0 {
+			continue
+		}
+		shrink := excess
+		if shrink > canShrink {
+			shrink = canShrink
+		}
+		widths[col] -= shrink
+	}
+
+	return widths
+}
+
+// Render outputs the table, dynamically fitting columns to the terminal width.
+func (t *TableWriter) Render() {
+	widths := t.renderWidths()
+	last := len(t.headers) - 1
+
+	// Print headers
+	for i, h := range t.headers {
+		cell := truncateCell(h, widths[i])
+		if i < last {
+			fmt.Fprintf(t.w, "%-*s", widths[i]+columnGap, cell)
+		} else {
+			fmt.Fprint(t.w, cell)
+		}
+	}
+	fmt.Fprintln(t.w)
+
+	// Print rows
+	for _, row := range t.rows {
+		for i, cell := range row {
+			cell = truncateCell(cell, widths[i])
+			if i < last {
+				fmt.Fprintf(t.w, "%-*s", widths[i]+columnGap, cell)
+			} else {
+				fmt.Fprint(t.w, cell)
+			}
+		}
+		fmt.Fprintln(t.w)
+	}
+}
+
+// truncateCell truncates s to fit within maxWidth, appending "..." if needed.
+func truncateCell(s string, maxWidth int) string {
+	if len(s) <= maxWidth {
+		return s
+	}
+	if maxWidth <= 3 {
+		return s[:maxWidth]
+	}
+	return s[:maxWidth-3] + "..."
+}
+
+// FormatTimeAgo formats a time as "X ago" string
+func FormatTimeAgo(t time.Time) string {
+	if t.IsZero() {
+		return "N/A"
+	}
+
+	d := time.Since(t)
+
+	switch {
+	case d < time.Minute:
+		return fmt.Sprintf("%d seconds ago", int(d.Seconds()))
+	case d < time.Hour:
+		mins := int(d.Minutes())
+		if mins == 1 {
+			return "1 minute ago"
+		}
+		return fmt.Sprintf("%d minutes ago", mins)
+	case d < 24*time.Hour:
+		hours := int(d.Hours())
+		if hours == 1 {
+			return "1 hour ago"
+		}
+		return fmt.Sprintf("%d hours ago", hours)
+	default:
+		days := int(d.Hours() / 24)
+		if days == 1 {
+			return "1 day ago"
+		}
+		return fmt.Sprintf("%d days ago", days)
+	}
+}
+
+// TruncateID truncates an ID to 12 characters (like Docker)
+func TruncateID(id string) string {
+	if len(id) > 12 {
+		return id[:12]
+	}
+	return id
+}
+
+// TruncateString truncates a string to max length with ellipsis
+func TruncateString(s string, max int) string {
+	if len(s) <= max {
+		return s
+	}
+	if max <= 3 {
+		return s[:max]
+	}
+	return s[:max-3] + "..."
+}
+
+// GenerateInstanceName generates a name from image reference
+func GenerateInstanceName(image string) string {
+	// Extract image name without registry/tag
+	name := image
+
+	// Remove registry prefix
+	if idx := strings.LastIndex(name, "/"); idx != -1 {
+		name = name[idx+1:]
+	}
+
+	// Remove tag/digest
+	if idx := strings.Index(name, ":"); idx != -1 {
+		name = name[:idx]
+	}
+	if idx := strings.Index(name, "@"); idx != -1 {
+		name = name[:idx]
+	}
+
+	// Add random suffix
+	suffix := randomSuffix(4)
+	return fmt.Sprintf("%s-%s", name, suffix)
+}
+
+// randomSuffix generates a random alphanumeric suffix
+func randomSuffix(n int) string {
+	const chars = "abcdefghijklmnopqrstuvwxyz0123456789"
+	b := make([]byte, n)
+	for i := range b {
+		// Simple pseudo-random using time
+		b[i] = chars[(time.Now().UnixNano()+int64(i))%int64(len(chars))]
+	}
+	return string(b)
+}
+
+// ResolveInstance resolves an instance identifier to a full instance ID.
+// It supports:
+// - Full instance ID (exact match)
+// - Partial instance ID (prefix match)
+// - Instance name (exact match)
+// Returns an error if the identifier is ambiguous or not found.
+func ResolveInstance(ctx context.Context, client *hypeman.Client, identifier string) (string, error) {
+	// List all instances
+	instances, err := client.Instances.List(ctx, hypeman.InstanceListParams{})
+	if err != nil {
+		return "", fmt.Errorf("failed to list instances: %w", err)
+	}
+
+	var matches []hypeman.Instance
+
+	for _, inst := range *instances {
+		// Exact ID match - return immediately
+		if inst.ID == identifier {
+			return inst.ID, nil
+		}
+		// Exact name match - return immediately
+		if inst.Name == identifier {
+			return inst.ID, nil
+		}
+		// Partial ID match (prefix)
+		if strings.HasPrefix(inst.ID, identifier) {
+			matches = append(matches, inst)
+		}
+	}
+
+	switch len(matches) {
+	case 0:
+		return "", fmt.Errorf("no instance found matching %q", identifier)
+	case 1:
+		return matches[0].ID, nil
+	default:
+		// Ambiguous - show matching IDs
+		ids := make([]string, len(matches))
+		for i, m := range matches {
+			ids[i] = TruncateID(m.ID)
+		}
+		return "", fmt.Errorf("ambiguous instance identifier %q matches: %s", identifier, strings.Join(ids, ", "))
+	}
+}
diff --git a/apps/cli/pkg/cmd/imagecmd.go b/apps/cli/pkg/cmd/imagecmd.go
new file mode 100644
index 00000000..c178ef72
--- /dev/null
+++ b/apps/cli/pkg/cmd/imagecmd.go
@@ -0,0 +1,175 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/tidwall/gjson"
+	"github.com/urfave/cli/v3"
+)
+
+var imageCmd = cli.Command{
+	Name:  "image",
+	Usage: "Manage images",
+	Commands: []*cli.Command{
+		&imageListCmd,
+		&imageGetCmd,
+		&imageDeleteCmd,
+	},
+	HideHelpCommand: true,
+}
+
+var imageListCmd = cli.Command{
+	Name:  "list",
+	Usage: "List images",
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:    "quiet",
+			Aliases: []string{"q"},
+			Usage:   "Only display image names",
+		},
+	},
+	Action:          handleImageList,
+	HideHelpCommand: true,
+}
+
+var imageGetCmd = cli.Command{
+	Name:      "get",
+	Usage:     "Get image details",
+	ArgsUsage: "<name>",
+	Action:    handleImageGet,
+	HideHelpCommand: true,
+}
+
+var imageDeleteCmd = cli.Command{
+	Name:      "delete",
+	Aliases:   []string{"rm"},
+	Usage:     "Delete an image",
+	ArgsUsage: "<name>",
+	Action:    handleImageDelete,
+	HideHelpCommand: true,
+}
+
+func handleImageList(ctx context.Context, cmd *cli.Command) error {
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	if format != "auto" {
+		var res []byte
+		opts = append(opts, option.WithResponseBodyInto(&res))
+		_, err := client.Images.List(ctx, opts...)
+		if err != nil {
+			return err
+		}
+		obj := gjson.ParseBytes(res)
+		return ShowJSON(os.Stdout, "image list", obj, format, transform)
+	}
+
+	images, err := client.Images.List(ctx, opts...)
+	if err != nil {
+		return err
+	}
+
+	quietMode := cmd.Bool("quiet")
+
+	if quietMode {
+		for _, img := range *images {
+			fmt.Println(img.Name)
+		}
+		return nil
+	}
+
+	if len(*images) == 0 {
+		fmt.Fprintln(os.Stderr, "No images found.")
+		return nil
+	}
+
+	table := NewTableWriter(os.Stdout, "NAME", "STATUS", "DIGEST", "SIZE", "CREATED")
+	table.TruncOrder = []int{0, 2, 4} // NAME first, then DIGEST, CREATED
+	for _, img := range *images {
+		digest := img.Digest
+		if len(digest) > 19 {
+			digest = digest[:19]
+		}
+
+		size := "-"
+		if img.SizeBytes > 0 {
+			size = formatBytes(img.SizeBytes)
+		}
+
+		table.AddRow(
+			img.Name,
+			string(img.Status),
+			digest,
+			size,
+			FormatTimeAgo(img.CreatedAt),
+		)
+	}
+	table.Render()
+
+	return nil
+}
+
+func handleImageGet(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("image name required\nUsage: hypeman image get <name>")
+	}
+
+	name := args[0]
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	var res []byte
+	opts = append(opts, option.WithResponseBodyInto(&res))
+	_, err := client.Images.Get(ctx, url.PathEscape(name), opts...)
+	if err != nil {
+		return err
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	obj := gjson.ParseBytes(res)
+	return ShowJSON(os.Stdout, "image get", obj, format, transform)
+}
+
+func handleImageDelete(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("image name required\nUsage: hypeman image delete <name>")
+	}
+
+	name := args[0]
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	err := client.Images.Delete(ctx, url.PathEscape(name), opts...)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "Deleted image %s\n", name)
+	return nil
+}
diff --git a/apps/cli/pkg/cmd/ingresscmd.go b/apps/cli/pkg/cmd/ingresscmd.go
new file mode 100644
index 00000000..6da8a52e
--- /dev/null
+++ b/apps/cli/pkg/cmd/ingresscmd.go
@@ -0,0 +1,299 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/tidwall/gjson"
+	"github.com/urfave/cli/v3"
+)
+
+var ingressCmd = cli.Command{
+	Name:  "ingress",
+	Usage: "Manage ingresses",
+	Commands: []*cli.Command{
+		&ingressCreateCmd,
+		&ingressListCmd,
+		&ingressGetCmd,
+		&ingressDeleteCmd,
+	},
+	HideHelpCommand: true,
+}
+
+var ingressCreateCmd = cli.Command{
+	Name:      "create",
+	Usage:     "Create an ingress for an instance",
+	ArgsUsage: "<instance>",
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:     "hostname",
+			Aliases:  []string{"H"},
+			Usage:    "Hostname to match (exact match on Host header)",
+			Required: true,
+		},
+		&cli.IntFlag{
+			Name:     "port",
+			Aliases:  []string{"p"},
+			Usage:    "Target port on the instance",
+			Required: true,
+		},
+		&cli.IntFlag{
+			Name:  "host-port",
+			Usage: "Host port to listen on (default: 80)",
+			Value: 80,
+		},
+		&cli.BoolFlag{
+			Name:  "tls",
+			Usage: "Enable TLS termination (certificate auto-issued via ACME)",
+		},
+		&cli.BoolFlag{
+			Name:  "redirect-http",
+			Usage: "Auto-create HTTP to HTTPS redirect (only applies when --tls is enabled)",
+		},
+		&cli.StringFlag{
+			Name:  "name",
+			Usage: "Ingress name (auto-generated from hostname if not provided)",
+		},
+	},
+	Action:          handleIngressCreate,
+	HideHelpCommand: true,
+}
+
+var ingressListCmd = cli.Command{
+	Name:  "list",
+	Usage: "List ingresses",
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:    "quiet",
+			Aliases: []string{"q"},
+			Usage:   "Only display ingress IDs",
+		},
+	},
+	Action:          handleIngressList,
+	HideHelpCommand: true,
+}
+
+var ingressGetCmd = cli.Command{
+	Name:      "get",
+	Usage:     "Get ingress details",
+	ArgsUsage: "<id>",
+	Action:    handleIngressGet,
+	HideHelpCommand: true,
+}
+
+var ingressDeleteCmd = cli.Command{
+	Name:            "delete",
+	Usage:           "Delete an ingress",
+	ArgsUsage:       "<id>",
+	Action:          handleIngressDelete,
+	HideHelpCommand: true,
+}
+
+func handleIngressCreate(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("instance name or ID required\nUsage: hypeman ingress create <instance> --hostname <hostname> --port <port>")
+	}
+
+	instance := args[0]
+	hostname := cmd.String("hostname")
+	port := cmd.Int("port")
+	hostPort := cmd.Int("host-port")
+	tls := cmd.Bool("tls")
+	redirectHTTP := cmd.Bool("redirect-http")
+	name := cmd.String("name")
+
+	// Auto-generate name from hostname if not provided
+	if name == "" {
+		name = generateIngressName(hostname)
+	}
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	params := hypeman.IngressNewParams{
+		Name: name,
+		Rules: []hypeman.IngressRuleParam{
+			{
+				Match: hypeman.IngressMatchParam{
+					Hostname: hostname,
+					Port:     hypeman.Int(int64(hostPort)),
+				},
+				Target: hypeman.IngressTargetParam{
+					Instance: instance,
+					Port:     int64(port),
+				},
+				Tls:          hypeman.Bool(tls),
+				RedirectHTTP: hypeman.Bool(redirectHTTP),
+			},
+		},
+	}
+
+	fmt.Fprintf(os.Stderr, "Creating ingress %s...\n", name)
+
+	result, err := client.Ingresses.New(ctx, params, opts...)
+	if err != nil {
+		return err
+	}
+
+	fmt.Println(result.ID)
+	return nil
+}
+
+func handleIngressList(ctx context.Context, cmd *cli.Command) error {
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	// If a specific format is requested (not "auto"), output in that format
+	if format != "auto" {
+		var res []byte
+		opts = append(opts, option.WithResponseBodyInto(&res))
+		_, err := client.Ingresses.List(ctx, opts...)
+		if err != nil {
+			return err
+		}
+		obj := gjson.ParseBytes(res)
+		return ShowJSON(os.Stdout, "ingress list", obj, format, transform)
+	}
+
+	ingresses, err := client.Ingresses.List(ctx, opts...)
+	if err != nil {
+		return err
+	}
+
+	quietMode := cmd.Bool("quiet")
+
+	if quietMode {
+		for _, ing := range *ingresses {
+			fmt.Println(ing.ID)
+		}
+		return nil
+	}
+
+	if len(*ingresses) == 0 {
+		fmt.Fprintln(os.Stderr, "No ingresses found.")
+		return nil
+	}
+
+	table := NewTableWriter(os.Stdout, "ID", "NAME", "HOSTNAME", "TARGET", "TLS", "CREATED")
+	table.TruncOrder = []int{2, 3, 5, 1} // HOSTNAME first, then TARGET, CREATED, NAME
+	for _, ing := range *ingresses {
+		// Extract first rule's hostname and target for display
+		hostname := ""
+		target := ""
+		tlsEnabled := "-"
+		if len(ing.Rules) > 0 {
+			rule := ing.Rules[0]
+			hostname = rule.Match.Hostname
+			target = fmt.Sprintf("%s:%d", rule.Target.Instance, rule.Target.Port)
+			if rule.Tls {
+				tlsEnabled = "yes"
+			} else {
+				tlsEnabled = "no"
+			}
+		}
+
+		table.AddRow(
+			TruncateID(ing.ID),
+			ing.Name,
+			hostname,
+			target,
+			tlsEnabled,
+			FormatTimeAgo(ing.CreatedAt),
+		)
+	}
+	table.Render()
+
+	return nil
+}
+
+func handleIngressGet(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("ingress ID required\nUsage: hypeman ingress get <id>")
+	}
+
+	id := args[0]
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	var res []byte
+	opts = append(opts, option.WithResponseBodyInto(&res))
+	_, err := client.Ingresses.Get(ctx, id, opts...)
+	if err != nil {
+		return err
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	obj := gjson.ParseBytes(res)
+	return ShowJSON(os.Stdout, "ingress get", obj, format, transform)
+}
+
+func handleIngressDelete(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("ingress ID or name required\nUsage: hypeman ingress delete <id>")
+	}
+
+	id := args[0]
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	err := client.Ingresses.Delete(ctx, id, opts...)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "Deleted ingress %s\n", id)
+	return nil
+}
+
+// generateIngressName generates an ingress name from hostname
+func generateIngressName(hostname string) string {
+	// Replace dots with dashes
+	name := strings.ReplaceAll(hostname, ".", "-")
+	name = strings.ToLower(name)
+
+	// Remove invalid characters (only allow a-z, 0-9, and -)
+	var cleaned strings.Builder
+	for _, r := range name {
+		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '-' {
+			cleaned.WriteRune(r)
+		}
+	}
+	name = cleaned.String()
+
+	// Trim leading/trailing dashes
+	name = strings.Trim(name, "-")
+
+	// Add random suffix
+	suffix := randomSuffix(4)
+	return fmt.Sprintf("%s-%s", name, suffix)
+}
diff --git a/apps/cli/pkg/cmd/lifecycle.go b/apps/cli/pkg/cmd/lifecycle.go
new file mode 100644
index 00000000..cc511596
--- /dev/null
+++ b/apps/cli/pkg/cmd/lifecycle.go
@@ -0,0 +1,178 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/urfave/cli/v3"
+)
+
+var stopCmd = cli.Command{
+	Name:            "stop",
+	Usage:           "Stop a running instance",
+	ArgsUsage:       "<instance>",
+	Action:          handleStop,
+	HideHelpCommand: true,
+}
+
+var startCmd = cli.Command{
+	Name:      "start",
+	Usage:     "Start a stopped instance",
+	ArgsUsage: "<instance>",
+	Flags: []cli.Flag{
+		&cli.StringSliceFlag{
+			Name:  "entrypoint",
+			Usage: "Override image entrypoint for this run (can be repeated for multiple args)",
+		},
+		&cli.StringSliceFlag{
+			Name:  "cmd",
+			Usage: "Override image CMD for this run (can be repeated for multiple args)",
+		},
+	},
+	Action:          handleStart,
+	HideHelpCommand: true,
+}
+
+var standbyCmd = cli.Command{
+	Name:            "standby",
+	Usage:           "Put an instance into standby (pause and snapshot)",
+	ArgsUsage:       "<instance>",
+	Action:          handleStandby,
+	HideHelpCommand: true,
+}
+
+var restoreCmd = cli.Command{
+	Name:            "restore",
+	Usage:           "Restore an instance from standby",
+	ArgsUsage:       "<instance>",
+	Action:          handleRestore,
+	HideHelpCommand: true,
+}
+
+func handleStop(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("instance name or ID required\nUsage: hypeman stop <instance>")
+	}
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	instanceID, err := ResolveInstance(ctx, &client, args[0])
+	if err != nil {
+		return err
+	}
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	fmt.Fprintf(os.Stderr, "Stopping %s...\n", args[0])
+
+	instance, err := client.Instances.Stop(ctx, instanceID, opts...)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "Stopped %s (state: %s)\n", instance.Name, instance.State)
+	return nil
+}
+
+func handleStart(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("instance name or ID required\nUsage: hypeman start <instance>")
+	}
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	instanceID, err := ResolveInstance(ctx, &client, args[0])
+	if err != nil {
+		return err
+	}
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	params := hypeman.InstanceStartParams{}
+
+	if entrypoint := cmd.StringSlice("entrypoint"); len(entrypoint) > 0 {
+		params.Entrypoint = entrypoint
+	}
+	if cmdArgs := cmd.StringSlice("cmd"); len(cmdArgs) > 0 {
+		params.Cmd = cmdArgs
+	}
+
+	fmt.Fprintf(os.Stderr, "Starting %s...\n", args[0])
+
+	instance, err := client.Instances.Start(ctx, instanceID, params, opts...)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "Started %s (state: %s)\n", instance.Name, instance.State)
+	return nil
+}
+
+func handleStandby(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("instance name or ID required\nUsage: hypeman standby <instance>")
+	}
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	instanceID, err := ResolveInstance(ctx, &client, args[0])
+	if err != nil {
+		return err
+	}
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	fmt.Fprintf(os.Stderr, "Putting %s into standby...\n", args[0])
+
+	instance, err := client.Instances.Standby(ctx, instanceID, opts...)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "Standby %s (state: %s)\n", instance.Name, instance.State)
+	return nil
+}
+
+func handleRestore(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("instance name or ID required\nUsage: hypeman restore <instance>")
+	}
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	instanceID, err := ResolveInstance(ctx, &client, args[0])
+	if err != nil {
+		return err
+	}
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	fmt.Fprintf(os.Stderr, "Restoring %s from standby...\n", args[0])
+
+	instance, err := client.Instances.Restore(ctx, instanceID, opts...)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "Restored %s (state: %s)\n", instance.Name, instance.State)
+	return nil
+}
diff --git a/apps/cli/pkg/cmd/logs.go b/apps/cli/pkg/cmd/logs.go
new file mode 100644
index 00000000..d461aae9
--- /dev/null
+++ b/apps/cli/pkg/cmd/logs.go
@@ -0,0 +1,80 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/urfave/cli/v3"
+)
+
+var logsCmd = cli.Command{
+	Name:      "logs",
+	Usage:     "Fetch the logs of an instance",
+	ArgsUsage: "<instance>",
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:    "follow",
+			Aliases: []string{"f"},
+			Usage:   "Follow log output",
+		},
+		&cli.IntFlag{
+			Name:  "tail",
+			Usage: "Number of lines to show from the end of the logs",
+			Value: 100,
+		},
+		&cli.StringFlag{
+			Name:    "source",
+			Aliases: []string{"s"},
+			Usage:   "Log source: app (default), vmm (Cloud Hypervisor), or hypeman (operations log)",
+		},
+	},
+	Action:          handleLogs,
+	HideHelpCommand: true,
+}
+
+func handleLogs(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("instance ID required\nUsage: hypeman logs [flags] <instance>")
+	}
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	// Resolve instance by ID, partial ID, or name
+	instanceID, err := ResolveInstance(ctx, &client, args[0])
+	if err != nil {
+		return err
+	}
+
+	params := hypeman.InstanceLogsParams{}
+	if cmd.IsSet("follow") {
+		params.Follow = hypeman.Opt(cmd.Bool("follow"))
+	}
+	if cmd.IsSet("tail") {
+		params.Tail = hypeman.Opt(int64(cmd.Int("tail")))
+	}
+	if cmd.IsSet("source") {
+		params.Source = hypeman.InstanceLogsParamsSource(cmd.String("source"))
+	}
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	stream := client.Instances.LogsStreaming(
+		ctx,
+		instanceID,
+		params,
+		opts...,
+	)
+	defer stream.Close()
+
+	for stream.Next() {
+		fmt.Println(stream.Current())
+	}
+
+	return stream.Err()
+}
diff --git a/apps/cli/pkg/cmd/ps.go b/apps/cli/pkg/cmd/ps.go
new file mode 100644
index 00000000..9f4c7bed
--- /dev/null
+++ b/apps/cli/pkg/cmd/ps.go
@@ -0,0 +1,122 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/urfave/cli/v3"
+)
+
+var psCmd = cli.Command{
+	Name:  "ps",
+	Usage: "List instances",
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:    "all",
+			Aliases: []string{"a"},
+			Usage:   "Show all instances (default: running only)",
+		},
+		&cli.BoolFlag{
+			Name:    "quiet",
+			Aliases: []string{"q"},
+			Usage:   "Only display instance IDs",
+		},
+	},
+	Action:          handlePs,
+	HideHelpCommand: true,
+}
+
+func handlePs(ctx context.Context, cmd *cli.Command) error {
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	instances, err := client.Instances.List(
+		ctx,
+		hypeman.InstanceListParams{},
+		opts...,
+	)
+	if err != nil {
+		return err
+	}
+
+	showAll := cmd.Bool("all")
+	quietMode := cmd.Bool("quiet")
+
+	// Filter instances
+	var filtered []hypeman.Instance
+	for _, inst := range *instances {
+		if showAll || inst.State == "Running" {
+			filtered = append(filtered, inst)
+		}
+	}
+
+	// Quiet mode - just IDs
+	if quietMode {
+		for _, inst := range filtered {
+			fmt.Println(inst.ID)
+		}
+		return nil
+	}
+
+	// Table output
+	if len(filtered) == 0 {
+		if !showAll {
+			fmt.Fprintln(os.Stderr, "No running instances. Use -a to show all.")
+		}
+		return nil
+	}
+
+	table := NewTableWriter(os.Stdout, "INSTANCE ID", "NAME", "IMAGE", "STATE", "GPU", "HV", "CREATED")
+	table.TruncOrder = []int{2, 4, 6, 1} // IMAGE first, then GPU, CREATED, NAME
+	for _, inst := range filtered {
+		table.AddRow(
+			TruncateID(inst.ID),
+			inst.Name,
+			inst.Image,
+			string(inst.State),
+			formatGPU(inst.GPU),
+			formatHypervisor(inst.Hypervisor),
+			FormatTimeAgo(inst.CreatedAt),
+		)
+	}
+	table.Render()
+
+	return nil
+}
+
+// formatGPU returns a short representation of GPU configuration
+func formatGPU(gpu hypeman.InstanceGPU) string {
+	// Check if GPU profile is set
+	if gpu.Profile != "" {
+		return gpu.Profile
+	}
+	// Check if mdev UUID is set (indicates vGPU without profile name shown)
+	if gpu.MdevUuid != "" {
+		return "vgpu"
+	}
+	return "-"
+}
+
+// formatHypervisor returns a short abbreviation for the hypervisor
+func formatHypervisor(hv hypeman.InstanceHypervisor) string {
+	switch hv {
+	case hypeman.InstanceHypervisorCloudHypervisor:
+		return "ch"
+	case hypeman.InstanceHypervisorQemu:
+		return "qemu"
+	case hypeman.InstanceHypervisorVz:
+		return "vz"
+	default:
+		if hv == "" {
+			return "ch" // default
+		}
+		return string(hv)
+	}
+}
diff --git a/apps/cli/pkg/cmd/ps_test.go b/apps/cli/pkg/cmd/ps_test.go
new file mode 100644
index 00000000..3e48553e
--- /dev/null
+++ b/apps/cli/pkg/cmd/ps_test.go
@@ -0,0 +1,80 @@
+package cmd
+
+import (
+	"testing"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFormatGPU(t *testing.T) {
+	tests := []struct {
+		name     string
+		gpu      hypeman.InstanceGPU
+		expected string
+	}{
+		{
+			name:     "no GPU",
+			gpu:      hypeman.InstanceGPU{},
+			expected: "-",
+		},
+		{
+			name: "vGPU with profile",
+			gpu: hypeman.InstanceGPU{
+				Profile:  "L40S-1Q",
+				MdevUuid: "abc-123",
+			},
+			expected: "L40S-1Q",
+		},
+		{
+			name: "vGPU without profile but with mdev",
+			gpu: hypeman.InstanceGPU{
+				MdevUuid: "abc-123",
+			},
+			expected: "vgpu",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := formatGPU(tt.gpu)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestFormatHypervisor(t *testing.T) {
+	tests := []struct {
+		name       string
+		hypervisor hypeman.InstanceHypervisor
+		expected   string
+	}{
+		{
+			name:       "cloud-hypervisor",
+			hypervisor: hypeman.InstanceHypervisorCloudHypervisor,
+			expected:   "ch",
+		},
+		{
+			name:       "qemu",
+			hypervisor: hypeman.InstanceHypervisorQemu,
+			expected:   "qemu",
+		},
+		{
+			name:       "empty defaults to ch",
+			hypervisor: "",
+			expected:   "ch",
+		},
+		{
+			name:       "unknown value",
+			hypervisor: hypeman.InstanceHypervisor("unknown"),
+			expected:   "unknown",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := formatHypervisor(tt.hypervisor)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
diff --git a/apps/cli/pkg/cmd/pull.go b/apps/cli/pkg/cmd/pull.go
new file mode 100644
index 00000000..cf5c6864
--- /dev/null
+++ b/apps/cli/pkg/cmd/pull.go
@@ -0,0 +1,59 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/urfave/cli/v3"
+)
+
+var pullCmd = cli.Command{
+	Name:      "pull",
+	Usage:     "Pull an image from a registry",
+	ArgsUsage: "<image>",
+	Action:    handlePull,
+	HideHelpCommand: true,
+}
+
+func handlePull(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("image reference required\nUsage: hypeman pull <image>")
+	}
+
+	image := args[0]
+
+	fmt.Fprintf(os.Stderr, "Pulling %s...\n", image)
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	params := hypeman.ImageNewParams{
+		Name: image,
+	}
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	result, err := client.Images.New(
+		ctx,
+		params,
+		opts...,
+	)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "Status: %s\n", result.Status)
+	if result.Digest != "" {
+		fmt.Fprintf(os.Stderr, "Digest: %s\n", result.Digest)
+	}
+	fmt.Fprintf(os.Stderr, "Image: %s\n", result.Name)
+
+	return nil
+}
+
diff --git a/apps/cli/pkg/cmd/push.go b/apps/cli/pkg/cmd/push.go
new file mode 100644
index 00000000..da8f30e1
--- /dev/null
+++ b/apps/cli/pkg/cmd/push.go
@@ -0,0 +1,102 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+
+	"github.com/google/go-containerregistry/pkg/authn"
+	"github.com/google/go-containerregistry/pkg/name"
+	"github.com/google/go-containerregistry/pkg/v1/daemon"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/urfave/cli/v3"
+)
+
+var pushCmd = cli.Command{
+	Name:            "push",
+	Usage:           "Push a local Docker image to hypeman",
+	ArgsUsage:       "<image> [target-name]",
+	Action:          handlePush,
+	HideHelpCommand: true,
+}
+
+func handlePush(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("image reference required\nUsage: hypeman push <image>")
+	}
+
+	sourceImage := args[0]
+	targetName := sourceImage
+	if len(args) > 1 {
+		targetName = args[1]
+	}
+
+	baseURL := resolveBaseURL(cmd)
+
+	parsedURL, err := url.Parse(baseURL)
+	if err != nil {
+		return fmt.Errorf("invalid base URL: %w", err)
+	}
+
+	registryHost := parsedURL.Host
+
+	fmt.Fprintf(os.Stderr, "Loading image %s from Docker...\n", sourceImage)
+
+	srcRef, err := name.ParseReference(sourceImage)
+	if err != nil {
+		return fmt.Errorf("invalid source image: %w", err)
+	}
+
+	img, err := daemon.Image(srcRef)
+	if err != nil {
+		return fmt.Errorf("load image: %w", err)
+	}
+
+	// Build target reference - server computes digest from manifest
+	targetRef := registryHost + "/" + strings.TrimPrefix(targetName, "/")
+	fmt.Fprintf(os.Stderr, "Pushing to %s...\n", targetRef)
+
+	dstRef, err := name.ParseReference(targetRef, name.Insecure)
+	if err != nil {
+		return fmt.Errorf("invalid target: %w", err)
+	}
+
+	token := resolveAPIKey()
+
+	// Use custom transport that always sends Basic auth header
+	transport := &authTransport{
+		base:  http.DefaultTransport,
+		token: token,
+	}
+
+	err = remote.Write(dstRef, img,
+		remote.WithContext(ctx),
+		remote.WithAuth(authn.Anonymous),
+		remote.WithTransport(transport),
+	)
+	if err != nil {
+		return fmt.Errorf("push failed: %w", err)
+	}
+
+	fmt.Fprintf(os.Stderr, "Pushed %s\n", targetRef)
+	return nil
+}
+
+// authTransport adds Basic auth header to all requests
+type authTransport struct {
+	base  http.RoundTripper
+	token string
+}
+
+func (t *authTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	if t.token != "" {
+		// Clone request to avoid modifying the original (RoundTripper contract)
+		req = req.Clone(req.Context())
+		req.Header.Set("Authorization", "Bearer "+t.token)
+	}
+	return t.base.RoundTrip(req)
+}
diff --git a/apps/cli/pkg/cmd/resourcecmd.go b/apps/cli/pkg/cmd/resourcecmd.go
new file mode 100644
index 00000000..de2cce4b
--- /dev/null
+++ b/apps/cli/pkg/cmd/resourcecmd.go
@@ -0,0 +1,288 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/tidwall/gjson"
+	"github.com/urfave/cli/v3"
+)
+
+var resourcesCmd = cli.Command{
+	Name:  "resources",
+	Usage: "Show server resource capacity and allocation status",
+	Description: `Display current host resource capacity, allocation status, and per-instance breakdown.
+
+Resources include CPU, memory, disk, network, and GPU (if available).
+Oversubscription ratios are applied to calculate effective limits.
+
+Examples:
+  # Show all resources (default table format)
+  hypeman resources
+
+  # Show resources as JSON
+  hypeman resources --format json
+
+  # Show only GPU information
+  hypeman resources --transform gpu`,
+	Action:          handleResources,
+	HideHelpCommand: true,
+}
+
+func handleResources(ctx context.Context, cmd *cli.Command) error {
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	var res []byte
+	opts = append(opts, option.WithResponseBodyInto(&res))
+	_, err := client.Resources.Get(ctx, opts...)
+	if err != nil {
+		return err
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	// If format is "auto", use our custom table format
+	if format == "auto" || format == "" {
+		return showResourcesTable(res)
+	}
+
+	// Otherwise use standard JSON display
+	obj := gjson.ParseBytes(res)
+	return ShowJSON(os.Stdout, "resources", obj, format, transform)
+}
+
+func showResourcesTable(data []byte) error {
+	obj := gjson.ParseBytes(data)
+
+	// Print resource summary table
+	fmt.Println("RESOURCE   CAPACITY       EFFECTIVE      ALLOCATED      AVAILABLE      OVERSUB")
+	fmt.Println(strings.Repeat("-", 75))
+
+	printResourceRow("cpu", obj.Get("cpu"), "cores")
+	printResourceRow("memory", obj.Get("memory"), "bytes")
+	printResourceRow("disk", obj.Get("disk"), "bytes")
+	printResourceRow("disk_io", obj.Get("disk_io"), "disk_bps")
+	printResourceRow("network", obj.Get("network"), "bps")
+
+	// Print GPU information if available
+	gpu := obj.Get("gpu")
+	if gpu.Exists() && gpu.Type != gjson.Null {
+		fmt.Println()
+		printGPUInfo(gpu)
+	}
+
+	// Print disk breakdown if available
+	diskBreakdown := obj.Get("disk_breakdown")
+	if diskBreakdown.Exists() {
+		fmt.Println()
+		fmt.Println("DISK BREAKDOWN:")
+		if v := diskBreakdown.Get("images_bytes").Int(); v > 0 {
+			fmt.Printf("  Images:     %s\n", formatBytes(v))
+		}
+		if v := diskBreakdown.Get("volumes_bytes").Int(); v > 0 {
+			fmt.Printf("  Volumes:    %s\n", formatBytes(v))
+		}
+		if v := diskBreakdown.Get("overlays_bytes").Int(); v > 0 {
+			fmt.Printf("  Overlays:   %s\n", formatBytes(v))
+		}
+		if v := diskBreakdown.Get("oci_cache_bytes").Int(); v > 0 {
+			fmt.Printf("  OCI Cache:  %s\n", formatBytes(v))
+		}
+	}
+
+	// Print allocations if any
+	allocations := obj.Get("allocations")
+	if allocations.Exists() && allocations.IsArray() && len(allocations.Array()) > 0 {
+		fmt.Println()
+		fmt.Println("ALLOCATIONS:")
+		table := NewTableWriter(os.Stdout, "INSTANCE", "CPU", "MEMORY", "DISK", "DISK I/O", "NET DOWN", "NET UP")
+		table.TruncOrder = []int{0} // Only truncate INSTANCE name if needed
+		allocations.ForEach(func(key, value gjson.Result) bool {
+			name := value.Get("instance_name").String()
+			cpu := fmt.Sprintf("%d", value.Get("cpu").Int())
+			mem := formatBytes(value.Get("memory_bytes").Int())
+			disk := formatBytes(value.Get("disk_bytes").Int())
+			diskIO := formatDiskBps(value.Get("disk_io_bps").Int())
+			netDown := formatBps(value.Get("network_download_bps").Int())
+			netUp := formatBps(value.Get("network_upload_bps").Int())
+			table.AddRow(name, cpu, mem, disk, diskIO, netDown, netUp)
+			return true
+		})
+		table.Render()
+	}
+
+	return nil
+}
+
+func printResourceRow(name string, res gjson.Result, unit string) {
+	if !res.Exists() {
+		return
+	}
+
+	capacity := res.Get("capacity").Int()
+	effective := res.Get("effective_limit").Int()
+	allocated := res.Get("allocated").Int()
+	available := res.Get("available").Int()
+	ratio := res.Get("oversub_ratio").Float()
+
+	var capStr, effStr, allocStr, availStr string
+
+	switch unit {
+	case "bytes":
+		capStr = formatBytes(capacity)
+		effStr = formatBytes(effective)
+		allocStr = formatBytes(allocated)
+		availStr = formatBytes(available)
+	case "bps":
+		capStr = formatBps(capacity)
+		effStr = formatBps(effective)
+		allocStr = formatBps(allocated)
+		availStr = formatBps(available)
+	case "disk_bps":
+		capStr = formatDiskBps(capacity)
+		effStr = formatDiskBps(effective)
+		allocStr = formatDiskBps(allocated)
+		availStr = formatDiskBps(available)
+	default:
+		capStr = fmt.Sprintf("%d", capacity)
+		effStr = fmt.Sprintf("%d", effective)
+		allocStr = fmt.Sprintf("%d", allocated)
+		availStr = fmt.Sprintf("%d", available)
+	}
+
+	ratioStr := fmt.Sprintf("%.1fx", ratio)
+	if ratio == 1.0 {
+		ratioStr = "1.0x"
+	}
+
+	fmt.Printf("%-10s %-14s %-14s %-14s %-14s %s\n", name, capStr, effStr, allocStr, availStr, ratioStr)
+}
+
+func printGPUInfo(gpu gjson.Result) {
+	mode := gpu.Get("mode").String()
+	totalSlots := gpu.Get("total_slots").Int()
+	usedSlots := gpu.Get("used_slots").Int()
+
+	fmt.Printf("GPU: %s mode (%d/%d slots used)\n", mode, usedSlots, totalSlots)
+
+	if mode == "vgpu" {
+		profiles := gpu.Get("profiles")
+		if profiles.Exists() && profiles.IsArray() && len(profiles.Array()) > 0 {
+			fmt.Println("PROFILE        VRAM       AVAILABLE")
+			fmt.Println(strings.Repeat("-", 40))
+			profiles.ForEach(func(key, value gjson.Result) bool {
+				name := value.Get("name").String()
+				framebufferMB := value.Get("framebuffer_mb").Int()
+				available := value.Get("available").Int()
+				vram := formatMB(framebufferMB)
+				fmt.Printf("%-14s %-10s %d\n", name, vram, available)
+				return true
+			})
+		}
+	} else if mode == "passthrough" {
+		devices := gpu.Get("devices")
+		if devices.Exists() && devices.IsArray() && len(devices.Array()) > 0 {
+			fmt.Println("DEVICE                         AVAILABLE")
+			fmt.Println(strings.Repeat("-", 45))
+			devices.ForEach(func(key, value gjson.Result) bool {
+				name := value.Get("name").String()
+				available := value.Get("available").Bool()
+				availStr := "no"
+				if available {
+					availStr = "yes"
+				}
+				fmt.Printf("%-30s %s\n", name, availStr)
+				return true
+			})
+		}
+	}
+}
+
+func formatBytes(b int64) string {
+	const (
+		KB = 1024
+		MB = KB * 1024
+		GB = MB * 1024
+		TB = GB * 1024
+	)
+
+	switch {
+	case b >= TB:
+		return fmt.Sprintf("%.1f TB", float64(b)/TB)
+	case b >= GB:
+		return fmt.Sprintf("%.1f GB", float64(b)/GB)
+	case b >= MB:
+		return fmt.Sprintf("%.1f MB", float64(b)/MB)
+	case b >= KB:
+		return fmt.Sprintf("%.1f KB", float64(b)/KB)
+	default:
+		return fmt.Sprintf("%d B", b)
+	}
+}
+
+func formatMB(mb int64) string {
+	if mb >= 1024 {
+		return fmt.Sprintf("%.1f GB", float64(mb)/1024)
+	}
+	return fmt.Sprintf("%d MB", mb)
+}
+
+// formatBps converts bytes per second (as returned by the API) to a human-readable
+// bits per second string (Kbps, Mbps, Gbps). The API stores bandwidth in bytes/sec,
+// but users specify and expect to see bandwidth in bits/sec (the standard unit for
+// network bandwidth).
+func formatBps(bytesPerSec int64) string {
+	const (
+		Kbps = 1000
+		Mbps = Kbps * 1000
+		Gbps = Mbps * 1000
+	)
+
+	// Convert bytes/sec to bits/sec (multiply by 8)
+	bps := bytesPerSec * 8
+
+	switch {
+	case bps >= Gbps:
+		return fmt.Sprintf("%.1f Gbps", float64(bps)/Gbps)
+	case bps >= Mbps:
+		return fmt.Sprintf("%.0f Mbps", float64(bps)/Mbps)
+	case bps >= Kbps:
+		return fmt.Sprintf("%.0f Kbps", float64(bps)/Kbps)
+	default:
+		return fmt.Sprintf("%d bps", bps)
+	}
+}
+
+// formatDiskBps formats disk I/O bandwidth in bytes per second to a human-readable
+// string (KB/s, MB/s, GB/s). Unlike network bandwidth which uses bits, disk I/O
+// is conventionally displayed in bytes per second.
+func formatDiskBps(bytesPerSec int64) string {
+	const (
+		KBps = 1000
+		MBps = KBps * 1000
+		GBps = MBps * 1000
+	)
+
+	switch {
+	case bytesPerSec >= GBps:
+		return fmt.Sprintf("%.1f GB/s", float64(bytesPerSec)/GBps)
+	case bytesPerSec >= MBps:
+		return fmt.Sprintf("%.0f MB/s", float64(bytesPerSec)/MBps)
+	case bytesPerSec >= KBps:
+		return fmt.Sprintf("%.0f KB/s", float64(bytesPerSec)/KBps)
+	case bytesPerSec == 0:
+		return "-"
+	default:
+		return fmt.Sprintf("%d B/s", bytesPerSec)
+	}
+}
diff --git a/apps/cli/pkg/cmd/resourcecmd_test.go b/apps/cli/pkg/cmd/resourcecmd_test.go
new file mode 100644
index 00000000..4882adbd
--- /dev/null
+++ b/apps/cli/pkg/cmd/resourcecmd_test.go
@@ -0,0 +1,128 @@
+package cmd
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFormatBytes(t *testing.T) {
+	tests := []struct {
+		bytes    int64
+		expected string
+	}{
+		{0, "0 B"},
+		{100, "100 B"},
+		{1024, "1.0 KB"},
+		{1536, "1.5 KB"},
+		{1048576, "1.0 MB"},
+		{1073741824, "1.0 GB"},
+		{1099511627776, "1.0 TB"},
+		{1649267441664, "1.5 TB"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.expected, func(t *testing.T) {
+			result := formatBytes(tt.bytes)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestFormatMB(t *testing.T) {
+	tests := []struct {
+		mb       int64
+		expected string
+	}{
+		{512, "512 MB"},
+		{1024, "1.0 GB"},
+		{2048, "2.0 GB"},
+		{6144, "6.0 GB"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.expected, func(t *testing.T) {
+			result := formatMB(tt.mb)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestFormatBps(t *testing.T) {
+	// The API returns network_download_bps in BYTES per second
+	// The CLI should convert to bits and display as Mbps/Gbps
+	// Formula: bytes/sec * 8 = bits/sec
+	tests := []struct {
+		name        string
+		bytesPerSec int64
+		expected    string
+	}{
+		// 30 Mbps = 30,000,000 bits/sec = 3,750,000 bytes/sec
+		// This is the user's reported bug: they set 30Mbps, API stores 3750000 bytes/sec,
+		// CLI was incorrectly showing "4 Mbps" instead of "30 Mbps"
+		{"30Mbps bandwidth limit", 3750000, "30 Mbps"},
+
+		// 1 Gbps = 1,000,000,000 bits/sec = 125,000,000 bytes/sec
+		{"1Gbps bandwidth limit", 125000000, "1.0 Gbps"},
+
+		// 100 Mbps = 100,000,000 bits/sec = 12,500,000 bytes/sec
+		{"100Mbps bandwidth limit", 12500000, "100 Mbps"},
+
+		// 500 Mbps = 500,000,000 bits/sec = 62,500,000 bytes/sec
+		{"500Mbps bandwidth limit", 62500000, "500 Mbps"},
+
+		// 10 Gbps = 10,000,000,000 bits/sec = 1,250,000,000 bytes/sec
+		{"10Gbps bandwidth limit", 1250000000, "10.0 Gbps"},
+
+		// Small values: 1 Mbps = 1,000,000 bits/sec = 125,000 bytes/sec
+		{"1Mbps bandwidth limit", 125000, "1 Mbps"},
+
+		// Very small: 100 Kbps = 100,000 bits/sec = 12,500 bytes/sec
+		{"100Kbps bandwidth limit", 12500, "100 Kbps"},
+
+		// Tiny: 8000 bits/sec = 1000 bytes/sec
+		{"8Kbps bandwidth limit", 1000, "8 Kbps"},
+
+		// Edge case: 0 bytes/sec
+		{"zero bandwidth", 0, "0 bps"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := formatBps(tt.bytesPerSec)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestFormatDiskBps(t *testing.T) {
+	// Disk I/O is displayed in bytes/sec (KB/s, MB/s, GB/s), not bits/sec
+	tests := []struct {
+		name        string
+		bytesPerSec int64
+		expected    string
+	}{
+		// Common disk I/O limits
+		{"100 MB/s SSD limit", 100000000, "100 MB/s"},
+		{"500 MB/s NVMe limit", 500000000, "500 MB/s"},
+		{"1 GB/s high-perf limit", 1000000000, "1.0 GB/s"},
+		{"3.5 GB/s NVMe Gen4", 3500000000, "3.5 GB/s"},
+
+		// Smaller values
+		{"50 MB/s HDD limit", 50000000, "50 MB/s"},
+		{"10 MB/s throttled", 10000000, "10 MB/s"},
+		{"1 MB/s minimal", 1000000, "1 MB/s"},
+		{"500 KB/s very slow", 500000, "500 KB/s"},
+
+		// Edge cases
+		{"zero (no limit or disabled)", 0, "-"},
+		{"tiny value", 500, "500 B/s"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := formatDiskBps(tt.bytesPerSec)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
diff --git a/apps/cli/pkg/cmd/rm.go b/apps/cli/pkg/cmd/rm.go
new file mode 100644
index 00000000..68b1ee91
--- /dev/null
+++ b/apps/cli/pkg/cmd/rm.go
@@ -0,0 +1,122 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/urfave/cli/v3"
+)
+
+var rmCmd = cli.Command{
+	Name:      "rm",
+	Usage:     "Remove one or more instances",
+	ArgsUsage: "[instance...]",
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:    "force",
+			Aliases: []string{"f"},
+			Usage:   "Force removal of running instances",
+		},
+		&cli.BoolFlag{
+			Name:  "all",
+			Usage: "Remove all instances (stopped only, unless --force)",
+		},
+	},
+	Action:          handleRm,
+	HideHelpCommand: true,
+}
+
+func handleRm(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	force := cmd.Bool("force")
+	all := cmd.Bool("all")
+
+	if !all && len(args) < 1 {
+		return fmt.Errorf("instance ID required\nUsage: hypeman rm [flags] <instance> [instance...]\n       hypeman rm --all [--force]")
+	}
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	// If --all, get all instance IDs
+	var identifiers []string
+	if all {
+		instances, err := client.Instances.List(ctx, hypeman.InstanceListParams{})
+		if err != nil {
+			return fmt.Errorf("failed to list instances: %w", err)
+		}
+		for _, inst := range *instances {
+			identifiers = append(identifiers, inst.ID)
+		}
+		if len(identifiers) == 0 {
+			fmt.Println("No instances to remove")
+			return nil
+		}
+	} else {
+		identifiers = args
+	}
+
+	var lastErr error
+	for _, identifier := range identifiers {
+		// Resolve instance by ID, partial ID, or name (skip if --all since we have full IDs)
+		var instanceID string
+		var err error
+		if all {
+			instanceID = identifier
+		} else {
+			instanceID, err = ResolveInstance(ctx, &client, identifier)
+			if err != nil {
+				fmt.Printf("Error: %v\n", err)
+				lastErr = err
+				continue
+			}
+		}
+
+		// Build debug options once
+		var opts []option.RequestOption
+		if cmd.Root().Bool("debug") {
+			opts = append(opts, debugMiddlewareOption)
+		}
+
+		// Check instance state if not forcing
+		if !force {
+			inst, err := client.Instances.Get(
+				ctx,
+				instanceID,
+				opts...,
+			)
+			if err != nil {
+				fmt.Printf("Error: failed to get instance %s: %v\n", instanceID, err)
+				lastErr = err
+				continue
+			}
+
+			if inst.State == "Running" {
+				if all {
+					// Silently skip running instances when using --all without --force
+					continue
+				}
+				fmt.Printf("Error: cannot remove running instance %s. Stop it first or use --force\n", instanceID)
+				lastErr = fmt.Errorf("instance is running")
+				continue
+			}
+		}
+
+		// Delete the instance
+		err = client.Instances.Delete(
+			ctx,
+			instanceID,
+			opts...,
+		)
+		if err != nil {
+			fmt.Printf("Error: failed to remove instance %s: %v\n", instanceID, err)
+			lastErr = err
+			continue
+		}
+
+		fmt.Println(instanceID)
+	}
+
+	return lastErr
+}
diff --git a/apps/cli/pkg/cmd/run.go b/apps/cli/pkg/cmd/run.go
new file mode 100644
index 00000000..771d5571
--- /dev/null
+++ b/apps/cli/pkg/cmd/run.go
@@ -0,0 +1,441 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/urfave/cli/v3"
+)
+
+var runCmd = cli.Command{
+	Name:      "run",
+	Usage:     "Create and start a new instance from an image",
+	ArgsUsage: "<image>",
+	Description: `Create and start a new virtual machine instance from an OCI image.
+
+Examples:
+  # Basic run
+  hypeman run myimage:latest
+
+  # Run with custom resources
+  hypeman run --cpus 4 --memory 8GB myimage:latest
+
+  # Run with vGPU
+  hypeman run --gpu-profile L40S-1Q myimage:latest
+
+  # Run with GPU passthrough
+  hypeman run --device my-gpu myimage:latest
+
+  # Run with QEMU hypervisor
+  hypeman run --hypervisor qemu myimage:latest
+
+  # Run with bandwidth limits
+  hypeman run --bandwidth-down 1Gbps --bandwidth-up 500Mbps myimage:latest`,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:  "name",
+			Usage: "Instance name (auto-generated if not provided)",
+		},
+		&cli.StringSliceFlag{
+			Name:    "env",
+			Aliases: []string{"e"},
+			Usage:   "Set environment variable (KEY=VALUE, can be repeated)",
+		},
+		&cli.StringFlag{
+			Name:  "memory",
+			Usage: `Base memory size (e.g., "1GB", "512MB")`,
+			Value: "1GB",
+		},
+		&cli.IntFlag{
+			Name:  "cpus",
+			Usage: "Number of virtual CPUs",
+			Value: 2,
+		},
+		&cli.StringFlag{
+			Name:  "overlay-size",
+			Usage: `Writable overlay disk size (e.g., "10GB")`,
+			Value: "10GB",
+		},
+		&cli.StringFlag{
+			Name:  "hotplug-size",
+			Usage: `Additional memory for hotplug (e.g., "3GB")`,
+			Value: "3GB",
+		},
+		&cli.BoolFlag{
+			Name:  "network",
+			Usage: "Enable network (default: true)",
+			Value: true,
+		},
+		// GPU/vGPU flags
+		&cli.StringFlag{
+			Name:  "gpu-profile",
+			Usage: `vGPU profile name (e.g., "L40S-1Q", "L40S-2Q")`,
+		},
+		&cli.StringSliceFlag{
+			Name:  "device",
+			Usage: "Device ID or name for PCI/GPU passthrough (can be repeated)",
+		},
+		// Hypervisor flag
+		&cli.StringFlag{
+			Name:  "hypervisor",
+			Usage: `Hypervisor to use: "cloud-hypervisor", "qemu", or "vz"`,
+		},
+		// Resource limit flags
+		&cli.StringFlag{
+			Name:  "disk-io",
+			Usage: `Disk I/O rate limit (e.g., "100MB/s", "500MB/s")`,
+		},
+		&cli.StringFlag{
+			Name:  "bandwidth-down",
+			Usage: `Download bandwidth limit (e.g., "1Gbps", "125MB/s")`,
+		},
+		&cli.StringFlag{
+			Name:  "bandwidth-up",
+			Usage: `Upload bandwidth limit (e.g., "1Gbps", "125MB/s")`,
+		},
+		// Boot option flags
+		&cli.BoolFlag{
+			Name:  "skip-guest-agent",
+			Usage: "Skip guest-agent installation during boot (exec and stat APIs will not work)",
+		},
+		&cli.BoolFlag{
+			Name:  "skip-kernel-headers",
+			Usage: "Skip kernel headers installation during boot for faster startup (DKMS will not work)",
+		},
+		// Entrypoint and CMD overrides
+		&cli.StringSliceFlag{
+			Name:  "entrypoint",
+			Usage: "Override image entrypoint (can be repeated for multiple args)",
+		},
+		&cli.StringSliceFlag{
+			Name:  "cmd",
+			Usage: "Override image CMD (can be repeated for multiple args)",
+		},
+		// Metadata flags
+		&cli.StringSliceFlag{
+			Name:    "metadata",
+			Aliases: []string{"l"},
+			Usage:   "Set metadata key-value pair (KEY=VALUE, can be repeated)",
+		},
+		// Volume mount flags
+		&cli.StringSliceFlag{
+			Name:    "volume",
+			Aliases: []string{"v"},
+			Usage:   `Attach volume at creation (format: volume-id:/mount/path[:ro[:overlay=SIZE]]). Can be repeated.`,
+		},
+	},
+	Action:          handleRun,
+	HideHelpCommand: true,
+}
+
+func handleRun(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("image reference required\nUsage: hypeman run [flags] <image>")
+	}
+
+	image := args[0]
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	// Check if image exists and is ready
+	// URL-encode the image name to handle slashes (e.g., docker.io/library/nginx:latest)
+	imgInfo, err := client.Images.Get(ctx, url.PathEscape(image))
+	if err != nil {
+		// Image not found, try to pull it
+		var apiErr *hypeman.Error
+		if ok := isNotFoundError(err, &apiErr); ok {
+			fmt.Fprintf(os.Stderr, "Image not found locally. Pulling %s...\n", image)
+			imgInfo, err = client.Images.New(ctx, hypeman.ImageNewParams{
+				Name: image,
+			})
+			if err != nil {
+				return fmt.Errorf("failed to pull image: %w", err)
+			}
+		} else {
+			return fmt.Errorf("failed to check image: %w", err)
+		}
+	}
+
+	// Wait for image to be ready (build is asynchronous)
+	if err := waitForImageReady(ctx, &client, imgInfo); err != nil {
+		return err
+	}
+
+	// Generate name if not provided
+	name := cmd.String("name")
+	if name == "" {
+		name = GenerateInstanceName(image)
+	}
+
+	// Parse environment variables
+	env := make(map[string]string)
+	for _, e := range cmd.StringSlice("env") {
+		parts := strings.SplitN(e, "=", 2)
+		if len(parts) == 2 {
+			env[parts[0]] = parts[1]
+		} else {
+			fmt.Fprintf(os.Stderr, "Warning: ignoring malformed env var: %s\n", e)
+		}
+	}
+
+	// Build instance params
+	params := hypeman.InstanceNewParams{
+		Image:       image,
+		Name:        name,
+		Vcpus:       hypeman.Opt(int64(cmd.Int("cpus"))),
+		Size:        hypeman.Opt(cmd.String("memory")),
+		OverlaySize: hypeman.Opt(cmd.String("overlay-size")),
+		HotplugSize: hypeman.Opt(cmd.String("hotplug-size")),
+	}
+
+	if len(env) > 0 {
+		params.Env = env
+	}
+
+	// Network configuration
+	networkEnabled := cmd.Bool("network")
+	bandwidthDown := cmd.String("bandwidth-down")
+	bandwidthUp := cmd.String("bandwidth-up")
+
+	if !networkEnabled || bandwidthDown != "" || bandwidthUp != "" {
+		params.Network = hypeman.InstanceNewParamsNetwork{
+			Enabled: hypeman.Opt(networkEnabled),
+		}
+		if bandwidthDown != "" {
+			params.Network.BandwidthDownload = hypeman.Opt(bandwidthDown)
+		}
+		if bandwidthUp != "" {
+			params.Network.BandwidthUpload = hypeman.Opt(bandwidthUp)
+		}
+	}
+
+	// GPU configuration
+	gpuProfile := cmd.String("gpu-profile")
+	if gpuProfile != "" {
+		params.GPU = hypeman.InstanceNewParamsGPU{
+			Profile: hypeman.Opt(gpuProfile),
+		}
+	}
+
+	// Device passthrough
+	devices := cmd.StringSlice("device")
+	if len(devices) > 0 {
+		params.Devices = devices
+	}
+
+	// Hypervisor selection
+	hypervisor := cmd.String("hypervisor")
+	if hypervisor != "" {
+		switch hypervisor {
+		case "cloud-hypervisor", "ch":
+			params.Hypervisor = hypeman.InstanceNewParamsHypervisorCloudHypervisor
+		case "qemu":
+			params.Hypervisor = hypeman.InstanceNewParamsHypervisorQemu
+		case "vz":
+			params.Hypervisor = hypeman.InstanceNewParamsHypervisorVz
+		default:
+			return fmt.Errorf("invalid hypervisor: %s (must be 'cloud-hypervisor', 'qemu', or 'vz')", hypervisor)
+		}
+	}
+
+	// Disk I/O limit
+	diskIO := cmd.String("disk-io")
+	if diskIO != "" {
+		params.DiskIoBps = hypeman.Opt(diskIO)
+	}
+
+	// Boot options
+	if cmd.IsSet("skip-guest-agent") {
+		params.SkipGuestAgent = hypeman.Opt(cmd.Bool("skip-guest-agent"))
+	}
+	if cmd.IsSet("skip-kernel-headers") {
+		params.SkipKernelHeaders = hypeman.Opt(cmd.Bool("skip-kernel-headers"))
+	}
+
+	// Entrypoint and CMD overrides
+	if entrypoint := cmd.StringSlice("entrypoint"); len(entrypoint) > 0 {
+		params.Entrypoint = entrypoint
+	}
+	if cmdArgs := cmd.StringSlice("cmd"); len(cmdArgs) > 0 {
+		params.Cmd = cmdArgs
+	}
+
+	// Metadata
+	metadataSpecs := cmd.StringSlice("metadata")
+	if len(metadataSpecs) > 0 {
+		metadata := make(map[string]string)
+		for _, m := range metadataSpecs {
+			parts := strings.SplitN(m, "=", 2)
+			if len(parts) == 2 {
+				metadata[parts[0]] = parts[1]
+			} else {
+				fmt.Fprintf(os.Stderr, "Warning: ignoring malformed metadata: %s\n", m)
+			}
+		}
+		params.Metadata = metadata
+	}
+
+	// Volume mounts
+	volumeSpecs := cmd.StringSlice("volume")
+	if len(volumeSpecs) > 0 {
+		var mounts []hypeman.VolumeMountParam
+		for _, spec := range volumeSpecs {
+			mount, err := parseVolumeSpec(spec)
+			if err != nil {
+				return fmt.Errorf("invalid volume spec %q: %w", spec, err)
+			}
+			mounts = append(mounts, mount)
+		}
+		params.Volumes = mounts
+	}
+
+	fmt.Fprintf(os.Stderr, "Creating instance %s...\n", name)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	result, err := client.Instances.New(
+		ctx,
+		params,
+		opts...,
+	)
+	if err != nil {
+		return err
+	}
+
+	// Output instance ID (useful for scripting)
+	fmt.Println(result.ID)
+
+	return nil
+}
+
+// isNotFoundError checks if err is a 404 not found error
+func isNotFoundError(err error, target **hypeman.Error) bool {
+	if apiErr, ok := err.(*hypeman.Error); ok {
+		*target = apiErr
+		return apiErr.Response != nil && apiErr.Response.StatusCode == 404
+	}
+	return false
+}
+
+// waitForImageReady polls image status until it becomes ready or failed
+func waitForImageReady(ctx context.Context, client *hypeman.Client, img *hypeman.Image) error {
+	if img.Status == hypeman.ImageStatusReady {
+		return nil
+	}
+	if img.Status == hypeman.ImageStatusFailed {
+		if img.Error != "" {
+			return fmt.Errorf("image build failed: %s", img.Error)
+		}
+		return fmt.Errorf("image build failed")
+	}
+
+	// Poll until ready using the normalized image name from the API response
+	ticker := time.NewTicker(300 * time.Millisecond)
+	defer ticker.Stop()
+
+	// Show initial status
+	showImageStatus(img)
+
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-ticker.C:
+			updated, err := client.Images.Get(ctx, url.PathEscape(img.Name))
+			if err != nil {
+				return fmt.Errorf("failed to check image status: %w", err)
+			}
+
+			// Show status update if changed
+			if updated.Status != img.Status {
+				showImageStatus(updated)
+				img = updated
+			}
+
+			switch updated.Status {
+			case hypeman.ImageStatusReady:
+				return nil
+			case hypeman.ImageStatusFailed:
+				if updated.Error != "" {
+					return fmt.Errorf("image build failed: %s", updated.Error)
+				}
+				return fmt.Errorf("image build failed")
+			}
+		}
+	}
+}
+
+// parseVolumeSpec parses a volume mount specification string.
+// Format: volume-id:/mount/path[:ro[:overlay=SIZE]]
+// Examples:
+//
+//	my-vol:/data
+//	my-vol:/data:ro
+//	my-vol:/data:ro:overlay=10GB
+func parseVolumeSpec(spec string) (hypeman.VolumeMountParam, error) {
+	parts := strings.SplitN(spec, ":", 2)
+	if len(parts) < 2 {
+		return hypeman.VolumeMountParam{}, fmt.Errorf("expected format volume-id:/mount/path[:ro[:overlay=SIZE]]")
+	}
+
+	volumeID := parts[0]
+	if volumeID == "" {
+		return hypeman.VolumeMountParam{}, fmt.Errorf("volume ID cannot be empty")
+	}
+
+	remaining := parts[1]
+	// Split remaining by colon to get mount path and options
+	segments := strings.Split(remaining, ":")
+	mountPath := segments[0]
+	if mountPath == "" {
+		return hypeman.VolumeMountParam{}, fmt.Errorf("mount path cannot be empty")
+	}
+
+	mount := hypeman.VolumeMountParam{
+		VolumeID:  volumeID,
+		MountPath: mountPath,
+	}
+
+	// Parse optional flags
+	for _, seg := range segments[1:] {
+		switch {
+		case seg == "ro":
+			mount.Readonly = hypeman.Opt(true)
+		case strings.HasPrefix(seg, "overlay="):
+			mount.Overlay = hypeman.Opt(true)
+			mount.OverlaySize = hypeman.Opt(strings.TrimPrefix(seg, "overlay="))
+		default:
+			return hypeman.VolumeMountParam{}, fmt.Errorf("unknown option %q", seg)
+		}
+	}
+
+	return mount, nil
+}
+
+// showImageStatus prints image build status to stderr
+func showImageStatus(img *hypeman.Image) {
+	switch img.Status {
+	case hypeman.ImageStatusPending:
+		if img.QueuePosition > 0 {
+			fmt.Fprintf(os.Stderr, "Queued (position %d)...\n", img.QueuePosition)
+		} else {
+			fmt.Fprintf(os.Stderr, "Queued...\n")
+		}
+	case hypeman.ImageStatusPulling:
+		fmt.Fprintf(os.Stderr, "Pulling image...\n")
+	case hypeman.ImageStatusConverting:
+		fmt.Fprintf(os.Stderr, "Converting to disk image...\n")
+	case hypeman.ImageStatusReady:
+		fmt.Fprintf(os.Stderr, "Image ready.\n")
+	}
+}
diff --git a/apps/cli/pkg/cmd/version.go b/apps/cli/pkg/cmd/version.go
new file mode 100644
index 00000000..f55a0991
--- /dev/null
+++ b/apps/cli/pkg/cmd/version.go
@@ -0,0 +1,61 @@
+package cmd
+
+import (
+	"regexp"
+	"runtime/debug"
+)
+
+// version can be overridden at build time via ldflags:
+//
+//	-X github.com/kernel/hypeman-cli/pkg/cmd.version=1.2.3
+var version string
+
+// semverTag matches clean semver tags like v1.2.3 or v0.9.5 (no prerelease/pseudo-version suffix).
+var semverTag = regexp.MustCompile(`^v\d+\.\d+\.\d+$`)
+
+// Version is the CLI version string, resolved at init time.
+var Version = resolveVersion()
+
+func resolveVersion() string {
+	// 1. ldflags override (GoReleaser sets this)
+	if version != "" {
+		return version
+	}
+
+	// 2. Build info from Go toolchain
+	info, ok := debug.ReadBuildInfo()
+	if !ok {
+		return "dev"
+	}
+
+	// 3. VCS revision from git (embedded automatically by `go build`)
+	var revision string
+	var dirty bool
+	for _, s := range info.Settings {
+		switch s.Key {
+		case "vcs.revision":
+			revision = s.Value
+		case "vcs.modified":
+			dirty = s.Value == "true"
+		}
+	}
+
+	// Only use module version if it's a clean semver tag (e.g. v1.2.3),
+	// not a pseudo-version like v0.9.5-0.20260211212111-7ef5ed6df05d.
+	if v := info.Main.Version; semverTag.MatchString(v) {
+		return v
+	}
+
+	if revision != "" {
+		short := revision
+		if len(short) > 7 {
+			short = short[:7]
+		}
+		if dirty {
+			return short + "-dirty"
+		}
+		return short
+	}
+
+	return "dev"
+}
diff --git a/apps/cli/pkg/cmd/volumecmd.go b/apps/cli/pkg/cmd/volumecmd.go
new file mode 100644
index 00000000..74767789
--- /dev/null
+++ b/apps/cli/pkg/cmd/volumecmd.go
@@ -0,0 +1,349 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/tidwall/gjson"
+	"github.com/urfave/cli/v3"
+)
+
+var volumeCmd = cli.Command{
+	Name:  "volume",
+	Usage: "Manage volumes",
+	Commands: []*cli.Command{
+		&volumeCreateCmd,
+		&volumeListCmd,
+		&volumeGetCmd,
+		&volumeDeleteCmd,
+		&volumeAttachCmd,
+		&volumeDetachCmd,
+	},
+	HideHelpCommand: true,
+}
+
+var volumeCreateCmd = cli.Command{
+	Name:  "create",
+	Usage: "Create a new volume",
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:     "name",
+			Usage:    "Volume name",
+			Required: true,
+		},
+		&cli.IntFlag{
+			Name:     "size",
+			Usage:    "Size in gigabytes",
+			Required: true,
+		},
+		&cli.StringFlag{
+			Name:  "id",
+			Usage: "Optional custom identifier (auto-generated if not provided)",
+		},
+	},
+	Action:          handleVolumeCreate,
+	HideHelpCommand: true,
+}
+
+var volumeListCmd = cli.Command{
+	Name:  "list",
+	Usage: "List volumes",
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:    "quiet",
+			Aliases: []string{"q"},
+			Usage:   "Only display volume IDs",
+		},
+	},
+	Action:          handleVolumeList,
+	HideHelpCommand: true,
+}
+
+var volumeGetCmd = cli.Command{
+	Name:      "get",
+	Usage:     "Get volume details",
+	ArgsUsage: "<id>",
+	Action:    handleVolumeGet,
+	HideHelpCommand: true,
+}
+
+var volumeDeleteCmd = cli.Command{
+	Name:      "delete",
+	Aliases:   []string{"rm"},
+	Usage:     "Delete a volume",
+	ArgsUsage: "<id>",
+	Action:    handleVolumeDelete,
+	HideHelpCommand: true,
+}
+
+var volumeAttachCmd = cli.Command{
+	Name:      "attach",
+	Usage:     "Attach a volume to an instance",
+	ArgsUsage: "<volume-id>",
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:     "instance",
+			Aliases:  []string{"i"},
+			Usage:    "Instance ID or name",
+			Required: true,
+		},
+		&cli.StringFlag{
+			Name:     "mount-path",
+			Usage:    "Path where volume should be mounted in the guest",
+			Required: true,
+		},
+		&cli.BoolFlag{
+			Name:  "readonly",
+			Usage: "Mount as read-only",
+		},
+	},
+	Action:          handleVolumeAttach,
+	HideHelpCommand: true,
+}
+
+var volumeDetachCmd = cli.Command{
+	Name:      "detach",
+	Usage:     "Detach a volume from an instance",
+	ArgsUsage: "<volume-id>",
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:     "instance",
+			Aliases:  []string{"i"},
+			Usage:    "Instance ID or name",
+			Required: true,
+		},
+	},
+	Action:          handleVolumeDetach,
+	HideHelpCommand: true,
+}
+
+func handleVolumeCreate(ctx context.Context, cmd *cli.Command) error {
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	params := hypeman.VolumeNewParams{
+		Name:   cmd.String("name"),
+		SizeGB: int64(cmd.Int("size")),
+	}
+
+	if id := cmd.String("id"); id != "" {
+		params.ID = hypeman.Opt(id)
+	}
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	var res []byte
+	opts = append(opts, option.WithResponseBodyInto(&res))
+	_, err := client.Volumes.New(ctx, params, opts...)
+	if err != nil {
+		return err
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	if format == "auto" || format == "" {
+		vol := gjson.ParseBytes(res)
+		fmt.Printf("%s\n", vol.Get("id").String())
+		return nil
+	}
+
+	obj := gjson.ParseBytes(res)
+	return ShowJSON(os.Stdout, "volume create", obj, format, transform)
+}
+
+func handleVolumeList(ctx context.Context, cmd *cli.Command) error {
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	if format != "auto" {
+		var res []byte
+		opts = append(opts, option.WithResponseBodyInto(&res))
+		_, err := client.Volumes.List(ctx, opts...)
+		if err != nil {
+			return err
+		}
+		obj := gjson.ParseBytes(res)
+		return ShowJSON(os.Stdout, "volume list", obj, format, transform)
+	}
+
+	volumes, err := client.Volumes.List(ctx, opts...)
+	if err != nil {
+		return err
+	}
+
+	quietMode := cmd.Bool("quiet")
+
+	if quietMode {
+		for _, vol := range *volumes {
+			fmt.Println(vol.ID)
+		}
+		return nil
+	}
+
+	if len(*volumes) == 0 {
+		fmt.Fprintln(os.Stderr, "No volumes found.")
+		return nil
+	}
+
+	table := NewTableWriter(os.Stdout, "ID", "NAME", "SIZE", "ATTACHMENTS", "CREATED")
+	table.TruncOrder = []int{0, 1, 4} // ID first, then NAME, CREATED
+	for _, vol := range *volumes {
+		attachments := fmt.Sprintf("%d", len(vol.Attachments))
+		if len(vol.Attachments) == 0 {
+			attachments = "-"
+		}
+
+		table.AddRow(
+			TruncateID(vol.ID),
+			vol.Name,
+			fmt.Sprintf("%d GB", vol.SizeGB),
+			attachments,
+			FormatTimeAgo(vol.CreatedAt),
+		)
+	}
+	table.Render()
+
+	return nil
+}
+
+func handleVolumeGet(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("volume ID required\nUsage: hypeman volume get <id>")
+	}
+
+	id := args[0]
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	var res []byte
+	opts = append(opts, option.WithResponseBodyInto(&res))
+	_, err := client.Volumes.Get(ctx, id, opts...)
+	if err != nil {
+		return err
+	}
+
+	format := cmd.Root().String("format")
+	transform := cmd.Root().String("transform")
+
+	obj := gjson.ParseBytes(res)
+	return ShowJSON(os.Stdout, "volume get", obj, format, transform)
+}
+
+func handleVolumeDelete(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("volume ID required\nUsage: hypeman volume delete <id>")
+	}
+
+	id := args[0]
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	err := client.Volumes.Delete(ctx, id, opts...)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "Deleted volume %s\n", id)
+	return nil
+}
+
+func handleVolumeAttach(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("volume ID required\nUsage: hypeman volume attach <volume-id> --instance <instance> --mount-path <path>")
+	}
+
+	volumeID := args[0]
+	instanceIdentifier := cmd.String("instance")
+	mountPath := cmd.String("mount-path")
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	// Resolve instance
+	instanceID, err := ResolveInstance(ctx, &client, instanceIdentifier)
+	if err != nil {
+		return err
+	}
+
+	params := hypeman.InstanceVolumeAttachParams{
+		ID:        instanceID,
+		MountPath: mountPath,
+	}
+
+	if cmd.IsSet("readonly") {
+		params.Readonly = hypeman.Opt(cmd.Bool("readonly"))
+	}
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	_, err = client.Instances.Volumes.Attach(ctx, volumeID, params, opts...)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "Attached volume %s to instance %s at %s\n", volumeID, instanceIdentifier, mountPath)
+	return nil
+}
+
+func handleVolumeDetach(ctx context.Context, cmd *cli.Command) error {
+	args := cmd.Args().Slice()
+	if len(args) < 1 {
+		return fmt.Errorf("volume ID required\nUsage: hypeman volume detach <volume-id> --instance <instance>")
+	}
+
+	volumeID := args[0]
+	instanceIdentifier := cmd.String("instance")
+
+	client := hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+
+	// Resolve instance
+	instanceID, err := ResolveInstance(ctx, &client, instanceIdentifier)
+	if err != nil {
+		return err
+	}
+
+	params := hypeman.InstanceVolumeDetachParams{
+		ID: instanceID,
+	}
+
+	var opts []option.RequestOption
+	if cmd.Root().Bool("debug") {
+		opts = append(opts, debugMiddlewareOption)
+	}
+
+	_, err = client.Instances.Volumes.Detach(ctx, volumeID, params, opts...)
+	if err != nil {
+		return err
+	}
+
+	fmt.Fprintf(os.Stderr, "Detached volume %s from instance %s\n", volumeID, instanceIdentifier)
+	return nil
+}
diff --git a/apps/cli/pkg/jsonflag/json_flag.go b/apps/cli/pkg/jsonflag/json_flag.go
new file mode 100644
index 00000000..605f883b
--- /dev/null
+++ b/apps/cli/pkg/jsonflag/json_flag.go
@@ -0,0 +1,248 @@
+package jsonflag
+
+import (
+	"fmt"
+	"strconv"
+	"time"
+
+	"github.com/urfave/cli/v3"
+)
+
+type JSONConfig struct {
+	Kind MutationKind
+	Path string
+	// For boolean flags that set a specific value when present
+	SetValue any
+}
+
+type JSONValueCreator[T any] struct{}
+
+func (c JSONValueCreator[T]) Create(val T, dest *T, config JSONConfig) cli.Value {
+	*dest = val
+	return &jsonValue[T]{
+		destination: dest,
+		config:      config,
+	}
+}
+
+func (c JSONValueCreator[T]) ToString(val T) string {
+	switch v := any(val).(type) {
+	case string:
+		if v == "" {
+			return v
+		}
+		return fmt.Sprintf("%q", v)
+	case bool:
+		return strconv.FormatBool(v)
+	case int:
+		return strconv.Itoa(v)
+	case float64:
+		return strconv.FormatFloat(v, 'g', -1, 64)
+	case time.Time:
+		return v.Format(time.RFC3339)
+	default:
+		return fmt.Sprintf("%v", v)
+	}
+}
+
+type jsonValue[T any] struct {
+	destination *T
+	config      JSONConfig
+}
+
+func (v *jsonValue[T]) Set(val string) error {
+	var parsed T
+	var err error
+
+	// If SetValue is configured, use that value instead of parsing the input
+	if v.config.SetValue != nil {
+		// For boolean flags with SetValue, register the configured value
+		if _, isBool := any(parsed).(bool); isBool {
+			globalRegistry.Mutate(v.config.Kind, v.config.Path, v.config.SetValue)
+			*v.destination = any(true).(T) // Set the flag itself to true
+			return nil
+		}
+		// For any flags with SetValue, register the configured value
+		globalRegistry.Mutate(v.config.Kind, v.config.Path, v.config.SetValue)
+		*v.destination = any(v.config.SetValue).(T)
+		return nil
+	}
+
+	switch any(parsed).(type) {
+	case string:
+		parsed = any(val).(T)
+	case bool:
+		boolVal, parseErr := strconv.ParseBool(val)
+		if parseErr != nil {
+			return fmt.Errorf("invalid boolean value %q: %w", val, parseErr)
+		}
+		parsed = any(boolVal).(T)
+	case int:
+		intVal, parseErr := strconv.Atoi(val)
+		if parseErr != nil {
+			return fmt.Errorf("invalid integer value %q: %w", val, parseErr)
+		}
+		parsed = any(intVal).(T)
+	case float64:
+		floatVal, parseErr := strconv.ParseFloat(val, 64)
+		if parseErr != nil {
+			return fmt.Errorf("invalid float value %q: %w", val, parseErr)
+		}
+		parsed = any(floatVal).(T)
+	case time.Time:
+		// Try common datetime formats
+		formats := []string{
+			time.RFC3339,
+			"2006-01-02T15:04:05Z07:00",
+			"2006-01-02T15:04:05",
+			"2006-01-02 15:04:05",
+			"2006-01-02",
+			"15:04:05",
+			"15:04",
+		}
+		var timeVal time.Time
+		var parseErr error
+		for _, format := range formats {
+			timeVal, parseErr = time.Parse(format, val)
+			if parseErr == nil {
+				break
+			}
+		}
+		if parseErr != nil {
+			return fmt.Errorf("invalid datetime value %q: %w", val, parseErr)
+		}
+		parsed = any(timeVal).(T)
+	case any:
+		// For `any`, store the string value directly
+		parsed = any(val).(T)
+	default:
+		return fmt.Errorf("unsupported type for JSON flag")
+	}
+
+	*v.destination = parsed
+	globalRegistry.Mutate(v.config.Kind, v.config.Path, parsed)
+	return err
+}
+
+func (v *jsonValue[T]) Get() any {
+	if v.destination != nil {
+		return *v.destination
+	}
+	var zero T
+	return zero
+}
+
+func (v *jsonValue[T]) String() string {
+	if v.destination != nil {
+		switch val := any(*v.destination).(type) {
+		case string:
+			return val
+		case bool:
+			return strconv.FormatBool(val)
+		case int:
+			return strconv.Itoa(val)
+		case float64:
+			return strconv.FormatFloat(val, 'g', -1, 64)
+		case time.Time:
+			return val.Format(time.RFC3339)
+		default:
+			return fmt.Sprintf("%v", val)
+		}
+	}
+	var zero T
+	switch any(zero).(type) {
+	case string:
+		return ""
+	case bool:
+		return "false"
+	case int:
+		return "0"
+	case float64:
+		return "0"
+	case time.Time:
+		return ""
+	default:
+		return fmt.Sprintf("%v", zero)
+	}
+}
+
+func (v *jsonValue[T]) IsBoolFlag() bool {
+	return v.config.SetValue != nil
+}
+
+// JSONDateValueCreator is a specialized creator for date-only values
+type JSONDateValueCreator struct{}
+
+func (c JSONDateValueCreator) Create(val time.Time, dest *time.Time, config JSONConfig) cli.Value {
+	*dest = val
+	return &jsonDateValue{
+		destination: dest,
+		config:      config,
+	}
+}
+
+func (c JSONDateValueCreator) ToString(val time.Time) string {
+	return val.Format("2006-01-02")
+}
+
+type jsonDateValue struct {
+	destination *time.Time
+	config      JSONConfig
+}
+
+func (v *jsonDateValue) Set(val string) error {
+	// Try date-only formats first, then fall back to datetime formats
+	formats := []string{
+		"2006-01-02",
+		"01/02/2006",
+		"Jan 2, 2006",
+		"January 2, 2006",
+		"2-Jan-2006",
+		time.RFC3339,
+		"2006-01-02T15:04:05Z07:00",
+		"2006-01-02T15:04:05",
+		"2006-01-02 15:04:05",
+	}
+
+	var timeVal time.Time
+	var parseErr error
+	for _, format := range formats {
+		timeVal, parseErr = time.Parse(format, val)
+		if parseErr == nil {
+			break
+		}
+	}
+	if parseErr != nil {
+		return fmt.Errorf("invalid date value %q: %w", val, parseErr)
+	}
+
+	*v.destination = timeVal
+	globalRegistry.Mutate(v.config.Kind, v.config.Path, timeVal.Format("2006-01-02"))
+	return nil
+}
+
+func (v *jsonDateValue) Get() any {
+	if v.destination != nil {
+		return *v.destination
+	}
+	return time.Time{}
+}
+
+func (v *jsonDateValue) String() string {
+	if v.destination != nil {
+		return v.destination.Format("2006-01-02")
+	}
+	return ""
+}
+
+func (v *jsonDateValue) IsBoolFlag() bool {
+	return false
+}
+
+type JSONStringFlag = cli.FlagBase[string, JSONConfig, JSONValueCreator[string]]
+type JSONBoolFlag = cli.FlagBase[bool, JSONConfig, JSONValueCreator[bool]]
+type JSONIntFlag = cli.FlagBase[int, JSONConfig, JSONValueCreator[int]]
+type JSONFloatFlag = cli.FlagBase[float64, JSONConfig, JSONValueCreator[float64]]
+type JSONDatetimeFlag = cli.FlagBase[time.Time, JSONConfig, JSONValueCreator[time.Time]]
+type JSONDateFlag = cli.FlagBase[time.Time, JSONConfig, JSONDateValueCreator]
+type JSONAnyFlag = cli.FlagBase[any, JSONConfig, JSONValueCreator[any]]
diff --git a/apps/cli/pkg/jsonflag/mutation.go b/apps/cli/pkg/jsonflag/mutation.go
new file mode 100644
index 00000000..46c115b9
--- /dev/null
+++ b/apps/cli/pkg/jsonflag/mutation.go
@@ -0,0 +1,104 @@
+package jsonflag
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/tidwall/gjson"
+	"github.com/tidwall/sjson"
+)
+
+type MutationKind string
+
+const (
+	Body   MutationKind = "body"
+	Query  MutationKind = "query"
+	Header MutationKind = "header"
+)
+
+type Mutation struct {
+	Kind  MutationKind
+	Path  string
+	Value any
+}
+
+type registry struct {
+	mutations []Mutation
+}
+
+var globalRegistry = &registry{}
+
+func (r *registry) Mutate(kind MutationKind, path string, value any) {
+	r.mutations = append(r.mutations, Mutation{
+		Kind:  kind,
+		Path:  path,
+		Value: value,
+	})
+}
+
+func (r *registry) Apply(body, query, header []byte) ([]byte, []byte, []byte, error) {
+	var err error
+
+	for _, mutation := range r.mutations {
+		switch mutation.Kind {
+		case Body:
+			body, err = jsonSet(body, mutation.Path, mutation.Value)
+		case Query:
+			query, err = jsonSet(query, mutation.Path, mutation.Value)
+		case Header:
+			header, err = jsonSet(header, mutation.Path, mutation.Value)
+		}
+		if err != nil {
+			return nil, nil, nil, fmt.Errorf("failed to apply mutation %s.%s: %w", mutation.Kind, mutation.Path, err)
+		}
+	}
+
+	return body, query, header, nil
+}
+
+func (r *registry) Clear() {
+	r.mutations = nil
+}
+
+func (r *registry) List() []Mutation {
+	result := make([]Mutation, len(r.mutations))
+	copy(result, r.mutations)
+	return result
+}
+
+// Mutate adds a mutation that will be applied to the specified kind of data
+func Mutate(kind MutationKind, path string, value any) {
+	globalRegistry.Mutate(kind, path, value)
+}
+
+// ApplyMutations applies all registered mutations to the provided JSON data
+func ApplyMutations(body, query, header []byte) ([]byte, []byte, []byte, error) {
+	return globalRegistry.Apply(body, query, header)
+}
+
+// ClearMutations removes all registered mutations from the global registry
+func ClearMutations() {
+	globalRegistry.Clear()
+}
+
+// ListMutations returns a copy of all currently registered mutations
+func ListMutations() []Mutation {
+	return globalRegistry.List()
+}
+
+func jsonSet(json []byte, path string, value any) ([]byte, error) {
+	keys := strings.Split(path, ".")
+	path = ""
+	for _, key := range keys {
+		if key == "#" {
+			key = strconv.Itoa(len(gjson.GetBytes(json, path).Array()) - 1)
+		}
+
+		if len(path) > 0 {
+			path += "."
+		}
+		path += key
+	}
+	return sjson.SetBytes(json, path, value)
+}
diff --git a/apps/cli/pkg/jsonflag/mutation_test.go b/apps/cli/pkg/jsonflag/mutation_test.go
new file mode 100644
index 00000000..e87e518b
--- /dev/null
+++ b/apps/cli/pkg/jsonflag/mutation_test.go
@@ -0,0 +1,37 @@
+package jsonflag
+
+import (
+	"testing"
+)
+
+func TestApply(t *testing.T) {
+	ClearMutations()
+
+	Mutate(Body, "name", "test")
+	Mutate(Query, "page", 1)
+	Mutate(Header, "authorization", "Bearer token")
+
+	body, query, header, err := ApplyMutations(
+		[]byte(`{}`),
+		[]byte(`{}`),
+		[]byte(`{}`),
+	)
+
+	if err != nil {
+		t.Fatalf("Failed to apply mutations: %v", err)
+	}
+
+	expectedBody := `{"name":"test"}`
+	expectedQuery := `{"page":1}`
+	expectedHeader := `{"authorization":"Bearer token"}`
+
+	if string(body) != expectedBody {
+		t.Errorf("Body mismatch. Expected: %s, Got: %s", expectedBody, string(body))
+	}
+	if string(query) != expectedQuery {
+		t.Errorf("Query mismatch. Expected: %s, Got: %s", expectedQuery, string(query))
+	}
+	if string(header) != expectedHeader {
+		t.Errorf("Header mismatch. Expected: %s, Got: %s", expectedHeader, string(header))
+	}
+}
diff --git a/apps/cli/pkg/jsonview/explorer.go b/apps/cli/pkg/jsonview/explorer.go
new file mode 100644
index 00000000..8d725eb9
--- /dev/null
+++ b/apps/cli/pkg/jsonview/explorer.go
@@ -0,0 +1,590 @@
+package jsonview
+
+import (
+	"errors"
+	"fmt"
+	"math"
+	"strings"
+
+	"github.com/charmbracelet/bubbles/help"
+	"github.com/charmbracelet/bubbles/key"
+	"github.com/charmbracelet/bubbles/table"
+	"github.com/charmbracelet/bubbles/viewport"
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/muesli/reflow/truncate"
+	"github.com/muesli/reflow/wordwrap"
+	"github.com/tidwall/gjson"
+)
+
+const (
+	// UI layout constants
+	borderPadding     = 2
+	heightOffset      = 5
+	tableMinHeight    = 2
+	titlePaddingLeft  = 2
+	titlePaddingTop   = 0
+	footerPaddingLeft = 1
+
+	// Column width constants
+	defaultColumnWidth = 10
+	keyColumnWidth     = 3
+	valueColumnWidth   = 5
+
+	// String formatting constants
+	maxStringLength  = 100
+	maxPreviewLength = 24
+
+	arrayColor  = lipgloss.Color("1")
+	stringColor = lipgloss.Color("5")
+	objectColor = lipgloss.Color("4")
+)
+
+type keyMap struct {
+	Up         key.Binding
+	Down       key.Binding
+	Enter      key.Binding
+	Back       key.Binding
+	PrintValue key.Binding
+	Raw        key.Binding
+	Quit       key.Binding
+}
+
+func (k keyMap) ShortHelp() []key.Binding {
+	return []key.Binding{k.Quit, k.Up, k.Down, k.Back, k.Enter, k.PrintValue, k.Raw}
+}
+
+func (k keyMap) FullHelp() [][]key.Binding {
+	return [][]key.Binding{k.ShortHelp()}
+}
+
+var keys = keyMap{
+	Up: key.NewBinding(
+		key.WithKeys("up", "k"),
+		key.WithHelp("↑/k", "up"),
+	),
+	Down: key.NewBinding(
+		key.WithKeys("down", "j"),
+		key.WithHelp("↓/j", "down"),
+	),
+	Back: key.NewBinding(
+		key.WithKeys("left", "h", "backspace"),
+		key.WithHelp("←/h", "go back"),
+	),
+	Enter: key.NewBinding(
+		key.WithKeys("right", "l"),
+		key.WithHelp("→/l", "expand"),
+	),
+	PrintValue: key.NewBinding(
+		key.WithKeys("p"),
+		key.WithHelp("p", "print and exit"),
+	),
+	Raw: key.NewBinding(
+		key.WithKeys("r"),
+		key.WithHelp("r", "toggle raw JSON"),
+	),
+	Quit: key.NewBinding(
+		key.WithKeys("q", "esc", "ctrl+c", "enter"),
+		key.WithHelp("q/enter", "quit"),
+	),
+}
+
+var (
+	titleStyle         = lipgloss.NewStyle().Bold(true).PaddingLeft(titlePaddingLeft).PaddingTop(titlePaddingTop)
+	arrayStyle         = lipgloss.NewStyle().BorderStyle(lipgloss.RoundedBorder()).BorderForeground(arrayColor)
+	stringStyle        = lipgloss.NewStyle().BorderStyle(lipgloss.RoundedBorder()).BorderForeground(stringColor)
+	objectStyle        = lipgloss.NewStyle().BorderStyle(lipgloss.RoundedBorder()).BorderForeground(objectColor)
+	stringLiteralStyle = lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("2"))
+)
+
+type JSONView interface {
+	GetPath() string
+	GetData() gjson.Result
+	Update(tea.Msg) tea.Cmd
+	View() string
+	Resize(width, height int)
+}
+
+type TableView struct {
+	path    string
+	data    gjson.Result
+	table   table.Model
+	rowData []gjson.Result
+}
+
+func (tv *TableView) GetPath() string       { return tv.path }
+func (tv *TableView) GetData() gjson.Result { return tv.data }
+func (tv *TableView) View() string          { return tv.table.View() }
+
+func (tv *TableView) Update(msg tea.Msg) tea.Cmd {
+	var cmd tea.Cmd
+	tv.table, cmd = tv.table.Update(msg)
+	return cmd
+}
+
+func (tv *TableView) Resize(width, height int) {
+	tv.updateColumnWidths(width)
+	tv.table.SetHeight(min(height-heightOffset, tableMinHeight+len(tv.table.Rows())))
+}
+
+func (tv *TableView) updateColumnWidths(width int) {
+	columns := tv.table.Columns()
+	widths := make([]int, len(columns))
+
+	// Calculate required widths from headers and content
+	for i, col := range columns {
+		widths[i] = lipgloss.Width(col.Title)
+	}
+
+	for _, row := range tv.table.Rows() {
+		for i, cell := range row {
+			if i < len(widths) {
+				widths[i] = max(widths[i], lipgloss.Width(cell))
+			}
+		}
+	}
+
+	totalWidth := sum(widths)
+	available := width - borderPadding*len(columns)
+
+	if totalWidth <= available {
+		for i, w := range widths {
+			columns[i].Width = w
+		}
+		return
+	}
+
+	fairShare := float64(available) / float64(len(columns))
+	shrinkable := 0.0
+
+	for _, w := range widths {
+		if float64(w) > fairShare {
+			shrinkable += float64(w) - fairShare
+		}
+	}
+
+	if shrinkable > 0 {
+		excess := float64(totalWidth - available)
+		for i, w := range widths {
+			if float64(w) > fairShare {
+				reduction := (float64(w) - fairShare) * (excess / shrinkable)
+				widths[i] = int(math.Round(float64(w) - reduction))
+			}
+		}
+	}
+
+	for i, w := range widths {
+		columns[i].Width = w
+	}
+
+	tv.table.SetColumns(columns)
+}
+
+type TextView struct {
+	path     string
+	data     gjson.Result
+	viewport viewport.Model
+	ready    bool
+}
+
+func (tv *TextView) GetPath() string       { return tv.path }
+func (tv *TextView) GetData() gjson.Result { return tv.data }
+func (tv *TextView) View() string          { return tv.viewport.View() }
+func (tv *TextView) Update(msg tea.Msg) tea.Cmd {
+	var cmd tea.Cmd
+	tv.viewport, cmd = tv.viewport.Update(msg)
+	return cmd
+}
+
+func (tv *TextView) Resize(width, height int) {
+	h := height - heightOffset
+	if !tv.ready {
+		tv.viewport = viewport.New(width, h)
+		tv.viewport.SetContent(wordwrap.String(tv.data.String(), width))
+		tv.ready = true
+		return
+	}
+	tv.viewport.Width = width
+	tv.viewport.Height = h
+}
+
+type JSONViewer struct {
+	stack   []JSONView
+	root    string
+	width   int
+	height  int
+	rawMode bool
+	message string
+	help    help.Model
+}
+
+func ExploreJSON(title string, json gjson.Result) error {
+	view, err := newView("", json, false)
+	if err != nil {
+		return err
+	}
+
+	viewer := &JSONViewer{stack: []JSONView{view}, root: title, rawMode: false, help: help.New()}
+	_, err = tea.NewProgram(viewer).Run()
+	if viewer.message != "" {
+		_, msgErr := fmt.Println("\n" + viewer.message)
+		err = errors.Join(err, msgErr)
+	}
+	return err
+}
+
+func (v *JSONViewer) current() JSONView { return v.stack[len(v.stack)-1] }
+func (v *JSONViewer) Init() tea.Cmd     { return nil }
+
+func (v *JSONViewer) resize(width, height int) {
+	v.width, v.height = width, height
+	v.help.Width = width
+	for i := range v.stack {
+		v.stack[i].Resize(width, height)
+	}
+}
+
+func (v *JSONViewer) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	switch msg := msg.(type) {
+	case tea.WindowSizeMsg:
+		v.resize(msg.Width-borderPadding, msg.Height)
+		return v, nil
+	case tea.KeyMsg:
+		switch {
+		case key.Matches(msg, keys.Quit):
+			return v, tea.Quit
+		case key.Matches(msg, keys.Enter):
+			return v.navigateForward()
+		case key.Matches(msg, keys.Back):
+			return v.navigateBack()
+		case key.Matches(msg, keys.Raw):
+			return v.toggleRaw()
+		case key.Matches(msg, keys.PrintValue):
+			v.message = v.getSelectedContent()
+			return v, tea.Quit
+		}
+	}
+
+	return v, v.current().Update(msg)
+}
+
+func (v *JSONViewer) getSelectedContent() string {
+	tableView, ok := v.current().(*TableView)
+	if !ok {
+		return v.current().GetData().Raw
+	}
+
+	selected := tableView.rowData[tableView.table.Cursor()]
+	if selected.Type == gjson.String {
+		return selected.String()
+	}
+	return selected.Raw
+}
+
+func (v *JSONViewer) navigateForward() (tea.Model, tea.Cmd) {
+	tableView, ok := v.current().(*TableView)
+	if !ok {
+		return v, nil
+	}
+
+	cursor := tableView.table.Cursor()
+	selected := tableView.rowData[cursor]
+	if !v.canNavigateInto(selected) {
+		return v, nil
+	}
+
+	path := v.buildNavigationPath(tableView, cursor)
+	forwardView, err := newView(path, selected, v.rawMode)
+	if err != nil {
+		return v, nil
+	}
+
+	v.stack = append(v.stack, forwardView)
+	v.resize(v.width, v.height)
+	return v, nil
+}
+
+func (v *JSONViewer) buildNavigationPath(tableView *TableView, cursor int) string {
+	if tableView.data.IsArray() {
+		return fmt.Sprintf("%s[%d]", tableView.path, cursor)
+	}
+	key := tableView.data.Get("@keys").Array()[cursor].Str
+	return fmt.Sprintf("%s[%s]", tableView.path, quoteString(key))
+}
+
+func quoteString(s string) string {
+	// Replace backslashes and quotes with escaped versions
+	s = strings.ReplaceAll(s, "\\", "\\\\")
+	s = strings.ReplaceAll(s, "\"", "\\\"")
+	return stringLiteralStyle.Render("\"" + s + "\"")
+}
+
+func (v *JSONViewer) canNavigateInto(data gjson.Result) bool {
+	switch {
+	case data.IsArray():
+		return len(data.Array()) > 0
+	case data.IsObject():
+		return len(data.Map()) > 0
+	case data.Type == gjson.String:
+		str := data.String()
+		return strings.Contains(str, "\n") || lipgloss.Width(str) >= maxStringLength
+	}
+	return false
+}
+
+func (v *JSONViewer) navigateBack() (tea.Model, tea.Cmd) {
+	if len(v.stack) > 1 {
+		v.stack = v.stack[:len(v.stack)-1]
+	}
+	return v, nil
+}
+
+func (v *JSONViewer) toggleRaw() (tea.Model, tea.Cmd) {
+	v.rawMode = !v.rawMode
+
+	for i, view := range v.stack {
+		rawView, err := newView(view.GetPath(), view.GetData(), v.rawMode)
+		if err != nil {
+			return v, tea.Printf("Error: %s", err)
+		}
+		v.stack[i] = rawView
+	}
+
+	v.resize(v.width, v.height)
+	return v, nil
+}
+
+func (v *JSONViewer) View() string {
+	view := v.current()
+	title := v.buildTitle(view)
+	content := titleStyle.Render(title)
+	style := v.getStyleForData(view.GetData())
+	content += "\n" + style.Render(view.View())
+	content += "\n" + v.help.View(keys)
+	return content
+}
+
+func (v *JSONViewer) buildTitle(view JSONView) string {
+	title := v.root
+	if len(view.GetPath()) > 0 {
+		title += " → " + view.GetPath()
+	}
+	if v.rawMode {
+		title += " (JSON)"
+	}
+	return title
+}
+
+func (v *JSONViewer) getStyleForData(data gjson.Result) lipgloss.Style {
+	switch {
+	case data.Type == gjson.String:
+		return stringStyle
+	case data.IsArray():
+		return arrayStyle
+	default:
+		return objectStyle
+	}
+}
+
+func newView(path string, data gjson.Result, raw bool) (JSONView, error) {
+	if data.Type == gjson.String {
+		return newTextView(path, data)
+	}
+	return newTableView(path, data, raw)
+}
+
+func newTextView(path string, data gjson.Result) (*TextView, error) {
+	if !data.Exists() || data.Type != gjson.String {
+		return nil, fmt.Errorf("invalid text JSON")
+	}
+	return &TextView{path: path, data: data}, nil
+}
+
+func newTableView(path string, data gjson.Result, raw bool) (*TableView, error) {
+	if !data.Exists() || data.Type != gjson.JSON {
+		return nil, fmt.Errorf("invalid table JSON")
+	}
+
+	switch {
+	case data.IsArray():
+		array := data.Array()
+		if isArrayOfObjects(array) {
+			return newArrayOfObjectsTableView(path, data, array, raw), nil
+		} else {
+			return newArrayTableView(path, data, array, raw), nil
+		}
+	case data.IsObject():
+		return newObjectTableView(path, data, raw), nil
+	default:
+		return nil, fmt.Errorf("unsupported JSON type")
+	}
+}
+
+func newArrayTableView(path string, data gjson.Result, array []gjson.Result, raw bool) *TableView {
+	columns := []table.Column{{Title: "Items", Width: defaultColumnWidth}}
+	rows := make([]table.Row, 0, len(array))
+	rowData := make([]gjson.Result, 0, len(array))
+
+	for _, item := range array {
+		rows = append(rows, table.Row{formatValue(item, raw)})
+		rowData = append(rowData, item)
+	}
+
+	t := createTable(columns, rows, arrayColor)
+	return &TableView{path: path, data: data, table: t, rowData: rowData}
+}
+
+func newArrayOfObjectsTableView(path string, data gjson.Result, array []gjson.Result, raw bool) *TableView {
+	// Collect unique keys
+	keySet := make(map[string]struct{})
+	var columns []table.Column
+
+	for _, item := range array {
+		for _, key := range item.Get("@keys").Array() {
+			if _, exists := keySet[key.Str]; !exists {
+				keySet[key.Str] = struct{}{}
+				title := key.Str
+				columns = append(columns, table.Column{Title: title, Width: defaultColumnWidth})
+			}
+		}
+	}
+
+	rows := make([]table.Row, 0, len(array))
+	rowData := make([]gjson.Result, 0, len(array))
+
+	for _, item := range array {
+		row := make(table.Row, len(columns))
+		for i, col := range columns {
+			row[i] = formatValue(item.Get(col.Title), raw)
+		}
+		rows = append(rows, row)
+		rowData = append(rowData, item)
+	}
+
+	t := createTable(columns, rows, arrayColor)
+	return &TableView{path: path, data: data, table: t, rowData: rowData}
+}
+
+func newObjectTableView(path string, data gjson.Result, raw bool) *TableView {
+	columns := []table.Column{{Title: "Object"}, {}}
+
+	keys := data.Get("@keys").Array()
+	rows := make([]table.Row, 0, len(keys))
+	rowData := make([]gjson.Result, 0, len(keys))
+
+	for _, key := range keys {
+		value := data.Get(key.Str)
+		title := key.Str
+		rows = append(rows, table.Row{title, formatValue(value, raw)})
+		rowData = append(rowData, value)
+	}
+
+	// Adjust column widths based on content
+	for _, row := range rows {
+		for i, cell := range row {
+			if i < len(columns) {
+				columns[i].Width = max(columns[i].Width, lipgloss.Width(cell))
+			}
+		}
+	}
+
+	t := createTable(columns, rows, objectColor)
+	return &TableView{path: path, data: data, table: t, rowData: rowData}
+}
+
+func createTable(columns []table.Column, rows []table.Row, bgColor lipgloss.Color) table.Model {
+	t := table.New(
+		table.WithColumns(columns),
+		table.WithRows(rows),
+		table.WithFocused(true),
+	)
+
+	// Set common table styles
+	s := table.DefaultStyles()
+	s.Header = s.Header.
+		BorderStyle(lipgloss.NormalBorder()).
+		BorderForeground(lipgloss.Color("240")).
+		BorderBottom(true).
+		Bold(true)
+	s.Selected = s.Selected.
+		Foreground(lipgloss.Color("229")).
+		Background(bgColor).
+		Bold(false)
+	t.SetStyles(s)
+
+	return t
+}
+
+func formatValue(value gjson.Result, raw bool) string {
+	if raw {
+		return value.Get("@ugly").Raw
+	}
+
+	switch {
+	case value.IsObject():
+		return formatObject(value)
+	case value.IsArray():
+		return formatArray(value)
+	case value.Type == gjson.String:
+		return value.Str
+	default:
+		return value.Raw
+	}
+}
+
+func formatObject(value gjson.Result) string {
+	keys := value.Get("@keys").Array()
+	keyStrs := make([]string, len(keys))
+
+	for i, key := range keys {
+		val := value.Get(key.Str)
+		keyStrs[i] = formatObjectKey(key.Str, val)
+	}
+
+	return "{" + strings.Join(keyStrs, ", ") + "}"
+}
+
+func formatObjectKey(key string, val gjson.Result) string {
+	switch {
+	case val.IsObject():
+		return key + ":{…}"
+	case val.IsArray():
+		return key + ":[…]"
+	case val.Type == gjson.String:
+		str := val.Str
+		if lipgloss.Width(str) <= maxPreviewLength {
+			return fmt.Sprintf(`%s:"%s"`, key, str)
+		}
+		return fmt.Sprintf(`%s:"%s…"`, key, truncate.String(str, uint(maxPreviewLength)))
+	default:
+		return key + ":" + val.Raw
+	}
+}
+
+func formatArray(value gjson.Result) string {
+	switch count := len(value.Array()); count {
+	case 0:
+		return "[]"
+	case 1:
+		return "[...1 item...]"
+	default:
+		return fmt.Sprintf("[...%d items...]", count)
+	}
+}
+
+func isArrayOfObjects(array []gjson.Result) bool {
+	for _, item := range array {
+		if !item.IsObject() {
+			return false
+		}
+	}
+	return len(array) > 0
+}
+
+func sum(ints []int) int {
+	total := 0
+	for _, n := range ints {
+		total += n
+	}
+	return total
+}
diff --git a/apps/cli/pkg/jsonview/staticdisplay.go b/apps/cli/pkg/jsonview/staticdisplay.go
new file mode 100644
index 00000000..768ea34b
--- /dev/null
+++ b/apps/cli/pkg/jsonview/staticdisplay.go
@@ -0,0 +1,135 @@
+package jsonview
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/x/term"
+	"github.com/muesli/reflow/truncate"
+	"github.com/tidwall/gjson"
+)
+
+const (
+	tabWidth = 2
+)
+
+var (
+	keyStyle         = lipgloss.NewStyle().Foreground(lipgloss.Color("75")).Bold(false)
+	stringValueStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("113"))
+	numberValueStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("215"))
+	boolValueStyle   = lipgloss.NewStyle().Foreground(lipgloss.Color("207"))
+	nullValueStyle   = lipgloss.NewStyle().Foreground(lipgloss.Color("245")).Italic(true)
+	bulletStyle      = lipgloss.NewStyle().Foreground(lipgloss.Color("242"))
+	containerStyle   = lipgloss.NewStyle().
+				Border(lipgloss.RoundedBorder()).
+				BorderForeground(lipgloss.Color("63")).
+				Padding(0, 1)
+)
+
+func formatJSON(json gjson.Result, width int) string {
+	if !json.Exists() {
+		return nullValueStyle.Render("Invalid JSON")
+	}
+	return formatResult(json, 0, width)
+}
+
+func formatResult(result gjson.Result, indent, width int) string {
+	switch result.Type {
+	case gjson.String:
+		str := result.Str
+		if str == "" {
+			return nullValueStyle.Render("(empty)")
+		}
+		if lipgloss.Width(str) > width {
+			str = truncate.String(str, uint(width-1)) + "…"
+		}
+		return stringValueStyle.Render(str)
+	case gjson.Number:
+		return numberValueStyle.Render(result.Raw)
+	case gjson.True:
+		return boolValueStyle.Render("yes")
+	case gjson.False:
+		return boolValueStyle.Render("no")
+	case gjson.Null:
+		return nullValueStyle.Render("null")
+	case gjson.JSON:
+		if result.IsArray() {
+			return formatJSONArray(result, indent, width)
+		}
+		return formatJSONObject(result, indent, width)
+	default:
+		return stringValueStyle.Render(result.String())
+	}
+}
+
+func isSingleLine(result gjson.Result, indent int) bool {
+	return !(result.IsObject() || result.IsArray())
+}
+
+func formatJSONArray(result gjson.Result, indent, width int) string {
+	items := result.Array()
+	if len(items) == 0 {
+		return nullValueStyle.Render(" (none)")
+	}
+
+	numberWidth := lipgloss.Width(fmt.Sprintf("%d. ", len(items)))
+
+	var formattedItems []string
+	for i, item := range items {
+		number := fmt.Sprintf("%d.", i+1)
+		numbering := getIndent(indent) + bulletStyle.Render(number)
+
+		// If the item will be a one-liner, put it inline after the numbering,
+		// otherwise it starts with a newline and goes below the numbering.
+		itemWidth := width
+		if isSingleLine(item, indent+1) {
+			// Add right-padding:
+			numbering += strings.Repeat(" ", numberWidth-lipgloss.Width(number))
+			itemWidth = width - lipgloss.Width(numbering)
+		}
+		value := formatResult(item, indent+1, itemWidth)
+		formattedItems = append(formattedItems, numbering+value)
+	}
+	return "\n" + strings.Join(formattedItems, "\n")
+}
+
+func formatJSONObject(result gjson.Result, indent, width int) string {
+	keys := result.Get("@keys").Array()
+	if len(keys) == 0 {
+		return nullValueStyle.Render("(empty)")
+	}
+
+	var items []string
+	for _, key := range keys {
+		value := result.Get(key.String())
+		keyStr := getIndent(indent) + keyStyle.Render(key.String()+":")
+		// If item will be a one-liner, put it inline after the key, otherwise
+		// it starts with a newline and goes below the key.
+		itemWidth := width
+		if isSingleLine(value, indent+1) {
+			keyStr += " "
+			itemWidth = width - lipgloss.Width(keyStr)
+		}
+		formattedValue := formatResult(value, indent+1, itemWidth)
+		items = append(items, keyStr+formattedValue)
+	}
+
+	return "\n" + strings.Join(items, "\n")
+}
+
+func getIndent(indent int) string {
+	return strings.Repeat(" ", indent*tabWidth)
+}
+
+func RenderJSON(title string, json gjson.Result) string {
+	width, _, err := term.GetSize(os.Stdout.Fd())
+	if err != nil {
+		width = 80
+	}
+	width -= containerStyle.GetBorderLeftSize() + containerStyle.GetBorderRightSize() +
+		containerStyle.GetPaddingLeft() + containerStyle.GetPaddingRight()
+	content := strings.TrimLeft(formatJSON(json, width), "\n")
+	return titleStyle.Render(title) + "\n" + containerStyle.Render(content)
+}
diff --git a/apps/cli/release-please-config.json b/apps/cli/release-please-config.json
new file mode 100644
index 00000000..53619de6
--- /dev/null
+++ b/apps/cli/release-please-config.json
@@ -0,0 +1,67 @@
+{
+  "packages": {
+    ".": {}
+  },
+  "$schema": "https://raw.githubusercontent.com/stainless-api/release-please/main/schemas/config.json",
+  "include-v-in-tag": true,
+  "include-component-in-tag": false,
+  "versioning": "prerelease",
+  "prerelease": true,
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": false,
+  "pull-request-header": "Automated Release PR",
+  "pull-request-title-pattern": "release: ${version}",
+  "changelog-sections": [
+    {
+      "type": "feat",
+      "section": "Features"
+    },
+    {
+      "type": "fix",
+      "section": "Bug Fixes"
+    },
+    {
+      "type": "perf",
+      "section": "Performance Improvements"
+    },
+    {
+      "type": "revert",
+      "section": "Reverts"
+    },
+    {
+      "type": "chore",
+      "section": "Chores"
+    },
+    {
+      "type": "docs",
+      "section": "Documentation"
+    },
+    {
+      "type": "style",
+      "section": "Styles"
+    },
+    {
+      "type": "refactor",
+      "section": "Refactors"
+    },
+    {
+      "type": "test",
+      "section": "Tests",
+      "hidden": true
+    },
+    {
+      "type": "build",
+      "section": "Build System"
+    },
+    {
+      "type": "ci",
+      "section": "Continuous Integration",
+      "hidden": true
+    }
+  ],
+  "release-type": "simple",
+  "extra-files": [
+    "pkg/cmd/version.go",
+    "README.md"
+  ]
+}
\ No newline at end of file
diff --git a/apps/cli/scripts/bootstrap b/apps/cli/scripts/bootstrap
new file mode 100755
index 00000000..a73aff96
--- /dev/null
+++ b/apps/cli/scripts/bootstrap
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+if [ -f "Brewfile" ] && [ "$(uname -s)" = "Darwin" ] && [ "$SKIP_BREW" != "1" ] && [ -t 0 ]; then
+  brew bundle check >/dev/null 2>&1 || {
+    echo -n "==> Install Homebrew dependencies? (y/N): "
+    read -r response
+    case "$response" in
+      [yY][eE][sS]|[yY])
+        brew bundle
+        ;;
+      *)
+        ;;
+    esac
+    echo
+  }
+fi
+
+echo "==> Installing Go dependencies…"
+
+go mod tidy
diff --git a/apps/cli/scripts/build b/apps/cli/scripts/build
new file mode 100755
index 00000000..0ca9e5b4
--- /dev/null
+++ b/apps/cli/scripts/build
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+echo "==> Building hypeman"
+go build ./cmd/hypeman
diff --git a/apps/cli/scripts/checkout-preview b/apps/cli/scripts/checkout-preview
new file mode 100755
index 00000000..3c147200
--- /dev/null
+++ b/apps/cli/scripts/checkout-preview
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+# Checkout a preview branch from the stainless-sdks mirror.
+#
+# Usage:
+#   ./scripts/checkout-preview <branch>     # Checkout preview/<branch>
+#   ./scripts/checkout-preview -b <branch>  # Checkout exact branch name
+
+STAINLESS_REMOTE="git@github.com:stainless-sdks/hypeman-cli.git"
+
+usage() {
+  echo "Usage: $0 [-b] <branch>"
+  echo ""
+  echo "Checkout a branch from the stainless-sdks/hypeman-cli mirror."
+  echo ""
+  echo "Options:"
+  echo "  -b    Use exact branch name instead of preview/<branch>"
+  echo ""
+  echo "Examples:"
+  echo "  $0 devices          # Checkout preview/devices"
+  echo "  $0 -b main          # Checkout main"
+  echo "  $0 -b preview/foo   # Checkout preview/foo"
+  exit 1
+}
+
+ensure_stainless_remote() {
+  if ! git remote get-url stainless >/dev/null 2>&1; then
+    echo "==> Adding stainless remote..."
+    git remote add stainless "${STAINLESS_REMOTE}"
+  fi
+}
+
+EXACT_BRANCH=false
+
+while getopts "bh" opt; do
+  case $opt in
+    b) EXACT_BRANCH=true ;;
+    h) usage ;;
+    *) usage ;;
+  esac
+done
+shift $((OPTIND - 1))
+
+if [ $# -lt 1 ]; then
+  usage
+fi
+
+BRANCH="$1"
+
+if [ "$EXACT_BRANCH" = false ]; then
+  BRANCH="preview/${BRANCH}"
+fi
+
+ensure_stainless_remote
+
+echo "==> Fetching from stainless remote..."
+git fetch stainless
+
+echo "==> Checking out ${BRANCH}..."
+git checkout -B "${BRANCH}" "stainless/${BRANCH}"
+
+echo ""
+echo "Switched to branch '${BRANCH}' tracking stainless/${BRANCH}"
+
+# Point the hypeman-go SDK dependency to the corresponding preview branch
+echo ""
+SCRIPT_DIR="$(dirname "$0")"
+"${SCRIPT_DIR}/use-sdk-preview" "${BRANCH}"
diff --git a/apps/cli/scripts/format b/apps/cli/scripts/format
new file mode 100755
index 00000000..db2a3fa2
--- /dev/null
+++ b/apps/cli/scripts/format
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+echo "==> Running gofmt -s -w"
+gofmt -s -w .
diff --git a/apps/cli/scripts/link b/apps/cli/scripts/link
new file mode 100755
index 00000000..5c7f88e4
--- /dev/null
+++ b/apps/cli/scripts/link
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+if [[ -n "$1" ]]; then
+  LOCAL_GO="$1"
+  shift
+else
+  LOCAL_GO=../hypeman-go
+fi
+
+echo "==> Linking with local directory"
+go mod tidy -e
+go mod edit -replace github.com/kernel/hypeman-go="$LOCAL_GO"
diff --git a/apps/cli/scripts/lint b/apps/cli/scripts/lint
new file mode 100755
index 00000000..fa7ba1f6
--- /dev/null
+++ b/apps/cli/scripts/lint
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+echo "==> Running Go build"
+go build ./...
diff --git a/apps/cli/scripts/mock b/apps/cli/scripts/mock
new file mode 100755
index 00000000..0b28f6ea
--- /dev/null
+++ b/apps/cli/scripts/mock
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+if [[ -n "$1" && "$1" != '--'* ]]; then
+  URL="$1"
+  shift
+else
+  URL="$(grep 'openapi_spec_url' .stats.yml | cut -d' ' -f2)"
+fi
+
+# Check if the URL is empty
+if [ -z "$URL" ]; then
+  echo "Error: No OpenAPI spec path/url provided or found in .stats.yml"
+  exit 1
+fi
+
+echo "==> Starting mock server with URL ${URL}"
+
+# Run prism mock on the given spec
+if [ "$1" == "--daemon" ]; then
+  npm exec --package=@stainless-api/prism-cli@5.15.0 -- prism mock "$URL" &> .prism.log &
+
+  # Wait for server to come online
+  echo -n "Waiting for server"
+  while ! grep -q "✖  fatal\|Prism is listening" ".prism.log" ; do
+    echo -n "."
+    sleep 0.1
+  done
+
+  if grep -q "✖  fatal" ".prism.log"; then
+    cat .prism.log
+    exit 1
+  fi
+
+  echo
+else
+  npm exec --package=@stainless-api/prism-cli@5.15.0 -- prism mock "$URL"
+fi
diff --git a/apps/cli/scripts/run b/apps/cli/scripts/run
new file mode 100755
index 00000000..7818f0ee
--- /dev/null
+++ b/apps/cli/scripts/run
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+go run ./cmd/hypeman "$@"
diff --git a/apps/cli/scripts/test b/apps/cli/scripts/test
new file mode 100755
index 00000000..c26b1222
--- /dev/null
+++ b/apps/cli/scripts/test
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[0;33m'
+NC='\033[0m' # No Color
+
+function prism_is_running() {
+  curl --silent "http://localhost:4010" >/dev/null 2>&1
+}
+
+kill_server_on_port() {
+  pids=$(lsof -t -i tcp:"$1" || echo "")
+  if [ "$pids" != "" ]; then
+    kill "$pids"
+    echo "Stopped $pids."
+  fi
+}
+
+function is_overriding_api_base_url() {
+  [ -n "$TEST_API_BASE_URL" ]
+}
+
+if ! is_overriding_api_base_url && ! prism_is_running ; then
+  # When we exit this script, make sure to kill the background mock server process
+  trap 'kill_server_on_port 4010' EXIT
+
+  # Start the dev server
+  ./scripts/mock --daemon
+fi
+
+if is_overriding_api_base_url ; then
+  echo -e "${GREEN}✔ Running tests against ${TEST_API_BASE_URL}${NC}"
+  echo
+elif ! prism_is_running ; then
+  echo -e "${RED}ERROR:${NC} The test suite will not run without a mock Prism server"
+  echo -e "running against your OpenAPI spec."
+  echo
+  echo -e "To run the server, pass in the path or url of your OpenAPI"
+  echo -e "spec to the prism command:"
+  echo
+  echo -e "  \$ ${YELLOW}npm exec --package=@stainless-api/prism-cli@5.15.0 -- prism mock path/to/your.openapi.yml${NC}"
+  echo
+
+  exit 1
+else
+  echo -e "${GREEN}✔ Mock prism server is running with your OpenAPI spec${NC}"
+  echo
+fi
+
+echo "==> Running tests"
+go test ./... "$@"
diff --git a/apps/cli/scripts/unlink b/apps/cli/scripts/unlink
new file mode 100755
index 00000000..e96c0dc4
--- /dev/null
+++ b/apps/cli/scripts/unlink
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+echo "==> Unlinking with local directory"
+go mod edit -dropreplace github.com/kernel/hypeman-go
diff --git a/apps/cli/scripts/use-sdk-preview b/apps/cli/scripts/use-sdk-preview
new file mode 100755
index 00000000..8518d610
--- /dev/null
+++ b/apps/cli/scripts/use-sdk-preview
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Point the kernel/hypeman-go dependency to stainless-sdks/hypeman-go at a specific branch.
+#
+# Usage:
+#   ./scripts/use-sdk-preview <branch-name>
+#   ./scripts/use-sdk-preview <commit-hash>
+#
+# This modifies go.mod with a replace directive. Do not commit this change.
+
+cd "$(dirname "$0")/.."
+
+STAINLESS_SDK_REPO="github.com/stainless-sdks/hypeman-go"
+PUBLIC_SDK_REPO="github.com/kernel/hypeman-go"
+
+# Ensure the Go toolchain can access the private SDK repository.
+if [[ -z "${GOPRIVATE:-}" ]]; then
+  export GOPRIVATE="$STAINLESS_SDK_REPO"
+elif [[ "$GOPRIVATE" != *"$STAINLESS_SDK_REPO"* ]]; then
+  export GOPRIVATE="${GOPRIVATE},${STAINLESS_SDK_REPO}"
+fi
+
+# Ensure git rewrites GitHub HTTPS URLs to SSH for private repo access.
+if ! git config --global --get-all url."git@github.com:".insteadOf | grep -q "https://github.com/"; then
+  echo "Your git configuration is missing the rewrite from HTTPS to SSH for GitHub repositories." >&2
+  echo "Run the following command and try again:" >&2
+  echo "  git config --global url.\"git@github.com:\".insteadOf \"https://github.com/\"" >&2
+  exit 1
+fi
+
+usage() {
+  echo "Usage: $(basename "$0") <commit-hash|branch-name>" >&2
+  echo "" >&2
+  echo "Point the hypeman-go SDK dependency to stainless-sdks/hypeman-go at a specific ref." >&2
+  echo "" >&2
+  echo "Examples:" >&2
+  echo "  $(basename "$0") preview/devices      # Use preview/devices branch" >&2
+  echo "  $(basename "$0") main                 # Use main branch" >&2
+  echo "  $(basename "$0") abc1234              # Use specific commit" >&2
+  exit 1
+}
+
+if [ "$#" -ne 1 ]; then
+  usage
+fi
+
+ref="$1"
+commit=""
+tmp_dir="/tmp/hypeman-go"
+
+# Clone the stainless-sdks/hypeman-go repo (shallow clone for speed)
+rm -rf "$tmp_dir"
+echo "==> Cloning stainless-sdks/hypeman-go..."
+git clone --filter=blob:none --quiet git@github.com:stainless-sdks/hypeman-go "$tmp_dir"
+
+# Determine the commit hash corresponding to the provided ref
+pushd "$tmp_dir" >/dev/null
+
+# If the ref looks like a commit SHA (7-40 hex chars), use it directly; otherwise treat it as a branch
+if [[ "$ref" =~ ^[0-9a-f]{7,40}$ ]]; then
+  commit="$ref"
+else
+  # Fetch the branch and resolve its HEAD commit hash
+  git fetch --depth=1 origin "$ref" >/dev/null 2>&1 || {
+    echo "Error: failed to fetch branch '$ref' from stainless-sdks/hypeman-go." >&2
+    popd >/dev/null
+    exit 1
+  }
+  commit=$(git rev-parse FETCH_HEAD)
+fi
+
+# Compute the Go pseudo-version for the resolved commit
+gomod_version=$(git show -s --abbrev=12 \
+  --date=format:%Y%m%d%H%M%S \
+  --format='v0.0.0-%cd-%h' "$commit")
+
+popd >/dev/null
+
+# Verify we're in the CLI module directory
+if [ ! -f go.mod ]; then
+  echo "go.mod not found. Please run this script from the hypeman-cli repository root." >&2
+  exit 1
+fi
+
+echo "==> Updating go.mod to use stainless-sdks/hypeman-go @ $gomod_version..."
+
+# Remove any existing replace directive for the SDK, then add the new one
+go mod edit -dropreplace="$PUBLIC_SDK_REPO" 2>/dev/null || true
+go mod edit -replace="$PUBLIC_SDK_REPO"="$STAINLESS_SDK_REPO"@"$gomod_version"
+go mod tidy
+
+echo ""
+echo "go.mod updated to use $STAINLESS_SDK_REPO @ $gomod_version"
+echo ""
+echo "WARNING: Do not commit this change to go.mod/go.sum!"
+
diff --git a/go.work b/go.work
new file mode 100644
index 00000000..5dbeed1c
--- /dev/null
+++ b/go.work
@@ -0,0 +1,7 @@
+go 1.25.4
+
+use (
+	.
+	./apps/cli
+	./sdks/go
+)
diff --git a/go.work.sum b/go.work.sum
new file mode 100644
index 00000000..24c9e0e4
--- /dev/null
+++ b/go.work.sum
@@ -0,0 +1,36 @@
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
+github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f/go.mod h1:HlzOvOjVBOfTGSRXRyY0OiCS/3J1akRGQQpRO/7zyF4=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/envoyproxy/go-control-plane v0.13.5-0.20251024222203-75eaa193e329/go.mod h1:Alz8LEClvR7xKsrq3qzoc4N0guvVNSS8KmSChGYr9hs=
+github.com/envoyproxy/go-control-plane/envoy v1.35.0/go.mod h1:09qwbGVuSWWAyN5t/b3iyVfz5+z8QWGrzkoqm/8SbEs=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
+github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
+github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
+github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
+go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/telemetry v0.0.0-20251111182119-bc8e575c7b54/go.mod h1:hKdjCMrbv9skySur+Nek8Hd0uJ0GuxJIoIX2payrIdQ=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
diff --git a/openapi.yaml b/openapi.yaml
index 8e60ee13..5c94bcc1 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -593,6 +593,18 @@ components:
           type: string
           enum: [ok]
           example: ok
+        automation_probe:
+          type: string
+          description: Temporary field for CI SDK sync validation
+          example: probe
+        automation_probe_phase:
+          type: string
+          description: Temporary second field to force SDK regeneration
+          example: phase-2
+        automation_probe_nonce:
+          type: string
+          description: Temporary third field to force another SDK regeneration
+          example: n-3
     
     IngressMatch:
       type: object
diff --git a/scripts/e2e-install-test.sh b/scripts/e2e-install-test.sh
index 764d0353..84d5046f 100755
--- a/scripts/e2e-install-test.sh
+++ b/scripts/e2e-install-test.sh
@@ -37,6 +37,15 @@ KEEP_DATA=false bash scripts/uninstall.sh 2>/dev/null || true
 # =============================================================================
 info "Phase 2: Installing from source..."
 BRANCH=$(git rev-parse --abbrev-ref HEAD)
+if [ "$BRANCH" = "HEAD" ]; then
+    if [ -n "${GITHUB_HEAD_REF:-}" ]; then
+        BRANCH="$GITHUB_HEAD_REF"
+    elif [ -n "${GITHUB_REF_NAME:-}" ]; then
+        BRANCH="$GITHUB_REF_NAME"
+    else
+        fail "Unable to determine branch for source install (detached HEAD without GitHub branch context)"
+    fi
+fi
 # Build CLI from source too when CLI_BRANCH is set (e.g., for testing unreleased CLI features)
 BRANCH="$BRANCH" CLI_BRANCH="${CLI_BRANCH:-}" bash scripts/install.sh
 
diff --git a/scripts/install.sh b/scripts/install.sh
index 896fa12a..73e4bce3 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -9,7 +9,7 @@
 #   VERSION      - Install specific API version (default: latest)
 #   CLI_VERSION  - Install specific CLI version (default: latest)
 #   BRANCH       - Build from source using this branch (for development/testing)
-#   CLI_BRANCH   - Build CLI from source using this branch of kernel/hypeman-cli
+#   CLI_BRANCH   - Build CLI from source using this branch of kernel/hypeman
 #   BINARY_DIR   - Use binaries from this directory instead of building/downloading
 #   INSTALL_DIR  - Binary installation directory (default: /opt/hypeman/bin on Linux, /usr/local/bin on macOS)
 #   DATA_DIR     - Data directory (default: /var/lib/hypeman on Linux, ~/Library/Application Support/hypeman on macOS)
@@ -163,6 +163,11 @@ if [ "$count" -gt 1 ]; then
     error "BRANCH, VERSION, and BINARY_DIR are mutually exclusive"
 fi
 
+# When building API from source, default CLI source branch to the same branch.
+if [ -n "$BRANCH" ] && [ -z "$CLI_BRANCH" ]; then
+    CLI_BRANCH="$BRANCH"
+fi
+
 # Additional checks for build-from-source mode
 if [ -n "$BRANCH" ]; then
     command -v git >/dev/null 2>&1 || error "git is required for BRANCH mode but not installed"
@@ -629,22 +634,28 @@ fi
 # Install Hypeman CLI
 # =============================================================================
 
-CLI_REPO="kernel/hypeman-cli"
+CLI_RELEASE_REPO="kernel/hypeman-cli"
 CLI_INSTALLED=false
 
 if [ -n "$CLI_BRANCH" ]; then
     # Build CLI from source
-    info "Building CLI from source (branch: $CLI_BRANCH)..."
+    info "Building CLI from monorepo source (branch: $CLI_BRANCH)..."
     command -v go >/dev/null 2>&1 || error "go is required for CLI_BRANCH mode but not installed"
 
+    # Reuse API source checkout when possible to avoid re-cloning into the same temp path.
     CLI_BUILD_DIR="${TMP_DIR}/hypeman-cli"
-    if ! git clone --branch "$CLI_BRANCH" --depth 1 -q "https://github.com/${CLI_REPO}.git" "$CLI_BUILD_DIR" 2>&1; then
-        error "Failed to clone CLI repository (branch: $CLI_BRANCH)"
+    if [ -n "$BRANCH" ] && [ "$CLI_BRANCH" = "$BRANCH" ] && [ -d "${TMP_DIR}/hypeman" ]; then
+        CLI_BUILD_DIR="${TMP_DIR}/hypeman"
+    else
+        rm -rf "$CLI_BUILD_DIR"
+        if ! git clone --branch "$CLI_BRANCH" --depth 1 -q "https://github.com/${REPO}.git" "$CLI_BUILD_DIR" 2>&1; then
+            error "Failed to clone monorepo for CLI build (branch: $CLI_BRANCH)"
+        fi
     fi
 
     info "Compiling CLI..."
     mkdir -p "${TMP_DIR}/cli-bin"
-    if ! (cd "$CLI_BUILD_DIR" && go build -o "${TMP_DIR}/cli-bin/hypeman" ./cmd/hypeman 2>&1); then
+    if ! (cd "$CLI_BUILD_DIR" && go build -o "${TMP_DIR}/cli-bin/hypeman" ./apps/cli/cmd/hypeman 2>&1); then
         error "Failed to build CLI from source"
     fi
 
@@ -668,7 +679,7 @@ else
 
     if [ -z "$CLI_VERSION" ] || [ "$CLI_VERSION" == "latest" ]; then
         info "Fetching latest CLI version with available artifacts..."
-        CLI_VERSION=$(find_release_with_artifact "$CLI_REPO" "hypeman" "$CLI_OS" "$ARCH" "$CLI_EXT" || true)
+        CLI_VERSION=$(find_release_with_artifact "$CLI_RELEASE_REPO" "hypeman" "$CLI_OS" "$ARCH" "$CLI_EXT" || true)
         if [ -z "$CLI_VERSION" ]; then
             warn "Failed to find a CLI release with artifacts for ${CLI_OS}/${ARCH}, skipping CLI installation"
         fi
@@ -679,7 +690,7 @@ else
 
         CLI_VERSION_NUM="${CLI_VERSION#v}"
         CLI_ARCHIVE_NAME="hypeman_${CLI_VERSION_NUM}_${CLI_OS}_${ARCH}.${CLI_EXT}"
-        CLI_DOWNLOAD_URL="https://github.com/${CLI_REPO}/releases/download/${CLI_VERSION}/${CLI_ARCHIVE_NAME}"
+        CLI_DOWNLOAD_URL="https://github.com/${CLI_RELEASE_REPO}/releases/download/${CLI_VERSION}/${CLI_ARCHIVE_NAME}"
 
         info "Downloading CLI ${CLI_ARCHIVE_NAME}..."
         if curl -fsSL "$CLI_DOWNLOAD_URL" -o "${TMP_DIR}/${CLI_ARCHIVE_NAME}"; then
diff --git a/scripts/utm/bootstrap-dev-environment.sh b/scripts/utm/bootstrap-dev-environment.sh
index fcd191b5..7406ab77 100755
--- a/scripts/utm/bootstrap-dev-environment.sh
+++ b/scripts/utm/bootstrap-dev-environment.sh
@@ -100,9 +100,6 @@ mkdir -p ~/code
 
 REPOS=(
     "kernel/hypeman"
-    "kernel/hypeman-ts"
-    "kernel/hypeman-go"
-    "kernel/hypeman-cli"
     "kernel/linux"
 )
 
diff --git a/sdks/go/.devcontainer/devcontainer.json b/sdks/go/.devcontainer/devcontainer.json
new file mode 100644
index 00000000..889ae347
--- /dev/null
+++ b/sdks/go/.devcontainer/devcontainer.json
@@ -0,0 +1,7 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/debian
+{
+  "name": "Development",
+  "image": "mcr.microsoft.com/devcontainers/go:1.23-bookworm",
+  "postCreateCommand": "go mod tidy"
+}
diff --git a/sdks/go/.github/workflows/ci.yml b/sdks/go/.github/workflows/ci.yml
new file mode 100644
index 00000000..aa2972c5
--- /dev/null
+++ b/sdks/go/.github/workflows/ci.yml
@@ -0,0 +1,49 @@
+name: CI
+on:
+  push:
+    branches-ignore:
+      - 'generated'
+      - 'codegen/**'
+      - 'integrated/**'
+      - 'stl-preview-head/**'
+      - 'stl-preview-base/**'
+  pull_request:
+    branches-ignore:
+      - 'stl-preview-head/**'
+      - 'stl-preview-base/**'
+
+jobs:
+  lint:
+    timeout-minutes: 10
+    name: lint
+    runs-on: ${{ github.repository == 'stainless-sdks/hypeman-go' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: ./go.mod
+
+      - name: Run lints
+        run: ./scripts/lint
+  test:
+    timeout-minutes: 10
+    name: test
+    runs-on: ${{ github.repository == 'stainless-sdks/hypeman-go' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: ./go.mod
+
+      - name: Bootstrap
+        run: ./scripts/bootstrap
+
+      - name: Run tests
+        run: ./scripts/test
diff --git a/sdks/go/.github/workflows/update-cli-coverage.yml b/sdks/go/.github/workflows/update-cli-coverage.yml
new file mode 100644
index 00000000..1ced9fef
--- /dev/null
+++ b/sdks/go/.github/workflows/update-cli-coverage.yml
@@ -0,0 +1,368 @@
+name: Update CLI Coverage
+
+on:
+  push:
+    branches: 
+    - main
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to use for context (leave empty to use most recent merged PR)'
+        required: false
+        type: string
+
+# Only run one instance at a time; cancel older runs when a new push arrives
+concurrency:
+  group: update-cli-coverage
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  update-cli-coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.ADMIN_APP_ID }}
+          private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
+          owner: kernel
+
+      - name: Get PR info for manual dispatch
+        id: pr-info
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          if [ -n "${{ inputs.pr_number }}" ]; then
+            # Use provided PR number
+            PR_NUMBER="${{ inputs.pr_number }}"
+            echo "Using provided PR number: $PR_NUMBER"
+          else
+            # Get most recent merged PR
+            PR_NUMBER=$(gh pr list --repo ${{ github.repository }} --state merged --limit 1 --json number --jq '.[0].number')
+            echo "Using most recent merged PR: $PR_NUMBER"
+          fi
+
+          if [ -z "$PR_NUMBER" ]; then
+            echo "No PR found, will use HEAD commit"
+            echo "has_pr=false" >> $GITHUB_OUTPUT
+          else
+            # Get PR details
+            PR_DATA=$(gh pr view "$PR_NUMBER" --repo ${{ github.repository }} --json mergeCommit,author,title)
+            MERGE_SHA=$(echo "$PR_DATA" | jq -r '.mergeCommit.oid // empty')
+            PR_AUTHOR=$(echo "$PR_DATA" | jq -r '.author.login // empty')
+            PR_TITLE=$(echo "$PR_DATA" | jq -r '.title // empty')
+
+            echo "PR #$PR_NUMBER: $PR_TITLE"
+            echo "Merge commit: $MERGE_SHA"
+            echo "Author: $PR_AUTHOR"
+
+            echo "has_pr=true" >> $GITHUB_OUTPUT
+            echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
+            echo "merge_sha=$MERGE_SHA" >> $GITHUB_OUTPUT
+            echo "pr_author=$PR_AUTHOR" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Checkout SDK repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+          fetch-tags: true
+          # For manual dispatch with a specific PR, checkout the merge commit
+          ref: ${{ steps.pr-info.outputs.merge_sha || github.sha }}
+
+      - name: Install Cursor CLI
+        run: |
+          curl https://cursor.com/install -fsS | bash
+          echo "$HOME/.cursor/bin" >> $GITHUB_PATH
+
+      - name: Configure git identity
+        run: |
+          git config --global user.name "kernel-internal[bot]"
+          git config --global user.email "260533166+kernel-internal[bot]@users.noreply.github.com"
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: 'stable'
+
+      - name: Clone API repo
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          gh repo clone kernel/hypeman /tmp/hypeman -- --depth=1
+
+      - name: Clone CLI repo and checkout existing branch
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          gh repo clone kernel/hypeman-cli /tmp/hypeman-cli
+          cd /tmp/hypeman-cli
+
+          # Try to fetch the cli-coverage-update branch from remote
+          if git fetch origin cli-coverage-update 2>/dev/null; then
+            echo "Branch cli-coverage-update exists, checking it out..."
+            git checkout cli-coverage-update
+            # Merge latest main to keep it up to date
+            git merge origin/main -m "Merge main into cli-coverage-update" --no-edit || true
+          else
+            echo "Branch cli-coverage-update does not exist, creating from main..."
+            git checkout -b cli-coverage-update
+          fi
+
+      - name: Get SDK version info
+        id: sdk-version
+        run: |
+          # Get the latest tag if available, otherwise use commit SHA
+          LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          if [ -n "$LATEST_TAG" ]; then
+            echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+            echo "SDK version: $LATEST_TAG"
+          else
+            CURRENT_SHA="${{ steps.pr-info.outputs.merge_sha || github.sha }}"
+            echo "version=$CURRENT_SHA" >> $GITHUB_OUTPUT
+            echo "SDK version: $CURRENT_SHA (no tag)"
+          fi
+
+          # Get the module path from go.mod
+          MODULE_PATH=$(head -1 go.mod | awk '{print $2}')
+          echo "module=$MODULE_PATH" >> $GITHUB_OUTPUT
+          echo "SDK module: $MODULE_PATH"
+
+          # Determine the commit author (from PR info for manual dispatch, or from push event)
+          if [ -n "${{ steps.pr-info.outputs.pr_author }}" ]; then
+            echo "author=${{ steps.pr-info.outputs.pr_author }}" >> $GITHUB_OUTPUT
+          else
+            echo "author=${{ github.event.head_commit.author.username || github.actor }}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Update CLI coverage
+        env:
+          CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          BRANCH_PREFIX: cli-coverage-update
+        run: |
+          cursor-agent -p "You are a CLI updater that implements missing CLI commands based on SDK updates.
+
+          The GitHub CLI is available as \`gh\` and authenticated via GH_TOKEN. Git is available. You have write access to the CLI repository (kernel/hypeman-cli).
+
+          # Context
+          - SDK Repo: ${{ github.repository }} (current directory)
+          - SDK Module: ${{ steps.sdk-version.outputs.module }}
+          - SDK Version: ${{ steps.sdk-version.outputs.version }}
+          - Commit SHA: ${{ steps.pr-info.outputs.merge_sha || github.sha }}
+          - Commit Author: ${{ steps.sdk-version.outputs.author }}
+          - Trigger: ${{ github.event_name }} ${{ inputs.pr_number && format('(PR #{0})', inputs.pr_number) || '' }}
+          - API Repo Location: /tmp/hypeman
+          - CLI Repo Location: /tmp/hypeman-cli
+          - Update Branch Prefix: cli-coverage-update
+
+          # Background
+          The Go SDK (this repo) was just updated by Stainless, and may contain new API methods. The CLI (kernel/hypeman-cli) needs to be updated to expose these new methods as CLI commands.
+
+          # Source Files
+          - SDK api.md: Current directory - READ THIS FILE FIRST. This is the authoritative list of all SDK methods and their signatures.
+          - SDK *.go files: Current directory - Contains param structs (e.g., InstanceNewParams, ImageNewParams) with all available options/fields.
+          - API Spec: /tmp/hypeman/stainless.yaml - SDK configuration with resources and methods
+          - API Spec: /tmp/hypeman/openapi.yaml - Full OpenAPI specification. CHECK for x-cli-skip: true on endpoints - skip those from CLI coverage.
+          - CLI: /tmp/hypeman-cli - Existing CLI commands (in pkg/cmd/ directory)
+
+          # CLI Architecture
+          The CLI uses urfave/cli/v3 (NOT cobra). Commands are defined in /tmp/hypeman-cli/pkg/cmd/:
+          - Root command: pkg/cmd/cmd.go
+          - Resource commands: pkg/cmd/{resource}cmd.go (e.g., imagecmd.go, volumecmd.go, devicecmd.go, ingresscmd.go)
+          - Top-level commands: pkg/cmd/{command}.go (e.g., run.go, ps.go, rm.go, logs.go, exec.go, cp.go)
+          - Lifecycle commands: pkg/cmd/lifecycle.go (stop, start, standby, restore)
+          - Build commands: pkg/cmd/build.go
+          - Utilities: pkg/cmd/cmdutil.go, pkg/cmd/format.go
+          - Entry point: cmd/hypeman/main.go
+
+          # Task
+
+          ## Step 1: Update SDK Version (ALWAYS DO THIS FIRST)
+          - Go to /tmp/hypeman-cli
+          - Update go.mod to require the latest SDK: ${{ steps.sdk-version.outputs.module }}@${{ steps.sdk-version.outputs.version }}
+          - Run: go get ${{ steps.sdk-version.outputs.module }}@${{ steps.sdk-version.outputs.version }}
+          - Run: go mod tidy
+          - This ensures the CLI always uses the latest SDK, even if no new commands are added
+
+          ## Step 2: Full SDK Method Enumeration (CRITICAL - DO NOT SKIP)
+          You MUST perform a complete enumeration of ALL SDK methods and their parameters. Do NOT rely only on recent commits.
+
+          2a. Read the api.md file in the SDK repo root. This file lists EVERY SDK method in the format:
+              - \`client.Resource.Method(ctx, params)\` with links to param types
+              Extract a complete list of all methods.
+
+          2b. For EACH SDK method, read the corresponding param type from the Go source files.
+              For example:
+              - InstanceNewParams in instance.go -> lists all fields like \`Image\`, \`Region\`, \`VolumeMounts\`, etc.
+              - ImageNewParams in image.go -> lists all fields like \`Name\`, \`Tag\`, etc.
+              - VolumeNewParams in volume.go -> lists all fields like \`Name\`, \`Size\`, etc.
+              Each field in a Params struct represents an option that could be a CLI flag.
+
+          2c. Build a complete SDK coverage matrix:
+              | SDK Method | SDK Param Type | SDK Param Fields |
+              |------------|----------------|------------------|
+              | client.Instances.New | InstanceNewParams | Image, Region, VolumeMounts, ... |
+              | client.Instances.List | (none) | |
+              | client.Images.New | ImageNewParams | Name, Tag, ... |
+              | client.Volumes.New | VolumeNewParams | Name, Size, ... |
+              | ... | ... | ... |
+
+          ## Step 3: Full CLI Command Enumeration (CRITICAL - DO NOT SKIP)
+          Enumerate ALL existing CLI commands and their flags.
+
+          3a. Look at pkg/cmd/ directory for existing command files
+          3b. For each command file, extract:
+              - The command name/path (e.g., \`hypeman run\`, \`hypeman image list\`)
+              - All flags defined for that command
+          3c. Build a CLI coverage matrix:
+              | CLI Command | CLI Flags |
+              |-------------|-----------|
+              | hypeman run | --name, --image, --quiet, ... |
+              | hypeman ps | --quiet, --format, ... |
+              | hypeman image list | --format, ... |
+              | hypeman volume create | --name, ... |
+              | ... | ... |
+
+          ## Step 4: Gap Analysis (CRITICAL - DO NOT SKIP)
+          Compare the SDK matrix (Step 2) with the CLI matrix (Step 3) to identify:
+
+          4a. Missing commands: SDK methods with NO corresponding CLI command
+          4b. Missing flags: SDK param fields with NO corresponding CLI flag
+          4c. Create a gap report:
+              ## Missing Commands
+              - client.SomeResource.SomeMethod -> needs new CLI command
+
+              ## Missing Flags
+              - InstanceNewParams.SomeNewField -> \`hypeman run\` needs --some-new-field
+              - VolumeNewParams.Region -> \`hypeman volume create\` needs --region
+
+          ## Step 5: Implement Missing Coverage
+          For each gap identified in Step 4:
+          - Implement missing commands following existing patterns in pkg/cmd/
+          - Add missing flags to existing commands
+          - Use urfave/cli/v3 for command and flag definitions (NOT cobra)
+          - Run \`go build ./...\` to verify the code compiles
+
+          ## Step 6: Commit and Push
+          - You should already be on the cli-coverage-update branch (it was checked out during setup if it existed)
+          - If you're on main, create/switch to the cli-coverage-update branch
+          - Commit with message describing SDK version bump and any new commands/flags
+          - IMPORTANT: Do NOT force push! Use regular \`git push origin cli-coverage-update\` to preserve existing work on the branch
+          - If push fails due to divergence, pull and rebase first: \`git pull --rebase origin cli-coverage-update\`
+          - Create or update the PR in kernel/hypeman-cli
+
+          # SDK Method -> CLI Command Mapping Guide
+          Instance operations use Docker-style top-level commands:
+          - client.Instances.New() -> hypeman run
+          - client.Instances.List() -> hypeman ps
+          - client.Instances.Delete() -> hypeman rm
+          - client.Instances.Get() -> (used internally by other commands)
+          - client.Instances.Logs() -> hypeman logs
+          - client.Instances.Stop() -> hypeman stop
+          - client.Instances.Start() -> hypeman start
+          - client.Instances.Standby() -> hypeman standby
+          - client.Instances.Restore() -> hypeman restore
+          - client.Instances.Stat() -> (used internally by cp)
+
+          Resource group commands use subcommands:
+          - client.Images.New() -> hypeman image create
+          - client.Images.List() -> hypeman image list
+          - client.Images.Get() -> hypeman image get
+          - client.Images.Delete() -> hypeman image delete
+          - client.Volumes.New() -> hypeman volume create
+          - client.Volumes.List() -> hypeman volume list
+          - client.Volumes.Get() -> hypeman volume get
+          - client.Volumes.Delete() -> hypeman volume delete
+          - client.Volumes.NewFromArchive() -> (used internally by push)
+          - client.Instances.Volumes.Attach() -> hypeman volume attach
+          - client.Instances.Volumes.Detach() -> hypeman volume detach
+          - client.Devices.New() -> hypeman device register
+          - client.Devices.List() -> hypeman device list
+          - client.Devices.Get() -> hypeman device get
+          - client.Devices.Delete() -> hypeman device delete
+          - client.Devices.ListAvailable() -> hypeman device available
+          - client.Ingresses.New() -> hypeman ingress create
+          - client.Ingresses.List() -> hypeman ingress list
+          - client.Ingresses.Get() -> hypeman ingress get
+          - client.Ingresses.Delete() -> hypeman ingress delete
+          - client.Builds.New() -> hypeman build create (or used internally)
+          - client.Builds.List() -> hypeman build list
+          - client.Builds.Get() -> hypeman build get
+          - client.Builds.Cancel() -> hypeman build cancel
+          - client.Builds.Events() -> (used internally for streaming build output)
+          - client.Resources.Get() -> hypeman resources
+          - client.Health.Check() -> (internal, no CLI needed)
+
+          # SDK Param Field -> CLI Flag Mapping Guide
+          - CamelCaseField -> --camel-case-field
+          - TimeoutSeconds -> --timeout-seconds
+          - IncludeDeleted -> --include-deleted
+          - Optional fields use hypeman.Opt() wrapper in SDK calls
+
+          # Implementation Guidelines
+          - Follow the existing CLI code patterns in /tmp/hypeman-cli/pkg/cmd/
+          - Use urfave/cli/v3 for command definitions (cli.Command struct with Flags, Action, etc.)
+          - Use the Hypeman Go SDK (this repo) for API calls: hypeman.NewClient(getDefaultRequestOptions(cmd)...)
+          - Use existing helpers: ShowJSON() for output, ResolveInstance() for name resolution, FormatTimeAgo() for timestamps
+          - Include proper flag definitions with descriptions matching SDK field comments
+          - Add help text for commands matching SDK method comments
+          - Handle errors appropriately
+          - Match the style of existing commands
+
+          # Output Format
+          After pushing changes, create or update an evergreen PR using gh:
+
+          1. Check if a PR already exists for the cli-coverage-update branch:
+             gh pr list --repo kernel/hypeman-cli --head cli-coverage-update --json number
+
+          2. If PR exists, update it. If not, create a new one.
+
+          If new commands or flags were added:
+            Title: 'CLI: Update hypeman SDK to <version> and add new commands/flags'
+            Body:
+            'This PR updates the Hypeman Go SDK to ${{ steps.sdk-version.outputs.version }} and adds CLI commands/flags for new SDK methods.
+
+            ## SDK Update
+            - Updated hypeman-go to ${{ steps.sdk-version.outputs.version }}
+
+            ## Coverage Analysis
+            This PR was generated by performing a full enumeration of SDK methods and CLI commands.
+
+            ## New Commands
+            - \`hypeman <command>\` for \`client.Resource.Action()\`
+
+            ## New Flags
+            - \`--flag-name\` on \`hypeman <command>\` for \`ResourceParams.FieldName\`
+
+            Triggered by: kernel/hypeman-go@${{ steps.pr-info.outputs.merge_sha || github.sha }}
+            Reviewer: @<commit_author>'
+
+          If only SDK version update (no coverage gaps found):
+            Title: 'CLI: Update Hypeman Go SDK to ${{ steps.sdk-version.outputs.version }}'
+            Body:
+            'This PR updates the Hypeman Go SDK dependency to the latest version.
+
+            ## SDK Update
+            - Updated hypeman-go to ${{ steps.sdk-version.outputs.version }}
+
+            ## Coverage Analysis
+            A full enumeration of SDK methods and CLI commands was performed. No coverage gaps were found.
+
+            Triggered by: kernel/hypeman-go@${{ steps.pr-info.outputs.merge_sha || github.sha }}
+            Reviewer: @<commit_author>'
+
+          # Constraints
+          - ALWAYS update the SDK version in go.mod - this is the primary purpose
+          - ALWAYS perform the full enumeration (Steps 2-4) - this is critical for finding gaps
+          - ALL SDK methods in api.md MUST have corresponding CLI commands, EXCEPT those marked with x-cli-skip in openapi.yaml or noted as internal-only in the mapping guide above
+          - SKIP endpoints marked with x-cli-skip: true in openapi.yaml - these are internal endpoints not suitable for CLI
+          - Streaming methods may have different CLI implementations (e.g., build events are streamed internally)
+          - Even if no coverage gaps are found, still create a PR for the SDK version bump
+          - Ensure code compiles before pushing
+          " --model opus-4.6 --force --output-format=text
diff --git a/sdks/go/.gitignore b/sdks/go/.gitignore
new file mode 100644
index 00000000..c6d05015
--- /dev/null
+++ b/sdks/go/.gitignore
@@ -0,0 +1,4 @@
+.prism.log
+codegen.log
+Brewfile.lock.json
+.idea/
diff --git a/sdks/go/.release-please-manifest.json b/sdks/go/.release-please-manifest.json
new file mode 100644
index 00000000..d52d2b97
--- /dev/null
+++ b/sdks/go/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "0.13.0"
+}
\ No newline at end of file
diff --git a/sdks/go/.stats.yml b/sdks/go/.stats.yml
new file mode 100644
index 00000000..aac8b522
--- /dev/null
+++ b/sdks/go/.stats.yml
@@ -0,0 +1,4 @@
+configured_endpoints: 37
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel%2Fhypeman-57c5cb3d3dc57a03333475dc1817875a36eead6be9439c0203d1832c32b068d5.yml
+openapi_spec_hash: 14f7b09e6e010020f42981dddeb0b415
+config_hash: d452c139da1e46a44a68b91e8a40de72
diff --git a/sdks/go/Brewfile b/sdks/go/Brewfile
new file mode 100644
index 00000000..577e34a4
--- /dev/null
+++ b/sdks/go/Brewfile
@@ -0,0 +1 @@
+brew "go"
diff --git a/sdks/go/CHANGELOG.md b/sdks/go/CHANGELOG.md
new file mode 100644
index 00000000..da39ffc0
--- /dev/null
+++ b/sdks/go/CHANGELOG.md
@@ -0,0 +1,202 @@
+# Changelog
+
+## 0.13.0 (2026-02-26)
+
+Full Changelog: [v0.12.0...v0.13.0](https://github.com/kernel/hypeman-go/compare/v0.12.0...v0.13.0)
+
+### Features
+
+* wire up memory_mb and cpus in builds API ([ed09f5a](https://github.com/kernel/hypeman-go/commit/ed09f5a0bc3c60e7ccf6da1101d23311107c7118))
+
+## 0.12.0 (2026-02-26)
+
+Full Changelog: [v0.11.0...v0.12.0](https://github.com/kernel/hypeman-go/compare/v0.11.0...v0.12.0)
+
+### Features
+
+* add metadata and state filtering to GET /instances ([8149c9f](https://github.com/kernel/hypeman-go/commit/8149c9fe5e9b36aa5709767e7f3986d6778bd432))
+* Disable default hotplug memory allocation ([4c65d5c](https://github.com/kernel/hypeman-go/commit/4c65d5c271ac3a620da549b47ece553e1860aaf6))
+
+
+### Bug Fixes
+
+* allow canceling a request while it is waiting to retry ([daa2281](https://github.com/kernel/hypeman-go/commit/daa2281e6e9833ae4dba2b9b6870014ceb0b2fff))
+* send query params for NewFromArchive ([a8c45a6](https://github.com/kernel/hypeman-go/commit/a8c45a69e83c96137c772d999a115972f0e6a003))
+
+
+### Chores
+
+* **internal:** move custom custom `json` tags to `api` ([d04f6ed](https://github.com/kernel/hypeman-go/commit/d04f6ed70c95357f323aa4e76b3a6ad8ebd12ec3))
+* **internal:** remove mock server code ([b511676](https://github.com/kernel/hypeman-go/commit/b51167627fc0cd0f947633cb8694f4ee0756c268))
+* update mock server docs ([d2ae478](https://github.com/kernel/hypeman-go/commit/d2ae478d46fb67550a3b35d4261218f9368709f0))
+
+## 0.11.0 (2026-02-15)
+
+Full Changelog: [v0.10.0...v0.11.0](https://github.com/kernel/hypeman-go/compare/v0.10.0...v0.11.0)
+
+### Features
+
+* Add image_name parameter to builds ([36ea383](https://github.com/kernel/hypeman-go/commit/36ea383988ce81b907a893220bbc983e8143a1d2))
+
+## 0.10.0 (2026-02-13)
+
+Full Changelog: [v0.9.8...v0.10.0](https://github.com/kernel/hypeman-go/compare/v0.9.8...v0.10.0)
+
+### Features
+
+* Add metadata field to instances ([8ce4014](https://github.com/kernel/hypeman-go/commit/8ce40145c0f6db8e928efa9c2909521a6d452579))
+* Better stop behavior ([12cfb4e](https://github.com/kernel/hypeman-go/commit/12cfb4e4ddfc198c65b09efeb73c8db0fd609f5f))
+
+## 0.9.8 (2026-02-11)
+
+Full Changelog: [v0.9.7...v0.9.8](https://github.com/kernel/hypeman-go/compare/v0.9.7...v0.9.8)
+
+## 0.9.7 (2026-02-11)
+
+Full Changelog: [v0.9.6...v0.9.7](https://github.com/kernel/hypeman-go/compare/v0.9.6...v0.9.7)
+
+### Bug Fixes
+
+* **encoder:** correctly serialize NullStruct ([e693834](https://github.com/kernel/hypeman-go/commit/e693834704b3541d4a5f260b547026bae8a19b1b))
+
+
+### Refactors
+
+* cross-platform foundation for macOS support ([8adc4f3](https://github.com/kernel/hypeman-go/commit/8adc4f38026abee34ad85c15509e90f47644a0d0))
+
+## 0.9.6 (2026-01-30)
+
+Full Changelog: [v0.9.0...v0.9.6](https://github.com/kernel/hypeman-go/compare/v0.9.0...v0.9.6)
+
+### Features
+
+* add boot time optimizations for faster VM startup ([3992761](https://github.com/kernel/hypeman-go/commit/3992761e3ad8ebb0cc22fb7408199b068e9d8013))
+* Add to stainless config new API endpoints ([de008e8](https://github.com/kernel/hypeman-go/commit/de008e89fadbaedde6554181618fb03c71b49465))
+* **api:** manual updates ([f60e600](https://github.com/kernel/hypeman-go/commit/f60e60015bb9ce18c7083963d9ecd11c980de495))
+* **builds:** implement two-tier build cache with per-repo token scopes ([0e29d03](https://github.com/kernel/hypeman-go/commit/0e29d03d94cf50a0d0e83c323f7ed9f2e15f3e61))
+* **client:** add a convenient param.SetJSON helper ([7fea166](https://github.com/kernel/hypeman-go/commit/7fea1660f3d17d8a35f5d2f6aa352b553785624b))
+* Use resources module for input validation ([af678e8](https://github.com/kernel/hypeman-go/commit/af678e8c794307a6bd47476acff3ca42a7a52546))
+
+## 0.9.0 (2026-01-05)
+
+Full Changelog: [v0.8.0...v0.9.0](https://github.com/kernel/hypeman-go/compare/v0.8.0...v0.9.0)
+
+### Features
+
+* QEMU support ([d708091](https://github.com/kernel/hypeman-go/commit/d70809169d136df3f1efbf961f2a90084e1f9fa5))
+* Resource accounting ([4141287](https://github.com/kernel/hypeman-go/commit/414128770e8137ed2a40d404f0f4ac06ea1a0731))
+
+## 0.8.0 (2025-12-23)
+
+Full Changelog: [v0.7.0...v0.8.0](https://github.com/kernel/hypeman-go/compare/v0.7.0...v0.8.0)
+
+### Features
+
+* add hypeman cp for file copy to/from running VMs ([49ea898](https://github.com/kernel/hypeman-go/commit/49ea89852eed5e0893febc4c68d295a0d1a8bfe5))
+* **encoder:** support bracket encoding form-data object members ([8ab31e8](https://github.com/kernel/hypeman-go/commit/8ab31e89c70baa967842c1c160d0b49db44b089a))
+* gpu passthrough ([067a01b](https://github.com/kernel/hypeman-go/commit/067a01b4ac06e82c2db6b165127144afa18a691d))
+
+
+### Bug Fixes
+
+* skip usage tests that don't work with Prism ([d62b246](https://github.com/kernel/hypeman-go/commit/d62b2466715247e7d083ab7ef33040e5da036bd8))
+
+
+### Chores
+
+* add float64 to valid types for RegisterFieldValidator ([b4666fd](https://github.com/kernel/hypeman-go/commit/b4666fd1bfcdd17b0a4d4bf88541670cd40c8b1c))
+
+## 0.7.0 (2025-12-11)
+
+Full Changelog: [v0.6.0...v0.7.0](https://github.com/kernel/hypeman-go/compare/v0.6.0...v0.7.0)
+
+### Features
+
+* Operational logs over API: hypeman.log, vmm.log ([ec614f5](https://github.com/kernel/hypeman-go/commit/ec614f5bdc0e110f31cec905d6deb7f1d460305b))
+* Support TLS for ingress ([973a5d8](https://github.com/kernel/hypeman-go/commit/973a5d8b65601e70801ed4570f76980d01c92198))
+
+
+### Bug Fixes
+
+* incorrect reporting of Stopped, add better error reporting ([dc27cbd](https://github.com/kernel/hypeman-go/commit/dc27cbdc7985c1db74b19501f1eb7a5da6442041))
+
+## 0.6.0 (2025-12-06)
+
+Full Changelog: [v0.5.0...v0.6.0](https://github.com/kernel/hypeman-go/compare/v0.5.0...v0.6.0)
+
+### Features
+
+* Start and Stop VM ([b992228](https://github.com/kernel/hypeman-go/commit/b99222818b197010ba324c2e2477047e5bf13802))
+
+
+### Bug Fixes
+
+* **mcp:** correct code tool API endpoint ([0d87152](https://github.com/kernel/hypeman-go/commit/0d8715273698dab9bb6c276352a13605ddd272a5))
+* rename param to avoid collision ([f1ec9d5](https://github.com/kernel/hypeman-go/commit/f1ec9d52e3f5f6c8398bdded04a4ed9cfbd8151b))
+
+
+### Chores
+
+* elide duplicate aliases ([9be276f](https://github.com/kernel/hypeman-go/commit/9be276faa6d683ddffe3a21c969b44f13acface0))
+* **internal:** codegen related update ([f3de06d](https://github.com/kernel/hypeman-go/commit/f3de06d220faf866b70829862cd1b76ee4e8fbf8))
+
+## 0.5.0 (2025-12-05)
+
+Full Changelog: [v0.4.0...v0.5.0](https://github.com/kernel/hypeman-go/compare/v0.4.0...v0.5.0)
+
+### Features
+
+* add Push and PushImage functions for OCI registry push ([7417cc8](https://github.com/kernel/hypeman-go/commit/7417cc8a56c7d11c535ac7ab9a7b3d21d80bd2b4))
+* Ingress ([c751d1a](https://github.com/kernel/hypeman-go/commit/c751d1a6bba5ca619c03f833f27251c6d3b855a7))
+* Initialize volume with data ([32d4047](https://github.com/kernel/hypeman-go/commit/32d404746df0a3e9d83e7651105e6c6daa16476f))
+* try to fix name collision in codegen ([8173a73](https://github.com/kernel/hypeman-go/commit/8173a73d0317d35870d5a3cec8f3fdec56fcf362))
+* Volume readonly multi-attach ([bac3fd2](https://github.com/kernel/hypeman-go/commit/bac3fd2cee3325dc3d1b31e6077ad1f1ce13340c))
+* Volumes ([099f9b8](https://github.com/kernel/hypeman-go/commit/099f9b8a2553087e117c8c8a9731900081d713f0))
+
+## 0.4.0 (2025-11-26)
+
+Full Changelog: [v0.3.0...v0.4.0](https://github.com/kernel/hypeman-go/compare/v0.3.0...v0.4.0)
+
+### Features
+
+* Generate log streaming ([f444c22](https://github.com/kernel/hypeman-go/commit/f444c22bd9eb0ad06e66b3ca167171ddec2836e4))
+
+## 0.3.0 (2025-11-26)
+
+Full Changelog: [v0.2.0...v0.3.0](https://github.com/kernel/hypeman-go/compare/v0.2.0...v0.3.0)
+
+### Features
+
+* Remove exec from openapi spec ([ee8d1bb](https://github.com/kernel/hypeman-go/commit/ee8d1bb586a130c0b6629603ca4edb489f671889))
+
+## 0.2.0 (2025-11-26)
+
+Full Changelog: [v0.1.0...v0.2.0](https://github.com/kernel/hypeman-go/compare/v0.1.0...v0.2.0)
+
+### Features
+
+* **api:** add exec ([f3992ff](https://github.com/kernel/hypeman-go/commit/f3992ffe807e7006a25ae2211cd5cb25fb599bff))
+
+## 0.1.0 (2025-11-26)
+
+Full Changelog: [v0.0.3...v0.1.0](https://github.com/kernel/hypeman-go/compare/v0.0.3...v0.1.0)
+
+### Features
+
+* Network manager ([7864aba](https://github.com/kernel/hypeman-go/commit/7864abadad29bcfbb61d2c35a7135ef2407d6c47))
+
+## 0.0.3 (2025-11-19)
+
+Full Changelog: [v0.0.2...v0.0.3](https://github.com/kernel/hypeman-go/compare/v0.0.2...v0.0.3)
+
+### Bug Fixes
+
+* **client:** correctly specify Accept header with */* instead of empty ([ac1a646](https://github.com/kernel/hypeman-go/commit/ac1a64697c333aecdc6a463fe760b99635ba8b72))
+
+## 0.0.2 (2025-11-11)
+
+Full Changelog: [v0.0.1...v0.0.2](https://github.com/kernel/hypeman-go/compare/v0.0.1...v0.0.2)
+
+### Chores
+
+* update SDK settings ([ecdeb35](https://github.com/kernel/hypeman-go/commit/ecdeb354a1d6a82a1d2afc1742ca02b25eb3218f))
diff --git a/sdks/go/CONTRIBUTING.md b/sdks/go/CONTRIBUTING.md
new file mode 100644
index 00000000..7feadf47
--- /dev/null
+++ b/sdks/go/CONTRIBUTING.md
@@ -0,0 +1,59 @@
+## Setting up the environment
+
+To set up the repository, run:
+
+```sh
+$ ./scripts/bootstrap
+$ ./scripts/lint
+```
+
+This will install all the required dependencies and build the SDK.
+
+You can also [install go 1.22+ manually](https://go.dev/doc/install).
+
+## Modifying/Adding code
+
+Most of the SDK is generated code. Modifications to code will be persisted between generations, but may
+result in merge conflicts between manual patches and changes from the generator. The generator will never
+modify the contents of the `lib/` and `examples/` directories.
+
+## Adding and running examples
+
+All files in the `examples/` directory are not modified by the generator and can be freely edited or added to.
+
+```go
+# add an example to examples/<your-example>/main.go
+
+package main
+
+func main() {
+  // ...
+}
+```
+
+```sh
+$ go run ./examples/<your-example>
+```
+
+## Using the repository from source
+
+To use a local version of this library from source in another project, edit the `go.mod` with a replace
+directive. This can be done through the CLI with the following:
+
+```sh
+$ go mod edit -replace github.com/kernel/hypeman-go=/path/to/hypeman-go
+```
+
+## Running tests
+
+```sh
+$ ./scripts/test
+```
+
+## Formatting
+
+This library uses the standard gofmt code formatter:
+
+```sh
+$ ./scripts/format
+```
diff --git a/sdks/go/LICENSE b/sdks/go/LICENSE
new file mode 100644
index 00000000..d8dff65d
--- /dev/null
+++ b/sdks/go/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Hypeman
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/sdks/go/README.md b/sdks/go/README.md
new file mode 100644
index 00000000..bc895a29
--- /dev/null
+++ b/sdks/go/README.md
@@ -0,0 +1,515 @@
+# Hypeman Go API Library
+
+<!-- x-release-please-start-version -->
+
+<a href="https://pkg.go.dev/github.com/kernel/hypeman-go"><img src="https://pkg.go.dev/badge/github.com/kernel/hypeman-go.svg" alt="Go Reference"></a>
+
+<!-- x-release-please-end -->
+
+The Hypeman Go library provides convenient access to the Hypeman REST API
+from applications written in Go.
+
+It is generated with [Stainless](https://www.stainless.com/).
+
+## Installation
+
+<!-- x-release-please-start-version -->
+
+```go
+import (
+	"github.com/kernel/hypeman-go" // imported as hypeman
+)
+```
+
+<!-- x-release-please-end -->
+
+Or to pin the version:
+
+<!-- x-release-please-start-version -->
+
+```sh
+go get -u 'github.com/kernel/hypeman-go@v0.13.0'
+```
+
+<!-- x-release-please-end -->
+
+## Requirements
+
+This library requires Go 1.22+.
+
+## Usage
+
+The full API of this library can be found in [api.md](api.md).
+
+```go
+package main
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/option"
+)
+
+func main() {
+	client := hypeman.NewClient(
+		option.WithAPIKey("My API Key"), // defaults to os.LookupEnv("HYPEMAN_API_KEY")
+	)
+	response, err := client.Health.Check(context.TODO())
+	if err != nil {
+		panic(err.Error())
+	}
+	fmt.Printf("%+v\n", response.Status)
+}
+
+```
+
+### Request fields
+
+The hypeman library uses the [`omitzero`](https://tip.golang.org/doc/go1.24#encodingjsonpkgencodingjson)
+semantics from the Go 1.24+ `encoding/json` release for request fields.
+
+Required primitive fields (`int64`, `string`, etc.) feature the tag <code>\`json:"...,required"\`</code>. These
+fields are always serialized, even their zero values.
+
+Optional primitive types are wrapped in a `param.Opt[T]`. These fields can be set with the provided constructors, `hypeman.String(string)`, `hypeman.Int(int64)`, etc.
+
+Any `param.Opt[T]`, map, slice, struct or string enum uses the
+tag <code>\`json:"...,omitzero"\`</code>. Its zero value is considered omitted.
+
+The `param.IsOmitted(any)` function can confirm the presence of any `omitzero` field.
+
+```go
+p := hypeman.ExampleParams{
+	ID:   "id_xxx",              // required property
+	Name: hypeman.String("..."), // optional property
+
+	Point: hypeman.Point{
+		X: 0,              // required field will serialize as 0
+		Y: hypeman.Int(1), // optional field will serialize as 1
+		// ... omitted non-required fields will not be serialized
+	},
+
+	Origin: hypeman.Origin{}, // the zero value of [Origin] is considered omitted
+}
+```
+
+To send `null` instead of a `param.Opt[T]`, use `param.Null[T]()`.
+To send `null` instead of a struct `T`, use `param.NullStruct[T]()`.
+
+```go
+p.Name = param.Null[string]()       // 'null' instead of string
+p.Point = param.NullStruct[Point]() // 'null' instead of struct
+
+param.IsNull(p.Name)  // true
+param.IsNull(p.Point) // true
+```
+
+Request structs contain a `.SetExtraFields(map[string]any)` method which can send non-conforming
+fields in the request body. Extra fields overwrite any struct fields with a matching
+key. For security reasons, only use `SetExtraFields` with trusted data.
+
+To send a custom value instead of a struct, use `param.Override[T](value)`.
+
+```go
+// In cases where the API specifies a given type,
+// but you want to send something else, use [SetExtraFields]:
+p.SetExtraFields(map[string]any{
+	"x": 0.01, // send "x" as a float instead of int
+})
+
+// Send a number instead of an object
+custom := param.Override[hypeman.FooParams](12)
+```
+
+### Request unions
+
+Unions are represented as a struct with fields prefixed by "Of" for each of its variants,
+only one field can be non-zero. The non-zero field will be serialized.
+
+Sub-properties of the union can be accessed via methods on the union struct.
+These methods return a mutable pointer to the underlying data, if present.
+
+```go
+// Only one field can be non-zero, use param.IsOmitted() to check if a field is set
+type AnimalUnionParam struct {
+	OfCat *Cat `json:",omitzero,inline`
+	OfDog *Dog `json:",omitzero,inline`
+}
+
+animal := AnimalUnionParam{
+	OfCat: &Cat{
+		Name: "Whiskers",
+		Owner: PersonParam{
+			Address: AddressParam{Street: "3333 Coyote Hill Rd", Zip: 0},
+		},
+	},
+}
+
+// Mutating a field
+if address := animal.GetOwner().GetAddress(); address != nil {
+	address.ZipCode = 94304
+}
+```
+
+### Response objects
+
+All fields in response structs are ordinary value types (not pointers or wrappers).
+Response structs also include a special `JSON` field containing metadata about
+each property.
+
+```go
+type Animal struct {
+	Name   string `json:"name,nullable"`
+	Owners int    `json:"owners"`
+	Age    int    `json:"age"`
+	JSON   struct {
+		Name        respjson.Field
+		Owner       respjson.Field
+		Age         respjson.Field
+		ExtraFields map[string]respjson.Field
+	} `json:"-"`
+}
+```
+
+To handle optional data, use the `.Valid()` method on the JSON field.
+`.Valid()` returns true if a field is not `null`, not present, or couldn't be marshaled.
+
+If `.Valid()` is false, the corresponding field will simply be its zero value.
+
+```go
+raw := `{"owners": 1, "name": null}`
+
+var res Animal
+json.Unmarshal([]byte(raw), &res)
+
+// Accessing regular fields
+
+res.Owners // 1
+res.Name   // ""
+res.Age    // 0
+
+// Optional field checks
+
+res.JSON.Owners.Valid() // true
+res.JSON.Name.Valid()   // false
+res.JSON.Age.Valid()    // false
+
+// Raw JSON values
+
+res.JSON.Owners.Raw()                  // "1"
+res.JSON.Name.Raw() == "null"          // true
+res.JSON.Name.Raw() == respjson.Null   // true
+res.JSON.Age.Raw() == ""               // true
+res.JSON.Age.Raw() == respjson.Omitted // true
+```
+
+These `.JSON` structs also include an `ExtraFields` map containing
+any properties in the json response that were not specified
+in the struct. This can be useful for API features not yet
+present in the SDK.
+
+```go
+body := res.JSON.ExtraFields["my_unexpected_field"].Raw()
+```
+
+### Response Unions
+
+In responses, unions are represented by a flattened struct containing all possible fields from each of the
+object variants.
+To convert it to a variant use the `.AsFooVariant()` method or the `.AsAny()` method if present.
+
+If a response value union contains primitive values, primitive fields will be alongside
+the properties but prefixed with `Of` and feature the tag `json:"...,inline"`.
+
+```go
+type AnimalUnion struct {
+	// From variants [Dog], [Cat]
+	Owner Person `json:"owner"`
+	// From variant [Dog]
+	DogBreed string `json:"dog_breed"`
+	// From variant [Cat]
+	CatBreed string `json:"cat_breed"`
+	// ...
+
+	JSON struct {
+		Owner respjson.Field
+		// ...
+	} `json:"-"`
+}
+
+// If animal variant
+if animal.Owner.Address.ZipCode == "" {
+	panic("missing zip code")
+}
+
+// Switch on the variant
+switch variant := animal.AsAny().(type) {
+case Dog:
+case Cat:
+default:
+	panic("unexpected type")
+}
+```
+
+### RequestOptions
+
+This library uses the functional options pattern. Functions defined in the
+`option` package return a `RequestOption`, which is a closure that mutates a
+`RequestConfig`. These options can be supplied to the client or at individual
+requests. For example:
+
+```go
+client := hypeman.NewClient(
+	// Adds a header to every request made by the client
+	option.WithHeader("X-Some-Header", "custom_header_info"),
+)
+
+client.Health.Check(context.TODO(), ...,
+	// Override the header
+	option.WithHeader("X-Some-Header", "some_other_custom_header_info"),
+	// Add an undocumented field to the request body, using sjson syntax
+	option.WithJSONSet("some.json.path", map[string]string{"my": "object"}),
+)
+```
+
+The request option `option.WithDebugLog(nil)` may be helpful while debugging.
+
+See the [full list of request options](https://pkg.go.dev/github.com/kernel/hypeman-go/option).
+
+### Pagination
+
+This library provides some conveniences for working with paginated list endpoints.
+
+You can use `.ListAutoPaging()` methods to iterate through items across all pages:
+
+Or you can use simple `.List()` methods to fetch a single page and receive a standard response object
+with additional helper methods like `.GetNextPage()`, e.g.:
+
+### Errors
+
+When the API returns a non-success status code, we return an error with type
+`*hypeman.Error`. This contains the `StatusCode`, `*http.Request`, and
+`*http.Response` values of the request, as well as the JSON of the error body
+(much like other response objects in the SDK).
+
+To handle errors, we recommend that you use the `errors.As` pattern:
+
+```go
+_, err := client.Health.Check(context.TODO())
+if err != nil {
+	var apierr *hypeman.Error
+	if errors.As(err, &apierr) {
+		println(string(apierr.DumpRequest(true)))  // Prints the serialized HTTP request
+		println(string(apierr.DumpResponse(true))) // Prints the serialized HTTP response
+	}
+	panic(err.Error()) // GET "/health": 400 Bad Request { ... }
+}
+```
+
+When other errors occur, they are returned unwrapped; for example,
+if HTTP transport fails, you might receive `*url.Error` wrapping `*net.OpError`.
+
+### Timeouts
+
+Requests do not time out by default; use context to configure a timeout for a request lifecycle.
+
+Note that if a request is [retried](#retries), the context timeout does not start over.
+To set a per-retry timeout, use `option.WithRequestTimeout()`.
+
+```go
+// This sets the timeout for the request, including all the retries.
+ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+defer cancel()
+client.Health.Check(
+	ctx,
+	// This sets the per-retry timeout
+	option.WithRequestTimeout(20*time.Second),
+)
+```
+
+### File uploads
+
+Request parameters that correspond to file uploads in multipart requests are typed as
+`io.Reader`. The contents of the `io.Reader` will by default be sent as a multipart form
+part with the file name of "anonymous_file" and content-type of "application/octet-stream".
+
+The file name and content-type can be customized by implementing `Name() string` or `ContentType()
+string` on the run-time type of `io.Reader`. Note that `os.File` implements `Name() string`, so a
+file returned by `os.Open` will be sent with the file name on disk.
+
+We also provide a helper `hypeman.File(reader io.Reader, filename string, contentType string)`
+which can be used to wrap any `io.Reader` with the appropriate file name and content type.
+
+```go
+// A file from the file system
+file, err := os.Open("/path/to/file")
+hypeman.BuildNewParams{
+	Source: file,
+}
+
+// A file from a string
+hypeman.BuildNewParams{
+	Source: strings.NewReader("my file contents"),
+}
+
+// With a custom filename and contentType
+hypeman.BuildNewParams{
+	Source: hypeman.File(strings.NewReader(`{"hello": "foo"}`), "file.go", "application/json"),
+}
+```
+
+### Retries
+
+Certain errors will be automatically retried 2 times by default, with a short exponential backoff.
+We retry by default all connection errors, 408 Request Timeout, 409 Conflict, 429 Rate Limit,
+and >=500 Internal errors.
+
+You can use the `WithMaxRetries` option to configure or disable this:
+
+```go
+// Configure the default for all requests:
+client := hypeman.NewClient(
+	option.WithMaxRetries(0), // default is 2
+)
+
+// Override per-request:
+client.Health.Check(context.TODO(), option.WithMaxRetries(5))
+```
+
+### Accessing raw response data (e.g. response headers)
+
+You can access the raw HTTP response data by using the `option.WithResponseInto()` request option. This is useful when
+you need to examine response headers, status codes, or other details.
+
+```go
+// Create a variable to store the HTTP response
+var response *http.Response
+response, err := client.Health.Check(context.TODO(), option.WithResponseInto(&response))
+if err != nil {
+	// handle error
+}
+fmt.Printf("%+v\n", response)
+
+fmt.Printf("Status Code: %d\n", response.StatusCode)
+fmt.Printf("Headers: %+#v\n", response.Header)
+```
+
+### Making custom/undocumented requests
+
+This library is typed for convenient access to the documented API. If you need to access undocumented
+endpoints, params, or response properties, the library can still be used.
+
+#### Undocumented endpoints
+
+To make requests to undocumented endpoints, you can use `client.Get`, `client.Post`, and other HTTP verbs.
+`RequestOptions` on the client, such as retries, will be respected when making these requests.
+
+```go
+var (
+    // params can be an io.Reader, a []byte, an encoding/json serializable object,
+    // or a "…Params" struct defined in this library.
+    params map[string]any
+
+    // result can be an []byte, *http.Response, a encoding/json deserializable object,
+    // or a model defined in this library.
+    result *http.Response
+)
+err := client.Post(context.Background(), "/unspecified", params, &result)
+if err != nil {
+    …
+}
+```
+
+#### Undocumented request params
+
+To make requests using undocumented parameters, you may use either the `option.WithQuerySet()`
+or the `option.WithJSONSet()` methods.
+
+```go
+params := FooNewParams{
+    ID:   "id_xxxx",
+    Data: FooNewParamsData{
+        FirstName: hypeman.String("John"),
+    },
+}
+client.Foo.New(context.Background(), params, option.WithJSONSet("data.last_name", "Doe"))
+```
+
+#### Undocumented response properties
+
+To access undocumented response properties, you may either access the raw JSON of the response as a string
+with `result.JSON.RawJSON()`, or get the raw JSON of a particular field on the result with
+`result.JSON.Foo.Raw()`.
+
+Any fields that are not present on the response struct will be saved and can be accessed by `result.JSON.ExtraFields()` which returns the extra fields as a `map[string]Field`.
+
+### Middleware
+
+We provide `option.WithMiddleware` which applies the given
+middleware to requests.
+
+```go
+func Logger(req *http.Request, next option.MiddlewareNext) (res *http.Response, err error) {
+	// Before the request
+	start := time.Now()
+	LogReq(req)
+
+	// Forward the request to the next handler
+	res, err = next(req)
+
+	// Handle stuff after the request
+	end := time.Now()
+	LogRes(res, err, start - end)
+
+    return res, err
+}
+
+client := hypeman.NewClient(
+	option.WithMiddleware(Logger),
+)
+```
+
+When multiple middlewares are provided as variadic arguments, the middlewares
+are applied left to right. If `option.WithMiddleware` is given
+multiple times, for example first in the client then the method, the
+middleware in the client will run first and the middleware given in the method
+will run next.
+
+You may also replace the default `http.Client` with
+`option.WithHTTPClient(client)`. Only one http client is
+accepted (this overwrites any previous client) and receives requests after any
+middleware has been applied.
+
+## Semantic versioning
+
+This package generally follows [SemVer](https://semver.org/spec/v2.0.0.html) conventions, though certain backwards-incompatible changes may be released as minor versions:
+
+1. Changes to library internals which are technically public but not intended or documented for external use. _(Please open a GitHub issue to let us know if you are relying on such internals.)_
+2. Changes that we do not expect to impact the vast majority of users in practice.
+
+We take backwards-compatibility seriously and work hard to ensure you can rely on a smooth upgrade experience.
+
+We are keen for your feedback; please open an [issue](https://www.github.com/kernel/hypeman-go/issues) with questions, bugs, or suggestions.
+
+## Development
+
+### Testing Preview Branches
+
+When developing features in the main [hypeman](https://github.com/kernel/hypeman) repo, Stainless automatically creates preview branches in `stainless-sdks/hypeman-go` with your API changes. You can check out these branches locally to test the SDK changes:
+
+```bash
+# Checkout preview/<branch> (e.g., if working on "devices" branch in hypeman)
+./scripts/checkout-preview devices
+
+# Checkout an exact branch name
+./scripts/checkout-preview -b main
+./scripts/checkout-preview -b preview/my-feature
+```
+
+The script automatically adds the `stainless` remote if it doesn't exist.
+
+## Contributing
+
+See [the contributing documentation](./CONTRIBUTING.md).
diff --git a/sdks/go/SECURITY.md b/sdks/go/SECURITY.md
new file mode 100644
index 00000000..94a5b008
--- /dev/null
+++ b/sdks/go/SECURITY.md
@@ -0,0 +1,23 @@
+# Security Policy
+
+## Reporting Security Issues
+
+This SDK is generated by [Stainless Software Inc](http://stainless.com). Stainless takes security seriously, and encourages you to report any security vulnerability promptly so that appropriate action can be taken.
+
+To report a security issue, please contact the Stainless team at security@stainless.com.
+
+## Responsible Disclosure
+
+We appreciate the efforts of security researchers and individuals who help us maintain the security of
+SDKs we generate. If you believe you have found a security vulnerability, please adhere to responsible
+disclosure practices by allowing us a reasonable amount of time to investigate and address the issue
+before making any information public.
+
+## Reporting Non-SDK Related Security Issues
+
+If you encounter security issues that are not directly related to SDKs but pertain to the services
+or products provided by Hypeman, please follow the respective company's security reporting guidelines.
+
+---
+
+Thank you for helping us keep the SDKs and systems they interact with secure.
diff --git a/sdks/go/aliases.go b/sdks/go/aliases.go
new file mode 100644
index 00000000..1eefe6d2
--- /dev/null
+++ b/sdks/go/aliases.go
@@ -0,0 +1,16 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman
+
+import (
+	"github.com/kernel/hypeman-go/internal/apierror"
+	"github.com/kernel/hypeman-go/packages/param"
+)
+
+// aliased to make [param.APIUnion] private when embedding
+type paramUnion = param.APIUnion
+
+// aliased to make [param.APIObject] private when embedding
+type paramObj = param.APIObject
+
+type Error = apierror.Error
diff --git a/sdks/go/api.md b/sdks/go/api.md
new file mode 100644
index 00000000..dfd33e23
--- /dev/null
+++ b/sdks/go/api.md
@@ -0,0 +1,140 @@
+# Health
+
+Response Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#HealthCheckResponse">HealthCheckResponse</a>
+
+Methods:
+
+- <code title="get /health">client.Health.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#HealthService.Check">Check</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#HealthCheckResponse">HealthCheckResponse</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+
+# Images
+
+Response Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Image">Image</a>
+
+Methods:
+
+- <code title="post /images">client.Images.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#ImageService.New">New</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, body <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#ImageNewParams">ImageNewParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Image">Image</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="get /images">client.Images.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#ImageService.List">List</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>) (\*[]<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Image">Image</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="delete /images/{name}">client.Images.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#ImageService.Delete">Delete</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, name <a href="https://pkg.go.dev/builtin#string">string</a>) <a href="https://pkg.go.dev/builtin#error">error</a></code>
+- <code title="get /images/{name}">client.Images.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#ImageService.Get">Get</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, name <a href="https://pkg.go.dev/builtin#string">string</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Image">Image</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+
+# Instances
+
+Params Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#VolumeMountParam">VolumeMountParam</a>
+
+Response Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Instance">Instance</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#PathInfo">PathInfo</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#VolumeMount">VolumeMount</a>
+
+Methods:
+
+- <code title="post /instances">client.Instances.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceService.New">New</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, body <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceNewParams">InstanceNewParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Instance">Instance</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="get /instances">client.Instances.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceService.List">List</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, query <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceListParams">InstanceListParams</a>) (\*[]<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Instance">Instance</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="delete /instances/{id}">client.Instances.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceService.Delete">Delete</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) <a href="https://pkg.go.dev/builtin#error">error</a></code>
+- <code title="get /instances/{id}">client.Instances.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceService.Get">Get</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Instance">Instance</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="get /instances/{id}/logs">client.Instances.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceService.Logs">Logs</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>, query <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceLogsParams">InstanceLogsParams</a>) (\*<a href="https://pkg.go.dev/builtin#string">string</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="post /instances/{id}/restore">client.Instances.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceService.Restore">Restore</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Instance">Instance</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="post /instances/{id}/standby">client.Instances.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceService.Standby">Standby</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Instance">Instance</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="post /instances/{id}/start">client.Instances.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceService.Start">Start</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>, body <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceStartParams">InstanceStartParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Instance">Instance</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="get /instances/{id}/stat">client.Instances.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceService.Stat">Stat</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>, query <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceStatParams">InstanceStatParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#PathInfo">PathInfo</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="post /instances/{id}/stop">client.Instances.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceService.Stop">Stop</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Instance">Instance</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+
+## Volumes
+
+Methods:
+
+- <code title="post /instances/{id}/volumes/{volumeId}">client.Instances.Volumes.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceVolumeService.Attach">Attach</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, volumeID <a href="https://pkg.go.dev/builtin#string">string</a>, params <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceVolumeAttachParams">InstanceVolumeAttachParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Instance">Instance</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="delete /instances/{id}/volumes/{volumeId}">client.Instances.Volumes.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceVolumeService.Detach">Detach</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, volumeID <a href="https://pkg.go.dev/builtin#string">string</a>, body <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#InstanceVolumeDetachParams">InstanceVolumeDetachParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Instance">Instance</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+
+# Volumes
+
+Response Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Volume">Volume</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#VolumeAttachment">VolumeAttachment</a>
+
+Methods:
+
+- <code title="post /volumes">client.Volumes.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#VolumeService.New">New</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, body <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#VolumeNewParams">VolumeNewParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Volume">Volume</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="get /volumes">client.Volumes.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#VolumeService.List">List</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>) (\*[]<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Volume">Volume</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="delete /volumes/{id}">client.Volumes.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#VolumeService.Delete">Delete</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) <a href="https://pkg.go.dev/builtin#error">error</a></code>
+- <code title="post /volumes/from-archive">client.Volumes.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#VolumeService.NewFromArchive">NewFromArchive</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, body <a href="https://pkg.go.dev/builtin#io.Reader">io.Reader</a>, params <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#VolumeNewFromArchiveParams">VolumeNewFromArchiveParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Volume">Volume</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="get /volumes/{id}">client.Volumes.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#VolumeService.Get">Get</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Volume">Volume</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+
+# Devices
+
+Response Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#AvailableDevice">AvailableDevice</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Device">Device</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#DeviceType">DeviceType</a>
+
+Methods:
+
+- <code title="post /devices">client.Devices.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#DeviceService.New">New</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, body <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#DeviceNewParams">DeviceNewParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Device">Device</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="get /devices/{id}">client.Devices.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#DeviceService.Get">Get</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Device">Device</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="get /devices">client.Devices.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#DeviceService.List">List</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>) (\*[]<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Device">Device</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="delete /devices/{id}">client.Devices.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#DeviceService.Delete">Delete</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) <a href="https://pkg.go.dev/builtin#error">error</a></code>
+- <code title="get /devices/available">client.Devices.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#DeviceService.ListAvailable">ListAvailable</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>) (\*[]<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#AvailableDevice">AvailableDevice</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+
+# Ingresses
+
+Params Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#IngressMatchParam">IngressMatchParam</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#IngressRuleParam">IngressRuleParam</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#IngressTargetParam">IngressTargetParam</a>
+
+Response Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Ingress">Ingress</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#IngressMatch">IngressMatch</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#IngressRule">IngressRule</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#IngressTarget">IngressTarget</a>
+
+Methods:
+
+- <code title="post /ingresses">client.Ingresses.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#IngressService.New">New</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, body <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#IngressNewParams">IngressNewParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Ingress">Ingress</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="get /ingresses">client.Ingresses.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#IngressService.List">List</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>) (\*[]<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Ingress">Ingress</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="delete /ingresses/{id}">client.Ingresses.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#IngressService.Delete">Delete</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) <a href="https://pkg.go.dev/builtin#error">error</a></code>
+- <code title="get /ingresses/{id}">client.Ingresses.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#IngressService.Get">Get</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Ingress">Ingress</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+
+# Resources
+
+Response Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#DiskBreakdown">DiskBreakdown</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#GPUProfile">GPUProfile</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#GPUResourceStatus">GPUResourceStatus</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#PassthroughDevice">PassthroughDevice</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#ResourceAllocation">ResourceAllocation</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#ResourceStatus">ResourceStatus</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Resources">Resources</a>
+
+Methods:
+
+- <code title="get /resources">client.Resources.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#ResourceService.Get">Get</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Resources">Resources</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+
+# Builds
+
+Response Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Build">Build</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#BuildEvent">BuildEvent</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#BuildProvenance">BuildProvenance</a>
+- <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#BuildStatus">BuildStatus</a>
+
+Methods:
+
+- <code title="post /builds">client.Builds.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#BuildService.New">New</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, body <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#BuildNewParams">BuildNewParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Build">Build</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="get /builds">client.Builds.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#BuildService.List">List</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>) (\*[]<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Build">Build</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="delete /builds/{id}">client.Builds.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#BuildService.Cancel">Cancel</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) <a href="https://pkg.go.dev/builtin#error">error</a></code>
+- <code title="get /builds/{id}/events">client.Builds.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#BuildService.Events">Events</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>, query <a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#BuildEventsParams">BuildEventsParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#BuildEvent">BuildEvent</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="get /builds/{id}">client.Builds.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#BuildService.Get">Get</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/hypeman-go">hypeman</a>.<a href="https://pkg.go.dev/github.com/kernel/hypeman-go#Build">Build</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
diff --git a/sdks/go/build.go b/sdks/go/build.go
new file mode 100644
index 00000000..48de63b1
--- /dev/null
+++ b/sdks/go/build.go
@@ -0,0 +1,304 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/url"
+	"slices"
+	"time"
+
+	"github.com/kernel/hypeman-go/internal/apiform"
+	"github.com/kernel/hypeman-go/internal/apijson"
+	"github.com/kernel/hypeman-go/internal/apiquery"
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/kernel/hypeman-go/packages/param"
+	"github.com/kernel/hypeman-go/packages/respjson"
+	"github.com/kernel/hypeman-go/packages/ssestream"
+)
+
+// BuildService contains methods and other services that help with interacting with
+// the hypeman API.
+//
+// Note, unlike clients, this service does not read variables from the environment
+// automatically. You should not instantiate this service directly, and instead use
+// the [NewBuildService] method instead.
+type BuildService struct {
+	Options []option.RequestOption
+}
+
+// NewBuildService generates a new service that applies the given options to each
+// request. These options are applied after the parent client's options (if there
+// is one), and before any request-specific options.
+func NewBuildService(opts ...option.RequestOption) (r BuildService) {
+	r = BuildService{}
+	r.Options = opts
+	return
+}
+
+// Creates a new build job. Source code should be uploaded as a tar.gz archive in
+// the multipart form data.
+func (r *BuildService) New(ctx context.Context, body BuildNewParams, opts ...option.RequestOption) (res *Build, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "builds"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, body, &res, opts...)
+	return
+}
+
+// List builds
+func (r *BuildService) List(ctx context.Context, opts ...option.RequestOption) (res *[]Build, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "builds"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+// Cancel build
+func (r *BuildService) Cancel(ctx context.Context, id string, opts ...option.RequestOption) (err error) {
+	opts = slices.Concat(r.Options, opts)
+	opts = append([]option.RequestOption{option.WithHeader("Accept", "*/*")}, opts...)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("builds/%s", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodDelete, path, nil, nil, opts...)
+	return
+}
+
+// Streams build events as Server-Sent Events. Events include:
+//
+// - `log`: Build log lines with timestamp and content
+// - `status`: Build status changes (queued→building→pushing→ready/failed)
+// - `heartbeat`: Keep-alive events sent every 30s to prevent connection timeouts
+//
+// Returns existing logs as events, then continues streaming if follow=true.
+func (r *BuildService) EventsStreaming(ctx context.Context, id string, query BuildEventsParams, opts ...option.RequestOption) (stream *ssestream.Stream[BuildEvent]) {
+	var (
+		raw *http.Response
+		err error
+	)
+	opts = slices.Concat(r.Options, opts)
+	opts = append([]option.RequestOption{option.WithHeader("Accept", "text/event-stream")}, opts...)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("builds/%s/events", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, query, &raw, opts...)
+	return ssestream.NewStream[BuildEvent](ssestream.NewDecoder(raw), err)
+}
+
+// Get build details
+func (r *BuildService) Get(ctx context.Context, id string, opts ...option.RequestOption) (res *Build, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("builds/%s", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+type Build struct {
+	// Build job identifier
+	ID string `json:"id" api:"required"`
+	// Build creation timestamp
+	CreatedAt time.Time `json:"created_at" api:"required" format:"date-time"`
+	// Build job status
+	//
+	// Any of "queued", "building", "pushing", "ready", "failed", "cancelled".
+	Status BuildStatus `json:"status" api:"required"`
+	// Instance ID of the builder VM (for debugging)
+	BuilderInstanceID string `json:"builder_instance_id" api:"nullable"`
+	// Build completion timestamp
+	CompletedAt time.Time `json:"completed_at" api:"nullable" format:"date-time"`
+	// Build duration in milliseconds
+	DurationMs int64 `json:"duration_ms" api:"nullable"`
+	// Error message (only when status is failed)
+	Error string `json:"error" api:"nullable"`
+	// Digest of built image (only when status is ready)
+	ImageDigest string `json:"image_digest" api:"nullable"`
+	// Full image reference (only when status is ready)
+	ImageRef   string          `json:"image_ref" api:"nullable"`
+	Provenance BuildProvenance `json:"provenance"`
+	// Position in build queue (only when status is queued)
+	QueuePosition int64 `json:"queue_position" api:"nullable"`
+	// Build start timestamp
+	StartedAt time.Time `json:"started_at" api:"nullable" format:"date-time"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		ID                respjson.Field
+		CreatedAt         respjson.Field
+		Status            respjson.Field
+		BuilderInstanceID respjson.Field
+		CompletedAt       respjson.Field
+		DurationMs        respjson.Field
+		Error             respjson.Field
+		ImageDigest       respjson.Field
+		ImageRef          respjson.Field
+		Provenance        respjson.Field
+		QueuePosition     respjson.Field
+		StartedAt         respjson.Field
+		ExtraFields       map[string]respjson.Field
+		raw               string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r Build) RawJSON() string { return r.JSON.raw }
+func (r *Build) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type BuildEvent struct {
+	// Event timestamp
+	Timestamp time.Time `json:"timestamp" api:"required" format:"date-time"`
+	// Event type
+	//
+	// Any of "log", "status", "heartbeat".
+	Type BuildEventType `json:"type" api:"required"`
+	// Log line content (only for type=log)
+	Content string `json:"content"`
+	// New build status (only for type=status)
+	//
+	// Any of "queued", "building", "pushing", "ready", "failed", "cancelled".
+	Status BuildStatus `json:"status"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		Timestamp   respjson.Field
+		Type        respjson.Field
+		Content     respjson.Field
+		Status      respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r BuildEvent) RawJSON() string { return r.JSON.raw }
+func (r *BuildEvent) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// Event type
+type BuildEventType string
+
+const (
+	BuildEventTypeLog       BuildEventType = "log"
+	BuildEventTypeStatus    BuildEventType = "status"
+	BuildEventTypeHeartbeat BuildEventType = "heartbeat"
+)
+
+type BuildProvenance struct {
+	// Pinned base image digest used
+	BaseImageDigest string `json:"base_image_digest"`
+	// BuildKit version used
+	BuildkitVersion string `json:"buildkit_version"`
+	// Map of lockfile names to SHA256 hashes
+	LockfileHashes map[string]string `json:"lockfile_hashes"`
+	// SHA256 hash of source tarball
+	SourceHash string `json:"source_hash"`
+	// Build completion timestamp
+	Timestamp time.Time `json:"timestamp" format:"date-time"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		BaseImageDigest respjson.Field
+		BuildkitVersion respjson.Field
+		LockfileHashes  respjson.Field
+		SourceHash      respjson.Field
+		Timestamp       respjson.Field
+		ExtraFields     map[string]respjson.Field
+		raw             string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r BuildProvenance) RawJSON() string { return r.JSON.raw }
+func (r *BuildProvenance) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// Build job status
+type BuildStatus string
+
+const (
+	BuildStatusQueued    BuildStatus = "queued"
+	BuildStatusBuilding  BuildStatus = "building"
+	BuildStatusPushing   BuildStatus = "pushing"
+	BuildStatusReady     BuildStatus = "ready"
+	BuildStatusFailed    BuildStatus = "failed"
+	BuildStatusCancelled BuildStatus = "cancelled"
+)
+
+type BuildNewParams struct {
+	// Source tarball (tar.gz) containing application code and optionally a Dockerfile
+	Source io.Reader `json:"source,omitzero" api:"required" format:"binary"`
+	// Optional pinned base image digest
+	BaseImageDigest param.Opt[string] `json:"base_image_digest,omitzero"`
+	// Tenant-specific cache key prefix
+	CacheScope param.Opt[string] `json:"cache_scope,omitzero"`
+	// Number of vCPUs for builder VM (default 2)
+	CPUs param.Opt[int64] `json:"cpus,omitzero"`
+	// Dockerfile content. Required if not included in the source tarball.
+	Dockerfile param.Opt[string] `json:"dockerfile,omitzero"`
+	// Global cache identifier (e.g., "node", "python", "ubuntu", "browser"). When
+	// specified, the build will import from cache/global/{key}. Admin builds will also
+	// export to this location.
+	GlobalCacheKey param.Opt[string] `json:"global_cache_key,omitzero"`
+	// Custom image name for the build output. When set, the image is pushed to
+	// {registry}/{image_name} instead of {registry}/builds/{id}.
+	ImageName param.Opt[string] `json:"image_name,omitzero"`
+	// Set to "true" to grant push access to global cache (operator-only). Admin builds
+	// can populate the shared global cache that all tenant builds read from.
+	IsAdminBuild param.Opt[string] `json:"is_admin_build,omitzero"`
+	// Memory limit for builder VM in MB (default 2048)
+	MemoryMB param.Opt[int64] `json:"memory_mb,omitzero"`
+	// JSON array of secret references to inject during build. Each object has "id"
+	// (required) for use with --mount=type=secret,id=... Example: [{"id":
+	// "npm_token"}, {"id": "github_token"}]
+	Secrets param.Opt[string] `json:"secrets,omitzero"`
+	// Build timeout (default 600)
+	TimeoutSeconds param.Opt[int64] `json:"timeout_seconds,omitzero"`
+	paramObj
+}
+
+func (r BuildNewParams) MarshalMultipart() (data []byte, contentType string, err error) {
+	buf := bytes.NewBuffer(nil)
+	writer := multipart.NewWriter(buf)
+	err = apiform.MarshalRoot(r, writer)
+	if err == nil {
+		err = apiform.WriteExtras(writer, r.ExtraFields())
+	}
+	if err != nil {
+		writer.Close()
+		return nil, "", err
+	}
+	err = writer.Close()
+	if err != nil {
+		return nil, "", err
+	}
+	return buf.Bytes(), writer.FormDataContentType(), nil
+}
+
+type BuildEventsParams struct {
+	// Continue streaming new events after initial output
+	Follow param.Opt[bool] `query:"follow,omitzero" json:"-"`
+	paramObj
+}
+
+// URLQuery serializes [BuildEventsParams]'s query parameters as `url.Values`.
+func (r BuildEventsParams) URLQuery() (v url.Values, err error) {
+	return apiquery.MarshalWithSettings(r, apiquery.QuerySettings{
+		ArrayFormat:  apiquery.ArrayQueryFormatComma,
+		NestedFormat: apiquery.NestedQueryFormatBrackets,
+	})
+}
diff --git a/sdks/go/build_test.go b/sdks/go/build_test.go
new file mode 100644
index 00000000..250c1e3d
--- /dev/null
+++ b/sdks/go/build_test.go
@@ -0,0 +1,120 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman_test
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"os"
+	"testing"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/internal/testutil"
+	"github.com/kernel/hypeman-go/option"
+)
+
+func TestBuildNewWithOptionalParams(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Builds.New(context.TODO(), hypeman.BuildNewParams{
+		Source:          io.Reader(bytes.NewBuffer([]byte("some file contents"))),
+		BaseImageDigest: hypeman.String("base_image_digest"),
+		CacheScope:      hypeman.String("cache_scope"),
+		CPUs:            hypeman.Int(0),
+		Dockerfile:      hypeman.String("dockerfile"),
+		GlobalCacheKey:  hypeman.String("global_cache_key"),
+		ImageName:       hypeman.String("image_name"),
+		IsAdminBuild:    hypeman.String("is_admin_build"),
+		MemoryMB:        hypeman.Int(0),
+		Secrets:         hypeman.String("secrets"),
+		TimeoutSeconds:  hypeman.Int(0),
+	})
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestBuildList(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Builds.List(context.TODO())
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestBuildCancel(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	err := client.Builds.Cancel(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestBuildGet(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Builds.Get(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
diff --git a/sdks/go/client.go b/sdks/go/client.go
new file mode 100644
index 00000000..eeef91ea
--- /dev/null
+++ b/sdks/go/client.go
@@ -0,0 +1,131 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman
+
+import (
+	"context"
+	"net/http"
+	"os"
+	"slices"
+
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+	"github.com/kernel/hypeman-go/option"
+)
+
+// Client creates a struct with services and top level methods that help with
+// interacting with the hypeman API. You should not instantiate this client
+// directly, and instead use the [NewClient] method instead.
+type Client struct {
+	Options   []option.RequestOption
+	Health    HealthService
+	Images    ImageService
+	Instances InstanceService
+	Volumes   VolumeService
+	Devices   DeviceService
+	Ingresses IngressService
+	Resources ResourceService
+	Builds    BuildService
+}
+
+// DefaultClientOptions read from the environment (HYPEMAN_API_KEY,
+// HYPEMAN_BASE_URL). This should be used to initialize new clients.
+func DefaultClientOptions() []option.RequestOption {
+	defaults := []option.RequestOption{option.WithEnvironmentProduction()}
+	if o, ok := os.LookupEnv("HYPEMAN_BASE_URL"); ok {
+		defaults = append(defaults, option.WithBaseURL(o))
+	}
+	if o, ok := os.LookupEnv("HYPEMAN_API_KEY"); ok {
+		defaults = append(defaults, option.WithAPIKey(o))
+	}
+	return defaults
+}
+
+// NewClient generates a new client with the default option read from the
+// environment (HYPEMAN_API_KEY, HYPEMAN_BASE_URL). The option passed in as
+// arguments are applied after these default arguments, and all option will be
+// passed down to the services and requests that this client makes.
+func NewClient(opts ...option.RequestOption) (r Client) {
+	opts = append(DefaultClientOptions(), opts...)
+
+	r = Client{Options: opts}
+
+	r.Health = NewHealthService(opts...)
+	r.Images = NewImageService(opts...)
+	r.Instances = NewInstanceService(opts...)
+	r.Volumes = NewVolumeService(opts...)
+	r.Devices = NewDeviceService(opts...)
+	r.Ingresses = NewIngressService(opts...)
+	r.Resources = NewResourceService(opts...)
+	r.Builds = NewBuildService(opts...)
+
+	return
+}
+
+// Execute makes a request with the given context, method, URL, request params,
+// response, and request options. This is useful for hitting undocumented endpoints
+// while retaining the base URL, auth, retries, and other options from the client.
+//
+// If a byte slice or an [io.Reader] is supplied to params, it will be used as-is
+// for the request body.
+//
+// The params is by default serialized into the body using [encoding/json]. If your
+// type implements a MarshalJSON function, it will be used instead to serialize the
+// request. If a URLQuery method is implemented, the returned [url.Values] will be
+// used as query strings to the url.
+//
+// If your params struct uses [param.Field], you must provide either [MarshalJSON],
+// [URLQuery], and/or [MarshalForm] functions. It is undefined behavior to use a
+// struct uses [param.Field] without specifying how it is serialized.
+//
+// Any "…Params" object defined in this library can be used as the request
+// argument. Note that 'path' arguments will not be forwarded into the url.
+//
+// The response body will be deserialized into the res variable, depending on its
+// type:
+//
+//   - A pointer to a [*http.Response] is populated by the raw response.
+//   - A pointer to a byte array will be populated with the contents of the request
+//     body.
+//   - A pointer to any other type uses this library's default JSON decoding, which
+//     respects UnmarshalJSON if it is defined on the type.
+//   - A nil value will not read the response body.
+//
+// For even greater flexibility, see [option.WithResponseInto] and
+// [option.WithResponseBodyInto].
+func (r *Client) Execute(ctx context.Context, method string, path string, params any, res any, opts ...option.RequestOption) error {
+	opts = slices.Concat(r.Options, opts)
+	return requestconfig.ExecuteNewRequest(ctx, method, path, params, res, opts...)
+}
+
+// Get makes a GET request with the given URL, params, and optionally deserializes
+// to a response. See [Execute] documentation on the params and response.
+func (r *Client) Get(ctx context.Context, path string, params any, res any, opts ...option.RequestOption) error {
+	return r.Execute(ctx, http.MethodGet, path, params, res, opts...)
+}
+
+// Post makes a POST request with the given URL, params, and optionally
+// deserializes to a response. See [Execute] documentation on the params and
+// response.
+func (r *Client) Post(ctx context.Context, path string, params any, res any, opts ...option.RequestOption) error {
+	return r.Execute(ctx, http.MethodPost, path, params, res, opts...)
+}
+
+// Put makes a PUT request with the given URL, params, and optionally deserializes
+// to a response. See [Execute] documentation on the params and response.
+func (r *Client) Put(ctx context.Context, path string, params any, res any, opts ...option.RequestOption) error {
+	return r.Execute(ctx, http.MethodPut, path, params, res, opts...)
+}
+
+// Patch makes a PATCH request with the given URL, params, and optionally
+// deserializes to a response. See [Execute] documentation on the params and
+// response.
+func (r *Client) Patch(ctx context.Context, path string, params any, res any, opts ...option.RequestOption) error {
+	return r.Execute(ctx, http.MethodPatch, path, params, res, opts...)
+}
+
+// Delete makes a DELETE request with the given URL, params, and optionally
+// deserializes to a response. See [Execute] documentation on the params and
+// response.
+func (r *Client) Delete(ctx context.Context, path string, params any, res any, opts ...option.RequestOption) error {
+	return r.Execute(ctx, http.MethodDelete, path, params, res, opts...)
+}
diff --git a/sdks/go/client_test.go b/sdks/go/client_test.go
new file mode 100644
index 00000000..cd17cef0
--- /dev/null
+++ b/sdks/go/client_test.go
@@ -0,0 +1,351 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman_test
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/internal"
+	"github.com/kernel/hypeman-go/option"
+)
+
+type closureTransport struct {
+	fn func(req *http.Request) (*http.Response, error)
+}
+
+func (t *closureTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	return t.fn(req)
+}
+
+func TestUserAgentHeader(t *testing.T) {
+	var userAgent string
+	client := hypeman.NewClient(
+		option.WithAPIKey("My API Key"),
+		option.WithHTTPClient(&http.Client{
+			Transport: &closureTransport{
+				fn: func(req *http.Request) (*http.Response, error) {
+					userAgent = req.Header.Get("User-Agent")
+					return &http.Response{
+						StatusCode: http.StatusOK,
+					}, nil
+				},
+			},
+		}),
+	)
+	client.Health.Check(context.Background())
+	if userAgent != fmt.Sprintf("Hypeman/Go %s", internal.PackageVersion) {
+		t.Errorf("Expected User-Agent to be correct, but got: %#v", userAgent)
+	}
+}
+
+func TestRetryAfter(t *testing.T) {
+	retryCountHeaders := make([]string, 0)
+	client := hypeman.NewClient(
+		option.WithAPIKey("My API Key"),
+		option.WithHTTPClient(&http.Client{
+			Transport: &closureTransport{
+				fn: func(req *http.Request) (*http.Response, error) {
+					retryCountHeaders = append(retryCountHeaders, req.Header.Get("X-Stainless-Retry-Count"))
+					return &http.Response{
+						StatusCode: http.StatusTooManyRequests,
+						Header: http.Header{
+							http.CanonicalHeaderKey("Retry-After"): []string{"0.1"},
+						},
+					}, nil
+				},
+			},
+		}),
+	)
+	_, err := client.Health.Check(context.Background())
+	if err == nil {
+		t.Error("Expected there to be a cancel error")
+	}
+
+	attempts := len(retryCountHeaders)
+	if attempts != 3 {
+		t.Errorf("Expected %d attempts, got %d", 3, attempts)
+	}
+
+	expectedRetryCountHeaders := []string{"0", "1", "2"}
+	if !reflect.DeepEqual(retryCountHeaders, expectedRetryCountHeaders) {
+		t.Errorf("Expected %v retry count headers, got %v", expectedRetryCountHeaders, retryCountHeaders)
+	}
+}
+
+func TestDeleteRetryCountHeader(t *testing.T) {
+	retryCountHeaders := make([]string, 0)
+	client := hypeman.NewClient(
+		option.WithAPIKey("My API Key"),
+		option.WithHTTPClient(&http.Client{
+			Transport: &closureTransport{
+				fn: func(req *http.Request) (*http.Response, error) {
+					retryCountHeaders = append(retryCountHeaders, req.Header.Get("X-Stainless-Retry-Count"))
+					return &http.Response{
+						StatusCode: http.StatusTooManyRequests,
+						Header: http.Header{
+							http.CanonicalHeaderKey("Retry-After"): []string{"0.1"},
+						},
+					}, nil
+				},
+			},
+		}),
+		option.WithHeaderDel("X-Stainless-Retry-Count"),
+	)
+	_, err := client.Health.Check(context.Background())
+	if err == nil {
+		t.Error("Expected there to be a cancel error")
+	}
+
+	expectedRetryCountHeaders := []string{"", "", ""}
+	if !reflect.DeepEqual(retryCountHeaders, expectedRetryCountHeaders) {
+		t.Errorf("Expected %v retry count headers, got %v", expectedRetryCountHeaders, retryCountHeaders)
+	}
+}
+
+func TestOverwriteRetryCountHeader(t *testing.T) {
+	retryCountHeaders := make([]string, 0)
+	client := hypeman.NewClient(
+		option.WithAPIKey("My API Key"),
+		option.WithHTTPClient(&http.Client{
+			Transport: &closureTransport{
+				fn: func(req *http.Request) (*http.Response, error) {
+					retryCountHeaders = append(retryCountHeaders, req.Header.Get("X-Stainless-Retry-Count"))
+					return &http.Response{
+						StatusCode: http.StatusTooManyRequests,
+						Header: http.Header{
+							http.CanonicalHeaderKey("Retry-After"): []string{"0.1"},
+						},
+					}, nil
+				},
+			},
+		}),
+		option.WithHeader("X-Stainless-Retry-Count", "42"),
+	)
+	_, err := client.Health.Check(context.Background())
+	if err == nil {
+		t.Error("Expected there to be a cancel error")
+	}
+
+	expectedRetryCountHeaders := []string{"42", "42", "42"}
+	if !reflect.DeepEqual(retryCountHeaders, expectedRetryCountHeaders) {
+		t.Errorf("Expected %v retry count headers, got %v", expectedRetryCountHeaders, retryCountHeaders)
+	}
+}
+
+func TestRetryAfterMs(t *testing.T) {
+	attempts := 0
+	client := hypeman.NewClient(
+		option.WithAPIKey("My API Key"),
+		option.WithHTTPClient(&http.Client{
+			Transport: &closureTransport{
+				fn: func(req *http.Request) (*http.Response, error) {
+					attempts++
+					return &http.Response{
+						StatusCode: http.StatusTooManyRequests,
+						Header: http.Header{
+							http.CanonicalHeaderKey("Retry-After-Ms"): []string{"100"},
+						},
+					}, nil
+				},
+			},
+		}),
+	)
+	_, err := client.Health.Check(context.Background())
+	if err == nil {
+		t.Error("Expected there to be a cancel error")
+	}
+	if want := 3; attempts != want {
+		t.Errorf("Expected %d attempts, got %d", want, attempts)
+	}
+}
+
+func TestContextCancel(t *testing.T) {
+	client := hypeman.NewClient(
+		option.WithAPIKey("My API Key"),
+		option.WithHTTPClient(&http.Client{
+			Transport: &closureTransport{
+				fn: func(req *http.Request) (*http.Response, error) {
+					<-req.Context().Done()
+					return nil, req.Context().Err()
+				},
+			},
+		}),
+	)
+	cancelCtx, cancel := context.WithCancel(context.Background())
+	cancel()
+	_, err := client.Health.Check(cancelCtx)
+	if err == nil {
+		t.Error("Expected there to be a cancel error")
+	}
+}
+
+func TestContextCancelDelay(t *testing.T) {
+	client := hypeman.NewClient(
+		option.WithAPIKey("My API Key"),
+		option.WithHTTPClient(&http.Client{
+			Transport: &closureTransport{
+				fn: func(req *http.Request) (*http.Response, error) {
+					<-req.Context().Done()
+					return nil, req.Context().Err()
+				},
+			},
+		}),
+	)
+	cancelCtx, cancel := context.WithTimeout(context.Background(), 2*time.Millisecond)
+	defer cancel()
+	_, err := client.Health.Check(cancelCtx)
+	if err == nil {
+		t.Error("expected there to be a cancel error")
+	}
+}
+
+func TestContextDeadline(t *testing.T) {
+	testTimeout := time.After(3 * time.Second)
+	testDone := make(chan struct{})
+
+	deadline := time.Now().Add(100 * time.Millisecond)
+	deadlineCtx, cancel := context.WithDeadline(context.Background(), deadline)
+	defer cancel()
+
+	go func() {
+		client := hypeman.NewClient(
+			option.WithAPIKey("My API Key"),
+			option.WithHTTPClient(&http.Client{
+				Transport: &closureTransport{
+					fn: func(req *http.Request) (*http.Response, error) {
+						<-req.Context().Done()
+						return nil, req.Context().Err()
+					},
+				},
+			}),
+		)
+		_, err := client.Health.Check(deadlineCtx)
+		if err == nil {
+			t.Error("expected there to be a deadline error")
+		}
+		close(testDone)
+	}()
+
+	select {
+	case <-testTimeout:
+		t.Fatal("client didn't finish in time")
+	case <-testDone:
+		if diff := time.Since(deadline); diff < -30*time.Millisecond || 30*time.Millisecond < diff {
+			t.Fatalf("client did not return within 30ms of context deadline, got %s", diff)
+		}
+	}
+}
+
+func TestContextDeadlineStreaming(t *testing.T) {
+	testTimeout := time.After(3 * time.Second)
+	testDone := make(chan struct{})
+
+	deadline := time.Now().Add(100 * time.Millisecond)
+	deadlineCtx, cancel := context.WithDeadline(context.Background(), deadline)
+	defer cancel()
+
+	go func() {
+		client := hypeman.NewClient(
+			option.WithAPIKey("My API Key"),
+			option.WithHTTPClient(&http.Client{
+				Transport: &closureTransport{
+					fn: func(req *http.Request) (*http.Response, error) {
+						return &http.Response{
+							StatusCode: 200,
+							Status:     "200 OK",
+							Body: io.NopCloser(
+								io.Reader(readerFunc(func([]byte) (int, error) {
+									<-req.Context().Done()
+									return 0, req.Context().Err()
+								})),
+							),
+						}, nil
+					},
+				},
+			}),
+		)
+		stream := client.Instances.LogsStreaming(
+			deadlineCtx,
+			"id",
+			hypeman.InstanceLogsParams{},
+		)
+		for stream.Next() {
+			_ = stream.Current()
+		}
+		if stream.Err() == nil {
+			t.Error("expected there to be a deadline error")
+		}
+		close(testDone)
+	}()
+
+	select {
+	case <-testTimeout:
+		t.Fatal("client didn't finish in time")
+	case <-testDone:
+		if diff := time.Since(deadline); diff < -30*time.Millisecond || 30*time.Millisecond < diff {
+			t.Fatalf("client did not return within 30ms of context deadline, got %s", diff)
+		}
+	}
+}
+
+func TestContextDeadlineStreamingWithRequestTimeout(t *testing.T) {
+	testTimeout := time.After(3 * time.Second)
+	testDone := make(chan struct{})
+	deadline := time.Now().Add(100 * time.Millisecond)
+
+	go func() {
+		client := hypeman.NewClient(
+			option.WithAPIKey("My API Key"),
+			option.WithHTTPClient(&http.Client{
+				Transport: &closureTransport{
+					fn: func(req *http.Request) (*http.Response, error) {
+						return &http.Response{
+							StatusCode: 200,
+							Status:     "200 OK",
+							Body: io.NopCloser(
+								io.Reader(readerFunc(func([]byte) (int, error) {
+									<-req.Context().Done()
+									return 0, req.Context().Err()
+								})),
+							),
+						}, nil
+					},
+				},
+			}),
+		)
+		stream := client.Instances.LogsStreaming(
+			context.Background(),
+			"id",
+			hypeman.InstanceLogsParams{},
+			option.WithRequestTimeout((100 * time.Millisecond)),
+		)
+		for stream.Next() {
+			_ = stream.Current()
+		}
+		if stream.Err() == nil {
+			t.Error("expected there to be a deadline error")
+		}
+		close(testDone)
+	}()
+
+	select {
+	case <-testTimeout:
+		t.Fatal("client didn't finish in time")
+	case <-testDone:
+		if diff := time.Since(deadline); diff < -30*time.Millisecond || 30*time.Millisecond < diff {
+			t.Fatalf("client did not return within 30ms of context deadline, got %s", diff)
+		}
+	}
+}
+
+type readerFunc func([]byte) (int, error)
+
+func (f readerFunc) Read(p []byte) (int, error) { return f(p) }
+func (f readerFunc) Close() error               { return nil }
diff --git a/sdks/go/device.go b/sdks/go/device.go
new file mode 100644
index 00000000..c754587d
--- /dev/null
+++ b/sdks/go/device.go
@@ -0,0 +1,198 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
+	"time"
+
+	"github.com/kernel/hypeman-go/internal/apijson"
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/kernel/hypeman-go/packages/param"
+	"github.com/kernel/hypeman-go/packages/respjson"
+)
+
+// DeviceService contains methods and other services that help with interacting
+// with the hypeman API.
+//
+// Note, unlike clients, this service does not read variables from the environment
+// automatically. You should not instantiate this service directly, and instead use
+// the [NewDeviceService] method instead.
+type DeviceService struct {
+	Options []option.RequestOption
+}
+
+// NewDeviceService generates a new service that applies the given options to each
+// request. These options are applied after the parent client's options (if there
+// is one), and before any request-specific options.
+func NewDeviceService(opts ...option.RequestOption) (r DeviceService) {
+	r = DeviceService{}
+	r.Options = opts
+	return
+}
+
+// Register a device for passthrough
+func (r *DeviceService) New(ctx context.Context, body DeviceNewParams, opts ...option.RequestOption) (res *Device, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "devices"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, body, &res, opts...)
+	return
+}
+
+// Get device details
+func (r *DeviceService) Get(ctx context.Context, id string, opts ...option.RequestOption) (res *Device, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("devices/%s", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+// List registered devices
+func (r *DeviceService) List(ctx context.Context, opts ...option.RequestOption) (res *[]Device, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "devices"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+// Unregister device
+func (r *DeviceService) Delete(ctx context.Context, id string, opts ...option.RequestOption) (err error) {
+	opts = slices.Concat(r.Options, opts)
+	opts = append([]option.RequestOption{option.WithHeader("Accept", "*/*")}, opts...)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("devices/%s", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodDelete, path, nil, nil, opts...)
+	return
+}
+
+// Discover passthrough-capable devices on host
+func (r *DeviceService) ListAvailable(ctx context.Context, opts ...option.RequestOption) (res *[]AvailableDevice, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "devices/available"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+type AvailableDevice struct {
+	// PCI device ID (hex)
+	DeviceID string `json:"device_id" api:"required"`
+	// IOMMU group number
+	IommuGroup int64 `json:"iommu_group" api:"required"`
+	// PCI address
+	PciAddress string `json:"pci_address" api:"required"`
+	// PCI vendor ID (hex)
+	VendorID string `json:"vendor_id" api:"required"`
+	// Currently bound driver (null if none)
+	CurrentDriver string `json:"current_driver" api:"nullable"`
+	// Human-readable device name
+	DeviceName string `json:"device_name"`
+	// Human-readable vendor name
+	VendorName string `json:"vendor_name"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		DeviceID      respjson.Field
+		IommuGroup    respjson.Field
+		PciAddress    respjson.Field
+		VendorID      respjson.Field
+		CurrentDriver respjson.Field
+		DeviceName    respjson.Field
+		VendorName    respjson.Field
+		ExtraFields   map[string]respjson.Field
+		raw           string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r AvailableDevice) RawJSON() string { return r.JSON.raw }
+func (r *AvailableDevice) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type Device struct {
+	// Auto-generated unique identifier (CUID2 format)
+	ID string `json:"id" api:"required"`
+	// Whether the device is currently bound to the vfio-pci driver, which is required
+	// for VM passthrough.
+	//
+	//   - true: Device is bound to vfio-pci and ready for (or currently in use by) a VM.
+	//     The device's native driver has been unloaded.
+	//   - false: Device is using its native driver (e.g., nvidia) or no driver. Hypeman
+	//     will automatically bind to vfio-pci when attaching to an instance.
+	BoundToVfio bool `json:"bound_to_vfio" api:"required"`
+	// Registration timestamp (RFC3339)
+	CreatedAt time.Time `json:"created_at" api:"required" format:"date-time"`
+	// PCI device ID (hex)
+	DeviceID string `json:"device_id" api:"required"`
+	// IOMMU group number
+	IommuGroup int64 `json:"iommu_group" api:"required"`
+	// PCI address
+	PciAddress string `json:"pci_address" api:"required"`
+	// Type of PCI device
+	//
+	// Any of "gpu", "pci".
+	Type DeviceType `json:"type" api:"required"`
+	// PCI vendor ID (hex)
+	VendorID string `json:"vendor_id" api:"required"`
+	// Instance ID if attached
+	AttachedTo string `json:"attached_to" api:"nullable"`
+	// Device name (user-provided or auto-generated from PCI address)
+	Name string `json:"name"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		ID          respjson.Field
+		BoundToVfio respjson.Field
+		CreatedAt   respjson.Field
+		DeviceID    respjson.Field
+		IommuGroup  respjson.Field
+		PciAddress  respjson.Field
+		Type        respjson.Field
+		VendorID    respjson.Field
+		AttachedTo  respjson.Field
+		Name        respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r Device) RawJSON() string { return r.JSON.raw }
+func (r *Device) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// Type of PCI device
+type DeviceType string
+
+const (
+	DeviceTypeGPU DeviceType = "gpu"
+	DeviceTypePci DeviceType = "pci"
+)
+
+type DeviceNewParams struct {
+	// PCI address of the device (required, e.g., "0000:a2:00.0")
+	PciAddress string `json:"pci_address" api:"required"`
+	// Optional globally unique device name. If not provided, a name is auto-generated
+	// from the PCI address (e.g., "pci-0000-a2-00-0")
+	Name param.Opt[string] `json:"name,omitzero"`
+	paramObj
+}
+
+func (r DeviceNewParams) MarshalJSON() (data []byte, err error) {
+	type shadow DeviceNewParams
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *DeviceNewParams) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
diff --git a/sdks/go/device_test.go b/sdks/go/device_test.go
new file mode 100644
index 00000000..1c092572
--- /dev/null
+++ b/sdks/go/device_test.go
@@ -0,0 +1,132 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman_test
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/internal/testutil"
+	"github.com/kernel/hypeman-go/option"
+)
+
+func TestDeviceNewWithOptionalParams(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Devices.New(context.TODO(), hypeman.DeviceNewParams{
+		PciAddress: "0000:a2:00.0",
+		Name:       hypeman.String("l4-gpu"),
+	})
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestDeviceGet(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Devices.Get(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestDeviceList(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Devices.List(context.TODO())
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestDeviceDelete(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	err := client.Devices.Delete(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestDeviceListAvailable(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Devices.ListAvailable(context.TODO())
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
diff --git a/sdks/go/examples/.keep b/sdks/go/examples/.keep
new file mode 100644
index 00000000..d8c73e93
--- /dev/null
+++ b/sdks/go/examples/.keep
@@ -0,0 +1,4 @@
+File generated from our OpenAPI spec by Stainless.
+
+This directory can be used to store example files demonstrating usage of this SDK.
+It is ignored by Stainless code generation and its content (other than this keep file) won't be touched.
\ No newline at end of file
diff --git a/sdks/go/examples/push/main.go b/sdks/go/examples/push/main.go
new file mode 100644
index 00000000..f5a17478
--- /dev/null
+++ b/sdks/go/examples/push/main.go
@@ -0,0 +1,100 @@
+// Example: Push a local Docker image to hypeman
+//
+// This example demonstrates how to push images to hypeman's registry using the SDK.
+// It shows three approaches:
+//  1. Push from local Docker daemon (most common for development)
+//  2. Push from a remote registry (pull and push)
+//  3. Push using PushFromURL helper (standalone scripts)
+//
+// Usage:
+//
+//	export HYPEMAN_API_KEY="your-jwt-token"
+//	export HYPEMAN_BASE_URL="http://localhost:8080"
+//	go run ./examples/push myapp:latest
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/google/go-containerregistry/pkg/name"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+	hypeman "github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/lib"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		fmt.Fprintln(os.Stderr, "Usage: push <image> [target-name]")
+		fmt.Fprintln(os.Stderr, "  image:       Local Docker image reference (e.g., myapp:latest)")
+		fmt.Fprintln(os.Stderr, "  target-name: Optional name in hypeman (defaults to image)")
+		os.Exit(1)
+	}
+
+	sourceImage := os.Args[1]
+	targetName := sourceImage
+	if len(os.Args) > 2 {
+		targetName = os.Args[2]
+	}
+
+	ctx := context.Background()
+
+	// Create a hypeman client (reads HYPEMAN_API_KEY and HYPEMAN_BASE_URL from env)
+	client := hypeman.NewClient()
+
+	// Extract push configuration from client options
+	cfg, err := lib.ExtractPushConfig(client.Options)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}
+
+	fmt.Printf("Pushing %s to hypeman as %s...\n", sourceImage, targetName)
+
+	// Push from local Docker daemon
+	err = lib.Push(ctx, cfg, sourceImage, targetName)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Push failed: %v\n", err)
+		os.Exit(1)
+	}
+
+	fmt.Println("Push successful!")
+}
+
+// Example: Push from a remote registry (pull from Docker Hub, push to hypeman)
+func examplePushFromRemote(ctx context.Context, cfg lib.PushConfig) error {
+	// Pull from Docker Hub
+	ref, err := name.ParseReference("docker.io/library/alpine:latest")
+	if err != nil {
+		return err
+	}
+
+	img, err := remote.Image(ref)
+	if err != nil {
+		return err
+	}
+
+	// Push to hypeman
+	return lib.PushImage(ctx, cfg, img, "alpine:latest")
+}
+
+// Example: Using PushFromURL for standalone scripts
+func examplePushFromURL(ctx context.Context) error {
+	baseURL := os.Getenv("HYPEMAN_BASE_URL")
+	apiKey := os.Getenv("HYPEMAN_API_KEY")
+
+	// Pull image from remote
+	ref, err := name.ParseReference("docker.io/library/nginx:alpine")
+	if err != nil {
+		return err
+	}
+
+	img, err := remote.Image(ref)
+	if err != nil {
+		return err
+	}
+
+	// Push directly using URL (no client needed)
+	return lib.PushFromURL(ctx, baseURL, apiKey, img, "nginx:alpine")
+}
diff --git a/sdks/go/field.go b/sdks/go/field.go
new file mode 100644
index 00000000..2051a0bd
--- /dev/null
+++ b/sdks/go/field.go
@@ -0,0 +1,45 @@
+package hypeman
+
+import (
+	"github.com/kernel/hypeman-go/packages/param"
+	"io"
+	"time"
+)
+
+func String(s string) param.Opt[string]     { return param.NewOpt(s) }
+func Int(i int64) param.Opt[int64]          { return param.NewOpt(i) }
+func Bool(b bool) param.Opt[bool]           { return param.NewOpt(b) }
+func Float(f float64) param.Opt[float64]    { return param.NewOpt(f) }
+func Time(t time.Time) param.Opt[time.Time] { return param.NewOpt(t) }
+
+func Opt[T comparable](v T) param.Opt[T] { return param.NewOpt(v) }
+func Ptr[T any](v T) *T                  { return &v }
+
+func IntPtr(v int64) *int64          { return &v }
+func BoolPtr(v bool) *bool           { return &v }
+func FloatPtr(v float64) *float64    { return &v }
+func StringPtr(v string) *string     { return &v }
+func TimePtr(v time.Time) *time.Time { return &v }
+
+func File(rdr io.Reader, filename string, contentType string) file {
+	return file{rdr, filename, contentType}
+}
+
+type file struct {
+	io.Reader
+	name        string
+	contentType string
+}
+
+func (f file) Filename() string {
+	if f.name != "" {
+		return f.name
+	} else if named, ok := f.Reader.(interface{ Name() string }); ok {
+		return named.Name()
+	}
+	return ""
+}
+
+func (f file) ContentType() string {
+	return f.contentType
+}
diff --git a/sdks/go/go.mod b/sdks/go/go.mod
new file mode 100644
index 00000000..68dc94ac
--- /dev/null
+++ b/sdks/go/go.mod
@@ -0,0 +1,57 @@
+module github.com/kernel/hypeman-go
+
+go 1.24.0
+
+require (
+	github.com/google/go-containerregistry v0.20.7
+	github.com/gorilla/websocket v1.5.3
+	github.com/stretchr/testify v1.11.1
+	github.com/tidwall/gjson v1.18.0
+	github.com/tidwall/sjson v1.2.5
+)
+
+require (
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/cli v29.0.3+incompatible // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker v28.5.2+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/klauspost/compress v1.18.1 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/vbatts/tar-split v0.12.2 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
+	go.opentelemetry.io/otel/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.38.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/trace v1.38.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
diff --git a/sdks/go/go.sum b/sdks/go/go.sum
new file mode 100644
index 00000000..fa2fd63a
--- /dev/null
+++ b/sdks/go/go.sum
@@ -0,0 +1,142 @@
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfNOFMA/c10O1axL69EU7iirO8=
+github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/cli v29.0.3+incompatible h1:8J+PZIcF2xLd6h5sHPsp5pvvJA+Sr2wGQxHkRl53a1E=
+github.com/docker/cli v29.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
+github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
+github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
+github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-containerregistry v0.20.7 h1:24VGNpS0IwrOZ2ms2P1QE3Xa5X9p4phx0aUgzYzHW6I=
+github.com/google/go-containerregistry v0.20.7/go.mod h1:Lx5LCZQjLH1QBaMPeGwsME9biPeo1lPx6lbGj/UmzgM=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
+github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
+github.com/klauspost/compress v1.18.1 h1:bcSGx7UbpBqMChDtsF28Lw6v/G94LPrrbMbdC3JH2co=
+github.com/klauspost/compress v1.18.1/go.mod h1:ZQFFVG+MdnR0P+l6wpXgIL4NTtwiKIdBnrBd8Nrxr+0=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/term v0.0.0-20221205130635-1aeaba878587 h1:HfkjXDfhgVaN5rmueG8cL8KKeFNecRCXFhaJ2qZ5SKA=
+github.com/moby/term v0.0.0-20221205130635-1aeaba878587/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
+github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
+github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4=
+github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
+go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.33.0 h1:wpMfgF8E1rkrT1Z6meFh1NDtownE9Ii3n3X2GJYjsaU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.33.0/go.mod h1:wAy0T/dUbs468uOlkT31xjvqQgEVXv58BRFWEgn5v/0=
+go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
+go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
+go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
+go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
+go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
+go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
+go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
+go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
+go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
+go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac h1:7zkz7BUtwNFFqcowJ+RIgu2MaV/MapERkDIy+mwPyjs=
+golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 h1:BIRfGDEjiHRrk0QKZe3Xv2ieMhtgRGeLcZQ0mIVn4EY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5/go.mod h1:j3QtIyytwqGr1JUDtYXwtMXWPKsEa5LtzIFN1Wn5WvE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 h1:eaY8u2EuxbRv7c3NiGK0/NedzVsCcV6hDuU5qPX5EGE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5/go.mod h1:M4/wBTSeyLxupu3W3tJtOgB14jILAS/XWPSSa3TAlJc=
+google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
+google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
+gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
diff --git a/sdks/go/health.go b/sdks/go/health.go
new file mode 100644
index 00000000..9e6cc0f3
--- /dev/null
+++ b/sdks/go/health.go
@@ -0,0 +1,64 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman
+
+import (
+	"context"
+	"net/http"
+	"slices"
+
+	"github.com/kernel/hypeman-go/internal/apijson"
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/kernel/hypeman-go/packages/respjson"
+)
+
+// HealthService contains methods and other services that help with interacting
+// with the hypeman API.
+//
+// Note, unlike clients, this service does not read variables from the environment
+// automatically. You should not instantiate this service directly, and instead use
+// the [NewHealthService] method instead.
+type HealthService struct {
+	Options []option.RequestOption
+}
+
+// NewHealthService generates a new service that applies the given options to each
+// request. These options are applied after the parent client's options (if there
+// is one), and before any request-specific options.
+func NewHealthService(opts ...option.RequestOption) (r HealthService) {
+	r = HealthService{}
+	r.Options = opts
+	return
+}
+
+// Health check
+func (r *HealthService) Check(ctx context.Context, opts ...option.RequestOption) (res *HealthCheckResponse, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "health"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+type HealthCheckResponse struct {
+	// Any of "ok".
+	Status HealthCheckResponseStatus `json:"status" api:"required"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		Status      respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r HealthCheckResponse) RawJSON() string { return r.JSON.raw }
+func (r *HealthCheckResponse) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type HealthCheckResponseStatus string
+
+const (
+	HealthCheckResponseStatusOk HealthCheckResponseStatus = "ok"
+)
diff --git a/sdks/go/health_test.go b/sdks/go/health_test.go
new file mode 100644
index 00000000..2b588c83
--- /dev/null
+++ b/sdks/go/health_test.go
@@ -0,0 +1,37 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman_test
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/internal/testutil"
+	"github.com/kernel/hypeman-go/option"
+)
+
+func TestHealthCheck(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Health.Check(context.TODO())
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
diff --git a/sdks/go/image.go b/sdks/go/image.go
new file mode 100644
index 00000000..5c116487
--- /dev/null
+++ b/sdks/go/image.go
@@ -0,0 +1,152 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
+	"time"
+
+	"github.com/kernel/hypeman-go/internal/apijson"
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/kernel/hypeman-go/packages/param"
+	"github.com/kernel/hypeman-go/packages/respjson"
+)
+
+// ImageService contains methods and other services that help with interacting with
+// the hypeman API.
+//
+// Note, unlike clients, this service does not read variables from the environment
+// automatically. You should not instantiate this service directly, and instead use
+// the [NewImageService] method instead.
+type ImageService struct {
+	Options []option.RequestOption
+}
+
+// NewImageService generates a new service that applies the given options to each
+// request. These options are applied after the parent client's options (if there
+// is one), and before any request-specific options.
+func NewImageService(opts ...option.RequestOption) (r ImageService) {
+	r = ImageService{}
+	r.Options = opts
+	return
+}
+
+// Pull and convert OCI image
+func (r *ImageService) New(ctx context.Context, body ImageNewParams, opts ...option.RequestOption) (res *Image, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "images"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, body, &res, opts...)
+	return
+}
+
+// List images
+func (r *ImageService) List(ctx context.Context, opts ...option.RequestOption) (res *[]Image, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "images"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+// Delete image
+func (r *ImageService) Delete(ctx context.Context, name string, opts ...option.RequestOption) (err error) {
+	opts = slices.Concat(r.Options, opts)
+	opts = append([]option.RequestOption{option.WithHeader("Accept", "*/*")}, opts...)
+	if name == "" {
+		err = errors.New("missing required name parameter")
+		return
+	}
+	path := fmt.Sprintf("images/%s", name)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodDelete, path, nil, nil, opts...)
+	return
+}
+
+// Get image details
+func (r *ImageService) Get(ctx context.Context, name string, opts ...option.RequestOption) (res *Image, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if name == "" {
+		err = errors.New("missing required name parameter")
+		return
+	}
+	path := fmt.Sprintf("images/%s", name)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+type Image struct {
+	// Creation timestamp (RFC3339)
+	CreatedAt time.Time `json:"created_at" api:"required" format:"date-time"`
+	// Resolved manifest digest
+	Digest string `json:"digest" api:"required"`
+	// Normalized OCI image reference (tag or digest)
+	Name string `json:"name" api:"required"`
+	// Build status
+	//
+	// Any of "pending", "pulling", "converting", "ready", "failed".
+	Status ImageStatus `json:"status" api:"required"`
+	// CMD from container metadata
+	Cmd []string `json:"cmd" api:"nullable"`
+	// Entrypoint from container metadata
+	Entrypoint []string `json:"entrypoint" api:"nullable"`
+	// Environment variables from container metadata
+	Env map[string]string `json:"env"`
+	// Error message if status is failed
+	Error string `json:"error" api:"nullable"`
+	// Position in build queue (null if not queued)
+	QueuePosition int64 `json:"queue_position" api:"nullable"`
+	// Disk size in bytes (null until ready)
+	SizeBytes int64 `json:"size_bytes" api:"nullable"`
+	// Working directory from container metadata
+	WorkingDir string `json:"working_dir" api:"nullable"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		CreatedAt     respjson.Field
+		Digest        respjson.Field
+		Name          respjson.Field
+		Status        respjson.Field
+		Cmd           respjson.Field
+		Entrypoint    respjson.Field
+		Env           respjson.Field
+		Error         respjson.Field
+		QueuePosition respjson.Field
+		SizeBytes     respjson.Field
+		WorkingDir    respjson.Field
+		ExtraFields   map[string]respjson.Field
+		raw           string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r Image) RawJSON() string { return r.JSON.raw }
+func (r *Image) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// Build status
+type ImageStatus string
+
+const (
+	ImageStatusPending    ImageStatus = "pending"
+	ImageStatusPulling    ImageStatus = "pulling"
+	ImageStatusConverting ImageStatus = "converting"
+	ImageStatusReady      ImageStatus = "ready"
+	ImageStatusFailed     ImageStatus = "failed"
+)
+
+type ImageNewParams struct {
+	// OCI image reference (e.g., docker.io/library/nginx:latest)
+	Name string `json:"name" api:"required"`
+	paramObj
+}
+
+func (r ImageNewParams) MarshalJSON() (data []byte, err error) {
+	type shadow ImageNewParams
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *ImageNewParams) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
diff --git a/sdks/go/image_test.go b/sdks/go/image_test.go
new file mode 100644
index 00000000..e799946d
--- /dev/null
+++ b/sdks/go/image_test.go
@@ -0,0 +1,108 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman_test
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/internal/testutil"
+	"github.com/kernel/hypeman-go/option"
+)
+
+func TestImageNew(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Images.New(context.TODO(), hypeman.ImageNewParams{
+		Name: "docker.io/library/nginx:latest",
+	})
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestImageList(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Images.List(context.TODO())
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestImageDelete(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	err := client.Images.Delete(context.TODO(), "name")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestImageGet(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Images.Get(context.TODO(), "name")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
diff --git a/sdks/go/ingress.go b/sdks/go/ingress.go
new file mode 100644
index 00000000..860f31c8
--- /dev/null
+++ b/sdks/go/ingress.go
@@ -0,0 +1,296 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
+	"time"
+
+	"github.com/kernel/hypeman-go/internal/apijson"
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/kernel/hypeman-go/packages/param"
+	"github.com/kernel/hypeman-go/packages/respjson"
+)
+
+// IngressService contains methods and other services that help with interacting
+// with the hypeman API.
+//
+// Note, unlike clients, this service does not read variables from the environment
+// automatically. You should not instantiate this service directly, and instead use
+// the [NewIngressService] method instead.
+type IngressService struct {
+	Options []option.RequestOption
+}
+
+// NewIngressService generates a new service that applies the given options to each
+// request. These options are applied after the parent client's options (if there
+// is one), and before any request-specific options.
+func NewIngressService(opts ...option.RequestOption) (r IngressService) {
+	r = IngressService{}
+	r.Options = opts
+	return
+}
+
+// Create ingress
+func (r *IngressService) New(ctx context.Context, body IngressNewParams, opts ...option.RequestOption) (res *Ingress, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "ingresses"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, body, &res, opts...)
+	return
+}
+
+// List ingresses
+func (r *IngressService) List(ctx context.Context, opts ...option.RequestOption) (res *[]Ingress, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "ingresses"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+// Delete ingress
+func (r *IngressService) Delete(ctx context.Context, id string, opts ...option.RequestOption) (err error) {
+	opts = slices.Concat(r.Options, opts)
+	opts = append([]option.RequestOption{option.WithHeader("Accept", "*/*")}, opts...)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("ingresses/%s", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodDelete, path, nil, nil, opts...)
+	return
+}
+
+// Get ingress details
+func (r *IngressService) Get(ctx context.Context, id string, opts ...option.RequestOption) (res *Ingress, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("ingresses/%s", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+type Ingress struct {
+	// Auto-generated unique identifier
+	ID string `json:"id" api:"required"`
+	// Creation timestamp (RFC3339)
+	CreatedAt time.Time `json:"created_at" api:"required" format:"date-time"`
+	// Human-readable name
+	Name string `json:"name" api:"required"`
+	// Routing rules for this ingress
+	Rules []IngressRule `json:"rules" api:"required"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		ID          respjson.Field
+		CreatedAt   respjson.Field
+		Name        respjson.Field
+		Rules       respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r Ingress) RawJSON() string { return r.JSON.raw }
+func (r *Ingress) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type IngressMatch struct {
+	// Hostname to match. Can be:
+	//
+	// - Literal: "api.example.com" (exact match on Host header)
+	// - Pattern: "{instance}.example.com" (dynamic routing based on subdomain)
+	//
+	// Pattern hostnames use named captures in curly braces (e.g., {instance}, {app})
+	// that extract parts of the hostname for routing. The extracted values can be
+	// referenced in the target.instance field.
+	Hostname string `json:"hostname" api:"required"`
+	// Host port to listen on for this rule (default 80)
+	Port int64 `json:"port"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		Hostname    respjson.Field
+		Port        respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r IngressMatch) RawJSON() string { return r.JSON.raw }
+func (r *IngressMatch) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// ToParam converts this IngressMatch to a IngressMatchParam.
+//
+// Warning: the fields of the param type will not be present. ToParam should only
+// be used at the last possible moment before sending a request. Test for this with
+// IngressMatchParam.Overrides()
+func (r IngressMatch) ToParam() IngressMatchParam {
+	return param.Override[IngressMatchParam](json.RawMessage(r.RawJSON()))
+}
+
+// The property Hostname is required.
+type IngressMatchParam struct {
+	// Hostname to match. Can be:
+	//
+	// - Literal: "api.example.com" (exact match on Host header)
+	// - Pattern: "{instance}.example.com" (dynamic routing based on subdomain)
+	//
+	// Pattern hostnames use named captures in curly braces (e.g., {instance}, {app})
+	// that extract parts of the hostname for routing. The extracted values can be
+	// referenced in the target.instance field.
+	Hostname string `json:"hostname" api:"required"`
+	// Host port to listen on for this rule (default 80)
+	Port param.Opt[int64] `json:"port,omitzero"`
+	paramObj
+}
+
+func (r IngressMatchParam) MarshalJSON() (data []byte, err error) {
+	type shadow IngressMatchParam
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *IngressMatchParam) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type IngressRule struct {
+	Match  IngressMatch  `json:"match" api:"required"`
+	Target IngressTarget `json:"target" api:"required"`
+	// Auto-create HTTP to HTTPS redirect for this hostname (only applies when tls is
+	// enabled)
+	RedirectHTTP bool `json:"redirect_http"`
+	// Enable TLS termination (certificate auto-issued via ACME).
+	Tls bool `json:"tls"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		Match        respjson.Field
+		Target       respjson.Field
+		RedirectHTTP respjson.Field
+		Tls          respjson.Field
+		ExtraFields  map[string]respjson.Field
+		raw          string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r IngressRule) RawJSON() string { return r.JSON.raw }
+func (r *IngressRule) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// ToParam converts this IngressRule to a IngressRuleParam.
+//
+// Warning: the fields of the param type will not be present. ToParam should only
+// be used at the last possible moment before sending a request. Test for this with
+// IngressRuleParam.Overrides()
+func (r IngressRule) ToParam() IngressRuleParam {
+	return param.Override[IngressRuleParam](json.RawMessage(r.RawJSON()))
+}
+
+// The properties Match, Target are required.
+type IngressRuleParam struct {
+	Match  IngressMatchParam  `json:"match,omitzero" api:"required"`
+	Target IngressTargetParam `json:"target,omitzero" api:"required"`
+	// Auto-create HTTP to HTTPS redirect for this hostname (only applies when tls is
+	// enabled)
+	RedirectHTTP param.Opt[bool] `json:"redirect_http,omitzero"`
+	// Enable TLS termination (certificate auto-issued via ACME).
+	Tls param.Opt[bool] `json:"tls,omitzero"`
+	paramObj
+}
+
+func (r IngressRuleParam) MarshalJSON() (data []byte, err error) {
+	type shadow IngressRuleParam
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *IngressRuleParam) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type IngressTarget struct {
+	// Target instance name, ID, or capture reference.
+	//
+	//   - For literal hostnames: Use the instance name or ID directly (e.g., "my-api")
+	//   - For pattern hostnames: Reference a capture from the hostname (e.g.,
+	//     "{instance}")
+	//
+	// When using pattern hostnames, the instance is resolved dynamically at request
+	// time.
+	Instance string `json:"instance" api:"required"`
+	// Target port on the instance
+	Port int64 `json:"port" api:"required"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		Instance    respjson.Field
+		Port        respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r IngressTarget) RawJSON() string { return r.JSON.raw }
+func (r *IngressTarget) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// ToParam converts this IngressTarget to a IngressTargetParam.
+//
+// Warning: the fields of the param type will not be present. ToParam should only
+// be used at the last possible moment before sending a request. Test for this with
+// IngressTargetParam.Overrides()
+func (r IngressTarget) ToParam() IngressTargetParam {
+	return param.Override[IngressTargetParam](json.RawMessage(r.RawJSON()))
+}
+
+// The properties Instance, Port are required.
+type IngressTargetParam struct {
+	// Target instance name, ID, or capture reference.
+	//
+	//   - For literal hostnames: Use the instance name or ID directly (e.g., "my-api")
+	//   - For pattern hostnames: Reference a capture from the hostname (e.g.,
+	//     "{instance}")
+	//
+	// When using pattern hostnames, the instance is resolved dynamically at request
+	// time.
+	Instance string `json:"instance" api:"required"`
+	// Target port on the instance
+	Port int64 `json:"port" api:"required"`
+	paramObj
+}
+
+func (r IngressTargetParam) MarshalJSON() (data []byte, err error) {
+	type shadow IngressTargetParam
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *IngressTargetParam) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type IngressNewParams struct {
+	// Human-readable name (lowercase letters, digits, and dashes only; cannot start or
+	// end with a dash)
+	Name string `json:"name" api:"required"`
+	// Routing rules for this ingress
+	Rules []IngressRuleParam `json:"rules,omitzero" api:"required"`
+	paramObj
+}
+
+func (r IngressNewParams) MarshalJSON() (data []byte, err error) {
+	type shadow IngressNewParams
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *IngressNewParams) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
diff --git a/sdks/go/ingress_test.go b/sdks/go/ingress_test.go
new file mode 100644
index 00000000..28bbab5f
--- /dev/null
+++ b/sdks/go/ingress_test.go
@@ -0,0 +1,120 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman_test
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/internal/testutil"
+	"github.com/kernel/hypeman-go/option"
+)
+
+func TestIngressNew(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Ingresses.New(context.TODO(), hypeman.IngressNewParams{
+		Name: "my-api-ingress",
+		Rules: []hypeman.IngressRuleParam{{
+			Match: hypeman.IngressMatchParam{
+				Hostname: "{instance}.example.com",
+				Port:     hypeman.Int(8080),
+			},
+			Target: hypeman.IngressTargetParam{
+				Instance: "{instance}",
+				Port:     8080,
+			},
+			RedirectHTTP: hypeman.Bool(true),
+			Tls:          hypeman.Bool(true),
+		}},
+	})
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestIngressList(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Ingresses.List(context.TODO())
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestIngressDelete(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	err := client.Ingresses.Delete(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestIngressGet(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Ingresses.Get(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
diff --git a/sdks/go/instance.go b/sdks/go/instance.go
new file mode 100644
index 00000000..c1eabf63
--- /dev/null
+++ b/sdks/go/instance.go
@@ -0,0 +1,658 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"slices"
+	"time"
+
+	"github.com/kernel/hypeman-go/internal/apijson"
+	"github.com/kernel/hypeman-go/internal/apiquery"
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/kernel/hypeman-go/packages/param"
+	"github.com/kernel/hypeman-go/packages/respjson"
+	"github.com/kernel/hypeman-go/packages/ssestream"
+)
+
+// InstanceService contains methods and other services that help with interacting
+// with the hypeman API.
+//
+// Note, unlike clients, this service does not read variables from the environment
+// automatically. You should not instantiate this service directly, and instead use
+// the [NewInstanceService] method instead.
+type InstanceService struct {
+	Options []option.RequestOption
+	Volumes InstanceVolumeService
+}
+
+// NewInstanceService generates a new service that applies the given options to
+// each request. These options are applied after the parent client's options (if
+// there is one), and before any request-specific options.
+func NewInstanceService(opts ...option.RequestOption) (r InstanceService) {
+	r = InstanceService{}
+	r.Options = opts
+	r.Volumes = NewInstanceVolumeService(opts...)
+	return
+}
+
+// Create and start instance
+func (r *InstanceService) New(ctx context.Context, body InstanceNewParams, opts ...option.RequestOption) (res *Instance, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "instances"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, body, &res, opts...)
+	return
+}
+
+// List instances
+func (r *InstanceService) List(ctx context.Context, query InstanceListParams, opts ...option.RequestOption) (res *[]Instance, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "instances"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, query, &res, opts...)
+	return
+}
+
+// Stop and delete instance
+func (r *InstanceService) Delete(ctx context.Context, id string, opts ...option.RequestOption) (err error) {
+	opts = slices.Concat(r.Options, opts)
+	opts = append([]option.RequestOption{option.WithHeader("Accept", "*/*")}, opts...)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("instances/%s", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodDelete, path, nil, nil, opts...)
+	return
+}
+
+// Get instance details
+func (r *InstanceService) Get(ctx context.Context, id string, opts ...option.RequestOption) (res *Instance, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("instances/%s", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+// Streams instance logs as Server-Sent Events. Use the `source` parameter to
+// select which log to stream:
+//
+// - `app` (default): Guest application logs (serial console)
+// - `vmm`: Cloud Hypervisor VMM logs
+// - `hypeman`: Hypeman operations log
+//
+// Returns the last N lines (controlled by `tail` parameter), then optionally
+// continues streaming new lines if `follow=true`.
+func (r *InstanceService) LogsStreaming(ctx context.Context, id string, query InstanceLogsParams, opts ...option.RequestOption) (stream *ssestream.Stream[string]) {
+	var (
+		raw *http.Response
+		err error
+	)
+	opts = slices.Concat(r.Options, opts)
+	opts = append([]option.RequestOption{option.WithHeader("Accept", "text/event-stream")}, opts...)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("instances/%s/logs", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, query, &raw, opts...)
+	return ssestream.NewStream[string](ssestream.NewDecoder(raw), err)
+}
+
+// Restore instance from standby
+func (r *InstanceService) Restore(ctx context.Context, id string, opts ...option.RequestOption) (res *Instance, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("instances/%s/restore", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, nil, &res, opts...)
+	return
+}
+
+// Put instance in standby (pause, snapshot, delete VMM)
+func (r *InstanceService) Standby(ctx context.Context, id string, opts ...option.RequestOption) (res *Instance, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("instances/%s/standby", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, nil, &res, opts...)
+	return
+}
+
+// Start a stopped instance
+func (r *InstanceService) Start(ctx context.Context, id string, body InstanceStartParams, opts ...option.RequestOption) (res *Instance, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("instances/%s/start", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, body, &res, opts...)
+	return
+}
+
+// Returns information about a path in the guest filesystem. Useful for checking if
+// a path exists, its type, and permissions before performing file operations.
+func (r *InstanceService) Stat(ctx context.Context, id string, query InstanceStatParams, opts ...option.RequestOption) (res *PathInfo, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("instances/%s/stat", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, query, &res, opts...)
+	return
+}
+
+// Stop instance (graceful shutdown)
+func (r *InstanceService) Stop(ctx context.Context, id string, opts ...option.RequestOption) (res *Instance, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("instances/%s/stop", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, nil, &res, opts...)
+	return
+}
+
+type Instance struct {
+	// Auto-generated unique identifier (CUID2 format)
+	ID string `json:"id" api:"required"`
+	// Creation timestamp (RFC3339)
+	CreatedAt time.Time `json:"created_at" api:"required" format:"date-time"`
+	// OCI image reference
+	Image string `json:"image" api:"required"`
+	// Human-readable name
+	Name string `json:"name" api:"required"`
+	// Instance state:
+	//
+	// - Created: VMM created but not started (Cloud Hypervisor native)
+	// - Running: VM is actively running (Cloud Hypervisor native)
+	// - Paused: VM is paused (Cloud Hypervisor native)
+	// - Shutdown: VM shut down but VMM exists (Cloud Hypervisor native)
+	// - Stopped: No VMM running, no snapshot exists
+	// - Standby: No VMM running, snapshot exists (can be restored)
+	// - Unknown: Failed to determine state (see state_error for details)
+	//
+	// Any of "Created", "Running", "Paused", "Shutdown", "Stopped", "Standby",
+	// "Unknown".
+	State InstanceState `json:"state" api:"required"`
+	// Disk I/O rate limit (human-readable, e.g., "100MB/s")
+	DiskIoBps string `json:"disk_io_bps"`
+	// Environment variables
+	Env map[string]string `json:"env"`
+	// App exit code (null if VM hasn't exited)
+	ExitCode int64 `json:"exit_code" api:"nullable"`
+	// Human-readable description of exit (e.g., "command not found", "killed by signal
+	// 9 (SIGKILL) - OOM")
+	ExitMessage string `json:"exit_message"`
+	// GPU information attached to the instance
+	GPU InstanceGPU `json:"gpu"`
+	// Whether a snapshot exists for this instance
+	HasSnapshot bool `json:"has_snapshot"`
+	// Hotplug memory size (human-readable)
+	HotplugSize string `json:"hotplug_size"`
+	// Hypervisor running this instance
+	//
+	// Any of "cloud-hypervisor", "qemu", "vz".
+	Hypervisor InstanceHypervisor `json:"hypervisor"`
+	// User-defined key-value metadata
+	Metadata map[string]string `json:"metadata"`
+	// Network configuration of the instance
+	Network InstanceNetwork `json:"network"`
+	// Writable overlay disk size (human-readable)
+	OverlaySize string `json:"overlay_size"`
+	// Base memory size (human-readable)
+	Size string `json:"size"`
+	// Start timestamp (RFC3339)
+	StartedAt time.Time `json:"started_at" api:"nullable" format:"date-time"`
+	// Error message if state couldn't be determined (only set when state is Unknown)
+	StateError string `json:"state_error" api:"nullable"`
+	// Stop timestamp (RFC3339)
+	StoppedAt time.Time `json:"stopped_at" api:"nullable" format:"date-time"`
+	// Number of virtual CPUs
+	Vcpus int64 `json:"vcpus"`
+	// Volumes attached to the instance
+	Volumes []VolumeMount `json:"volumes"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		ID          respjson.Field
+		CreatedAt   respjson.Field
+		Image       respjson.Field
+		Name        respjson.Field
+		State       respjson.Field
+		DiskIoBps   respjson.Field
+		Env         respjson.Field
+		ExitCode    respjson.Field
+		ExitMessage respjson.Field
+		GPU         respjson.Field
+		HasSnapshot respjson.Field
+		HotplugSize respjson.Field
+		Hypervisor  respjson.Field
+		Metadata    respjson.Field
+		Network     respjson.Field
+		OverlaySize respjson.Field
+		Size        respjson.Field
+		StartedAt   respjson.Field
+		StateError  respjson.Field
+		StoppedAt   respjson.Field
+		Vcpus       respjson.Field
+		Volumes     respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r Instance) RawJSON() string { return r.JSON.raw }
+func (r *Instance) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// Instance state:
+//
+// - Created: VMM created but not started (Cloud Hypervisor native)
+// - Running: VM is actively running (Cloud Hypervisor native)
+// - Paused: VM is paused (Cloud Hypervisor native)
+// - Shutdown: VM shut down but VMM exists (Cloud Hypervisor native)
+// - Stopped: No VMM running, no snapshot exists
+// - Standby: No VMM running, snapshot exists (can be restored)
+// - Unknown: Failed to determine state (see state_error for details)
+type InstanceState string
+
+const (
+	InstanceStateCreated  InstanceState = "Created"
+	InstanceStateRunning  InstanceState = "Running"
+	InstanceStatePaused   InstanceState = "Paused"
+	InstanceStateShutdown InstanceState = "Shutdown"
+	InstanceStateStopped  InstanceState = "Stopped"
+	InstanceStateStandby  InstanceState = "Standby"
+	InstanceStateUnknown  InstanceState = "Unknown"
+)
+
+// GPU information attached to the instance
+type InstanceGPU struct {
+	// mdev device UUID
+	MdevUuid string `json:"mdev_uuid"`
+	// vGPU profile name
+	Profile string `json:"profile"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		MdevUuid    respjson.Field
+		Profile     respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r InstanceGPU) RawJSON() string { return r.JSON.raw }
+func (r *InstanceGPU) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// Hypervisor running this instance
+type InstanceHypervisor string
+
+const (
+	InstanceHypervisorCloudHypervisor InstanceHypervisor = "cloud-hypervisor"
+	InstanceHypervisorQemu            InstanceHypervisor = "qemu"
+	InstanceHypervisorVz              InstanceHypervisor = "vz"
+)
+
+// Network configuration of the instance
+type InstanceNetwork struct {
+	// Download bandwidth limit (human-readable, e.g., "1Gbps", "125MB/s")
+	BandwidthDownload string `json:"bandwidth_download"`
+	// Upload bandwidth limit (human-readable, e.g., "1Gbps", "125MB/s")
+	BandwidthUpload string `json:"bandwidth_upload"`
+	// Whether instance is attached to the default network
+	Enabled bool `json:"enabled"`
+	// Assigned IP address (null if no network)
+	IP string `json:"ip" api:"nullable"`
+	// Assigned MAC address (null if no network)
+	Mac string `json:"mac" api:"nullable"`
+	// Network name (always "default" when enabled)
+	Name string `json:"name"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		BandwidthDownload respjson.Field
+		BandwidthUpload   respjson.Field
+		Enabled           respjson.Field
+		IP                respjson.Field
+		Mac               respjson.Field
+		Name              respjson.Field
+		ExtraFields       map[string]respjson.Field
+		raw               string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r InstanceNetwork) RawJSON() string { return r.JSON.raw }
+func (r *InstanceNetwork) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type PathInfo struct {
+	// Whether the path exists
+	Exists bool `json:"exists" api:"required"`
+	// Error message if stat failed (e.g., permission denied). Only set when exists is
+	// false due to an error rather than the path not existing.
+	Error string `json:"error" api:"nullable"`
+	// True if this is a directory
+	IsDir bool `json:"is_dir"`
+	// True if this is a regular file
+	IsFile bool `json:"is_file"`
+	// True if this is a symbolic link (only set when follow_links=false)
+	IsSymlink bool `json:"is_symlink"`
+	// Symlink target path (only set when is_symlink=true)
+	LinkTarget string `json:"link_target" api:"nullable"`
+	// File mode (Unix permissions)
+	Mode int64 `json:"mode"`
+	// File size in bytes
+	Size int64 `json:"size"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		Exists      respjson.Field
+		Error       respjson.Field
+		IsDir       respjson.Field
+		IsFile      respjson.Field
+		IsSymlink   respjson.Field
+		LinkTarget  respjson.Field
+		Mode        respjson.Field
+		Size        respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r PathInfo) RawJSON() string { return r.JSON.raw }
+func (r *PathInfo) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type VolumeMount struct {
+	// Path where volume is mounted in the guest
+	MountPath string `json:"mount_path" api:"required"`
+	// Volume identifier
+	VolumeID string `json:"volume_id" api:"required"`
+	// Create per-instance overlay for writes (requires readonly=true)
+	Overlay bool `json:"overlay"`
+	// Max overlay size as human-readable string (e.g., "1GB"). Required if
+	// overlay=true.
+	OverlaySize string `json:"overlay_size"`
+	// Whether volume is mounted read-only
+	Readonly bool `json:"readonly"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		MountPath   respjson.Field
+		VolumeID    respjson.Field
+		Overlay     respjson.Field
+		OverlaySize respjson.Field
+		Readonly    respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r VolumeMount) RawJSON() string { return r.JSON.raw }
+func (r *VolumeMount) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// ToParam converts this VolumeMount to a VolumeMountParam.
+//
+// Warning: the fields of the param type will not be present. ToParam should only
+// be used at the last possible moment before sending a request. Test for this with
+// VolumeMountParam.Overrides()
+func (r VolumeMount) ToParam() VolumeMountParam {
+	return param.Override[VolumeMountParam](json.RawMessage(r.RawJSON()))
+}
+
+// The properties MountPath, VolumeID are required.
+type VolumeMountParam struct {
+	// Path where volume is mounted in the guest
+	MountPath string `json:"mount_path" api:"required"`
+	// Volume identifier
+	VolumeID string `json:"volume_id" api:"required"`
+	// Create per-instance overlay for writes (requires readonly=true)
+	Overlay param.Opt[bool] `json:"overlay,omitzero"`
+	// Max overlay size as human-readable string (e.g., "1GB"). Required if
+	// overlay=true.
+	OverlaySize param.Opt[string] `json:"overlay_size,omitzero"`
+	// Whether volume is mounted read-only
+	Readonly param.Opt[bool] `json:"readonly,omitzero"`
+	paramObj
+}
+
+func (r VolumeMountParam) MarshalJSON() (data []byte, err error) {
+	type shadow VolumeMountParam
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *VolumeMountParam) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type InstanceNewParams struct {
+	// OCI image reference
+	Image string `json:"image" api:"required"`
+	// Human-readable name (lowercase letters, digits, and dashes only; cannot start or
+	// end with a dash)
+	Name string `json:"name" api:"required"`
+	// Disk I/O rate limit (e.g., "100MB/s", "500MB/s"). Defaults to proportional share
+	// based on CPU allocation if configured.
+	DiskIoBps param.Opt[string] `json:"disk_io_bps,omitzero"`
+	// Additional memory for hotplug (human-readable format like "3GB", "1G"). Omit to
+	// disable hotplug memory.
+	HotplugSize param.Opt[string] `json:"hotplug_size,omitzero"`
+	// Writable overlay disk size (human-readable format like "10GB", "50G")
+	OverlaySize param.Opt[string] `json:"overlay_size,omitzero"`
+	// Base memory size (human-readable format like "1GB", "512MB", "2G")
+	Size param.Opt[string] `json:"size,omitzero"`
+	// Skip guest-agent installation during boot. When true, the exec and stat APIs
+	// will not work for this instance. The instance will still run, but remote command
+	// execution will be unavailable.
+	SkipGuestAgent param.Opt[bool] `json:"skip_guest_agent,omitzero"`
+	// Skip kernel headers installation during boot for faster startup. When true, DKMS
+	// (Dynamic Kernel Module Support) will not work, preventing compilation of
+	// out-of-tree kernel modules (e.g., NVIDIA vGPU drivers). Recommended for
+	// workloads that don't need kernel module compilation.
+	SkipKernelHeaders param.Opt[bool] `json:"skip_kernel_headers,omitzero"`
+	// Number of virtual CPUs
+	Vcpus param.Opt[int64] `json:"vcpus,omitzero"`
+	// Override image CMD (like docker run <image> <command>). Omit to use image
+	// default.
+	Cmd []string `json:"cmd,omitzero"`
+	// Device IDs or names to attach for GPU/PCI passthrough
+	Devices []string `json:"devices,omitzero"`
+	// Override image entrypoint (like docker run --entrypoint). Omit to use image
+	// default.
+	Entrypoint []string `json:"entrypoint,omitzero"`
+	// Environment variables
+	Env map[string]string `json:"env,omitzero"`
+	// GPU configuration for the instance
+	GPU InstanceNewParamsGPU `json:"gpu,omitzero"`
+	// Hypervisor to use for this instance. Defaults to server configuration.
+	//
+	// Any of "cloud-hypervisor", "qemu", "vz".
+	Hypervisor InstanceNewParamsHypervisor `json:"hypervisor,omitzero"`
+	// User-defined key-value metadata for the instance
+	Metadata map[string]string `json:"metadata,omitzero"`
+	// Network configuration for the instance
+	Network InstanceNewParamsNetwork `json:"network,omitzero"`
+	// Volumes to attach to the instance at creation time
+	Volumes []VolumeMountParam `json:"volumes,omitzero"`
+	paramObj
+}
+
+func (r InstanceNewParams) MarshalJSON() (data []byte, err error) {
+	type shadow InstanceNewParams
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *InstanceNewParams) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// GPU configuration for the instance
+type InstanceNewParamsGPU struct {
+	// vGPU profile name (e.g., "L40S-1Q"). Only used in vGPU mode.
+	Profile param.Opt[string] `json:"profile,omitzero"`
+	paramObj
+}
+
+func (r InstanceNewParamsGPU) MarshalJSON() (data []byte, err error) {
+	type shadow InstanceNewParamsGPU
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *InstanceNewParamsGPU) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// Hypervisor to use for this instance. Defaults to server configuration.
+type InstanceNewParamsHypervisor string
+
+const (
+	InstanceNewParamsHypervisorCloudHypervisor InstanceNewParamsHypervisor = "cloud-hypervisor"
+	InstanceNewParamsHypervisorQemu            InstanceNewParamsHypervisor = "qemu"
+	InstanceNewParamsHypervisorVz              InstanceNewParamsHypervisor = "vz"
+)
+
+// Network configuration for the instance
+type InstanceNewParamsNetwork struct {
+	// Download bandwidth limit (external→VM, e.g., "1Gbps", "125MB/s"). Defaults to
+	// proportional share based on CPU allocation.
+	BandwidthDownload param.Opt[string] `json:"bandwidth_download,omitzero"`
+	// Upload bandwidth limit (VM→external, e.g., "1Gbps", "125MB/s"). Defaults to
+	// proportional share based on CPU allocation.
+	BandwidthUpload param.Opt[string] `json:"bandwidth_upload,omitzero"`
+	// Whether to attach instance to the default network
+	Enabled param.Opt[bool] `json:"enabled,omitzero"`
+	paramObj
+}
+
+func (r InstanceNewParamsNetwork) MarshalJSON() (data []byte, err error) {
+	type shadow InstanceNewParamsNetwork
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *InstanceNewParamsNetwork) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type InstanceListParams struct {
+	// Filter instances by metadata key-value pairs. Uses deepObject style:
+	// ?metadata[team]=backend&metadata[env]=staging Multiple entries are ANDed
+	// together. All specified key-value pairs must match.
+	Metadata map[string]string `query:"metadata,omitzero" json:"-"`
+	// Filter instances by state (e.g., Running, Stopped)
+	//
+	// Any of "Created", "Running", "Paused", "Shutdown", "Stopped", "Standby",
+	// "Unknown".
+	State InstanceListParamsState `query:"state,omitzero" json:"-"`
+	paramObj
+}
+
+// URLQuery serializes [InstanceListParams]'s query parameters as `url.Values`.
+func (r InstanceListParams) URLQuery() (v url.Values, err error) {
+	return apiquery.MarshalWithSettings(r, apiquery.QuerySettings{
+		ArrayFormat:  apiquery.ArrayQueryFormatComma,
+		NestedFormat: apiquery.NestedQueryFormatBrackets,
+	})
+}
+
+// Filter instances by state (e.g., Running, Stopped)
+type InstanceListParamsState string
+
+const (
+	InstanceListParamsStateCreated  InstanceListParamsState = "Created"
+	InstanceListParamsStateRunning  InstanceListParamsState = "Running"
+	InstanceListParamsStatePaused   InstanceListParamsState = "Paused"
+	InstanceListParamsStateShutdown InstanceListParamsState = "Shutdown"
+	InstanceListParamsStateStopped  InstanceListParamsState = "Stopped"
+	InstanceListParamsStateStandby  InstanceListParamsState = "Standby"
+	InstanceListParamsStateUnknown  InstanceListParamsState = "Unknown"
+)
+
+type InstanceLogsParams struct {
+	// Continue streaming new lines after initial output
+	Follow param.Opt[bool] `query:"follow,omitzero" json:"-"`
+	// Number of lines to return from end
+	Tail param.Opt[int64] `query:"tail,omitzero" json:"-"`
+	// Log source to stream:
+	//
+	// - app: Guest application logs (serial console output)
+	// - vmm: Cloud Hypervisor VMM logs (hypervisor stdout+stderr)
+	// - hypeman: Hypeman operations log (actions taken on this instance)
+	//
+	// Any of "app", "vmm", "hypeman".
+	Source InstanceLogsParamsSource `query:"source,omitzero" json:"-"`
+	paramObj
+}
+
+// URLQuery serializes [InstanceLogsParams]'s query parameters as `url.Values`.
+func (r InstanceLogsParams) URLQuery() (v url.Values, err error) {
+	return apiquery.MarshalWithSettings(r, apiquery.QuerySettings{
+		ArrayFormat:  apiquery.ArrayQueryFormatComma,
+		NestedFormat: apiquery.NestedQueryFormatBrackets,
+	})
+}
+
+// Log source to stream:
+//
+// - app: Guest application logs (serial console output)
+// - vmm: Cloud Hypervisor VMM logs (hypervisor stdout+stderr)
+// - hypeman: Hypeman operations log (actions taken on this instance)
+type InstanceLogsParamsSource string
+
+const (
+	InstanceLogsParamsSourceApp     InstanceLogsParamsSource = "app"
+	InstanceLogsParamsSourceVmm     InstanceLogsParamsSource = "vmm"
+	InstanceLogsParamsSourceHypeman InstanceLogsParamsSource = "hypeman"
+)
+
+type InstanceStartParams struct {
+	// Override image CMD for this run. Omit to keep previous value.
+	Cmd []string `json:"cmd,omitzero"`
+	// Override image entrypoint for this run. Omit to keep previous value.
+	Entrypoint []string `json:"entrypoint,omitzero"`
+	paramObj
+}
+
+func (r InstanceStartParams) MarshalJSON() (data []byte, err error) {
+	type shadow InstanceStartParams
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *InstanceStartParams) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type InstanceStatParams struct {
+	// Path to stat in the guest filesystem
+	Path string `query:"path" api:"required" json:"-"`
+	// Follow symbolic links (like stat vs lstat)
+	FollowLinks param.Opt[bool] `query:"follow_links,omitzero" json:"-"`
+	paramObj
+}
+
+// URLQuery serializes [InstanceStatParams]'s query parameters as `url.Values`.
+func (r InstanceStatParams) URLQuery() (v url.Values, err error) {
+	return apiquery.MarshalWithSettings(r, apiquery.QuerySettings{
+		ArrayFormat:  apiquery.ArrayQueryFormatComma,
+		NestedFormat: apiquery.NestedQueryFormatBrackets,
+	})
+}
diff --git a/sdks/go/instance_test.go b/sdks/go/instance_test.go
new file mode 100644
index 00000000..4434e31f
--- /dev/null
+++ b/sdks/go/instance_test.go
@@ -0,0 +1,277 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman_test
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/internal/testutil"
+	"github.com/kernel/hypeman-go/option"
+)
+
+func TestInstanceNewWithOptionalParams(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Instances.New(context.TODO(), hypeman.InstanceNewParams{
+		Image:      "docker.io/library/alpine:latest",
+		Name:       "my-workload-1",
+		Cmd:        []string{"echo", "hello"},
+		Devices:    []string{"l4-gpu"},
+		DiskIoBps:  hypeman.String("100MB/s"),
+		Entrypoint: []string{"/bin/sh", "-c"},
+		Env: map[string]string{
+			"PORT":     "3000",
+			"NODE_ENV": "production",
+		},
+		GPU: hypeman.InstanceNewParamsGPU{
+			Profile: hypeman.String("L40S-1Q"),
+		},
+		HotplugSize: hypeman.String("2GB"),
+		Hypervisor:  hypeman.InstanceNewParamsHypervisorCloudHypervisor,
+		Metadata: map[string]string{
+			"team":    "backend",
+			"purpose": "staging",
+		},
+		Network: hypeman.InstanceNewParamsNetwork{
+			BandwidthDownload: hypeman.String("1Gbps"),
+			BandwidthUpload:   hypeman.String("1Gbps"),
+			Enabled:           hypeman.Bool(true),
+		},
+		OverlaySize:       hypeman.String("20GB"),
+		Size:              hypeman.String("2GB"),
+		SkipGuestAgent:    hypeman.Bool(false),
+		SkipKernelHeaders: hypeman.Bool(true),
+		Vcpus:             hypeman.Int(2),
+		Volumes: []hypeman.VolumeMountParam{{
+			MountPath:   "/mnt/data",
+			VolumeID:    "vol-abc123",
+			Overlay:     hypeman.Bool(true),
+			OverlaySize: hypeman.String("1GB"),
+			Readonly:    hypeman.Bool(true),
+		}},
+	})
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestInstanceListWithOptionalParams(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Instances.List(context.TODO(), hypeman.InstanceListParams{
+		Metadata: map[string]string{
+			"foo": "string",
+		},
+		State: hypeman.InstanceListParamsStateCreated,
+	})
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestInstanceDelete(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	err := client.Instances.Delete(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestInstanceGet(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Instances.Get(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestInstanceRestore(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Instances.Restore(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestInstanceStandby(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Instances.Standby(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestInstanceStartWithOptionalParams(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Instances.Start(
+		context.TODO(),
+		"id",
+		hypeman.InstanceStartParams{
+			Cmd:        []string{"string"},
+			Entrypoint: []string{"string"},
+		},
+	)
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestInstanceStatWithOptionalParams(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Instances.Stat(
+		context.TODO(),
+		"id",
+		hypeman.InstanceStatParams{
+			Path:        "path",
+			FollowLinks: hypeman.Bool(true),
+		},
+	)
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestInstanceStop(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Instances.Stop(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
diff --git a/sdks/go/instancevolume.go b/sdks/go/instancevolume.go
new file mode 100644
index 00000000..2bc78d5e
--- /dev/null
+++ b/sdks/go/instancevolume.go
@@ -0,0 +1,89 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
+
+	"github.com/kernel/hypeman-go/internal/apijson"
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/kernel/hypeman-go/packages/param"
+)
+
+// InstanceVolumeService contains methods and other services that help with
+// interacting with the hypeman API.
+//
+// Note, unlike clients, this service does not read variables from the environment
+// automatically. You should not instantiate this service directly, and instead use
+// the [NewInstanceVolumeService] method instead.
+type InstanceVolumeService struct {
+	Options []option.RequestOption
+}
+
+// NewInstanceVolumeService generates a new service that applies the given options
+// to each request. These options are applied after the parent client's options (if
+// there is one), and before any request-specific options.
+func NewInstanceVolumeService(opts ...option.RequestOption) (r InstanceVolumeService) {
+	r = InstanceVolumeService{}
+	r.Options = opts
+	return
+}
+
+// Attach volume to instance
+func (r *InstanceVolumeService) Attach(ctx context.Context, volumeID string, params InstanceVolumeAttachParams, opts ...option.RequestOption) (res *Instance, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if params.ID == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	if volumeID == "" {
+		err = errors.New("missing required volumeId parameter")
+		return
+	}
+	path := fmt.Sprintf("instances/%s/volumes/%s", params.ID, volumeID)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, params, &res, opts...)
+	return
+}
+
+// Detach volume from instance
+func (r *InstanceVolumeService) Detach(ctx context.Context, volumeID string, body InstanceVolumeDetachParams, opts ...option.RequestOption) (res *Instance, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if body.ID == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	if volumeID == "" {
+		err = errors.New("missing required volumeId parameter")
+		return
+	}
+	path := fmt.Sprintf("instances/%s/volumes/%s", body.ID, volumeID)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodDelete, path, nil, &res, opts...)
+	return
+}
+
+type InstanceVolumeAttachParams struct {
+	ID string `path:"id" api:"required" json:"-"`
+	// Path where volume should be mounted
+	MountPath string `json:"mount_path" api:"required"`
+	// Mount as read-only
+	Readonly param.Opt[bool] `json:"readonly,omitzero"`
+	paramObj
+}
+
+func (r InstanceVolumeAttachParams) MarshalJSON() (data []byte, err error) {
+	type shadow InstanceVolumeAttachParams
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *InstanceVolumeAttachParams) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type InstanceVolumeDetachParams struct {
+	ID string `path:"id" api:"required" json:"-"`
+	paramObj
+}
diff --git a/sdks/go/instancevolume_test.go b/sdks/go/instancevolume_test.go
new file mode 100644
index 00000000..30ce7d0e
--- /dev/null
+++ b/sdks/go/instancevolume_test.go
@@ -0,0 +1,74 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman_test
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/internal/testutil"
+	"github.com/kernel/hypeman-go/option"
+)
+
+func TestInstanceVolumeAttachWithOptionalParams(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Instances.Volumes.Attach(
+		context.TODO(),
+		"volumeId",
+		hypeman.InstanceVolumeAttachParams{
+			ID:        "id",
+			MountPath: "/mnt/data",
+			Readonly:  hypeman.Bool(true),
+		},
+	)
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestInstanceVolumeDetach(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Instances.Volumes.Detach(
+		context.TODO(),
+		"volumeId",
+		hypeman.InstanceVolumeDetachParams{
+			ID: "id",
+		},
+	)
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
diff --git a/sdks/go/internal/apierror/apierror.go b/sdks/go/internal/apierror/apierror.go
new file mode 100644
index 00000000..aa8b694e
--- /dev/null
+++ b/sdks/go/internal/apierror/apierror.go
@@ -0,0 +1,50 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package apierror
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httputil"
+
+	"github.com/kernel/hypeman-go/internal/apijson"
+	"github.com/kernel/hypeman-go/packages/respjson"
+)
+
+// Error represents an error that originates from the API, i.e. when a request is
+// made and the API returns a response with a HTTP status code. Other errors are
+// not wrapped by this SDK.
+type Error struct {
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+	StatusCode int
+	Request    *http.Request
+	Response   *http.Response
+}
+
+// Returns the unmodified JSON received from the API
+func (r Error) RawJSON() string { return r.JSON.raw }
+func (r *Error) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+func (r *Error) Error() string {
+	// Attempt to re-populate the response body
+	return fmt.Sprintf("%s %q: %d %s %s", r.Request.Method, r.Request.URL, r.Response.StatusCode, http.StatusText(r.Response.StatusCode), r.JSON.raw)
+}
+
+func (r *Error) DumpRequest(body bool) []byte {
+	if r.Request.GetBody != nil {
+		r.Request.Body, _ = r.Request.GetBody()
+	}
+	out, _ := httputil.DumpRequestOut(r.Request, body)
+	return out
+}
+
+func (r *Error) DumpResponse(body bool) []byte {
+	out, _ := httputil.DumpResponse(r.Response, body)
+	return out
+}
diff --git a/sdks/go/internal/apiform/encoder.go b/sdks/go/internal/apiform/encoder.go
new file mode 100644
index 00000000..a2f1516c
--- /dev/null
+++ b/sdks/go/internal/apiform/encoder.go
@@ -0,0 +1,473 @@
+package apiform
+
+import (
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/textproto"
+	"path"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/kernel/hypeman-go/packages/param"
+)
+
+var encoders sync.Map // map[encoderEntry]encoderFunc
+
+func Marshal(value any, writer *multipart.Writer) error {
+	e := &encoder{
+		dateFormat: time.RFC3339,
+		arrayFmt:   "comma",
+	}
+	return e.marshal(value, writer)
+}
+
+func MarshalRoot(value any, writer *multipart.Writer) error {
+	e := &encoder{
+		root:       true,
+		dateFormat: time.RFC3339,
+		arrayFmt:   "comma",
+	}
+	return e.marshal(value, writer)
+}
+
+func MarshalWithSettings(value any, writer *multipart.Writer, arrayFormat string) error {
+	e := &encoder{
+		arrayFmt:   arrayFormat,
+		dateFormat: time.RFC3339,
+	}
+	return e.marshal(value, writer)
+}
+
+type encoder struct {
+	arrayFmt   string
+	dateFormat string
+	root       bool
+}
+
+type encoderFunc func(key string, value reflect.Value, writer *multipart.Writer) error
+
+type encoderField struct {
+	tag parsedStructTag
+	fn  encoderFunc
+	idx []int
+}
+
+type encoderEntry struct {
+	reflect.Type
+	dateFormat string
+	arrayFmt   string
+	root       bool
+}
+
+func (e *encoder) marshal(value any, writer *multipart.Writer) error {
+	val := reflect.ValueOf(value)
+	if !val.IsValid() {
+		return nil
+	}
+	typ := val.Type()
+	enc := e.typeEncoder(typ)
+	return enc("", val, writer)
+}
+
+func (e *encoder) typeEncoder(t reflect.Type) encoderFunc {
+	entry := encoderEntry{
+		Type:       t,
+		dateFormat: e.dateFormat,
+		arrayFmt:   e.arrayFmt,
+		root:       e.root,
+	}
+
+	if fi, ok := encoders.Load(entry); ok {
+		return fi.(encoderFunc)
+	}
+
+	// To deal with recursive types, populate the map with an
+	// indirect func before we build it. This type waits on the
+	// real func (f) to be ready and then calls it. This indirect
+	// func is only used for recursive types.
+	var (
+		wg sync.WaitGroup
+		f  encoderFunc
+	)
+	wg.Add(1)
+	fi, loaded := encoders.LoadOrStore(entry, encoderFunc(func(key string, v reflect.Value, writer *multipart.Writer) error {
+		wg.Wait()
+		return f(key, v, writer)
+	}))
+	if loaded {
+		return fi.(encoderFunc)
+	}
+
+	// Compute the real encoder and replace the indirect func with it.
+	f = e.newTypeEncoder(t)
+	wg.Done()
+	encoders.Store(entry, f)
+	return f
+}
+
+func (e *encoder) newTypeEncoder(t reflect.Type) encoderFunc {
+	if t.ConvertibleTo(reflect.TypeOf(time.Time{})) {
+		return e.newTimeTypeEncoder()
+	}
+	if t.Implements(reflect.TypeOf((*io.Reader)(nil)).Elem()) {
+		return e.newReaderTypeEncoder()
+	}
+	e.root = false
+	switch t.Kind() {
+	case reflect.Pointer:
+		inner := t.Elem()
+
+		innerEncoder := e.typeEncoder(inner)
+		return func(key string, v reflect.Value, writer *multipart.Writer) error {
+			if !v.IsValid() || v.IsNil() {
+				return nil
+			}
+			return innerEncoder(key, v.Elem(), writer)
+		}
+	case reflect.Struct:
+		return e.newStructTypeEncoder(t)
+	case reflect.Slice, reflect.Array:
+		return e.newArrayTypeEncoder(t)
+	case reflect.Map:
+		return e.newMapEncoder(t)
+	case reflect.Interface:
+		return e.newInterfaceEncoder()
+	default:
+		return e.newPrimitiveTypeEncoder(t)
+	}
+}
+
+func (e *encoder) newPrimitiveTypeEncoder(t reflect.Type) encoderFunc {
+	switch t.Kind() {
+	// Note that we could use `gjson` to encode these types but it would complicate our
+	// code more and this current code shouldn't cause any issues
+	case reflect.String:
+		return func(key string, v reflect.Value, writer *multipart.Writer) error {
+			return writer.WriteField(key, v.String())
+		}
+	case reflect.Bool:
+		return func(key string, v reflect.Value, writer *multipart.Writer) error {
+			if v.Bool() {
+				return writer.WriteField(key, "true")
+			}
+			return writer.WriteField(key, "false")
+		}
+	case reflect.Int, reflect.Int16, reflect.Int32, reflect.Int64:
+		return func(key string, v reflect.Value, writer *multipart.Writer) error {
+			return writer.WriteField(key, strconv.FormatInt(v.Int(), 10))
+		}
+	case reflect.Uint, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return func(key string, v reflect.Value, writer *multipart.Writer) error {
+			return writer.WriteField(key, strconv.FormatUint(v.Uint(), 10))
+		}
+	case reflect.Float32:
+		return func(key string, v reflect.Value, writer *multipart.Writer) error {
+			return writer.WriteField(key, strconv.FormatFloat(v.Float(), 'f', -1, 32))
+		}
+	case reflect.Float64:
+		return func(key string, v reflect.Value, writer *multipart.Writer) error {
+			return writer.WriteField(key, strconv.FormatFloat(v.Float(), 'f', -1, 64))
+		}
+	default:
+		return func(key string, v reflect.Value, writer *multipart.Writer) error {
+			return fmt.Errorf("unknown type received at primitive encoder: %s", t.String())
+		}
+	}
+}
+
+func (e *encoder) newArrayTypeEncoder(t reflect.Type) encoderFunc {
+	itemEncoder := e.typeEncoder(t.Elem())
+	keyFn := e.arrayKeyEncoder()
+	return func(key string, v reflect.Value, writer *multipart.Writer) error {
+		if keyFn == nil {
+			return fmt.Errorf("apiform: unsupported array format")
+		}
+		for i := 0; i < v.Len(); i++ {
+			err := itemEncoder(keyFn(key, i), v.Index(i), writer)
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+}
+
+func (e *encoder) newStructTypeEncoder(t reflect.Type) encoderFunc {
+	if t.Implements(reflect.TypeOf((*param.Optional)(nil)).Elem()) {
+		return e.newRichFieldTypeEncoder(t)
+	}
+
+	for i := 0; i < t.NumField(); i++ {
+		if t.Field(i).Type == paramUnionType && t.Field(i).Anonymous {
+			return e.newStructUnionTypeEncoder(t)
+		}
+	}
+
+	encoderFields := []encoderField{}
+	extraEncoder := (*encoderField)(nil)
+
+	// This helper allows us to recursively collect field encoders into a flat
+	// array. The parameter `index` keeps track of the access patterns necessary
+	// to get to some field.
+	var collectEncoderFields func(r reflect.Type, index []int)
+	collectEncoderFields = func(r reflect.Type, index []int) {
+		for i := 0; i < r.NumField(); i++ {
+			idx := append(index, i)
+			field := t.FieldByIndex(idx)
+			if !field.IsExported() {
+				continue
+			}
+			// If this is an embedded struct, traverse one level deeper to extract
+			// the field and get their encoders as well.
+			if field.Anonymous {
+				collectEncoderFields(field.Type, idx)
+				continue
+			}
+			// If json tag is not present, then we skip, which is intentionally
+			// different behavior from the stdlib.
+			ptag, ok := parseFormStructTag(field)
+			if !ok {
+				continue
+			}
+			// We only want to support unexported field if they're tagged with
+			// `extras` because that field shouldn't be part of the public API. We
+			// also want to only keep the top level extras
+			if ptag.extras && len(index) == 0 {
+				extraEncoder = &encoderField{ptag, e.typeEncoder(field.Type.Elem()), idx}
+				continue
+			}
+			if ptag.name == "-" || ptag.name == "" {
+				continue
+			}
+
+			dateFormat, ok := parseFormatStructTag(field)
+			oldFormat := e.dateFormat
+			if ok {
+				switch dateFormat {
+				case "date-time":
+					e.dateFormat = time.RFC3339
+				case "date":
+					e.dateFormat = "2006-01-02"
+				}
+			}
+
+			var encoderFn encoderFunc
+			if ptag.omitzero {
+				typeEncoderFn := e.typeEncoder(field.Type)
+				encoderFn = func(key string, value reflect.Value, writer *multipart.Writer) error {
+					if value.IsZero() {
+						return nil
+					}
+					return typeEncoderFn(key, value, writer)
+				}
+			} else {
+				encoderFn = e.typeEncoder(field.Type)
+			}
+			encoderFields = append(encoderFields, encoderField{ptag, encoderFn, idx})
+			e.dateFormat = oldFormat
+		}
+	}
+	collectEncoderFields(t, []int{})
+
+	// Ensure deterministic output by sorting by lexicographic order
+	sort.Slice(encoderFields, func(i, j int) bool {
+		return encoderFields[i].tag.name < encoderFields[j].tag.name
+	})
+
+	return func(key string, value reflect.Value, writer *multipart.Writer) error {
+		keyFn := e.objKeyEncoder(key)
+		for _, ef := range encoderFields {
+			field := value.FieldByIndex(ef.idx)
+			err := ef.fn(keyFn(ef.tag.name), field, writer)
+			if err != nil {
+				return err
+			}
+		}
+
+		if extraEncoder != nil {
+			err := e.encodeMapEntries(key, value.FieldByIndex(extraEncoder.idx), writer)
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}
+}
+
+var paramUnionType = reflect.TypeOf((*param.APIUnion)(nil)).Elem()
+
+func (e *encoder) newStructUnionTypeEncoder(t reflect.Type) encoderFunc {
+	var fieldEncoders []encoderFunc
+	for i := 0; i < t.NumField(); i++ {
+		field := t.Field(i)
+		if field.Type == paramUnionType && field.Anonymous {
+			fieldEncoders = append(fieldEncoders, nil)
+			continue
+		}
+		fieldEncoders = append(fieldEncoders, e.typeEncoder(field.Type))
+	}
+
+	return func(key string, value reflect.Value, writer *multipart.Writer) error {
+		for i := 0; i < t.NumField(); i++ {
+			if value.Field(i).Type() == paramUnionType {
+				continue
+			}
+			if !value.Field(i).IsZero() {
+				return fieldEncoders[i](key, value.Field(i), writer)
+			}
+		}
+		return fmt.Errorf("apiform: union %s has no field set", t.String())
+	}
+}
+
+func (e *encoder) newTimeTypeEncoder() encoderFunc {
+	format := e.dateFormat
+	return func(key string, value reflect.Value, writer *multipart.Writer) error {
+		return writer.WriteField(key, value.Convert(reflect.TypeOf(time.Time{})).Interface().(time.Time).Format(format))
+	}
+}
+
+func (e encoder) newInterfaceEncoder() encoderFunc {
+	return func(key string, value reflect.Value, writer *multipart.Writer) error {
+		value = value.Elem()
+		if !value.IsValid() {
+			return nil
+		}
+		return e.typeEncoder(value.Type())(key, value, writer)
+	}
+}
+
+var quoteEscaper = strings.NewReplacer("\\", "\\\\", `"`, "\\\"")
+
+func escapeQuotes(s string) string {
+	return quoteEscaper.Replace(s)
+}
+
+func (e *encoder) newReaderTypeEncoder() encoderFunc {
+	return func(key string, value reflect.Value, writer *multipart.Writer) error {
+		reader, ok := value.Convert(reflect.TypeOf((*io.Reader)(nil)).Elem()).Interface().(io.Reader)
+		if !ok {
+			return nil
+		}
+		filename := "anonymous_file"
+		contentType := "application/octet-stream"
+		if named, ok := reader.(interface{ Filename() string }); ok {
+			filename = named.Filename()
+		} else if named, ok := reader.(interface{ Name() string }); ok {
+			filename = path.Base(named.Name())
+		}
+		if typed, ok := reader.(interface{ ContentType() string }); ok {
+			contentType = typed.ContentType()
+		}
+
+		// Below is taken almost 1-for-1 from [multipart.CreateFormFile]
+		h := make(textproto.MIMEHeader)
+		h.Set("Content-Disposition", fmt.Sprintf(`form-data; name="%s"; filename="%s"`, escapeQuotes(key), escapeQuotes(filename)))
+		h.Set("Content-Type", contentType)
+		filewriter, err := writer.CreatePart(h)
+		if err != nil {
+			return err
+		}
+		_, err = io.Copy(filewriter, reader)
+		return err
+	}
+}
+
+func (e encoder) arrayKeyEncoder() func(string, int) string {
+	var keyFn func(string, int) string
+	switch e.arrayFmt {
+	case "comma", "repeat":
+		keyFn = func(k string, _ int) string { return k }
+	case "brackets":
+		keyFn = func(key string, _ int) string { return key + "[]" }
+	case "indices:dots":
+		keyFn = func(k string, i int) string {
+			if k == "" {
+				return strconv.Itoa(i)
+			}
+			return k + "." + strconv.Itoa(i)
+		}
+	case "indices:brackets":
+		keyFn = func(k string, i int) string {
+			if k == "" {
+				return strconv.Itoa(i)
+			}
+			return k + "[" + strconv.Itoa(i) + "]"
+		}
+	}
+	return keyFn
+}
+
+func (e encoder) objKeyEncoder(parent string) func(string) string {
+	if parent == "" {
+		return func(child string) string { return child }
+	}
+	switch e.arrayFmt {
+	case "brackets":
+		return func(child string) string { return parent + "[" + child + "]" }
+	default:
+		return func(child string) string { return parent + "." + child }
+	}
+}
+
+// Given a []byte of json (may either be an empty object or an object that already contains entries)
+// encode all of the entries in the map to the json byte array.
+func (e *encoder) encodeMapEntries(key string, v reflect.Value, writer *multipart.Writer) error {
+	type mapPair struct {
+		key   string
+		value reflect.Value
+	}
+
+	pairs := []mapPair{}
+
+	iter := v.MapRange()
+	for iter.Next() {
+		if iter.Key().Type().Kind() == reflect.String {
+			pairs = append(pairs, mapPair{key: iter.Key().String(), value: iter.Value()})
+		} else {
+			return fmt.Errorf("cannot encode a map with a non string key")
+		}
+	}
+
+	// Ensure deterministic output
+	sort.Slice(pairs, func(i, j int) bool {
+		return pairs[i].key < pairs[j].key
+	})
+
+	elementEncoder := e.typeEncoder(v.Type().Elem())
+	keyFn := e.objKeyEncoder(key)
+	for _, p := range pairs {
+		err := elementEncoder(keyFn(p.key), p.value, writer)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (e *encoder) newMapEncoder(_ reflect.Type) encoderFunc {
+	return func(key string, value reflect.Value, writer *multipart.Writer) error {
+		return e.encodeMapEntries(key, value, writer)
+	}
+}
+
+func WriteExtras(writer *multipart.Writer, extras map[string]any) (err error) {
+	for k, v := range extras {
+		str, ok := v.(string)
+		if !ok {
+			break
+		}
+		err = writer.WriteField(k, str)
+		if err != nil {
+			break
+		}
+	}
+	return
+}
diff --git a/sdks/go/internal/apiform/form.go b/sdks/go/internal/apiform/form.go
new file mode 100644
index 00000000..5445116e
--- /dev/null
+++ b/sdks/go/internal/apiform/form.go
@@ -0,0 +1,5 @@
+package apiform
+
+type Marshaler interface {
+	MarshalMultipart() ([]byte, string, error)
+}
diff --git a/sdks/go/internal/apiform/form_test.go b/sdks/go/internal/apiform/form_test.go
new file mode 100644
index 00000000..2884602a
--- /dev/null
+++ b/sdks/go/internal/apiform/form_test.go
@@ -0,0 +1,609 @@
+package apiform
+
+import (
+	"bytes"
+	"github.com/kernel/hypeman-go/packages/param"
+	"io"
+	"mime/multipart"
+	"strings"
+	"testing"
+	"time"
+)
+
+func P[T any](v T) *T { return &v }
+
+type Primitives struct {
+	A bool    `form:"a"`
+	B int     `form:"b"`
+	C uint    `form:"c"`
+	D float64 `form:"d"`
+	E float32 `form:"e"`
+	F []int   `form:"f"`
+}
+
+// These aliases are necessary to bypass the cache.
+// This only relevant during testing.
+type int_ int
+type PrimitivesBrackets struct {
+	F []int_ `form:"f"`
+}
+
+type PrimitivePointers struct {
+	A *bool    `form:"a"`
+	B *int     `form:"b"`
+	C *uint    `form:"c"`
+	D *float64 `form:"d"`
+	E *float32 `form:"e"`
+	F *[]int   `form:"f"`
+}
+
+type Slices struct {
+	Slice []Primitives `form:"slices"`
+}
+
+type DateTime struct {
+	Date     time.Time `form:"date" format:"date"`
+	DateTime time.Time `form:"date-time" format:"date-time"`
+}
+
+type AdditionalProperties struct {
+	A      bool           `form:"a"`
+	Extras map[string]any `form:"-" api:"extrafields"`
+}
+
+type TypedAdditionalProperties struct {
+	A      bool           `form:"a"`
+	Extras map[string]int `form:"-" api:"extrafields"`
+}
+
+type EmbeddedStructs struct {
+	AdditionalProperties
+	A      *int           `form:"number2"`
+	Extras map[string]any `form:"-" api:"extrafields"`
+}
+
+type Recursive struct {
+	Name  string     `form:"name"`
+	Child *Recursive `form:"child"`
+}
+
+type UnknownStruct struct {
+	Unknown any `form:"unknown"`
+}
+
+type UnionStruct struct {
+	Union Union `form:"union" format:"date"`
+}
+
+type Union interface {
+	union()
+}
+
+type UnionInteger int64
+
+func (UnionInteger) union() {}
+
+type UnionStructA struct {
+	Type string `form:"type"`
+	A    string `form:"a"`
+	B    string `form:"b"`
+}
+
+func (UnionStructA) union() {}
+
+type UnionStructB struct {
+	Type string `form:"type"`
+	A    string `form:"a"`
+}
+
+func (UnionStructB) union() {}
+
+type UnionTime time.Time
+
+func (UnionTime) union() {}
+
+type ReaderStruct struct {
+	File io.Reader `form:"file"`
+}
+
+type NamedEnum string
+
+const NamedEnumFoo NamedEnum = "foo"
+
+type StructUnionWrapper struct {
+	Union StructUnion `form:"union"`
+}
+
+type StructUnion struct {
+	OfInt    param.Opt[int64]     `form:",omitzero,inline"`
+	OfString param.Opt[string]    `form:",omitzero,inline"`
+	OfEnum   param.Opt[NamedEnum] `form:",omitzero,inline"`
+	OfA      UnionStructA         `form:",omitzero,inline"`
+	OfB      UnionStructB         `form:",omitzero,inline"`
+	param.APIUnion
+}
+
+type MultipartMarshalerParent struct {
+	Middle MultipartMarshalerMiddleNext `form:"middle"`
+}
+
+type MultipartMarshalerMiddleNext struct {
+	MiddleNext MultipartMarshalerMiddle `form:"middleNext"`
+}
+
+type MultipartMarshalerMiddle struct {
+	Child int `form:"child"`
+}
+
+var tests = map[string]struct {
+	buf string
+	val any
+}{
+	"file": {
+		buf: `--xxx
+Content-Disposition: form-data; name="file"; filename="anonymous_file"
+Content-Type: application/octet-stream
+
+some file contents...
+--xxx--
+`,
+		val: ReaderStruct{
+			File: io.Reader(bytes.NewBuffer([]byte("some file contents..."))),
+		},
+	},
+	"map_string": {
+		`--xxx
+Content-Disposition: form-data; name="foo"
+
+bar
+--xxx--
+`,
+		map[string]string{"foo": "bar"},
+	},
+
+	"map_interface": {
+		`--xxx
+Content-Disposition: form-data; name="a"
+
+1
+--xxx
+Content-Disposition: form-data; name="b"
+
+str
+--xxx
+Content-Disposition: form-data; name="c"
+
+false
+--xxx--
+`,
+		map[string]any{"a": float64(1), "b": "str", "c": false},
+	},
+
+	"primitive_struct": {
+		`--xxx
+Content-Disposition: form-data; name="a"
+
+false
+--xxx
+Content-Disposition: form-data; name="b"
+
+237628372683
+--xxx
+Content-Disposition: form-data; name="c"
+
+654
+--xxx
+Content-Disposition: form-data; name="d"
+
+9999.43
+--xxx
+Content-Disposition: form-data; name="e"
+
+43.76
+--xxx
+Content-Disposition: form-data; name="f.0"
+
+1
+--xxx
+Content-Disposition: form-data; name="f.1"
+
+2
+--xxx
+Content-Disposition: form-data; name="f.2"
+
+3
+--xxx
+Content-Disposition: form-data; name="f.3"
+
+4
+--xxx--
+`,
+		Primitives{A: false, B: 237628372683, C: uint(654), D: 9999.43, E: 43.76, F: []int{1, 2, 3, 4}},
+	},
+	"primitive_struct,brackets": {
+		`--xxx
+Content-Disposition: form-data; name="f[]"
+
+1
+--xxx
+Content-Disposition: form-data; name="f[]"
+
+2
+--xxx
+Content-Disposition: form-data; name="f[]"
+
+3
+--xxx
+Content-Disposition: form-data; name="f[]"
+
+4
+--xxx--
+`,
+		PrimitivesBrackets{F: []int_{1, 2, 3, 4}},
+	},
+
+	"slices": {
+		`--xxx
+Content-Disposition: form-data; name="slices.0.a"
+
+false
+--xxx
+Content-Disposition: form-data; name="slices.0.b"
+
+237628372683
+--xxx
+Content-Disposition: form-data; name="slices.0.c"
+
+654
+--xxx
+Content-Disposition: form-data; name="slices.0.d"
+
+9999.43
+--xxx
+Content-Disposition: form-data; name="slices.0.e"
+
+43.76
+--xxx
+Content-Disposition: form-data; name="slices.0.f.0"
+
+1
+--xxx
+Content-Disposition: form-data; name="slices.0.f.1"
+
+2
+--xxx
+Content-Disposition: form-data; name="slices.0.f.2"
+
+3
+--xxx
+Content-Disposition: form-data; name="slices.0.f.3"
+
+4
+--xxx--
+`,
+		Slices{
+			Slice: []Primitives{{A: false, B: 237628372683, C: uint(654), D: 9999.43, E: 43.76, F: []int{1, 2, 3, 4}}},
+		},
+	},
+	"primitive_pointer_struct": {
+		`--xxx
+Content-Disposition: form-data; name="a"
+
+false
+--xxx
+Content-Disposition: form-data; name="b"
+
+237628372683
+--xxx
+Content-Disposition: form-data; name="c"
+
+654
+--xxx
+Content-Disposition: form-data; name="d"
+
+9999.43
+--xxx
+Content-Disposition: form-data; name="e"
+
+43.76
+--xxx
+Content-Disposition: form-data; name="f.0"
+
+1
+--xxx
+Content-Disposition: form-data; name="f.1"
+
+2
+--xxx
+Content-Disposition: form-data; name="f.2"
+
+3
+--xxx
+Content-Disposition: form-data; name="f.3"
+
+4
+--xxx
+Content-Disposition: form-data; name="f.4"
+
+5
+--xxx--
+`,
+		PrimitivePointers{
+			A: P(false),
+			B: P(237628372683),
+			C: P(uint(654)),
+			D: P(9999.43),
+			E: P(float32(43.76)),
+			F: &[]int{1, 2, 3, 4, 5},
+		},
+	},
+
+	"datetime_struct": {
+		`--xxx
+Content-Disposition: form-data; name="date"
+
+2006-01-02
+--xxx
+Content-Disposition: form-data; name="date-time"
+
+2006-01-02T15:04:05Z
+--xxx--
+`,
+		DateTime{
+			Date:     time.Date(2006, time.January, 2, 0, 0, 0, 0, time.UTC),
+			DateTime: time.Date(2006, time.January, 2, 15, 4, 5, 0, time.UTC),
+		},
+	},
+
+	"additional_properties": {
+		`--xxx
+Content-Disposition: form-data; name="a"
+
+true
+--xxx
+Content-Disposition: form-data; name="bar"
+
+value
+--xxx
+Content-Disposition: form-data; name="foo"
+
+true
+--xxx--
+`,
+		AdditionalProperties{
+			A: true,
+			Extras: map[string]any{
+				"bar": "value",
+				"foo": true,
+			},
+		},
+	},
+	"recursive_struct,brackets": {
+		`--xxx
+Content-Disposition: form-data; name="child[name]"
+
+Alex
+--xxx
+Content-Disposition: form-data; name="name"
+
+Robert
+--xxx--
+`,
+		Recursive{Name: "Robert", Child: &Recursive{Name: "Alex"}},
+	},
+
+	"recursive_struct": {
+		`--xxx
+Content-Disposition: form-data; name="child.name"
+
+Alex
+--xxx
+Content-Disposition: form-data; name="name"
+
+Robert
+--xxx--
+`,
+		Recursive{Name: "Robert", Child: &Recursive{Name: "Alex"}},
+	},
+
+	"unknown_struct_number": {
+		`--xxx
+Content-Disposition: form-data; name="unknown"
+
+12
+--xxx--
+`,
+		UnknownStruct{
+			Unknown: 12.,
+		},
+	},
+
+	"unknown_struct_map": {
+		`--xxx
+Content-Disposition: form-data; name="unknown.foo"
+
+bar
+--xxx--
+`,
+		UnknownStruct{
+			Unknown: map[string]any{
+				"foo": "bar",
+			},
+		},
+	},
+
+	"struct_union_integer": {
+		`--xxx
+Content-Disposition: form-data; name="union"
+
+12
+--xxx--
+`,
+		StructUnionWrapper{
+			Union: StructUnion{OfInt: param.NewOpt[int64](12)},
+		},
+	},
+
+	"union_integer": {
+		`--xxx
+Content-Disposition: form-data; name="union"
+
+12
+--xxx--
+`,
+		UnionStruct{
+			Union: UnionInteger(12),
+		},
+	},
+
+	"struct_union_struct_discriminated_a": {
+		`--xxx
+Content-Disposition: form-data; name="union.a"
+
+foo
+--xxx
+Content-Disposition: form-data; name="union.b"
+
+bar
+--xxx
+Content-Disposition: form-data; name="union.type"
+
+typeA
+--xxx--
+`,
+		StructUnionWrapper{
+			Union: StructUnion{OfA: UnionStructA{
+				Type: "typeA",
+				A:    "foo",
+				B:    "bar",
+			}},
+		},
+	},
+
+	"union_struct_discriminated_a": {
+		`--xxx
+Content-Disposition: form-data; name="union.a"
+
+foo
+--xxx
+Content-Disposition: form-data; name="union.b"
+
+bar
+--xxx
+Content-Disposition: form-data; name="union.type"
+
+typeA
+--xxx--
+`,
+
+		UnionStruct{
+			Union: UnionStructA{
+				Type: "typeA",
+				A:    "foo",
+				B:    "bar",
+			},
+		},
+	},
+
+	"struct_union_struct_discriminated_b": {
+		`--xxx
+Content-Disposition: form-data; name="union.a"
+
+foo
+--xxx
+Content-Disposition: form-data; name="union.type"
+
+typeB
+--xxx--
+`,
+		StructUnionWrapper{
+			Union: StructUnion{OfB: UnionStructB{
+				Type: "typeB",
+				A:    "foo",
+			}},
+		},
+	},
+
+	"union_struct_discriminated_b": {
+		`--xxx
+Content-Disposition: form-data; name="union.a"
+
+foo
+--xxx
+Content-Disposition: form-data; name="union.type"
+
+typeB
+--xxx--
+`,
+		UnionStruct{
+			Union: UnionStructB{
+				Type: "typeB",
+				A:    "foo",
+			},
+		},
+	},
+
+	"union_struct_time": {
+		`--xxx
+Content-Disposition: form-data; name="union"
+
+2010-05-23
+--xxx--
+`,
+		UnionStruct{
+			Union: UnionTime(time.Date(2010, 05, 23, 0, 0, 0, 0, time.UTC)),
+		},
+	},
+	"deeply-nested-struct,brackets": {
+		`--xxx
+Content-Disposition: form-data; name="middle[middleNext][child]"
+
+10
+--xxx--
+`,
+		MultipartMarshalerParent{
+			Middle: MultipartMarshalerMiddleNext{
+				MiddleNext: MultipartMarshalerMiddle{
+					Child: 10,
+				},
+			},
+		},
+	},
+	"deeply-nested-map,brackets": {
+		`--xxx
+Content-Disposition: form-data; name="middle[middleNext][child]"
+
+10
+--xxx--
+`,
+		map[string]any{"middle": map[string]any{"middleNext": map[string]any{"child": 10}}},
+	},
+}
+
+func TestEncode(t *testing.T) {
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			buf := bytes.NewBuffer(nil)
+			writer := multipart.NewWriter(buf)
+			writer.SetBoundary("xxx")
+
+			var arrayFmt string = "indices:dots"
+			if tags := strings.Split(name, ","); len(tags) > 1 {
+				arrayFmt = tags[1]
+			}
+
+			err := MarshalWithSettings(test.val, writer, arrayFmt)
+			if err != nil {
+				t.Errorf("serialization of %v failed with error %v", test.val, err)
+			}
+			err = writer.Close()
+			if err != nil {
+				t.Errorf("serialization of %v failed with error %v", test.val, err)
+			}
+			raw := buf.Bytes()
+			if string(raw) != strings.ReplaceAll(test.buf, "\n", "\r\n") {
+				t.Errorf("expected %+#v to serialize to '%s' but got '%s' (with format %s)", test.val, test.buf, string(raw), arrayFmt)
+			}
+		})
+	}
+}
diff --git a/sdks/go/internal/apiform/richparam.go b/sdks/go/internal/apiform/richparam.go
new file mode 100644
index 00000000..fab4fa15
--- /dev/null
+++ b/sdks/go/internal/apiform/richparam.go
@@ -0,0 +1,20 @@
+package apiform
+
+import (
+	"github.com/kernel/hypeman-go/packages/param"
+	"mime/multipart"
+	"reflect"
+)
+
+func (e *encoder) newRichFieldTypeEncoder(t reflect.Type) encoderFunc {
+	f, _ := t.FieldByName("Value")
+	enc := e.newPrimitiveTypeEncoder(f.Type)
+	return func(key string, value reflect.Value, writer *multipart.Writer) error {
+		if opt, ok := value.Interface().(param.Optional); ok && opt.Valid() {
+			return enc(key, value.FieldByIndex(f.Index), writer)
+		} else if ok && param.IsNull(opt) {
+			return writer.WriteField(key, "null")
+		}
+		return nil
+	}
+}
diff --git a/sdks/go/internal/apiform/tag.go b/sdks/go/internal/apiform/tag.go
new file mode 100644
index 00000000..b3536176
--- /dev/null
+++ b/sdks/go/internal/apiform/tag.go
@@ -0,0 +1,70 @@
+package apiform
+
+import (
+	"reflect"
+	"strings"
+)
+
+const apiStructTag = "api"
+const jsonStructTag = "json"
+const formStructTag = "form"
+const formatStructTag = "format"
+
+type parsedStructTag struct {
+	name     string
+	required bool
+	extras   bool
+	metadata bool
+	omitzero bool
+}
+
+func parseFormStructTag(field reflect.StructField) (tag parsedStructTag, ok bool) {
+	raw, ok := field.Tag.Lookup(formStructTag)
+	if !ok {
+		raw, ok = field.Tag.Lookup(jsonStructTag)
+	}
+	if !ok {
+		return
+	}
+	parts := strings.Split(raw, ",")
+	if len(parts) == 0 {
+		return tag, false
+	}
+	tag.name = parts[0]
+	for _, part := range parts[1:] {
+		switch part {
+		case "required":
+			tag.required = true
+		case "extras":
+			tag.extras = true
+		case "metadata":
+			tag.metadata = true
+		case "omitzero":
+			tag.omitzero = true
+		}
+	}
+
+	parseApiStructTag(field, &tag)
+	return
+}
+
+func parseApiStructTag(field reflect.StructField, tag *parsedStructTag) {
+	raw, ok := field.Tag.Lookup(apiStructTag)
+	if !ok {
+		return
+	}
+	parts := strings.Split(raw, ",")
+	for _, part := range parts {
+		switch part {
+		case "extrafields":
+			tag.extras = true
+		case "required":
+			tag.required = true
+		}
+	}
+}
+
+func parseFormatStructTag(field reflect.StructField) (format string, ok bool) {
+	format, ok = field.Tag.Lookup(formatStructTag)
+	return
+}
diff --git a/sdks/go/internal/apijson/decodeparam_test.go b/sdks/go/internal/apijson/decodeparam_test.go
new file mode 100644
index 00000000..d2a7c71b
--- /dev/null
+++ b/sdks/go/internal/apijson/decodeparam_test.go
@@ -0,0 +1,498 @@
+package apijson_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"github.com/kernel/hypeman-go/internal/apijson"
+	"github.com/kernel/hypeman-go/packages/param"
+	"reflect"
+	"testing"
+)
+
+func TestOptionalDecoders(t *testing.T) {
+	cases := map[string]struct {
+		buf string
+		val any
+	}{
+
+		"opt_string_present": {
+			`"hello"`,
+			param.NewOpt("hello"),
+		},
+		"opt_string_empty_present": {
+			`""`,
+			param.NewOpt(""),
+		},
+		"opt_string_null": {
+			`null`,
+			param.Null[string](),
+		},
+		"opt_string_null_with_whitespace": {
+			`  null  `,
+			param.Null[string](),
+		},
+	}
+
+	for name, test := range cases {
+		t.Run(name, func(t *testing.T) {
+			result := reflect.New(reflect.TypeOf(test.val))
+			if err := json.Unmarshal([]byte(test.buf), result.Interface()); err != nil {
+				t.Fatalf("deserialization of %v failed with error %v", result, err)
+			}
+
+			if !reflect.DeepEqual(result.Elem().Interface(), test.val) {
+				t.Fatalf("expected '%s' to deserialize to \n%#v\nbut got\n%#v", test.buf, test.val, result.Elem().Interface())
+			}
+		})
+	}
+}
+
+type paramObject = param.APIObject
+
+type BasicObject struct {
+	ReqInt    int64   `json:"req_int" api:"required"`
+	ReqFloat  float64 `json:"req_float" api:"required"`
+	ReqString string  `json:"req_string" api:"required"`
+	ReqBool   bool    `json:"req_bool" api:"required"`
+
+	OptInt    param.Opt[int64]   `json:"opt_int"`
+	OptFloat  param.Opt[float64] `json:"opt_float"`
+	OptString param.Opt[string]  `json:"opt_string"`
+	OptBool   param.Opt[bool]    `json:"opt_bool"`
+
+	paramObject
+}
+
+func (o *BasicObject) UnmarshalJSON(data []byte) error { return apijson.UnmarshalRoot(data, o) }
+
+func TestBasicObjectWithNull(t *testing.T) {
+	raw := `{"opt_int":null,"opt_string":null,"opt_bool":null}`
+	var dst BasicObject
+	target := BasicObject{
+		OptInt: param.Null[int64](),
+		// OptFloat:  param.Opt[float64]{},
+		OptString: param.Null[string](),
+		OptBool:   param.Null[bool](),
+	}
+
+	err := json.Unmarshal([]byte(raw), &dst)
+	if err != nil {
+		t.Fatalf("failed unmarshal")
+	}
+
+	if !reflect.DeepEqual(dst, target) {
+		t.Fatalf("failed equality check %#v", dst)
+	}
+}
+
+func TestBasicObject(t *testing.T) {
+	raw := `{"req_int":1,"req_float":1.3,"req_string":"test","req_bool":true,"opt_int":2,"opt_float":2.0,"opt_string":"test","opt_bool":false}`
+	var dst BasicObject
+	target := BasicObject{
+		ReqInt:    1,
+		ReqFloat:  1.3,
+		ReqString: "test",
+		ReqBool:   true,
+		OptInt:    param.NewOpt[int64](2),
+		OptFloat:  param.NewOpt(2.0),
+		OptString: param.NewOpt("test"),
+		OptBool:   param.NewOpt(false),
+	}
+
+	err := json.Unmarshal([]byte(raw), &dst)
+	if err != nil {
+		t.Fatalf("failed unmarshal")
+	}
+
+	if !reflect.DeepEqual(dst, target) {
+		t.Fatalf("failed equality check %#v", dst)
+	}
+}
+
+type ComplexObject struct {
+	Basic BasicObject `json:"basic" api:"required"`
+	Enum  string      `json:"enum"`
+	paramObject
+}
+
+func (o *ComplexObject) UnmarshalJSON(data []byte) error { return apijson.UnmarshalRoot(data, o) }
+
+func init() {
+	apijson.RegisterFieldValidator[ComplexObject]("enum", "a", "b", "c")
+}
+
+func TestComplexObject(t *testing.T) {
+	raw := `{"basic":{"req_int":1,"req_float":1.3,"req_string":"test","req_bool":true,"opt_int":2,"opt_float":2.0,"opt_string":"test","opt_bool":false},"enum":"a"}`
+	var dst ComplexObject
+
+	target := ComplexObject{
+		Basic: BasicObject{
+			ReqInt:    1,
+			ReqFloat:  1.3,
+			ReqString: "test",
+			ReqBool:   true,
+			OptInt:    param.NewOpt[int64](2),
+			OptFloat:  param.NewOpt(2.0),
+			OptString: param.NewOpt("test"),
+			OptBool:   param.NewOpt(false),
+		},
+		Enum: "a",
+	}
+
+	err := json.Unmarshal([]byte(raw), &dst)
+	if err != nil {
+		t.Fatalf("failed unmarshal")
+	}
+
+	if !reflect.DeepEqual(dst, target) {
+		t.Fatalf("failed equality check %#v", dst)
+	}
+}
+
+type paramUnion = param.APIUnion
+
+type MemberA struct {
+	Name string `json:"name" api:"required"`
+	Age  int    `json:"age" api:"required"`
+}
+
+type MemberB struct {
+	Name string `json:"name" api:"required"`
+	Age  string `json:"age" api:"required"`
+}
+
+type MemberC struct {
+	Name   string `json:"name" api:"required"`
+	Age    int    `json:"age" api:"required"`
+	Status string `json:"status"`
+}
+
+type MemberD struct {
+	Cost   int    `json:"cost" api:"required"`
+	Status string `json:"status" api:"required"`
+}
+
+type MemberE struct {
+	Cost   int    `json:"cost" api:"required"`
+	Status string `json:"status" api:"required"`
+}
+
+type MemberF struct {
+	D int            `json:"d"`
+	E string         `json:"e"`
+	F float64        `json:"f"`
+	G param.Opt[int] `json:"g"`
+}
+
+type MemberG struct {
+	D int             `json:"d"`
+	E string          `json:"e"`
+	F float64         `json:"f"`
+	G param.Opt[bool] `json:"g"`
+}
+
+func init() {
+	apijson.RegisterFieldValidator[MemberD]("status", "good", "ok", "bad")
+	apijson.RegisterFieldValidator[MemberE]("status", "GOOD", "OK", "BAD")
+}
+
+type UnionStruct struct {
+	OfMemberA *MemberA          `json:",inline"`
+	OfMemberB *MemberB          `json:",inline"`
+	OfMemberC *MemberC          `json:",inline"`
+	OfMemberD *MemberD          `json:",inline"`
+	OfMemberE *MemberE          `json:",inline"`
+	OfMemberF *MemberF          `json:",inline"`
+	OfMemberG *MemberG          `json:",inline"`
+	OfString  param.Opt[string] `json:",inline"`
+
+	paramUnion
+}
+
+func (union *UnionStruct) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, union)
+}
+
+func TestUnionStruct(t *testing.T) {
+	tests := map[string]struct {
+		raw        string
+		target     UnionStruct
+		shouldFail bool
+	}{
+		"fail": {
+			raw:        `1200`,
+			target:     UnionStruct{},
+			shouldFail: true,
+		},
+		"easy": {
+			raw:    `{"age":30}`,
+			target: UnionStruct{OfMemberA: &MemberA{Age: 30}},
+		},
+		"less-easy": {
+			raw:    `{"age":"thirty"}`,
+			target: UnionStruct{OfMemberB: &MemberB{Age: "thirty"}},
+		},
+		"even-less-easy": {
+			raw:    `{"age":"30"}`,
+			target: UnionStruct{OfMemberB: &MemberB{Age: "30"}},
+		},
+		"medium": {
+			raw: `{"name":"jacob","age":30}`,
+			target: UnionStruct{OfMemberA: &MemberA{
+				Age:  30,
+				Name: "jacob",
+			}},
+		},
+		"less-medium": {
+			raw: `{"name":"jacob","age":"thirty"}`,
+			target: UnionStruct{OfMemberB: &MemberB{
+				Age:  "thirty",
+				Name: "jacob",
+			}},
+		},
+		"even-less-medium": {
+			raw: `{"name":"jacob","age":"30"}`,
+			target: UnionStruct{OfMemberB: &MemberB{
+				Name: "jacob",
+				Age:  "30",
+			}},
+		},
+		"hard": {
+			raw: `{"name":"jacob","age":30,"status":"active"}`,
+			target: UnionStruct{OfMemberC: &MemberC{
+				Name:   "jacob",
+				Age:    30,
+				Status: "active",
+			}},
+		},
+		"inline-string": {
+			raw:    `"hello there"`,
+			target: UnionStruct{OfString: param.NewOpt("hello there")},
+		},
+		"enum-field": {
+			raw:    `{"cost":100,"status":"ok"}`,
+			target: UnionStruct{OfMemberD: &MemberD{Cost: 100, Status: "ok"}},
+		},
+		"other-enum-field": {
+			raw:    `{"cost":100,"status":"GOOD"}`,
+			target: UnionStruct{OfMemberE: &MemberE{Cost: 100, Status: "GOOD"}},
+		},
+		"tricky-extra-fields": {
+			raw:    `{"d":12,"e":"hello","f":1.00}`,
+			target: UnionStruct{OfMemberF: &MemberF{D: 12, E: "hello", F: 1.00}},
+		},
+		"optional-fields": {
+			raw:    `{"d":12,"e":"hello","f":1.00,"g":12}`,
+			target: UnionStruct{OfMemberF: &MemberF{D: 12, E: "hello", F: 1.00, G: param.NewOpt(12)}},
+		},
+		"optional-fields-2": {
+			raw:    `{"d":12,"e":"hello","f":1.00,"g":false}`,
+			target: UnionStruct{OfMemberG: &MemberG{D: 12, E: "hello", F: 1.00, G: param.NewOpt(false)}},
+		},
+	}
+
+	for name, test := range tests {
+		var dst UnionStruct
+		t.Run(name, func(t *testing.T) {
+			err := json.Unmarshal([]byte(test.raw), &dst)
+			if err != nil && !test.shouldFail {
+				t.Fatalf("failed unmarshal with err: %v %#v", err, dst)
+			}
+
+			if !reflect.DeepEqual(dst, test.target) {
+				if dst.OfMemberA != nil {
+					fmt.Printf("%#v", dst.OfMemberA)
+				}
+				t.Fatalf("failed equality, got %#v but expected %#v", dst, test.target)
+			}
+		})
+	}
+}
+
+type ConstantA string
+type ConstantB string
+type ConstantC string
+
+func (c ConstantA) Default() string { return "A" }
+func (c ConstantB) Default() string { return "B" }
+func (c ConstantC) Default() string { return "C" }
+
+type DiscVariantA struct {
+	Name string    `json:"name" api:"required"`
+	Age  int       `json:"age" api:"required"`
+	Type ConstantA `json:"type" api:"required"`
+}
+
+type DiscVariantB struct {
+	Name string    `json:"name" api:"required"`
+	Age  int       `json:"age" api:"required"`
+	Type ConstantB `json:"type" api:"required"`
+}
+
+type DiscVariantC struct {
+	Name string    `json:"name" api:"required"`
+	Age  float64   `json:"age" api:"required"`
+	Type ConstantC `json:"type" api:"required"`
+}
+
+type DiscriminatedUnion struct {
+	OfA *DiscVariantA `json:",inline"`
+	OfB *DiscVariantB `json:",inline"`
+	OfC *DiscVariantC `json:",inline"`
+
+	paramUnion
+}
+
+func init() {
+	apijson.RegisterDiscriminatedUnion[DiscriminatedUnion]("type", map[string]reflect.Type{
+		"A": reflect.TypeOf(DiscVariantA{}),
+		"B": reflect.TypeOf(DiscVariantB{}),
+		"C": reflect.TypeOf(DiscVariantC{}),
+	})
+}
+
+type FooVariant struct {
+	Type  string `json:"type" api:"required"`
+	Value string `json:"value" api:"required"`
+}
+
+type BarVariant struct {
+	Type   string `json:"type" api:"required"`
+	Enable bool   `json:"enable" api:"required"`
+}
+
+type MultiDiscriminatorUnion struct {
+	OfFoo *FooVariant `json:",inline"`
+	OfBar *BarVariant `json:",inline"`
+
+	paramUnion
+}
+
+func init() {
+	apijson.RegisterDiscriminatedUnion[MultiDiscriminatorUnion]("type", map[string]reflect.Type{
+		"foo":        reflect.TypeOf(FooVariant{}),
+		"foo_v2":     reflect.TypeOf(FooVariant{}),
+		"bar":        reflect.TypeOf(BarVariant{}),
+		"bar_legacy": reflect.TypeOf(BarVariant{}),
+	})
+}
+
+func (m *MultiDiscriminatorUnion) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, m)
+}
+
+func (d *DiscriminatedUnion) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, d)
+}
+
+func TestDiscriminatedUnion(t *testing.T) {
+	tests := map[string]struct {
+		raw        string
+		target     DiscriminatedUnion
+		shouldFail bool
+	}{
+		"variant_a": {
+			raw: `{"name":"Alice","age":25,"type":"A"}`,
+			target: DiscriminatedUnion{OfA: &DiscVariantA{
+				Name: "Alice",
+				Age:  25,
+				Type: "A",
+			}},
+		},
+		"variant_b": {
+			raw: `{"name":"Bob","age":30,"type":"B"}`,
+			target: DiscriminatedUnion{OfB: &DiscVariantB{
+				Name: "Bob",
+				Age:  30,
+				Type: "B",
+			}},
+		},
+		"variant_c": {
+			raw: `{"name":"Charlie","age":35.5,"type":"C"}`,
+			target: DiscriminatedUnion{OfC: &DiscVariantC{
+				Name: "Charlie",
+				Age:  35.5,
+				Type: "C",
+			}},
+		},
+		"invalid_type": {
+			raw:        `{"name":"Unknown","age":40,"type":"D"}`,
+			target:     DiscriminatedUnion{},
+			shouldFail: true,
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			var dst DiscriminatedUnion
+			err := json.Unmarshal([]byte(test.raw), &dst)
+			if err != nil && !test.shouldFail {
+				t.Fatalf("failed unmarshal with err: %v", err)
+			}
+			if err == nil && test.shouldFail {
+				t.Fatalf("expected unmarshal to fail but it succeeded")
+			}
+			if !reflect.DeepEqual(dst, test.target) {
+				t.Fatalf("failed equality, got %#v but expected %#v", dst, test.target)
+			}
+		})
+	}
+}
+
+func TestMultiDiscriminatorUnion(t *testing.T) {
+	tests := map[string]struct {
+		raw        string
+		target     MultiDiscriminatorUnion
+		shouldFail bool
+	}{
+		"foo_variant": {
+			raw: `{"type":"foo","value":"test"}`,
+			target: MultiDiscriminatorUnion{OfFoo: &FooVariant{
+				Type:  "foo",
+				Value: "test",
+			}},
+		},
+		"foo_v2_variant": {
+			raw: `{"type":"foo_v2","value":"test_v2"}`,
+			target: MultiDiscriminatorUnion{OfFoo: &FooVariant{
+				Type:  "foo_v2",
+				Value: "test_v2",
+			}},
+		},
+		"bar_variant": {
+			raw: `{"type":"bar","enable":true}`,
+			target: MultiDiscriminatorUnion{OfBar: &BarVariant{
+				Type:   "bar",
+				Enable: true,
+			}},
+		},
+		"bar_legacy_variant": {
+			raw: `{"type":"bar_legacy","enable":false}`,
+			target: MultiDiscriminatorUnion{OfBar: &BarVariant{
+				Type:   "bar_legacy",
+				Enable: false,
+			}},
+		},
+		"invalid_type": {
+			raw:        `{"type":"unknown","value":"test"}`,
+			target:     MultiDiscriminatorUnion{},
+			shouldFail: true,
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			var dst MultiDiscriminatorUnion
+			err := json.Unmarshal([]byte(test.raw), &dst)
+			if err != nil && !test.shouldFail {
+				t.Fatalf("failed unmarshal with err: %v", err)
+			}
+			if err == nil && test.shouldFail {
+				t.Fatalf("expected unmarshal to fail but it succeeded")
+			}
+			if !reflect.DeepEqual(dst, test.target) {
+				t.Fatalf("failed equality, got %#v but expected %#v", dst, test.target)
+			}
+		})
+	}
+}
diff --git a/sdks/go/internal/apijson/decoder.go b/sdks/go/internal/apijson/decoder.go
new file mode 100644
index 00000000..95c9c287
--- /dev/null
+++ b/sdks/go/internal/apijson/decoder.go
@@ -0,0 +1,691 @@
+// The deserialization algorithm from apijson may be subject to improvements
+// between minor versions, particularly with respect to calling [json.Unmarshal]
+// into param unions.
+
+package apijson
+
+import (
+	"encoding/json"
+	"fmt"
+	"github.com/kernel/hypeman-go/packages/param"
+	"reflect"
+	"strconv"
+	"sync"
+	"time"
+	"unsafe"
+
+	"github.com/tidwall/gjson"
+)
+
+// decoders is a synchronized map with roughly the following type:
+// map[reflect.Type]decoderFunc
+var decoders sync.Map
+
+// Unmarshal is similar to [encoding/json.Unmarshal] and parses the JSON-encoded
+// data and stores it in the given pointer.
+func Unmarshal(raw []byte, to any) error {
+	d := &decoderBuilder{dateFormat: time.RFC3339}
+	return d.unmarshal(raw, to)
+}
+
+// UnmarshalRoot is like Unmarshal, but doesn't try to call MarshalJSON on the
+// root element. Useful if a struct's UnmarshalJSON is overrode to use the
+// behavior of this encoder versus the standard library.
+func UnmarshalRoot(raw []byte, to any) error {
+	d := &decoderBuilder{dateFormat: time.RFC3339, root: true}
+	return d.unmarshal(raw, to)
+}
+
+// decoderBuilder contains the 'compile-time' state of the decoder.
+type decoderBuilder struct {
+	// Whether or not this is the first element and called by [UnmarshalRoot], see
+	// the documentation there to see why this is necessary.
+	root bool
+	// The dateFormat (a format string for [time.Format]) which is chosen by the
+	// last struct tag that was seen.
+	dateFormat string
+}
+
+// decoderState contains the 'run-time' state of the decoder.
+type decoderState struct {
+	strict    bool
+	exactness exactness
+	validator *validationEntry
+}
+
+// Exactness refers to how close to the type the result was if deserialization
+// was successful. This is useful in deserializing unions, where you want to try
+// each entry, first with strict, then with looser validation, without actually
+// having to do a lot of redundant work by marshalling twice (or maybe even more
+// times).
+type exactness int8
+
+const (
+	// Some values had to fudged a bit, for example by converting a string to an
+	// int, or an enum with extra values.
+	loose exactness = iota
+	// There are some extra arguments, but other wise it matches the union.
+	extras
+	// Exactly right.
+	exact
+)
+
+type decoderFunc func(node gjson.Result, value reflect.Value, state *decoderState) error
+
+type decoderField struct {
+	tag    parsedStructTag
+	fn     decoderFunc
+	idx    []int
+	goname string
+}
+
+type decoderEntry struct {
+	reflect.Type
+	dateFormat string
+	root       bool
+}
+
+func (d *decoderBuilder) unmarshal(raw []byte, to any) error {
+	value := reflect.ValueOf(to).Elem()
+	result := gjson.ParseBytes(raw)
+	if !value.IsValid() {
+		return fmt.Errorf("apijson: cannot marshal into invalid value")
+	}
+	return d.typeDecoder(value.Type())(result, value, &decoderState{strict: false, exactness: exact})
+}
+
+// unmarshalWithExactness is used for internal testing purposes.
+func (d *decoderBuilder) unmarshalWithExactness(raw []byte, to any) (exactness, error) {
+	value := reflect.ValueOf(to).Elem()
+	result := gjson.ParseBytes(raw)
+	if !value.IsValid() {
+		return 0, fmt.Errorf("apijson: cannot marshal into invalid value")
+	}
+	state := decoderState{strict: false, exactness: exact}
+	err := d.typeDecoder(value.Type())(result, value, &state)
+	return state.exactness, err
+}
+
+func (d *decoderBuilder) typeDecoder(t reflect.Type) decoderFunc {
+	entry := decoderEntry{
+		Type:       t,
+		dateFormat: d.dateFormat,
+		root:       d.root,
+	}
+
+	if fi, ok := decoders.Load(entry); ok {
+		return fi.(decoderFunc)
+	}
+
+	// To deal with recursive types, populate the map with an
+	// indirect func before we build it. This type waits on the
+	// real func (f) to be ready and then calls it. This indirect
+	// func is only used for recursive types.
+	var (
+		wg sync.WaitGroup
+		f  decoderFunc
+	)
+	wg.Add(1)
+	fi, loaded := decoders.LoadOrStore(entry, decoderFunc(func(node gjson.Result, v reflect.Value, state *decoderState) error {
+		wg.Wait()
+		return f(node, v, state)
+	}))
+	if loaded {
+		return fi.(decoderFunc)
+	}
+
+	// Compute the real decoder and replace the indirect func with it.
+	f = d.newTypeDecoder(t)
+	wg.Done()
+	decoders.Store(entry, f)
+	return f
+}
+
+// validatedTypeDecoder wraps the type decoder with a validator. This is helpful
+// for ensuring that enum fields are correct.
+func (d *decoderBuilder) validatedTypeDecoder(t reflect.Type, entry *validationEntry) decoderFunc {
+	dec := d.typeDecoder(t)
+	if entry == nil {
+		return dec
+	}
+
+	// Thread the current validation entry through the decoder,
+	// but clean up in time for the next field.
+	return func(node gjson.Result, v reflect.Value, state *decoderState) error {
+		state.validator = entry
+		err := dec(node, v, state)
+		state.validator = nil
+		return err
+	}
+}
+
+func indirectUnmarshalerDecoder(n gjson.Result, v reflect.Value, state *decoderState) error {
+	return v.Addr().Interface().(json.Unmarshaler).UnmarshalJSON([]byte(n.Raw))
+}
+
+func unmarshalerDecoder(n gjson.Result, v reflect.Value, state *decoderState) error {
+	if v.Kind() == reflect.Pointer && v.CanSet() {
+		v.Set(reflect.New(v.Type().Elem()))
+	}
+	return v.Interface().(json.Unmarshaler).UnmarshalJSON([]byte(n.Raw))
+}
+
+func (d *decoderBuilder) newTypeDecoder(t reflect.Type) decoderFunc {
+	if t.ConvertibleTo(reflect.TypeOf(time.Time{})) {
+		return d.newTimeTypeDecoder(t)
+	}
+
+	if t.Implements(reflect.TypeOf((*param.Optional)(nil)).Elem()) {
+		return d.newOptTypeDecoder(t)
+	}
+
+	if !d.root && t.Implements(reflect.TypeOf((*json.Unmarshaler)(nil)).Elem()) {
+		return unmarshalerDecoder
+	}
+	if !d.root && reflect.PointerTo(t).Implements(reflect.TypeOf((*json.Unmarshaler)(nil)).Elem()) {
+		if _, ok := unionVariants[t]; !ok {
+			return indirectUnmarshalerDecoder
+		}
+	}
+	d.root = false
+
+	if _, ok := unionRegistry[t]; ok {
+		if isStructUnion(t) {
+			return d.newStructUnionDecoder(t)
+		}
+		return d.newUnionDecoder(t)
+	}
+
+	switch t.Kind() {
+	case reflect.Pointer:
+		inner := t.Elem()
+		innerDecoder := d.typeDecoder(inner)
+
+		return func(n gjson.Result, v reflect.Value, state *decoderState) error {
+			if !v.IsValid() {
+				return fmt.Errorf("apijson: unexpected invalid reflection value %+#v", v)
+			}
+
+			newValue := reflect.New(inner).Elem()
+			err := innerDecoder(n, newValue, state)
+			if err != nil {
+				return err
+			}
+
+			v.Set(newValue.Addr())
+			return nil
+		}
+	case reflect.Struct:
+		if isStructUnion(t) {
+			return d.newStructUnionDecoder(t)
+		}
+		return d.newStructTypeDecoder(t)
+	case reflect.Array:
+		fallthrough
+	case reflect.Slice:
+		return d.newArrayTypeDecoder(t)
+	case reflect.Map:
+		return d.newMapDecoder(t)
+	case reflect.Interface:
+		return func(node gjson.Result, value reflect.Value, state *decoderState) error {
+			if !value.IsValid() {
+				return fmt.Errorf("apijson: unexpected invalid value %+#v", value)
+			}
+			if node.Value() != nil && value.CanSet() {
+				value.Set(reflect.ValueOf(node.Value()))
+			}
+			return nil
+		}
+	default:
+		return d.newPrimitiveTypeDecoder(t)
+	}
+}
+
+func (d *decoderBuilder) newMapDecoder(t reflect.Type) decoderFunc {
+	keyType := t.Key()
+	itemType := t.Elem()
+	itemDecoder := d.typeDecoder(itemType)
+
+	return func(node gjson.Result, value reflect.Value, state *decoderState) (err error) {
+		mapValue := reflect.MakeMapWithSize(t, len(node.Map()))
+
+		node.ForEach(func(key, value gjson.Result) bool {
+			// It's fine for us to just use `ValueOf` here because the key types will
+			// always be primitive types so we don't need to decode it using the standard pattern
+			keyValue := reflect.ValueOf(key.Value())
+			if !keyValue.IsValid() {
+				if err == nil {
+					err = fmt.Errorf("apijson: received invalid key type %v", keyValue.String())
+				}
+				return false
+			}
+			if keyValue.Type() != keyType {
+				if err == nil {
+					err = fmt.Errorf("apijson: expected key type %v but got %v", keyType, keyValue.Type())
+				}
+				return false
+			}
+
+			itemValue := reflect.New(itemType).Elem()
+			itemerr := itemDecoder(value, itemValue, state)
+			if itemerr != nil {
+				if err == nil {
+					err = itemerr
+				}
+				return false
+			}
+
+			mapValue.SetMapIndex(keyValue, itemValue)
+			return true
+		})
+
+		if err != nil {
+			return err
+		}
+		value.Set(mapValue)
+		return nil
+	}
+}
+
+func (d *decoderBuilder) newArrayTypeDecoder(t reflect.Type) decoderFunc {
+	itemDecoder := d.typeDecoder(t.Elem())
+
+	return func(node gjson.Result, value reflect.Value, state *decoderState) (err error) {
+		if !node.IsArray() {
+			return fmt.Errorf("apijson: could not deserialize to an array")
+		}
+
+		arrayNode := node.Array()
+
+		arrayValue := reflect.MakeSlice(reflect.SliceOf(t.Elem()), len(arrayNode), len(arrayNode))
+		for i, itemNode := range arrayNode {
+			err = itemDecoder(itemNode, arrayValue.Index(i), state)
+			if err != nil {
+				return err
+			}
+		}
+
+		value.Set(arrayValue)
+		return nil
+	}
+}
+
+func (d *decoderBuilder) newStructTypeDecoder(t reflect.Type) decoderFunc {
+	// map of json field name to struct field decoders
+	decoderFields := map[string]decoderField{}
+	anonymousDecoders := []decoderField{}
+	extraDecoder := (*decoderField)(nil)
+	var inlineDecoders []decoderField
+
+	validationEntries := validationRegistry[t]
+
+	for i := 0; i < t.NumField(); i++ {
+		idx := []int{i}
+		field := t.FieldByIndex(idx)
+		if !field.IsExported() {
+			continue
+		}
+
+		var validator *validationEntry
+		for _, entry := range validationEntries {
+			if entry.field.Offset == field.Offset {
+				validator = &entry
+				break
+			}
+		}
+
+		// If this is an embedded struct, traverse one level deeper to extract
+		// the fields and get their encoders as well.
+		if field.Anonymous {
+			anonymousDecoders = append(anonymousDecoders, decoderField{
+				fn:  d.typeDecoder(field.Type),
+				idx: idx[:],
+			})
+			continue
+		}
+		// If json tag is not present, then we skip, which is intentionally
+		// different behavior from the stdlib.
+		ptag, ok := parseJSONStructTag(field)
+		if !ok {
+			continue
+		}
+		// We only want to support unexported fields if they're tagged with
+		// `extras` because that field shouldn't be part of the public API.
+		if ptag.extras {
+			extraDecoder = &decoderField{ptag, d.typeDecoder(field.Type.Elem()), idx, field.Name}
+			continue
+		}
+		if ptag.inline {
+			df := decoderField{ptag, d.typeDecoder(field.Type), idx, field.Name}
+			inlineDecoders = append(inlineDecoders, df)
+			continue
+		}
+		if ptag.metadata {
+			continue
+		}
+
+		oldFormat := d.dateFormat
+		dateFormat, ok := parseFormatStructTag(field)
+		if ok {
+			switch dateFormat {
+			case "date-time":
+				d.dateFormat = time.RFC3339
+			case "date":
+				d.dateFormat = "2006-01-02"
+			}
+		}
+
+		decoderFields[ptag.name] = decoderField{
+			ptag,
+			d.validatedTypeDecoder(field.Type, validator),
+			idx, field.Name,
+		}
+
+		d.dateFormat = oldFormat
+	}
+
+	return func(node gjson.Result, value reflect.Value, state *decoderState) (err error) {
+		if field := value.FieldByName("JSON"); field.IsValid() {
+			if raw := field.FieldByName("raw"); raw.IsValid() {
+				setUnexportedField(raw, node.Raw)
+			}
+		}
+
+		for _, decoder := range anonymousDecoders {
+			// ignore errors
+			decoder.fn(node, value.FieldByIndex(decoder.idx), state)
+		}
+
+		for _, inlineDecoder := range inlineDecoders {
+			var meta Field
+			dest := value.FieldByIndex(inlineDecoder.idx)
+			isValid := false
+			if dest.IsValid() && node.Type != gjson.Null {
+				inlineState := decoderState{exactness: state.exactness, strict: true}
+				err = inlineDecoder.fn(node, dest, &inlineState)
+				if err == nil {
+					isValid = true
+				}
+			}
+
+			if node.Type == gjson.Null {
+				meta = Field{
+					raw:    node.Raw,
+					status: null,
+				}
+			} else if !isValid {
+				// If an inline decoder fails, unset the field and move on.
+				if dest.IsValid() {
+					dest.SetZero()
+				}
+				continue
+			} else if isValid {
+				meta = Field{
+					raw:    node.Raw,
+					status: valid,
+				}
+			}
+			setMetadataSubField(value, inlineDecoder.idx, inlineDecoder.goname, meta)
+		}
+
+		typedExtraType := reflect.Type(nil)
+		typedExtraFields := reflect.Value{}
+		if extraDecoder != nil {
+			typedExtraType = value.FieldByIndex(extraDecoder.idx).Type()
+			typedExtraFields = reflect.MakeMap(typedExtraType)
+		}
+		untypedExtraFields := map[string]Field{}
+
+		for fieldName, itemNode := range node.Map() {
+			df, explicit := decoderFields[fieldName]
+			var (
+				dest reflect.Value
+				fn   decoderFunc
+				meta Field
+			)
+			if explicit {
+				fn = df.fn
+				dest = value.FieldByIndex(df.idx)
+			}
+			if !explicit && extraDecoder != nil {
+				dest = reflect.New(typedExtraType.Elem()).Elem()
+				fn = extraDecoder.fn
+			}
+
+			isValid := false
+			if dest.IsValid() && itemNode.Type != gjson.Null {
+				err = fn(itemNode, dest, state)
+				if err == nil {
+					isValid = true
+				}
+			}
+
+			// Handle null [param.Opt]
+			if itemNode.Type == gjson.Null && dest.IsValid() && dest.Type().Implements(reflect.TypeOf((*param.Optional)(nil)).Elem()) {
+				dest.Addr().Interface().(json.Unmarshaler).UnmarshalJSON([]byte(itemNode.Raw))
+				continue
+			}
+
+			if itemNode.Type == gjson.Null {
+				meta = Field{
+					raw:    itemNode.Raw,
+					status: null,
+				}
+			} else if !isValid {
+				meta = Field{
+					raw:    itemNode.Raw,
+					status: invalid,
+				}
+			} else if isValid {
+				meta = Field{
+					raw:    itemNode.Raw,
+					status: valid,
+				}
+			}
+
+			if explicit {
+				setMetadataSubField(value, df.idx, df.goname, meta)
+			}
+			if !explicit {
+				untypedExtraFields[fieldName] = meta
+			}
+			if !explicit && extraDecoder != nil {
+				typedExtraFields.SetMapIndex(reflect.ValueOf(fieldName), dest)
+			}
+		}
+
+		if extraDecoder != nil && typedExtraFields.Len() > 0 {
+			value.FieldByIndex(extraDecoder.idx).Set(typedExtraFields)
+		}
+
+		// Set exactness to 'extras' if there are untyped, extra fields.
+		if len(untypedExtraFields) > 0 && state.exactness > extras {
+			state.exactness = extras
+		}
+
+		if len(untypedExtraFields) > 0 {
+			setMetadataExtraFields(value, []int{-1}, "ExtraFields", untypedExtraFields)
+		}
+		return nil
+	}
+}
+
+func (d *decoderBuilder) newPrimitiveTypeDecoder(t reflect.Type) decoderFunc {
+	switch t.Kind() {
+	case reflect.String:
+		return func(n gjson.Result, v reflect.Value, state *decoderState) error {
+			v.SetString(n.String())
+			if guardStrict(state, n.Type != gjson.String) {
+				return fmt.Errorf("apijson: failed to parse string strictly")
+			}
+			// Everything that is not an object can be loosely stringified.
+			if n.Type == gjson.JSON {
+				return fmt.Errorf("apijson: failed to parse string")
+			}
+
+			state.validateString(v)
+
+			if guardUnknown(state, v) {
+				return fmt.Errorf("apijson: failed string enum validation")
+			}
+			return nil
+		}
+	case reflect.Bool:
+		return func(n gjson.Result, v reflect.Value, state *decoderState) error {
+			v.SetBool(n.Bool())
+			if guardStrict(state, n.Type != gjson.True && n.Type != gjson.False) {
+				return fmt.Errorf("apijson: failed to parse bool strictly")
+			}
+			// Numbers and strings that are either 'true' or 'false' can be loosely
+			// deserialized as bool.
+			if n.Type == gjson.String && (n.Raw != "true" && n.Raw != "false") || n.Type == gjson.JSON {
+				return fmt.Errorf("apijson: failed to parse bool")
+			}
+
+			state.validateBool(v)
+
+			if guardUnknown(state, v) {
+				return fmt.Errorf("apijson: failed bool enum validation")
+			}
+			return nil
+		}
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return func(n gjson.Result, v reflect.Value, state *decoderState) error {
+			v.SetInt(n.Int())
+			if guardStrict(state, n.Type != gjson.Number || n.Num != float64(int(n.Num))) {
+				return fmt.Errorf("apijson: failed to parse int strictly")
+			}
+			// Numbers, booleans, and strings that maybe look like numbers can be
+			// loosely deserialized as numbers.
+			if n.Type == gjson.JSON || (n.Type == gjson.String && !canParseAsNumber(n.Str)) {
+				return fmt.Errorf("apijson: failed to parse int")
+			}
+
+			state.validateInt(v)
+
+			if guardUnknown(state, v) {
+				return fmt.Errorf("apijson: failed int enum validation")
+			}
+			return nil
+		}
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return func(n gjson.Result, v reflect.Value, state *decoderState) error {
+			v.SetUint(n.Uint())
+			if guardStrict(state, n.Type != gjson.Number || n.Num != float64(int(n.Num)) || n.Num < 0) {
+				return fmt.Errorf("apijson: failed to parse uint strictly")
+			}
+			// Numbers, booleans, and strings that maybe look like numbers can be
+			// loosely deserialized as uint.
+			if n.Type == gjson.JSON || (n.Type == gjson.String && !canParseAsNumber(n.Str)) {
+				return fmt.Errorf("apijson: failed to parse uint")
+			}
+			if guardUnknown(state, v) {
+				return fmt.Errorf("apijson: failed uint enum validation")
+			}
+			return nil
+		}
+	case reflect.Float32, reflect.Float64:
+		return func(n gjson.Result, v reflect.Value, state *decoderState) error {
+			v.SetFloat(n.Float())
+			if guardStrict(state, n.Type != gjson.Number) {
+				return fmt.Errorf("apijson: failed to parse float strictly")
+			}
+			// Numbers, booleans, and strings that maybe look like numbers can be
+			// loosely deserialized as floats.
+			if n.Type == gjson.JSON || (n.Type == gjson.String && !canParseAsNumber(n.Str)) {
+				return fmt.Errorf("apijson: failed to parse float")
+			}
+			if guardUnknown(state, v) {
+				return fmt.Errorf("apijson: failed float enum validation")
+			}
+			return nil
+		}
+	default:
+		return func(node gjson.Result, v reflect.Value, state *decoderState) error {
+			return fmt.Errorf("unknown type received at primitive decoder: %s", t.String())
+		}
+	}
+}
+
+func (d *decoderBuilder) newOptTypeDecoder(t reflect.Type) decoderFunc {
+	for t.Kind() == reflect.Pointer {
+		t = t.Elem()
+	}
+	valueField, _ := t.FieldByName("Value")
+	return func(n gjson.Result, v reflect.Value, state *decoderState) error {
+		state.validateOptKind(n, valueField.Type)
+		return v.Addr().Interface().(json.Unmarshaler).UnmarshalJSON([]byte(n.Raw))
+	}
+}
+
+func (d *decoderBuilder) newTimeTypeDecoder(t reflect.Type) decoderFunc {
+	format := d.dateFormat
+	return func(n gjson.Result, v reflect.Value, state *decoderState) error {
+		parsed, err := time.Parse(format, n.Str)
+		if err == nil {
+			v.Set(reflect.ValueOf(parsed).Convert(t))
+			return nil
+		}
+
+		if guardStrict(state, true) {
+			return err
+		}
+
+		layouts := []string{
+			"2006-01-02",
+			"2006-01-02T15:04:05Z07:00",
+			"2006-01-02T15:04:05Z0700",
+			"2006-01-02T15:04:05",
+			"2006-01-02 15:04:05Z07:00",
+			"2006-01-02 15:04:05Z0700",
+			"2006-01-02 15:04:05",
+		}
+
+		for _, layout := range layouts {
+			parsed, err := time.Parse(layout, n.Str)
+			if err == nil {
+				v.Set(reflect.ValueOf(parsed).Convert(t))
+				return nil
+			}
+		}
+
+		return fmt.Errorf("unable to leniently parse date-time string: %s", n.Str)
+	}
+}
+
+func setUnexportedField(field reflect.Value, value any) {
+	reflect.NewAt(field.Type(), unsafe.Pointer(field.UnsafeAddr())).Elem().Set(reflect.ValueOf(value))
+}
+
+func guardStrict(state *decoderState, cond bool) bool {
+	if !cond {
+		return false
+	}
+
+	if state.strict {
+		return true
+	}
+
+	state.exactness = loose
+	return false
+}
+
+func canParseAsNumber(str string) bool {
+	_, err := strconv.ParseFloat(str, 64)
+	return err == nil
+}
+
+var stringType = reflect.TypeOf(string(""))
+
+func guardUnknown(state *decoderState, v reflect.Value) bool {
+	if have, ok := v.Interface().(interface{ IsKnown() bool }); guardStrict(state, ok && !have.IsKnown()) {
+		return true
+	}
+
+	constantString, ok := v.Interface().(interface{ Default() string })
+	named := v.Type() != stringType
+	if guardStrict(state, ok && named && v.Equal(reflect.ValueOf(constantString.Default()))) {
+		return true
+	}
+	return false
+}
diff --git a/sdks/go/internal/apijson/decoderesp_test.go b/sdks/go/internal/apijson/decoderesp_test.go
new file mode 100644
index 00000000..b45af01d
--- /dev/null
+++ b/sdks/go/internal/apijson/decoderesp_test.go
@@ -0,0 +1,30 @@
+package apijson_test
+
+import (
+	"encoding/json"
+	"github.com/kernel/hypeman-go/internal/apijson"
+	"github.com/kernel/hypeman-go/packages/respjson"
+	"testing"
+)
+
+type StructWithNullExtraField struct {
+	Results []string `json:"results" api:"required"`
+	JSON    struct {
+		Results     respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+func (r *StructWithNullExtraField) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+func TestDecodeWithNullExtraField(t *testing.T) {
+	raw := `{"something_else":null}`
+	var dst *StructWithNullExtraField
+	err := json.Unmarshal([]byte(raw), &dst)
+	if err != nil {
+		t.Fatalf("error: %s", err.Error())
+	}
+}
diff --git a/sdks/go/internal/apijson/encoder.go b/sdks/go/internal/apijson/encoder.go
new file mode 100644
index 00000000..ab7a3c15
--- /dev/null
+++ b/sdks/go/internal/apijson/encoder.go
@@ -0,0 +1,392 @@
+package apijson
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/tidwall/sjson"
+)
+
+var encoders sync.Map // map[encoderEntry]encoderFunc
+
+// If we want to set a literal key value into JSON using sjson, we need to make sure it doesn't have
+// special characters that sjson interprets as a path.
+var EscapeSJSONKey = strings.NewReplacer("\\", "\\\\", "|", "\\|", "#", "\\#", "@", "\\@", "*", "\\*", ".", "\\.", ":", "\\:", "?", "\\?").Replace
+
+func Marshal(value any) ([]byte, error) {
+	e := &encoder{dateFormat: time.RFC3339}
+	return e.marshal(value)
+}
+
+func MarshalRoot(value any) ([]byte, error) {
+	e := &encoder{root: true, dateFormat: time.RFC3339}
+	return e.marshal(value)
+}
+
+type encoder struct {
+	dateFormat string
+	root       bool
+}
+
+type encoderFunc func(value reflect.Value) ([]byte, error)
+
+type encoderField struct {
+	tag parsedStructTag
+	fn  encoderFunc
+	idx []int
+}
+
+type encoderEntry struct {
+	reflect.Type
+	dateFormat string
+	root       bool
+}
+
+func (e *encoder) marshal(value any) ([]byte, error) {
+	val := reflect.ValueOf(value)
+	if !val.IsValid() {
+		return nil, nil
+	}
+	typ := val.Type()
+	enc := e.typeEncoder(typ)
+	return enc(val)
+}
+
+func (e *encoder) typeEncoder(t reflect.Type) encoderFunc {
+	entry := encoderEntry{
+		Type:       t,
+		dateFormat: e.dateFormat,
+		root:       e.root,
+	}
+
+	if fi, ok := encoders.Load(entry); ok {
+		return fi.(encoderFunc)
+	}
+
+	// To deal with recursive types, populate the map with an
+	// indirect func before we build it. This type waits on the
+	// real func (f) to be ready and then calls it. This indirect
+	// func is only used for recursive types.
+	var (
+		wg sync.WaitGroup
+		f  encoderFunc
+	)
+	wg.Add(1)
+	fi, loaded := encoders.LoadOrStore(entry, encoderFunc(func(v reflect.Value) ([]byte, error) {
+		wg.Wait()
+		return f(v)
+	}))
+	if loaded {
+		return fi.(encoderFunc)
+	}
+
+	// Compute the real encoder and replace the indirect func with it.
+	f = e.newTypeEncoder(t)
+	wg.Done()
+	encoders.Store(entry, f)
+	return f
+}
+
+func marshalerEncoder(v reflect.Value) ([]byte, error) {
+	return v.Interface().(json.Marshaler).MarshalJSON()
+}
+
+func indirectMarshalerEncoder(v reflect.Value) ([]byte, error) {
+	return v.Addr().Interface().(json.Marshaler).MarshalJSON()
+}
+
+func (e *encoder) newTypeEncoder(t reflect.Type) encoderFunc {
+	if t.ConvertibleTo(reflect.TypeOf(time.Time{})) {
+		return e.newTimeTypeEncoder()
+	}
+	if !e.root && t.Implements(reflect.TypeOf((*json.Marshaler)(nil)).Elem()) {
+		return marshalerEncoder
+	}
+	if !e.root && reflect.PointerTo(t).Implements(reflect.TypeOf((*json.Marshaler)(nil)).Elem()) {
+		return indirectMarshalerEncoder
+	}
+	e.root = false
+	switch t.Kind() {
+	case reflect.Pointer:
+		inner := t.Elem()
+
+		innerEncoder := e.typeEncoder(inner)
+		return func(v reflect.Value) ([]byte, error) {
+			if !v.IsValid() || v.IsNil() {
+				return nil, nil
+			}
+			return innerEncoder(v.Elem())
+		}
+	case reflect.Struct:
+		return e.newStructTypeEncoder(t)
+	case reflect.Array:
+		fallthrough
+	case reflect.Slice:
+		return e.newArrayTypeEncoder(t)
+	case reflect.Map:
+		return e.newMapEncoder(t)
+	case reflect.Interface:
+		return e.newInterfaceEncoder()
+	default:
+		return e.newPrimitiveTypeEncoder(t)
+	}
+}
+
+func (e *encoder) newPrimitiveTypeEncoder(t reflect.Type) encoderFunc {
+	switch t.Kind() {
+	// Note that we could use `gjson` to encode these types but it would complicate our
+	// code more and this current code shouldn't cause any issues
+	case reflect.String:
+		return func(v reflect.Value) ([]byte, error) {
+			return json.Marshal(v.Interface())
+		}
+	case reflect.Bool:
+		return func(v reflect.Value) ([]byte, error) {
+			if v.Bool() {
+				return []byte("true"), nil
+			}
+			return []byte("false"), nil
+		}
+	case reflect.Int, reflect.Int16, reflect.Int32, reflect.Int64:
+		return func(v reflect.Value) ([]byte, error) {
+			return []byte(strconv.FormatInt(v.Int(), 10)), nil
+		}
+	case reflect.Uint, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return func(v reflect.Value) ([]byte, error) {
+			return []byte(strconv.FormatUint(v.Uint(), 10)), nil
+		}
+	case reflect.Float32:
+		return func(v reflect.Value) ([]byte, error) {
+			return []byte(strconv.FormatFloat(v.Float(), 'f', -1, 32)), nil
+		}
+	case reflect.Float64:
+		return func(v reflect.Value) ([]byte, error) {
+			return []byte(strconv.FormatFloat(v.Float(), 'f', -1, 64)), nil
+		}
+	default:
+		return func(v reflect.Value) ([]byte, error) {
+			return nil, fmt.Errorf("unknown type received at primitive encoder: %s", t.String())
+		}
+	}
+}
+
+func (e *encoder) newArrayTypeEncoder(t reflect.Type) encoderFunc {
+	itemEncoder := e.typeEncoder(t.Elem())
+
+	return func(value reflect.Value) ([]byte, error) {
+		json := []byte("[]")
+		for i := 0; i < value.Len(); i++ {
+			var value, err = itemEncoder(value.Index(i))
+			if err != nil {
+				return nil, err
+			}
+			if value == nil {
+				// Assume that empty items should be inserted as `null` so that the output array
+				// will be the same length as the input array
+				value = []byte("null")
+			}
+
+			json, err = sjson.SetRawBytes(json, "-1", value)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		return json, nil
+	}
+}
+
+func (e *encoder) newStructTypeEncoder(t reflect.Type) encoderFunc {
+	encoderFields := []encoderField{}
+	extraEncoder := (*encoderField)(nil)
+
+	// This helper allows us to recursively collect field encoders into a flat
+	// array. The parameter `index` keeps track of the access patterns necessary
+	// to get to some field.
+	var collectEncoderFields func(r reflect.Type, index []int)
+	collectEncoderFields = func(r reflect.Type, index []int) {
+		for i := 0; i < r.NumField(); i++ {
+			idx := append(index, i)
+			field := t.FieldByIndex(idx)
+			if !field.IsExported() {
+				continue
+			}
+			// If this is an embedded struct, traverse one level deeper to extract
+			// the field and get their encoders as well.
+			if field.Anonymous {
+				collectEncoderFields(field.Type, idx)
+				continue
+			}
+			// If json tag is not present, then we skip, which is intentionally
+			// different behavior from the stdlib.
+			ptag, ok := parseJSONStructTag(field)
+			if !ok {
+				continue
+			}
+			// We only want to support unexported field if they're tagged with
+			// `extras` because that field shouldn't be part of the public API. We
+			// also want to only keep the top level extras
+			if ptag.extras && len(index) == 0 {
+				extraEncoder = &encoderField{ptag, e.typeEncoder(field.Type.Elem()), idx}
+				continue
+			}
+			if ptag.name == "-" {
+				continue
+			}
+
+			dateFormat, ok := parseFormatStructTag(field)
+			oldFormat := e.dateFormat
+			if ok {
+				switch dateFormat {
+				case "date-time":
+					e.dateFormat = time.RFC3339
+				case "date":
+					e.dateFormat = "2006-01-02"
+				}
+			}
+			encoderFields = append(encoderFields, encoderField{ptag, e.typeEncoder(field.Type), idx})
+			e.dateFormat = oldFormat
+		}
+	}
+	collectEncoderFields(t, []int{})
+
+	// Ensure deterministic output by sorting by lexicographic order
+	sort.Slice(encoderFields, func(i, j int) bool {
+		return encoderFields[i].tag.name < encoderFields[j].tag.name
+	})
+
+	return func(value reflect.Value) (json []byte, err error) {
+		json = []byte("{}")
+
+		for _, ef := range encoderFields {
+			field := value.FieldByIndex(ef.idx)
+			encoded, err := ef.fn(field)
+			if err != nil {
+				return nil, err
+			}
+			if encoded == nil {
+				continue
+			}
+			json, err = sjson.SetRawBytes(json, EscapeSJSONKey(ef.tag.name), encoded)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		if extraEncoder != nil {
+			json, err = e.encodeMapEntries(json, value.FieldByIndex(extraEncoder.idx))
+			if err != nil {
+				return nil, err
+			}
+		}
+		return
+	}
+}
+
+func (e *encoder) newFieldTypeEncoder(t reflect.Type) encoderFunc {
+	f, _ := t.FieldByName("Value")
+	enc := e.typeEncoder(f.Type)
+
+	return func(value reflect.Value) (json []byte, err error) {
+		present := value.FieldByName("Present")
+		if !present.Bool() {
+			return nil, nil
+		}
+		null := value.FieldByName("Null")
+		if null.Bool() {
+			return []byte("null"), nil
+		}
+		raw := value.FieldByName("Raw")
+		if !raw.IsNil() {
+			return e.typeEncoder(raw.Type())(raw)
+		}
+		return enc(value.FieldByName("Value"))
+	}
+}
+
+func (e *encoder) newTimeTypeEncoder() encoderFunc {
+	format := e.dateFormat
+	return func(value reflect.Value) (json []byte, err error) {
+		return []byte(`"` + value.Convert(reflect.TypeOf(time.Time{})).Interface().(time.Time).Format(format) + `"`), nil
+	}
+}
+
+func (e encoder) newInterfaceEncoder() encoderFunc {
+	return func(value reflect.Value) ([]byte, error) {
+		value = value.Elem()
+		if !value.IsValid() {
+			return nil, nil
+		}
+		return e.typeEncoder(value.Type())(value)
+	}
+}
+
+// Given a []byte of json (may either be an empty object or an object that already contains entries)
+// encode all of the entries in the map to the json byte array.
+func (e *encoder) encodeMapEntries(json []byte, v reflect.Value) ([]byte, error) {
+	type mapPair struct {
+		key   []byte
+		value reflect.Value
+	}
+
+	pairs := []mapPair{}
+	keyEncoder := e.typeEncoder(v.Type().Key())
+
+	iter := v.MapRange()
+	for iter.Next() {
+		var encodedKeyString string
+		if iter.Key().Type().Kind() == reflect.String {
+			encodedKeyString = iter.Key().String()
+		} else {
+			var err error
+			encodedKeyBytes, err := keyEncoder(iter.Key())
+			if err != nil {
+				return nil, err
+			}
+			encodedKeyString = string(encodedKeyBytes)
+		}
+		encodedKey := []byte(encodedKeyString)
+		pairs = append(pairs, mapPair{key: encodedKey, value: iter.Value()})
+	}
+
+	// Ensure deterministic output
+	sort.Slice(pairs, func(i, j int) bool {
+		return bytes.Compare(pairs[i].key, pairs[j].key) < 0
+	})
+
+	elementEncoder := e.typeEncoder(v.Type().Elem())
+	for _, p := range pairs {
+		encodedValue, err := elementEncoder(p.value)
+		if err != nil {
+			return nil, err
+		}
+		if len(encodedValue) == 0 {
+			continue
+		}
+		json, err = sjson.SetRawBytes(json, EscapeSJSONKey(string(p.key)), encodedValue)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return json, nil
+}
+
+func (e *encoder) newMapEncoder(_ reflect.Type) encoderFunc {
+	return func(value reflect.Value) ([]byte, error) {
+		json := []byte("{}")
+		var err error
+		json, err = e.encodeMapEntries(json, value)
+		if err != nil {
+			return nil, err
+		}
+		return json, nil
+	}
+}
diff --git a/sdks/go/internal/apijson/enum.go b/sdks/go/internal/apijson/enum.go
new file mode 100644
index 00000000..5bef11c3
--- /dev/null
+++ b/sdks/go/internal/apijson/enum.go
@@ -0,0 +1,145 @@
+package apijson
+
+import (
+	"fmt"
+	"reflect"
+	"slices"
+	"sync"
+
+	"github.com/tidwall/gjson"
+)
+
+/********************/
+/* Validating Enums */
+/********************/
+
+type validationEntry struct {
+	field       reflect.StructField
+	required    bool
+	legalValues struct {
+		strings []string
+		// 1 represents true, 0 represents false, -1 represents either
+		bools int
+		ints  []int64
+	}
+}
+
+type validatorFunc func(reflect.Value) exactness
+
+var validators sync.Map
+var validationRegistry = map[reflect.Type][]validationEntry{}
+
+func RegisterFieldValidator[T any, V string | bool | int | float64](fieldName string, values ...V) {
+	var t T
+	parentType := reflect.TypeOf(t)
+
+	if _, ok := validationRegistry[parentType]; !ok {
+		validationRegistry[parentType] = []validationEntry{}
+	}
+
+	// The following checks run at initialization time,
+	// it is impossible for them to panic if any tests pass.
+	if parentType.Kind() != reflect.Struct {
+		panic(fmt.Sprintf("apijson: cannot initialize validator for non-struct %s", parentType.String()))
+	}
+
+	var field reflect.StructField
+	found := false
+	for i := 0; i < parentType.NumField(); i++ {
+		ptag, ok := parseJSONStructTag(parentType.Field(i))
+		if ok && ptag.name == fieldName {
+			field = parentType.Field(i)
+			found = true
+			break
+		}
+	}
+
+	if !found {
+		panic(fmt.Sprintf("apijson: cannot find field %s in struct %s", fieldName, parentType.String()))
+	}
+
+	newEntry := validationEntry{field: field}
+	newEntry.legalValues.bools = -1 // default to either
+
+	switch values := any(values).(type) {
+	case []string:
+		newEntry.legalValues.strings = values
+	case []int:
+		newEntry.legalValues.ints = make([]int64, len(values))
+		for i, value := range values {
+			newEntry.legalValues.ints[i] = int64(value)
+		}
+	case []bool:
+		for i, value := range values {
+			var next int
+			if value {
+				next = 1
+			}
+			if i > 0 && newEntry.legalValues.bools != next {
+				newEntry.legalValues.bools = -1 // accept either
+				break
+			}
+			newEntry.legalValues.bools = next
+		}
+	}
+
+	// Store the information necessary to create a validator, so that we can use it
+	// lazily create the validator function when did.
+	validationRegistry[parentType] = append(validationRegistry[parentType], newEntry)
+}
+
+func (state *decoderState) validateString(v reflect.Value) {
+	if state.validator == nil {
+		return
+	}
+	if !slices.Contains(state.validator.legalValues.strings, v.String()) {
+		state.exactness = loose
+	}
+}
+
+func (state *decoderState) validateInt(v reflect.Value) {
+	if state.validator == nil {
+		return
+	}
+	if !slices.Contains(state.validator.legalValues.ints, v.Int()) {
+		state.exactness = loose
+	}
+}
+
+func (state *decoderState) validateBool(v reflect.Value) {
+	if state.validator == nil {
+		return
+	}
+	b := v.Bool()
+	if state.validator.legalValues.bools == 1 && b == false {
+		state.exactness = loose
+	} else if state.validator.legalValues.bools == 0 && b == true {
+		state.exactness = loose
+	}
+}
+
+func (state *decoderState) validateOptKind(node gjson.Result, t reflect.Type) {
+	switch node.Type {
+	case gjson.JSON:
+		state.exactness = loose
+	case gjson.Null:
+		return
+	case gjson.False, gjson.True:
+		if t.Kind() != reflect.Bool {
+			state.exactness = loose
+		}
+	case gjson.Number:
+		switch t.Kind() {
+		case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+			reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64,
+			reflect.Float32, reflect.Float64:
+			return
+		default:
+			state.exactness = loose
+		}
+	case gjson.String:
+		if t.Kind() != reflect.String {
+			state.exactness = loose
+		}
+	}
+}
diff --git a/sdks/go/internal/apijson/enum_test.go b/sdks/go/internal/apijson/enum_test.go
new file mode 100644
index 00000000..a2aeed44
--- /dev/null
+++ b/sdks/go/internal/apijson/enum_test.go
@@ -0,0 +1,87 @@
+package apijson
+
+import (
+	"reflect"
+	"testing"
+)
+
+type EnumStruct struct {
+	NormalString string        `json:"normal_string"`
+	StringEnum   string        `json:"string_enum"`
+	NamedEnum    NamedEnumType `json:"named_enum"`
+
+	IntEnum  int  `json:"int_enum"`
+	BoolEnum bool `json:"bool_enum"`
+
+	WeirdBoolEnum bool `json:"weird_bool_enum"`
+}
+
+func (o *EnumStruct) UnmarshalJSON(data []byte) error {
+	return UnmarshalRoot(data, o)
+}
+
+func init() {
+	RegisterFieldValidator[EnumStruct]("string_enum", "one", "two", "three")
+	RegisterFieldValidator[EnumStruct]("int_enum", 200, 404)
+	RegisterFieldValidator[EnumStruct]("bool_enum", false)
+	RegisterFieldValidator[EnumStruct]("weird_bool_enum", true, false)
+}
+
+type NamedEnumType string
+
+const (
+	NamedEnumOne   NamedEnumType = "one"
+	NamedEnumTwo   NamedEnumType = "two"
+	NamedEnumThree NamedEnumType = "three"
+)
+
+func (e NamedEnumType) IsKnown() bool {
+	return e == NamedEnumOne || e == NamedEnumTwo || e == NamedEnumThree
+}
+
+func TestEnumStructStringValidator(t *testing.T) {
+	cases := map[string]struct {
+		exactness
+		EnumStruct
+	}{
+		`{"string_enum":"one"}`:     {exact, EnumStruct{StringEnum: "one"}},
+		`{"string_enum":"two"}`:     {exact, EnumStruct{StringEnum: "two"}},
+		`{"string_enum":"three"}`:   {exact, EnumStruct{StringEnum: "three"}},
+		`{"string_enum":"none"}`:    {loose, EnumStruct{StringEnum: "none"}},
+		`{"int_enum":200}`:          {exact, EnumStruct{IntEnum: 200}},
+		`{"int_enum":404}`:          {exact, EnumStruct{IntEnum: 404}},
+		`{"int_enum":500}`:          {loose, EnumStruct{IntEnum: 500}},
+		`{"bool_enum":false}`:       {exact, EnumStruct{BoolEnum: false}},
+		`{"bool_enum":true}`:        {loose, EnumStruct{BoolEnum: true}},
+		`{"weird_bool_enum":true}`:  {exact, EnumStruct{WeirdBoolEnum: true}},
+		`{"weird_bool_enum":false}`: {exact, EnumStruct{WeirdBoolEnum: false}},
+
+		`{"named_enum":"one"}`:  {exact, EnumStruct{NamedEnum: NamedEnumOne}},
+		`{"named_enum":"none"}`: {loose, EnumStruct{NamedEnum: "none"}},
+
+		`{"string_enum":"one","named_enum":"one"}`: {exact, EnumStruct{NamedEnum: "one", StringEnum: "one"}},
+		`{"string_enum":"four","named_enum":"one"}`: {
+			loose,
+			EnumStruct{NamedEnum: "one", StringEnum: "four"},
+		},
+		`{"string_enum":"one","named_enum":"four"}`: {
+			loose, EnumStruct{NamedEnum: "four", StringEnum: "one"},
+		},
+		`{"wrong_key":"one"}`: {extras, EnumStruct{StringEnum: ""}},
+	}
+
+	for raw, expected := range cases {
+		var dst EnumStruct
+
+		dec := decoderBuilder{root: true}
+		exactness, _ := dec.unmarshalWithExactness([]byte(raw), &dst)
+
+		if !reflect.DeepEqual(dst, expected.EnumStruct) {
+			t.Fatalf("failed equality check %#v", dst)
+		}
+
+		if exactness != expected.exactness {
+			t.Fatalf("exactness got %d expected %d %s", exactness, expected.exactness, raw)
+		}
+	}
+}
diff --git a/sdks/go/internal/apijson/field.go b/sdks/go/internal/apijson/field.go
new file mode 100644
index 00000000..854d6dd7
--- /dev/null
+++ b/sdks/go/internal/apijson/field.go
@@ -0,0 +1,23 @@
+package apijson
+
+type status uint8
+
+const (
+	missing status = iota
+	null
+	invalid
+	valid
+)
+
+type Field struct {
+	raw    string
+	status status
+}
+
+// Returns true if the field is explicitly `null` _or_ if it is not present at all (ie, missing).
+// To check if the field's key is present in the JSON with an explicit null value,
+// you must check `f.IsNull() && !f.IsMissing()`.
+func (j Field) IsNull() bool    { return j.status <= null }
+func (j Field) IsMissing() bool { return j.status == missing }
+func (j Field) IsInvalid() bool { return j.status == invalid }
+func (j Field) Raw() string     { return j.raw }
diff --git a/sdks/go/internal/apijson/json_test.go b/sdks/go/internal/apijson/json_test.go
new file mode 100644
index 00000000..fac9fcce
--- /dev/null
+++ b/sdks/go/internal/apijson/json_test.go
@@ -0,0 +1,616 @@
+package apijson
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/tidwall/gjson"
+)
+
+func P[T any](v T) *T { return &v }
+
+type Primitives struct {
+	A bool    `json:"a"`
+	B int     `json:"b"`
+	C uint    `json:"c"`
+	D float64 `json:"d"`
+	E float32 `json:"e"`
+	F []int   `json:"f"`
+}
+
+type PrimitivePointers struct {
+	A *bool    `json:"a"`
+	B *int     `json:"b"`
+	C *uint    `json:"c"`
+	D *float64 `json:"d"`
+	E *float32 `json:"e"`
+	F *[]int   `json:"f"`
+}
+
+type Slices struct {
+	Slice []Primitives `json:"slices"`
+}
+
+type DateTime struct {
+	Date     time.Time `json:"date" format:"date"`
+	DateTime time.Time `json:"date-time" format:"date-time"`
+}
+
+type AdditionalProperties struct {
+	A           bool           `json:"a"`
+	ExtraFields map[string]any `json:"-" api:"extrafields"`
+}
+
+type TypedAdditionalProperties struct {
+	A           bool           `json:"a"`
+	ExtraFields map[string]int `json:"-" api:"extrafields"`
+}
+
+type EmbeddedStruct struct {
+	A bool   `json:"a"`
+	B string `json:"b"`
+
+	JSON EmbeddedStructJSON
+}
+
+type EmbeddedStructJSON struct {
+	A           Field
+	B           Field
+	ExtraFields map[string]Field
+	raw         string
+}
+
+type EmbeddedStructs struct {
+	EmbeddedStruct
+	A           *int           `json:"a"`
+	ExtraFields map[string]any `json:"-" api:"extrafields"`
+
+	JSON EmbeddedStructsJSON
+}
+
+type EmbeddedStructsJSON struct {
+	A           Field
+	ExtraFields map[string]Field
+	raw         string
+}
+
+type Recursive struct {
+	Name  string     `json:"name"`
+	Child *Recursive `json:"child"`
+}
+
+type JSONFieldStruct struct {
+	A           bool                `json:"a"`
+	B           int64               `json:"b"`
+	C           string              `json:"c"`
+	D           string              `json:"d"`
+	ExtraFields map[string]int64    `json:"" api:"extrafields"`
+	JSON        JSONFieldStructJSON `json:",metadata"`
+}
+
+type JSONFieldStructJSON struct {
+	A           Field
+	B           Field
+	C           Field
+	D           Field
+	ExtraFields map[string]Field
+	raw         string
+}
+
+type UnknownStruct struct {
+	Unknown any `json:"unknown"`
+}
+
+type UnionStruct struct {
+	Union Union `json:"union" format:"date"`
+}
+
+type Union interface {
+	union()
+}
+
+type Inline struct {
+	InlineField Primitives `json:",inline"`
+	JSON        InlineJSON `json:",metadata"`
+}
+
+type InlineArray struct {
+	InlineField []string   `json:",inline"`
+	JSON        InlineJSON `json:",metadata"`
+}
+
+type InlineJSON struct {
+	InlineField Field
+	raw         string
+}
+
+type UnionInteger int64
+
+func (UnionInteger) union() {}
+
+type UnionStructA struct {
+	Type string `json:"type"`
+	A    string `json:"a"`
+	B    string `json:"b"`
+}
+
+func (UnionStructA) union() {}
+
+type UnionStructB struct {
+	Type string `json:"type"`
+	A    string `json:"a"`
+}
+
+func (UnionStructB) union() {}
+
+type UnionTime time.Time
+
+func (UnionTime) union() {}
+
+func init() {
+	RegisterUnion[Union]("type",
+		UnionVariant{
+			TypeFilter: gjson.String,
+			Type:       reflect.TypeOf(UnionTime{}),
+		},
+		UnionVariant{
+			TypeFilter: gjson.Number,
+			Type:       reflect.TypeOf(UnionInteger(0)),
+		},
+		UnionVariant{
+			TypeFilter:         gjson.JSON,
+			DiscriminatorValue: "typeA",
+			Type:               reflect.TypeOf(UnionStructA{}),
+		},
+		UnionVariant{
+			TypeFilter:         gjson.JSON,
+			DiscriminatorValue: "typeB",
+			Type:               reflect.TypeOf(UnionStructB{}),
+		},
+	)
+}
+
+type ComplexUnionStruct struct {
+	Union ComplexUnion `json:"union"`
+}
+
+type ComplexUnion interface {
+	complexUnion()
+}
+
+type ComplexUnionA struct {
+	Boo string `json:"boo"`
+	Foo bool   `json:"foo"`
+}
+
+func (ComplexUnionA) complexUnion() {}
+
+type ComplexUnionB struct {
+	Boo bool   `json:"boo"`
+	Foo string `json:"foo"`
+}
+
+func (ComplexUnionB) complexUnion() {}
+
+type ComplexUnionC struct {
+	Boo int64 `json:"boo"`
+}
+
+func (ComplexUnionC) complexUnion() {}
+
+type ComplexUnionTypeA struct {
+	Baz  int64 `json:"baz"`
+	Type TypeA `json:"type"`
+}
+
+func (ComplexUnionTypeA) complexUnion() {}
+
+type TypeA string
+
+func (t TypeA) IsKnown() bool {
+	return t == "a"
+}
+
+type ComplexUnionTypeB struct {
+	Baz  int64 `json:"baz"`
+	Type TypeB `json:"type"`
+}
+
+type TypeB string
+
+func (t TypeB) IsKnown() bool {
+	return t == "b"
+}
+
+type UnmarshalStruct struct {
+	Foo  string `json:"foo"`
+	prop bool   `json:"-"`
+}
+
+func (r *UnmarshalStruct) UnmarshalJSON(json []byte) error {
+	r.prop = true
+	return UnmarshalRoot(json, r)
+}
+
+func (ComplexUnionTypeB) complexUnion() {}
+
+func init() {
+	RegisterUnion[ComplexUnion]("",
+		UnionVariant{
+			TypeFilter: gjson.JSON,
+			Type:       reflect.TypeOf(ComplexUnionA{}),
+		},
+		UnionVariant{
+			TypeFilter: gjson.JSON,
+			Type:       reflect.TypeOf(ComplexUnionB{}),
+		},
+		UnionVariant{
+			TypeFilter: gjson.JSON,
+			Type:       reflect.TypeOf(ComplexUnionC{}),
+		},
+		UnionVariant{
+			TypeFilter: gjson.JSON,
+			Type:       reflect.TypeOf(ComplexUnionTypeA{}),
+		},
+		UnionVariant{
+			TypeFilter: gjson.JSON,
+			Type:       reflect.TypeOf(ComplexUnionTypeB{}),
+		},
+	)
+}
+
+type MarshallingUnionStruct struct {
+	Union MarshallingUnion
+}
+
+func (r *MarshallingUnionStruct) UnmarshalJSON(data []byte) (err error) {
+	*r = MarshallingUnionStruct{}
+	err = UnmarshalRoot(data, &r.Union)
+	return
+}
+
+func (r MarshallingUnionStruct) MarshalJSON() (data []byte, err error) {
+	return MarshalRoot(r.Union)
+}
+
+type MarshallingUnion interface {
+	marshallingUnion()
+}
+
+type MarshallingUnionA struct {
+	Boo string `json:"boo"`
+}
+
+func (MarshallingUnionA) marshallingUnion() {}
+
+func (r *MarshallingUnionA) UnmarshalJSON(data []byte) (err error) {
+	return UnmarshalRoot(data, r)
+}
+
+type MarshallingUnionB struct {
+	Foo string `json:"foo"`
+}
+
+func (MarshallingUnionB) marshallingUnion() {}
+
+func (r *MarshallingUnionB) UnmarshalJSON(data []byte) (err error) {
+	return UnmarshalRoot(data, r)
+}
+
+func init() {
+	RegisterUnion[MarshallingUnion](
+		"",
+		UnionVariant{
+			TypeFilter: gjson.JSON,
+			Type:       reflect.TypeOf(MarshallingUnionA{}),
+		},
+		UnionVariant{
+			TypeFilter: gjson.JSON,
+			Type:       reflect.TypeOf(MarshallingUnionB{}),
+		},
+	)
+}
+
+var tests = map[string]struct {
+	buf string
+	val any
+}{
+	"true":               {"true", true},
+	"false":              {"false", false},
+	"int":                {"1", 1},
+	"int_bigger":         {"12324", 12324},
+	"int_string_coerce":  {`"65"`, 65},
+	"int_boolean_coerce": {"true", 1},
+	"int64":              {"1", int64(1)},
+	"int64_huge":         {"123456789123456789", int64(123456789123456789)},
+	"uint":               {"1", uint(1)},
+	"uint_bigger":        {"12324", uint(12324)},
+	"uint_coerce":        {`"65"`, uint(65)},
+	"float_1.54":         {"1.54", float32(1.54)},
+	"float_1.89":         {"1.89", float64(1.89)},
+	"string":             {`"str"`, "str"},
+	"string_int_coerce":  {`12`, "12"},
+	"array_string":       {`["foo","bar"]`, []string{"foo", "bar"}},
+	"array_int":          {`[1,2]`, []int{1, 2}},
+	"array_int_coerce":   {`["1",2]`, []int{1, 2}},
+
+	"ptr_true":               {"true", P(true)},
+	"ptr_false":              {"false", P(false)},
+	"ptr_int":                {"1", P(1)},
+	"ptr_int_bigger":         {"12324", P(12324)},
+	"ptr_int_string_coerce":  {`"65"`, P(65)},
+	"ptr_int_boolean_coerce": {"true", P(1)},
+	"ptr_int64":              {"1", P(int64(1))},
+	"ptr_int64_huge":         {"123456789123456789", P(int64(123456789123456789))},
+	"ptr_uint":               {"1", P(uint(1))},
+	"ptr_uint_bigger":        {"12324", P(uint(12324))},
+	"ptr_uint_coerce":        {`"65"`, P(uint(65))},
+	"ptr_float_1.54":         {"1.54", P(float32(1.54))},
+	"ptr_float_1.89":         {"1.89", P(float64(1.89))},
+
+	"date_time":             {`"2007-03-01T13:00:00Z"`, time.Date(2007, time.March, 1, 13, 0, 0, 0, time.UTC)},
+	"date_time_nano_coerce": {`"2007-03-01T13:03:05.123456789Z"`, time.Date(2007, time.March, 1, 13, 3, 5, 123456789, time.UTC)},
+
+	"date_time_missing_t_coerce":        {`"2007-03-01 13:03:05Z"`, time.Date(2007, time.March, 1, 13, 3, 5, 0, time.UTC)},
+	"date_time_missing_timezone_coerce": {`"2007-03-01T13:03:05"`, time.Date(2007, time.March, 1, 13, 3, 5, 0, time.UTC)},
+	// note: using -1200 to minimize probability of conflicting with the local timezone of the test runner
+	// see https://en.wikipedia.org/wiki/UTC%E2%88%9212:00
+	"date_time_missing_timezone_colon_coerce": {`"2007-03-01T13:03:05-1200"`, time.Date(2007, time.March, 1, 13, 3, 5, 0, time.FixedZone("", -12*60*60))},
+	"date_time_nano_missing_t_coerce":         {`"2007-03-01 13:03:05.123456789Z"`, time.Date(2007, time.March, 1, 13, 3, 5, 123456789, time.UTC)},
+
+	"map_string":                       {`{"foo":"bar"}`, map[string]string{"foo": "bar"}},
+	"map_string_with_sjson_path_chars": {`{":a.b.c*:d*-1e.f":"bar"}`, map[string]string{":a.b.c*:d*-1e.f": "bar"}},
+	"map_interface":                    {`{"a":1,"b":"str","c":false}`, map[string]any{"a": float64(1), "b": "str", "c": false}},
+
+	"primitive_struct": {
+		`{"a":false,"b":237628372683,"c":654,"d":9999.43,"e":43.76,"f":[1,2,3,4]}`,
+		Primitives{A: false, B: 237628372683, C: uint(654), D: 9999.43, E: 43.76, F: []int{1, 2, 3, 4}},
+	},
+
+	"slices": {
+		`{"slices":[{"a":false,"b":237628372683,"c":654,"d":9999.43,"e":43.76,"f":[1,2,3,4]}]}`,
+		Slices{
+			Slice: []Primitives{{A: false, B: 237628372683, C: uint(654), D: 9999.43, E: 43.76, F: []int{1, 2, 3, 4}}},
+		},
+	},
+
+	"primitive_pointer_struct": {
+		`{"a":false,"b":237628372683,"c":654,"d":9999.43,"e":43.76,"f":[1,2,3,4,5]}`,
+		PrimitivePointers{
+			A: P(false),
+			B: P(237628372683),
+			C: P(uint(654)),
+			D: P(9999.43),
+			E: P(float32(43.76)),
+			F: &[]int{1, 2, 3, 4, 5},
+		},
+	},
+
+	"datetime_struct": {
+		`{"date":"2006-01-02","date-time":"2006-01-02T15:04:05Z"}`,
+		DateTime{
+			Date:     time.Date(2006, time.January, 2, 0, 0, 0, 0, time.UTC),
+			DateTime: time.Date(2006, time.January, 2, 15, 4, 5, 0, time.UTC),
+		},
+	},
+
+	"additional_properties": {
+		`{"a":true,"bar":"value","foo":true}`,
+		AdditionalProperties{
+			A: true,
+			ExtraFields: map[string]any{
+				"bar": "value",
+				"foo": true,
+			},
+		},
+	},
+
+	"embedded_struct": {
+		`{"a":1,"b":"bar"}`,
+		EmbeddedStructs{
+			EmbeddedStruct: EmbeddedStruct{
+				A: true,
+				B: "bar",
+				JSON: EmbeddedStructJSON{
+					A:   Field{raw: `1`, status: valid},
+					B:   Field{raw: `"bar"`, status: valid},
+					raw: `{"a":1,"b":"bar"}`,
+				},
+			},
+			A:           P(1),
+			ExtraFields: map[string]any{"b": "bar"},
+			JSON: EmbeddedStructsJSON{
+				A: Field{raw: `1`, status: valid},
+				ExtraFields: map[string]Field{
+					"b": {raw: `"bar"`, status: valid},
+				},
+				raw: `{"a":1,"b":"bar"}`,
+			},
+		},
+	},
+
+	"recursive_struct": {
+		`{"child":{"name":"Alex"},"name":"Robert"}`,
+		Recursive{Name: "Robert", Child: &Recursive{Name: "Alex"}},
+	},
+
+	"metadata_coerce": {
+		`{"a":"12","b":"12","c":null,"extra_typed":12,"extra_untyped":{"foo":"bar"}}`,
+		JSONFieldStruct{
+			A: false,
+			B: 12,
+			C: "",
+			JSON: JSONFieldStructJSON{
+				raw: `{"a":"12","b":"12","c":null,"extra_typed":12,"extra_untyped":{"foo":"bar"}}`,
+				A:   Field{raw: `"12"`, status: invalid},
+				B:   Field{raw: `"12"`, status: valid},
+				C:   Field{raw: "null", status: null},
+				D:   Field{raw: "", status: missing},
+				ExtraFields: map[string]Field{
+					"extra_typed": {
+						raw:    "12",
+						status: valid,
+					},
+					"extra_untyped": {
+						raw:    `{"foo":"bar"}`,
+						status: invalid,
+					},
+				},
+			},
+			ExtraFields: map[string]int64{
+				"extra_typed":   12,
+				"extra_untyped": 0,
+			},
+		},
+	},
+
+	"unknown_struct_number": {
+		`{"unknown":12}`,
+		UnknownStruct{
+			Unknown: 12.,
+		},
+	},
+
+	"unknown_struct_map": {
+		`{"unknown":{"foo":"bar"}}`,
+		UnknownStruct{
+			Unknown: map[string]any{
+				"foo": "bar",
+			},
+		},
+	},
+
+	"union_integer": {
+		`{"union":12}`,
+		UnionStruct{
+			Union: UnionInteger(12),
+		},
+	},
+
+	"union_struct_discriminated_a": {
+		`{"union":{"a":"foo","b":"bar","type":"typeA"}}`,
+		UnionStruct{
+			Union: UnionStructA{
+				Type: "typeA",
+				A:    "foo",
+				B:    "bar",
+			},
+		},
+	},
+
+	"union_struct_discriminated_b": {
+		`{"union":{"a":"foo","type":"typeB"}}`,
+		UnionStruct{
+			Union: UnionStructB{
+				Type: "typeB",
+				A:    "foo",
+			},
+		},
+	},
+
+	"union_struct_time": {
+		`{"union":"2010-05-23"}`,
+		UnionStruct{
+			Union: UnionTime(time.Date(2010, 05, 23, 0, 0, 0, 0, time.UTC)),
+		},
+	},
+
+	"complex_union_a": {
+		`{"union":{"boo":"12","foo":true}}`,
+		ComplexUnionStruct{Union: ComplexUnionA{Boo: "12", Foo: true}},
+	},
+
+	"complex_union_b": {
+		`{"union":{"boo":true,"foo":"12"}}`,
+		ComplexUnionStruct{Union: ComplexUnionB{Boo: true, Foo: "12"}},
+	},
+
+	"complex_union_c": {
+		`{"union":{"boo":12}}`,
+		ComplexUnionStruct{Union: ComplexUnionC{Boo: 12}},
+	},
+
+	"complex_union_type_a": {
+		`{"union":{"baz":12,"type":"a"}}`,
+		ComplexUnionStruct{Union: ComplexUnionTypeA{Baz: 12, Type: TypeA("a")}},
+	},
+
+	"complex_union_type_b": {
+		`{"union":{"baz":12,"type":"b"}}`,
+		ComplexUnionStruct{Union: ComplexUnionTypeB{Baz: 12, Type: TypeB("b")}},
+	},
+
+	"marshalling_union_a": {
+		`{"boo":"hello"}`,
+		MarshallingUnionStruct{Union: MarshallingUnionA{Boo: "hello"}},
+	},
+	"marshalling_union_b": {
+		`{"foo":"hi"}`,
+		MarshallingUnionStruct{Union: MarshallingUnionB{Foo: "hi"}},
+	},
+
+	"unmarshal": {
+		`{"foo":"hello"}`,
+		&UnmarshalStruct{Foo: "hello", prop: true},
+	},
+
+	"array_of_unmarshal": {
+		`[{"foo":"hello"}]`,
+		[]UnmarshalStruct{{Foo: "hello", prop: true}},
+	},
+
+	"inline_coerce": {
+		`{"a":false,"b":237628372683,"c":654,"d":9999.43,"e":43.76,"f":[1,2,3,4]}`,
+		Inline{
+			InlineField: Primitives{A: false, B: 237628372683, C: 0x28e, D: 9999.43, E: 43.76, F: []int{1, 2, 3, 4}},
+			JSON: InlineJSON{
+				InlineField: Field{raw: "{\"a\":false,\"b\":237628372683,\"c\":654,\"d\":9999.43,\"e\":43.76,\"f\":[1,2,3,4]}", status: 3},
+				raw:         "{\"a\":false,\"b\":237628372683,\"c\":654,\"d\":9999.43,\"e\":43.76,\"f\":[1,2,3,4]}",
+			},
+		},
+	},
+
+	"inline_array_coerce": {
+		`["Hello","foo","bar"]`,
+		InlineArray{
+			InlineField: []string{"Hello", "foo", "bar"},
+			JSON: InlineJSON{
+				InlineField: Field{raw: `["Hello","foo","bar"]`, status: 3},
+				raw:         `["Hello","foo","bar"]`,
+			},
+		},
+	},
+}
+
+func TestDecode(t *testing.T) {
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			result := reflect.New(reflect.TypeOf(test.val))
+			if err := Unmarshal([]byte(test.buf), result.Interface()); err != nil {
+				t.Fatalf("deserialization of %v failed with error %v", result, err)
+			}
+			if !reflect.DeepEqual(result.Elem().Interface(), test.val) {
+				t.Fatalf("expected '%s' to deserialize to \n%#v\nbut got\n%#v", test.buf, test.val, result.Elem().Interface())
+			}
+		})
+	}
+}
+
+func TestEncode(t *testing.T) {
+	for name, test := range tests {
+		if strings.HasSuffix(name, "_coerce") {
+			continue
+		}
+		t.Run(name, func(t *testing.T) {
+			raw, err := Marshal(test.val)
+			if err != nil {
+				t.Fatalf("serialization of %v failed with error %v", test.val, err)
+			}
+			if string(raw) != test.buf {
+				t.Fatalf("expected %+#v to serialize to %s but got %s", test.val, test.buf, string(raw))
+			}
+		})
+	}
+}
diff --git a/sdks/go/internal/apijson/port.go b/sdks/go/internal/apijson/port.go
new file mode 100644
index 00000000..b40013c1
--- /dev/null
+++ b/sdks/go/internal/apijson/port.go
@@ -0,0 +1,120 @@
+package apijson
+
+import (
+	"fmt"
+	"reflect"
+)
+
+// Port copies over values from one struct to another struct.
+func Port(from any, to any) error {
+	toVal := reflect.ValueOf(to)
+	fromVal := reflect.ValueOf(from)
+
+	if toVal.Kind() != reflect.Ptr || toVal.IsNil() {
+		return fmt.Errorf("destination must be a non-nil pointer")
+	}
+
+	for toVal.Kind() == reflect.Ptr {
+		toVal = toVal.Elem()
+	}
+	toType := toVal.Type()
+
+	for fromVal.Kind() == reflect.Ptr {
+		fromVal = fromVal.Elem()
+	}
+	fromType := fromVal.Type()
+
+	if toType.Kind() != reflect.Struct {
+		return fmt.Errorf("destination must be a non-nil pointer to a struct (%v %v)", toType, toType.Kind())
+	}
+
+	values := map[string]reflect.Value{}
+	fields := map[string]reflect.Value{}
+
+	fromJSON := fromVal.FieldByName("JSON")
+	toJSON := toVal.FieldByName("JSON")
+
+	// Iterate through the fields of v and load all the "normal" fields in the struct to the map of
+	// string to reflect.Value, as well as their raw .JSON.Foo counterpart indicated by j.
+	var getFields func(t reflect.Type, v reflect.Value)
+	getFields = func(t reflect.Type, v reflect.Value) {
+		j := v.FieldByName("JSON")
+
+		// Recurse into anonymous fields first, since the fields on the object should win over the fields in the
+		// embedded object.
+		for i := 0; i < t.NumField(); i++ {
+			field := t.Field(i)
+			if field.Anonymous {
+				getFields(field.Type, v.Field(i))
+				continue
+			}
+		}
+
+		for i := 0; i < t.NumField(); i++ {
+			field := t.Field(i)
+			ptag, ok := parseJSONStructTag(field)
+			if !ok || ptag.name == "-" || ptag.name == "" {
+				continue
+			}
+			values[ptag.name] = v.Field(i)
+			if j.IsValid() {
+				fields[ptag.name] = j.FieldByName(field.Name)
+			}
+		}
+	}
+	getFields(fromType, fromVal)
+
+	// Use the values from the previous step to populate the 'to' struct.
+	for i := 0; i < toType.NumField(); i++ {
+		field := toType.Field(i)
+		ptag, ok := parseJSONStructTag(field)
+		if !ok {
+			continue
+		}
+		if ptag.name == "-" {
+			continue
+		}
+		if value, ok := values[ptag.name]; ok {
+			delete(values, ptag.name)
+			if field.Type.Kind() == reflect.Interface {
+				toVal.Field(i).Set(value)
+			} else {
+				switch value.Kind() {
+				case reflect.String:
+					toVal.Field(i).SetString(value.String())
+				case reflect.Bool:
+					toVal.Field(i).SetBool(value.Bool())
+				case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+					toVal.Field(i).SetInt(value.Int())
+				case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+					toVal.Field(i).SetUint(value.Uint())
+				case reflect.Float32, reflect.Float64:
+					toVal.Field(i).SetFloat(value.Float())
+				default:
+					toVal.Field(i).Set(value)
+				}
+			}
+		}
+
+		if fromJSONField, ok := fields[ptag.name]; ok {
+			if toJSONField := toJSON.FieldByName(field.Name); toJSONField.IsValid() {
+				toJSONField.Set(fromJSONField)
+			}
+		}
+	}
+
+	// Finally, copy over the .JSON.raw and .JSON.ExtraFields
+	if toJSON.IsValid() {
+		if raw := toJSON.FieldByName("raw"); raw.IsValid() {
+			setUnexportedField(raw, fromJSON.Interface().(interface{ RawJSON() string }).RawJSON())
+		}
+
+		if toExtraFields := toJSON.FieldByName("ExtraFields"); toExtraFields.IsValid() {
+			if fromExtraFields := fromJSON.FieldByName("ExtraFields"); fromExtraFields.IsValid() {
+				setUnexportedField(toExtraFields, fromExtraFields.Interface())
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/sdks/go/internal/apijson/port_test.go b/sdks/go/internal/apijson/port_test.go
new file mode 100644
index 00000000..bb01f1ad
--- /dev/null
+++ b/sdks/go/internal/apijson/port_test.go
@@ -0,0 +1,257 @@
+package apijson
+
+import (
+	"reflect"
+	"testing"
+)
+
+type Metadata struct {
+	CreatedAt string `json:"created_at"`
+}
+
+// Card is the "combined" type of CardVisa and CardMastercard
+type Card struct {
+	Processor CardProcessor `json:"processor"`
+	Data      any           `json:"data"`
+	IsFoo     bool          `json:"is_foo"`
+	IsBar     bool          `json:"is_bar"`
+	Metadata  Metadata      `json:"metadata"`
+	Value     any           `json:"value"`
+
+	JSON cardJSON
+}
+
+type cardJSON struct {
+	Processor   Field
+	Data        Field
+	IsFoo       Field
+	IsBar       Field
+	Metadata    Field
+	Value       Field
+	ExtraFields map[string]Field
+	raw         string
+}
+
+func (r cardJSON) RawJSON() string { return r.raw }
+
+type CardProcessor string
+
+// CardVisa
+type CardVisa struct {
+	Processor CardVisaProcessor `json:"processor"`
+	Data      CardVisaData      `json:"data"`
+	IsFoo     bool              `json:"is_foo"`
+	Metadata  Metadata          `json:"metadata"`
+	Value     string            `json:"value"`
+
+	JSON cardVisaJSON
+}
+
+type cardVisaJSON struct {
+	Processor   Field
+	Data        Field
+	IsFoo       Field
+	Metadata    Field
+	Value       Field
+	ExtraFields map[string]Field
+	raw         string
+}
+
+func (r cardVisaJSON) RawJSON() string { return r.raw }
+
+type CardVisaProcessor string
+
+type CardVisaData struct {
+	Foo string `json:"foo"`
+}
+
+// CardMastercard
+type CardMastercard struct {
+	Processor CardMastercardProcessor `json:"processor"`
+	Data      CardMastercardData      `json:"data"`
+	IsBar     bool                    `json:"is_bar"`
+	Metadata  Metadata                `json:"metadata"`
+	Value     bool                    `json:"value"`
+
+	JSON cardMastercardJSON
+}
+
+type cardMastercardJSON struct {
+	Processor   Field
+	Data        Field
+	IsBar       Field
+	Metadata    Field
+	Value       Field
+	ExtraFields map[string]Field
+	raw         string
+}
+
+func (r cardMastercardJSON) RawJSON() string { return r.raw }
+
+type CardMastercardProcessor string
+
+type CardMastercardData struct {
+	Bar int64 `json:"bar"`
+}
+
+type CommonFields struct {
+	Metadata Metadata `json:"metadata"`
+	Value    string   `json:"value"`
+
+	JSON commonFieldsJSON
+}
+
+type commonFieldsJSON struct {
+	Metadata    Field
+	Value       Field
+	ExtraFields map[string]Field
+	raw         string
+}
+
+type CardEmbedded struct {
+	CommonFields
+	Processor CardVisaProcessor `json:"processor"`
+	Data      CardVisaData      `json:"data"`
+	IsFoo     bool              `json:"is_foo"`
+
+	JSON cardEmbeddedJSON
+}
+
+type cardEmbeddedJSON struct {
+	Processor   Field
+	Data        Field
+	IsFoo       Field
+	ExtraFields map[string]Field
+	raw         string
+}
+
+func (r cardEmbeddedJSON) RawJSON() string { return r.raw }
+
+var portTests = map[string]struct {
+	from any
+	to   any
+}{
+	"visa to card": {
+		CardVisa{
+			Processor: "visa",
+			IsFoo:     true,
+			Data: CardVisaData{
+				Foo: "foo",
+			},
+			Metadata: Metadata{
+				CreatedAt: "Mar 29 2024",
+			},
+			Value: "value",
+			JSON: cardVisaJSON{
+				raw:         `{"processor":"visa","is_foo":true,"data":{"foo":"foo"}}`,
+				Processor:   Field{raw: `"visa"`, status: valid},
+				IsFoo:       Field{raw: `true`, status: valid},
+				Data:        Field{raw: `{"foo":"foo"}`, status: valid},
+				Value:       Field{raw: `"value"`, status: valid},
+				ExtraFields: map[string]Field{"extra": {raw: `"yo"`, status: valid}},
+			},
+		},
+		Card{
+			Processor: "visa",
+			IsFoo:     true,
+			IsBar:     false,
+			Data: CardVisaData{
+				Foo: "foo",
+			},
+			Metadata: Metadata{
+				CreatedAt: "Mar 29 2024",
+			},
+			Value: "value",
+			JSON: cardJSON{
+				raw:         `{"processor":"visa","is_foo":true,"data":{"foo":"foo"}}`,
+				Processor:   Field{raw: `"visa"`, status: valid},
+				IsFoo:       Field{raw: `true`, status: valid},
+				Data:        Field{raw: `{"foo":"foo"}`, status: valid},
+				Value:       Field{raw: `"value"`, status: valid},
+				ExtraFields: map[string]Field{"extra": {raw: `"yo"`, status: valid}},
+			},
+		},
+	},
+	"mastercard to card": {
+		CardMastercard{
+			Processor: "mastercard",
+			IsBar:     true,
+			Data: CardMastercardData{
+				Bar: 13,
+			},
+			Value: false,
+		},
+		Card{
+			Processor: "mastercard",
+			IsFoo:     false,
+			IsBar:     true,
+			Data: CardMastercardData{
+				Bar: 13,
+			},
+			Value: false,
+		},
+	},
+	"embedded to card": {
+		CardEmbedded{
+			CommonFields: CommonFields{
+				Metadata: Metadata{
+					CreatedAt: "Mar 29 2024",
+				},
+				Value: "embedded_value",
+				JSON: commonFieldsJSON{
+					Metadata: Field{raw: `{"created_at":"Mar 29 2024"}`, status: valid},
+					Value:    Field{raw: `"embedded_value"`, status: valid},
+					raw:      `should not matter`,
+				},
+			},
+			Processor: "visa",
+			IsFoo:     true,
+			Data: CardVisaData{
+				Foo: "embedded_foo",
+			},
+			JSON: cardEmbeddedJSON{
+				raw:       `{"processor":"visa","is_foo":true,"data":{"foo":"embedded_foo"},"metadata":{"created_at":"Mar 29 2024"},"value":"embedded_value"}`,
+				Processor: Field{raw: `"visa"`, status: valid},
+				IsFoo:     Field{raw: `true`, status: valid},
+				Data:      Field{raw: `{"foo":"embedded_foo"}`, status: valid},
+			},
+		},
+		Card{
+			Processor: "visa",
+			IsFoo:     true,
+			IsBar:     false,
+			Data: CardVisaData{
+				Foo: "embedded_foo",
+			},
+			Metadata: Metadata{
+				CreatedAt: "Mar 29 2024",
+			},
+			Value: "embedded_value",
+			JSON: cardJSON{
+				raw:       `{"processor":"visa","is_foo":true,"data":{"foo":"embedded_foo"},"metadata":{"created_at":"Mar 29 2024"},"value":"embedded_value"}`,
+				Processor: Field{raw: `"visa"`, status: 0x3},
+				IsFoo:     Field{raw: "true", status: 0x3},
+				Data:      Field{raw: `{"foo":"embedded_foo"}`, status: 0x3},
+				Metadata:  Field{raw: `{"created_at":"Mar 29 2024"}`, status: 0x3},
+				Value:     Field{raw: `"embedded_value"`, status: 0x3},
+			},
+		},
+	},
+}
+
+func TestPort(t *testing.T) {
+	for name, test := range portTests {
+		t.Run(name, func(t *testing.T) {
+			toVal := reflect.New(reflect.TypeOf(test.to))
+
+			err := Port(test.from, toVal.Interface())
+			if err != nil {
+				t.Fatalf("port of %v failed with error %v", test.from, err)
+			}
+
+			if !reflect.DeepEqual(toVal.Elem().Interface(), test.to) {
+				t.Fatalf("expected:\n%+#v\n\nto port to:\n%+#v\n\nbut got:\n%+#v", test.from, test.to, toVal.Elem().Interface())
+			}
+		})
+	}
+}
diff --git a/sdks/go/internal/apijson/registry.go b/sdks/go/internal/apijson/registry.go
new file mode 100644
index 00000000..2a249827
--- /dev/null
+++ b/sdks/go/internal/apijson/registry.go
@@ -0,0 +1,51 @@
+package apijson
+
+import (
+	"reflect"
+
+	"github.com/tidwall/gjson"
+)
+
+type UnionVariant struct {
+	TypeFilter         gjson.Type
+	DiscriminatorValue any
+	Type               reflect.Type
+}
+
+var unionRegistry = map[reflect.Type]unionEntry{}
+var unionVariants = map[reflect.Type]any{}
+
+type unionEntry struct {
+	discriminatorKey string
+	variants         []UnionVariant
+}
+
+func Discriminator[T any](value any) UnionVariant {
+	var zero T
+	return UnionVariant{
+		TypeFilter:         gjson.JSON,
+		DiscriminatorValue: value,
+		Type:               reflect.TypeOf(zero),
+	}
+}
+
+func RegisterUnion[T any](discriminator string, variants ...UnionVariant) {
+	typ := reflect.TypeOf((*T)(nil)).Elem()
+	unionRegistry[typ] = unionEntry{
+		discriminatorKey: discriminator,
+		variants:         variants,
+	}
+	for _, variant := range variants {
+		unionVariants[variant.Type] = typ
+	}
+}
+
+// Useful to wrap a union type to force it to use [apijson.UnmarshalJSON] since you cannot define an
+// UnmarshalJSON function on the interface itself.
+type UnionUnmarshaler[T any] struct {
+	Value T
+}
+
+func (c *UnionUnmarshaler[T]) UnmarshalJSON(buf []byte) error {
+	return UnmarshalRoot(buf, &c.Value)
+}
diff --git a/sdks/go/internal/apijson/subfield.go b/sdks/go/internal/apijson/subfield.go
new file mode 100644
index 00000000..55b02575
--- /dev/null
+++ b/sdks/go/internal/apijson/subfield.go
@@ -0,0 +1,67 @@
+package apijson
+
+import (
+	"github.com/kernel/hypeman-go/packages/respjson"
+	"reflect"
+)
+
+func getSubField(root reflect.Value, index []int, name string) reflect.Value {
+	strct := root.FieldByIndex(index[:len(index)-1])
+	if !strct.IsValid() {
+		panic("couldn't find encapsulating struct for field " + name)
+	}
+	meta := strct.FieldByName("JSON")
+	if !meta.IsValid() {
+		return reflect.Value{}
+	}
+	field := meta.FieldByName(name)
+	if !field.IsValid() {
+		return reflect.Value{}
+	}
+	return field
+}
+
+func setMetadataSubField(root reflect.Value, index []int, name string, meta Field) {
+	target := getSubField(root, index, name)
+	if !target.IsValid() {
+		return
+	}
+
+	if target.Type() == reflect.TypeOf(meta) {
+		target.Set(reflect.ValueOf(meta))
+	} else if respMeta := meta.toRespField(); target.Type() == reflect.TypeOf(respMeta) {
+		target.Set(reflect.ValueOf(respMeta))
+	}
+}
+
+func setMetadataExtraFields(root reflect.Value, index []int, name string, metaExtras map[string]Field) {
+	target := getSubField(root, index, name)
+	if !target.IsValid() {
+		return
+	}
+
+	if target.Type() == reflect.TypeOf(metaExtras) {
+		target.Set(reflect.ValueOf(metaExtras))
+		return
+	}
+
+	newMap := make(map[string]respjson.Field, len(metaExtras))
+	if target.Type() == reflect.TypeOf(newMap) {
+		for k, v := range metaExtras {
+			newMap[k] = v.toRespField()
+		}
+		target.Set(reflect.ValueOf(newMap))
+	}
+}
+
+func (f Field) toRespField() respjson.Field {
+	if f.IsMissing() {
+		return respjson.Field{}
+	} else if f.IsNull() {
+		return respjson.NewField("null")
+	} else if f.IsInvalid() {
+		return respjson.NewInvalidField(f.raw)
+	} else {
+		return respjson.NewField(f.raw)
+	}
+}
diff --git a/sdks/go/internal/apijson/tag.go b/sdks/go/internal/apijson/tag.go
new file mode 100644
index 00000000..49731b88
--- /dev/null
+++ b/sdks/go/internal/apijson/tag.go
@@ -0,0 +1,67 @@
+package apijson
+
+import (
+	"reflect"
+	"strings"
+)
+
+const apiStructTag = "api"
+const jsonStructTag = "json"
+const formatStructTag = "format"
+
+type parsedStructTag struct {
+	name     string
+	required bool
+	extras   bool
+	metadata bool
+	inline   bool
+}
+
+func parseJSONStructTag(field reflect.StructField) (tag parsedStructTag, ok bool) {
+	raw, ok := field.Tag.Lookup(jsonStructTag)
+	if !ok {
+		return
+	}
+	parts := strings.Split(raw, ",")
+	if len(parts) == 0 {
+		return tag, false
+	}
+	tag.name = parts[0]
+	for _, part := range parts[1:] {
+		switch part {
+		case "required":
+			tag.required = true
+		case "extras":
+			tag.extras = true
+		case "metadata":
+			tag.metadata = true
+		case "inline":
+			tag.inline = true
+		}
+	}
+
+	// the `api` struct tag is only used alongside `json` for custom behaviour
+	parseApiStructTag(field, &tag)
+	return
+}
+
+func parseApiStructTag(field reflect.StructField, tag *parsedStructTag) {
+	raw, ok := field.Tag.Lookup(apiStructTag)
+	if !ok {
+		return
+	}
+	parts := strings.Split(raw, ",")
+	for _, part := range parts {
+		switch part {
+		case "extrafields":
+			tag.extras = true
+		case "required":
+			tag.required = true
+		}
+	}
+}
+
+func parseFormatStructTag(field reflect.StructField) (format string, ok bool) {
+	format, ok = field.Tag.Lookup(formatStructTag)
+	return
+}
diff --git a/sdks/go/internal/apijson/union.go b/sdks/go/internal/apijson/union.go
new file mode 100644
index 00000000..fa66e16d
--- /dev/null
+++ b/sdks/go/internal/apijson/union.go
@@ -0,0 +1,208 @@
+package apijson
+
+import (
+	"errors"
+	"github.com/kernel/hypeman-go/packages/param"
+	"reflect"
+
+	"github.com/tidwall/gjson"
+)
+
+var apiUnionType = reflect.TypeOf(param.APIUnion{})
+
+func isStructUnion(t reflect.Type) bool {
+	if t.Kind() != reflect.Struct {
+		return false
+	}
+	for i := 0; i < t.NumField(); i++ {
+		if t.Field(i).Type == apiUnionType && t.Field(i).Anonymous {
+			return true
+		}
+	}
+	return false
+}
+
+func RegisterDiscriminatedUnion[T any](key string, mappings map[string]reflect.Type) {
+	var t T
+	entry := unionEntry{
+		discriminatorKey: key,
+		variants:         []UnionVariant{},
+	}
+	for k, typ := range mappings {
+		entry.variants = append(entry.variants, UnionVariant{
+			DiscriminatorValue: k,
+			Type:               typ,
+		})
+	}
+	unionRegistry[reflect.TypeOf(t)] = entry
+}
+
+func (d *decoderBuilder) newStructUnionDecoder(t reflect.Type) decoderFunc {
+	type variantDecoder struct {
+		decoder decoderFunc
+		field   reflect.StructField
+	}
+	decoders := []variantDecoder{}
+	for i := 0; i < t.NumField(); i++ {
+		field := t.Field(i)
+
+		if field.Anonymous && field.Type == apiUnionType {
+			continue
+		}
+
+		decoder := d.typeDecoder(field.Type)
+		decoders = append(decoders, variantDecoder{
+			decoder: decoder,
+			field:   field,
+		})
+	}
+
+	type discriminatedDecoder struct {
+		variantDecoder
+		discriminator any
+	}
+	discriminatedDecoders := []discriminatedDecoder{}
+	unionEntry, discriminated := unionRegistry[t]
+	for _, variant := range unionEntry.variants {
+		// For each union variant, find a matching decoder and save it
+		for _, decoder := range decoders {
+			if decoder.field.Type.Elem() == variant.Type {
+				discriminatedDecoders = append(discriminatedDecoders, discriminatedDecoder{
+					decoder,
+					variant.DiscriminatorValue,
+				})
+				break
+			}
+		}
+	}
+
+	return func(n gjson.Result, v reflect.Value, state *decoderState) error {
+		if discriminated && n.Type == gjson.JSON && len(unionEntry.discriminatorKey) != 0 {
+			discriminator := n.Get(EscapeSJSONKey(unionEntry.discriminatorKey)).Value()
+			for _, decoder := range discriminatedDecoders {
+				if discriminator == decoder.discriminator {
+					inner := v.FieldByIndex(decoder.field.Index)
+					return decoder.decoder(n, inner, state)
+				}
+			}
+			return errors.New("apijson: was not able to find discriminated union variant")
+		}
+
+		// Set bestExactness to worse than loose
+		bestExactness := loose - 1
+		bestVariant := -1
+		for i, decoder := range decoders {
+			// Pointers are used to discern JSON object variants from value variants
+			if n.Type != gjson.JSON && decoder.field.Type.Kind() == reflect.Ptr {
+				continue
+			}
+
+			sub := decoderState{strict: state.strict, exactness: exact}
+			inner := v.FieldByIndex(decoder.field.Index)
+			err := decoder.decoder(n, inner, &sub)
+			if err != nil {
+				continue
+			}
+			if sub.exactness == exact {
+				bestExactness = exact
+				bestVariant = i
+				break
+			}
+			if sub.exactness > bestExactness {
+				bestExactness = sub.exactness
+				bestVariant = i
+			}
+		}
+
+		if bestExactness < loose {
+			return errors.New("apijson: was not able to coerce type as union")
+		}
+
+		if guardStrict(state, bestExactness != exact) {
+			return errors.New("apijson: was not able to coerce type as union strictly")
+		}
+
+		for i := 0; i < len(decoders); i++ {
+			if i == bestVariant {
+				continue
+			}
+			v.FieldByIndex(decoders[i].field.Index).SetZero()
+		}
+
+		return nil
+	}
+}
+
+// newUnionDecoder returns a decoderFunc that deserializes into a union using an
+// algorithm roughly similar to Pydantic's [smart algorithm].
+//
+// Conceptually this is equivalent to choosing the best schema based on how 'exact'
+// the deserialization is for each of the schemas.
+//
+// If there is a tie in the level of exactness, then the tie is broken
+// left-to-right.
+//
+// [smart algorithm]: https://docs.pydantic.dev/latest/concepts/unions/#smart-mode
+func (d *decoderBuilder) newUnionDecoder(t reflect.Type) decoderFunc {
+	unionEntry, ok := unionRegistry[t]
+	if !ok {
+		panic("apijson: couldn't find union of type " + t.String() + " in union registry")
+	}
+	decoders := []decoderFunc{}
+	for _, variant := range unionEntry.variants {
+		decoder := d.typeDecoder(variant.Type)
+		decoders = append(decoders, decoder)
+	}
+	return func(n gjson.Result, v reflect.Value, state *decoderState) error {
+		// If there is a discriminator match, circumvent the exactness logic entirely
+		for idx, variant := range unionEntry.variants {
+			decoder := decoders[idx]
+			if variant.TypeFilter != n.Type {
+				continue
+			}
+
+			if len(unionEntry.discriminatorKey) != 0 {
+				discriminatorValue := n.Get(EscapeSJSONKey(unionEntry.discriminatorKey)).Value()
+				if discriminatorValue == variant.DiscriminatorValue {
+					inner := reflect.New(variant.Type).Elem()
+					err := decoder(n, inner, state)
+					v.Set(inner)
+					return err
+				}
+			}
+		}
+
+		// Set bestExactness to worse than loose
+		bestExactness := loose - 1
+		for idx, variant := range unionEntry.variants {
+			decoder := decoders[idx]
+			if variant.TypeFilter != n.Type {
+				continue
+			}
+			sub := decoderState{strict: state.strict, exactness: exact}
+			inner := reflect.New(variant.Type).Elem()
+			err := decoder(n, inner, &sub)
+			if err != nil {
+				continue
+			}
+			if sub.exactness == exact {
+				v.Set(inner)
+				return nil
+			}
+			if sub.exactness > bestExactness {
+				v.Set(inner)
+				bestExactness = sub.exactness
+			}
+		}
+
+		if bestExactness < loose {
+			return errors.New("apijson: was not able to coerce type as union")
+		}
+
+		if guardStrict(state, bestExactness != exact) {
+			return errors.New("apijson: was not able to coerce type as union strictly")
+		}
+
+		return nil
+	}
+}
diff --git a/sdks/go/internal/apiquery/encoder.go b/sdks/go/internal/apiquery/encoder.go
new file mode 100644
index 00000000..a98c29c1
--- /dev/null
+++ b/sdks/go/internal/apiquery/encoder.go
@@ -0,0 +1,415 @@
+package apiquery
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/kernel/hypeman-go/packages/param"
+)
+
+var encoders sync.Map // map[reflect.Type]encoderFunc
+
+type encoder struct {
+	dateFormat string
+	root       bool
+	settings   QuerySettings
+}
+
+type encoderFunc func(key string, value reflect.Value) ([]Pair, error)
+
+type encoderField struct {
+	tag parsedStructTag
+	fn  encoderFunc
+	idx []int
+}
+
+type encoderEntry struct {
+	reflect.Type
+	dateFormat string
+	root       bool
+	settings   QuerySettings
+}
+
+type Pair struct {
+	key   string
+	value string
+}
+
+func (e *encoder) typeEncoder(t reflect.Type) encoderFunc {
+	entry := encoderEntry{
+		Type:       t,
+		dateFormat: e.dateFormat,
+		root:       e.root,
+		settings:   e.settings,
+	}
+
+	if fi, ok := encoders.Load(entry); ok {
+		return fi.(encoderFunc)
+	}
+
+	// To deal with recursive types, populate the map with an
+	// indirect func before we build it. This type waits on the
+	// real func (f) to be ready and then calls it. This indirect
+	// func is only used for recursive types.
+	var (
+		wg sync.WaitGroup
+		f  encoderFunc
+	)
+	wg.Add(1)
+	fi, loaded := encoders.LoadOrStore(entry, encoderFunc(func(key string, v reflect.Value) ([]Pair, error) {
+		wg.Wait()
+		return f(key, v)
+	}))
+	if loaded {
+		return fi.(encoderFunc)
+	}
+
+	// Compute the real encoder and replace the indirect func with it.
+	f = e.newTypeEncoder(t)
+	wg.Done()
+	encoders.Store(entry, f)
+	return f
+}
+
+func marshalerEncoder(key string, value reflect.Value) ([]Pair, error) {
+	s, err := value.Interface().(json.Marshaler).MarshalJSON()
+	if err != nil {
+		return nil, fmt.Errorf("apiquery: json fallback marshal error %s", err)
+	}
+	return []Pair{{key, string(s)}}, nil
+}
+
+func (e *encoder) newTypeEncoder(t reflect.Type) encoderFunc {
+	if t.ConvertibleTo(reflect.TypeOf(time.Time{})) {
+		return e.newTimeTypeEncoder(t)
+	}
+
+	if t.Implements(reflect.TypeOf((*param.Optional)(nil)).Elem()) {
+		return e.newRichFieldTypeEncoder(t)
+	}
+
+	if !e.root && t.Implements(reflect.TypeOf((*json.Marshaler)(nil)).Elem()) {
+		return marshalerEncoder
+	}
+
+	e.root = false
+	switch t.Kind() {
+	case reflect.Pointer:
+		encoder := e.typeEncoder(t.Elem())
+		return func(key string, value reflect.Value) (pairs []Pair, err error) {
+			if !value.IsValid() || value.IsNil() {
+				return
+			}
+			return encoder(key, value.Elem())
+		}
+	case reflect.Struct:
+		return e.newStructTypeEncoder(t)
+	case reflect.Array:
+		fallthrough
+	case reflect.Slice:
+		return e.newArrayTypeEncoder(t)
+	case reflect.Map:
+		return e.newMapEncoder(t)
+	case reflect.Interface:
+		return e.newInterfaceEncoder()
+	default:
+		return e.newPrimitiveTypeEncoder(t)
+	}
+}
+
+func (e *encoder) newStructTypeEncoder(t reflect.Type) encoderFunc {
+	if t.Implements(reflect.TypeOf((*param.Optional)(nil)).Elem()) {
+		return e.newRichFieldTypeEncoder(t)
+	}
+
+	for i := 0; i < t.NumField(); i++ {
+		if t.Field(i).Type == paramUnionType && t.Field(i).Anonymous {
+			return e.newStructUnionTypeEncoder(t)
+		}
+	}
+
+	encoderFields := []encoderField{}
+
+	// This helper allows us to recursively collect field encoders into a flat
+	// array. The parameter `index` keeps track of the access patterns necessary
+	// to get to some field.
+	var collectEncoderFields func(r reflect.Type, index []int)
+	collectEncoderFields = func(r reflect.Type, index []int) {
+		for i := 0; i < r.NumField(); i++ {
+			idx := append(index, i)
+			field := t.FieldByIndex(idx)
+			if !field.IsExported() {
+				continue
+			}
+			// If this is an embedded struct, traverse one level deeper to extract
+			// the field and get their encoders as well.
+			if field.Anonymous {
+				collectEncoderFields(field.Type, idx)
+				continue
+			}
+			// If query tag is not present, then we skip, which is intentionally
+			// different behavior from the stdlib.
+			ptag, ok := parseQueryStructTag(field)
+			if !ok {
+				continue
+			}
+
+			if (ptag.name == "-" || ptag.name == "") && !ptag.inline {
+				continue
+			}
+
+			dateFormat, ok := parseFormatStructTag(field)
+			oldFormat := e.dateFormat
+			if ok {
+				switch dateFormat {
+				case "date-time":
+					e.dateFormat = time.RFC3339
+				case "date":
+					e.dateFormat = "2006-01-02"
+				}
+			}
+			var encoderFn encoderFunc
+			if ptag.omitzero {
+				typeEncoderFn := e.typeEncoder(field.Type)
+				encoderFn = func(key string, value reflect.Value) ([]Pair, error) {
+					if value.IsZero() {
+						return nil, nil
+					}
+					return typeEncoderFn(key, value)
+				}
+			} else {
+				encoderFn = e.typeEncoder(field.Type)
+			}
+			encoderFields = append(encoderFields, encoderField{ptag, encoderFn, idx})
+			e.dateFormat = oldFormat
+		}
+	}
+	collectEncoderFields(t, []int{})
+
+	return func(key string, value reflect.Value) (pairs []Pair, err error) {
+		for _, ef := range encoderFields {
+			var subkey string = e.renderKeyPath(key, ef.tag.name)
+			if ef.tag.inline {
+				subkey = key
+			}
+
+			field := value.FieldByIndex(ef.idx)
+			subpairs, suberr := ef.fn(subkey, field)
+			if suberr != nil {
+				err = suberr
+			}
+			pairs = append(pairs, subpairs...)
+		}
+		return
+	}
+}
+
+var paramUnionType = reflect.TypeOf((*param.APIUnion)(nil)).Elem()
+
+func (e *encoder) newStructUnionTypeEncoder(t reflect.Type) encoderFunc {
+	var fieldEncoders []encoderFunc
+	for i := 0; i < t.NumField(); i++ {
+		field := t.Field(i)
+		if field.Type == paramUnionType && field.Anonymous {
+			fieldEncoders = append(fieldEncoders, nil)
+			continue
+		}
+		fieldEncoders = append(fieldEncoders, e.typeEncoder(field.Type))
+	}
+
+	return func(key string, value reflect.Value) (pairs []Pair, err error) {
+		for i := 0; i < t.NumField(); i++ {
+			if value.Field(i).Type() == paramUnionType {
+				continue
+			}
+			if !value.Field(i).IsZero() {
+				return fieldEncoders[i](key, value.Field(i))
+			}
+		}
+		return nil, fmt.Errorf("apiquery: union %s has no field set", t.String())
+	}
+}
+
+func (e *encoder) newMapEncoder(t reflect.Type) encoderFunc {
+	keyEncoder := e.typeEncoder(t.Key())
+	elementEncoder := e.typeEncoder(t.Elem())
+	return func(key string, value reflect.Value) (pairs []Pair, err error) {
+		iter := value.MapRange()
+		for iter.Next() {
+			encodedKey, err := keyEncoder("", iter.Key())
+			if err != nil {
+				return nil, err
+			}
+			if len(encodedKey) != 1 {
+				return nil, fmt.Errorf("apiquery: unexpected number of parts for encoded map key, map may contain non-primitive")
+			}
+			subkey := encodedKey[0].value
+			keyPath := e.renderKeyPath(key, subkey)
+			subpairs, suberr := elementEncoder(keyPath, iter.Value())
+			if suberr != nil {
+				err = suberr
+			}
+			pairs = append(pairs, subpairs...)
+		}
+		return
+	}
+}
+
+func (e *encoder) renderKeyPath(key string, subkey string) string {
+	if len(key) == 0 {
+		return subkey
+	}
+	if e.settings.NestedFormat == NestedQueryFormatDots {
+		return fmt.Sprintf("%s.%s", key, subkey)
+	}
+	return fmt.Sprintf("%s[%s]", key, subkey)
+}
+
+func (e *encoder) newArrayTypeEncoder(t reflect.Type) encoderFunc {
+	switch e.settings.ArrayFormat {
+	case ArrayQueryFormatComma:
+		innerEncoder := e.typeEncoder(t.Elem())
+		return func(key string, v reflect.Value) ([]Pair, error) {
+			elements := []string{}
+			for i := 0; i < v.Len(); i++ {
+				innerPairs, err := innerEncoder("", v.Index(i))
+				if err != nil {
+					return nil, err
+				}
+				for _, pair := range innerPairs {
+					elements = append(elements, pair.value)
+				}
+			}
+			if len(elements) == 0 {
+				return []Pair{}, nil
+			}
+			return []Pair{{key, strings.Join(elements, ",")}}, nil
+		}
+	case ArrayQueryFormatRepeat:
+		innerEncoder := e.typeEncoder(t.Elem())
+		return func(key string, value reflect.Value) (pairs []Pair, err error) {
+			for i := 0; i < value.Len(); i++ {
+				subpairs, suberr := innerEncoder(key, value.Index(i))
+				if suberr != nil {
+					err = suberr
+				}
+				pairs = append(pairs, subpairs...)
+			}
+			return
+		}
+	case ArrayQueryFormatIndices:
+		panic("The array indices format is not supported yet")
+	case ArrayQueryFormatBrackets:
+		innerEncoder := e.typeEncoder(t.Elem())
+		return func(key string, value reflect.Value) (pairs []Pair, err error) {
+			pairs = []Pair{}
+			for i := 0; i < value.Len(); i++ {
+				subpairs, suberr := innerEncoder(key+"[]", value.Index(i))
+				if suberr != nil {
+					err = suberr
+				}
+				pairs = append(pairs, subpairs...)
+			}
+			return
+		}
+	default:
+		panic(fmt.Sprintf("Unknown ArrayFormat value: %d", e.settings.ArrayFormat))
+	}
+}
+
+func (e *encoder) newPrimitiveTypeEncoder(t reflect.Type) encoderFunc {
+	switch t.Kind() {
+	case reflect.Pointer:
+		inner := t.Elem()
+
+		innerEncoder := e.newPrimitiveTypeEncoder(inner)
+		return func(key string, v reflect.Value) ([]Pair, error) {
+			if !v.IsValid() || v.IsNil() {
+				return nil, nil
+			}
+			return innerEncoder(key, v.Elem())
+		}
+	case reflect.String:
+		return func(key string, v reflect.Value) ([]Pair, error) {
+			return []Pair{{key, v.String()}}, nil
+		}
+	case reflect.Bool:
+		return func(key string, v reflect.Value) ([]Pair, error) {
+			if v.Bool() {
+				return []Pair{{key, "true"}}, nil
+			}
+			return []Pair{{key, "false"}}, nil
+		}
+	case reflect.Int, reflect.Int16, reflect.Int32, reflect.Int64:
+		return func(key string, v reflect.Value) ([]Pair, error) {
+			return []Pair{{key, strconv.FormatInt(v.Int(), 10)}}, nil
+		}
+	case reflect.Uint, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return func(key string, v reflect.Value) ([]Pair, error) {
+			return []Pair{{key, strconv.FormatUint(v.Uint(), 10)}}, nil
+		}
+	case reflect.Float32, reflect.Float64:
+		return func(key string, v reflect.Value) ([]Pair, error) {
+			return []Pair{{key, strconv.FormatFloat(v.Float(), 'f', -1, 64)}}, nil
+		}
+	case reflect.Complex64, reflect.Complex128:
+		bitSize := 64
+		if t.Kind() == reflect.Complex128 {
+			bitSize = 128
+		}
+		return func(key string, v reflect.Value) ([]Pair, error) {
+			return []Pair{{key, strconv.FormatComplex(v.Complex(), 'f', -1, bitSize)}}, nil
+		}
+	default:
+		return func(key string, v reflect.Value) ([]Pair, error) {
+			return nil, nil
+		}
+	}
+}
+
+func (e *encoder) newFieldTypeEncoder(t reflect.Type) encoderFunc {
+	f, _ := t.FieldByName("Value")
+	enc := e.typeEncoder(f.Type)
+
+	return func(key string, value reflect.Value) ([]Pair, error) {
+		present := value.FieldByName("Present")
+		if !present.Bool() {
+			return nil, nil
+		}
+		null := value.FieldByName("Null")
+		if null.Bool() {
+			return nil, fmt.Errorf("apiquery: field cannot be null")
+		}
+		raw := value.FieldByName("Raw")
+		if !raw.IsNil() {
+			return e.typeEncoder(raw.Type())(key, raw)
+		}
+		return enc(key, value.FieldByName("Value"))
+	}
+}
+
+func (e *encoder) newTimeTypeEncoder(_ reflect.Type) encoderFunc {
+	format := e.dateFormat
+	return func(key string, value reflect.Value) ([]Pair, error) {
+		return []Pair{{
+			key,
+			value.Convert(reflect.TypeOf(time.Time{})).Interface().(time.Time).Format(format),
+		}}, nil
+	}
+}
+
+func (e encoder) newInterfaceEncoder() encoderFunc {
+	return func(key string, value reflect.Value) ([]Pair, error) {
+		value = value.Elem()
+		if !value.IsValid() {
+			return nil, nil
+		}
+		return e.typeEncoder(value.Type())(key, value)
+	}
+
+}
diff --git a/sdks/go/internal/apiquery/query.go b/sdks/go/internal/apiquery/query.go
new file mode 100644
index 00000000..0f379fa3
--- /dev/null
+++ b/sdks/go/internal/apiquery/query.go
@@ -0,0 +1,55 @@
+package apiquery
+
+import (
+	"net/url"
+	"reflect"
+	"time"
+)
+
+func MarshalWithSettings(value any, settings QuerySettings) (url.Values, error) {
+	e := encoder{time.RFC3339, true, settings}
+	kv := url.Values{}
+	val := reflect.ValueOf(value)
+	if !val.IsValid() {
+		return nil, nil
+	}
+	typ := val.Type()
+
+	pairs, err := e.typeEncoder(typ)("", val)
+	if err != nil {
+		return nil, err
+	}
+	for _, pair := range pairs {
+		kv.Add(pair.key, pair.value)
+	}
+	return kv, nil
+}
+
+func Marshal(value any) (url.Values, error) {
+	return MarshalWithSettings(value, QuerySettings{})
+}
+
+type Queryer interface {
+	URLQuery() (url.Values, error)
+}
+
+type QuerySettings struct {
+	NestedFormat NestedQueryFormat
+	ArrayFormat  ArrayQueryFormat
+}
+
+type NestedQueryFormat int
+
+const (
+	NestedQueryFormatBrackets NestedQueryFormat = iota
+	NestedQueryFormatDots
+)
+
+type ArrayQueryFormat int
+
+const (
+	ArrayQueryFormatComma ArrayQueryFormat = iota
+	ArrayQueryFormatRepeat
+	ArrayQueryFormatIndices
+	ArrayQueryFormatBrackets
+)
diff --git a/sdks/go/internal/apiquery/query_test.go b/sdks/go/internal/apiquery/query_test.go
new file mode 100644
index 00000000..d3d628e9
--- /dev/null
+++ b/sdks/go/internal/apiquery/query_test.go
@@ -0,0 +1,435 @@
+package apiquery
+
+import (
+	"github.com/kernel/hypeman-go/packages/param"
+	"net/url"
+	"testing"
+	"time"
+)
+
+func P[T any](v T) *T { return &v }
+
+type Primitives struct {
+	A bool    `query:"a"`
+	B int     `query:"b"`
+	C uint    `query:"c"`
+	D float64 `query:"d"`
+	E float32 `query:"e"`
+	F []int   `query:"f"`
+}
+
+type PrimitivePointers struct {
+	A *bool    `query:"a"`
+	B *int     `query:"b"`
+	C *uint    `query:"c"`
+	D *float64 `query:"d"`
+	E *float32 `query:"e"`
+	F *[]int   `query:"f"`
+}
+
+type Slices struct {
+	Slice []Primitives `query:"slices"`
+	Mixed []any        `query:"mixed"`
+}
+
+type DateTime struct {
+	Date     time.Time `query:"date" format:"date"`
+	DateTime time.Time `query:"date-time" format:"date-time"`
+}
+
+type AdditionalProperties struct {
+	A      bool           `query:"a"`
+	Extras map[string]any `query:"-,inline"`
+}
+
+type Recursive struct {
+	Name  string     `query:"name"`
+	Child *Recursive `query:"child"`
+}
+
+type UnknownStruct struct {
+	Unknown any `query:"unknown"`
+}
+
+type UnionStruct struct {
+	Union Union `query:"union" format:"date"`
+}
+
+type Union interface {
+	union()
+}
+
+type UnionInteger int64
+
+func (UnionInteger) union() {}
+
+type UnionString string
+
+func (UnionString) union() {}
+
+type UnionStructA struct {
+	Type string `query:"type"`
+	A    string `query:"a"`
+	B    string `query:"b"`
+}
+
+func (UnionStructA) union() {}
+
+type UnionStructB struct {
+	Type string `query:"type"`
+	A    string `query:"a"`
+}
+
+func (UnionStructB) union() {}
+
+type UnionTime time.Time
+
+func (UnionTime) union() {}
+
+type DeeplyNested struct {
+	A DeeplyNested1 `query:"a"`
+}
+
+type DeeplyNested1 struct {
+	B DeeplyNested2 `query:"b"`
+}
+
+type DeeplyNested2 struct {
+	C DeeplyNested3 `query:"c"`
+}
+
+type DeeplyNested3 struct {
+	D *string `query:"d"`
+}
+
+type RichPrimitives struct {
+	A param.Opt[string] `query:"a"`
+}
+
+type QueryOmitTest struct {
+	A param.Opt[string] `query:"a,omitzero"`
+	B string            `query:"b,omitzero"`
+}
+
+type NamedEnum string
+
+const NamedEnumFoo NamedEnum = "foo"
+
+type StructUnionWrapper struct {
+	Union StructUnion `query:"union"`
+}
+
+type StructUnion struct {
+	OfInt    param.Opt[int64]     `query:",omitzero,inline"`
+	OfString param.Opt[string]    `query:",omitzero,inline"`
+	OfEnum   param.Opt[NamedEnum] `query:",omitzero,inline"`
+	OfA      UnionStructA         `query:",omitzero,inline"`
+	OfB      UnionStructB         `query:",omitzero,inline"`
+	param.APIUnion
+}
+
+var tests = map[string]struct {
+	enc      string
+	val      any
+	settings QuerySettings
+}{
+	"primitives": {
+		"a=false&b=237628372683&c=654&d=9999.43&e=43.7599983215332&f=1,2,3,4",
+		Primitives{A: false, B: 237628372683, C: uint(654), D: 9999.43, E: 43.76, F: []int{1, 2, 3, 4}},
+		QuerySettings{},
+	},
+
+	"slices_brackets": {
+		`mixed[]=1&mixed[]=2.3&mixed[]=hello&slices[][a]=false&slices[][a]=false&slices[][b]=237628372683&slices[][b]=237628372683&slices[][c]=654&slices[][c]=654&slices[][d]=9999.43&slices[][d]=9999.43&slices[][e]=43.7599983215332&slices[][e]=43.7599983215332&slices[][f][]=1&slices[][f][]=2&slices[][f][]=3&slices[][f][]=4&slices[][f][]=1&slices[][f][]=2&slices[][f][]=3&slices[][f][]=4`,
+		Slices{
+			Slice: []Primitives{
+				{A: false, B: 237628372683, C: uint(654), D: 9999.43, E: 43.76, F: []int{1, 2, 3, 4}},
+				{A: false, B: 237628372683, C: uint(654), D: 9999.43, E: 43.76, F: []int{1, 2, 3, 4}},
+			},
+			Mixed: []any{1, 2.3, "hello"},
+		},
+		QuerySettings{ArrayFormat: ArrayQueryFormatBrackets},
+	},
+
+	"slices_comma": {
+		`mixed=1,2.3,hello`,
+		Slices{
+			Mixed: []any{1, 2.3, "hello"},
+		},
+		QuerySettings{ArrayFormat: ArrayQueryFormatComma},
+	},
+
+	"slices_repeat": {
+		`mixed=1&mixed=2.3&mixed=hello&slices[a]=false&slices[a]=false&slices[b]=237628372683&slices[b]=237628372683&slices[c]=654&slices[c]=654&slices[d]=9999.43&slices[d]=9999.43&slices[e]=43.7599983215332&slices[e]=43.7599983215332&slices[f]=1&slices[f]=2&slices[f]=3&slices[f]=4&slices[f]=1&slices[f]=2&slices[f]=3&slices[f]=4`,
+		Slices{
+			Slice: []Primitives{
+				{A: false, B: 237628372683, C: uint(654), D: 9999.43, E: 43.76, F: []int{1, 2, 3, 4}},
+				{A: false, B: 237628372683, C: uint(654), D: 9999.43, E: 43.76, F: []int{1, 2, 3, 4}},
+			},
+			Mixed: []any{1, 2.3, "hello"},
+		},
+		QuerySettings{ArrayFormat: ArrayQueryFormatRepeat},
+	},
+
+	"primitive_pointer_struct": {
+		"a=false&b=237628372683&c=654&d=9999.43&e=43.7599983215332&f=1,2,3,4,5",
+		PrimitivePointers{
+			A: P(false),
+			B: P(237628372683),
+			C: P(uint(654)),
+			D: P(9999.43),
+			E: P(float32(43.76)),
+			F: &[]int{1, 2, 3, 4, 5},
+		},
+		QuerySettings{},
+	},
+
+	"datetime_struct": {
+		`date=2006-01-02&date-time=2006-01-02T15:04:05Z`,
+		DateTime{
+			Date:     time.Date(2006, time.January, 2, 0, 0, 0, 0, time.UTC),
+			DateTime: time.Date(2006, time.January, 2, 15, 4, 5, 0, time.UTC),
+		},
+		QuerySettings{},
+	},
+
+	"additional_properties": {
+		`a=true&bar=value&foo=true`,
+		AdditionalProperties{
+			A: true,
+			Extras: map[string]any{
+				"bar": "value",
+				"foo": true,
+			},
+		},
+		QuerySettings{},
+	},
+
+	"recursive_struct_brackets": {
+		`child[name]=Alex&name=Robert`,
+		Recursive{Name: "Robert", Child: &Recursive{Name: "Alex"}},
+		QuerySettings{NestedFormat: NestedQueryFormatBrackets},
+	},
+
+	"recursive_struct_dots": {
+		`child.name=Alex&name=Robert`,
+		Recursive{Name: "Robert", Child: &Recursive{Name: "Alex"}},
+		QuerySettings{NestedFormat: NestedQueryFormatDots},
+	},
+
+	"unknown_struct_number": {
+		`unknown=12`,
+		UnknownStruct{
+			Unknown: 12.,
+		},
+		QuerySettings{},
+	},
+
+	"unknown_struct_map_brackets": {
+		`unknown[foo]=bar`,
+		UnknownStruct{
+			Unknown: map[string]any{
+				"foo": "bar",
+			},
+		},
+		QuerySettings{NestedFormat: NestedQueryFormatBrackets},
+	},
+
+	"unknown_struct_map_dots": {
+		`unknown.foo=bar`,
+		UnknownStruct{
+			Unknown: map[string]any{
+				"foo": "bar",
+			},
+		},
+		QuerySettings{NestedFormat: NestedQueryFormatDots},
+	},
+
+	"struct_union_string": {
+		`union=hello`,
+		StructUnionWrapper{
+			Union: StructUnion{OfString: param.NewOpt("hello")},
+		},
+		QuerySettings{},
+	},
+
+	"union_string": {
+		`union=hello`,
+		UnionStruct{
+			Union: UnionString("hello"),
+		},
+		QuerySettings{},
+	},
+
+	"struct_union_integer": {
+		`union=12`,
+		StructUnionWrapper{
+			Union: StructUnion{OfInt: param.NewOpt[int64](12)},
+		},
+		QuerySettings{},
+	},
+
+	"union_integer": {
+		`union=12`,
+		UnionStruct{
+			Union: UnionInteger(12),
+		},
+		QuerySettings{},
+	},
+
+	"struct_union_enum": {
+		`union=foo`,
+		StructUnionWrapper{
+			Union: StructUnion{OfEnum: param.NewOpt[NamedEnum](NamedEnumFoo)},
+		},
+		QuerySettings{},
+	},
+
+	"struct_union_struct_discriminated_a": {
+		`union[a]=foo&union[b]=bar&union[type]=typeA`,
+		StructUnionWrapper{
+			Union: StructUnion{OfA: UnionStructA{
+				Type: "typeA",
+				A:    "foo",
+				B:    "bar",
+			}},
+		},
+		QuerySettings{},
+	},
+
+	"union_struct_discriminated_a": {
+		`union[a]=foo&union[b]=bar&union[type]=typeA`,
+		UnionStruct{
+			Union: UnionStructA{
+				Type: "typeA",
+				A:    "foo",
+				B:    "bar",
+			},
+		},
+		QuerySettings{},
+	},
+
+	"struct_union_struct_discriminated_b": {
+		`union[a]=foo&union[type]=typeB`,
+		StructUnionWrapper{
+			Union: StructUnion{OfB: UnionStructB{
+				Type: "typeB",
+				A:    "foo",
+			}},
+		},
+		QuerySettings{},
+	},
+
+	"union_struct_discriminated_b": {
+		`union[a]=foo&union[type]=typeB`,
+		UnionStruct{
+			Union: UnionStructB{
+				Type: "typeB",
+				A:    "foo",
+			},
+		},
+		QuerySettings{},
+	},
+
+	"union_struct_time": {
+		`union=2010-05-23`,
+		UnionStruct{
+			Union: UnionTime(time.Date(2010, 05, 23, 0, 0, 0, 0, time.UTC)),
+		},
+		QuerySettings{},
+	},
+
+	"deeply_nested_brackets": {
+		`a[b][c][d]=hello`,
+		DeeplyNested{
+			A: DeeplyNested1{
+				B: DeeplyNested2{
+					C: DeeplyNested3{
+						D: P("hello"),
+					},
+				},
+			},
+		},
+		QuerySettings{NestedFormat: NestedQueryFormatBrackets},
+	},
+
+	"deeply_nested_dots": {
+		`a.b.c.d=hello`,
+		DeeplyNested{
+			A: DeeplyNested1{
+				B: DeeplyNested2{
+					C: DeeplyNested3{
+						D: P("hello"),
+					},
+				},
+			},
+		},
+		QuerySettings{NestedFormat: NestedQueryFormatDots},
+	},
+
+	"deeply_nested_brackets_empty": {
+		``,
+		DeeplyNested{
+			A: DeeplyNested1{
+				B: DeeplyNested2{
+					C: DeeplyNested3{
+						D: nil,
+					},
+				},
+			},
+		},
+		QuerySettings{NestedFormat: NestedQueryFormatBrackets},
+	},
+
+	"deeply_nested_dots_empty": {
+		``,
+		DeeplyNested{
+			A: DeeplyNested1{
+				B: DeeplyNested2{
+					C: DeeplyNested3{
+						D: nil,
+					},
+				},
+			},
+		},
+		QuerySettings{NestedFormat: NestedQueryFormatDots},
+	},
+
+	"rich_primitives": {
+		`a=hello`,
+		RichPrimitives{
+			A: param.Opt[string]{Value: "hello"},
+		},
+		QuerySettings{},
+	},
+
+	"rich_primitives_omit": {
+		``,
+		QueryOmitTest{
+			A: param.Opt[string]{},
+		},
+		QuerySettings{},
+	},
+	"query_omit": {
+		`a=hello`,
+		QueryOmitTest{
+			A: param.Opt[string]{Value: "hello"},
+		},
+		QuerySettings{},
+	},
+}
+
+func TestEncode(t *testing.T) {
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			values, err := MarshalWithSettings(test.val, test.settings)
+			if err != nil {
+				t.Fatalf("failed to marshal url %s", err)
+			}
+			str, _ := url.QueryUnescape(values.Encode())
+			if str != test.enc {
+				t.Fatalf("expected %+#v to serialize to %s but got %s", test.val, test.enc, str)
+			}
+		})
+	}
+}
diff --git a/sdks/go/internal/apiquery/richparam.go b/sdks/go/internal/apiquery/richparam.go
new file mode 100644
index 00000000..ef67c230
--- /dev/null
+++ b/sdks/go/internal/apiquery/richparam.go
@@ -0,0 +1,19 @@
+package apiquery
+
+import (
+	"github.com/kernel/hypeman-go/packages/param"
+	"reflect"
+)
+
+func (e *encoder) newRichFieldTypeEncoder(t reflect.Type) encoderFunc {
+	f, _ := t.FieldByName("Value")
+	enc := e.typeEncoder(f.Type)
+	return func(key string, value reflect.Value) ([]Pair, error) {
+		if opt, ok := value.Interface().(param.Optional); ok && opt.Valid() {
+			return enc(key, value.FieldByIndex(f.Index))
+		} else if ok && param.IsNull(opt) {
+			return []Pair{{key, "null"}}, nil
+		}
+		return nil, nil
+	}
+}
diff --git a/sdks/go/internal/apiquery/tag.go b/sdks/go/internal/apiquery/tag.go
new file mode 100644
index 00000000..772c40e1
--- /dev/null
+++ b/sdks/go/internal/apiquery/tag.go
@@ -0,0 +1,44 @@
+package apiquery
+
+import (
+	"reflect"
+	"strings"
+)
+
+const queryStructTag = "query"
+const formatStructTag = "format"
+
+type parsedStructTag struct {
+	name      string
+	omitempty bool
+	omitzero  bool
+	inline    bool
+}
+
+func parseQueryStructTag(field reflect.StructField) (tag parsedStructTag, ok bool) {
+	raw, ok := field.Tag.Lookup(queryStructTag)
+	if !ok {
+		return
+	}
+	parts := strings.Split(raw, ",")
+	if len(parts) == 0 {
+		return tag, false
+	}
+	tag.name = parts[0]
+	for _, part := range parts[1:] {
+		switch part {
+		case "omitzero":
+			tag.omitzero = true
+		case "omitempty":
+			tag.omitempty = true
+		case "inline":
+			tag.inline = true
+		}
+	}
+	return
+}
+
+func parseFormatStructTag(field reflect.StructField) (format string, ok bool) {
+	format, ok = field.Tag.Lookup(formatStructTag)
+	return
+}
diff --git a/sdks/go/internal/encoding/json/decode.go b/sdks/go/internal/encoding/json/decode.go
new file mode 100644
index 00000000..2c6b0958
--- /dev/null
+++ b/sdks/go/internal/encoding/json/decode.go
@@ -0,0 +1,1324 @@
+// Vendored from Go 1.24.0-pre-release
+// To find alterations, check package shims, and comments beginning in SHIM().
+//
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Represents JSON data structure using native Go types: booleans, floats,
+// strings, arrays, and maps.
+
+package json
+
+import (
+	"encoding"
+	"encoding/base64"
+	"fmt"
+	"github.com/kernel/hypeman-go/internal/encoding/json/shims"
+	"reflect"
+	"strconv"
+	"strings"
+	"unicode"
+	"unicode/utf16"
+	"unicode/utf8"
+	_ "unsafe" // for linkname
+)
+
+// Unmarshal parses the JSON-encoded data and stores the result
+// in the value pointed to by v. If v is nil or not a pointer,
+// Unmarshal returns an [InvalidUnmarshalError].
+//
+// Unmarshal uses the inverse of the encodings that
+// [Marshal] uses, allocating maps, slices, and pointers as necessary,
+// with the following additional rules:
+//
+// To unmarshal JSON into a pointer, Unmarshal first handles the case of
+// the JSON being the JSON literal null. In that case, Unmarshal sets
+// the pointer to nil. Otherwise, Unmarshal unmarshals the JSON into
+// the value pointed at by the pointer. If the pointer is nil, Unmarshal
+// allocates a new value for it to point to.
+//
+// To unmarshal JSON into a value implementing [Unmarshaler],
+// Unmarshal calls that value's [Unmarshaler.UnmarshalJSON] method, including
+// when the input is a JSON null.
+// Otherwise, if the value implements [encoding.TextUnmarshaler]
+// and the input is a JSON quoted string, Unmarshal calls
+// [encoding.TextUnmarshaler.UnmarshalText] with the unquoted form of the string.
+//
+// To unmarshal JSON into a struct, Unmarshal matches incoming object
+// keys to the keys used by [Marshal] (either the struct field name or its tag),
+// preferring an exact match but also accepting a case-insensitive match. By
+// default, object keys which don't have a corresponding struct field are
+// ignored (see [Decoder.DisallowUnknownFields] for an alternative).
+//
+// To unmarshal JSON into an interface value,
+// Unmarshal stores one of these in the interface value:
+//
+//   - bool, for JSON booleans
+//   - float64, for JSON numbers
+//   - string, for JSON strings
+//   - []any, for JSON arrays
+//   - map[string]any, for JSON objects
+//   - nil for JSON null
+//
+// To unmarshal a JSON array into a slice, Unmarshal resets the slice length
+// to zero and then appends each element to the slice.
+// As a special case, to unmarshal an empty JSON array into a slice,
+// Unmarshal replaces the slice with a new empty slice.
+//
+// To unmarshal a JSON array into a Go array, Unmarshal decodes
+// JSON array elements into corresponding Go array elements.
+// If the Go array is smaller than the JSON array,
+// the additional JSON array elements are discarded.
+// If the JSON array is smaller than the Go array,
+// the additional Go array elements are set to zero values.
+//
+// To unmarshal a JSON object into a map, Unmarshal first establishes a map to
+// use. If the map is nil, Unmarshal allocates a new map. Otherwise Unmarshal
+// reuses the existing map, keeping existing entries. Unmarshal then stores
+// key-value pairs from the JSON object into the map. The map's key type must
+// either be any string type, an integer, or implement [encoding.TextUnmarshaler].
+//
+// If the JSON-encoded data contain a syntax error, Unmarshal returns a [SyntaxError].
+//
+// If a JSON value is not appropriate for a given target type,
+// or if a JSON number overflows the target type, Unmarshal
+// skips that field and completes the unmarshaling as best it can.
+// If no more serious errors are encountered, Unmarshal returns
+// an [UnmarshalTypeError] describing the earliest such error. In any
+// case, it's not guaranteed that all the remaining fields following
+// the problematic one will be unmarshaled into the target object.
+//
+// The JSON null value unmarshals into an interface, map, pointer, or slice
+// by setting that Go value to nil. Because null is often used in JSON to mean
+// “not present,” unmarshaling a JSON null into any other Go type has no effect
+// on the value and produces no error.
+//
+// When unmarshaling quoted strings, invalid UTF-8 or
+// invalid UTF-16 surrogate pairs are not treated as an error.
+// Instead, they are replaced by the Unicode replacement
+// character U+FFFD.
+func Unmarshal(data []byte, v any) error {
+	// Check for well-formedness.
+	// Avoids filling out half a data structure
+	// before discovering a JSON syntax error.
+	var d decodeState
+	err := checkValid(data, &d.scan)
+	if err != nil {
+		return err
+	}
+
+	d.init(data)
+	return d.unmarshal(v)
+}
+
+// Unmarshaler is the interface implemented by types
+// that can unmarshal a JSON description of themselves.
+// The input can be assumed to be a valid encoding of
+// a JSON value. UnmarshalJSON must copy the JSON data
+// if it wishes to retain the data after returning.
+//
+// By convention, to approximate the behavior of [Unmarshal] itself,
+// Unmarshalers implement UnmarshalJSON([]byte("null")) as a no-op.
+type Unmarshaler interface {
+	UnmarshalJSON([]byte) error
+}
+
+// An UnmarshalTypeError describes a JSON value that was
+// not appropriate for a value of a specific Go type.
+type UnmarshalTypeError struct {
+	Value  string       // description of JSON value - "bool", "array", "number -5"
+	Type   reflect.Type // type of Go value it could not be assigned to
+	Offset int64        // error occurred after reading Offset bytes
+	Struct string       // name of the struct type containing the field
+	Field  string       // the full path from root node to the field, include embedded struct
+}
+
+func (e *UnmarshalTypeError) Error() string {
+	if e.Struct != "" || e.Field != "" {
+		return "json: cannot unmarshal " + e.Value + " into Go struct field " + e.Struct + "." + e.Field + " of type " + e.Type.String()
+	}
+	return "json: cannot unmarshal " + e.Value + " into Go value of type " + e.Type.String()
+}
+
+// An UnmarshalFieldError describes a JSON object key that
+// led to an unexported (and therefore unwritable) struct field.
+//
+// Deprecated: No longer used; kept for compatibility.
+type UnmarshalFieldError struct {
+	Key   string
+	Type  reflect.Type
+	Field reflect.StructField
+}
+
+func (e *UnmarshalFieldError) Error() string {
+	return "json: cannot unmarshal object key " + strconv.Quote(e.Key) + " into unexported field " + e.Field.Name + " of type " + e.Type.String()
+}
+
+// An InvalidUnmarshalError describes an invalid argument passed to [Unmarshal].
+// (The argument to [Unmarshal] must be a non-nil pointer.)
+type InvalidUnmarshalError struct {
+	Type reflect.Type
+}
+
+func (e *InvalidUnmarshalError) Error() string {
+	if e.Type == nil {
+		return "json: Unmarshal(nil)"
+	}
+
+	if e.Type.Kind() != reflect.Pointer {
+		return "json: Unmarshal(non-pointer " + e.Type.String() + ")"
+	}
+	return "json: Unmarshal(nil " + e.Type.String() + ")"
+}
+
+func (d *decodeState) unmarshal(v any) error {
+	rv := reflect.ValueOf(v)
+	if rv.Kind() != reflect.Pointer || rv.IsNil() {
+		return &InvalidUnmarshalError{reflect.TypeOf(v)}
+	}
+
+	d.scan.reset()
+	d.scanWhile(scanSkipSpace)
+	// We decode rv not rv.Elem because the Unmarshaler interface
+	// test must be applied at the top level of the value.
+	err := d.value(rv)
+	if err != nil {
+		return d.addErrorContext(err)
+	}
+	return d.savedError
+}
+
+// A Number represents a JSON number literal.
+type Number string
+
+// String returns the literal text of the number.
+func (n Number) String() string { return string(n) }
+
+// Float64 returns the number as a float64.
+func (n Number) Float64() (float64, error) {
+	return strconv.ParseFloat(string(n), 64)
+}
+
+// Int64 returns the number as an int64.
+func (n Number) Int64() (int64, error) {
+	return strconv.ParseInt(string(n), 10, 64)
+}
+
+// An errorContext provides context for type errors during decoding.
+type errorContext struct {
+	Struct     reflect.Type
+	FieldStack []string
+}
+
+// decodeState represents the state while decoding a JSON value.
+type decodeState struct {
+	data                  []byte
+	off                   int // next read offset in data
+	opcode                int // last read result
+	scan                  scanner
+	errorContext          *errorContext
+	savedError            error
+	useNumber             bool
+	disallowUnknownFields bool
+}
+
+// readIndex returns the position of the last byte read.
+func (d *decodeState) readIndex() int {
+	return d.off - 1
+}
+
+// phasePanicMsg is used as a panic message when we end up with something that
+// shouldn't happen. It can indicate a bug in the JSON decoder, or that
+// something is editing the data slice while the decoder executes.
+const phasePanicMsg = "JSON decoder out of sync - data changing underfoot?"
+
+func (d *decodeState) init(data []byte) *decodeState {
+	d.data = data
+	d.off = 0
+	d.savedError = nil
+	if d.errorContext != nil {
+		d.errorContext.Struct = nil
+		// Reuse the allocated space for the FieldStack slice.
+		d.errorContext.FieldStack = d.errorContext.FieldStack[:0]
+	}
+	return d
+}
+
+// saveError saves the first err it is called with,
+// for reporting at the end of the unmarshal.
+func (d *decodeState) saveError(err error) {
+	if d.savedError == nil {
+		d.savedError = d.addErrorContext(err)
+	}
+}
+
+// addErrorContext returns a new error enhanced with information from d.errorContext
+func (d *decodeState) addErrorContext(err error) error {
+	if d.errorContext != nil && (d.errorContext.Struct != nil || len(d.errorContext.FieldStack) > 0) {
+		switch err := err.(type) {
+		case *UnmarshalTypeError:
+			err.Struct = d.errorContext.Struct.Name()
+			fieldStack := d.errorContext.FieldStack
+			if err.Field != "" {
+				fieldStack = append(fieldStack, err.Field)
+			}
+			err.Field = strings.Join(fieldStack, ".")
+		}
+	}
+	return err
+}
+
+// skip scans to the end of what was started.
+func (d *decodeState) skip() {
+	s, data, i := &d.scan, d.data, d.off
+	depth := len(s.parseState)
+	for {
+		op := s.step(s, data[i])
+		i++
+		if len(s.parseState) < depth {
+			d.off = i
+			d.opcode = op
+			return
+		}
+	}
+}
+
+// scanNext processes the byte at d.data[d.off].
+func (d *decodeState) scanNext() {
+	if d.off < len(d.data) {
+		d.opcode = d.scan.step(&d.scan, d.data[d.off])
+		d.off++
+	} else {
+		d.opcode = d.scan.eof()
+		d.off = len(d.data) + 1 // mark processed EOF with len+1
+	}
+}
+
+// scanWhile processes bytes in d.data[d.off:] until it
+// receives a scan code not equal to op.
+func (d *decodeState) scanWhile(op int) {
+	s, data, i := &d.scan, d.data, d.off
+	for i < len(data) {
+		newOp := s.step(s, data[i])
+		i++
+		if newOp != op {
+			d.opcode = newOp
+			d.off = i
+			return
+		}
+	}
+
+	d.off = len(data) + 1 // mark processed EOF with len+1
+	d.opcode = d.scan.eof()
+}
+
+// rescanLiteral is similar to scanWhile(scanContinue), but it specialises the
+// common case where we're decoding a literal. The decoder scans the input
+// twice, once for syntax errors and to check the length of the value, and the
+// second to perform the decoding.
+//
+// Only in the second step do we use decodeState to tokenize literals, so we
+// know there aren't any syntax errors. We can take advantage of that knowledge,
+// and scan a literal's bytes much more quickly.
+func (d *decodeState) rescanLiteral() {
+	data, i := d.data, d.off
+Switch:
+	switch data[i-1] {
+	case '"': // string
+		for ; i < len(data); i++ {
+			switch data[i] {
+			case '\\':
+				i++ // escaped char
+			case '"':
+				i++ // tokenize the closing quote too
+				break Switch
+			}
+		}
+	case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '-': // number
+		for ; i < len(data); i++ {
+			switch data[i] {
+			case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
+				'.', 'e', 'E', '+', '-':
+			default:
+				break Switch
+			}
+		}
+	case 't': // true
+		i += len("rue")
+	case 'f': // false
+		i += len("alse")
+	case 'n': // null
+		i += len("ull")
+	}
+	if i < len(data) {
+		d.opcode = stateEndValue(&d.scan, data[i])
+	} else {
+		d.opcode = scanEnd
+	}
+	d.off = i + 1
+}
+
+// value consumes a JSON value from d.data[d.off-1:], decoding into v, and
+// reads the following byte ahead. If v is invalid, the value is discarded.
+// The first byte of the value has been read already.
+func (d *decodeState) value(v reflect.Value) error {
+	switch d.opcode {
+	default:
+		panic(phasePanicMsg)
+
+	case scanBeginArray:
+		if v.IsValid() {
+			if err := d.array(v); err != nil {
+				return err
+			}
+		} else {
+			d.skip()
+		}
+		d.scanNext()
+
+	case scanBeginObject:
+		if v.IsValid() {
+			if err := d.object(v); err != nil {
+				return err
+			}
+		} else {
+			d.skip()
+		}
+		d.scanNext()
+
+	case scanBeginLiteral:
+		// All bytes inside literal return scanContinue op code.
+		start := d.readIndex()
+		d.rescanLiteral()
+
+		if v.IsValid() {
+			if err := d.literalStore(d.data[start:d.readIndex()], v, false); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+type unquotedValue struct{}
+
+// valueQuoted is like value but decodes a
+// quoted string literal or literal null into an interface value.
+// If it finds anything other than a quoted string literal or null,
+// valueQuoted returns unquotedValue{}.
+func (d *decodeState) valueQuoted() any {
+	switch d.opcode {
+	default:
+		panic(phasePanicMsg)
+
+	case scanBeginArray, scanBeginObject:
+		d.skip()
+		d.scanNext()
+
+	case scanBeginLiteral:
+		v := d.literalInterface()
+		switch v.(type) {
+		case nil, string:
+			return v
+		}
+	}
+	return unquotedValue{}
+}
+
+// indirect walks down v allocating pointers as needed,
+// until it gets to a non-pointer.
+// If it encounters an Unmarshaler, indirect stops and returns that.
+// If decodingNull is true, indirect stops at the first settable pointer so it
+// can be set to nil.
+func indirect(v reflect.Value, decodingNull bool) (Unmarshaler, encoding.TextUnmarshaler, reflect.Value) {
+	// Issue #24153 indicates that it is generally not a guaranteed property
+	// that you may round-trip a reflect.Value by calling Value.Addr().Elem()
+	// and expect the value to still be settable for values derived from
+	// unexported embedded struct fields.
+	//
+	// The logic below effectively does this when it first addresses the value
+	// (to satisfy possible pointer methods) and continues to dereference
+	// subsequent pointers as necessary.
+	//
+	// After the first round-trip, we set v back to the original value to
+	// preserve the original RW flags contained in reflect.Value.
+	v0 := v
+	haveAddr := false
+
+	// If v is a named type and is addressable,
+	// start with its address, so that if the type has pointer methods,
+	// we find them.
+	if v.Kind() != reflect.Pointer && v.Type().Name() != "" && v.CanAddr() {
+		haveAddr = true
+		v = v.Addr()
+	}
+	for {
+		// Load value from interface, but only if the result will be
+		// usefully addressable.
+		if v.Kind() == reflect.Interface && !v.IsNil() {
+			e := v.Elem()
+			if e.Kind() == reflect.Pointer && !e.IsNil() && (!decodingNull || e.Elem().Kind() == reflect.Pointer) {
+				haveAddr = false
+				v = e
+				continue
+			}
+		}
+
+		if v.Kind() != reflect.Pointer {
+			break
+		}
+
+		if decodingNull && v.CanSet() {
+			break
+		}
+
+		// Prevent infinite loop if v is an interface pointing to its own address:
+		//     var v any
+		//     v = &v
+		if v.Elem().Kind() == reflect.Interface && v.Elem().Elem().Equal(v) {
+			v = v.Elem()
+			break
+		}
+		if v.IsNil() {
+			v.Set(reflect.New(v.Type().Elem()))
+		}
+		if v.Type().NumMethod() > 0 && v.CanInterface() {
+			if u, ok := v.Interface().(Unmarshaler); ok {
+				return u, nil, reflect.Value{}
+			}
+			if !decodingNull {
+				if u, ok := v.Interface().(encoding.TextUnmarshaler); ok {
+					return nil, u, reflect.Value{}
+				}
+			}
+		}
+
+		if haveAddr {
+			v = v0 // restore original value after round-trip Value.Addr().Elem()
+			haveAddr = false
+		} else {
+			v = v.Elem()
+		}
+	}
+	return nil, nil, v
+}
+
+// array consumes an array from d.data[d.off-1:], decoding into v.
+// The first byte of the array ('[') has been read already.
+func (d *decodeState) array(v reflect.Value) error {
+	// Check for unmarshaler.
+	u, ut, pv := indirect(v, false)
+	if u != nil {
+		start := d.readIndex()
+		d.skip()
+		return u.UnmarshalJSON(d.data[start:d.off])
+	}
+	if ut != nil {
+		d.saveError(&UnmarshalTypeError{Value: "array", Type: v.Type(), Offset: int64(d.off)})
+		d.skip()
+		return nil
+	}
+	v = pv
+
+	// Check type of target.
+	switch v.Kind() {
+	case reflect.Interface:
+		if v.NumMethod() == 0 {
+			// Decoding into nil interface? Switch to non-reflect code.
+			ai := d.arrayInterface()
+			v.Set(reflect.ValueOf(ai))
+			return nil
+		}
+		// Otherwise it's invalid.
+		fallthrough
+	default:
+		d.saveError(&UnmarshalTypeError{Value: "array", Type: v.Type(), Offset: int64(d.off)})
+		d.skip()
+		return nil
+	case reflect.Array, reflect.Slice:
+		break
+	}
+
+	i := 0
+	for {
+		// Look ahead for ] - can only happen on first iteration.
+		d.scanWhile(scanSkipSpace)
+		if d.opcode == scanEndArray {
+			break
+		}
+
+		// Expand slice length, growing the slice if necessary.
+		if v.Kind() == reflect.Slice {
+			if i >= v.Cap() {
+				v.Grow(1)
+			}
+			if i >= v.Len() {
+				v.SetLen(i + 1)
+			}
+		}
+
+		if i < v.Len() {
+			// Decode into element.
+			if err := d.value(v.Index(i)); err != nil {
+				return err
+			}
+		} else {
+			// Ran out of fixed array: skip.
+			if err := d.value(reflect.Value{}); err != nil {
+				return err
+			}
+		}
+		i++
+
+		// Next token must be , or ].
+		if d.opcode == scanSkipSpace {
+			d.scanWhile(scanSkipSpace)
+		}
+		if d.opcode == scanEndArray {
+			break
+		}
+		if d.opcode != scanArrayValue {
+			panic(phasePanicMsg)
+		}
+	}
+
+	if i < v.Len() {
+		if v.Kind() == reflect.Array {
+			for ; i < v.Len(); i++ {
+				v.Index(i).SetZero() // zero remainder of array
+			}
+		} else {
+			v.SetLen(i) // truncate the slice
+		}
+	}
+	if i == 0 && v.Kind() == reflect.Slice {
+		v.Set(reflect.MakeSlice(v.Type(), 0, 0))
+	}
+	return nil
+}
+
+var nullLiteral = []byte("null")
+
+// SHIM(reflect): reflect.TypeFor[T]() reflect.T
+var textUnmarshalerType = shims.TypeFor[encoding.TextUnmarshaler]()
+
+// object consumes an object from d.data[d.off-1:], decoding into v.
+// The first byte ('{') of the object has been read already.
+func (d *decodeState) object(v reflect.Value) error {
+	// Check for unmarshaler.
+	u, ut, pv := indirect(v, false)
+	if u != nil {
+		start := d.readIndex()
+		d.skip()
+		return u.UnmarshalJSON(d.data[start:d.off])
+	}
+	if ut != nil {
+		d.saveError(&UnmarshalTypeError{Value: "object", Type: v.Type(), Offset: int64(d.off)})
+		d.skip()
+		return nil
+	}
+	v = pv
+	t := v.Type()
+
+	// Decoding into nil interface? Switch to non-reflect code.
+	if v.Kind() == reflect.Interface && v.NumMethod() == 0 {
+		oi := d.objectInterface()
+		v.Set(reflect.ValueOf(oi))
+		return nil
+	}
+
+	var fields structFields
+
+	// Check type of target:
+	//   struct or
+	//   map[T1]T2 where T1 is string, an integer type,
+	//             or an encoding.TextUnmarshaler
+	switch v.Kind() {
+	case reflect.Map:
+		// Map key must either have string kind, have an integer kind,
+		// or be an encoding.TextUnmarshaler.
+		switch t.Key().Kind() {
+		case reflect.String,
+			reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+			reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		default:
+			if !reflect.PointerTo(t.Key()).Implements(textUnmarshalerType) {
+				d.saveError(&UnmarshalTypeError{Value: "object", Type: t, Offset: int64(d.off)})
+				d.skip()
+				return nil
+			}
+		}
+		if v.IsNil() {
+			v.Set(reflect.MakeMap(t))
+		}
+	case reflect.Struct:
+		fields = cachedTypeFields(t)
+		// ok
+	default:
+		d.saveError(&UnmarshalTypeError{Value: "object", Type: t, Offset: int64(d.off)})
+		d.skip()
+		return nil
+	}
+
+	var mapElem reflect.Value
+	var origErrorContext errorContext
+	if d.errorContext != nil {
+		origErrorContext = *d.errorContext
+	}
+
+	for {
+		// Read opening " of string key or closing }.
+		d.scanWhile(scanSkipSpace)
+		if d.opcode == scanEndObject {
+			// closing } - can only happen on first iteration.
+			break
+		}
+		if d.opcode != scanBeginLiteral {
+			panic(phasePanicMsg)
+		}
+
+		// Read key.
+		start := d.readIndex()
+		d.rescanLiteral()
+		item := d.data[start:d.readIndex()]
+		key, ok := unquoteBytes(item)
+		if !ok {
+			panic(phasePanicMsg)
+		}
+
+		// Figure out field corresponding to key.
+		var subv reflect.Value
+		destring := false // whether the value is wrapped in a string to be decoded first
+
+		if v.Kind() == reflect.Map {
+			elemType := t.Elem()
+			if !mapElem.IsValid() {
+				mapElem = reflect.New(elemType).Elem()
+			} else {
+				mapElem.SetZero()
+			}
+			subv = mapElem
+		} else {
+			f := fields.byExactName[string(key)]
+			if f == nil {
+				f = fields.byFoldedName[string(foldName(key))]
+			}
+			if f != nil {
+				subv = v
+				destring = f.quoted
+				if d.errorContext == nil {
+					d.errorContext = new(errorContext)
+				}
+				for i, ind := range f.index {
+					if subv.Kind() == reflect.Pointer {
+						if subv.IsNil() {
+							// If a struct embeds a pointer to an unexported type,
+							// it is not possible to set a newly allocated value
+							// since the field is unexported.
+							//
+							// See https://golang.org/issue/21357
+							if !subv.CanSet() {
+								d.saveError(fmt.Errorf("json: cannot set embedded pointer to unexported struct: %v", subv.Type().Elem()))
+								// Invalidate subv to ensure d.value(subv) skips over
+								// the JSON value without assigning it to subv.
+								subv = reflect.Value{}
+								destring = false
+								break
+							}
+							subv.Set(reflect.New(subv.Type().Elem()))
+						}
+						subv = subv.Elem()
+					}
+					if i < len(f.index)-1 {
+						d.errorContext.FieldStack = append(
+							d.errorContext.FieldStack,
+							subv.Type().Field(ind).Name,
+						)
+					}
+					subv = subv.Field(ind)
+				}
+				d.errorContext.Struct = t
+				d.errorContext.FieldStack = append(d.errorContext.FieldStack, f.name)
+			} else if d.disallowUnknownFields {
+				d.saveError(fmt.Errorf("json: unknown field %q", key))
+			}
+		}
+
+		// Read : before value.
+		if d.opcode == scanSkipSpace {
+			d.scanWhile(scanSkipSpace)
+		}
+		if d.opcode != scanObjectKey {
+			panic(phasePanicMsg)
+		}
+		d.scanWhile(scanSkipSpace)
+
+		if destring {
+			switch qv := d.valueQuoted().(type) {
+			case nil:
+				if err := d.literalStore(nullLiteral, subv, false); err != nil {
+					return err
+				}
+			case string:
+				if err := d.literalStore([]byte(qv), subv, true); err != nil {
+					return err
+				}
+			default:
+				d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal unquoted value into %v", subv.Type()))
+			}
+		} else {
+			if err := d.value(subv); err != nil {
+				return err
+			}
+		}
+
+		// Write value back to map;
+		// if using struct, subv points into struct already.
+		if v.Kind() == reflect.Map {
+			kt := t.Key()
+			var kv reflect.Value
+			if reflect.PointerTo(kt).Implements(textUnmarshalerType) {
+				kv = reflect.New(kt)
+				if err := d.literalStore(item, kv, true); err != nil {
+					return err
+				}
+				kv = kv.Elem()
+			} else {
+				switch kt.Kind() {
+				case reflect.String:
+					kv = reflect.New(kt).Elem()
+					kv.SetString(string(key))
+				case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+					s := string(key)
+					n, err := strconv.ParseInt(s, 10, 64)
+					// SHIM(reflect): reflect.Type.OverflowInt(int64) bool
+					okt := shims.OverflowableType{Type: kt}
+					if err != nil || okt.OverflowInt(n) {
+						d.saveError(&UnmarshalTypeError{Value: "number " + s, Type: kt, Offset: int64(start + 1)})
+						break
+					}
+					kv = reflect.New(kt).Elem()
+					kv.SetInt(n)
+				case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+					s := string(key)
+					n, err := strconv.ParseUint(s, 10, 64)
+					// SHIM(reflect): reflect.Type.OverflowUint(uint64) bool
+					okt := shims.OverflowableType{Type: kt}
+					if err != nil || okt.OverflowUint(n) {
+						d.saveError(&UnmarshalTypeError{Value: "number " + s, Type: kt, Offset: int64(start + 1)})
+						break
+					}
+					kv = reflect.New(kt).Elem()
+					kv.SetUint(n)
+				default:
+					panic("json: Unexpected key type") // should never occur
+				}
+			}
+			if kv.IsValid() {
+				v.SetMapIndex(kv, subv)
+			}
+		}
+
+		// Next token must be , or }.
+		if d.opcode == scanSkipSpace {
+			d.scanWhile(scanSkipSpace)
+		}
+		if d.errorContext != nil {
+			// Reset errorContext to its original state.
+			// Keep the same underlying array for FieldStack, to reuse the
+			// space and avoid unnecessary allocs.
+			d.errorContext.FieldStack = d.errorContext.FieldStack[:len(origErrorContext.FieldStack)]
+			d.errorContext.Struct = origErrorContext.Struct
+		}
+		if d.opcode == scanEndObject {
+			break
+		}
+		if d.opcode != scanObjectValue {
+			panic(phasePanicMsg)
+		}
+	}
+	return nil
+}
+
+// convertNumber converts the number literal s to a float64 or a Number
+// depending on the setting of d.useNumber.
+func (d *decodeState) convertNumber(s string) (any, error) {
+	if d.useNumber {
+		return Number(s), nil
+	}
+	f, err := strconv.ParseFloat(s, 64)
+	if err != nil {
+		// SHIM(reflect): reflect.TypeFor[T]() reflect.Type
+		return nil, &UnmarshalTypeError{Value: "number " + s, Type: shims.TypeFor[float64](), Offset: int64(d.off)}
+	}
+	return f, nil
+}
+
+// SHIM(reflect): TypeFor[T]() reflect.Type
+var numberType = shims.TypeFor[Number]()
+
+// literalStore decodes a literal stored in item into v.
+//
+// fromQuoted indicates whether this literal came from unwrapping a
+// string from the ",string" struct tag option. this is used only to
+// produce more helpful error messages.
+func (d *decodeState) literalStore(item []byte, v reflect.Value, fromQuoted bool) error {
+	// Check for unmarshaler.
+	if len(item) == 0 {
+		// Empty string given.
+		d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+		return nil
+	}
+	isNull := item[0] == 'n' // null
+	u, ut, pv := indirect(v, isNull)
+	if u != nil {
+		return u.UnmarshalJSON(item)
+	}
+	if ut != nil {
+		if item[0] != '"' {
+			if fromQuoted {
+				d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+				return nil
+			}
+			val := "number"
+			switch item[0] {
+			case 'n':
+				val = "null"
+			case 't', 'f':
+				val = "bool"
+			}
+			d.saveError(&UnmarshalTypeError{Value: val, Type: v.Type(), Offset: int64(d.readIndex())})
+			return nil
+		}
+		s, ok := unquoteBytes(item)
+		if !ok {
+			if fromQuoted {
+				return fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type())
+			}
+			panic(phasePanicMsg)
+		}
+		return ut.UnmarshalText(s)
+	}
+
+	v = pv
+
+	switch c := item[0]; c {
+	case 'n': // null
+		// The main parser checks that only true and false can reach here,
+		// but if this was a quoted string input, it could be anything.
+		if fromQuoted && string(item) != "null" {
+			d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+			break
+		}
+		switch v.Kind() {
+		case reflect.Interface, reflect.Pointer, reflect.Map, reflect.Slice:
+			v.SetZero()
+			// otherwise, ignore null for primitives/string
+		}
+	case 't', 'f': // true, false
+		value := item[0] == 't'
+		// The main parser checks that only true and false can reach here,
+		// but if this was a quoted string input, it could be anything.
+		if fromQuoted && string(item) != "true" && string(item) != "false" {
+			d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+			break
+		}
+		switch v.Kind() {
+		default:
+			if fromQuoted {
+				d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+			} else {
+				d.saveError(&UnmarshalTypeError{Value: "bool", Type: v.Type(), Offset: int64(d.readIndex())})
+			}
+		case reflect.Bool:
+			v.SetBool(value)
+		case reflect.Interface:
+			if v.NumMethod() == 0 {
+				v.Set(reflect.ValueOf(value))
+			} else {
+				d.saveError(&UnmarshalTypeError{Value: "bool", Type: v.Type(), Offset: int64(d.readIndex())})
+			}
+		}
+
+	case '"': // string
+		s, ok := unquoteBytes(item)
+		if !ok {
+			if fromQuoted {
+				return fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type())
+			}
+			panic(phasePanicMsg)
+		}
+		switch v.Kind() {
+		default:
+			d.saveError(&UnmarshalTypeError{Value: "string", Type: v.Type(), Offset: int64(d.readIndex())})
+		case reflect.Slice:
+			if v.Type().Elem().Kind() != reflect.Uint8 {
+				d.saveError(&UnmarshalTypeError{Value: "string", Type: v.Type(), Offset: int64(d.readIndex())})
+				break
+			}
+			b := make([]byte, base64.StdEncoding.DecodedLen(len(s)))
+			n, err := base64.StdEncoding.Decode(b, s)
+			if err != nil {
+				d.saveError(err)
+				break
+			}
+			v.SetBytes(b[:n])
+		case reflect.String:
+			t := string(s)
+			if v.Type() == numberType && !isValidNumber(t) {
+				return fmt.Errorf("json: invalid number literal, trying to unmarshal %q into Number", item)
+			}
+			v.SetString(t)
+		case reflect.Interface:
+			if v.NumMethod() == 0 {
+				v.Set(reflect.ValueOf(string(s)))
+			} else {
+				d.saveError(&UnmarshalTypeError{Value: "string", Type: v.Type(), Offset: int64(d.readIndex())})
+			}
+		}
+
+	default: // number
+		if c != '-' && (c < '0' || c > '9') {
+			if fromQuoted {
+				return fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type())
+			}
+			panic(phasePanicMsg)
+		}
+		switch v.Kind() {
+		default:
+			if v.Kind() == reflect.String && v.Type() == numberType {
+				// s must be a valid number, because it's
+				// already been tokenized.
+				v.SetString(string(item))
+				break
+			}
+			if fromQuoted {
+				return fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type())
+			}
+			d.saveError(&UnmarshalTypeError{Value: "number", Type: v.Type(), Offset: int64(d.readIndex())})
+		case reflect.Interface:
+			n, err := d.convertNumber(string(item))
+			if err != nil {
+				d.saveError(err)
+				break
+			}
+			if v.NumMethod() != 0 {
+				d.saveError(&UnmarshalTypeError{Value: "number", Type: v.Type(), Offset: int64(d.readIndex())})
+				break
+			}
+			v.Set(reflect.ValueOf(n))
+
+		case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+			n, err := strconv.ParseInt(string(item), 10, 64)
+			if err != nil || v.OverflowInt(n) {
+				d.saveError(&UnmarshalTypeError{Value: "number " + string(item), Type: v.Type(), Offset: int64(d.readIndex())})
+				break
+			}
+			v.SetInt(n)
+
+		case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+			n, err := strconv.ParseUint(string(item), 10, 64)
+			if err != nil || v.OverflowUint(n) {
+				d.saveError(&UnmarshalTypeError{Value: "number " + string(item), Type: v.Type(), Offset: int64(d.readIndex())})
+				break
+			}
+			v.SetUint(n)
+
+		case reflect.Float32, reflect.Float64:
+			n, err := strconv.ParseFloat(string(item), v.Type().Bits())
+			if err != nil || v.OverflowFloat(n) {
+				d.saveError(&UnmarshalTypeError{Value: "number " + string(item), Type: v.Type(), Offset: int64(d.readIndex())})
+				break
+			}
+			v.SetFloat(n)
+		}
+	}
+	return nil
+}
+
+// The xxxInterface routines build up a value to be stored
+// in an empty interface. They are not strictly necessary,
+// but they avoid the weight of reflection in this common case.
+
+// valueInterface is like value but returns any.
+func (d *decodeState) valueInterface() (val any) {
+	switch d.opcode {
+	default:
+		panic(phasePanicMsg)
+	case scanBeginArray:
+		val = d.arrayInterface()
+		d.scanNext()
+	case scanBeginObject:
+		val = d.objectInterface()
+		d.scanNext()
+	case scanBeginLiteral:
+		val = d.literalInterface()
+	}
+	return
+}
+
+// arrayInterface is like array but returns []any.
+func (d *decodeState) arrayInterface() []any {
+	var v = make([]any, 0)
+	for {
+		// Look ahead for ] - can only happen on first iteration.
+		d.scanWhile(scanSkipSpace)
+		if d.opcode == scanEndArray {
+			break
+		}
+
+		v = append(v, d.valueInterface())
+
+		// Next token must be , or ].
+		if d.opcode == scanSkipSpace {
+			d.scanWhile(scanSkipSpace)
+		}
+		if d.opcode == scanEndArray {
+			break
+		}
+		if d.opcode != scanArrayValue {
+			panic(phasePanicMsg)
+		}
+	}
+	return v
+}
+
+// objectInterface is like object but returns map[string]any.
+func (d *decodeState) objectInterface() map[string]any {
+	m := make(map[string]any)
+	for {
+		// Read opening " of string key or closing }.
+		d.scanWhile(scanSkipSpace)
+		if d.opcode == scanEndObject {
+			// closing } - can only happen on first iteration.
+			break
+		}
+		if d.opcode != scanBeginLiteral {
+			panic(phasePanicMsg)
+		}
+
+		// Read string key.
+		start := d.readIndex()
+		d.rescanLiteral()
+		item := d.data[start:d.readIndex()]
+		key, ok := unquote(item)
+		if !ok {
+			panic(phasePanicMsg)
+		}
+
+		// Read : before value.
+		if d.opcode == scanSkipSpace {
+			d.scanWhile(scanSkipSpace)
+		}
+		if d.opcode != scanObjectKey {
+			panic(phasePanicMsg)
+		}
+		d.scanWhile(scanSkipSpace)
+
+		// Read value.
+		m[key] = d.valueInterface()
+
+		// Next token must be , or }.
+		if d.opcode == scanSkipSpace {
+			d.scanWhile(scanSkipSpace)
+		}
+		if d.opcode == scanEndObject {
+			break
+		}
+		if d.opcode != scanObjectValue {
+			panic(phasePanicMsg)
+		}
+	}
+	return m
+}
+
+// literalInterface consumes and returns a literal from d.data[d.off-1:] and
+// it reads the following byte ahead. The first byte of the literal has been
+// read already (that's how the caller knows it's a literal).
+func (d *decodeState) literalInterface() any {
+	// All bytes inside literal return scanContinue op code.
+	start := d.readIndex()
+	d.rescanLiteral()
+
+	item := d.data[start:d.readIndex()]
+
+	switch c := item[0]; c {
+	case 'n': // null
+		return nil
+
+	case 't', 'f': // true, false
+		return c == 't'
+
+	case '"': // string
+		s, ok := unquote(item)
+		if !ok {
+			panic(phasePanicMsg)
+		}
+		return s
+
+	default: // number
+		if c != '-' && (c < '0' || c > '9') {
+			panic(phasePanicMsg)
+		}
+		n, err := d.convertNumber(string(item))
+		if err != nil {
+			d.saveError(err)
+		}
+		return n
+	}
+}
+
+// getu4 decodes \uXXXX from the beginning of s, returning the hex value,
+// or it returns -1.
+func getu4(s []byte) rune {
+	if len(s) < 6 || s[0] != '\\' || s[1] != 'u' {
+		return -1
+	}
+	var r rune
+	for _, c := range s[2:6] {
+		switch {
+		case '0' <= c && c <= '9':
+			c = c - '0'
+		case 'a' <= c && c <= 'f':
+			c = c - 'a' + 10
+		case 'A' <= c && c <= 'F':
+			c = c - 'A' + 10
+		default:
+			return -1
+		}
+		r = r*16 + rune(c)
+	}
+	return r
+}
+
+// unquote converts a quoted JSON string literal s into an actual string t.
+// The rules are different than for Go, so cannot use strconv.Unquote.
+func unquote(s []byte) (t string, ok bool) {
+	s, ok = unquoteBytes(s)
+	t = string(s)
+	return
+}
+
+// unquoteBytes should be an internal detail,
+// but widely used packages access it using linkname.
+// Notable members of the hall of shame include:
+//   - github.com/bytedance/sonic
+//
+// Do not remove or change the type signature.
+// See go.dev/issue/67401.
+//
+//go:linkname unquoteBytes
+func unquoteBytes(s []byte) (t []byte, ok bool) {
+	if len(s) < 2 || s[0] != '"' || s[len(s)-1] != '"' {
+		return
+	}
+	s = s[1 : len(s)-1]
+
+	// Check for unusual characters. If there are none,
+	// then no unquoting is needed, so return a slice of the
+	// original bytes.
+	r := 0
+	for r < len(s) {
+		c := s[r]
+		if c == '\\' || c == '"' || c < ' ' {
+			break
+		}
+		if c < utf8.RuneSelf {
+			r++
+			continue
+		}
+		rr, size := utf8.DecodeRune(s[r:])
+		if rr == utf8.RuneError && size == 1 {
+			break
+		}
+		r += size
+	}
+	if r == len(s) {
+		return s, true
+	}
+
+	b := make([]byte, len(s)+2*utf8.UTFMax)
+	w := copy(b, s[0:r])
+	for r < len(s) {
+		// Out of room? Can only happen if s is full of
+		// malformed UTF-8 and we're replacing each
+		// byte with RuneError.
+		if w >= len(b)-2*utf8.UTFMax {
+			nb := make([]byte, (len(b)+utf8.UTFMax)*2)
+			copy(nb, b[0:w])
+			b = nb
+		}
+		switch c := s[r]; {
+		case c == '\\':
+			r++
+			if r >= len(s) {
+				return
+			}
+			switch s[r] {
+			default:
+				return
+			case '"', '\\', '/', '\'':
+				b[w] = s[r]
+				r++
+				w++
+			case 'b':
+				b[w] = '\b'
+				r++
+				w++
+			case 'f':
+				b[w] = '\f'
+				r++
+				w++
+			case 'n':
+				b[w] = '\n'
+				r++
+				w++
+			case 'r':
+				b[w] = '\r'
+				r++
+				w++
+			case 't':
+				b[w] = '\t'
+				r++
+				w++
+			case 'u':
+				r--
+				rr := getu4(s[r:])
+				if rr < 0 {
+					return
+				}
+				r += 6
+				if utf16.IsSurrogate(rr) {
+					rr1 := getu4(s[r:])
+					if dec := utf16.DecodeRune(rr, rr1); dec != unicode.ReplacementChar {
+						// A valid pair; consume.
+						r += 6
+						w += utf8.EncodeRune(b[w:], dec)
+						break
+					}
+					// Invalid surrogate; fall back to replacement rune.
+					rr = unicode.ReplacementChar
+				}
+				w += utf8.EncodeRune(b[w:], rr)
+			}
+
+		// Quote, control characters are invalid.
+		case c == '"', c < ' ':
+			return
+
+		// ASCII
+		case c < utf8.RuneSelf:
+			b[w] = c
+			r++
+			w++
+
+		// Coerce to well-formed UTF-8.
+		default:
+			rr, size := utf8.DecodeRune(s[r:])
+			r += size
+			w += utf8.EncodeRune(b[w:], rr)
+		}
+	}
+	return b[0:w], true
+}
diff --git a/sdks/go/internal/encoding/json/encode.go b/sdks/go/internal/encoding/json/encode.go
new file mode 100644
index 00000000..bdd596e2
--- /dev/null
+++ b/sdks/go/internal/encoding/json/encode.go
@@ -0,0 +1,1395 @@
+// Vendored from Go 1.24.0-pre-release
+// To find alterations, check package shims, and comments beginning in SHIM().
+//
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package json implements encoding and decoding of JSON as defined in
+// RFC 7159. The mapping between JSON and Go values is described
+// in the documentation for the Marshal and Unmarshal functions.
+//
+// See "JSON and Go" for an introduction to this package:
+// https://golang.org/doc/articles/json_and_go.html
+package json
+
+import (
+	"bytes"
+	"cmp"
+	"encoding"
+	"encoding/base64"
+	"fmt"
+	"github.com/kernel/hypeman-go/internal/encoding/json/sentinel"
+	"github.com/kernel/hypeman-go/internal/encoding/json/shims"
+	"math"
+	"reflect"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"unicode"
+	"unicode/utf8"
+	_ "unsafe" // for linkname
+)
+
+// Marshal returns the JSON encoding of v.
+//
+// Marshal traverses the value v recursively.
+// If an encountered value implements [Marshaler]
+// and is not a nil pointer, Marshal calls [Marshaler.MarshalJSON]
+// to produce JSON. If no [Marshaler.MarshalJSON] method is present but the
+// value implements [encoding.TextMarshaler] instead, Marshal calls
+// [encoding.TextMarshaler.MarshalText] and encodes the result as a JSON string.
+// The nil pointer exception is not strictly necessary
+// but mimics a similar, necessary exception in the behavior of
+// [Unmarshaler.UnmarshalJSON].
+//
+// Otherwise, Marshal uses the following type-dependent default encodings:
+//
+// Boolean values encode as JSON booleans.
+//
+// Floating point, integer, and [Number] values encode as JSON numbers.
+// NaN and +/-Inf values will return an [UnsupportedValueError].
+//
+// String values encode as JSON strings coerced to valid UTF-8,
+// replacing invalid bytes with the Unicode replacement rune.
+// So that the JSON will be safe to embed inside HTML <script> tags,
+// the string is encoded using [HTMLEscape],
+// which replaces "<", ">", "&", U+2028, and U+2029 are escaped
+// to "\u003c","\u003e", "\u0026", "\u2028", and "\u2029".
+// This replacement can be disabled when using an [Encoder],
+// by calling [Encoder.SetEscapeHTML](false).
+//
+// Array and slice values encode as JSON arrays, except that
+// []byte encodes as a base64-encoded string, and a nil slice
+// encodes as the null JSON value.
+//
+// Struct values encode as JSON objects.
+// Each exported struct field becomes a member of the object, using the
+// field name as the object key, unless the field is omitted for one of the
+// reasons given below.
+//
+// The encoding of each struct field can be customized by the format string
+// stored under the "json" key in the struct field's tag.
+// The format string gives the name of the field, possibly followed by a
+// comma-separated list of options. The name may be empty in order to
+// specify options without overriding the default field name.
+//
+// The "omitempty" option specifies that the field should be omitted
+// from the encoding if the field has an empty value, defined as
+// false, 0, a nil pointer, a nil interface value, and any array,
+// slice, map, or string of length zero.
+//
+// As a special case, if the field tag is "-", the field is always omitted.
+// Note that a field with name "-" can still be generated using the tag "-,".
+//
+// Examples of struct field tags and their meanings:
+//
+//	// Field appears in JSON as key "myName".
+//	Field int `json:"myName"`
+//
+//	// Field appears in JSON as key "myName" and
+//	// the field is omitted from the object if its value is empty,
+//	// as defined above.
+//	Field int `json:"myName,omitempty"`
+//
+//	// Field appears in JSON as key "Field" (the default), but
+//	// the field is skipped if empty.
+//	// Note the leading comma.
+//	Field int `json:",omitempty"`
+//
+//	// Field is ignored by this package.
+//	Field int `json:"-"`
+//
+//	// Field appears in JSON as key "-".
+//	Field int `json:"-,"`
+//
+// The "omitzero" option specifies that the field should be omitted
+// from the encoding if the field has a zero value, according to rules:
+//
+// 1) If the field type has an "IsZero() bool" method, that will be used to
+// determine whether the value is zero.
+//
+// 2) Otherwise, the value is zero if it is the zero value for its type.
+//
+// If both "omitempty" and "omitzero" are specified, the field will be omitted
+// if the value is either empty or zero (or both).
+//
+// The "string" option signals that a field is stored as JSON inside a
+// JSON-encoded string. It applies only to fields of string, floating point,
+// integer, or boolean types. This extra level of encoding is sometimes used
+// when communicating with JavaScript programs:
+//
+//	Int64String int64 `json:",string"`
+//
+// The key name will be used if it's a non-empty string consisting of
+// only Unicode letters, digits, and ASCII punctuation except quotation
+// marks, backslash, and comma.
+//
+// Embedded struct fields are usually marshaled as if their inner exported fields
+// were fields in the outer struct, subject to the usual Go visibility rules amended
+// as described in the next paragraph.
+// An anonymous struct field with a name given in its JSON tag is treated as
+// having that name, rather than being anonymous.
+// An anonymous struct field of interface type is treated the same as having
+// that type as its name, rather than being anonymous.
+//
+// The Go visibility rules for struct fields are amended for JSON when
+// deciding which field to marshal or unmarshal. If there are
+// multiple fields at the same level, and that level is the least
+// nested (and would therefore be the nesting level selected by the
+// usual Go rules), the following extra rules apply:
+//
+// 1) Of those fields, if any are JSON-tagged, only tagged fields are considered,
+// even if there are multiple untagged fields that would otherwise conflict.
+//
+// 2) If there is exactly one field (tagged or not according to the first rule), that is selected.
+//
+// 3) Otherwise there are multiple fields, and all are ignored; no error occurs.
+//
+// Handling of anonymous struct fields is new in Go 1.1.
+// Prior to Go 1.1, anonymous struct fields were ignored. To force ignoring of
+// an anonymous struct field in both current and earlier versions, give the field
+// a JSON tag of "-".
+//
+// Map values encode as JSON objects. The map's key type must either be a
+// string, an integer type, or implement [encoding.TextMarshaler]. The map keys
+// are sorted and used as JSON object keys by applying the following rules,
+// subject to the UTF-8 coercion described for string values above:
+//   - keys of any string type are used directly
+//   - keys that implement [encoding.TextMarshaler] are marshaled
+//   - integer keys are converted to strings
+//
+// Pointer values encode as the value pointed to.
+// A nil pointer encodes as the null JSON value.
+//
+// Interface values encode as the value contained in the interface.
+// A nil interface value encodes as the null JSON value.
+//
+// Channel, complex, and function values cannot be encoded in JSON.
+// Attempting to encode such a value causes Marshal to return
+// an [UnsupportedTypeError].
+//
+// JSON cannot represent cyclic data structures and Marshal does not
+// handle them. Passing cyclic structures to Marshal will result in
+// an error.
+func Marshal(v any) ([]byte, error) {
+	e := newEncodeState()
+	defer encodeStatePool.Put(e)
+
+	// SHIM(begin): don't escape HTML by default
+	err := e.marshal(v, encOpts{escapeHTML: shims.EscapeHTMLByDefault})
+	// ORIGINAL:
+	//  err := e.marshal(v, encOpts{escapeHTML: true})
+	// SHIM(end)
+	if err != nil {
+		return nil, err
+	}
+	buf := append([]byte(nil), e.Bytes()...)
+
+	return buf, nil
+}
+
+// MarshalIndent is like [Marshal] but applies [Indent] to format the output.
+// Each JSON element in the output will begin on a new line beginning with prefix
+// followed by one or more copies of indent according to the indentation nesting.
+func MarshalIndent(v any, prefix, indent string) ([]byte, error) {
+	b, err := Marshal(v)
+	if err != nil {
+		return nil, err
+	}
+	b2 := make([]byte, 0, indentGrowthFactor*len(b))
+	b2, err = appendIndent(b2, b, prefix, indent)
+	if err != nil {
+		return nil, err
+	}
+	return b2, nil
+}
+
+// Marshaler is the interface implemented by types that
+// can marshal themselves into valid JSON.
+type Marshaler interface {
+	MarshalJSON() ([]byte, error)
+}
+
+// An UnsupportedTypeError is returned by [Marshal] when attempting
+// to encode an unsupported value type.
+type UnsupportedTypeError struct {
+	Type reflect.Type
+}
+
+func (e *UnsupportedTypeError) Error() string {
+	return "json: unsupported type: " + e.Type.String()
+}
+
+// An UnsupportedValueError is returned by [Marshal] when attempting
+// to encode an unsupported value.
+type UnsupportedValueError struct {
+	Value reflect.Value
+	Str   string
+}
+
+func (e *UnsupportedValueError) Error() string {
+	return "json: unsupported value: " + e.Str
+}
+
+// Before Go 1.2, an InvalidUTF8Error was returned by [Marshal] when
+// attempting to encode a string value with invalid UTF-8 sequences.
+// As of Go 1.2, [Marshal] instead coerces the string to valid UTF-8 by
+// replacing invalid bytes with the Unicode replacement rune U+FFFD.
+//
+// Deprecated: No longer used; kept for compatibility.
+type InvalidUTF8Error struct {
+	S string // the whole string value that caused the error
+}
+
+func (e *InvalidUTF8Error) Error() string {
+	return "json: invalid UTF-8 in string: " + strconv.Quote(e.S)
+}
+
+// A MarshalerError represents an error from calling a
+// [Marshaler.MarshalJSON] or [encoding.TextMarshaler.MarshalText] method.
+type MarshalerError struct {
+	Type       reflect.Type
+	Err        error
+	sourceFunc string
+}
+
+func (e *MarshalerError) Error() string {
+	srcFunc := e.sourceFunc
+	if srcFunc == "" {
+		srcFunc = "MarshalJSON"
+	}
+	return "json: error calling " + srcFunc +
+		" for type " + e.Type.String() +
+		": " + e.Err.Error()
+}
+
+// Unwrap returns the underlying error.
+func (e *MarshalerError) Unwrap() error { return e.Err }
+
+const hex = "0123456789abcdef"
+
+// An encodeState encodes JSON into a bytes.Buffer.
+type encodeState struct {
+	bytes.Buffer // accumulated output
+
+	// Keep track of what pointers we've seen in the current recursive call
+	// path, to avoid cycles that could lead to a stack overflow. Only do
+	// the relatively expensive map operations if ptrLevel is larger than
+	// startDetectingCyclesAfter, so that we skip the work if we're within a
+	// reasonable amount of nested pointers deep.
+	ptrLevel uint
+	ptrSeen  map[any]struct{}
+}
+
+const startDetectingCyclesAfter = 1000
+
+var encodeStatePool sync.Pool
+
+func newEncodeState() *encodeState {
+	if v := encodeStatePool.Get(); v != nil {
+		e := v.(*encodeState)
+		e.Reset()
+		if len(e.ptrSeen) > 0 {
+			panic("ptrEncoder.encode should have emptied ptrSeen via defers")
+		}
+		e.ptrLevel = 0
+		return e
+	}
+	return &encodeState{ptrSeen: make(map[any]struct{})}
+}
+
+// jsonError is an error wrapper type for internal use only.
+// Panics with errors are wrapped in jsonError so that the top-level recover
+// can distinguish intentional panics from this package.
+type jsonError struct{ error }
+
+func (e *encodeState) marshal(v any, opts encOpts) (err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			if je, ok := r.(jsonError); ok {
+				err = je.error
+			} else {
+				panic(r)
+			}
+		}
+	}()
+	e.reflectValue(reflect.ValueOf(v), opts)
+	return nil
+}
+
+// error aborts the encoding by panicking with err wrapped in jsonError.
+func (e *encodeState) error(err error) {
+	panic(jsonError{err})
+}
+
+func isEmptyValue(v reflect.Value) bool {
+	switch v.Kind() {
+	case reflect.String:
+		return v.Len() == 0
+	case reflect.Array, reflect.Map, reflect.Slice:
+		return v.Len() == 0
+	case reflect.Bool,
+		reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+		reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr,
+		reflect.Float32, reflect.Float64,
+		reflect.Interface, reflect.Pointer:
+		return v.IsZero()
+	}
+	return false
+}
+
+func (e *encodeState) reflectValue(v reflect.Value, opts encOpts) {
+	valueEncoder(v)(e, v, opts)
+}
+
+type encOpts struct {
+	// quoted causes primitive fields to be encoded inside JSON strings.
+	quoted bool
+	// escapeHTML causes '<', '>', and '&' to be escaped in JSON strings.
+	escapeHTML bool
+	// EDIT(begin): save the timefmt
+	timefmt string
+	// EDIT(end)
+}
+
+type encoderFunc func(e *encodeState, v reflect.Value, opts encOpts)
+
+var encoderCache sync.Map // map[reflect.Type]encoderFunc
+
+func valueEncoder(v reflect.Value) encoderFunc {
+	if !v.IsValid() {
+		return invalidValueEncoder
+	}
+	return typeEncoder(v.Type())
+}
+
+func typeEncoder(t reflect.Type) encoderFunc {
+	if fi, ok := encoderCache.Load(t); ok {
+		return fi.(encoderFunc)
+	}
+
+	// To deal with recursive types, populate the map with an
+	// indirect func before we build it. This type waits on the
+	// real func (f) to be ready and then calls it. This indirect
+	// func is only used for recursive types.
+	var (
+		wg sync.WaitGroup
+		f  encoderFunc
+	)
+	wg.Add(1)
+	fi, loaded := encoderCache.LoadOrStore(t, encoderFunc(func(e *encodeState, v reflect.Value, opts encOpts) {
+		wg.Wait()
+		f(e, v, opts)
+	}))
+	if loaded {
+		return fi.(encoderFunc)
+	}
+
+	// Compute the real encoder and replace the indirect func with it.
+	f = newTypeEncoder(t, true)
+	wg.Done()
+	encoderCache.Store(t, f)
+	return f
+}
+
+var (
+	// SHIM(begin): TypeFor[T]() reflect.Type
+	marshalerType     = shims.TypeFor[Marshaler]()
+	textMarshalerType = shims.TypeFor[encoding.TextMarshaler]()
+	// SHIM(end)
+)
+
+// newTypeEncoder constructs an encoderFunc for a type.
+// The returned encoder only checks CanAddr when allowAddr is true.
+func newTypeEncoder(t reflect.Type, allowAddr bool) encoderFunc {
+	// EDIT(begin): add custom time encoder
+	if t == timeType {
+		return newTimeEncoder()
+	}
+	// EDIT(end)
+
+	// If we have a non-pointer value whose type implements
+	// Marshaler with a value receiver, then we're better off taking
+	// the address of the value - otherwise we end up with an
+	// allocation as we cast the value to an interface.
+	if t.Kind() != reflect.Pointer && allowAddr && reflect.PointerTo(t).Implements(marshalerType) {
+		return newCondAddrEncoder(addrMarshalerEncoder, newTypeEncoder(t, false))
+	}
+
+	if t.Implements(marshalerType) {
+		return marshalerEncoder
+	}
+	if t.Kind() != reflect.Pointer && allowAddr && reflect.PointerTo(t).Implements(textMarshalerType) {
+		return newCondAddrEncoder(addrTextMarshalerEncoder, newTypeEncoder(t, false))
+	}
+	if t.Implements(textMarshalerType) {
+		return textMarshalerEncoder
+	}
+
+	switch t.Kind() {
+	case reflect.Bool:
+		return boolEncoder
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return intEncoder
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return uintEncoder
+	case reflect.Float32:
+		return float32Encoder
+	case reflect.Float64:
+		return float64Encoder
+	case reflect.String:
+		return stringEncoder
+	case reflect.Interface:
+		return interfaceEncoder
+	case reflect.Struct:
+		return newStructEncoder(t)
+	case reflect.Map:
+		return newMapEncoder(t)
+	case reflect.Slice:
+		return newSliceEncoder(t)
+	case reflect.Array:
+		return newArrayEncoder(t)
+	case reflect.Pointer:
+		return newPtrEncoder(t)
+	default:
+		return unsupportedTypeEncoder
+	}
+}
+
+func invalidValueEncoder(e *encodeState, v reflect.Value, _ encOpts) {
+	e.WriteString("null")
+}
+
+func marshalerEncoder(e *encodeState, v reflect.Value, opts encOpts) {
+	if v.Kind() == reflect.Pointer && v.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	m, ok := v.Interface().(Marshaler)
+	if !ok {
+		e.WriteString("null")
+		return
+	}
+
+	// EDIT(begin): use custom time encoder
+	if timeMarshalEncoder(e, v, opts) {
+		return
+	}
+	// EDIT(end)
+
+	b, err := m.MarshalJSON()
+	if err == nil {
+		e.Grow(len(b))
+		out := e.AvailableBuffer()
+		out, err = appendCompact(out, b, opts.escapeHTML)
+		e.Buffer.Write(out)
+	}
+	if err != nil {
+		e.error(&MarshalerError{v.Type(), err, "MarshalJSON"})
+	}
+}
+
+func addrMarshalerEncoder(e *encodeState, v reflect.Value, opts encOpts) {
+	va := v.Addr()
+	if va.IsNil() {
+		e.WriteString("null")
+		return
+	}
+
+	// EDIT(begin): use custom time encoder
+	if timeMarshalEncoder(e, v, opts) {
+		return
+	}
+	// EDIT(end)
+
+	m := va.Interface().(Marshaler)
+	b, err := m.MarshalJSON()
+	if err == nil {
+		e.Grow(len(b))
+		out := e.AvailableBuffer()
+		out, err = appendCompact(out, b, opts.escapeHTML)
+		e.Buffer.Write(out)
+	}
+	if err != nil {
+		e.error(&MarshalerError{v.Type(), err, "MarshalJSON"})
+	}
+}
+
+func textMarshalerEncoder(e *encodeState, v reflect.Value, opts encOpts) {
+	if v.Kind() == reflect.Pointer && v.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	m, ok := v.Interface().(encoding.TextMarshaler)
+	if !ok {
+		e.WriteString("null")
+		return
+	}
+	b, err := m.MarshalText()
+	if err != nil {
+		e.error(&MarshalerError{v.Type(), err, "MarshalText"})
+	}
+	e.Write(appendString(e.AvailableBuffer(), b, opts.escapeHTML))
+}
+
+func addrTextMarshalerEncoder(e *encodeState, v reflect.Value, opts encOpts) {
+	va := v.Addr()
+	if va.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	m := va.Interface().(encoding.TextMarshaler)
+	b, err := m.MarshalText()
+	if err != nil {
+		e.error(&MarshalerError{v.Type(), err, "MarshalText"})
+	}
+	e.Write(appendString(e.AvailableBuffer(), b, opts.escapeHTML))
+}
+
+func boolEncoder(e *encodeState, v reflect.Value, opts encOpts) {
+	b := e.AvailableBuffer()
+	b = mayAppendQuote(b, opts.quoted)
+	b = strconv.AppendBool(b, v.Bool())
+	b = mayAppendQuote(b, opts.quoted)
+	e.Write(b)
+}
+
+func intEncoder(e *encodeState, v reflect.Value, opts encOpts) {
+	b := e.AvailableBuffer()
+	b = mayAppendQuote(b, opts.quoted)
+	b = strconv.AppendInt(b, v.Int(), 10)
+	b = mayAppendQuote(b, opts.quoted)
+	e.Write(b)
+}
+
+func uintEncoder(e *encodeState, v reflect.Value, opts encOpts) {
+	b := e.AvailableBuffer()
+	b = mayAppendQuote(b, opts.quoted)
+	b = strconv.AppendUint(b, v.Uint(), 10)
+	b = mayAppendQuote(b, opts.quoted)
+	e.Write(b)
+}
+
+type floatEncoder int // number of bits
+
+func (bits floatEncoder) encode(e *encodeState, v reflect.Value, opts encOpts) {
+	f := v.Float()
+	if math.IsInf(f, 0) || math.IsNaN(f) {
+		e.error(&UnsupportedValueError{v, strconv.FormatFloat(f, 'g', -1, int(bits))})
+	}
+
+	// Convert as if by ES6 number to string conversion.
+	// This matches most other JSON generators.
+	// See golang.org/issue/6384 and golang.org/issue/14135.
+	// Like fmt %g, but the exponent cutoffs are different
+	// and exponents themselves are not padded to two digits.
+	b := e.AvailableBuffer()
+	b = mayAppendQuote(b, opts.quoted)
+	abs := math.Abs(f)
+	fmt := byte('f')
+	// Note: Must use float32 comparisons for underlying float32 value to get precise cutoffs right.
+	if abs != 0 {
+		if bits == 64 && (abs < 1e-6 || abs >= 1e21) || bits == 32 && (float32(abs) < 1e-6 || float32(abs) >= 1e21) {
+			fmt = 'e'
+		}
+	}
+	b = strconv.AppendFloat(b, f, fmt, -1, int(bits))
+	if fmt == 'e' {
+		// clean up e-09 to e-9
+		n := len(b)
+		if n >= 4 && b[n-4] == 'e' && b[n-3] == '-' && b[n-2] == '0' {
+			b[n-2] = b[n-1]
+			b = b[:n-1]
+		}
+	}
+	b = mayAppendQuote(b, opts.quoted)
+	e.Write(b)
+}
+
+var (
+	float32Encoder = (floatEncoder(32)).encode
+	float64Encoder = (floatEncoder(64)).encode
+)
+
+func stringEncoder(e *encodeState, v reflect.Value, opts encOpts) {
+	if v.Type() == numberType {
+		numStr := v.String()
+		// In Go1.5 the empty string encodes to "0", while this is not a valid number literal
+		// we keep compatibility so check validity after this.
+		if numStr == "" {
+			numStr = "0" // Number's zero-val
+		}
+		if !isValidNumber(numStr) {
+			e.error(fmt.Errorf("json: invalid number literal %q", numStr))
+		}
+		b := e.AvailableBuffer()
+		b = mayAppendQuote(b, opts.quoted)
+		b = append(b, numStr...)
+		b = mayAppendQuote(b, opts.quoted)
+		e.Write(b)
+		return
+	}
+	if opts.quoted {
+		b := appendString(nil, v.String(), opts.escapeHTML)
+		e.Write(appendString(e.AvailableBuffer(), b, false)) // no need to escape again since it is already escaped
+	} else {
+		e.Write(appendString(e.AvailableBuffer(), v.String(), opts.escapeHTML))
+	}
+}
+
+// isValidNumber reports whether s is a valid JSON number literal.
+//
+// isValidNumber should be an internal detail,
+// but widely used packages access it using linkname.
+// Notable members of the hall of shame include:
+//   - github.com/bytedance/sonic
+//
+// Do not remove or change the type signature.
+// See go.dev/issue/67401.
+//
+//go:linkname isValidNumber
+func isValidNumber(s string) bool {
+	// This function implements the JSON numbers grammar.
+	// See https://tools.ietf.org/html/rfc7159#section-6
+	// and https://www.json.org/img/number.png
+
+	if s == "" {
+		return false
+	}
+
+	// Optional -
+	if s[0] == '-' {
+		s = s[1:]
+		if s == "" {
+			return false
+		}
+	}
+
+	// Digits
+	switch {
+	default:
+		return false
+
+	case s[0] == '0':
+		s = s[1:]
+
+	case '1' <= s[0] && s[0] <= '9':
+		s = s[1:]
+		for len(s) > 0 && '0' <= s[0] && s[0] <= '9' {
+			s = s[1:]
+		}
+	}
+
+	// . followed by 1 or more digits.
+	if len(s) >= 2 && s[0] == '.' && '0' <= s[1] && s[1] <= '9' {
+		s = s[2:]
+		for len(s) > 0 && '0' <= s[0] && s[0] <= '9' {
+			s = s[1:]
+		}
+	}
+
+	// e or E followed by an optional - or + and
+	// 1 or more digits.
+	if len(s) >= 2 && (s[0] == 'e' || s[0] == 'E') {
+		s = s[1:]
+		if s[0] == '+' || s[0] == '-' {
+			s = s[1:]
+			if s == "" {
+				return false
+			}
+		}
+		for len(s) > 0 && '0' <= s[0] && s[0] <= '9' {
+			s = s[1:]
+		}
+	}
+
+	// Make sure we are at the end.
+	return s == ""
+}
+
+func interfaceEncoder(e *encodeState, v reflect.Value, opts encOpts) {
+	if v.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	e.reflectValue(v.Elem(), opts)
+}
+
+func unsupportedTypeEncoder(e *encodeState, v reflect.Value, _ encOpts) {
+	e.error(&UnsupportedTypeError{v.Type()})
+}
+
+type structEncoder struct {
+	fields structFields
+}
+
+type structFields struct {
+	list         []field
+	byExactName  map[string]*field
+	byFoldedName map[string]*field
+}
+
+func (se structEncoder) encode(e *encodeState, v reflect.Value, opts encOpts) {
+	next := byte('{')
+FieldLoop:
+	for i := range se.fields.list {
+		f := &se.fields.list[i]
+
+		// Find the nested struct field by following f.index.
+		fv := v
+		for _, i := range f.index {
+			if fv.Kind() == reflect.Pointer {
+				if fv.IsNil() {
+					continue FieldLoop
+				}
+				fv = fv.Elem()
+			}
+			fv = fv.Field(i)
+		}
+
+		if (f.omitEmpty && isEmptyValue(fv)) ||
+			(f.omitZero && (f.isZero == nil && fv.IsZero() || (f.isZero != nil && f.isZero(fv)))) {
+			continue
+		}
+		e.WriteByte(next)
+		next = ','
+		if opts.escapeHTML {
+			e.WriteString(f.nameEscHTML)
+		} else {
+			e.WriteString(f.nameNonEsc)
+		}
+		opts.quoted = f.quoted
+		f.encoder(e, fv, opts)
+	}
+	if next == '{' {
+		e.WriteString("{}")
+	} else {
+		e.WriteByte('}')
+	}
+}
+
+func newStructEncoder(t reflect.Type) encoderFunc {
+	se := structEncoder{fields: cachedTypeFields(t)}
+	return se.encode
+}
+
+type mapEncoder struct {
+	elemEnc encoderFunc
+}
+
+func (me mapEncoder) encode(e *encodeState, v reflect.Value, opts encOpts) {
+	if v.IsNil() /* EDIT(begin) */ || sentinel.IsValueNull(v) /* EDIT(end) */ {
+		e.WriteString("null")
+		return
+	}
+	if e.ptrLevel++; e.ptrLevel > startDetectingCyclesAfter {
+		// We're a large number of nested ptrEncoder.encode calls deep;
+		// start checking if we've run into a pointer cycle.
+		ptr := v.UnsafePointer()
+		if _, ok := e.ptrSeen[ptr]; ok {
+			e.error(&UnsupportedValueError{v, fmt.Sprintf("encountered a cycle via %s", v.Type())})
+		}
+		e.ptrSeen[ptr] = struct{}{}
+		defer delete(e.ptrSeen, ptr)
+	}
+	e.WriteByte('{')
+
+	// Extract and sort the keys.
+	var (
+		sv  = make([]reflectWithString, v.Len())
+		mi  = v.MapRange()
+		err error
+	)
+	for i := 0; mi.Next(); i++ {
+		if sv[i].ks, err = resolveKeyName(mi.Key()); err != nil {
+			e.error(fmt.Errorf("json: encoding error for type %q: %q", v.Type().String(), err.Error()))
+		}
+		sv[i].v = mi.Value()
+	}
+	slices.SortFunc(sv, func(i, j reflectWithString) int {
+		return strings.Compare(i.ks, j.ks)
+	})
+
+	for i, kv := range sv {
+		if i > 0 {
+			e.WriteByte(',')
+		}
+		e.Write(appendString(e.AvailableBuffer(), kv.ks, opts.escapeHTML))
+		e.WriteByte(':')
+		me.elemEnc(e, kv.v, opts)
+	}
+	e.WriteByte('}')
+	e.ptrLevel--
+}
+
+func newMapEncoder(t reflect.Type) encoderFunc {
+	switch t.Key().Kind() {
+	case reflect.String,
+		reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+		reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+	default:
+		if !t.Key().Implements(textMarshalerType) {
+			return unsupportedTypeEncoder
+		}
+	}
+	me := mapEncoder{typeEncoder(t.Elem())}
+	return me.encode
+}
+
+func encodeByteSlice(e *encodeState, v reflect.Value, _ encOpts) {
+	if v.IsNil() {
+		e.WriteString("null")
+		return
+	}
+
+	s := v.Bytes()
+	b := e.AvailableBuffer()
+	b = append(b, '"')
+	// SHIM(base64): base64.StdEncoding.AppendEncode([]byte, []byte) []byte
+	b = (shims.AppendableStdEncoding{Encoding: base64.StdEncoding}).AppendEncode(b, s)
+	b = append(b, '"')
+	e.Write(b)
+}
+
+// sliceEncoder just wraps an arrayEncoder, checking to make sure the value isn't nil.
+type sliceEncoder struct {
+	arrayEnc encoderFunc
+}
+
+func (se sliceEncoder) encode(e *encodeState, v reflect.Value, opts encOpts) {
+	if v.IsNil() /* EDIT(begin) */ || sentinel.IsValueNull(v) /* EDIT(end) */ {
+		e.WriteString("null")
+		return
+	}
+	if e.ptrLevel++; e.ptrLevel > startDetectingCyclesAfter {
+		// We're a large number of nested ptrEncoder.encode calls deep;
+		// start checking if we've run into a pointer cycle.
+		// Here we use a struct to memorize the pointer to the first element of the slice
+		// and its length.
+		ptr := struct {
+			ptr any // always an unsafe.Pointer, but avoids a dependency on package unsafe
+			len int
+		}{v.UnsafePointer(), v.Len()}
+		if _, ok := e.ptrSeen[ptr]; ok {
+			e.error(&UnsupportedValueError{v, fmt.Sprintf("encountered a cycle via %s", v.Type())})
+		}
+		e.ptrSeen[ptr] = struct{}{}
+		defer delete(e.ptrSeen, ptr)
+	}
+	se.arrayEnc(e, v, opts)
+	e.ptrLevel--
+}
+
+func newSliceEncoder(t reflect.Type) encoderFunc {
+	// Byte slices get special treatment; arrays don't.
+	if t.Elem().Kind() == reflect.Uint8 {
+		p := reflect.PointerTo(t.Elem())
+		if !p.Implements(marshalerType) && !p.Implements(textMarshalerType) {
+			return encodeByteSlice
+		}
+	}
+	enc := sliceEncoder{newArrayEncoder(t)}
+	return enc.encode
+}
+
+type arrayEncoder struct {
+	elemEnc encoderFunc
+}
+
+func (ae arrayEncoder) encode(e *encodeState, v reflect.Value, opts encOpts) {
+	e.WriteByte('[')
+	n := v.Len()
+	for i := 0; i < n; i++ {
+		if i > 0 {
+			e.WriteByte(',')
+		}
+		ae.elemEnc(e, v.Index(i), opts)
+	}
+	e.WriteByte(']')
+}
+
+func newArrayEncoder(t reflect.Type) encoderFunc {
+	enc := arrayEncoder{typeEncoder(t.Elem())}
+	return enc.encode
+}
+
+type ptrEncoder struct {
+	elemEnc encoderFunc
+}
+
+func (pe ptrEncoder) encode(e *encodeState, v reflect.Value, opts encOpts) {
+	if v.IsNil() {
+		e.WriteString("null")
+		return
+	}
+
+	// EDIT(end)
+	if e.ptrLevel++; e.ptrLevel > startDetectingCyclesAfter {
+		// We're a large number of nested ptrEncoder.encode calls deep;
+		// start checking if we've run into a pointer cycle.
+		ptr := v.Interface()
+		if _, ok := e.ptrSeen[ptr]; ok {
+			e.error(&UnsupportedValueError{v, fmt.Sprintf("encountered a cycle via %s", v.Type())})
+		}
+		e.ptrSeen[ptr] = struct{}{}
+		defer delete(e.ptrSeen, ptr)
+	}
+	pe.elemEnc(e, v.Elem(), opts)
+	e.ptrLevel--
+}
+
+func newPtrEncoder(t reflect.Type) encoderFunc {
+	enc := ptrEncoder{typeEncoder(t.Elem())}
+	return enc.encode
+}
+
+type condAddrEncoder struct {
+	canAddrEnc, elseEnc encoderFunc
+}
+
+func (ce condAddrEncoder) encode(e *encodeState, v reflect.Value, opts encOpts) {
+	if v.CanAddr() {
+		ce.canAddrEnc(e, v, opts)
+	} else {
+		ce.elseEnc(e, v, opts)
+	}
+}
+
+// newCondAddrEncoder returns an encoder that checks whether its value
+// CanAddr and delegates to canAddrEnc if so, else to elseEnc.
+func newCondAddrEncoder(canAddrEnc, elseEnc encoderFunc) encoderFunc {
+	enc := condAddrEncoder{canAddrEnc: canAddrEnc, elseEnc: elseEnc}
+	return enc.encode
+}
+
+func isValidTag(s string) bool {
+	if s == "" {
+		return false
+	}
+	for _, c := range s {
+		switch {
+		case strings.ContainsRune("!#$%&()*+-./:;<=>?@[]^_{|}~ ", c):
+			// Backslash and quote chars are reserved, but
+			// otherwise any punctuation chars are allowed
+			// in a tag name.
+		case !unicode.IsLetter(c) && !unicode.IsDigit(c):
+			return false
+		}
+	}
+	return true
+}
+
+func typeByIndex(t reflect.Type, index []int) reflect.Type {
+	for _, i := range index {
+		if t.Kind() == reflect.Pointer {
+			t = t.Elem()
+		}
+		t = t.Field(i).Type
+	}
+	return t
+}
+
+type reflectWithString struct {
+	v  reflect.Value
+	ks string
+}
+
+func resolveKeyName(k reflect.Value) (string, error) {
+	if k.Kind() == reflect.String {
+		return k.String(), nil
+	}
+	if tm, ok := k.Interface().(encoding.TextMarshaler); ok {
+		if k.Kind() == reflect.Pointer && k.IsNil() {
+			return "", nil
+		}
+		buf, err := tm.MarshalText()
+		return string(buf), err
+	}
+	switch k.Kind() {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return strconv.FormatInt(k.Int(), 10), nil
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return strconv.FormatUint(k.Uint(), 10), nil
+	}
+	panic("unexpected map key type")
+}
+
+func appendString[Bytes []byte | string](dst []byte, src Bytes, escapeHTML bool) []byte {
+	dst = append(dst, '"')
+	start := 0
+	for i := 0; i < len(src); {
+		if b := src[i]; b < utf8.RuneSelf {
+			if htmlSafeSet[b] || (!escapeHTML && safeSet[b]) {
+				i++
+				continue
+			}
+			dst = append(dst, src[start:i]...)
+			switch b {
+			case '\\', '"':
+				dst = append(dst, '\\', b)
+			case '\b':
+				dst = append(dst, '\\', 'b')
+			case '\f':
+				dst = append(dst, '\\', 'f')
+			case '\n':
+				dst = append(dst, '\\', 'n')
+			case '\r':
+				dst = append(dst, '\\', 'r')
+			case '\t':
+				dst = append(dst, '\\', 't')
+			default:
+				// This encodes bytes < 0x20 except for \b, \f, \n, \r and \t.
+				// If escapeHTML is set, it also escapes <, >, and &
+				// because they can lead to security holes when
+				// user-controlled strings are rendered into JSON
+				// and served to some browsers.
+				dst = append(dst, '\\', 'u', '0', '0', hex[b>>4], hex[b&0xF])
+			}
+			i++
+			start = i
+			continue
+		}
+		// TODO(https://go.dev/issue/56948): Use generic utf8 functionality.
+		// For now, cast only a small portion of byte slices to a string
+		// so that it can be stack allocated. This slows down []byte slightly
+		// due to the extra copy, but keeps string performance roughly the same.
+		n := len(src) - i
+		if n > utf8.UTFMax {
+			n = utf8.UTFMax
+		}
+		c, size := utf8.DecodeRuneInString(string(src[i : i+n]))
+		if c == utf8.RuneError && size == 1 {
+			dst = append(dst, src[start:i]...)
+			dst = append(dst, `\ufffd`...)
+			i += size
+			start = i
+			continue
+		}
+		// U+2028 is LINE SEPARATOR.
+		// U+2029 is PARAGRAPH SEPARATOR.
+		// They are both technically valid characters in JSON strings,
+		// but don't work in JSONP, which has to be evaluated as JavaScript,
+		// and can lead to security holes there. It is valid JSON to
+		// escape them, so we do so unconditionally.
+		// See https://en.wikipedia.org/wiki/JSON#Safety.
+		if c == '\u2028' || c == '\u2029' {
+			dst = append(dst, src[start:i]...)
+			dst = append(dst, '\\', 'u', '2', '0', '2', hex[c&0xF])
+			i += size
+			start = i
+			continue
+		}
+		i += size
+	}
+	dst = append(dst, src[start:]...)
+	dst = append(dst, '"')
+	return dst
+}
+
+// A field represents a single field found in a struct.
+type field struct {
+	name      string
+	nameBytes []byte // []byte(name)
+
+	nameNonEsc  string // `"` + name + `":`
+	nameEscHTML string // `"` + HTMLEscape(name) + `":`
+
+	tag       bool
+	index     []int
+	typ       reflect.Type
+	omitEmpty bool
+	omitZero  bool
+	isZero    func(reflect.Value) bool
+	quoted    bool
+
+	encoder encoderFunc
+
+	// EDIT(begin): save the timefmt if present
+	timefmt string
+	// EDIT(end)
+}
+
+type isZeroer interface {
+	IsZero() bool
+}
+
+// SHIM(reflect): TypeFor[T]() reflect.Type
+var isZeroerType = shims.TypeFor[isZeroer]()
+
+// typeFields returns a list of fields that JSON should recognize for the given type.
+// The algorithm is breadth-first search over the set of structs to include - the top struct
+// and then any reachable anonymous structs.
+//
+// typeFields should be an internal detail,
+// but widely used packages access it using linkname.
+// Notable members of the hall of shame include:
+//   - github.com/bytedance/sonic
+//
+// Do not remove or change the type signature.
+// See go.dev/issue/67401.
+//
+//go:linkname typeFields
+func typeFields(t reflect.Type) structFields {
+	// Anonymous fields to explore at the current level and the next.
+	current := []field{}
+	next := []field{{typ: t}}
+
+	// Count of queued names for current level and the next.
+	var count, nextCount map[reflect.Type]int
+
+	// Types already visited at an earlier level.
+	visited := map[reflect.Type]bool{}
+
+	// Fields found.
+	var fields []field
+
+	// Buffer to run appendHTMLEscape on field names.
+	var nameEscBuf []byte
+
+	for len(next) > 0 {
+		current, next = next, current[:0]
+		count, nextCount = nextCount, map[reflect.Type]int{}
+
+		for _, f := range current {
+			if visited[f.typ] {
+				continue
+			}
+			visited[f.typ] = true
+
+			// Scan f.typ for fields to include.
+			for i := 0; i < f.typ.NumField(); i++ {
+				sf := f.typ.Field(i)
+				if sf.Anonymous {
+					t := sf.Type
+					if t.Kind() == reflect.Pointer {
+						t = t.Elem()
+					}
+					if !sf.IsExported() && t.Kind() != reflect.Struct {
+						// Ignore embedded fields of unexported non-struct types.
+						continue
+					}
+					// Do not ignore embedded fields of unexported struct types
+					// since they may have exported fields.
+				} else if !sf.IsExported() {
+					// Ignore unexported non-embedded fields.
+					continue
+				}
+				tag := sf.Tag.Get("json")
+				if tag == "-" {
+					continue
+				}
+				name, opts := parseTag(tag)
+				if !isValidTag(name) {
+					name = ""
+				}
+				index := make([]int, len(f.index)+1)
+				copy(index, f.index)
+				index[len(f.index)] = i
+
+				ft := sf.Type
+				if ft.Name() == "" && ft.Kind() == reflect.Pointer {
+					// Follow pointer.
+					ft = ft.Elem()
+				}
+
+				// Only strings, floats, integers, and booleans can be quoted.
+				quoted := false
+				if opts.Contains("string") {
+					switch ft.Kind() {
+					case reflect.Bool,
+						reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+						reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr,
+						reflect.Float32, reflect.Float64,
+						reflect.String:
+						quoted = true
+					}
+				}
+
+				// Record found field and index sequence.
+				if name != "" || !sf.Anonymous || ft.Kind() != reflect.Struct {
+					tagged := name != ""
+					if name == "" {
+						name = sf.Name
+					}
+					field := field{
+						name:      name,
+						tag:       tagged,
+						index:     index,
+						typ:       ft,
+						omitEmpty: opts.Contains("omitempty"),
+						omitZero:  opts.Contains("omitzero"),
+						quoted:    quoted,
+						// EDIT(begin): save the timefmt
+						timefmt: sf.Tag.Get("format"),
+						// EDIT(end)
+					}
+					field.nameBytes = []byte(field.name)
+
+					// Build nameEscHTML and nameNonEsc ahead of time.
+					nameEscBuf = appendHTMLEscape(nameEscBuf[:0], field.nameBytes)
+					field.nameEscHTML = `"` + string(nameEscBuf) + `":`
+					field.nameNonEsc = `"` + field.name + `":`
+
+					if field.omitZero {
+						t := sf.Type
+						// Provide a function that uses a type's IsZero method.
+						switch {
+						case t.Kind() == reflect.Interface && t.Implements(isZeroerType):
+							field.isZero = func(v reflect.Value) bool {
+								// Avoid panics calling IsZero on a nil interface or
+								// non-nil interface with nil pointer.
+								return v.IsNil() ||
+									(v.Elem().Kind() == reflect.Pointer && v.Elem().IsNil()) ||
+									v.Interface().(isZeroer).IsZero()
+							}
+						case t.Kind() == reflect.Pointer && t.Implements(isZeroerType):
+							field.isZero = func(v reflect.Value) bool {
+								// Avoid panics calling IsZero on nil pointer.
+								return v.IsNil() || v.Interface().(isZeroer).IsZero()
+							}
+						case t.Implements(isZeroerType):
+							field.isZero = func(v reflect.Value) bool {
+								return v.Interface().(isZeroer).IsZero()
+							}
+						case reflect.PointerTo(t).Implements(isZeroerType):
+							field.isZero = func(v reflect.Value) bool {
+								if !v.CanAddr() {
+									// Temporarily box v so we can take the address.
+									v2 := reflect.New(v.Type()).Elem()
+									v2.Set(v)
+									v = v2
+								}
+								return v.Addr().Interface().(isZeroer).IsZero()
+							}
+						}
+					}
+
+					fields = append(fields, field)
+					if count[f.typ] > 1 {
+						// If there were multiple instances, add a second,
+						// so that the annihilation code will see a duplicate.
+						// It only cares about the distinction between 1 and 2,
+						// so don't bother generating any more copies.
+						fields = append(fields, fields[len(fields)-1])
+					}
+					continue
+				}
+
+				// Record new anonymous struct to explore in next round.
+				nextCount[ft]++
+				if nextCount[ft] == 1 {
+					next = append(next, field{name: ft.Name(), index: index, typ: ft})
+				}
+			}
+		}
+	}
+
+	slices.SortFunc(fields, func(a, b field) int {
+		// sort field by name, breaking ties with depth, then
+		// breaking ties with "name came from json tag", then
+		// breaking ties with index sequence.
+		if c := strings.Compare(a.name, b.name); c != 0 {
+			return c
+		}
+		if c := cmp.Compare(len(a.index), len(b.index)); c != 0 {
+			return c
+		}
+		if a.tag != b.tag {
+			if a.tag {
+				return -1
+			}
+			return +1
+		}
+		return slices.Compare(a.index, b.index)
+	})
+
+	// Delete all fields that are hidden by the Go rules for embedded fields,
+	// except that fields with JSON tags are promoted.
+
+	// The fields are sorted in primary order of name, secondary order
+	// of field index length. Loop over names; for each name, delete
+	// hidden fields by choosing the one dominant field that survives.
+	out := fields[:0]
+	for advance, i := 0, 0; i < len(fields); i += advance {
+		// One iteration per name.
+		// Find the sequence of fields with the name of this first field.
+		fi := fields[i]
+		name := fi.name
+		for advance = 1; i+advance < len(fields); advance++ {
+			fj := fields[i+advance]
+			if fj.name != name {
+				break
+			}
+		}
+		if advance == 1 { // Only one field with this name
+			out = append(out, fi)
+			continue
+		}
+		dominant, ok := dominantField(fields[i : i+advance])
+		if ok {
+			out = append(out, dominant)
+		}
+	}
+
+	fields = out
+	slices.SortFunc(fields, func(i, j field) int {
+		return slices.Compare(i.index, j.index)
+	})
+
+	for i := range fields {
+		f := &fields[i]
+		f.encoder = typeEncoder(typeByIndex(t, f.index))
+
+		// EDIT(begin): add custom timefmt if necessary
+		if f.timefmt != "" {
+			f.encoder = continueWithTimeFmt(f.timefmt, f.encoder)
+		}
+		// EDIT(end)
+	}
+	exactNameIndex := make(map[string]*field, len(fields))
+	foldedNameIndex := make(map[string]*field, len(fields))
+	for i, field := range fields {
+		exactNameIndex[field.name] = &fields[i]
+		// For historical reasons, first folded match takes precedence.
+		if _, ok := foldedNameIndex[string(foldName(field.nameBytes))]; !ok {
+			foldedNameIndex[string(foldName(field.nameBytes))] = &fields[i]
+		}
+	}
+	return structFields{fields, exactNameIndex, foldedNameIndex}
+}
+
+// dominantField looks through the fields, all of which are known to
+// have the same name, to find the single field that dominates the
+// others using Go's embedding rules, modified by the presence of
+// JSON tags. If there are multiple top-level fields, the boolean
+// will be false: This condition is an error in Go and we skip all
+// the fields.
+func dominantField(fields []field) (field, bool) {
+	// The fields are sorted in increasing index-length order, then by presence of tag.
+	// That means that the first field is the dominant one. We need only check
+	// for error cases: two fields at top level, either both tagged or neither tagged.
+	if len(fields) > 1 && len(fields[0].index) == len(fields[1].index) && fields[0].tag == fields[1].tag {
+		return field{}, false
+	}
+	return fields[0], true
+}
+
+var fieldCache sync.Map // map[reflect.Type]structFields
+
+// cachedTypeFields is like typeFields but uses a cache to avoid repeated work.
+func cachedTypeFields(t reflect.Type) structFields {
+	if f, ok := fieldCache.Load(t); ok {
+		return f.(structFields)
+	}
+	f, _ := fieldCache.LoadOrStore(t, typeFields(t))
+	return f.(structFields)
+}
+
+func mayAppendQuote(b []byte, quoted bool) []byte {
+	if quoted {
+		b = append(b, '"')
+	}
+	return b
+}
diff --git a/sdks/go/internal/encoding/json/fold.go b/sdks/go/internal/encoding/json/fold.go
new file mode 100644
index 00000000..c4c671b5
--- /dev/null
+++ b/sdks/go/internal/encoding/json/fold.go
@@ -0,0 +1,48 @@
+// Copyright 2013 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"unicode"
+	"unicode/utf8"
+)
+
+// foldName returns a folded string such that foldName(x) == foldName(y)
+// is identical to bytes.EqualFold(x, y).
+func foldName(in []byte) []byte {
+	// This is inlinable to take advantage of "function outlining".
+	var arr [32]byte // large enough for most JSON names
+	return appendFoldedName(arr[:0], in)
+}
+
+func appendFoldedName(out, in []byte) []byte {
+	for i := 0; i < len(in); {
+		// Handle single-byte ASCII.
+		if c := in[i]; c < utf8.RuneSelf {
+			if 'a' <= c && c <= 'z' {
+				c -= 'a' - 'A'
+			}
+			out = append(out, c)
+			i++
+			continue
+		}
+		// Handle multi-byte Unicode.
+		r, n := utf8.DecodeRune(in[i:])
+		out = utf8.AppendRune(out, foldRune(r))
+		i += n
+	}
+	return out
+}
+
+// foldRune is returns the smallest rune for all runes in the same fold set.
+func foldRune(r rune) rune {
+	for {
+		r2 := unicode.SimpleFold(r)
+		if r2 <= r {
+			return r2
+		}
+		r = r2
+	}
+}
diff --git a/sdks/go/internal/encoding/json/indent.go b/sdks/go/internal/encoding/json/indent.go
new file mode 100644
index 00000000..01bfdf65
--- /dev/null
+++ b/sdks/go/internal/encoding/json/indent.go
@@ -0,0 +1,182 @@
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import "bytes"
+
+// HTMLEscape appends to dst the JSON-encoded src with <, >, &, U+2028 and U+2029
+// characters inside string literals changed to \u003c, \u003e, \u0026, \u2028, \u2029
+// so that the JSON will be safe to embed inside HTML <script> tags.
+// For historical reasons, web browsers don't honor standard HTML
+// escaping within <script> tags, so an alternative JSON encoding must be used.
+func HTMLEscape(dst *bytes.Buffer, src []byte) {
+	dst.Grow(len(src))
+	dst.Write(appendHTMLEscape(dst.AvailableBuffer(), src))
+}
+
+func appendHTMLEscape(dst, src []byte) []byte {
+	// The characters can only appear in string literals,
+	// so just scan the string one byte at a time.
+	start := 0
+	for i, c := range src {
+		if c == '<' || c == '>' || c == '&' {
+			dst = append(dst, src[start:i]...)
+			dst = append(dst, '\\', 'u', '0', '0', hex[c>>4], hex[c&0xF])
+			start = i + 1
+		}
+		// Convert U+2028 and U+2029 (E2 80 A8 and E2 80 A9).
+		if c == 0xE2 && i+2 < len(src) && src[i+1] == 0x80 && src[i+2]&^1 == 0xA8 {
+			dst = append(dst, src[start:i]...)
+			dst = append(dst, '\\', 'u', '2', '0', '2', hex[src[i+2]&0xF])
+			start = i + len("\u2029")
+		}
+	}
+	return append(dst, src[start:]...)
+}
+
+// Compact appends to dst the JSON-encoded src with
+// insignificant space characters elided.
+func Compact(dst *bytes.Buffer, src []byte) error {
+	dst.Grow(len(src))
+	b := dst.AvailableBuffer()
+	b, err := appendCompact(b, src, false)
+	dst.Write(b)
+	return err
+}
+
+func appendCompact(dst, src []byte, escape bool) ([]byte, error) {
+	origLen := len(dst)
+	scan := newScanner()
+	defer freeScanner(scan)
+	start := 0
+	for i, c := range src {
+		if escape && (c == '<' || c == '>' || c == '&') {
+			if start < i {
+				dst = append(dst, src[start:i]...)
+			}
+			dst = append(dst, '\\', 'u', '0', '0', hex[c>>4], hex[c&0xF])
+			start = i + 1
+		}
+		// Convert U+2028 and U+2029 (E2 80 A8 and E2 80 A9).
+		if escape && c == 0xE2 && i+2 < len(src) && src[i+1] == 0x80 && src[i+2]&^1 == 0xA8 {
+			if start < i {
+				dst = append(dst, src[start:i]...)
+			}
+			dst = append(dst, '\\', 'u', '2', '0', '2', hex[src[i+2]&0xF])
+			start = i + 3
+		}
+		v := scan.step(scan, c)
+		if v >= scanSkipSpace {
+			if v == scanError {
+				break
+			}
+			if start < i {
+				dst = append(dst, src[start:i]...)
+			}
+			start = i + 1
+		}
+	}
+	if scan.eof() == scanError {
+		return dst[:origLen], scan.err
+	}
+	if start < len(src) {
+		dst = append(dst, src[start:]...)
+	}
+	return dst, nil
+}
+
+func appendNewline(dst []byte, prefix, indent string, depth int) []byte {
+	dst = append(dst, '\n')
+	dst = append(dst, prefix...)
+	for i := 0; i < depth; i++ {
+		dst = append(dst, indent...)
+	}
+	return dst
+}
+
+// indentGrowthFactor specifies the growth factor of indenting JSON input.
+// Empirically, the growth factor was measured to be between 1.4x to 1.8x
+// for some set of compacted JSON with the indent being a single tab.
+// Specify a growth factor slightly larger than what is observed
+// to reduce probability of allocation in appendIndent.
+// A factor no higher than 2 ensures that wasted space never exceeds 50%.
+const indentGrowthFactor = 2
+
+// Indent appends to dst an indented form of the JSON-encoded src.
+// Each element in a JSON object or array begins on a new,
+// indented line beginning with prefix followed by one or more
+// copies of indent according to the indentation nesting.
+// The data appended to dst does not begin with the prefix nor
+// any indentation, to make it easier to embed inside other formatted JSON data.
+// Although leading space characters (space, tab, carriage return, newline)
+// at the beginning of src are dropped, trailing space characters
+// at the end of src are preserved and copied to dst.
+// For example, if src has no trailing spaces, neither will dst;
+// if src ends in a trailing newline, so will dst.
+func Indent(dst *bytes.Buffer, src []byte, prefix, indent string) error {
+	dst.Grow(indentGrowthFactor * len(src))
+	b := dst.AvailableBuffer()
+	b, err := appendIndent(b, src, prefix, indent)
+	dst.Write(b)
+	return err
+}
+
+func appendIndent(dst, src []byte, prefix, indent string) ([]byte, error) {
+	origLen := len(dst)
+	scan := newScanner()
+	defer freeScanner(scan)
+	needIndent := false
+	depth := 0
+	for _, c := range src {
+		scan.bytes++
+		v := scan.step(scan, c)
+		if v == scanSkipSpace {
+			continue
+		}
+		if v == scanError {
+			break
+		}
+		if needIndent && v != scanEndObject && v != scanEndArray {
+			needIndent = false
+			depth++
+			dst = appendNewline(dst, prefix, indent, depth)
+		}
+
+		// Emit semantically uninteresting bytes
+		// (in particular, punctuation in strings) unmodified.
+		if v == scanContinue {
+			dst = append(dst, c)
+			continue
+		}
+
+		// Add spacing around real punctuation.
+		switch c {
+		case '{', '[':
+			// delay indent so that empty object and array are formatted as {} and [].
+			needIndent = true
+			dst = append(dst, c)
+		case ',':
+			dst = append(dst, c)
+			dst = appendNewline(dst, prefix, indent, depth)
+		case ':':
+			dst = append(dst, c, ' ')
+		case '}', ']':
+			if needIndent {
+				// suppress indent in empty object/array
+				needIndent = false
+			} else {
+				depth--
+				dst = appendNewline(dst, prefix, indent, depth)
+			}
+			dst = append(dst, c)
+		default:
+			dst = append(dst, c)
+		}
+	}
+	if scan.eof() == scanError {
+		return dst[:origLen], scan.err
+	}
+	return dst, nil
+}
diff --git a/sdks/go/internal/encoding/json/scanner.go b/sdks/go/internal/encoding/json/scanner.go
new file mode 100644
index 00000000..da6ea2ac
--- /dev/null
+++ b/sdks/go/internal/encoding/json/scanner.go
@@ -0,0 +1,610 @@
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+// JSON value parser state machine.
+// Just about at the limit of what is reasonable to write by hand.
+// Some parts are a bit tedious, but overall it nicely factors out the
+// otherwise common code from the multiple scanning functions
+// in this package (Compact, Indent, checkValid, etc).
+//
+// This file starts with two simple examples using the scanner
+// before diving into the scanner itself.
+
+import (
+	"strconv"
+	"sync"
+)
+
+// Valid reports whether data is a valid JSON encoding.
+func Valid(data []byte) bool {
+	scan := newScanner()
+	defer freeScanner(scan)
+	return checkValid(data, scan) == nil
+}
+
+// checkValid verifies that data is valid JSON-encoded data.
+// scan is passed in for use by checkValid to avoid an allocation.
+// checkValid returns nil or a SyntaxError.
+func checkValid(data []byte, scan *scanner) error {
+	scan.reset()
+	for _, c := range data {
+		scan.bytes++
+		if scan.step(scan, c) == scanError {
+			return scan.err
+		}
+	}
+	if scan.eof() == scanError {
+		return scan.err
+	}
+	return nil
+}
+
+// A SyntaxError is a description of a JSON syntax error.
+// [Unmarshal] will return a SyntaxError if the JSON can't be parsed.
+type SyntaxError struct {
+	msg    string // description of error
+	Offset int64  // error occurred after reading Offset bytes
+}
+
+func (e *SyntaxError) Error() string { return e.msg }
+
+// A scanner is a JSON scanning state machine.
+// Callers call scan.reset and then pass bytes in one at a time
+// by calling scan.step(&scan, c) for each byte.
+// The return value, referred to as an opcode, tells the
+// caller about significant parsing events like beginning
+// and ending literals, objects, and arrays, so that the
+// caller can follow along if it wishes.
+// The return value scanEnd indicates that a single top-level
+// JSON value has been completed, *before* the byte that
+// just got passed in.  (The indication must be delayed in order
+// to recognize the end of numbers: is 123 a whole value or
+// the beginning of 12345e+6?).
+type scanner struct {
+	// The step is a func to be called to execute the next transition.
+	// Also tried using an integer constant and a single func
+	// with a switch, but using the func directly was 10% faster
+	// on a 64-bit Mac Mini, and it's nicer to read.
+	step func(*scanner, byte) int
+
+	// Reached end of top-level value.
+	endTop bool
+
+	// Stack of what we're in the middle of - array values, object keys, object values.
+	parseState []int
+
+	// Error that happened, if any.
+	err error
+
+	// total bytes consumed, updated by decoder.Decode (and deliberately
+	// not set to zero by scan.reset)
+	bytes int64
+}
+
+var scannerPool = sync.Pool{
+	New: func() any {
+		return &scanner{}
+	},
+}
+
+func newScanner() *scanner {
+	scan := scannerPool.Get().(*scanner)
+	// scan.reset by design doesn't set bytes to zero
+	scan.bytes = 0
+	scan.reset()
+	return scan
+}
+
+func freeScanner(scan *scanner) {
+	// Avoid hanging on to too much memory in extreme cases.
+	if len(scan.parseState) > 1024 {
+		scan.parseState = nil
+	}
+	scannerPool.Put(scan)
+}
+
+// These values are returned by the state transition functions
+// assigned to scanner.state and the method scanner.eof.
+// They give details about the current state of the scan that
+// callers might be interested to know about.
+// It is okay to ignore the return value of any particular
+// call to scanner.state: if one call returns scanError,
+// every subsequent call will return scanError too.
+const (
+	// Continue.
+	scanContinue     = iota // uninteresting byte
+	scanBeginLiteral        // end implied by next result != scanContinue
+	scanBeginObject         // begin object
+	scanObjectKey           // just finished object key (string)
+	scanObjectValue         // just finished non-last object value
+	scanEndObject           // end object (implies scanObjectValue if possible)
+	scanBeginArray          // begin array
+	scanArrayValue          // just finished array value
+	scanEndArray            // end array (implies scanArrayValue if possible)
+	scanSkipSpace           // space byte; can skip; known to be last "continue" result
+
+	// Stop.
+	scanEnd   // top-level value ended *before* this byte; known to be first "stop" result
+	scanError // hit an error, scanner.err.
+)
+
+// These values are stored in the parseState stack.
+// They give the current state of a composite value
+// being scanned. If the parser is inside a nested value
+// the parseState describes the nested state, outermost at entry 0.
+const (
+	parseObjectKey   = iota // parsing object key (before colon)
+	parseObjectValue        // parsing object value (after colon)
+	parseArrayValue         // parsing array value
+)
+
+// This limits the max nesting depth to prevent stack overflow.
+// This is permitted by https://tools.ietf.org/html/rfc7159#section-9
+const maxNestingDepth = 10000
+
+// reset prepares the scanner for use.
+// It must be called before calling s.step.
+func (s *scanner) reset() {
+	s.step = stateBeginValue
+	s.parseState = s.parseState[0:0]
+	s.err = nil
+	s.endTop = false
+}
+
+// eof tells the scanner that the end of input has been reached.
+// It returns a scan status just as s.step does.
+func (s *scanner) eof() int {
+	if s.err != nil {
+		return scanError
+	}
+	if s.endTop {
+		return scanEnd
+	}
+	s.step(s, ' ')
+	if s.endTop {
+		return scanEnd
+	}
+	if s.err == nil {
+		s.err = &SyntaxError{"unexpected end of JSON input", s.bytes}
+	}
+	return scanError
+}
+
+// pushParseState pushes a new parse state p onto the parse stack.
+// an error state is returned if maxNestingDepth was exceeded, otherwise successState is returned.
+func (s *scanner) pushParseState(c byte, newParseState int, successState int) int {
+	s.parseState = append(s.parseState, newParseState)
+	if len(s.parseState) <= maxNestingDepth {
+		return successState
+	}
+	return s.error(c, "exceeded max depth")
+}
+
+// popParseState pops a parse state (already obtained) off the stack
+// and updates s.step accordingly.
+func (s *scanner) popParseState() {
+	n := len(s.parseState) - 1
+	s.parseState = s.parseState[0:n]
+	if n == 0 {
+		s.step = stateEndTop
+		s.endTop = true
+	} else {
+		s.step = stateEndValue
+	}
+}
+
+func isSpace(c byte) bool {
+	return c <= ' ' && (c == ' ' || c == '\t' || c == '\r' || c == '\n')
+}
+
+// stateBeginValueOrEmpty is the state after reading `[`.
+func stateBeginValueOrEmpty(s *scanner, c byte) int {
+	if isSpace(c) {
+		return scanSkipSpace
+	}
+	if c == ']' {
+		return stateEndValue(s, c)
+	}
+	return stateBeginValue(s, c)
+}
+
+// stateBeginValue is the state at the beginning of the input.
+func stateBeginValue(s *scanner, c byte) int {
+	if isSpace(c) {
+		return scanSkipSpace
+	}
+	switch c {
+	case '{':
+		s.step = stateBeginStringOrEmpty
+		return s.pushParseState(c, parseObjectKey, scanBeginObject)
+	case '[':
+		s.step = stateBeginValueOrEmpty
+		return s.pushParseState(c, parseArrayValue, scanBeginArray)
+	case '"':
+		s.step = stateInString
+		return scanBeginLiteral
+	case '-':
+		s.step = stateNeg
+		return scanBeginLiteral
+	case '0': // beginning of 0.123
+		s.step = state0
+		return scanBeginLiteral
+	case 't': // beginning of true
+		s.step = stateT
+		return scanBeginLiteral
+	case 'f': // beginning of false
+		s.step = stateF
+		return scanBeginLiteral
+	case 'n': // beginning of null
+		s.step = stateN
+		return scanBeginLiteral
+	}
+	if '1' <= c && c <= '9' { // beginning of 1234.5
+		s.step = state1
+		return scanBeginLiteral
+	}
+	return s.error(c, "looking for beginning of value")
+}
+
+// stateBeginStringOrEmpty is the state after reading `{`.
+func stateBeginStringOrEmpty(s *scanner, c byte) int {
+	if isSpace(c) {
+		return scanSkipSpace
+	}
+	if c == '}' {
+		n := len(s.parseState)
+		s.parseState[n-1] = parseObjectValue
+		return stateEndValue(s, c)
+	}
+	return stateBeginString(s, c)
+}
+
+// stateBeginString is the state after reading `{"key": value,`.
+func stateBeginString(s *scanner, c byte) int {
+	if isSpace(c) {
+		return scanSkipSpace
+	}
+	if c == '"' {
+		s.step = stateInString
+		return scanBeginLiteral
+	}
+	return s.error(c, "looking for beginning of object key string")
+}
+
+// stateEndValue is the state after completing a value,
+// such as after reading `{}` or `true` or `["x"`.
+func stateEndValue(s *scanner, c byte) int {
+	n := len(s.parseState)
+	if n == 0 {
+		// Completed top-level before the current byte.
+		s.step = stateEndTop
+		s.endTop = true
+		return stateEndTop(s, c)
+	}
+	if isSpace(c) {
+		s.step = stateEndValue
+		return scanSkipSpace
+	}
+	ps := s.parseState[n-1]
+	switch ps {
+	case parseObjectKey:
+		if c == ':' {
+			s.parseState[n-1] = parseObjectValue
+			s.step = stateBeginValue
+			return scanObjectKey
+		}
+		return s.error(c, "after object key")
+	case parseObjectValue:
+		if c == ',' {
+			s.parseState[n-1] = parseObjectKey
+			s.step = stateBeginString
+			return scanObjectValue
+		}
+		if c == '}' {
+			s.popParseState()
+			return scanEndObject
+		}
+		return s.error(c, "after object key:value pair")
+	case parseArrayValue:
+		if c == ',' {
+			s.step = stateBeginValue
+			return scanArrayValue
+		}
+		if c == ']' {
+			s.popParseState()
+			return scanEndArray
+		}
+		return s.error(c, "after array element")
+	}
+	return s.error(c, "")
+}
+
+// stateEndTop is the state after finishing the top-level value,
+// such as after reading `{}` or `[1,2,3]`.
+// Only space characters should be seen now.
+func stateEndTop(s *scanner, c byte) int {
+	if !isSpace(c) {
+		// Complain about non-space byte on next call.
+		s.error(c, "after top-level value")
+	}
+	return scanEnd
+}
+
+// stateInString is the state after reading `"`.
+func stateInString(s *scanner, c byte) int {
+	if c == '"' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	if c == '\\' {
+		s.step = stateInStringEsc
+		return scanContinue
+	}
+	if c < 0x20 {
+		return s.error(c, "in string literal")
+	}
+	return scanContinue
+}
+
+// stateInStringEsc is the state after reading `"\` during a quoted string.
+func stateInStringEsc(s *scanner, c byte) int {
+	switch c {
+	case 'b', 'f', 'n', 'r', 't', '\\', '/', '"':
+		s.step = stateInString
+		return scanContinue
+	case 'u':
+		s.step = stateInStringEscU
+		return scanContinue
+	}
+	return s.error(c, "in string escape code")
+}
+
+// stateInStringEscU is the state after reading `"\u` during a quoted string.
+func stateInStringEscU(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInStringEscU1
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateInStringEscU1 is the state after reading `"\u1` during a quoted string.
+func stateInStringEscU1(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInStringEscU12
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateInStringEscU12 is the state after reading `"\u12` during a quoted string.
+func stateInStringEscU12(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInStringEscU123
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateInStringEscU123 is the state after reading `"\u123` during a quoted string.
+func stateInStringEscU123(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInString
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateNeg is the state after reading `-` during a number.
+func stateNeg(s *scanner, c byte) int {
+	if c == '0' {
+		s.step = state0
+		return scanContinue
+	}
+	if '1' <= c && c <= '9' {
+		s.step = state1
+		return scanContinue
+	}
+	return s.error(c, "in numeric literal")
+}
+
+// state1 is the state after reading a non-zero integer during a number,
+// such as after reading `1` or `100` but not `0`.
+func state1(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		s.step = state1
+		return scanContinue
+	}
+	return state0(s, c)
+}
+
+// state0 is the state after reading `0` during a number.
+func state0(s *scanner, c byte) int {
+	if c == '.' {
+		s.step = stateDot
+		return scanContinue
+	}
+	if c == 'e' || c == 'E' {
+		s.step = stateE
+		return scanContinue
+	}
+	return stateEndValue(s, c)
+}
+
+// stateDot is the state after reading the integer and decimal point in a number,
+// such as after reading `1.`.
+func stateDot(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		s.step = stateDot0
+		return scanContinue
+	}
+	return s.error(c, "after decimal point in numeric literal")
+}
+
+// stateDot0 is the state after reading the integer, decimal point, and subsequent
+// digits of a number, such as after reading `3.14`.
+func stateDot0(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		return scanContinue
+	}
+	if c == 'e' || c == 'E' {
+		s.step = stateE
+		return scanContinue
+	}
+	return stateEndValue(s, c)
+}
+
+// stateE is the state after reading the mantissa and e in a number,
+// such as after reading `314e` or `0.314e`.
+func stateE(s *scanner, c byte) int {
+	if c == '+' || c == '-' {
+		s.step = stateESign
+		return scanContinue
+	}
+	return stateESign(s, c)
+}
+
+// stateESign is the state after reading the mantissa, e, and sign in a number,
+// such as after reading `314e-` or `0.314e+`.
+func stateESign(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		s.step = stateE0
+		return scanContinue
+	}
+	return s.error(c, "in exponent of numeric literal")
+}
+
+// stateE0 is the state after reading the mantissa, e, optional sign,
+// and at least one digit of the exponent in a number,
+// such as after reading `314e-2` or `0.314e+1` or `3.14e0`.
+func stateE0(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		return scanContinue
+	}
+	return stateEndValue(s, c)
+}
+
+// stateT is the state after reading `t`.
+func stateT(s *scanner, c byte) int {
+	if c == 'r' {
+		s.step = stateTr
+		return scanContinue
+	}
+	return s.error(c, "in literal true (expecting 'r')")
+}
+
+// stateTr is the state after reading `tr`.
+func stateTr(s *scanner, c byte) int {
+	if c == 'u' {
+		s.step = stateTru
+		return scanContinue
+	}
+	return s.error(c, "in literal true (expecting 'u')")
+}
+
+// stateTru is the state after reading `tru`.
+func stateTru(s *scanner, c byte) int {
+	if c == 'e' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	return s.error(c, "in literal true (expecting 'e')")
+}
+
+// stateF is the state after reading `f`.
+func stateF(s *scanner, c byte) int {
+	if c == 'a' {
+		s.step = stateFa
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 'a')")
+}
+
+// stateFa is the state after reading `fa`.
+func stateFa(s *scanner, c byte) int {
+	if c == 'l' {
+		s.step = stateFal
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 'l')")
+}
+
+// stateFal is the state after reading `fal`.
+func stateFal(s *scanner, c byte) int {
+	if c == 's' {
+		s.step = stateFals
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 's')")
+}
+
+// stateFals is the state after reading `fals`.
+func stateFals(s *scanner, c byte) int {
+	if c == 'e' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 'e')")
+}
+
+// stateN is the state after reading `n`.
+func stateN(s *scanner, c byte) int {
+	if c == 'u' {
+		s.step = stateNu
+		return scanContinue
+	}
+	return s.error(c, "in literal null (expecting 'u')")
+}
+
+// stateNu is the state after reading `nu`.
+func stateNu(s *scanner, c byte) int {
+	if c == 'l' {
+		s.step = stateNul
+		return scanContinue
+	}
+	return s.error(c, "in literal null (expecting 'l')")
+}
+
+// stateNul is the state after reading `nul`.
+func stateNul(s *scanner, c byte) int {
+	if c == 'l' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	return s.error(c, "in literal null (expecting 'l')")
+}
+
+// stateError is the state after reaching a syntax error,
+// such as after reading `[1}` or `5.1.2`.
+func stateError(s *scanner, c byte) int {
+	return scanError
+}
+
+// error records an error and switches to the error state.
+func (s *scanner) error(c byte, context string) int {
+	s.step = stateError
+	s.err = &SyntaxError{"invalid character " + quoteChar(c) + " " + context, s.bytes}
+	return scanError
+}
+
+// quoteChar formats c as a quoted character literal.
+func quoteChar(c byte) string {
+	// special cases - different from quoted strings
+	if c == '\'' {
+		return `'\''`
+	}
+	if c == '"' {
+		return `'"'`
+	}
+
+	// use quoted string with different quotation marks
+	s := strconv.Quote(string(c))
+	return "'" + s[1:len(s)-1] + "'"
+}
diff --git a/sdks/go/internal/encoding/json/sentinel/null.go b/sdks/go/internal/encoding/json/sentinel/null.go
new file mode 100644
index 00000000..031f2d8c
--- /dev/null
+++ b/sdks/go/internal/encoding/json/sentinel/null.go
@@ -0,0 +1,46 @@
+package sentinel
+
+import (
+	"github.com/kernel/hypeman-go/internal/encoding/json/shims"
+	"reflect"
+	"sync"
+)
+
+type cacheEntry struct {
+	x    any
+	ptr  uintptr
+	kind reflect.Kind
+}
+
+var nullCache sync.Map // map[reflect.Type]cacheEntry
+
+func NewNullSentinel[T any](mk func() T) T {
+	t := shims.TypeFor[T]()
+	entry, loaded := nullCache.Load(t) // avoid premature allocation
+	if !loaded {
+		x := mk()
+		ptr := reflect.ValueOf(x).Pointer()
+		entry, _ = nullCache.LoadOrStore(t, cacheEntry{x, ptr, t.Kind()})
+	}
+	return entry.(cacheEntry).x.(T)
+}
+
+// for internal use only
+func IsValueNull(v reflect.Value) bool {
+	switch v.Kind() {
+	case reflect.Map, reflect.Slice:
+		null, ok := nullCache.Load(v.Type())
+		return ok && v.Pointer() == null.(cacheEntry).ptr
+	}
+	return false
+}
+
+func IsNull[T any](v T) bool {
+	t := shims.TypeFor[T]()
+	switch t.Kind() {
+	case reflect.Map, reflect.Slice:
+		null, ok := nullCache.Load(t)
+		return ok && reflect.ValueOf(v).Pointer() == null.(cacheEntry).ptr
+	}
+	return false
+}
diff --git a/sdks/go/internal/encoding/json/sentinel/sentinel_test.go b/sdks/go/internal/encoding/json/sentinel/sentinel_test.go
new file mode 100644
index 00000000..7578a33c
--- /dev/null
+++ b/sdks/go/internal/encoding/json/sentinel/sentinel_test.go
@@ -0,0 +1,91 @@
+package sentinel_test
+
+import (
+	"github.com/kernel/hypeman-go/internal/encoding/json/sentinel"
+	"github.com/kernel/hypeman-go/packages/param"
+	"reflect"
+	"slices"
+	"testing"
+)
+
+type Pair struct {
+	got  bool
+	want bool
+}
+
+func TestNullSlice(t *testing.T) {
+	var nilSlice []int = nil
+	var nonNilSlice []int = []int{1, 2, 3}
+	var nullSlice []int = param.NullSlice[[]int]()
+
+	cases := map[string]Pair{
+		"nilSlice":            {sentinel.IsNull(nilSlice), false},
+		"nullSlice":           {sentinel.IsNull(nullSlice), true},
+		"newNullSlice":        {sentinel.IsNull(param.NullSlice[[]int]()), true},
+		"lenNullSlice":        {len(nullSlice) == 0, true},
+		"nilSliceValue":       {sentinel.IsValueNull(reflect.ValueOf(nilSlice)), false},
+		"nullSliceValue":      {sentinel.IsValueNull(reflect.ValueOf(nullSlice)), true},
+		"compareSlices":       {slices.Compare(nilSlice, nullSlice) == 0, true},
+		"compareNonNilSlices": {slices.Compare(nonNilSlice, nullSlice) == 0, false},
+	}
+
+	for name, c := range cases {
+		t.Run(name, func(t *testing.T) {
+			got, want := c.got, c.want
+			if got != want {
+				t.Errorf("got %v, want %v", got, want)
+			}
+		})
+	}
+}
+
+func TestNullMap(t *testing.T) {
+	var nilMap map[string]int = nil
+	var nonNilMap map[string]int = map[string]int{"a": 1, "b": 2}
+	var nullMap map[string]int = param.NullMap[map[string]int]()
+
+	cases := map[string]Pair{
+		"nilMap":            {sentinel.IsNull(nilMap), false},
+		"nullMap":           {sentinel.IsNull(nullMap), true},
+		"newNullMap":        {sentinel.IsNull(param.NullMap[map[string]int]()), true},
+		"lenNullMap":        {len(nullMap) == 0, true},
+		"nilMapValue":       {sentinel.IsValueNull(reflect.ValueOf(nilMap)), false},
+		"nullMapValue":      {sentinel.IsValueNull(reflect.ValueOf(nullMap)), true},
+		"compareMaps":       {reflect.DeepEqual(nilMap, nullMap), false},
+		"compareNonNilMaps": {reflect.DeepEqual(nonNilMap, nullMap), false},
+	}
+
+	for name, test := range cases {
+		t.Run(name, func(t *testing.T) {
+			got, want := test.got, test.want
+			if got != want {
+				t.Errorf("got %v, want %v", got, want)
+			}
+		})
+	}
+}
+
+func TestIsNullRepeated(t *testing.T) {
+	// Test for slices
+	nullSlice1 := param.NullSlice[[]int]()
+	nullSlice2 := param.NullSlice[[]int]()
+	if !sentinel.IsNull(nullSlice1) {
+		t.Errorf("IsNull(nullSlice1) = false, want true")
+	}
+	if !sentinel.IsNull(nullSlice2) {
+		t.Errorf("IsNull(nullSlice2) = false, want true")
+	}
+	if !sentinel.IsNull(nullSlice1) || !sentinel.IsNull(nullSlice2) {
+		t.Errorf("IsNull should return true for all NullSlice instances")
+	}
+
+	// Test for maps
+	nullMap1 := param.NullMap[map[string]int]()
+	nullMap2 := param.NullMap[map[string]int]()
+	if !sentinel.IsNull(nullMap1) {
+		t.Errorf("IsNull(nullMap1) = false, want true")
+	}
+	if !sentinel.IsNull(nullMap2) {
+		t.Errorf("IsNull(nullMap2) = false, want true")
+	}
+}
diff --git a/sdks/go/internal/encoding/json/shims/shims.go b/sdks/go/internal/encoding/json/shims/shims.go
new file mode 100644
index 00000000..fe9a71ab
--- /dev/null
+++ b/sdks/go/internal/encoding/json/shims/shims.go
@@ -0,0 +1,113 @@
+// This package provides shims over Go 1.2{2,3} APIs
+// which are missing from Go 1.22, and used by the Go 1.24 encoding/json package.
+//
+// Inside the vendored package, all shim code has comments that begin look like
+// // SHIM(...): ...
+package shims
+
+import (
+	"encoding/base64"
+	"reflect"
+	"slices"
+)
+
+const EscapeHTMLByDefault = true
+
+type OverflowableType struct{ reflect.Type }
+
+func (t OverflowableType) OverflowInt(x int64) bool {
+	k := t.Kind()
+	switch k {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		bitSize := t.Size() * 8
+		trunc := (x << (64 - bitSize)) >> (64 - bitSize)
+		return x != trunc
+	}
+	panic("reflect: OverflowInt of non-int type " + t.String())
+}
+
+func (t OverflowableType) OverflowUint(x uint64) bool {
+	k := t.Kind()
+	switch k {
+	case reflect.Uint, reflect.Uintptr, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		bitSize := t.Size() * 8
+		trunc := (x << (64 - bitSize)) >> (64 - bitSize)
+		return x != trunc
+	}
+	panic("reflect: OverflowUint of non-uint type " + t.String())
+}
+
+// Original src code from Go 1.23 go/src/reflect/type.go (taken 1/9/25)
+/*
+
+func (t *rtype) OverflowInt(x int64) bool {
+	k := t.Kind()
+	switch k {
+	case Int, Int8, Int16, Int32, Int64:
+		bitSize := t.Size() * 8
+		trunc := (x << (64 - bitSize)) >> (64 - bitSize)
+		return x != trunc
+	}
+	panic("reflect: OverflowInt of non-int type " + t.String())
+}
+
+func (t *rtype) OverflowUint(x uint64) bool {
+	k := t.Kind()
+	switch k {
+	case Uint, Uintptr, Uint8, Uint16, Uint32, Uint64:
+		bitSize := t.Size() * 8
+		trunc := (x << (64 - bitSize)) >> (64 - bitSize)
+		return x != trunc
+	}
+	panic("reflect: OverflowUint of non-uint type " + t.String())
+}
+
+*/
+
+// TypeFor returns the [Type] that represents the type argument T.
+func TypeFor[T any]() reflect.Type {
+	var v T
+	if t := reflect.TypeOf(v); t != nil {
+		return t // optimize for T being a non-interface kind
+	}
+	return reflect.TypeOf((*T)(nil)).Elem() // only for an interface kind
+}
+
+// Original src code from Go 1.23 go/src/reflect/type.go (taken 1/9/25)
+/*
+
+// TypeFor returns the [Type] that represents the type argument T.
+func TypeFor[T any]() Type {
+	var v T
+	if t := TypeOf(v); t != nil {
+		return t // optimize for T being a non-interface kind
+	}
+	return TypeOf((*T)(nil)).Elem() // only for an interface kind
+}
+
+*/
+
+type AppendableStdEncoding struct{ *base64.Encoding }
+
+// AppendEncode appends the base64 encoded src to dst
+// and returns the extended buffer.
+func (enc AppendableStdEncoding) AppendEncode(dst, src []byte) []byte {
+	n := enc.EncodedLen(len(src))
+	dst = slices.Grow(dst, n)
+	enc.Encode(dst[len(dst):][:n], src)
+	return dst[:len(dst)+n]
+}
+
+// Original src code from Go 1.23.4 go/src/encoding/base64/base64.go (taken 1/9/25)
+/*
+
+// AppendEncode appends the base64 encoded src to dst
+// and returns the extended buffer.
+func (enc *Encoding) AppendEncode(dst, src []byte) []byte {
+	n := enc.EncodedLen(len(src))
+	dst = slices.Grow(dst, n)
+	enc.Encode(dst[len(dst):][:n], src)
+	return dst[:len(dst)+n]
+}
+
+*/
diff --git a/sdks/go/internal/encoding/json/stream.go b/sdks/go/internal/encoding/json/stream.go
new file mode 100644
index 00000000..e2d9470b
--- /dev/null
+++ b/sdks/go/internal/encoding/json/stream.go
@@ -0,0 +1,512 @@
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"bytes"
+	"errors"
+	"io"
+)
+
+// A Decoder reads and decodes JSON values from an input stream.
+type Decoder struct {
+	r       io.Reader
+	buf     []byte
+	d       decodeState
+	scanp   int   // start of unread data in buf
+	scanned int64 // amount of data already scanned
+	scan    scanner
+	err     error
+
+	tokenState int
+	tokenStack []int
+}
+
+// NewDecoder returns a new decoder that reads from r.
+//
+// The decoder introduces its own buffering and may
+// read data from r beyond the JSON values requested.
+func NewDecoder(r io.Reader) *Decoder {
+	return &Decoder{r: r}
+}
+
+// UseNumber causes the Decoder to unmarshal a number into an
+// interface value as a [Number] instead of as a float64.
+func (dec *Decoder) UseNumber() { dec.d.useNumber = true }
+
+// DisallowUnknownFields causes the Decoder to return an error when the destination
+// is a struct and the input contains object keys which do not match any
+// non-ignored, exported fields in the destination.
+func (dec *Decoder) DisallowUnknownFields() { dec.d.disallowUnknownFields = true }
+
+// Decode reads the next JSON-encoded value from its
+// input and stores it in the value pointed to by v.
+//
+// See the documentation for [Unmarshal] for details about
+// the conversion of JSON into a Go value.
+func (dec *Decoder) Decode(v any) error {
+	if dec.err != nil {
+		return dec.err
+	}
+
+	if err := dec.tokenPrepareForDecode(); err != nil {
+		return err
+	}
+
+	if !dec.tokenValueAllowed() {
+		return &SyntaxError{msg: "not at beginning of value", Offset: dec.InputOffset()}
+	}
+
+	// Read whole value into buffer.
+	n, err := dec.readValue()
+	if err != nil {
+		return err
+	}
+	dec.d.init(dec.buf[dec.scanp : dec.scanp+n])
+	dec.scanp += n
+
+	// Don't save err from unmarshal into dec.err:
+	// the connection is still usable since we read a complete JSON
+	// object from it before the error happened.
+	err = dec.d.unmarshal(v)
+
+	// fixup token streaming state
+	dec.tokenValueEnd()
+
+	return err
+}
+
+// Buffered returns a reader of the data remaining in the Decoder's
+// buffer. The reader is valid until the next call to [Decoder.Decode].
+func (dec *Decoder) Buffered() io.Reader {
+	return bytes.NewReader(dec.buf[dec.scanp:])
+}
+
+// readValue reads a JSON value into dec.buf.
+// It returns the length of the encoding.
+func (dec *Decoder) readValue() (int, error) {
+	dec.scan.reset()
+
+	scanp := dec.scanp
+	var err error
+Input:
+	// help the compiler see that scanp is never negative, so it can remove
+	// some bounds checks below.
+	for scanp >= 0 {
+
+		// Look in the buffer for a new value.
+		for ; scanp < len(dec.buf); scanp++ {
+			c := dec.buf[scanp]
+			dec.scan.bytes++
+			switch dec.scan.step(&dec.scan, c) {
+			case scanEnd:
+				// scanEnd is delayed one byte so we decrement
+				// the scanner bytes count by 1 to ensure that
+				// this value is correct in the next call of Decode.
+				dec.scan.bytes--
+				break Input
+			case scanEndObject, scanEndArray:
+				// scanEnd is delayed one byte.
+				// We might block trying to get that byte from src,
+				// so instead invent a space byte.
+				if stateEndValue(&dec.scan, ' ') == scanEnd {
+					scanp++
+					break Input
+				}
+			case scanError:
+				dec.err = dec.scan.err
+				return 0, dec.scan.err
+			}
+		}
+
+		// Did the last read have an error?
+		// Delayed until now to allow buffer scan.
+		if err != nil {
+			if err == io.EOF {
+				if dec.scan.step(&dec.scan, ' ') == scanEnd {
+					break Input
+				}
+				if nonSpace(dec.buf) {
+					err = io.ErrUnexpectedEOF
+				}
+			}
+			dec.err = err
+			return 0, err
+		}
+
+		n := scanp - dec.scanp
+		err = dec.refill()
+		scanp = dec.scanp + n
+	}
+	return scanp - dec.scanp, nil
+}
+
+func (dec *Decoder) refill() error {
+	// Make room to read more into the buffer.
+	// First slide down data already consumed.
+	if dec.scanp > 0 {
+		dec.scanned += int64(dec.scanp)
+		n := copy(dec.buf, dec.buf[dec.scanp:])
+		dec.buf = dec.buf[:n]
+		dec.scanp = 0
+	}
+
+	// Grow buffer if not large enough.
+	const minRead = 512
+	if cap(dec.buf)-len(dec.buf) < minRead {
+		newBuf := make([]byte, len(dec.buf), 2*cap(dec.buf)+minRead)
+		copy(newBuf, dec.buf)
+		dec.buf = newBuf
+	}
+
+	// Read. Delay error for next iteration (after scan).
+	n, err := dec.r.Read(dec.buf[len(dec.buf):cap(dec.buf)])
+	dec.buf = dec.buf[0 : len(dec.buf)+n]
+
+	return err
+}
+
+func nonSpace(b []byte) bool {
+	for _, c := range b {
+		if !isSpace(c) {
+			return true
+		}
+	}
+	return false
+}
+
+// An Encoder writes JSON values to an output stream.
+type Encoder struct {
+	w          io.Writer
+	err        error
+	escapeHTML bool
+
+	indentBuf    []byte
+	indentPrefix string
+	indentValue  string
+}
+
+// NewEncoder returns a new encoder that writes to w.
+func NewEncoder(w io.Writer) *Encoder {
+	return &Encoder{w: w, escapeHTML: true}
+}
+
+// Encode writes the JSON encoding of v to the stream,
+// with insignificant space characters elided,
+// followed by a newline character.
+//
+// See the documentation for [Marshal] for details about the
+// conversion of Go values to JSON.
+func (enc *Encoder) Encode(v any) error {
+	if enc.err != nil {
+		return enc.err
+	}
+
+	e := newEncodeState()
+	defer encodeStatePool.Put(e)
+
+	err := e.marshal(v, encOpts{escapeHTML: enc.escapeHTML})
+	if err != nil {
+		return err
+	}
+
+	// Terminate each value with a newline.
+	// This makes the output look a little nicer
+	// when debugging, and some kind of space
+	// is required if the encoded value was a number,
+	// so that the reader knows there aren't more
+	// digits coming.
+	e.WriteByte('\n')
+
+	b := e.Bytes()
+	if enc.indentPrefix != "" || enc.indentValue != "" {
+		enc.indentBuf, err = appendIndent(enc.indentBuf[:0], b, enc.indentPrefix, enc.indentValue)
+		if err != nil {
+			return err
+		}
+		b = enc.indentBuf
+	}
+	if _, err = enc.w.Write(b); err != nil {
+		enc.err = err
+	}
+	return err
+}
+
+// SetIndent instructs the encoder to format each subsequent encoded
+// value as if indented by the package-level function Indent(dst, src, prefix, indent).
+// Calling SetIndent("", "") disables indentation.
+func (enc *Encoder) SetIndent(prefix, indent string) {
+	enc.indentPrefix = prefix
+	enc.indentValue = indent
+}
+
+// SetEscapeHTML specifies whether problematic HTML characters
+// should be escaped inside JSON quoted strings.
+// The default behavior is to escape &, <, and > to \u0026, \u003c, and \u003e
+// to avoid certain safety problems that can arise when embedding JSON in HTML.
+//
+// In non-HTML settings where the escaping interferes with the readability
+// of the output, SetEscapeHTML(false) disables this behavior.
+func (enc *Encoder) SetEscapeHTML(on bool) {
+	enc.escapeHTML = on
+}
+
+// RawMessage is a raw encoded JSON value.
+// It implements [Marshaler] and [Unmarshaler] and can
+// be used to delay JSON decoding or precompute a JSON encoding.
+type RawMessage []byte
+
+// MarshalJSON returns m as the JSON encoding of m.
+func (m RawMessage) MarshalJSON() ([]byte, error) {
+	if m == nil {
+		return []byte("null"), nil
+	}
+	return m, nil
+}
+
+// UnmarshalJSON sets *m to a copy of data.
+func (m *RawMessage) UnmarshalJSON(data []byte) error {
+	if m == nil {
+		return errors.New("json.RawMessage: UnmarshalJSON on nil pointer")
+	}
+	*m = append((*m)[0:0], data...)
+	return nil
+}
+
+var _ Marshaler = (*RawMessage)(nil)
+var _ Unmarshaler = (*RawMessage)(nil)
+
+// A Token holds a value of one of these types:
+//
+//   - [Delim], for the four JSON delimiters [ ] { }
+//   - bool, for JSON booleans
+//   - float64, for JSON numbers
+//   - [Number], for JSON numbers
+//   - string, for JSON string literals
+//   - nil, for JSON null
+type Token any
+
+const (
+	tokenTopValue = iota
+	tokenArrayStart
+	tokenArrayValue
+	tokenArrayComma
+	tokenObjectStart
+	tokenObjectKey
+	tokenObjectColon
+	tokenObjectValue
+	tokenObjectComma
+)
+
+// advance tokenstate from a separator state to a value state
+func (dec *Decoder) tokenPrepareForDecode() error {
+	// Note: Not calling peek before switch, to avoid
+	// putting peek into the standard Decode path.
+	// peek is only called when using the Token API.
+	switch dec.tokenState {
+	case tokenArrayComma:
+		c, err := dec.peek()
+		if err != nil {
+			return err
+		}
+		if c != ',' {
+			return &SyntaxError{"expected comma after array element", dec.InputOffset()}
+		}
+		dec.scanp++
+		dec.tokenState = tokenArrayValue
+	case tokenObjectColon:
+		c, err := dec.peek()
+		if err != nil {
+			return err
+		}
+		if c != ':' {
+			return &SyntaxError{"expected colon after object key", dec.InputOffset()}
+		}
+		dec.scanp++
+		dec.tokenState = tokenObjectValue
+	}
+	return nil
+}
+
+func (dec *Decoder) tokenValueAllowed() bool {
+	switch dec.tokenState {
+	case tokenTopValue, tokenArrayStart, tokenArrayValue, tokenObjectValue:
+		return true
+	}
+	return false
+}
+
+func (dec *Decoder) tokenValueEnd() {
+	switch dec.tokenState {
+	case tokenArrayStart, tokenArrayValue:
+		dec.tokenState = tokenArrayComma
+	case tokenObjectValue:
+		dec.tokenState = tokenObjectComma
+	}
+}
+
+// A Delim is a JSON array or object delimiter, one of [ ] { or }.
+type Delim rune
+
+func (d Delim) String() string {
+	return string(d)
+}
+
+// Token returns the next JSON token in the input stream.
+// At the end of the input stream, Token returns nil, [io.EOF].
+//
+// Token guarantees that the delimiters [ ] { } it returns are
+// properly nested and matched: if Token encounters an unexpected
+// delimiter in the input, it will return an error.
+//
+// The input stream consists of basic JSON values—bool, string,
+// number, and null—along with delimiters [ ] { } of type [Delim]
+// to mark the start and end of arrays and objects.
+// Commas and colons are elided.
+func (dec *Decoder) Token() (Token, error) {
+	for {
+		c, err := dec.peek()
+		if err != nil {
+			return nil, err
+		}
+		switch c {
+		case '[':
+			if !dec.tokenValueAllowed() {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenStack = append(dec.tokenStack, dec.tokenState)
+			dec.tokenState = tokenArrayStart
+			return Delim('['), nil
+
+		case ']':
+			if dec.tokenState != tokenArrayStart && dec.tokenState != tokenArrayComma {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenState = dec.tokenStack[len(dec.tokenStack)-1]
+			dec.tokenStack = dec.tokenStack[:len(dec.tokenStack)-1]
+			dec.tokenValueEnd()
+			return Delim(']'), nil
+
+		case '{':
+			if !dec.tokenValueAllowed() {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenStack = append(dec.tokenStack, dec.tokenState)
+			dec.tokenState = tokenObjectStart
+			return Delim('{'), nil
+
+		case '}':
+			if dec.tokenState != tokenObjectStart && dec.tokenState != tokenObjectComma {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenState = dec.tokenStack[len(dec.tokenStack)-1]
+			dec.tokenStack = dec.tokenStack[:len(dec.tokenStack)-1]
+			dec.tokenValueEnd()
+			return Delim('}'), nil
+
+		case ':':
+			if dec.tokenState != tokenObjectColon {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenState = tokenObjectValue
+			continue
+
+		case ',':
+			if dec.tokenState == tokenArrayComma {
+				dec.scanp++
+				dec.tokenState = tokenArrayValue
+				continue
+			}
+			if dec.tokenState == tokenObjectComma {
+				dec.scanp++
+				dec.tokenState = tokenObjectKey
+				continue
+			}
+			return dec.tokenError(c)
+
+		case '"':
+			if dec.tokenState == tokenObjectStart || dec.tokenState == tokenObjectKey {
+				var x string
+				old := dec.tokenState
+				dec.tokenState = tokenTopValue
+				err := dec.Decode(&x)
+				dec.tokenState = old
+				if err != nil {
+					return nil, err
+				}
+				dec.tokenState = tokenObjectColon
+				return x, nil
+			}
+			fallthrough
+
+		default:
+			if !dec.tokenValueAllowed() {
+				return dec.tokenError(c)
+			}
+			var x any
+			if err := dec.Decode(&x); err != nil {
+				return nil, err
+			}
+			return x, nil
+		}
+	}
+}
+
+func (dec *Decoder) tokenError(c byte) (Token, error) {
+	var context string
+	switch dec.tokenState {
+	case tokenTopValue:
+		context = " looking for beginning of value"
+	case tokenArrayStart, tokenArrayValue, tokenObjectValue:
+		context = " looking for beginning of value"
+	case tokenArrayComma:
+		context = " after array element"
+	case tokenObjectKey:
+		context = " looking for beginning of object key string"
+	case tokenObjectColon:
+		context = " after object key"
+	case tokenObjectComma:
+		context = " after object key:value pair"
+	}
+	return nil, &SyntaxError{"invalid character " + quoteChar(c) + context, dec.InputOffset()}
+}
+
+// More reports whether there is another element in the
+// current array or object being parsed.
+func (dec *Decoder) More() bool {
+	c, err := dec.peek()
+	return err == nil && c != ']' && c != '}'
+}
+
+func (dec *Decoder) peek() (byte, error) {
+	var err error
+	for {
+		for i := dec.scanp; i < len(dec.buf); i++ {
+			c := dec.buf[i]
+			if isSpace(c) {
+				continue
+			}
+			dec.scanp = i
+			return c, nil
+		}
+		// buffer has been scanned, now report any error
+		if err != nil {
+			return 0, err
+		}
+		err = dec.refill()
+	}
+}
+
+// InputOffset returns the input stream byte offset of the current decoder position.
+// The offset gives the location of the end of the most recently returned token
+// and the beginning of the next token.
+func (dec *Decoder) InputOffset() int64 {
+	return dec.scanned + int64(dec.scanp)
+}
diff --git a/sdks/go/internal/encoding/json/tables.go b/sdks/go/internal/encoding/json/tables.go
new file mode 100644
index 00000000..10acdc18
--- /dev/null
+++ b/sdks/go/internal/encoding/json/tables.go
@@ -0,0 +1,218 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import "unicode/utf8"
+
+// safeSet holds the value true if the ASCII character with the given array
+// position can be represented inside a JSON string without any further
+// escaping.
+//
+// All values are true except for the ASCII control characters (0-31), the
+// double quote ("), and the backslash character ("\").
+var safeSet = [utf8.RuneSelf]bool{
+	' ':      true,
+	'!':      true,
+	'"':      false,
+	'#':      true,
+	'$':      true,
+	'%':      true,
+	'&':      true,
+	'\'':     true,
+	'(':      true,
+	')':      true,
+	'*':      true,
+	'+':      true,
+	',':      true,
+	'-':      true,
+	'.':      true,
+	'/':      true,
+	'0':      true,
+	'1':      true,
+	'2':      true,
+	'3':      true,
+	'4':      true,
+	'5':      true,
+	'6':      true,
+	'7':      true,
+	'8':      true,
+	'9':      true,
+	':':      true,
+	';':      true,
+	'<':      true,
+	'=':      true,
+	'>':      true,
+	'?':      true,
+	'@':      true,
+	'A':      true,
+	'B':      true,
+	'C':      true,
+	'D':      true,
+	'E':      true,
+	'F':      true,
+	'G':      true,
+	'H':      true,
+	'I':      true,
+	'J':      true,
+	'K':      true,
+	'L':      true,
+	'M':      true,
+	'N':      true,
+	'O':      true,
+	'P':      true,
+	'Q':      true,
+	'R':      true,
+	'S':      true,
+	'T':      true,
+	'U':      true,
+	'V':      true,
+	'W':      true,
+	'X':      true,
+	'Y':      true,
+	'Z':      true,
+	'[':      true,
+	'\\':     false,
+	']':      true,
+	'^':      true,
+	'_':      true,
+	'`':      true,
+	'a':      true,
+	'b':      true,
+	'c':      true,
+	'd':      true,
+	'e':      true,
+	'f':      true,
+	'g':      true,
+	'h':      true,
+	'i':      true,
+	'j':      true,
+	'k':      true,
+	'l':      true,
+	'm':      true,
+	'n':      true,
+	'o':      true,
+	'p':      true,
+	'q':      true,
+	'r':      true,
+	's':      true,
+	't':      true,
+	'u':      true,
+	'v':      true,
+	'w':      true,
+	'x':      true,
+	'y':      true,
+	'z':      true,
+	'{':      true,
+	'|':      true,
+	'}':      true,
+	'~':      true,
+	'\u007f': true,
+}
+
+// htmlSafeSet holds the value true if the ASCII character with the given
+// array position can be safely represented inside a JSON string, embedded
+// inside of HTML <script> tags, without any additional escaping.
+//
+// All values are true except for the ASCII control characters (0-31), the
+// double quote ("), the backslash character ("\"), HTML opening and closing
+// tags ("<" and ">"), and the ampersand ("&").
+var htmlSafeSet = [utf8.RuneSelf]bool{
+	' ':      true,
+	'!':      true,
+	'"':      false,
+	'#':      true,
+	'$':      true,
+	'%':      true,
+	'&':      false,
+	'\'':     true,
+	'(':      true,
+	')':      true,
+	'*':      true,
+	'+':      true,
+	',':      true,
+	'-':      true,
+	'.':      true,
+	'/':      true,
+	'0':      true,
+	'1':      true,
+	'2':      true,
+	'3':      true,
+	'4':      true,
+	'5':      true,
+	'6':      true,
+	'7':      true,
+	'8':      true,
+	'9':      true,
+	':':      true,
+	';':      true,
+	'<':      false,
+	'=':      true,
+	'>':      false,
+	'?':      true,
+	'@':      true,
+	'A':      true,
+	'B':      true,
+	'C':      true,
+	'D':      true,
+	'E':      true,
+	'F':      true,
+	'G':      true,
+	'H':      true,
+	'I':      true,
+	'J':      true,
+	'K':      true,
+	'L':      true,
+	'M':      true,
+	'N':      true,
+	'O':      true,
+	'P':      true,
+	'Q':      true,
+	'R':      true,
+	'S':      true,
+	'T':      true,
+	'U':      true,
+	'V':      true,
+	'W':      true,
+	'X':      true,
+	'Y':      true,
+	'Z':      true,
+	'[':      true,
+	'\\':     false,
+	']':      true,
+	'^':      true,
+	'_':      true,
+	'`':      true,
+	'a':      true,
+	'b':      true,
+	'c':      true,
+	'd':      true,
+	'e':      true,
+	'f':      true,
+	'g':      true,
+	'h':      true,
+	'i':      true,
+	'j':      true,
+	'k':      true,
+	'l':      true,
+	'm':      true,
+	'n':      true,
+	'o':      true,
+	'p':      true,
+	'q':      true,
+	'r':      true,
+	's':      true,
+	't':      true,
+	'u':      true,
+	'v':      true,
+	'w':      true,
+	'x':      true,
+	'y':      true,
+	'z':      true,
+	'{':      true,
+	'|':      true,
+	'}':      true,
+	'~':      true,
+	'\u007f': true,
+}
diff --git a/sdks/go/internal/encoding/json/tags.go b/sdks/go/internal/encoding/json/tags.go
new file mode 100644
index 00000000..b490328f
--- /dev/null
+++ b/sdks/go/internal/encoding/json/tags.go
@@ -0,0 +1,38 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"strings"
+)
+
+// tagOptions is the string following a comma in a struct field's "json"
+// tag, or the empty string. It does not include the leading comma.
+type tagOptions string
+
+// parseTag splits a struct field's json tag into its name and
+// comma-separated options.
+func parseTag(tag string) (string, tagOptions) {
+	tag, opt, _ := strings.Cut(tag, ",")
+	return tag, tagOptions(opt)
+}
+
+// Contains reports whether a comma-separated list of options
+// contains a particular substr flag. substr must be surrounded by a
+// string boundary or commas.
+func (o tagOptions) Contains(optionName string) bool {
+	if len(o) == 0 {
+		return false
+	}
+	s := string(o)
+	for s != "" {
+		var name string
+		name, s, _ = strings.Cut(s, ",")
+		if name == optionName {
+			return true
+		}
+	}
+	return false
+}
diff --git a/sdks/go/internal/encoding/json/time.go b/sdks/go/internal/encoding/json/time.go
new file mode 100644
index 00000000..581f0af2
--- /dev/null
+++ b/sdks/go/internal/encoding/json/time.go
@@ -0,0 +1,61 @@
+// EDIT(begin): custom time marshaler
+package json
+
+import (
+	"github.com/kernel/hypeman-go/internal/encoding/json/shims"
+	"reflect"
+	"time"
+)
+
+type TimeMarshaler interface {
+	MarshalJSONWithTimeLayout(string) []byte
+}
+
+func TimeLayout(fmt string) string {
+	switch fmt {
+	case "", "date-time":
+		return time.RFC3339
+	case "date":
+		return time.DateOnly
+	default:
+		return fmt
+	}
+}
+
+var timeType = shims.TypeFor[time.Time]()
+
+func newTimeEncoder() encoderFunc {
+	return func(e *encodeState, v reflect.Value, opts encOpts) {
+		t := v.Interface().(time.Time)
+		fmtted := t.Format(TimeLayout(opts.timefmt))
+		stringEncoder(e, reflect.ValueOf(fmtted), opts)
+	}
+}
+
+// Uses continuation passing style, to add the timefmt option to k
+func continueWithTimeFmt(timefmt string, k encoderFunc) encoderFunc {
+	return func(e *encodeState, v reflect.Value, opts encOpts) {
+		opts.timefmt = timefmt
+		k(e, v, opts)
+	}
+}
+
+func timeMarshalEncoder(e *encodeState, v reflect.Value, opts encOpts) bool {
+	tm, ok := v.Interface().(TimeMarshaler)
+	if !ok {
+		return false
+	}
+
+	b := tm.MarshalJSONWithTimeLayout(opts.timefmt)
+	if b != nil {
+		e.Grow(len(b))
+		out := e.AvailableBuffer()
+		out, _ = appendCompact(out, b, opts.escapeHTML)
+		e.Buffer.Write(out)
+		return true
+	}
+
+	return false
+}
+
+// EDIT(end)
diff --git a/sdks/go/internal/paramutil/field.go b/sdks/go/internal/paramutil/field.go
new file mode 100644
index 00000000..6022f514
--- /dev/null
+++ b/sdks/go/internal/paramutil/field.go
@@ -0,0 +1,30 @@
+package paramutil
+
+import (
+	"github.com/kernel/hypeman-go/packages/param"
+	"github.com/kernel/hypeman-go/packages/respjson"
+)
+
+func AddrIfPresent[T comparable](v param.Opt[T]) *T {
+	if v.Valid() {
+		return &v.Value
+	}
+	return nil
+}
+
+func ToOpt[T comparable](v T, meta respjson.Field) param.Opt[T] {
+	if meta.Valid() {
+		return param.NewOpt(v)
+	} else if meta.Raw() == respjson.Null {
+		return param.Null[T]()
+	}
+	return param.Opt[T]{}
+}
+
+// Checks if the value is not omitted and not null
+func Valid(v param.ParamStruct) bool {
+	if ovr, ok := v.Overrides(); ok {
+		return ovr != nil
+	}
+	return !param.IsNull(v) && !param.IsOmitted(v)
+}
diff --git a/sdks/go/internal/paramutil/union.go b/sdks/go/internal/paramutil/union.go
new file mode 100644
index 00000000..adecfd4b
--- /dev/null
+++ b/sdks/go/internal/paramutil/union.go
@@ -0,0 +1,48 @@
+package paramutil
+
+import (
+	"fmt"
+	"github.com/kernel/hypeman-go/packages/param"
+	"reflect"
+)
+
+var paramUnionType = reflect.TypeOf(param.APIUnion{})
+
+// VariantFromUnion can be used to extract the present variant from a param union type.
+// A param union type is a struct with an embedded field of [APIUnion].
+func VariantFromUnion(u reflect.Value) (any, error) {
+	if u.Kind() == reflect.Ptr {
+		u = u.Elem()
+	}
+
+	if u.Kind() != reflect.Struct {
+		return nil, fmt.Errorf("param: cannot extract variant from non-struct union")
+	}
+
+	isUnion := false
+	nVariants := 0
+	variantIdx := -1
+	for i := 0; i < u.NumField(); i++ {
+		if !u.Field(i).IsZero() {
+			nVariants++
+			variantIdx = i
+		}
+		if u.Field(i).Type() == paramUnionType {
+			isUnion = u.Type().Field(i).Anonymous
+		}
+	}
+
+	if !isUnion {
+		return nil, fmt.Errorf("param: cannot extract variant from non-union")
+	}
+
+	if nVariants > 1 {
+		return nil, fmt.Errorf("param: cannot extract variant from union with multiple variants")
+	}
+
+	if nVariants == 0 {
+		return nil, fmt.Errorf("param: cannot extract variant from union with no variants")
+	}
+
+	return u.Field(variantIdx).Interface(), nil
+}
diff --git a/sdks/go/internal/requestconfig/requestconfig.go b/sdks/go/internal/requestconfig/requestconfig.go
new file mode 100644
index 00000000..595c464c
--- /dev/null
+++ b/sdks/go/internal/requestconfig/requestconfig.go
@@ -0,0 +1,638 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package requestconfig
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"math"
+	"math/rand"
+	"mime"
+	"net/http"
+	"net/url"
+	"runtime"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/kernel/hypeman-go/internal"
+	"github.com/kernel/hypeman-go/internal/apierror"
+	"github.com/kernel/hypeman-go/internal/apiform"
+	"github.com/kernel/hypeman-go/internal/apiquery"
+)
+
+func getDefaultHeaders() map[string]string {
+	return map[string]string{
+		"User-Agent": fmt.Sprintf("Hypeman/Go %s", internal.PackageVersion),
+	}
+}
+
+func getNormalizedOS() string {
+	switch runtime.GOOS {
+	case "ios":
+		return "iOS"
+	case "android":
+		return "Android"
+	case "darwin":
+		return "MacOS"
+	case "window":
+		return "Windows"
+	case "freebsd":
+		return "FreeBSD"
+	case "openbsd":
+		return "OpenBSD"
+	case "linux":
+		return "Linux"
+	default:
+		return fmt.Sprintf("Other:%s", runtime.GOOS)
+	}
+}
+
+func getNormalizedArchitecture() string {
+	switch runtime.GOARCH {
+	case "386":
+		return "x32"
+	case "amd64":
+		return "x64"
+	case "arm":
+		return "arm"
+	case "arm64":
+		return "arm64"
+	default:
+		return fmt.Sprintf("other:%s", runtime.GOARCH)
+	}
+}
+
+func getPlatformProperties() map[string]string {
+	return map[string]string{
+		"X-Stainless-Lang":            "go",
+		"X-Stainless-Package-Version": internal.PackageVersion,
+		"X-Stainless-OS":              getNormalizedOS(),
+		"X-Stainless-Arch":            getNormalizedArchitecture(),
+		"X-Stainless-Runtime":         "go",
+		"X-Stainless-Runtime-Version": runtime.Version(),
+	}
+}
+
+type RequestOption interface {
+	Apply(*RequestConfig) error
+}
+
+type RequestOptionFunc func(*RequestConfig) error
+type PreRequestOptionFunc func(*RequestConfig) error
+
+func (s RequestOptionFunc) Apply(r *RequestConfig) error    { return s(r) }
+func (s PreRequestOptionFunc) Apply(r *RequestConfig) error { return s(r) }
+
+func NewRequestConfig(ctx context.Context, method string, u string, body any, dst any, opts ...RequestOption) (*RequestConfig, error) {
+	var reader io.Reader
+
+	contentType := "application/json"
+	hasSerializationFunc := false
+
+	if body, ok := body.(json.Marshaler); ok {
+		content, err := body.MarshalJSON()
+		if err != nil {
+			return nil, err
+		}
+		reader = bytes.NewBuffer(content)
+		hasSerializationFunc = true
+	}
+	if body, ok := body.(apiform.Marshaler); ok {
+		var (
+			content []byte
+			err     error
+		)
+		content, contentType, err = body.MarshalMultipart()
+		if err != nil {
+			return nil, err
+		}
+		reader = bytes.NewBuffer(content)
+		hasSerializationFunc = true
+	}
+	if body, ok := body.(apiquery.Queryer); ok {
+		hasSerializationFunc = true
+		q, err := body.URLQuery()
+		if err != nil {
+			return nil, err
+		}
+		params := q.Encode()
+		if params != "" {
+			u = u + "?" + params
+		}
+	}
+	if body, ok := body.([]byte); ok {
+		reader = bytes.NewBuffer(body)
+		hasSerializationFunc = true
+	}
+	if body, ok := body.(io.Reader); ok {
+		reader = body
+		hasSerializationFunc = true
+	}
+
+	// Fallback to json serialization if none of the serialization functions that we expect
+	// to see is present.
+	if body != nil && !hasSerializationFunc {
+		buf := new(bytes.Buffer)
+		enc := json.NewEncoder(buf)
+		enc.SetEscapeHTML(true)
+		if err := enc.Encode(body); err != nil {
+			return nil, err
+		}
+		reader = buf
+	}
+
+	req, err := http.NewRequestWithContext(ctx, method, u, nil)
+	if err != nil {
+		return nil, err
+	}
+	if reader != nil {
+		req.Header.Set("Content-Type", contentType)
+	}
+
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("X-Stainless-Retry-Count", "0")
+	req.Header.Set("X-Stainless-Timeout", "0")
+	for k, v := range getDefaultHeaders() {
+		req.Header.Add(k, v)
+	}
+
+	for k, v := range getPlatformProperties() {
+		req.Header.Add(k, v)
+	}
+	cfg := RequestConfig{
+		MaxRetries: 2,
+		Context:    ctx,
+		Request:    req,
+		HTTPClient: http.DefaultClient,
+		Body:       reader,
+	}
+	cfg.ResponseBodyInto = dst
+	err = cfg.Apply(opts...)
+	if err != nil {
+		return nil, err
+	}
+
+	// This must run after `cfg.Apply(...)` above in case the request timeout gets modified. We also only
+	// apply our own logic for it if it's still "0" from above. If it's not, then it was deleted or modified
+	// by the user and we should respect that.
+	if req.Header.Get("X-Stainless-Timeout") == "0" {
+		if cfg.RequestTimeout == time.Duration(0) {
+			req.Header.Del("X-Stainless-Timeout")
+		} else {
+			req.Header.Set("X-Stainless-Timeout", strconv.Itoa(int(cfg.RequestTimeout.Seconds())))
+		}
+	}
+
+	return &cfg, nil
+}
+
+// This interface is primarily used to describe an [*http.Client], but also
+// supports custom HTTP implementations.
+type HTTPDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// RequestConfig represents all the state related to one request.
+//
+// Editing the variables inside RequestConfig directly is unstable api. Prefer
+// composing the RequestOption instead if possible.
+type RequestConfig struct {
+	MaxRetries     int
+	RequestTimeout time.Duration
+	Context        context.Context
+	Request        *http.Request
+	BaseURL        *url.URL
+	// DefaultBaseURL will be used if BaseURL is not explicitly overridden using
+	// WithBaseURL.
+	DefaultBaseURL *url.URL
+	CustomHTTPDoer HTTPDoer
+	HTTPClient     *http.Client
+	Middlewares    []middleware
+	APIKey         string
+	// If ResponseBodyInto not nil, then we will attempt to deserialize into
+	// ResponseBodyInto. If Destination is a []byte, then it will return the body as
+	// is.
+	ResponseBodyInto any
+	// ResponseInto copies the \*http.Response of the corresponding request into the
+	// given address
+	ResponseInto **http.Response
+	Body         io.Reader
+}
+
+// middleware is exactly the same type as the Middleware type found in the [option] package,
+// but it is redeclared here for circular dependency issues.
+type middleware = func(*http.Request, middlewareNext) (*http.Response, error)
+
+// middlewareNext is exactly the same type as the MiddlewareNext type found in the [option] package,
+// but it is redeclared here for circular dependency issues.
+type middlewareNext = func(*http.Request) (*http.Response, error)
+
+func applyMiddleware(middleware middleware, next middlewareNext) middlewareNext {
+	return func(req *http.Request) (res *http.Response, err error) {
+		return middleware(req, next)
+	}
+}
+
+func shouldRetry(req *http.Request, res *http.Response) bool {
+	// If there is no way to recover the Body, then we shouldn't retry.
+	if req.Body != nil && req.GetBody == nil {
+		return false
+	}
+
+	// If there is no response, that indicates that there is a connection error
+	// so we retry the request.
+	if res == nil {
+		return true
+	}
+
+	// If the header explicitly wants a retry behavior, respect that over the
+	// http status code.
+	if res.Header.Get("x-should-retry") == "true" {
+		return true
+	}
+	if res.Header.Get("x-should-retry") == "false" {
+		return false
+	}
+
+	return res.StatusCode == http.StatusRequestTimeout ||
+		res.StatusCode == http.StatusConflict ||
+		res.StatusCode == http.StatusTooManyRequests ||
+		res.StatusCode >= http.StatusInternalServerError
+}
+
+func parseRetryAfterHeader(resp *http.Response) (time.Duration, bool) {
+	if resp == nil {
+		return 0, false
+	}
+
+	type retryData struct {
+		header string
+		units  time.Duration
+
+		// custom is used when the regular algorithm failed and is optional.
+		// the returned duration is used verbatim (units is not applied).
+		custom func(string) (time.Duration, bool)
+	}
+
+	nop := func(string) (time.Duration, bool) { return 0, false }
+
+	// the headers are listed in order of preference
+	retries := []retryData{
+		{
+			header: "Retry-After-Ms",
+			units:  time.Millisecond,
+			custom: nop,
+		},
+		{
+			header: "Retry-After",
+			units:  time.Second,
+
+			// retry-after values are expressed in either number of
+			// seconds or an HTTP-date indicating when to try again
+			custom: func(ra string) (time.Duration, bool) {
+				t, err := time.Parse(time.RFC1123, ra)
+				if err != nil {
+					return 0, false
+				}
+				return time.Until(t), true
+			},
+		},
+	}
+
+	for _, retry := range retries {
+		v := resp.Header.Get(retry.header)
+		if v == "" {
+			continue
+		}
+		if retryAfter, err := strconv.ParseFloat(v, 64); err == nil {
+			return time.Duration(retryAfter * float64(retry.units)), true
+		}
+		if d, ok := retry.custom(v); ok {
+			return d, true
+		}
+	}
+
+	return 0, false
+}
+
+// isBeforeContextDeadline reports whether the non-zero Time t is
+// before ctx's deadline. If ctx does not have a deadline, it
+// always reports true (the deadline is considered infinite).
+func isBeforeContextDeadline(t time.Time, ctx context.Context) bool {
+	d, ok := ctx.Deadline()
+	if !ok {
+		return true
+	}
+	return t.Before(d)
+}
+
+// bodyWithTimeout is an io.ReadCloser which can observe a context's cancel func
+// to handle timeouts etc. It wraps an existing io.ReadCloser.
+type bodyWithTimeout struct {
+	stop func() // stops the time.Timer waiting to cancel the request
+	rc   io.ReadCloser
+}
+
+func (b *bodyWithTimeout) Read(p []byte) (n int, err error) {
+	n, err = b.rc.Read(p)
+	if err == nil {
+		return n, nil
+	}
+	if err == io.EOF {
+		return n, err
+	}
+	return n, err
+}
+
+func (b *bodyWithTimeout) Close() error {
+	err := b.rc.Close()
+	b.stop()
+	return err
+}
+
+func retryDelay(res *http.Response, retryCount int) time.Duration {
+	// If the API asks us to wait a certain amount of time (and it's a reasonable amount),
+	// just do what it says.
+
+	if retryAfterDelay, ok := parseRetryAfterHeader(res); ok && 0 <= retryAfterDelay && retryAfterDelay < time.Minute {
+		return retryAfterDelay
+	}
+
+	maxDelay := 8 * time.Second
+	delay := time.Duration(0.5 * float64(time.Second) * math.Pow(2, float64(retryCount)))
+	if delay > maxDelay {
+		delay = maxDelay
+	}
+
+	jitter := rand.Int63n(int64(delay / 4))
+	delay -= time.Duration(jitter)
+	return delay
+}
+
+func (cfg *RequestConfig) Execute() (err error) {
+	if cfg.BaseURL == nil {
+		if cfg.DefaultBaseURL != nil {
+			cfg.BaseURL = cfg.DefaultBaseURL
+		} else {
+			return fmt.Errorf("requestconfig: base url is not set")
+		}
+	}
+
+	cfg.Request.URL, err = cfg.BaseURL.Parse(strings.TrimLeft(cfg.Request.URL.String(), "/"))
+	if err != nil {
+		return err
+	}
+
+	if cfg.Body != nil && cfg.Request.Body == nil {
+		switch body := cfg.Body.(type) {
+		case *bytes.Buffer:
+			b := body.Bytes()
+			cfg.Request.ContentLength = int64(body.Len())
+			cfg.Request.GetBody = func() (io.ReadCloser, error) { return io.NopCloser(bytes.NewReader(b)), nil }
+			cfg.Request.Body, _ = cfg.Request.GetBody()
+		case *bytes.Reader:
+			cfg.Request.ContentLength = int64(body.Len())
+			cfg.Request.GetBody = func() (io.ReadCloser, error) {
+				_, err := body.Seek(0, 0)
+				return io.NopCloser(body), err
+			}
+			cfg.Request.Body, _ = cfg.Request.GetBody()
+		default:
+			if rc, ok := body.(io.ReadCloser); ok {
+				cfg.Request.Body = rc
+			} else {
+				cfg.Request.Body = io.NopCloser(body)
+			}
+		}
+	}
+
+	handler := cfg.HTTPClient.Do
+	if cfg.CustomHTTPDoer != nil {
+		handler = cfg.CustomHTTPDoer.Do
+	}
+	for i := len(cfg.Middlewares) - 1; i >= 0; i -= 1 {
+		handler = applyMiddleware(cfg.Middlewares[i], handler)
+	}
+
+	// Don't send the current retry count in the headers if the caller modified the header defaults.
+	shouldSendRetryCount := cfg.Request.Header.Get("X-Stainless-Retry-Count") == "0"
+
+	var res *http.Response
+	var cancel context.CancelFunc
+	for retryCount := 0; retryCount <= cfg.MaxRetries; retryCount += 1 {
+		ctx := cfg.Request.Context()
+		if cfg.RequestTimeout != time.Duration(0) && isBeforeContextDeadline(time.Now().Add(cfg.RequestTimeout), ctx) {
+			ctx, cancel = context.WithTimeout(ctx, cfg.RequestTimeout)
+			defer func() {
+				// The cancel function is nil if it was handed off to be handled in a different scope.
+				if cancel != nil {
+					cancel()
+				}
+			}()
+		}
+
+		req := cfg.Request.Clone(ctx)
+		if shouldSendRetryCount {
+			req.Header.Set("X-Stainless-Retry-Count", strconv.Itoa(retryCount))
+		}
+
+		res, err = handler(req)
+		if ctx != nil && ctx.Err() != nil {
+			return ctx.Err()
+		}
+		if !shouldRetry(cfg.Request, res) || retryCount >= cfg.MaxRetries {
+			break
+		}
+
+		// Prepare next request and wait for the retry delay
+		if cfg.Request.GetBody != nil {
+			cfg.Request.Body, err = cfg.Request.GetBody()
+			if err != nil {
+				return err
+			}
+		}
+
+		// Can't actually refresh the body, so we don't attempt to retry here
+		if cfg.Request.GetBody == nil && cfg.Request.Body != nil {
+			break
+		}
+
+		// Close the response body before retrying to prevent connection leaks
+		if res != nil && res.Body != nil {
+			res.Body.Close()
+		}
+
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(retryDelay(res, retryCount)):
+		}
+	}
+
+	// Save *http.Response if it is requested to, even if there was an error making the request. This is
+	// useful in cases where you might want to debug by inspecting the response. Note that if err != nil,
+	// the response should be generally be empty, but there are edge cases.
+	if cfg.ResponseInto != nil {
+		*cfg.ResponseInto = res
+	}
+	if responseBodyInto, ok := cfg.ResponseBodyInto.(**http.Response); ok {
+		*responseBodyInto = res
+	}
+
+	// If there was a connection error in the final request or any other transport error,
+	// return that early without trying to coerce into an APIError.
+	if err != nil {
+		return err
+	}
+
+	if res.StatusCode >= 400 {
+		contents, err := io.ReadAll(res.Body)
+		res.Body.Close()
+		if err != nil {
+			return err
+		}
+
+		// If there is an APIError, re-populate the response body so that debugging
+		// utilities can conveniently dump the response without issue.
+		res.Body = io.NopCloser(bytes.NewBuffer(contents))
+
+		// Load the contents into the error format if it is provided.
+		aerr := apierror.Error{Request: cfg.Request, Response: res, StatusCode: res.StatusCode}
+		err = aerr.UnmarshalJSON(contents)
+		if err != nil {
+			return err
+		}
+		return &aerr
+	}
+
+	_, intoCustomResponseBody := cfg.ResponseBodyInto.(**http.Response)
+	if cfg.ResponseBodyInto == nil || intoCustomResponseBody {
+		// We aren't reading the response body in this scope, but whoever is will need the
+		// cancel func from the context to observe request timeouts.
+		// Put the cancel function in the response body so it can be handled elsewhere.
+		if cancel != nil {
+			res.Body = &bodyWithTimeout{rc: res.Body, stop: cancel}
+			cancel = nil
+		}
+		return nil
+	}
+
+	contents, err := io.ReadAll(res.Body)
+	res.Body.Close()
+	if err != nil {
+		return fmt.Errorf("error reading response body: %w", err)
+	}
+
+	// If we are not json, return plaintext
+	contentType := res.Header.Get("content-type")
+	mediaType, _, _ := mime.ParseMediaType(contentType)
+	isJSON := strings.Contains(mediaType, "application/json") || strings.HasSuffix(mediaType, "+json")
+	if !isJSON {
+		switch dst := cfg.ResponseBodyInto.(type) {
+		case *string:
+			*dst = string(contents)
+		case **string:
+			tmp := string(contents)
+			*dst = &tmp
+		case *[]byte:
+			*dst = contents
+		default:
+			return fmt.Errorf("expected destination type of 'string' or '[]byte' for responses with content-type '%s' that is not 'application/json'", contentType)
+		}
+		return nil
+	}
+
+	switch dst := cfg.ResponseBodyInto.(type) {
+	// If the response happens to be a byte array, deserialize the body as-is.
+	case *[]byte:
+		*dst = contents
+	default:
+		err = json.NewDecoder(bytes.NewReader(contents)).Decode(cfg.ResponseBodyInto)
+		if err != nil {
+			return fmt.Errorf("error parsing response json: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func ExecuteNewRequest(ctx context.Context, method string, u string, body any, dst any, opts ...RequestOption) error {
+	cfg, err := NewRequestConfig(ctx, method, u, body, dst, opts...)
+	if err != nil {
+		return err
+	}
+	return cfg.Execute()
+}
+
+func (cfg *RequestConfig) Clone(ctx context.Context) *RequestConfig {
+	if cfg == nil {
+		return nil
+	}
+	req := cfg.Request.Clone(ctx)
+	var err error
+	if req.Body != nil {
+		req.Body, err = req.GetBody()
+	}
+	if err != nil {
+		return nil
+	}
+	new := &RequestConfig{
+		MaxRetries:     cfg.MaxRetries,
+		RequestTimeout: cfg.RequestTimeout,
+		Context:        ctx,
+		Request:        req,
+		BaseURL:        cfg.BaseURL,
+		HTTPClient:     cfg.HTTPClient,
+		Middlewares:    cfg.Middlewares,
+		APIKey:         cfg.APIKey,
+	}
+
+	return new
+}
+
+func (cfg *RequestConfig) Apply(opts ...RequestOption) error {
+	for _, opt := range opts {
+		err := opt.Apply(cfg)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// PreRequestOptions is used to collect all the options which need to be known before
+// a call to [RequestConfig.ExecuteNewRequest], such as path parameters
+// or global defaults.
+// PreRequestOptions will return a [RequestConfig] with the options applied.
+//
+// Only request option functions of type [PreRequestOptionFunc] are applied.
+func PreRequestOptions(opts ...RequestOption) (RequestConfig, error) {
+	cfg := RequestConfig{}
+	for _, opt := range opts {
+		if opt, ok := opt.(PreRequestOptionFunc); ok {
+			err := opt.Apply(&cfg)
+			if err != nil {
+				return cfg, err
+			}
+		}
+	}
+	return cfg, nil
+}
+
+// WithDefaultBaseURL returns a RequestOption that sets the client's default Base URL.
+// This is always overridden by setting a base URL with WithBaseURL.
+// WithBaseURL should be used instead of WithDefaultBaseURL except in internal code.
+func WithDefaultBaseURL(baseURL string) RequestOption {
+	u, err := url.Parse(baseURL)
+	return RequestOptionFunc(func(r *RequestConfig) error {
+		if err != nil {
+			return err
+		}
+		r.DefaultBaseURL = u
+		return nil
+	})
+}
diff --git a/sdks/go/internal/testutil/testutil.go b/sdks/go/internal/testutil/testutil.go
new file mode 100644
index 00000000..31103e9e
--- /dev/null
+++ b/sdks/go/internal/testutil/testutil.go
@@ -0,0 +1,27 @@
+package testutil
+
+import (
+	"net/http"
+	"os"
+	"strconv"
+	"testing"
+)
+
+func CheckTestServer(t *testing.T, url string) bool {
+	if _, err := http.Get(url); err != nil {
+		const SKIP_MOCK_TESTS = "SKIP_MOCK_TESTS"
+		if str, ok := os.LookupEnv(SKIP_MOCK_TESTS); ok {
+			skip, err := strconv.ParseBool(str)
+			if err != nil {
+				t.Fatalf("strconv.ParseBool(os.LookupEnv(%s)) failed: %s", SKIP_MOCK_TESTS, err)
+			}
+			if skip {
+				t.Skip("The test will not run without a mock server running against your OpenAPI spec")
+				return false
+			}
+			t.Errorf("The test will not run without a mock server running against your OpenAPI spec. You can set the environment variable %s to true to skip running any tests that require the mock server", SKIP_MOCK_TESTS)
+			return false
+		}
+	}
+	return true
+}
diff --git a/sdks/go/internal/version.go b/sdks/go/internal/version.go
new file mode 100644
index 00000000..871f0965
--- /dev/null
+++ b/sdks/go/internal/version.go
@@ -0,0 +1,5 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package internal
+
+const PackageVersion = "0.13.0" // x-release-please-version
diff --git a/sdks/go/lib/.keep b/sdks/go/lib/.keep
new file mode 100644
index 00000000..5e2c99fd
--- /dev/null
+++ b/sdks/go/lib/.keep
@@ -0,0 +1,4 @@
+File generated from our OpenAPI spec by Stainless.
+
+This directory can be used to store custom files to expand the SDK.
+It is ignored by Stainless code generation and its content (other than this keep file) won't be touched.
\ No newline at end of file
diff --git a/sdks/go/lib/cp.go b/sdks/go/lib/cp.go
new file mode 100644
index 00000000..e9aa3b0d
--- /dev/null
+++ b/sdks/go/lib/cp.go
@@ -0,0 +1,699 @@
+// Package lib provides manually-maintained functionality that extends the auto-generated SDK.
+package lib
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/gorilla/websocket"
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+)
+
+// CpConfig holds the configuration needed for copy operations.
+// Extract this from a hypeman.Client using ExtractCpConfig.
+type CpConfig struct {
+	// BaseURL is the base URL for the hypeman API
+	BaseURL string
+	// APIKey is the JWT token for authentication
+	APIKey string
+}
+
+// ExtractCpConfig extracts the base URL and API key from client options.
+func ExtractCpConfig(opts []requestconfig.RequestOption) (CpConfig, error) {
+	cfg := &requestconfig.RequestConfig{}
+	if err := cfg.Apply(opts...); err != nil {
+		return CpConfig{}, fmt.Errorf("apply options: %w", err)
+	}
+
+	baseURL := cfg.BaseURL
+	if baseURL == nil {
+		baseURL = cfg.DefaultBaseURL
+	}
+	if baseURL == nil {
+		return CpConfig{}, fmt.Errorf("base URL not configured")
+	}
+
+	return CpConfig{
+		BaseURL: baseURL.String(),
+		APIKey:  cfg.APIKey,
+	}, nil
+}
+
+// CpCallbacks provides optional progress callbacks for copy operations.
+type CpCallbacks struct {
+	OnFileStart func(path string, size int64) // Called when a file starts copying
+	OnProgress  func(bytesCopied int64)       // Called as bytes are copied
+	OnFileEnd   func(path string)             // Called when a file finishes copying
+}
+
+// CpToInstanceOptions configures a copy-to-instance operation
+type CpToInstanceOptions struct {
+	InstanceID  string       // Instance ID to copy to
+	SrcPath     string       // Local source path
+	DstPath     string       // Destination path in guest
+	Mode        fs.FileMode  // Optional: override file mode (0 = auto-detect)
+	Archive     bool         // Preserve UID/GID ownership
+	FollowLinks bool         // Follow symbolic links when copying
+	Callbacks   *CpCallbacks // Optional: progress callbacks
+	Dialer      WsDialer     // Optional: custom WebSocket dialer (for testing)
+}
+
+// CpFromInstanceOptions configures a copy-from-instance operation
+type CpFromInstanceOptions struct {
+	InstanceID  string       // Instance ID to copy from
+	SrcPath     string       // Source path in guest
+	DstPath     string       // Local destination path
+	FollowLinks bool         // Follow symbolic links
+	Archive     bool         // Preserve UID/GID ownership
+	Callbacks   *CpCallbacks // Optional: progress callbacks
+	Dialer      WsDialer     // Optional: custom WebSocket dialer (for testing)
+}
+
+// cpRequest is the JSON request sent over WebSocket
+type cpRequest struct {
+	Direction   string `json:"direction"`
+	GuestPath   string `json:"guest_path"`
+	IsDir       bool   `json:"is_dir,omitempty"`
+	Mode        uint32 `json:"mode,omitempty"`
+	FollowLinks bool   `json:"follow_links,omitempty"`
+	Uid         uint32 `json:"uid,omitempty"`
+	Gid         uint32 `json:"gid,omitempty"`
+}
+
+// cpFileHeader is received from the server when copying from guest
+type cpFileHeader struct {
+	Type       string `json:"type"`
+	Path       string `json:"path"`
+	Mode       uint32 `json:"mode"`
+	IsDir      bool   `json:"is_dir"`
+	IsSymlink  bool   `json:"is_symlink"`
+	LinkTarget string `json:"link_target"`
+	Size       int64  `json:"size"`
+	Mtime      int64  `json:"mtime"`
+	Uid        uint32 `json:"uid,omitempty"`
+	Gid        uint32 `json:"gid,omitempty"`
+}
+
+// cpEndMarker signals end of file or transfer
+type cpEndMarker struct {
+	Type  string `json:"type"`
+	Final bool   `json:"final"`
+}
+
+// cpResult is the response from a copy-to operation
+type cpResult struct {
+	Type         string `json:"type"`
+	Success      bool   `json:"success"`
+	Error        string `json:"error,omitempty"`
+	BytesWritten int64  `json:"bytes_written,omitempty"`
+}
+
+// cpError is an error message from the server
+type cpError struct {
+	Type    string `json:"type"`
+	Message string `json:"message"`
+	Path    string `json:"path,omitempty"`
+}
+
+// CpToInstance copies a file or directory to a running instance.
+//
+// Example:
+//
+//	cfg, _ := lib.ExtractCpConfig(client.Options)
+//	err := lib.CpToInstance(ctx, cfg, lib.CpToInstanceOptions{
+//	    InstanceID: "inst_123",
+//	    SrcPath:    "./local-file.txt",
+//	    DstPath:    "/app/file.txt",
+//	})
+func CpToInstance(ctx context.Context, cfg CpConfig, opts CpToInstanceOptions) error {
+	return cpToInstanceInternal(ctx, cfg, opts, nil)
+}
+
+// cpToInstanceInternal is the internal implementation that accepts visitedDirs for cycle detection
+func cpToInstanceInternal(ctx context.Context, cfg CpConfig, opts CpToInstanceOptions, visitedDirs map[string]bool) error {
+	// Build WebSocket URL
+	wsURL, err := buildWsURL(cfg.BaseURL, opts.InstanceID)
+	if err != nil {
+		return fmt.Errorf("build ws url: %w", err)
+	}
+
+	// Connect to WebSocket
+	headers := http.Header{}
+	headers.Set("Authorization", fmt.Sprintf("Bearer %s", cfg.APIKey))
+
+	// Use provided dialer or default
+	dialer := opts.Dialer
+	if dialer == nil {
+		dialer = &DefaultDialer{}
+	}
+
+	ws, resp, err := dialer.DialContext(ctx, wsURL, headers)
+	if err != nil {
+		if resp != nil {
+			defer resp.Body.Close()
+			body, _ := io.ReadAll(resp.Body)
+			return fmt.Errorf("websocket connect failed (HTTP %d): %s", resp.StatusCode, string(body))
+		}
+		return fmt.Errorf("websocket connect failed: %w", err)
+	}
+	defer ws.Close()
+
+	// Stat the source
+	srcInfo, err := os.Stat(opts.SrcPath)
+	if err != nil {
+		return fmt.Errorf("stat source: %w", err)
+	}
+
+	mode := opts.Mode
+	if mode == 0 {
+		mode = srcInfo.Mode().Perm()
+	}
+
+	// Get UID/GID if archive mode is enabled
+	var uid, gid uint32
+	if opts.Archive {
+		uid, gid = getFileOwnership(srcInfo)
+	}
+
+	// Send initial request
+	req := cpRequest{
+		Direction:   "to",
+		GuestPath:   opts.DstPath,
+		IsDir:       srcInfo.IsDir(),
+		Mode:        uint32(mode),
+		FollowLinks: opts.FollowLinks,
+		Uid:         uid,
+		Gid:         gid,
+	}
+	reqJSON, _ := json.Marshal(req)
+	if err := ws.WriteMessage(websocket.TextMessage, reqJSON); err != nil {
+		return fmt.Errorf("send request: %w", err)
+	}
+
+	if srcInfo.IsDir() {
+		// Track visited directories to detect symlink cycles
+		if visitedDirs == nil {
+			visitedDirs = make(map[string]bool)
+		}
+		absPath, _ := filepath.Abs(opts.SrcPath)
+		absPath, _ = filepath.EvalSymlinks(absPath)
+		if !visitedDirs[absPath] {
+			visitedDirs[absPath] = true
+		}
+		return copyDirToWs(ctx, cfg, ws, opts.SrcPath, opts.DstPath, opts.InstanceID, opts.Archive, opts.FollowLinks, opts.Dialer, opts.Callbacks, visitedDirs)
+	}
+	return copyFileToWs(ws, opts.SrcPath, srcInfo.Size(), opts.Callbacks)
+}
+
+// copyFileToWs copies a single file to the WebSocket
+func copyFileToWs(ws WsConn, srcPath string, size int64, callbacks *CpCallbacks) error {
+	file, err := os.Open(srcPath)
+	if err != nil {
+		return fmt.Errorf("open source: %w", err)
+	}
+	defer file.Close()
+
+	// Notify file start
+	if callbacks != nil && callbacks.OnFileStart != nil {
+		callbacks.OnFileStart(srcPath, size)
+	}
+
+	buf := make([]byte, 32*1024)
+	var bytesSent int64
+	for {
+		n, err := file.Read(buf)
+		if n > 0 {
+			if sendErr := ws.WriteMessage(websocket.BinaryMessage, buf[:n]); sendErr != nil {
+				return fmt.Errorf("send data: %w", sendErr)
+			}
+			bytesSent += int64(n)
+			// Notify progress
+			if callbacks != nil && callbacks.OnProgress != nil {
+				callbacks.OnProgress(bytesSent)
+			}
+		}
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return fmt.Errorf("read source: %w", err)
+		}
+	}
+
+	// Send end marker
+	endMsg, _ := json.Marshal(map[string]string{"type": "end"})
+	if err := ws.WriteMessage(websocket.TextMessage, endMsg); err != nil {
+		return fmt.Errorf("send end: %w", err)
+	}
+
+	// Wait for result
+	_, message, err := ws.ReadMessage()
+	if err != nil {
+		return fmt.Errorf("read result: %w", err)
+	}
+
+	// Check message type first - server may send error or result
+	var msgType struct {
+		Type string `json:"type"`
+	}
+	if err := json.Unmarshal(message, &msgType); err != nil {
+		return fmt.Errorf("parse message type: %w", err)
+	}
+
+	if msgType.Type == "error" {
+		var errMsg cpError
+		if err := json.Unmarshal(message, &errMsg); err != nil {
+			return fmt.Errorf("parse error: %w", err)
+		}
+		return fmt.Errorf("copy failed: %s", errMsg.Message)
+	}
+
+	var result cpResult
+	if err := json.Unmarshal(message, &result); err != nil {
+		return fmt.Errorf("parse result: %w", err)
+	}
+
+	if !result.Success {
+		return fmt.Errorf("copy failed: %s", result.Error)
+	}
+
+	// Notify file end (srcPath not available here, use empty string)
+	if callbacks != nil && callbacks.OnFileEnd != nil {
+		callbacks.OnFileEnd(srcPath)
+	}
+
+	return nil
+}
+
+// copyDirToWs copies a directory to the WebSocket
+func copyDirToWs(ctx context.Context, cfg CpConfig, ws WsConn, srcPath, dstPath, instanceID string, archive, followLinks bool, dialer WsDialer, callbacks *CpCallbacks, visitedDirs map[string]bool) error {
+	// For directory copy, we just send the end marker
+	// The server will create the directory
+	endMsg, _ := json.Marshal(map[string]string{"type": "end"})
+	if err := ws.WriteMessage(websocket.TextMessage, endMsg); err != nil {
+		return fmt.Errorf("send end: %w", err)
+	}
+
+	// Wait for result
+	_, message, err := ws.ReadMessage()
+	if err != nil {
+		return fmt.Errorf("read result: %w", err)
+	}
+
+	// Check message type first - server may send error or result
+	var msgType struct {
+		Type string `json:"type"`
+	}
+	if err := json.Unmarshal(message, &msgType); err != nil {
+		return fmt.Errorf("parse message type: %w", err)
+	}
+
+	if msgType.Type == "error" {
+		var errMsg cpError
+		if err := json.Unmarshal(message, &errMsg); err != nil {
+			return fmt.Errorf("parse error: %w", err)
+		}
+		return fmt.Errorf("copy failed: %s", errMsg.Message)
+	}
+
+	var result cpResult
+	if err := json.Unmarshal(message, &result); err != nil {
+		return fmt.Errorf("parse result: %w", err)
+	}
+
+	if !result.Success {
+		return fmt.Errorf("copy failed: %s", result.Error)
+	}
+
+	// Now recursively copy contents
+	return filepath.WalkDir(srcPath, func(walkPath string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if walkPath == srcPath {
+			return nil // Skip root
+		}
+
+		relPath, err := filepath.Rel(srcPath, walkPath)
+		if err != nil {
+			return fmt.Errorf("relative path: %w", err)
+		}
+
+		// Use path.Join (not filepath.Join) for guest paths to ensure forward slashes
+		// Convert Windows backslashes to forward slashes for Linux guest
+		targetPath := path.Join(dstPath, filepath.ToSlash(relPath))
+		info, err := d.Info()
+		if err != nil {
+			return fmt.Errorf("info: %w", err)
+		}
+
+		// Check for symlink cycles when following links
+		if followLinks && info.Mode()&fs.ModeSymlink != 0 {
+			// Resolve the symlink to its real path
+			realPath, err := filepath.EvalSymlinks(walkPath)
+			if err != nil {
+				// If we can't resolve the symlink, skip it (might be broken)
+				return nil
+			}
+			realInfo, err := os.Stat(realPath)
+			if err != nil {
+				return nil // Skip broken symlinks
+			}
+			// If it's a directory symlink, check for cycles
+			if realInfo.IsDir() {
+				if visitedDirs[realPath] {
+					// Cycle detected, skip this symlink to prevent infinite recursion
+					return nil
+				}
+				visitedDirs[realPath] = true
+			}
+		}
+
+		// Determine the mode to use
+		// For symlinks: if following links, let CpToInstance auto-detect from target
+		// (symlinks show 0777 but that's not the target's actual mode)
+		var mode fs.FileMode
+		if info.Mode()&fs.ModeSymlink != 0 && followLinks {
+			mode = 0 // Let CpToInstance use os.Stat to get target's mode
+		} else {
+			mode = info.Mode().Perm()
+		}
+
+		// For each file/dir, we need a new WebSocket connection
+		// This is because the protocol is one-file-per-connection
+		return cpToInstanceInternal(ctx, cfg, CpToInstanceOptions{
+			InstanceID:  instanceID,
+			SrcPath:     walkPath,
+			DstPath:     targetPath,
+			Mode:        mode,
+			Archive:     archive,
+			FollowLinks: followLinks,
+			Dialer:      dialer,
+			Callbacks:   callbacks,
+		}, visitedDirs)
+	})
+}
+
+// CpFromInstance copies a file or directory from a running instance.
+//
+// Example:
+//
+//	cfg, _ := lib.ExtractCpConfig(client.Options)
+//	err := lib.CpFromInstance(ctx, cfg, lib.CpFromInstanceOptions{
+//	    InstanceID: "inst_123",
+//	    SrcPath:    "/app/output.txt",
+//	    DstPath:    "./local-output.txt",
+//	})
+func CpFromInstance(ctx context.Context, cfg CpConfig, opts CpFromInstanceOptions) error {
+	// Build WebSocket URL
+	wsURL, err := buildWsURL(cfg.BaseURL, opts.InstanceID)
+	if err != nil {
+		return fmt.Errorf("build ws url: %w", err)
+	}
+
+	// Connect to WebSocket
+	headers := http.Header{}
+	headers.Set("Authorization", fmt.Sprintf("Bearer %s", cfg.APIKey))
+
+	// Use provided dialer or default
+	dialer := opts.Dialer
+	if dialer == nil {
+		dialer = &DefaultDialer{}
+	}
+
+	ws, resp, err := dialer.DialContext(ctx, wsURL, headers)
+	if err != nil {
+		if resp != nil {
+			defer resp.Body.Close()
+			body, _ := io.ReadAll(resp.Body)
+			return fmt.Errorf("websocket connect failed (HTTP %d): %s", resp.StatusCode, string(body))
+		}
+		return fmt.Errorf("websocket connect failed: %w", err)
+	}
+	defer ws.Close()
+
+	// Send initial request
+	req := cpRequest{
+		Direction:   "from",
+		GuestPath:   opts.SrcPath,
+		FollowLinks: opts.FollowLinks,
+	}
+	reqJSON, _ := json.Marshal(req)
+	if err := ws.WriteMessage(websocket.TextMessage, reqJSON); err != nil {
+		return fmt.Errorf("send request: %w", err)
+	}
+
+	var currentFile *os.File
+	var currentHeader *cpFileHeader
+	var bytesReceived int64
+	var receivedFinal bool
+
+	// Ensure any open file is closed on function exit (fixes file handle leak)
+	defer func() {
+		if currentFile != nil {
+			currentFile.Close()
+		}
+	}()
+
+	for {
+		msgType, message, err := ws.ReadMessage()
+		if err != nil {
+			if websocket.IsCloseError(err, websocket.CloseNormalClosure, websocket.CloseGoingAway) {
+				break
+			}
+			return fmt.Errorf("read message: %w", err)
+		}
+
+		if msgType == websocket.TextMessage {
+			// Parse JSON message
+			var msgMap map[string]interface{}
+			if err := json.Unmarshal(message, &msgMap); err != nil {
+				return fmt.Errorf("parse message: %w", err)
+			}
+
+			msgType, _ := msgMap["type"].(string)
+
+			switch msgType {
+			case "header":
+				// Close previous file if any
+				if currentFile != nil {
+					currentFile.Close()
+					currentFile = nil
+				}
+
+				var header cpFileHeader
+				if err := json.Unmarshal(message, &header); err != nil {
+					return fmt.Errorf("parse header: %w", err)
+				}
+				currentHeader = &header
+
+				// Sanitize server-provided path to prevent path traversal attacks
+				targetPath, err := sanitizePath(opts.DstPath, header.Path)
+				if err != nil {
+					return fmt.Errorf("invalid path from server: %w", err)
+				}
+
+				if header.IsDir {
+					if err := os.MkdirAll(targetPath, fs.FileMode(header.Mode)); err != nil {
+						return fmt.Errorf("create directory %s: %w", targetPath, err)
+					}
+					// Apply ownership if archive mode
+					if opts.Archive {
+						os.Chown(targetPath, int(header.Uid), int(header.Gid))
+					}
+			} else if header.IsSymlink {
+				// Validate symlink target to prevent pointing outside destination
+				if filepath.IsAbs(header.LinkTarget) || strings.HasPrefix(filepath.Clean(header.LinkTarget), "..") {
+					return fmt.Errorf("invalid symlink target: %s", header.LinkTarget)
+				}
+				// Create parent directory if needed
+				if err := os.MkdirAll(filepath.Dir(targetPath), 0755); err != nil {
+					return fmt.Errorf("create parent dir for symlink: %w", err)
+				}
+				os.Remove(targetPath)
+				if err := os.Symlink(header.LinkTarget, targetPath); err != nil {
+					return fmt.Errorf("create symlink %s: %w", targetPath, err)
+				}
+					// Apply ownership if archive mode (use Lchown for symlinks)
+					if opts.Archive {
+						os.Lchown(targetPath, int(header.Uid), int(header.Gid))
+					}
+				} else {
+					if err := os.MkdirAll(filepath.Dir(targetPath), 0755); err != nil {
+						return fmt.Errorf("create parent dir: %w", err)
+					}
+					f, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, fs.FileMode(header.Mode))
+					if err != nil {
+						return fmt.Errorf("create file %s: %w", targetPath, err)
+					}
+					currentFile = f
+					// Notify file start
+					if opts.Callbacks != nil && opts.Callbacks.OnFileStart != nil {
+						opts.Callbacks.OnFileStart(header.Path, header.Size)
+					}
+				}
+
+			case "end":
+				var endMarker cpEndMarker
+				if err := json.Unmarshal(message, &endMarker); err != nil {
+					return fmt.Errorf("invalid end marker: %w", err)
+				}
+
+				if currentFile != nil {
+					currentFile.Close()
+					if currentHeader != nil {
+						// Path was already validated when file was created
+						targetPath, _ := sanitizePath(opts.DstPath, currentHeader.Path)
+						if currentHeader.Mtime > 0 {
+							mtime := time.Unix(currentHeader.Mtime, 0)
+							os.Chtimes(targetPath, mtime, mtime)
+						}
+						// Apply ownership if archive mode
+						if opts.Archive {
+							os.Chown(targetPath, int(currentHeader.Uid), int(currentHeader.Gid))
+						}
+						// Notify file end
+						if opts.Callbacks != nil && opts.Callbacks.OnFileEnd != nil {
+							opts.Callbacks.OnFileEnd(currentHeader.Path)
+						}
+					}
+					currentFile = nil
+					currentHeader = nil
+					bytesReceived = 0 // Reset for next file
+				}
+
+				if endMarker.Final {
+					receivedFinal = true
+					return nil
+				}
+
+			case "error":
+				var cpErr cpError
+				json.Unmarshal(message, &cpErr)
+				return fmt.Errorf("copy error at %s: %s", cpErr.Path, cpErr.Message)
+
+			case "result":
+				var result cpResult
+				json.Unmarshal(message, &result)
+				if !result.Success {
+					return fmt.Errorf("copy failed: %s", result.Error)
+				}
+			}
+		} else if msgType == websocket.BinaryMessage {
+			// File data
+			if currentFile != nil {
+				n, err := currentFile.Write(message)
+				if err != nil {
+					return fmt.Errorf("write: %w", err)
+				}
+				bytesReceived += int64(n)
+				// Notify progress
+				if opts.Callbacks != nil && opts.Callbacks.OnProgress != nil {
+					opts.Callbacks.OnProgress(bytesReceived)
+				}
+			}
+		}
+	}
+
+	// If connection closed without receiving final marker, the transfer was incomplete
+	if !receivedFinal {
+		return fmt.Errorf("copy stream ended without completion marker")
+	}
+	return nil
+}
+
+// sanitizePath ensures the path doesn't escape the base directory.
+// This prevents path traversal attacks where server-provided paths contain ".." components.
+func sanitizePath(base, path string) (string, error) {
+	// Clean the path to resolve any . or .. components
+	cleaned := filepath.Clean(path)
+
+	// Reject absolute paths
+	if filepath.IsAbs(cleaned) {
+		return "", fmt.Errorf("invalid path: absolute paths not allowed: %s", path)
+	}
+
+	// Reject paths that start with ..
+	if strings.HasPrefix(cleaned, "..") {
+		return "", fmt.Errorf("invalid path: path escapes destination: %s", path)
+	}
+
+	// Join with base and verify the result is under base
+	result := filepath.Join(base, cleaned)
+	absBase, err := filepath.Abs(base)
+	if err != nil {
+		return "", fmt.Errorf("resolve base path: %w", err)
+	}
+	absResult, err := filepath.Abs(result)
+	if err != nil {
+		return "", fmt.Errorf("resolve result path: %w", err)
+	}
+
+	// Ensure the result is under the base directory
+	// Special case: if base is root ("/"), everything under it is valid
+	isRoot := absBase == "/" || absBase == string(filepath.Separator)
+	if !isRoot && !strings.HasPrefix(absResult, absBase+string(filepath.Separator)) && absResult != absBase {
+		return "", fmt.Errorf("invalid path: path escapes destination: %s", path)
+	}
+
+	return result, nil
+}
+
+// buildWsURL builds the WebSocket URL for the cp endpoint
+func buildWsURL(baseURL, instanceID string) (string, error) {
+	// Validate instanceID to prevent path traversal attacks
+	if instanceID == "" {
+		return "", fmt.Errorf("instance ID cannot be empty")
+	}
+	if strings.Contains(instanceID, "/") || strings.Contains(instanceID, "\\") || strings.Contains(instanceID, "..") {
+		return "", fmt.Errorf("invalid instance ID: contains path separator or traversal sequence")
+	}
+
+	u, err := url.Parse(baseURL)
+	if err != nil {
+		return "", fmt.Errorf("invalid base URL: %w", err)
+	}
+
+	// Append to existing path (preserves any path prefix like /api)
+	// Use path.Join to handle trailing slashes and ensure clean paths
+	u.Path = path.Join(u.Path, "instances", instanceID, "cp")
+
+	switch u.Scheme {
+	case "https":
+		u.Scheme = "wss"
+	case "http":
+		u.Scheme = "ws"
+	}
+
+	return u.String(), nil
+}
+
+// CpToInstanceFromURL is a convenience function that uses base URL and API key directly.
+func CpToInstanceFromURL(ctx context.Context, baseURL, apiKey string, opts CpToInstanceOptions) error {
+	cfg := CpConfig{
+		BaseURL: baseURL,
+		APIKey:  apiKey,
+	}
+	return CpToInstance(ctx, cfg, opts)
+}
+
+// CpFromInstanceFromURL is a convenience function that uses base URL and API key directly.
+func CpFromInstanceFromURL(ctx context.Context, baseURL, apiKey string, opts CpFromInstanceOptions) error {
+	cfg := CpConfig{
+		BaseURL: baseURL,
+		APIKey:  apiKey,
+	}
+	return CpFromInstance(ctx, cfg, opts)
+}
+
diff --git a/sdks/go/lib/cp_test.go b/sdks/go/lib/cp_test.go
new file mode 100644
index 00000000..f138d31a
--- /dev/null
+++ b/sdks/go/lib/cp_test.go
@@ -0,0 +1,421 @@
+package lib
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// wsMessage represents a message to be sent/received
+type wsMessage struct {
+	Type int
+	Data []byte
+}
+
+// MockWsConn implements WsConn for testing
+type MockWsConn struct {
+	writtenMessages []wsMessage
+	readQueue       []wsMessage
+	readIndex       int
+	closed          bool
+}
+
+func (m *MockWsConn) WriteMessage(messageType int, data []byte) error {
+	m.writtenMessages = append(m.writtenMessages, wsMessage{Type: messageType, Data: data})
+	return nil
+}
+
+func (m *MockWsConn) ReadMessage() (int, []byte, error) {
+	if m.readIndex >= len(m.readQueue) {
+		return 0, nil, &websocket.CloseError{Code: websocket.CloseNormalClosure}
+	}
+	msg := m.readQueue[m.readIndex]
+	m.readIndex++
+	return msg.Type, msg.Data, nil
+}
+
+func (m *MockWsConn) Close() error {
+	m.closed = true
+	return nil
+}
+
+// MockWsDialer implements WsDialer for testing
+type MockWsDialer struct {
+	conn     *MockWsConn
+	dialErr  error
+	dialResp *http.Response
+}
+
+func (d *MockWsDialer) DialContext(ctx context.Context, url string, headers http.Header) (WsConn, *http.Response, error) {
+	if d.dialErr != nil {
+		return nil, d.dialResp, d.dialErr
+	}
+	return d.conn, nil, nil
+}
+
+// TestSanitizePath tests the path sanitization function
+func TestSanitizePath(t *testing.T) {
+	tests := []struct {
+		name    string
+		base    string
+		path    string
+		want    string
+		wantErr bool
+		errMsg  string
+	}{
+		{
+			name:    "normal file",
+			base:    "/dest",
+			path:    "file.txt",
+			want:    "/dest/file.txt",
+			wantErr: false,
+		},
+		{
+			name:    "subdirectory file",
+			base:    "/dest",
+			path:    "sub/dir/file.txt",
+			want:    "/dest/sub/dir/file.txt",
+			wantErr: false,
+		},
+		{
+			name:    "path traversal attack",
+			base:    "/dest",
+			path:    "../../../etc/passwd",
+			wantErr: true,
+			errMsg:  "path escapes destination",
+		},
+		{
+			name:    "absolute path attack",
+			base:    "/dest",
+			path:    "/etc/passwd",
+			wantErr: true,
+			errMsg:  "absolute paths not allowed",
+		},
+		{
+			name:    "dot-dot in middle",
+			base:    "/dest",
+			path:    "sub/../../../etc/passwd",
+			wantErr: true,
+			errMsg:  "path escapes destination",
+		},
+		{
+			name:    "current dir reference",
+			base:    "/dest",
+			path:    "./file.txt",
+			want:    "/dest/file.txt",
+			wantErr: false,
+		},
+		{
+			name:    "empty path",
+			base:    "/dest",
+			path:    "",
+			want:    "/dest",
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := sanitizePath(tt.base, tt.path)
+			if tt.wantErr {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errMsg)
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tt.want, got)
+			}
+		})
+	}
+}
+
+// TestCpToInstance_SingleFile tests copying a single file
+func TestCpToInstance_SingleFile(t *testing.T) {
+	// Create a temp file to copy
+	tmpDir := t.TempDir()
+	srcFile := filepath.Join(tmpDir, "test.txt")
+	err := os.WriteFile(srcFile, []byte("hello world"), 0644)
+	require.NoError(t, err)
+
+	// Create mock that returns success
+	successResult, _ := json.Marshal(cpResult{Type: "result", Success: true, BytesWritten: 11})
+	mockConn := &MockWsConn{
+		readQueue: []wsMessage{
+			{Type: websocket.TextMessage, Data: successResult},
+		},
+	}
+
+	mockDialer := &MockWsDialer{conn: mockConn}
+
+	err = CpToInstance(context.Background(), CpConfig{
+		BaseURL: "http://localhost:8080",
+		APIKey:  "test-key",
+	}, CpToInstanceOptions{
+		InstanceID: "inst_123",
+		SrcPath:    srcFile,
+		DstPath:    "/app/test.txt",
+		Dialer:     mockDialer,
+	})
+
+	require.NoError(t, err)
+	assert.True(t, mockConn.closed)
+
+	// Verify messages were sent
+	require.GreaterOrEqual(t, len(mockConn.writtenMessages), 2) // request + data + end
+
+	// First message should be JSON request
+	var req cpRequest
+	err = json.Unmarshal(mockConn.writtenMessages[0].Data, &req)
+	require.NoError(t, err)
+	assert.Equal(t, "to", req.Direction)
+	assert.Equal(t, "/app/test.txt", req.GuestPath)
+	assert.False(t, req.IsDir)
+}
+
+// TestCpFromInstance_PathTraversal tests that path traversal is rejected
+func TestCpFromInstance_PathTraversal(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	// Create mock that sends a malicious header
+	maliciousHeader, _ := json.Marshal(cpFileHeader{
+		Type:   "header",
+		Path:   "../../../etc/passwd",
+		Mode:   0644,
+		IsDir:  false,
+		Size:   100,
+	})
+
+	mockConn := &MockWsConn{
+		readQueue: []wsMessage{
+			{Type: websocket.TextMessage, Data: maliciousHeader},
+		},
+	}
+
+	mockDialer := &MockWsDialer{conn: mockConn}
+
+	err := CpFromInstance(context.Background(), CpConfig{
+		BaseURL: "http://localhost:8080",
+		APIKey:  "test-key",
+	}, CpFromInstanceOptions{
+		InstanceID: "inst_123",
+		SrcPath:    "/app/file.txt",
+		DstPath:    tmpDir,
+		Dialer:     mockDialer,
+	})
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid path from server")
+}
+
+// TestCpFromInstance_AbsoluteSymlinkTarget tests that absolute symlink targets are rejected
+func TestCpFromInstance_AbsoluteSymlinkTarget(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	// Create mock that sends a symlink with absolute target
+	maliciousHeader, _ := json.Marshal(cpFileHeader{
+		Type:       "header",
+		Path:       "link",
+		Mode:       0777,
+		IsSymlink:  true,
+		LinkTarget: "/etc/passwd",
+	})
+
+	mockConn := &MockWsConn{
+		readQueue: []wsMessage{
+			{Type: websocket.TextMessage, Data: maliciousHeader},
+		},
+	}
+
+	mockDialer := &MockWsDialer{conn: mockConn}
+
+	err := CpFromInstance(context.Background(), CpConfig{
+		BaseURL: "http://localhost:8080",
+		APIKey:  "test-key",
+	}, CpFromInstanceOptions{
+		InstanceID: "inst_123",
+		SrcPath:    "/app/",
+		DstPath:    tmpDir,
+		Dialer:     mockDialer,
+	})
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid symlink target")
+}
+
+// TestCpFromInstance_TraversingSymlinkTarget tests that traversing symlink targets are rejected
+func TestCpFromInstance_TraversingSymlinkTarget(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	// Create mock that sends a symlink with traversing target
+	maliciousHeader, _ := json.Marshal(cpFileHeader{
+		Type:       "header",
+		Path:       "link",
+		Mode:       0777,
+		IsSymlink:  true,
+		LinkTarget: "../../../etc/passwd",
+	})
+
+	mockConn := &MockWsConn{
+		readQueue: []wsMessage{
+			{Type: websocket.TextMessage, Data: maliciousHeader},
+		},
+	}
+
+	mockDialer := &MockWsDialer{conn: mockConn}
+
+	err := CpFromInstance(context.Background(), CpConfig{
+		BaseURL: "http://localhost:8080",
+		APIKey:  "test-key",
+	}, CpFromInstanceOptions{
+		InstanceID: "inst_123",
+		SrcPath:    "/app/",
+		DstPath:    tmpDir,
+		Dialer:     mockDialer,
+	})
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid symlink target")
+}
+
+// TestCpFromInstance_NormalFile tests successful file copy from instance
+func TestCpFromInstance_NormalFile(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	// Create mock that sends a valid file
+	header, _ := json.Marshal(cpFileHeader{
+		Type:  "header",
+		Path:  "output.txt",
+		Mode:  0644,
+		IsDir: false,
+		Size:  11,
+		Mtime: 1234567890,
+	})
+	endMarker, _ := json.Marshal(cpEndMarker{Type: "end", Final: true})
+
+	mockConn := &MockWsConn{
+		readQueue: []wsMessage{
+			{Type: websocket.TextMessage, Data: header},
+			{Type: websocket.BinaryMessage, Data: []byte("hello world")},
+			{Type: websocket.TextMessage, Data: endMarker},
+		},
+	}
+
+	mockDialer := &MockWsDialer{conn: mockConn}
+
+	err := CpFromInstance(context.Background(), CpConfig{
+		BaseURL: "http://localhost:8080",
+		APIKey:  "test-key",
+	}, CpFromInstanceOptions{
+		InstanceID: "inst_123",
+		SrcPath:    "/app/output.txt",
+		DstPath:    tmpDir,
+		Dialer:     mockDialer,
+	})
+
+	require.NoError(t, err)
+
+	// Verify file was created
+	content, err := os.ReadFile(filepath.Join(tmpDir, "output.txt"))
+	require.NoError(t, err)
+	assert.Equal(t, "hello world", string(content))
+}
+
+// TestCpCallbacks tests that callbacks are invoked correctly
+func TestCpCallbacks(t *testing.T) {
+	// Create a temp file to copy
+	tmpDir := t.TempDir()
+	srcFile := filepath.Join(tmpDir, "test.txt")
+	err := os.WriteFile(srcFile, []byte("hello world"), 0644)
+	require.NoError(t, err)
+
+	// Track callback invocations
+	var fileStartCalled bool
+	var progressCalled bool
+	var fileEndCalled bool
+	var progressBytes int64
+
+	callbacks := &CpCallbacks{
+		OnFileStart: func(path string, size int64) {
+			fileStartCalled = true
+			assert.Equal(t, srcFile, path)
+			assert.Equal(t, int64(11), size)
+		},
+		OnProgress: func(bytesCopied int64) {
+			progressCalled = true
+			progressBytes = bytesCopied
+		},
+		OnFileEnd: func(path string) {
+			fileEndCalled = true
+		},
+	}
+
+	// Create mock that returns success
+	successResult, _ := json.Marshal(cpResult{Type: "result", Success: true, BytesWritten: 11})
+	mockConn := &MockWsConn{
+		readQueue: []wsMessage{
+			{Type: websocket.TextMessage, Data: successResult},
+		},
+	}
+
+	mockDialer := &MockWsDialer{conn: mockConn}
+
+	err = CpToInstance(context.Background(), CpConfig{
+		BaseURL: "http://localhost:8080",
+		APIKey:  "test-key",
+	}, CpToInstanceOptions{
+		InstanceID: "inst_123",
+		SrcPath:    srcFile,
+		DstPath:    "/app/test.txt",
+		Callbacks:  callbacks,
+		Dialer:     mockDialer,
+	})
+
+	require.NoError(t, err)
+	assert.True(t, fileStartCalled, "OnFileStart should be called")
+	assert.True(t, progressCalled, "OnProgress should be called")
+	assert.True(t, fileEndCalled, "OnFileEnd should be called")
+	assert.Equal(t, int64(11), progressBytes)
+}
+
+// TestBuildWsURL tests WebSocket URL construction
+func TestBuildWsURL(t *testing.T) {
+	tests := []struct {
+		name       string
+		baseURL    string
+		instanceID string
+		want       string
+		wantErr    bool
+	}{
+		{
+			name:       "https to wss",
+			baseURL:    "https://api.example.com",
+			instanceID: "inst_123",
+			want:       "wss://api.example.com/instances/inst_123/cp",
+		},
+		{
+			name:       "http to ws",
+			baseURL:    "http://localhost:8080",
+			instanceID: "inst_456",
+			want:       "ws://localhost:8080/instances/inst_456/cp",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := buildWsURL(tt.baseURL, tt.instanceID)
+			if tt.wantErr {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tt.want, got)
+			}
+		})
+	}
+}
+
diff --git a/sdks/go/lib/push.go b/sdks/go/lib/push.go
new file mode 100644
index 00000000..e8e322f4
--- /dev/null
+++ b/sdks/go/lib/push.go
@@ -0,0 +1,139 @@
+// Package lib provides manually-maintained functionality that extends the auto-generated SDK.
+package lib
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"strings"
+
+	"github.com/google/go-containerregistry/pkg/authn"
+	"github.com/google/go-containerregistry/pkg/name"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/google/go-containerregistry/pkg/v1/daemon"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+)
+
+// PushConfig holds the configuration needed to push images to hypeman's registry.
+// Extract this from a hypeman.Client using ExtractPushConfig.
+type PushConfig struct {
+	// RegistryHost is the host:port of the hypeman registry (derived from base URL)
+	RegistryHost string
+	// APIKey is the JWT token for authentication
+	APIKey string
+}
+
+// ExtractPushConfig extracts the registry host and API key from client options.
+// This is needed because the Client struct doesn't expose these values directly.
+func ExtractPushConfig(opts []requestconfig.RequestOption) (PushConfig, error) {
+	cfg := &requestconfig.RequestConfig{}
+	if err := cfg.Apply(opts...); err != nil {
+		return PushConfig{}, fmt.Errorf("apply options: %w", err)
+	}
+
+	baseURL := cfg.BaseURL
+	if baseURL == nil {
+		baseURL = cfg.DefaultBaseURL
+	}
+	if baseURL == nil {
+		return PushConfig{}, fmt.Errorf("base URL not configured")
+	}
+
+	return PushConfig{
+		RegistryHost: baseURL.Host,
+		APIKey:       cfg.APIKey,
+	}, nil
+}
+
+// PushImage pushes a v1.Image to hypeman's OCI registry.
+//
+// This function works with images from any source supported by go-containerregistry:
+//   - Images built with Kaniko, ko, or buildpacks (no Docker needed)
+//   - Images pulled from remote registries via remote.Image()
+//   - Images loaded from tarballs via tarball.ImageFromPath()
+//   - Images from OCI layouts via layout.Image()
+//
+// The targetName parameter specifies how the image will be named in hypeman
+// (e.g., "myapp:latest" or "myorg/myapp:v1.0").
+func PushImage(ctx context.Context, cfg PushConfig, img v1.Image, targetName string) error {
+	if cfg.RegistryHost == "" {
+		return fmt.Errorf("registry host not configured")
+	}
+
+	// Build target reference
+	targetRef := cfg.RegistryHost + "/" + strings.TrimPrefix(targetName, "/")
+
+	dstRef, err := name.ParseReference(targetRef, name.Insecure)
+	if err != nil {
+		return fmt.Errorf("invalid target reference %q: %w", targetRef, err)
+	}
+
+	// Create authenticator with JWT token
+	auth := &jwtAuth{token: cfg.APIKey}
+
+	err = remote.Write(dstRef, img,
+		remote.WithContext(ctx),
+		remote.WithAuth(auth),
+	)
+	if err != nil {
+		return fmt.Errorf("push failed: %w", err)
+	}
+
+	return nil
+}
+
+// Push loads an image from the local Docker daemon and pushes it to hypeman's registry.
+//
+// This is a convenience function for local development workflows where images
+// are built using Docker. For CI/CD pipelines that use Kaniko, ko, or buildpacks,
+// use PushImage directly with the v1.Image they produce.
+//
+// Parameters:
+//   - sourceImage: Local Docker image reference (e.g., "myapp:latest")
+//   - targetName: Name in hypeman (defaults to sourceImage if empty)
+func Push(ctx context.Context, cfg PushConfig, sourceImage, targetName string) error {
+	srcRef, err := name.ParseReference(sourceImage)
+	if err != nil {
+		return fmt.Errorf("invalid source image %q: %w", sourceImage, err)
+	}
+
+	img, err := daemon.Image(srcRef)
+	if err != nil {
+		return fmt.Errorf("load image from docker daemon: %w", err)
+	}
+
+	if targetName == "" {
+		targetName = sourceImage
+	}
+
+	return PushImage(ctx, cfg, img, targetName)
+}
+
+// jwtAuth implements authn.Authenticator for JWT bearer token auth
+type jwtAuth struct {
+	token string
+}
+
+func (a *jwtAuth) Authorization() (*authn.AuthConfig, error) {
+	if a.token == "" {
+		return &authn.AuthConfig{}, nil
+	}
+	return &authn.AuthConfig{RegistryToken: a.token}, nil
+}
+
+// PushFromURL is a convenience function that parses a base URL and API key
+// directly, without needing a hypeman.Client. Useful for standalone scripts.
+func PushFromURL(ctx context.Context, baseURL, apiKey string, img v1.Image, targetName string) error {
+	parsedURL, err := url.Parse(baseURL)
+	if err != nil {
+		return fmt.Errorf("invalid base URL: %w", err)
+	}
+
+	cfg := PushConfig{
+		RegistryHost: parsedURL.Host,
+		APIKey:       apiKey,
+	}
+
+	return PushImage(ctx, cfg, img, targetName)
+}
diff --git a/sdks/go/lib/stat_unix.go b/sdks/go/lib/stat_unix.go
new file mode 100644
index 00000000..b827dd0c
--- /dev/null
+++ b/sdks/go/lib/stat_unix.go
@@ -0,0 +1,16 @@
+//go:build unix
+
+package lib
+
+import (
+	"io/fs"
+	"syscall"
+)
+
+// getFileOwnership returns the UID and GID of a file on Unix systems.
+func getFileOwnership(info fs.FileInfo) (uid, gid uint32) {
+	if stat, ok := info.Sys().(*syscall.Stat_t); ok {
+		return stat.Uid, stat.Gid
+	}
+	return 0, 0
+}
diff --git a/sdks/go/lib/stat_windows.go b/sdks/go/lib/stat_windows.go
new file mode 100644
index 00000000..5dfcaab6
--- /dev/null
+++ b/sdks/go/lib/stat_windows.go
@@ -0,0 +1,10 @@
+//go:build windows
+
+package lib
+
+import "io/fs"
+
+// getFileOwnership returns 0, 0 on Windows as UID/GID are Unix concepts.
+func getFileOwnership(info fs.FileInfo) (uid, gid uint32) {
+	return 0, 0
+}
diff --git a/sdks/go/lib/ws_connector.go b/sdks/go/lib/ws_connector.go
new file mode 100644
index 00000000..8e02e954
--- /dev/null
+++ b/sdks/go/lib/ws_connector.go
@@ -0,0 +1,38 @@
+// Package lib provides manually-maintained functionality that extends the auto-generated SDK.
+package lib
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/gorilla/websocket"
+)
+
+// WsConn abstracts a WebSocket connection for testing.
+type WsConn interface {
+	WriteMessage(messageType int, data []byte) error
+	ReadMessage() (messageType int, p []byte, err error)
+	Close() error
+}
+
+// WsDialer abstracts WebSocket connection creation for testing.
+type WsDialer interface {
+	DialContext(ctx context.Context, url string, headers http.Header) (WsConn, *http.Response, error)
+}
+
+// DefaultDialer uses gorilla/websocket for real WebSocket connections.
+type DefaultDialer struct{}
+
+// DialContext connects to a WebSocket server.
+func (d *DefaultDialer) DialContext(ctx context.Context, url string, headers http.Header) (WsConn, *http.Response, error) {
+	dialer := websocket.Dialer{}
+	conn, resp, err := dialer.DialContext(ctx, url, headers)
+	if err != nil {
+		return nil, resp, err
+	}
+	return conn, resp, nil
+}
+
+// Ensure gorilla websocket.Conn implements WsConn
+var _ WsConn = (*websocket.Conn)(nil)
+
diff --git a/sdks/go/option/middleware.go b/sdks/go/option/middleware.go
new file mode 100644
index 00000000..8ec9dd60
--- /dev/null
+++ b/sdks/go/option/middleware.go
@@ -0,0 +1,38 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package option
+
+import (
+	"log"
+	"net/http"
+	"net/http/httputil"
+)
+
+// WithDebugLog logs the HTTP request and response content.
+// If the logger parameter is nil, it uses the default logger.
+//
+// WithDebugLog is for debugging and development purposes only.
+// It should not be used in production code. The behavior and interface
+// of WithDebugLog is not guaranteed to be stable.
+func WithDebugLog(logger *log.Logger) RequestOption {
+	return WithMiddleware(func(req *http.Request, nxt MiddlewareNext) (*http.Response, error) {
+		if logger == nil {
+			logger = log.Default()
+		}
+
+		if reqBytes, err := httputil.DumpRequest(req, true); err == nil {
+			logger.Printf("Request Content:\n%s\n", reqBytes)
+		}
+
+		resp, err := nxt(req)
+		if err != nil {
+			return resp, err
+		}
+
+		if respBytes, err := httputil.DumpResponse(resp, true); err == nil {
+			logger.Printf("Response Content:\n%s\n", respBytes)
+		}
+
+		return resp, err
+	})
+}
diff --git a/sdks/go/option/requestoption.go b/sdks/go/option/requestoption.go
new file mode 100644
index 00000000..7b56bd6f
--- /dev/null
+++ b/sdks/go/option/requestoption.go
@@ -0,0 +1,275 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package option
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+	"github.com/tidwall/sjson"
+)
+
+// RequestOption is an option for the requests made by the hypeman API Client
+// which can be supplied to clients, services, and methods. You can read more about this functional
+// options pattern in our [README].
+//
+// [README]: https://pkg.go.dev/github.com/kernel/hypeman-go#readme-requestoptions
+type RequestOption = requestconfig.RequestOption
+
+// WithBaseURL returns a RequestOption that sets the BaseURL for the client.
+//
+// For security reasons, ensure that the base URL is trusted.
+func WithBaseURL(base string) RequestOption {
+	u, err := url.Parse(base)
+	if err == nil && u.Path != "" && !strings.HasSuffix(u.Path, "/") {
+		u.Path += "/"
+	}
+
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		if err != nil {
+			return fmt.Errorf("requestoption: WithBaseURL failed to parse url %s", err)
+		}
+
+		r.BaseURL = u
+		return nil
+	})
+}
+
+// HTTPClient is primarily used to describe an [*http.Client], but also
+// supports custom implementations.
+//
+// For bespoke implementations, prefer using an [*http.Client] with a
+// custom transport. See [http.RoundTripper] for further information.
+type HTTPClient interface {
+	Do(*http.Request) (*http.Response, error)
+}
+
+// WithHTTPClient returns a RequestOption that changes the underlying http client used to make this
+// request, which by default is [http.DefaultClient].
+//
+// For custom uses cases, it is recommended to provide an [*http.Client] with a custom
+// [http.RoundTripper] as its transport, rather than directly implementing [HTTPClient].
+func WithHTTPClient(client HTTPClient) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		if client == nil {
+			return fmt.Errorf("requestoption: custom http client cannot be nil")
+		}
+
+		if c, ok := client.(*http.Client); ok {
+			// Prefer the native client if possible.
+			r.HTTPClient = c
+			r.CustomHTTPDoer = nil
+		} else {
+			r.CustomHTTPDoer = client
+		}
+
+		return nil
+	})
+}
+
+// MiddlewareNext is a function which is called by a middleware to pass an HTTP request
+// to the next stage in the middleware chain.
+type MiddlewareNext = func(*http.Request) (*http.Response, error)
+
+// Middleware is a function which intercepts HTTP requests, processing or modifying
+// them, and then passing the request to the next middleware or handler
+// in the chain by calling the provided MiddlewareNext function.
+type Middleware = func(*http.Request, MiddlewareNext) (*http.Response, error)
+
+// WithMiddleware returns a RequestOption that applies the given middleware
+// to the requests made. Each middleware will execute in the order they were given.
+func WithMiddleware(middlewares ...Middleware) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		r.Middlewares = append(r.Middlewares, middlewares...)
+		return nil
+	})
+}
+
+// WithMaxRetries returns a RequestOption that sets the maximum number of retries that the client
+// attempts to make. When given 0, the client only makes one request. By
+// default, the client retries two times.
+//
+// WithMaxRetries panics when retries is negative.
+func WithMaxRetries(retries int) RequestOption {
+	if retries < 0 {
+		panic("option: cannot have fewer than 0 retries")
+	}
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		r.MaxRetries = retries
+		return nil
+	})
+}
+
+// WithHeader returns a RequestOption that sets the header value to the associated key. It overwrites
+// any value if there was one already present.
+func WithHeader(key, value string) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		r.Request.Header.Set(key, value)
+		return nil
+	})
+}
+
+// WithHeaderAdd returns a RequestOption that adds the header value to the associated key. It appends
+// onto any existing values.
+func WithHeaderAdd(key, value string) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		r.Request.Header.Add(key, value)
+		return nil
+	})
+}
+
+// WithHeaderDel returns a RequestOption that deletes the header value(s) associated with the given key.
+func WithHeaderDel(key string) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		r.Request.Header.Del(key)
+		return nil
+	})
+}
+
+// WithQuery returns a RequestOption that sets the query value to the associated key. It overwrites
+// any value if there was one already present.
+func WithQuery(key, value string) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		query := r.Request.URL.Query()
+		query.Set(key, value)
+		r.Request.URL.RawQuery = query.Encode()
+		return nil
+	})
+}
+
+// WithQueryAdd returns a RequestOption that adds the query value to the associated key. It appends
+// onto any existing values.
+func WithQueryAdd(key, value string) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		query := r.Request.URL.Query()
+		query.Add(key, value)
+		r.Request.URL.RawQuery = query.Encode()
+		return nil
+	})
+}
+
+// WithQueryDel returns a RequestOption that deletes the query value(s) associated with the key.
+func WithQueryDel(key string) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		query := r.Request.URL.Query()
+		query.Del(key)
+		r.Request.URL.RawQuery = query.Encode()
+		return nil
+	})
+}
+
+// WithJSONSet returns a RequestOption that sets the body's JSON value associated with the key.
+// The key accepts a string as defined by the [sjson format].
+//
+// [sjson format]: https://github.com/tidwall/sjson
+func WithJSONSet(key string, value any) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) (err error) {
+		var b []byte
+
+		if r.Body == nil {
+			b, err = sjson.SetBytes(nil, key, value)
+			if err != nil {
+				return err
+			}
+		} else if buffer, ok := r.Body.(*bytes.Buffer); ok {
+			b = buffer.Bytes()
+			b, err = sjson.SetBytes(b, key, value)
+			if err != nil {
+				return err
+			}
+		} else {
+			return fmt.Errorf("cannot use WithJSONSet on a body that is not serialized as *bytes.Buffer")
+		}
+
+		r.Body = bytes.NewBuffer(b)
+		return nil
+	})
+}
+
+// WithJSONDel returns a RequestOption that deletes the body's JSON value associated with the key.
+// The key accepts a string as defined by the [sjson format].
+//
+// [sjson format]: https://github.com/tidwall/sjson
+func WithJSONDel(key string) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) (err error) {
+		if buffer, ok := r.Body.(*bytes.Buffer); ok {
+			b := buffer.Bytes()
+			b, err = sjson.DeleteBytes(b, key)
+			if err != nil {
+				return err
+			}
+			r.Body = bytes.NewBuffer(b)
+			return nil
+		}
+
+		return fmt.Errorf("cannot use WithJSONDel on a body that is not serialized as *bytes.Buffer")
+	})
+}
+
+// WithResponseBodyInto returns a RequestOption that overwrites the deserialization target with
+// the given destination. If provided, we don't deserialize into the default struct.
+func WithResponseBodyInto(dst any) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		r.ResponseBodyInto = dst
+		return nil
+	})
+}
+
+// WithResponseInto returns a RequestOption that copies the [*http.Response] into the given address.
+func WithResponseInto(dst **http.Response) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		r.ResponseInto = dst
+		return nil
+	})
+}
+
+// WithRequestBody returns a RequestOption that provides a custom serialized body with the given
+// content type.
+//
+// body accepts an io.Reader or raw []bytes.
+func WithRequestBody(contentType string, body any) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		if reader, ok := body.(io.Reader); ok {
+			r.Body = reader
+			return r.Apply(WithHeader("Content-Type", contentType))
+		}
+
+		if b, ok := body.([]byte); ok {
+			r.Body = bytes.NewBuffer(b)
+			return r.Apply(WithHeader("Content-Type", contentType))
+		}
+
+		return fmt.Errorf("body must be a byte slice or implement io.Reader")
+	})
+}
+
+// WithRequestTimeout returns a RequestOption that sets the timeout for
+// each request attempt. This should be smaller than the timeout defined in
+// the context, which spans all retries.
+func WithRequestTimeout(dur time.Duration) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		r.RequestTimeout = dur
+		return nil
+	})
+}
+
+// WithEnvironmentProduction returns a RequestOption that sets the current
+// environment to be the "production" environment. An environment specifies which base URL
+// to use by default.
+func WithEnvironmentProduction() RequestOption {
+	return requestconfig.WithDefaultBaseURL("http://localhost:8080/")
+}
+
+// WithAPIKey returns a RequestOption that sets the client setting "api_key".
+func WithAPIKey(value string) RequestOption {
+	return requestconfig.RequestOptionFunc(func(r *requestconfig.RequestConfig) error {
+		r.APIKey = value
+		return r.Apply(WithHeader("authorization", fmt.Sprintf("Bearer %s", r.APIKey)))
+	})
+}
diff --git a/sdks/go/packages/param/encoder.go b/sdks/go/packages/param/encoder.go
new file mode 100644
index 00000000..c0a75850
--- /dev/null
+++ b/sdks/go/packages/param/encoder.go
@@ -0,0 +1,109 @@
+package param
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strings"
+	"time"
+
+	shimjson "github.com/kernel/hypeman-go/internal/encoding/json"
+
+	"github.com/tidwall/sjson"
+)
+
+// EncodedAsDate is not be stable and shouldn't be relied upon
+type EncodedAsDate Opt[time.Time]
+
+// If we want to set a literal key value into JSON using sjson, we need to make sure it doesn't have
+// special characters that sjson interprets as a path.
+var EscapeSJSONKey = strings.NewReplacer("\\", "\\\\", "|", "\\|", "#", "\\#", "@", "\\@", "*", "\\*", ".", "\\.", ":", "\\:", "?", "\\?").Replace
+
+type forceOmit int
+
+func (m EncodedAsDate) MarshalJSON() ([]byte, error) {
+	underlying := Opt[time.Time](m)
+	bytes := underlying.MarshalJSONWithTimeLayout("2006-01-02")
+	if len(bytes) > 0 {
+		return bytes, nil
+	}
+	return underlying.MarshalJSON()
+}
+
+// MarshalObject uses a shimmed 'encoding/json' from Go 1.24, to support the 'omitzero' tag
+//
+// Stability for the API of MarshalObject is not guaranteed.
+func MarshalObject[T ParamStruct](f T, underlying any) ([]byte, error) {
+	return MarshalWithExtras(f, underlying, f.extraFields())
+}
+
+// MarshalWithExtras is used to marshal a struct with additional properties.
+//
+// Stability for the API of MarshalWithExtras is not guaranteed.
+func MarshalWithExtras[T ParamStruct, R any](f T, underlying any, extras map[string]R) ([]byte, error) {
+	if f.null() {
+		return []byte("null"), nil
+	} else if len(extras) > 0 {
+		bytes, err := shimjson.Marshal(underlying)
+		if err != nil {
+			return nil, err
+		}
+		for k, v := range extras {
+			var a any = v
+			if a == Omit {
+				// Errors when handling ForceOmitted are ignored.
+				if b, e := sjson.DeleteBytes(bytes, k); e == nil {
+					bytes = b
+				}
+				continue
+			}
+			bytes, err = sjson.SetBytes(bytes, EscapeSJSONKey(k), v)
+			if err != nil {
+				return nil, err
+			}
+		}
+		return bytes, nil
+	} else if ovr, ok := f.Overrides(); ok {
+		return shimjson.Marshal(ovr)
+	} else {
+		return shimjson.Marshal(underlying)
+	}
+}
+
+// MarshalUnion uses a shimmed 'encoding/json' from Go 1.24, to support the 'omitzero' tag
+//
+// Stability for the API of MarshalUnion is not guaranteed.
+func MarshalUnion[T ParamStruct](metadata T, variants ...any) ([]byte, error) {
+	nPresent := 0
+	presentIdx := -1
+	for i, variant := range variants {
+		if !IsOmitted(variant) {
+			nPresent++
+			presentIdx = i
+		}
+	}
+	if nPresent == 0 || presentIdx == -1 {
+		if metadata.null() {
+			return []byte("null"), nil
+		}
+		if ovr, ok := metadata.Overrides(); ok {
+			return shimjson.Marshal(ovr)
+		}
+		return []byte(`null`), nil
+	} else if nPresent > 1 {
+		return nil, &json.MarshalerError{
+			Type: typeFor[T](),
+			Err:  fmt.Errorf("expected union to have only one present variant, got %d", nPresent),
+		}
+	}
+	return shimjson.Marshal(variants[presentIdx])
+}
+
+// typeFor is shimmed from Go 1.23 "reflect" package
+func typeFor[T any]() reflect.Type {
+	var v T
+	if t := reflect.TypeOf(v); t != nil {
+		return t // optimize for T being a non-interface kind
+	}
+	return reflect.TypeOf((*T)(nil)).Elem() // only for an interface kind
+}
diff --git a/sdks/go/packages/param/encoder_test.go b/sdks/go/packages/param/encoder_test.go
new file mode 100644
index 00000000..55afdf71
--- /dev/null
+++ b/sdks/go/packages/param/encoder_test.go
@@ -0,0 +1,377 @@
+package param_test
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/kernel/hypeman-go/packages/param"
+)
+
+type Struct struct {
+	A string `json:"a"`
+	B int64  `json:"b"`
+	param.APIObject
+}
+
+func (r Struct) MarshalJSON() (data []byte, err error) {
+	type shadow Struct
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+
+// Note that the order of fields affects the JSON
+// key order. Changing the order of the fields in this struct
+// will fail tests unnecessarily.
+type FieldStruct struct {
+	A param.Opt[string]    `json:"a,omitzero"`
+	B param.Opt[int64]     `json:"b,omitzero"`
+	C Struct               `json:"c,omitzero"`
+	D time.Time            `json:"d,omitzero" format:"date"`
+	E time.Time            `json:"e,omitzero"`
+	F param.Opt[time.Time] `json:"f,omitzero" format:"date"`
+	G param.Opt[time.Time] `json:"g,omitzero"`
+	H param.Opt[time.Time] `json:"h,omitzero" format:"date-time"`
+	param.APIObject
+}
+
+func (r FieldStruct) MarshalJSON() (data []byte, err error) {
+	type shadow FieldStruct
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+
+type StructWithAdditionalProperties struct {
+	First       string         `json:"first"`
+	Second      int            `json:"second"`
+	ExtraFields map[string]any `json:"-"`
+	param.APIObject
+}
+
+func (s StructWithAdditionalProperties) MarshalJSON() ([]byte, error) {
+	type shadow StructWithAdditionalProperties
+	return param.MarshalWithExtras(s, (*shadow)(&s), s.ExtraFields)
+}
+
+func TestIsNullish(t *testing.T) {
+	nullTests := map[string]param.ParamNullable{
+		"null_string": param.Null[string](),
+		"null_int64":  param.Null[int64](),
+		"null_time":   param.Null[time.Time](),
+		"null_struct": param.NullStruct[Struct](),
+	}
+
+	for name, test := range nullTests {
+		t.Run(name, func(t *testing.T) {
+			if !param.IsNull(test) {
+				t.Fatalf("expected %s to be null", name)
+			}
+			if param.IsOmitted(test) {
+				t.Fatalf("expected %s to not be omitted", name)
+			}
+		})
+	}
+
+	omitTests := map[string]param.ParamNullable{
+		"omit_string": param.Opt[string]{},
+		"omit_int64":  param.Opt[int64]{},
+		"omit_time":   param.Opt[time.Time]{},
+		"omit_struct": Struct{},
+	}
+
+	for name, test := range omitTests {
+		t.Run(name, func(t *testing.T) {
+			if param.IsNull(test) {
+				t.Fatalf("expected %s to be null", name)
+			}
+			if !param.IsOmitted(test) {
+				t.Fatalf("expected %s to not be omitted", name)
+			}
+		})
+	}
+}
+
+func TestFieldMarshal(t *testing.T) {
+	tests := map[string]struct {
+		value    any
+		expected string
+	}{
+		"null_string": {param.Null[string](), "null"},
+		"null_int64":  {param.Null[int64](), "null"},
+		"null_time":   {param.Null[time.Time](), "null"},
+		"null_struct": {param.NullStruct[Struct](), "null"},
+
+		"float_zero":  {param.NewOpt(float64(0.0)), "0"},
+		"string_zero": {param.NewOpt(""), `""`},
+		"time_zero":   {param.NewOpt(time.Time{}), `"0001-01-01T00:00:00Z"`},
+
+		"string": {param.Opt[string]{Value: "string"}, `"string"`},
+		"int":    {param.Opt[int64]{Value: 123}, "123"},
+		"int64":  {param.Opt[int64]{Value: int64(123456789123456789)}, "123456789123456789"},
+		"struct": {Struct{A: "yo", B: 123}, `{"a":"yo","b":123}`},
+		"datetime": {
+			param.Opt[time.Time]{Value: time.Date(2023, time.March, 18, 14, 47, 38, 0, time.UTC)},
+			`"2023-03-18T14:47:38Z"`,
+		},
+		"optional_date": {
+			FieldStruct{
+				F: param.Opt[time.Time]{Value: time.Date(2023, time.March, 18, 14, 47, 38, 0, time.UTC)},
+			},
+			`{"f":"2023-03-18"}`,
+		},
+		"optional_time": {
+			FieldStruct{
+				G: param.Opt[time.Time]{Value: time.Date(2023, time.March, 18, 14, 47, 38, 0, time.UTC)},
+			},
+			`{"g":"2023-03-18T14:47:38Z"}`,
+		},
+		"optional_datetime_explicit_format": {
+			FieldStruct{
+				H: param.Opt[time.Time]{Value: time.Date(2023, time.March, 18, 14, 47, 38, 0, time.UTC)},
+			},
+			`{"h":"2023-03-18T14:47:38Z"}`,
+		},
+		"param_struct": {
+			FieldStruct{
+				A: param.Opt[string]{Value: "hello"},
+				B: param.Opt[int64]{Value: int64(12)},
+				D: time.Date(2023, time.March, 18, 14, 47, 38, 0, time.UTC),
+				E: time.Date(2023, time.March, 18, 14, 47, 38, 0, time.UTC),
+				F: param.Opt[time.Time]{Value: time.Date(2023, time.March, 18, 14, 47, 38, 0, time.UTC)},
+				G: param.Opt[time.Time]{Value: time.Date(2023, time.March, 18, 14, 47, 38, 0, time.UTC)},
+				H: param.Opt[time.Time]{Value: time.Date(2023, time.March, 18, 14, 47, 38, 0, time.UTC)},
+			},
+			`{"a":"hello","b":12,"d":"2023-03-18","e":"2023-03-18T14:47:38Z","f":"2023-03-18","g":"2023-03-18T14:47:38Z","h":"2023-03-18T14:47:38Z"}`,
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			b, err := json.Marshal(test.value)
+			if err != nil {
+				t.Fatalf("didn't expect error %v, expected %s", err, test.expected)
+			}
+			if string(b) != test.expected {
+				t.Fatalf("expected %s, received %s", test.expected, string(b))
+			}
+		})
+	}
+}
+
+func TestAdditionalProperties(t *testing.T) {
+	s := StructWithAdditionalProperties{
+		First:  "hello",
+		Second: 14,
+		ExtraFields: map[string]any{
+			"hi": "there",
+		},
+	}
+	exp := `{"first":"hello","second":14,"hi":"there"}`
+
+	bytes, err := json.Marshal(s)
+	if err != nil {
+		t.Fatalf("failed to marshal: %v", err)
+	}
+
+	if string(bytes) != exp {
+		t.Fatalf("expected %s, got %s", exp, string(bytes))
+	}
+}
+
+func TestExtraFields(t *testing.T) {
+	v := Struct{
+		A: "hello",
+		B: 123,
+	}
+	v.SetExtraFields(map[string]any{
+		"extra": Struct{A: "recursive"},
+		"b":     nil,
+	})
+	bytes, err := json.Marshal(v)
+	if err != nil {
+		t.Fatalf("failed to marshal: %v", err)
+	}
+	if string(bytes) != `{"a":"hello","b":null,"extra":{"a":"recursive","b":0}}` {
+		t.Fatalf("failed to marshal: got %v", string(bytes))
+	}
+	if v.B != 123 {
+		t.Fatalf("marshal modified field B: got %v", v.B)
+	}
+}
+
+func TestExtraFieldsForceOmitted(t *testing.T) {
+	v := Struct{
+		// Testing with the zero value.
+		// A: "",
+		// B: 0,
+	}
+	v.SetExtraFields(map[string]any{
+		"b": param.Omit,
+	})
+	bytes, err := json.Marshal(v)
+	if err != nil {
+		t.Fatalf("failed to marshal: %v", err)
+	}
+	if string(bytes) != `{"a":""}` {
+		t.Fatalf("failed to marshal: got %v", string(bytes))
+	}
+}
+
+type UnionWithDates struct {
+	OfDate param.Opt[time.Time]
+	OfTime param.Opt[time.Time]
+	param.APIUnion
+}
+
+func (r UnionWithDates) MarshalJSON() (data []byte, err error) {
+	return param.MarshalUnion(r, param.EncodedAsDate(r.OfDate), r.OfTime)
+}
+
+func TestUnionDateMarshal(t *testing.T) {
+	tests := map[string]struct {
+		value    UnionWithDates
+		expected string
+	}{
+		"date_only": {
+			UnionWithDates{
+				OfDate: param.Opt[time.Time]{Value: time.Date(2023, time.March, 18, 0, 0, 0, 0, time.UTC)},
+			},
+			`"2023-03-18"`,
+		},
+		"datetime_only": {
+			UnionWithDates{
+				OfTime: param.Opt[time.Time]{Value: time.Date(2023, time.March, 18, 14, 47, 38, 0, time.UTC)},
+			},
+			`"2023-03-18T14:47:38Z"`,
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			b, err := json.Marshal(test.value)
+			if err != nil {
+				t.Fatalf("didn't expect error %v, expected %s", err, test.expected)
+			}
+			if string(b) != test.expected {
+				t.Fatalf("expected %s, received %s", test.expected, string(b))
+			}
+		})
+	}
+}
+
+func TestOverride(t *testing.T) {
+	tests := map[string]struct {
+		value    param.ParamStruct
+		expected string
+	}{
+		"param_struct": {
+			param.Override[FieldStruct](map[string]any{
+				"a": "hello",
+				"b": 12,
+				"c": nil,
+			}),
+			`{"a":"hello","b":12,"c":null}`,
+		},
+		"param_struct_primitive": {
+			param.Override[FieldStruct](12),
+			`12`,
+		},
+		"param_struct_null": {
+			param.Override[FieldStruct](nil),
+			`null`,
+		},
+	}
+
+	f := FieldStruct{}
+
+	f.SetExtraFields(map[string]any{
+		"z": "ok",
+	})
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			b, err := json.Marshal(test.value)
+			if err != nil {
+				t.Fatalf("didn't expect error %v, expected %s", err, test.expected)
+			}
+			if string(b) != test.expected {
+				t.Fatalf("expected %s, received %s", test.expected, string(b))
+			}
+			if _, ok := test.value.Overrides(); !ok {
+				t.Fatalf("expected to be overridden")
+			}
+		})
+	}
+}
+
+// Despite implementing the interface, this struct is not an param.Optional
+// since it was defined in a different package.
+type almostOpt struct{}
+
+func (almostOpt) Valid() bool  { return true }
+func (almostOpt) Null() bool   { return false }
+func (almostOpt) isZero() bool { return false }
+
+func (almostOpt) implOpt() {}
+
+func TestOptionalInterfaceAssignability(t *testing.T) {
+	optInt := param.Opt[int]{}
+	if _, ok := any(optInt).(param.Optional); !ok {
+		t.Fatalf("failed to assign")
+	}
+
+	notOpt := almostOpt{}
+	if _, ok := any(notOpt).(param.Optional); ok {
+		t.Fatalf("unexpected successful assignment")
+	}
+
+	notOpt.implOpt() // silence the warning
+}
+
+type PrimitiveUnion struct {
+	OfString param.Opt[string]
+	OfInt    param.Opt[int]
+	param.APIUnion
+}
+
+func (p PrimitiveUnion) MarshalJSON() (data []byte, err error) {
+	return param.MarshalUnion(p, p.OfString, p.OfInt)
+}
+
+func TestOverriddenUnion(t *testing.T) {
+	tests := map[string]struct {
+		value    PrimitiveUnion
+		expected string
+	}{
+		"string": {
+			param.Override[PrimitiveUnion](json.RawMessage(`"hello"`)),
+			`"hello"`,
+		},
+		"int": {
+			param.Override[PrimitiveUnion](json.RawMessage(`42`)),
+			`42`,
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			b, err := json.Marshal(test.value)
+			if err != nil {
+				t.Fatalf("didn't expect error %v, expected %s", err, test.expected)
+			}
+			if string(b) != test.expected {
+				t.Fatalf("expected %s, received %s", test.expected, string(b))
+			}
+		})
+	}
+}
+
+func TestNullStructUnion(t *testing.T) {
+	nullUnion := param.NullStruct[PrimitiveUnion]()
+
+	b, err := json.Marshal(nullUnion)
+	if err != nil {
+		t.Fatalf("didn't expect error %v", err)
+	}
+	if string(b) != "null" {
+		t.Fatalf("expected null, received %s", string(b))
+	}
+}
diff --git a/sdks/go/packages/param/null.go b/sdks/go/packages/param/null.go
new file mode 100644
index 00000000..12dcd8e4
--- /dev/null
+++ b/sdks/go/packages/param/null.go
@@ -0,0 +1,19 @@
+package param
+
+import "github.com/kernel/hypeman-go/internal/encoding/json/sentinel"
+
+// NullMap returns a non-nil map with a length of 0.
+// When used with [MarshalObject] or [MarshalUnion], it will be marshaled as null.
+//
+// It is unspecified behavior to mutate the map returned by [NullMap].
+func NullMap[MapT ~map[string]T, T any]() MapT {
+	return sentinel.NewNullSentinel(func() MapT { return make(MapT, 1) })
+}
+
+// NullSlice returns a non-nil slice with a length of 0.
+// When used with [MarshalObject] or [MarshalUnion], it will be marshaled as null.
+//
+// It is unspecified behavior to mutate the slice returned by [NullSlice].
+func NullSlice[SliceT ~[]T, T any]() SliceT {
+	return sentinel.NewNullSentinel(func() SliceT { return make(SliceT, 0, 1) })
+}
diff --git a/sdks/go/packages/param/null_test.go b/sdks/go/packages/param/null_test.go
new file mode 100644
index 00000000..338e8411
--- /dev/null
+++ b/sdks/go/packages/param/null_test.go
@@ -0,0 +1,49 @@
+package param_test
+
+import (
+	"encoding/json"
+	"github.com/kernel/hypeman-go/packages/param"
+	"testing"
+)
+
+type Nullables struct {
+	Slice []int          `json:"slice,omitzero"`
+	Map   map[string]int `json:"map,omitzero"`
+	param.APIObject
+}
+
+func (n Nullables) MarshalJSON() ([]byte, error) {
+	type shadow Nullables
+	return param.MarshalObject(n, (*shadow)(&n))
+}
+
+func TestNullMarshal(t *testing.T) {
+	bytes, err := json.Marshal(Nullables{})
+	if err != nil {
+		t.Fatalf("json error %v", err.Error())
+	}
+	if string(bytes) != `{}` {
+		t.Fatalf("expected empty object, got %s", string(bytes))
+	}
+
+	obj := Nullables{
+		Slice: param.NullSlice[[]int](),
+		Map:   param.NullMap[map[string]int](),
+	}
+	bytes, err = json.Marshal(obj)
+
+	if !param.IsNull(obj.Slice) {
+		t.Fatal("failed null check")
+	}
+	if !param.IsNull(obj.Map) {
+		t.Fatal("failed null check")
+	}
+
+	if err != nil {
+		t.Fatalf("json error %v", err.Error())
+	}
+	exp := `{"slice":null,"map":null}`
+	if string(bytes) != exp {
+		t.Fatalf("expected %s, got %s", exp, string(bytes))
+	}
+}
diff --git a/sdks/go/packages/param/option.go b/sdks/go/packages/param/option.go
new file mode 100644
index 00000000..96f12db0
--- /dev/null
+++ b/sdks/go/packages/param/option.go
@@ -0,0 +1,121 @@
+package param
+
+import (
+	"encoding/json"
+	"fmt"
+	shimjson "github.com/kernel/hypeman-go/internal/encoding/json"
+	"time"
+)
+
+func NewOpt[T comparable](v T) Opt[T] {
+	return Opt[T]{Value: v, status: included}
+}
+
+// Null creates optional field with the JSON value "null".
+//
+// To set a struct to null, use [NullStruct].
+func Null[T comparable]() Opt[T] { return Opt[T]{status: null} }
+
+type status int8
+
+const (
+	omitted status = iota
+	null
+	included
+)
+
+// Opt represents an optional parameter of type T. Use
+// the [Opt.Valid] method to confirm.
+type Opt[T comparable] struct {
+	Value T
+	// indicates whether the field should be omitted, null, or valid
+	status status
+	opt
+}
+
+// Valid returns true if the value is not "null" or omitted.
+//
+// To check if explicitly null, use [Opt.Null].
+func (o Opt[T]) Valid() bool {
+	var empty Opt[T]
+	return o.status == included || o != empty && o.status != null
+}
+
+func (o Opt[T]) Or(v T) T {
+	if o.Valid() {
+		return o.Value
+	}
+	return v
+}
+
+func (o Opt[T]) String() string {
+	if o.null() {
+		return "null"
+	}
+	if s, ok := any(o.Value).(fmt.Stringer); ok {
+		return s.String()
+	}
+	return fmt.Sprintf("%v", o.Value)
+}
+
+func (o Opt[T]) MarshalJSON() ([]byte, error) {
+	if !o.Valid() {
+		return []byte("null"), nil
+	}
+	return shimjson.Marshal(o.Value)
+}
+
+func (o *Opt[T]) UnmarshalJSON(data []byte) error {
+	if string(data) == "null" {
+		o.status = null
+		return nil
+	}
+
+	var value *T
+	if err := json.Unmarshal(data, &value); err != nil {
+		return err
+	}
+
+	if value == nil {
+		o.status = omitted
+		return nil
+	}
+
+	o.status = included
+	o.Value = *value
+	return nil
+}
+
+// MarshalJSONWithTimeLayout is necessary to bypass the internal caching performed
+// by [json.Marshal]. Prefer to use [Opt.MarshalJSON] instead.
+//
+// This function requires that the generic type parameter of [Opt] is not [time.Time].
+func (o Opt[T]) MarshalJSONWithTimeLayout(format string) []byte {
+	t, ok := any(o.Value).(time.Time)
+	if !ok || o.null() {
+		return nil
+	}
+
+	b, err := shimjson.Marshal(t.Format(shimjson.TimeLayout(format)))
+	if err != nil {
+		return nil
+	}
+	return b
+}
+
+func (o Opt[T]) null() bool   { return o.status == null }
+func (o Opt[T]) isZero() bool { return o == Opt[T]{} }
+
+// opt helps limit the [Optional] interface to only types in this package
+type opt struct{}
+
+func (opt) implOpt() {}
+
+// This interface is useful for internal purposes.
+type Optional interface {
+	Valid() bool
+	null() bool
+
+	isZero() bool
+	implOpt()
+}
diff --git a/sdks/go/packages/param/param.go b/sdks/go/packages/param/param.go
new file mode 100644
index 00000000..44dd849b
--- /dev/null
+++ b/sdks/go/packages/param/param.go
@@ -0,0 +1,186 @@
+package param
+
+import (
+	"encoding/json"
+	"github.com/kernel/hypeman-go/internal/encoding/json/sentinel"
+	"reflect"
+)
+
+// NullStruct is used to set a struct to the JSON value null.
+// Check for null structs with [IsNull].
+//
+// Only the first type parameter should be provided,
+// the type PtrT will be inferred.
+//
+//	json.Marshal(param.NullStruct[MyStruct]()) -> 'null'
+//
+// To send null to an [Opt] field use [Null].
+func NullStruct[T ParamStruct, PtrT InferPtr[T]]() T {
+	var t T
+	pt := PtrT(&t)
+	pt.setMetadata(nil)
+	return *pt
+}
+
+// Override replaces the value of a struct with any type.
+//
+// Only the first type parameter should be provided,
+// the type PtrT will be inferred.
+//
+// It's often useful for providing raw JSON
+//
+//	param.Override[MyStruct](json.RawMessage(`{"foo": "bar"}`))
+//
+// The public fields of the returned struct T will be unset.
+//
+// To override a specific field in a struct, use its [SetExtraFields] method.
+func Override[T ParamStruct, PtrT InferPtr[T]](v any) T {
+	var t T
+	pt := PtrT(&t)
+	pt.setMetadata(v)
+	return *pt
+}
+
+// SetJSON configures a param struct to serialize with the provided raw JSON data.
+// Use this when you have existing JSON that you want to send as request parameters.
+//
+//	var req example.NewUserParams
+//	var rawJSON = []byte(`{"name": "...", "age": 40}`)
+//	param.SetJSON(rawJSON, &req)
+//	res, err := client.Users.New(ctx, req)
+//
+// Note: The struct's existing fields will be ignored; only the provided JSON is serialized.
+func SetJSON(rawJSON []byte, ptr anyParamStruct) {
+	ptr.setMetadata(json.RawMessage(rawJSON))
+}
+
+// IsOmitted returns true if v is the zero value of its type.
+//
+// If IsOmitted is true, and the field uses a `json:"...,omitzero"` tag,
+// the field will be omitted from the request.
+//
+// If v is set explicitly to the JSON value "null", IsOmitted returns false.
+func IsOmitted(v any) bool {
+	if v == nil {
+		return false
+	}
+	if o, ok := v.(Optional); ok {
+		return o.isZero()
+	}
+	return reflect.ValueOf(v).IsZero()
+}
+
+// IsNull returns true if v was set to the JSON value null.
+//
+// To set a param to null use [NullStruct], [Null], [NullMap], or [NullSlice]
+// depending on the type of v.
+//
+// IsNull returns false if the value is omitted.
+func IsNull[T any](v T) bool {
+	if nullable, ok := any(v).(ParamNullable); ok {
+		return nullable.null()
+	}
+
+	switch reflect.TypeOf(v).Kind() {
+	case reflect.Slice, reflect.Map:
+		return sentinel.IsNull(v)
+	}
+
+	return false
+}
+
+// ParamNullable encapsulates all structs in parameters,
+// and all [Opt] types in parameters.
+type ParamNullable interface {
+	null() bool
+}
+
+// ParamStruct represents the set of all structs that are
+// used in API parameters, by convention these usually end in
+// "Params" or "Param".
+type ParamStruct interface {
+	Overrides() (any, bool)
+	null() bool
+	extraFields() map[string]any
+}
+
+// A pointer to ParamStruct
+type anyParamStruct interface {
+	setMetadata(any)
+}
+
+// This is an implementation detail and should never be explicitly set.
+type InferPtr[T ParamStruct] interface {
+	setMetadata(any)
+	*T
+}
+
+// APIObject should be embedded in api object fields, preferably using an alias to make private
+type APIObject struct{ metadata }
+
+// APIUnion should be embedded in all api unions fields, preferably using an alias to make private
+type APIUnion struct{ metadata }
+
+// Overrides returns the value of the struct when it is created with
+// [Override], the second argument helps differentiate an explicit null.
+func (m metadata) Overrides() (any, bool) {
+	if _, ok := m.any.(metadataExtraFields); ok {
+		return nil, false
+	}
+	return m.any, m.any != nil
+}
+
+// ExtraFields returns the extra fields added to the JSON object.
+func (m metadata) ExtraFields() map[string]any {
+	if extras, ok := m.any.(metadataExtraFields); ok {
+		return extras
+	}
+	return nil
+}
+
+// Omit can be used with [metadata.SetExtraFields] to ensure that a
+// required field is omitted. This is useful as an escape hatch for
+// when a required is unwanted for some unexpected reason.
+const Omit forceOmit = -1
+
+// SetExtraFields adds extra fields to the JSON object.
+//
+// SetExtraFields will override any existing fields with the same key.
+// For security reasons, ensure this is only used with trusted input data.
+//
+// To intentionally omit a required field, use [Omit].
+//
+//	foo.SetExtraFields(map[string]any{"bar": Omit})
+//
+// If the struct already contains the field ExtraFields, then this
+// method will have no effect.
+func (m *metadata) SetExtraFields(extraFields map[string]any) {
+	m.any = metadataExtraFields(extraFields)
+}
+
+// extraFields aliases [metadata.ExtraFields] to avoid name collisions.
+func (m metadata) extraFields() map[string]any { return m.ExtraFields() }
+
+func (m metadata) null() bool {
+	if _, ok := m.any.(metadataNull); ok {
+		return true
+	}
+
+	if msg, ok := m.any.(json.RawMessage); ok {
+		return string(msg) == "null"
+	}
+
+	return false
+}
+
+type metadata struct{ any }
+type metadataNull struct{}
+type metadataExtraFields map[string]any
+
+func (m *metadata) setMetadata(override any) {
+	if override == nil {
+		m.any = metadataNull{}
+		return
+	}
+	m.any = override
+}
diff --git a/sdks/go/packages/respjson/decoder_test.go b/sdks/go/packages/respjson/decoder_test.go
new file mode 100644
index 00000000..b1687619
--- /dev/null
+++ b/sdks/go/packages/respjson/decoder_test.go
@@ -0,0 +1,204 @@
+package respjson_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"github.com/kernel/hypeman-go/internal/apijson"
+	rj "github.com/kernel/hypeman-go/packages/respjson"
+	"reflect"
+	"testing"
+)
+
+type UnionOfStringIntOrObject struct {
+	OfString string    `json:",inline"`
+	OfInt    int       `json:",inline"`
+	Type     string    `json:"type"`
+	Function SubFields `json:"function"`
+	JSON     struct {
+		OfString rj.Field
+		OfInt    rj.Field
+		Type     rj.Field
+		Function rj.Field
+		raw      string
+	} `json:"-"`
+}
+
+func (u UnionOfStringIntOrObject) RawJSON() string { return u.JSON.raw }
+func (r *UnionOfStringIntOrObject) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type SubFields struct {
+	OfBool bool   `json:",inline"`
+	Name   string `json:"name" api:"required"`
+	JSON   struct {
+		OfBool      rj.Field
+		Name        rj.Field
+		ExtraFields map[string]rj.Field
+		raw         string
+	} `json:"-"`
+}
+
+func (r SubFields) RawJSON() string { return r.JSON.raw }
+func (r *SubFields) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+func TestUnmarshalUnionString(t *testing.T) {
+	rawJSON := `"123"`
+	testUnmarshalUnion(t, rawJSON, func(res UnionOfStringIntOrObject) map[string]error {
+		return map[string]error{
+			"rawJSON": checkEqual(res.RawJSON(), rawJSON),
+
+			"string":          checkEqual(res.OfString, "123"),
+			"int":             checkEqual(res.OfInt, 0),
+			"$.type":          checkEqual(res.Type, ""),
+			"$.function.name": checkEqual(res.Function.Name, ""),
+
+			"string.meta":          checkMeta(res.JSON.OfString, rawJSON, shouldBePresent),
+			"int.meta":             checkMeta(res.JSON.OfInt, "", shouldBeNullish),
+			"$.type.meta":          checkMeta(res.JSON.Type, "", shouldBeNullish),
+			"$.function.meta":      checkMeta(res.Function.JSON.Name, "", shouldBeNullish),
+			"$.function.name.meta": checkMeta(res.Function.JSON.Name, "", shouldBeNullish),
+		}
+	})
+}
+
+func TestUnmarshalUnionInt(t *testing.T) {
+	rawJSON := `123`
+	testUnmarshalUnion(t, rawJSON, func(res UnionOfStringIntOrObject) map[string]error {
+		return map[string]error{
+			"rawJSON": checkEqual(res.RawJSON(), rawJSON),
+
+			"string":          checkEqual(res.OfString, ""),
+			"int":             checkEqual(res.OfInt, 123),
+			"$.type":          checkEqual(res.Type, ""),
+			"$.function.name": checkEqual(res.Function.Name, ""),
+			"$.function.bool": checkEqual(res.Function.OfBool, false),
+
+			"string.meta":          checkMeta(res.JSON.OfString, "", shouldBeNullish),
+			"int.meta":             checkMeta(res.JSON.OfInt, rawJSON, shouldBePresent),
+			"$.type.meta":          checkMeta(res.JSON.Type, "", shouldBeNullish),
+			"$.function.meta":      checkMeta(res.Function.JSON.Name, "", shouldBeNullish),
+			"$.function.name.meta": checkMeta(res.Function.JSON.Name, "", shouldBeNullish),
+		}
+	})
+
+	testUnmarshalUnion(t, `0`, func(res UnionOfStringIntOrObject) map[string]error {
+		return map[string]error{
+			"rawJSON": checkEqual(res.RawJSON(), "0"),
+			"string":  checkEqual(res.OfString, ""),
+
+			"int":         checkEqual(res.OfInt, 0),
+			"int.meta":    checkMeta(res.JSON.OfInt, "0", shouldBePresent),
+			"string.meta": checkMeta(res.JSON.OfString, "", shouldBeNullish),
+		}
+	})
+}
+
+func TestUnmarshalUnionObject(t *testing.T) {
+	rawJSON := `{"type":"auto","function":{"name":"test_fn"}}`
+	testUnmarshalUnion(t, rawJSON, func(res UnionOfStringIntOrObject) map[string]error {
+		return map[string]error{
+			"rawJSON": checkEqual(res.RawJSON(), rawJSON),
+
+			"string":          checkEqual(res.OfString, ""),
+			"int":             checkEqual(res.OfInt, 0),
+			"$.type":          checkEqual(res.Type, "auto"),
+			"$.function.name": checkEqual(res.Function.Name, "test_fn"),
+			"$.function.bool": checkEqual(res.Function.OfBool, false),
+
+			"string.meta":          checkMeta(res.JSON.OfString, "", shouldBeNullish),
+			"int.meta":             checkMeta(res.JSON.OfInt, "", shouldBeNullish),
+			"$.type.meta":          checkMeta(res.JSON.Type, `"auto"`, shouldBePresent),
+			"$.function.meta":      checkMeta(res.JSON.Function, `{"name":"test_fn"}`, shouldBePresent),
+			"$.function.name.meta": checkMeta(res.Function.JSON.Name, `"test_fn"`, shouldBePresent),
+			"$.function.bool.meta": checkMeta(res.Function.JSON.OfBool, "", shouldBeNullish),
+		}
+	})
+}
+
+func TestUnmarshalUnionObjectWithInlineSubUnion(t *testing.T) {
+	rawJSON := `{"type":"auto","function":true}`
+	testUnmarshalUnion(t, rawJSON, func(res UnionOfStringIntOrObject) map[string]error {
+		return map[string]error{
+			"rawJSON": checkEqual(res.RawJSON(), rawJSON),
+
+			"string":     checkEqual(res.OfString, ""),
+			"int":        checkEqual(res.OfInt, 0),
+			"$.type":     checkEqual(res.Type, "auto"),
+			"$.function": checkEqual(res.Function.OfBool, true),
+
+			"string.meta":          checkMeta(res.JSON.OfString, "", shouldBeNullish),
+			"int.meta":             checkMeta(res.JSON.OfInt, "", shouldBeNullish),
+			"$.type.meta":          checkMeta(res.JSON.Type, `"auto"`, shouldBePresent),
+			"$.function.meta":      checkMeta(res.JSON.Function, `true`, shouldBePresent),
+			"$.function.name.meta": checkMeta(res.Function.JSON.Name, "", shouldBeNullish),
+			"$.function.bool.meta": checkMeta(res.Function.JSON.OfBool, `true`, shouldBePresent),
+		}
+	})
+}
+
+/*********/
+/* UTILS */
+/*********/
+
+func testUnmarshalUnion[T any](t *testing.T, raw string, check testChecks[T]) {
+	var res T
+	err := json.Unmarshal([]byte(raw), &res)
+	if err != nil {
+		t.Fatalf("failed to unmarshal %v", err.Error())
+	}
+
+	for label, fail := range check(res) {
+		if fail != nil {
+			t.Errorf("failed check %v: %v", label, fail.Error())
+		}
+	}
+}
+
+func checkEqual[T any](got, expected T) error {
+	if reflect.DeepEqual(got, expected) {
+		return nil
+	}
+	return fmt.Errorf("not equal: got %v, expected %v", got, expected)
+}
+
+type metaStatus int
+
+const (
+	shouldBePresent metaStatus = iota
+	shouldBeNullish
+	shouldBeInvalid
+)
+
+type testChecks[T any] func(T) map[string]error
+
+func checkMeta(got rj.Field, raw string, stat metaStatus) error {
+	switch stat {
+	case shouldBePresent:
+		if !got.Valid() {
+			return fmt.Errorf("expected field to be present, but got nullish")
+		}
+		if got.Raw() != raw {
+			return fmt.Errorf("expected field to be present with raw value %v, but got %v", raw, got.Raw())
+		}
+	case shouldBeNullish:
+		if got.Valid() {
+			return fmt.Errorf("expected field to be nullish, but got %v", got.Raw())
+		}
+		if got.Raw() != rj.Omitted && got.Raw() != rj.Null {
+			return fmt.Errorf("expected field to be nullish, but got %v", got.Raw())
+		}
+	case shouldBeInvalid:
+		if !got.Valid() || got.Raw() == "" {
+			return fmt.Errorf("expected field to be invalid, but got valid value %v", got.Raw())
+		}
+		if got.Raw() != raw {
+			return fmt.Errorf("expected field to be invalid, but got valid value %v", got.Raw())
+		}
+	default:
+		return fmt.Errorf("unknown metaStatus: %v", stat)
+	}
+	return nil
+}
diff --git a/sdks/go/packages/respjson/respjson.go b/sdks/go/packages/respjson/respjson.go
new file mode 100644
index 00000000..9e61c5ca
--- /dev/null
+++ b/sdks/go/packages/respjson/respjson.go
@@ -0,0 +1,88 @@
+package respjson
+
+// A Field provides metadata to indicate the presence of a value.
+//
+// Use [Field.Valid] to check if an optional value was null or omitted.
+//
+// A Field will always occur in the following structure, where it
+// mirrors the original field in its parent struct:
+//
+//	type ExampleObject struct {
+//		Foo bool	`json:"foo"`
+//		Bar int		`json:"bar"`
+//		// ...
+//
+//		// JSON provides metadata about the object.
+//		JSON struct {
+//			Foo Field
+//			Bar Field
+//			// ...
+//		} `json:"-"`
+//	}
+//
+// To differentiate a "nullish" value from the zero value,
+// use the [Field.Valid] method.
+//
+//	if !example.JSON.Foo.Valid() {
+//		println("Foo is null or omitted")
+//	}
+//
+//	if example.Foo {
+//		println("Foo is true")
+//	} else {
+//		println("Foo is false")
+//	}
+//
+// To differentiate if a field was omitted or the JSON value "null",
+// use the [Field.Raw] method.
+//
+//	if example.JSON.Foo.Raw() == "null" {
+//		println("Foo is null")
+//	}
+//
+//	if example.JSON.Foo.Raw() == "" {
+//		println("Foo was omitted")
+//	}
+//
+// Otherwise, if the field was invalid and couldn't be marshalled successfully,
+// [Field.Valid] will be false and [Field.Raw] will not be empty.
+type Field struct {
+	status
+	raw string
+}
+
+const (
+	omitted status = iota
+	null
+	invalid
+	valid
+)
+
+type status int8
+
+// Valid returns true if the parent field was set.
+// Valid returns false if the value doesn't exist, is JSON null, or
+// is an unexpected type.
+func (j Field) Valid() bool { return j.status > invalid }
+
+const Null string = "null"
+const Omitted string = ""
+
+// Returns the raw JSON value of the field.
+func (j Field) Raw() string {
+	if j.status == omitted {
+		return ""
+	}
+	return j.raw
+}
+
+func NewField(raw string) Field {
+	if raw == "null" {
+		return Field{status: null, raw: Null}
+	}
+	return Field{status: valid, raw: raw}
+}
+
+func NewInvalidField(raw string) Field {
+	return Field{status: invalid, raw: raw}
+}
diff --git a/sdks/go/packages/ssestream/ssestream.go b/sdks/go/packages/ssestream/ssestream.go
new file mode 100644
index 00000000..cc0afb7b
--- /dev/null
+++ b/sdks/go/packages/ssestream/ssestream.go
@@ -0,0 +1,181 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package ssestream
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+)
+
+type Decoder interface {
+	Event() Event
+	Next() bool
+	Close() error
+	Err() error
+}
+
+func NewDecoder(res *http.Response) Decoder {
+	if res == nil || res.Body == nil {
+		return nil
+	}
+
+	var decoder Decoder
+	contentType := res.Header.Get("content-type")
+	if t, ok := decoderTypes[contentType]; ok {
+		decoder = t(res.Body)
+	} else {
+		scn := bufio.NewScanner(res.Body)
+		scn.Buffer(nil, bufio.MaxScanTokenSize<<9)
+		decoder = &eventStreamDecoder{rc: res.Body, scn: scn}
+	}
+	return decoder
+}
+
+var decoderTypes = map[string](func(io.ReadCloser) Decoder){}
+
+func RegisterDecoder(contentType string, decoder func(io.ReadCloser) Decoder) {
+	decoderTypes[strings.ToLower(contentType)] = decoder
+}
+
+type Event struct {
+	Type string
+	Data []byte
+}
+
+// A base implementation of a Decoder for text/event-stream.
+type eventStreamDecoder struct {
+	evt Event
+	rc  io.ReadCloser
+	scn *bufio.Scanner
+	err error
+}
+
+func (s *eventStreamDecoder) Next() bool {
+	if s.err != nil {
+		return false
+	}
+
+	event := ""
+	data := bytes.NewBuffer(nil)
+
+	for s.scn.Scan() {
+		txt := s.scn.Bytes()
+
+		// Dispatch event on an empty line
+		if len(txt) == 0 {
+			s.evt = Event{
+				Type: event,
+				Data: data.Bytes(),
+			}
+			return true
+		}
+
+		// Split a string like "event: bar" into name="event" and value=" bar".
+		name, value, _ := bytes.Cut(txt, []byte(":"))
+
+		// Consume an optional space after the colon if it exists.
+		if len(value) > 0 && value[0] == ' ' {
+			value = value[1:]
+		}
+
+		switch string(name) {
+		case "":
+			// An empty line in the for ": something" is a comment and should be ignored.
+			continue
+		case "event":
+			event = string(value)
+		case "data":
+			_, s.err = data.Write(value)
+			if s.err != nil {
+				break
+			}
+			_, s.err = data.WriteRune('\n')
+			if s.err != nil {
+				break
+			}
+		}
+	}
+
+	if s.scn.Err() != nil {
+		s.err = s.scn.Err()
+	}
+
+	return false
+}
+
+func (s *eventStreamDecoder) Event() Event {
+	return s.evt
+}
+
+func (s *eventStreamDecoder) Close() error {
+	return s.rc.Close()
+}
+
+func (s *eventStreamDecoder) Err() error {
+	return s.err
+}
+
+type Stream[T any] struct {
+	decoder Decoder
+	cur     T
+	err     error
+}
+
+func NewStream[T any](decoder Decoder, err error) *Stream[T] {
+	return &Stream[T]{
+		decoder: decoder,
+		err:     err,
+	}
+}
+
+// Next returns false if the stream has ended or an error occurred.
+// Call Stream.Current() to get the current value.
+// Call Stream.Err() to get the error.
+//
+//		for stream.Next() {
+//			data := stream.Current()
+//		}
+//
+//	 	if stream.Err() != nil {
+//			...
+//	 	}
+func (s *Stream[T]) Next() bool {
+	if s.err != nil {
+		return false
+	}
+
+	for s.decoder.Next() {
+		var nxt T
+		s.err = json.Unmarshal(s.decoder.Event().Data, &nxt)
+		if s.err != nil {
+			return false
+		}
+		s.cur = nxt
+		return true
+	}
+
+	// decoder.Next() may be false because of an error
+	s.err = s.decoder.Err()
+
+	return false
+}
+
+func (s *Stream[T]) Current() T {
+	return s.cur
+}
+
+func (s *Stream[T]) Err() error {
+	return s.err
+}
+
+func (s *Stream[T]) Close() error {
+	if s.decoder == nil {
+		// already closed
+		return nil
+	}
+	return s.decoder.Close()
+}
diff --git a/sdks/go/release-please-config.json b/sdks/go/release-please-config.json
new file mode 100644
index 00000000..a38198ec
--- /dev/null
+++ b/sdks/go/release-please-config.json
@@ -0,0 +1,67 @@
+{
+  "packages": {
+    ".": {}
+  },
+  "$schema": "https://raw.githubusercontent.com/stainless-api/release-please/main/schemas/config.json",
+  "include-v-in-tag": true,
+  "include-component-in-tag": false,
+  "versioning": "prerelease",
+  "prerelease": true,
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": false,
+  "pull-request-header": "Automated Release PR",
+  "pull-request-title-pattern": "release: ${version}",
+  "changelog-sections": [
+    {
+      "type": "feat",
+      "section": "Features"
+    },
+    {
+      "type": "fix",
+      "section": "Bug Fixes"
+    },
+    {
+      "type": "perf",
+      "section": "Performance Improvements"
+    },
+    {
+      "type": "revert",
+      "section": "Reverts"
+    },
+    {
+      "type": "chore",
+      "section": "Chores"
+    },
+    {
+      "type": "docs",
+      "section": "Documentation"
+    },
+    {
+      "type": "style",
+      "section": "Styles"
+    },
+    {
+      "type": "refactor",
+      "section": "Refactors"
+    },
+    {
+      "type": "test",
+      "section": "Tests",
+      "hidden": true
+    },
+    {
+      "type": "build",
+      "section": "Build System"
+    },
+    {
+      "type": "ci",
+      "section": "Continuous Integration",
+      "hidden": true
+    }
+  ],
+  "release-type": "go",
+  "extra-files": [
+    "internal/version.go",
+    "README.md"
+  ]
+}
\ No newline at end of file
diff --git a/sdks/go/resource.go b/sdks/go/resource.go
new file mode 100644
index 00000000..6ee51a15
--- /dev/null
+++ b/sdks/go/resource.go
@@ -0,0 +1,258 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman
+
+import (
+	"context"
+	"net/http"
+	"slices"
+
+	"github.com/kernel/hypeman-go/internal/apijson"
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/kernel/hypeman-go/packages/respjson"
+)
+
+// ResourceService contains methods and other services that help with interacting
+// with the hypeman API.
+//
+// Note, unlike clients, this service does not read variables from the environment
+// automatically. You should not instantiate this service directly, and instead use
+// the [NewResourceService] method instead.
+type ResourceService struct {
+	Options []option.RequestOption
+}
+
+// NewResourceService generates a new service that applies the given options to
+// each request. These options are applied after the parent client's options (if
+// there is one), and before any request-specific options.
+func NewResourceService(opts ...option.RequestOption) (r ResourceService) {
+	r = ResourceService{}
+	r.Options = opts
+	return
+}
+
+// Returns current host resource capacity, allocation status, and per-instance
+// breakdown. Resources include CPU, memory, disk, and network. Oversubscription
+// ratios are applied to calculate effective limits.
+func (r *ResourceService) Get(ctx context.Context, opts ...option.RequestOption) (res *Resources, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "resources"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+type DiskBreakdown struct {
+	// Disk used by exported rootfs images
+	ImagesBytes int64 `json:"images_bytes"`
+	// Disk used by OCI layer cache (shared blobs)
+	OciCacheBytes int64 `json:"oci_cache_bytes"`
+	// Disk used by instance overlays (rootfs + volume overlays)
+	OverlaysBytes int64 `json:"overlays_bytes"`
+	// Disk used by volumes
+	VolumesBytes int64 `json:"volumes_bytes"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		ImagesBytes   respjson.Field
+		OciCacheBytes respjson.Field
+		OverlaysBytes respjson.Field
+		VolumesBytes  respjson.Field
+		ExtraFields   map[string]respjson.Field
+		raw           string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r DiskBreakdown) RawJSON() string { return r.JSON.raw }
+func (r *DiskBreakdown) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// Available vGPU profile
+type GPUProfile struct {
+	// Number of instances that can be created with this profile
+	Available int64 `json:"available" api:"required"`
+	// Frame buffer size in MB
+	FramebufferMB int64 `json:"framebuffer_mb" api:"required"`
+	// Profile name (user-facing)
+	Name string `json:"name" api:"required"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		Available     respjson.Field
+		FramebufferMB respjson.Field
+		Name          respjson.Field
+		ExtraFields   map[string]respjson.Field
+		raw           string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r GPUProfile) RawJSON() string { return r.JSON.raw }
+func (r *GPUProfile) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// GPU resource status. Null if no GPUs available.
+type GPUResourceStatus struct {
+	// GPU mode (vgpu for SR-IOV/mdev, passthrough for whole GPU)
+	//
+	// Any of "vgpu", "passthrough".
+	Mode GPUResourceStatusMode `json:"mode" api:"required"`
+	// Total slots (VFs for vGPU, physical GPUs for passthrough)
+	TotalSlots int64 `json:"total_slots" api:"required"`
+	// Slots currently in use
+	UsedSlots int64 `json:"used_slots" api:"required"`
+	// Physical GPUs (only in passthrough mode)
+	Devices []PassthroughDevice `json:"devices"`
+	// Available vGPU profiles (only in vGPU mode)
+	Profiles []GPUProfile `json:"profiles"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		Mode        respjson.Field
+		TotalSlots  respjson.Field
+		UsedSlots   respjson.Field
+		Devices     respjson.Field
+		Profiles    respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r GPUResourceStatus) RawJSON() string { return r.JSON.raw }
+func (r *GPUResourceStatus) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+// GPU mode (vgpu for SR-IOV/mdev, passthrough for whole GPU)
+type GPUResourceStatusMode string
+
+const (
+	GPUResourceStatusModeVgpu        GPUResourceStatusMode = "vgpu"
+	GPUResourceStatusModePassthrough GPUResourceStatusMode = "passthrough"
+)
+
+// Physical GPU available for passthrough
+type PassthroughDevice struct {
+	// Whether this GPU is available (not attached to an instance)
+	Available bool `json:"available" api:"required"`
+	// GPU name
+	Name string `json:"name" api:"required"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		Available   respjson.Field
+		Name        respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r PassthroughDevice) RawJSON() string { return r.JSON.raw }
+func (r *PassthroughDevice) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type ResourceAllocation struct {
+	// vCPUs allocated
+	CPU int64 `json:"cpu"`
+	// Disk allocated in bytes (overlay + volumes)
+	DiskBytes int64 `json:"disk_bytes"`
+	// Disk I/O bandwidth limit in bytes/sec
+	DiskIoBps int64 `json:"disk_io_bps"`
+	// Instance identifier
+	InstanceID string `json:"instance_id"`
+	// Instance name
+	InstanceName string `json:"instance_name"`
+	// Memory allocated in bytes
+	MemoryBytes int64 `json:"memory_bytes"`
+	// Download bandwidth limit in bytes/sec (external→VM)
+	NetworkDownloadBps int64 `json:"network_download_bps"`
+	// Upload bandwidth limit in bytes/sec (VM→external)
+	NetworkUploadBps int64 `json:"network_upload_bps"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		CPU                respjson.Field
+		DiskBytes          respjson.Field
+		DiskIoBps          respjson.Field
+		InstanceID         respjson.Field
+		InstanceName       respjson.Field
+		MemoryBytes        respjson.Field
+		NetworkDownloadBps respjson.Field
+		NetworkUploadBps   respjson.Field
+		ExtraFields        map[string]respjson.Field
+		raw                string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r ResourceAllocation) RawJSON() string { return r.JSON.raw }
+func (r *ResourceAllocation) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type ResourceStatus struct {
+	// Currently allocated resources
+	Allocated int64 `json:"allocated" api:"required"`
+	// Available for allocation (effective_limit - allocated)
+	Available int64 `json:"available" api:"required"`
+	// Raw host capacity
+	Capacity int64 `json:"capacity" api:"required"`
+	// Capacity after oversubscription (capacity \* ratio)
+	EffectiveLimit int64 `json:"effective_limit" api:"required"`
+	// Oversubscription ratio applied
+	OversubRatio float64 `json:"oversub_ratio" api:"required"`
+	// Resource type
+	Type string `json:"type" api:"required"`
+	// How capacity was determined (detected, configured)
+	Source string `json:"source"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		Allocated      respjson.Field
+		Available      respjson.Field
+		Capacity       respjson.Field
+		EffectiveLimit respjson.Field
+		OversubRatio   respjson.Field
+		Type           respjson.Field
+		Source         respjson.Field
+		ExtraFields    map[string]respjson.Field
+		raw            string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r ResourceStatus) RawJSON() string { return r.JSON.raw }
+func (r *ResourceStatus) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type Resources struct {
+	Allocations   []ResourceAllocation `json:"allocations" api:"required"`
+	CPU           ResourceStatus       `json:"cpu" api:"required"`
+	Disk          ResourceStatus       `json:"disk" api:"required"`
+	Memory        ResourceStatus       `json:"memory" api:"required"`
+	Network       ResourceStatus       `json:"network" api:"required"`
+	DiskBreakdown DiskBreakdown        `json:"disk_breakdown"`
+	DiskIo        ResourceStatus       `json:"disk_io"`
+	// GPU resource status. Null if no GPUs available.
+	GPU GPUResourceStatus `json:"gpu" api:"nullable"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		Allocations   respjson.Field
+		CPU           respjson.Field
+		Disk          respjson.Field
+		Memory        respjson.Field
+		Network       respjson.Field
+		DiskBreakdown respjson.Field
+		DiskIo        respjson.Field
+		GPU           respjson.Field
+		ExtraFields   map[string]respjson.Field
+		raw           string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r Resources) RawJSON() string { return r.JSON.raw }
+func (r *Resources) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
diff --git a/sdks/go/resource_test.go b/sdks/go/resource_test.go
new file mode 100644
index 00000000..47a06038
--- /dev/null
+++ b/sdks/go/resource_test.go
@@ -0,0 +1,37 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman_test
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/internal/testutil"
+	"github.com/kernel/hypeman-go/option"
+)
+
+func TestResourceGet(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Resources.Get(context.TODO())
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
diff --git a/sdks/go/scripts/bootstrap b/sdks/go/scripts/bootstrap
new file mode 100755
index 00000000..5ab30665
--- /dev/null
+++ b/sdks/go/scripts/bootstrap
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+if [ -f "Brewfile" ] && [ "$(uname -s)" = "Darwin" ] && [ "$SKIP_BREW" != "1" ] && [ -t 0 ]; then
+  brew bundle check >/dev/null 2>&1 || {
+    echo -n "==> Install Homebrew dependencies? (y/N): "
+    read -r response
+    case "$response" in
+      [yY][eE][sS]|[yY])
+        brew bundle
+        ;;
+      *)
+        ;;
+    esac
+    echo
+  }
+fi
+
+echo "==> Installing Go dependencies…"
+
+go mod tidy -e
diff --git a/sdks/go/scripts/checkout-preview b/sdks/go/scripts/checkout-preview
new file mode 100755
index 00000000..2d21fd42
--- /dev/null
+++ b/sdks/go/scripts/checkout-preview
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+# Checkout a preview branch from the stainless-sdks mirror.
+#
+# Usage:
+#   ./scripts/checkout-preview <branch>     # Checkout preview/<branch>
+#   ./scripts/checkout-preview -b <branch>  # Checkout exact branch name
+
+STAINLESS_REMOTE="git@github.com:stainless-sdks/hypeman-go.git"
+
+usage() {
+  echo "Usage: $0 [-b] <branch>"
+  echo ""
+  echo "Checkout a branch from the stainless-sdks/hypeman-go mirror."
+  echo ""
+  echo "Options:"
+  echo "  -b    Use exact branch name instead of preview/<branch>"
+  echo ""
+  echo "Examples:"
+  echo "  $0 devices          # Checkout preview/devices"
+  echo "  $0 -b main          # Checkout main"
+  echo "  $0 -b preview/foo   # Checkout preview/foo"
+  exit 1
+}
+
+ensure_stainless_remote() {
+  if ! git remote get-url stainless >/dev/null 2>&1; then
+    echo "==> Adding stainless remote..."
+    git remote add stainless "${STAINLESS_REMOTE}"
+  fi
+}
+
+EXACT_BRANCH=false
+
+while getopts "bh" opt; do
+  case $opt in
+    b) EXACT_BRANCH=true ;;
+    h) usage ;;
+    *) usage ;;
+  esac
+done
+shift $((OPTIND - 1))
+
+if [ $# -lt 1 ]; then
+  usage
+fi
+
+BRANCH="$1"
+
+if [ "$EXACT_BRANCH" = false ]; then
+  BRANCH="preview/${BRANCH}"
+fi
+
+ensure_stainless_remote
+
+echo "==> Fetching from stainless remote..."
+git fetch stainless
+
+echo "==> Checking out ${BRANCH}..."
+git checkout -B "${BRANCH}" "stainless/${BRANCH}"
+
+echo ""
+echo "Switched to branch '${BRANCH}' tracking stainless/${BRANCH}"
diff --git a/sdks/go/scripts/format b/sdks/go/scripts/format
new file mode 100755
index 00000000..db2a3fa2
--- /dev/null
+++ b/sdks/go/scripts/format
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+echo "==> Running gofmt -s -w"
+gofmt -s -w .
diff --git a/sdks/go/scripts/lint b/sdks/go/scripts/lint
new file mode 100755
index 00000000..7e03a7be
--- /dev/null
+++ b/sdks/go/scripts/lint
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+echo "==> Running Go build"
+go build ./...
+
+echo "==> Checking tests compile"
+go test -run=^$ ./...
diff --git a/sdks/go/scripts/test b/sdks/go/scripts/test
new file mode 100755
index 00000000..8704b648
--- /dev/null
+++ b/sdks/go/scripts/test
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+
+
+echo "==> Running tests"
+go test ./... "$@"
diff --git a/sdks/go/shared/constant/constants.go b/sdks/go/shared/constant/constants.go
new file mode 100644
index 00000000..000f61e1
--- /dev/null
+++ b/sdks/go/shared/constant/constants.go
@@ -0,0 +1,32 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package constant
+
+import (
+	shimjson "github.com/kernel/hypeman-go/internal/encoding/json"
+)
+
+type Constant[T any] interface {
+	Default() T
+}
+
+// ValueOf gives the default value of a constant from its type. It's helpful when
+// constructing constants as variants in a one-of. Note that empty structs are
+// marshalled by default. Usage: constant.ValueOf[constant.Foo]()
+func ValueOf[T Constant[T]]() T {
+	var t T
+	return t.Default()
+}
+
+type constant[T any] interface {
+	Constant[T]
+	*T
+}
+
+func marshalString[T ~string, PT constant[T]](v T) ([]byte, error) {
+	var zero T
+	if v == zero {
+		v = PT(&v).Default()
+	}
+	return shimjson.Marshal(string(v))
+}
diff --git a/sdks/go/usage_test.go b/sdks/go/usage_test.go
new file mode 100644
index 00000000..436721b1
--- /dev/null
+++ b/sdks/go/usage_test.go
@@ -0,0 +1,33 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman_test
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/internal/testutil"
+	"github.com/kernel/hypeman-go/option"
+)
+
+func TestUsage(t *testing.T) {
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	t.Skip("Mock server tests are disabled")
+	response, err := client.Health.Check(context.TODO())
+	if err != nil {
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+	t.Logf("%+v\n", response.Status)
+}
diff --git a/sdks/go/volume.go b/sdks/go/volume.go
new file mode 100644
index 00000000..4cbf2a03
--- /dev/null
+++ b/sdks/go/volume.go
@@ -0,0 +1,201 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/url"
+	"slices"
+	"time"
+
+	"github.com/kernel/hypeman-go/internal/apiform"
+	"github.com/kernel/hypeman-go/internal/apijson"
+	"github.com/kernel/hypeman-go/internal/apiquery"
+	"github.com/kernel/hypeman-go/internal/requestconfig"
+	"github.com/kernel/hypeman-go/option"
+	"github.com/kernel/hypeman-go/packages/param"
+	"github.com/kernel/hypeman-go/packages/respjson"
+)
+
+// VolumeService contains methods and other services that help with interacting
+// with the hypeman API.
+//
+// Note, unlike clients, this service does not read variables from the environment
+// automatically. You should not instantiate this service directly, and instead use
+// the [NewVolumeService] method instead.
+type VolumeService struct {
+	Options []option.RequestOption
+}
+
+// NewVolumeService generates a new service that applies the given options to each
+// request. These options are applied after the parent client's options (if there
+// is one), and before any request-specific options.
+func NewVolumeService(opts ...option.RequestOption) (r VolumeService) {
+	r = VolumeService{}
+	r.Options = opts
+	return
+}
+
+// Creates a new empty volume of the specified size.
+func (r *VolumeService) New(ctx context.Context, body VolumeNewParams, opts ...option.RequestOption) (res *Volume, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "volumes"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, body, &res, opts...)
+	return
+}
+
+// List volumes
+func (r *VolumeService) List(ctx context.Context, opts ...option.RequestOption) (res *[]Volume, err error) {
+	opts = slices.Concat(r.Options, opts)
+	path := "volumes"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+// Delete volume
+func (r *VolumeService) Delete(ctx context.Context, id string, opts ...option.RequestOption) (err error) {
+	opts = slices.Concat(r.Options, opts)
+	opts = append([]option.RequestOption{option.WithHeader("Accept", "*/*")}, opts...)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("volumes/%s", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodDelete, path, nil, nil, opts...)
+	return
+}
+
+// Creates a new volume pre-populated with content from a tar.gz archive. The
+// archive is streamed directly into the volume's root directory.
+func (r *VolumeService) NewFromArchive(ctx context.Context, body io.Reader, params VolumeNewFromArchiveParams, opts ...option.RequestOption) (res *Volume, err error) {
+	opts = slices.Concat(r.Options, opts)
+	opts = append([]option.RequestOption{option.WithRequestBody("application/gzip", body)}, opts...)
+	path := "volumes/from-archive"
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, params, &res, opts...)
+	return
+}
+
+// Get volume details
+func (r *VolumeService) Get(ctx context.Context, id string, opts ...option.RequestOption) (res *Volume, err error) {
+	opts = slices.Concat(r.Options, opts)
+	if id == "" {
+		err = errors.New("missing required id parameter")
+		return
+	}
+	path := fmt.Sprintf("volumes/%s", id)
+	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &res, opts...)
+	return
+}
+
+type Volume struct {
+	// Unique identifier
+	ID string `json:"id" api:"required"`
+	// Creation timestamp (RFC3339)
+	CreatedAt time.Time `json:"created_at" api:"required" format:"date-time"`
+	// Volume name
+	Name string `json:"name" api:"required"`
+	// Size in gigabytes
+	SizeGB int64 `json:"size_gb" api:"required"`
+	// List of current attachments (empty if not attached)
+	Attachments []VolumeAttachment `json:"attachments"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		ID          respjson.Field
+		CreatedAt   respjson.Field
+		Name        respjson.Field
+		SizeGB      respjson.Field
+		Attachments respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r Volume) RawJSON() string { return r.JSON.raw }
+func (r *Volume) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type VolumeAttachment struct {
+	// ID of the instance this volume is attached to
+	InstanceID string `json:"instance_id" api:"required"`
+	// Mount path in the guest
+	MountPath string `json:"mount_path" api:"required"`
+	// Whether the attachment is read-only
+	Readonly bool `json:"readonly" api:"required"`
+	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
+	JSON struct {
+		InstanceID  respjson.Field
+		MountPath   respjson.Field
+		Readonly    respjson.Field
+		ExtraFields map[string]respjson.Field
+		raw         string
+	} `json:"-"`
+}
+
+// Returns the unmodified JSON received from the API
+func (r VolumeAttachment) RawJSON() string { return r.JSON.raw }
+func (r *VolumeAttachment) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type VolumeNewParams struct {
+	// Volume name
+	Name string `json:"name" api:"required"`
+	// Size in gigabytes
+	SizeGB int64 `json:"size_gb" api:"required"`
+	// Optional custom identifier (auto-generated if not provided)
+	ID param.Opt[string] `json:"id,omitzero"`
+	paramObj
+}
+
+func (r VolumeNewParams) MarshalJSON() (data []byte, err error) {
+	type shadow VolumeNewParams
+	return param.MarshalObject(r, (*shadow)(&r))
+}
+func (r *VolumeNewParams) UnmarshalJSON(data []byte) error {
+	return apijson.UnmarshalRoot(data, r)
+}
+
+type VolumeNewFromArchiveParams struct {
+	// Volume name
+	Name string `query:"name" api:"required" json:"-"`
+	// Maximum size in GB (extraction fails if content exceeds this)
+	SizeGB int64 `query:"size_gb" api:"required" json:"-"`
+	// Optional custom volume ID (auto-generated if not provided)
+	ID param.Opt[string] `query:"id,omitzero" json:"-"`
+	paramObj
+}
+
+func (r VolumeNewFromArchiveParams) MarshalMultipart() (data []byte, contentType string, err error) {
+	buf := bytes.NewBuffer(nil)
+	writer := multipart.NewWriter(buf)
+	err = apiform.MarshalRoot(r, writer)
+	if err == nil {
+		err = apiform.WriteExtras(writer, r.ExtraFields())
+	}
+	if err != nil {
+		writer.Close()
+		return nil, "", err
+	}
+	err = writer.Close()
+	if err != nil {
+		return nil, "", err
+	}
+	return buf.Bytes(), writer.FormDataContentType(), nil
+}
+
+// URLQuery serializes [VolumeNewFromArchiveParams]'s query parameters as
+// `url.Values`.
+func (r VolumeNewFromArchiveParams) URLQuery() (v url.Values, err error) {
+	return apiquery.MarshalWithSettings(r, apiquery.QuerySettings{
+		ArrayFormat:  apiquery.ArrayQueryFormatComma,
+		NestedFormat: apiquery.NestedQueryFormatBrackets,
+	})
+}
diff --git a/sdks/go/volume_test.go b/sdks/go/volume_test.go
new file mode 100644
index 00000000..2f90508e
--- /dev/null
+++ b/sdks/go/volume_test.go
@@ -0,0 +1,143 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+package hypeman_test
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"os"
+	"testing"
+
+	"github.com/kernel/hypeman-go"
+	"github.com/kernel/hypeman-go/internal/testutil"
+	"github.com/kernel/hypeman-go/option"
+)
+
+func TestVolumeNewWithOptionalParams(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Volumes.New(context.TODO(), hypeman.VolumeNewParams{
+		Name:   "my-data-volume",
+		SizeGB: 10,
+		ID:     hypeman.String("vol-data-1"),
+	})
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestVolumeList(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Volumes.List(context.TODO())
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestVolumeDelete(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	err := client.Volumes.Delete(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestVolumeNewFromArchiveWithOptionalParams(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Volumes.NewFromArchive(
+		context.TODO(),
+		io.Reader(bytes.NewBuffer([]byte("some file contents"))),
+		hypeman.VolumeNewFromArchiveParams{
+			Name:   "name",
+			SizeGB: 0,
+			ID:     hypeman.String("id"),
+		},
+	)
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
+
+func TestVolumeGet(t *testing.T) {
+	t.Skip("Mock server tests are disabled")
+	baseURL := "http://localhost:4010"
+	if envURL, ok := os.LookupEnv("TEST_API_BASE_URL"); ok {
+		baseURL = envURL
+	}
+	if !testutil.CheckTestServer(t, baseURL) {
+		return
+	}
+	client := hypeman.NewClient(
+		option.WithBaseURL(baseURL),
+		option.WithAPIKey("My API Key"),
+	)
+	_, err := client.Volumes.Get(context.TODO(), "id")
+	if err != nil {
+		var apierr *hypeman.Error
+		if errors.As(err, &apierr) {
+			t.Log(string(apierr.DumpRequest(true)))
+		}
+		t.Fatalf("err should be nil: %s", err.Error())
+	}
+}
diff --git a/sdks/ts/.devcontainer/devcontainer.json b/sdks/ts/.devcontainer/devcontainer.json
new file mode 100644
index 00000000..cb95e3f9
--- /dev/null
+++ b/sdks/ts/.devcontainer/devcontainer.json
@@ -0,0 +1,15 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/debian
+{
+  "name": "Development",
+  "image": "mcr.microsoft.com/devcontainers/typescript-node:latest",
+  "features": {
+    "ghcr.io/devcontainers/features/node:1": {}
+  },
+  "postCreateCommand": "pnpm install",
+  "customizations": {
+    "vscode": {
+      "extensions": ["esbenp.prettier-vscode"]
+    }
+  }
+}
diff --git a/sdks/ts/.github/workflows/ci.yml b/sdks/ts/.github/workflows/ci.yml
new file mode 100644
index 00000000..4abcaa6b
--- /dev/null
+++ b/sdks/ts/.github/workflows/ci.yml
@@ -0,0 +1,103 @@
+name: CI
+on:
+  push:
+    branches-ignore:
+      - 'generated'
+      - 'codegen/**'
+      - 'integrated/**'
+      - 'stl-preview-head/**'
+      - 'stl-preview-base/**'
+  pull_request:
+    branches-ignore:
+      - 'stl-preview-head/**'
+      - 'stl-preview-base/**'
+
+jobs:
+  lint:
+    timeout-minutes: 10
+    name: lint
+    runs-on: ${{ github.repository == 'stainless-sdks/hypeman-typescript' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: '10.24.0'
+
+      - name: Bootstrap
+        run: ./scripts/bootstrap
+
+      - name: Check types
+        run: ./scripts/lint
+
+  build:
+    timeout-minutes: 5
+    name: build
+    runs-on: ${{ github.repository == 'stainless-sdks/hypeman-typescript' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: '10.24.0'
+
+      - name: Bootstrap
+        run: ./scripts/bootstrap
+
+      - name: Check build
+        run: ./scripts/build
+
+      - name: Get GitHub OIDC Token
+        if: github.repository == 'stainless-sdks/hypeman-typescript'
+        id: github-oidc
+        uses: actions/github-script@v6
+        with:
+          script: core.setOutput('github_token', await core.getIDToken());
+
+      - name: Upload tarball
+        if: github.repository == 'stainless-sdks/hypeman-typescript'
+        env:
+          URL: https://pkg.stainless.com/s
+          AUTH: ${{ steps.github-oidc.outputs.github_token }}
+          SHA: ${{ github.sha }}
+        run: ./scripts/utils/upload-artifact.sh
+  test:
+    timeout-minutes: 10
+    name: test
+    runs-on: ${{ github.repository == 'stainless-sdks/hypeman-typescript' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: '10.24.0'
+
+      - name: Bootstrap
+        run: ./scripts/bootstrap
+
+      - name: Run tests
+        run: ./scripts/test
diff --git a/sdks/ts/.github/workflows/publish-npm.yml b/sdks/ts/.github/workflows/publish-npm.yml
new file mode 100644
index 00000000..e8e4e82d
--- /dev/null
+++ b/sdks/ts/.github/workflows/publish-npm.yml
@@ -0,0 +1,35 @@
+# This workflow is triggered when a GitHub release is created.
+# It can also be run manually to re-publish to NPM in case it failed for some reason.
+# You can run this workflow by navigating to https://www.github.com/onkernel/hypeman-ts/actions/workflows/publish-npm.yml
+name: Publish NPM
+on:
+  workflow_dispatch:
+
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    name: publish
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: '20'
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Install dependencies
+        run: |
+          pnpm install
+
+      - name: Publish to NPM
+        run: |
+          bash ./bin/publish-npm
+        env:
+          NPM_TOKEN: ${{ secrets.HYPEMAN_NPM_TOKEN || secrets.NPM_TOKEN }}
diff --git a/sdks/ts/.github/workflows/release-doctor.yml b/sdks/ts/.github/workflows/release-doctor.yml
new file mode 100644
index 00000000..71cd2e28
--- /dev/null
+++ b/sdks/ts/.github/workflows/release-doctor.yml
@@ -0,0 +1,22 @@
+name: Release Doctor
+on:
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  release_doctor:
+    name: release doctor
+    runs-on: ubuntu-latest
+    if: github.repository == 'onkernel/hypeman-ts' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check release environment
+        run: |
+          bash ./bin/check-release-environment
+        env:
+          NPM_TOKEN: ${{ secrets.HYPEMAN_NPM_TOKEN || secrets.NPM_TOKEN }}
+
diff --git a/sdks/ts/.gitignore b/sdks/ts/.gitignore
new file mode 100644
index 00000000..2412bb77
--- /dev/null
+++ b/sdks/ts/.gitignore
@@ -0,0 +1,11 @@
+.prism.log
+node_modules
+yarn-error.log
+codegen.log
+Brewfile.lock.json
+dist
+dist-deno
+/*.tgz
+.idea/
+.eslintcache
+
diff --git a/sdks/ts/.prettierignore b/sdks/ts/.prettierignore
new file mode 100644
index 00000000..3548c5af
--- /dev/null
+++ b/sdks/ts/.prettierignore
@@ -0,0 +1,7 @@
+CHANGELOG.md
+/ecosystem-tests/*/**
+/node_modules
+/deno
+
+# don't format tsc output, will break source maps
+/dist
diff --git a/sdks/ts/.prettierrc.json b/sdks/ts/.prettierrc.json
new file mode 100644
index 00000000..af75adaf
--- /dev/null
+++ b/sdks/ts/.prettierrc.json
@@ -0,0 +1,7 @@
+{
+  "arrowParens": "always",
+  "experimentalTernaries": true,
+  "printWidth": 110,
+  "singleQuote": true,
+  "trailingComma": "all"
+}
diff --git a/sdks/ts/.release-please-manifest.json b/sdks/ts/.release-please-manifest.json
new file mode 100644
index 00000000..466df71c
--- /dev/null
+++ b/sdks/ts/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "0.1.0"
+}
diff --git a/sdks/ts/.stats.yml b/sdks/ts/.stats.yml
new file mode 100644
index 00000000..4838a307
--- /dev/null
+++ b/sdks/ts/.stats.yml
@@ -0,0 +1,4 @@
+configured_endpoints: 30
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel%2Fhypeman-cfdd18a303e2e6c87d671e6ae3ecdcd1d9642b053c2ef6bc507eee3f55cc6aa8.yml
+openapi_spec_hash: 0b038c955d95740ace74103a9c18d5a3
+config_hash: f65a6a2bcef49a9f623212f9de6d6f6f
diff --git a/sdks/ts/Brewfile b/sdks/ts/Brewfile
new file mode 100644
index 00000000..e4feee60
--- /dev/null
+++ b/sdks/ts/Brewfile
@@ -0,0 +1 @@
+brew "node"
diff --git a/sdks/ts/CHANGELOG.md b/sdks/ts/CHANGELOG.md
new file mode 100644
index 00000000..96b1ee51
--- /dev/null
+++ b/sdks/ts/CHANGELOG.md
@@ -0,0 +1,32 @@
+# Changelog
+
+## 0.1.0 (2025-12-23)
+
+Full Changelog: [v0.0.2...v0.1.0](https://github.com/onkernel/hypeman-ts/compare/v0.0.2...v0.1.0)
+
+### Features
+
+* add cpToInstance and cpFromInstance functions ([113b412](https://github.com/onkernel/hypeman-ts/commit/113b4129c3bcca7f2ba8cc1c590542a00ad873a0))
+* add hypeman cp for file copy to/from running VMs ([0ee9f4a](https://github.com/onkernel/hypeman-ts/commit/0ee9f4a86ea8a6a94b896ce66cf7dc90a8d7c296))
+* **api:** add autogenerated stat endpoint from Stainless ([38c9dbd](https://github.com/onkernel/hypeman-ts/commit/38c9dbdf9a129b434b7c9246d321da6b6f9ed2d4))
+* QEMU support ([8f0f4f4](https://github.com/onkernel/hypeman-ts/commit/8f0f4f4b0cf1723af0cd79e549f4aacaa9c6584b))
+
+
+### Bug Fixes
+
+* **cp:** address bugbot review comments ([ba6c287](https://github.com/onkernel/hypeman-ts/commit/ba6c2876049bae125951dbe363f5d6deabaaf03f))
+
+
+### Chores
+
+* sync repo ([75f4200](https://github.com/onkernel/hypeman-ts/commit/75f4200bb4c22d85be3ab8b065078ee1165cfa22))
+
+## 0.0.2 (2025-12-22)
+
+Full Changelog: [v0.0.1...v0.0.2](https://github.com/onkernel/hypeman-ts/compare/v0.0.1...v0.0.2)
+
+### Chores
+
+* configure new SDK language ([9eba465](https://github.com/onkernel/hypeman-ts/commit/9eba465b84418dc70994a43eb6b28e498841d8a6))
+* update SDK settings ([8a8e921](https://github.com/onkernel/hypeman-ts/commit/8a8e92120eea2a6cd22182555ec2caa2d159fca0))
+* update SDK settings ([523dcfd](https://github.com/onkernel/hypeman-ts/commit/523dcfdff90593e47211b52a05f8d3bed1433780))
diff --git a/sdks/ts/CONTRIBUTING.md b/sdks/ts/CONTRIBUTING.md
new file mode 100644
index 00000000..740b422f
--- /dev/null
+++ b/sdks/ts/CONTRIBUTING.md
@@ -0,0 +1,107 @@
+## Setting up the environment
+
+This repository uses [`pnpm`](https://pnpm.io/).
+Other package managers may work but are not officially supported for development.
+
+To set up the repository, run:
+
+```sh
+$ pnpm install
+$ pnpm build
+```
+
+This will install all the required dependencies and build output files to `dist/`.
+
+## Modifying/Adding code
+
+Most of the SDK is generated code. Modifications to code will be persisted between generations, but may
+result in merge conflicts between manual patches and changes from the generator. The generator will never
+modify the contents of the `src/lib/` and `examples/` directories.
+
+## Adding and running examples
+
+All files in the `examples/` directory are not modified by the generator and can be freely edited or added to.
+
+```ts
+// add an example to examples/<your-example>.ts
+
+#!/usr/bin/env -S npm run tsn -T
+…
+```
+
+```sh
+$ chmod +x examples/<your-example>.ts
+# run the example against your api
+$ pnpm tsn -T examples/<your-example>.ts
+```
+
+## Using the repository from source
+
+If you’d like to use the repository from source, you can either install from git or link to a cloned repository:
+
+To install via git:
+
+```sh
+$ npm install git+ssh://git@github.com:onkernel/hypeman-ts.git
+```
+
+Alternatively, to link a local copy of the repo:
+
+```sh
+# Clone
+$ git clone https://www.github.com/onkernel/hypeman-ts
+$ cd hypeman-ts
+
+# With yarn
+$ yarn link
+$ cd ../my-package
+$ yarn link @onkernel/hypeman
+
+# With pnpm
+$ pnpm link --global
+$ cd ../my-package
+$ pnpm link -—global @onkernel/hypeman
+```
+
+## Running tests
+
+Most tests require you to [set up a mock server](https://github.com/stoplightio/prism) against the OpenAPI spec to run the tests.
+
+```sh
+$ npx prism mock path/to/your/openapi.yml
+```
+
+```sh
+$ pnpm run test
+```
+
+## Linting and formatting
+
+This repository uses [prettier](https://www.npmjs.com/package/prettier) and
+[eslint](https://www.npmjs.com/package/eslint) to format the code in the repository.
+
+To lint:
+
+```sh
+$ pnpm lint
+```
+
+To format and fix all lint issues automatically:
+
+```sh
+$ pnpm fix
+```
+
+## Publishing and releases
+
+Changes made to this repository via the automated release PR pipeline should publish to npm automatically. If
+the changes aren't made through the automated pipeline, you may want to make releases manually.
+
+### Publish with a GitHub workflow
+
+You can release to package managers by using [the `Publish NPM` GitHub action](https://www.github.com/onkernel/hypeman-ts/actions/workflows/publish-npm.yml). This requires a setup organization or repository secret to be set up.
+
+### Publish manually
+
+If you need to manually release a package, you can run the `bin/publish-npm` script with an `NPM_TOKEN` set on
+the environment.
diff --git a/sdks/ts/LICENSE b/sdks/ts/LICENSE
new file mode 100644
index 00000000..5e9bf84c
--- /dev/null
+++ b/sdks/ts/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2025 Hypeman
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/sdks/ts/README.md b/sdks/ts/README.md
new file mode 100644
index 00000000..9a521666
--- /dev/null
+++ b/sdks/ts/README.md
@@ -0,0 +1,358 @@
+# Hypeman TypeScript API Library
+
+[![NPM version](<https://img.shields.io/npm/v/@onkernel/hypeman.svg?label=npm%20(stable)>)](https://npmjs.org/package/@onkernel/hypeman) ![npm bundle size](https://img.shields.io/bundlephobia/minzip/@onkernel/hypeman)
+
+This library provides convenient access to the Hypeman REST API from server-side TypeScript or JavaScript.
+
+The full API of this library can be found in [api.md](api.md).
+
+It is generated with [Stainless](https://www.stainless.com/).
+
+## Installation
+
+```sh
+npm install @onkernel/hypeman
+```
+
+## Usage
+
+The full API of this library can be found in [api.md](api.md).
+
+<!-- prettier-ignore -->
+```js
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  apiKey: process.env['HYPEMAN_API_KEY'], // This is the default and can be omitted
+});
+
+const response = await client.health.check();
+
+console.log(response.status);
+```
+
+### Request & Response types
+
+This library includes TypeScript definitions for all request params and response fields. You may import and use them like so:
+
+<!-- prettier-ignore -->
+```ts
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  apiKey: process.env['HYPEMAN_API_KEY'], // This is the default and can be omitted
+});
+
+const response: Hypeman.HealthCheckResponse = await client.health.check();
+```
+
+Documentation for each method, request param, and response field are available in docstrings and will appear on hover in most modern editors.
+
+## Handling errors
+
+When the library is unable to connect to the API,
+or if the API returns a non-success status code (i.e., 4xx or 5xx response),
+a subclass of `APIError` will be thrown:
+
+<!-- prettier-ignore -->
+```ts
+const response = await client.health.check().catch(async (err) => {
+  if (err instanceof Hypeman.APIError) {
+    console.log(err.status); // 400
+    console.log(err.name); // BadRequestError
+    console.log(err.headers); // {server: 'nginx', ...}
+  } else {
+    throw err;
+  }
+});
+```
+
+Error codes are as follows:
+
+| Status Code | Error Type                 |
+| ----------- | -------------------------- |
+| 400         | `BadRequestError`          |
+| 401         | `AuthenticationError`      |
+| 403         | `PermissionDeniedError`    |
+| 404         | `NotFoundError`            |
+| 422         | `UnprocessableEntityError` |
+| 429         | `RateLimitError`           |
+| >=500       | `InternalServerError`      |
+| N/A         | `APIConnectionError`       |
+
+### Retries
+
+Certain errors will be automatically retried 2 times by default, with a short exponential backoff.
+Connection errors (for example, due to a network connectivity problem), 408 Request Timeout, 409 Conflict,
+429 Rate Limit, and >=500 Internal errors will all be retried by default.
+
+You can use the `maxRetries` option to configure or disable this:
+
+<!-- prettier-ignore -->
+```js
+// Configure the default for all requests:
+const client = new Hypeman({
+  maxRetries: 0, // default is 2
+});
+
+// Or, configure per-request:
+await client.health.check({
+  maxRetries: 5,
+});
+```
+
+### Timeouts
+
+Requests time out after 1 minute by default. You can configure this with a `timeout` option:
+
+<!-- prettier-ignore -->
+```ts
+// Configure the default for all requests:
+const client = new Hypeman({
+  timeout: 20 * 1000, // 20 seconds (default is 1 minute)
+});
+
+// Override per-request:
+await client.health.check({
+  timeout: 5 * 1000,
+});
+```
+
+On timeout, an `APIConnectionTimeoutError` is thrown.
+
+Note that requests which time out will be [retried twice by default](#retries).
+
+## Advanced Usage
+
+### Accessing raw Response data (e.g., headers)
+
+The "raw" `Response` returned by `fetch()` can be accessed through the `.asResponse()` method on the `APIPromise` type that all methods return.
+This method returns as soon as the headers for a successful response are received and does not consume the response body, so you are free to write custom parsing or streaming logic.
+
+You can also use the `.withResponse()` method to get the raw `Response` along with the parsed data.
+Unlike `.asResponse()` this method consumes the body, returning once it is parsed.
+
+<!-- prettier-ignore -->
+```ts
+const client = new Hypeman();
+
+const response = await client.health.check().asResponse();
+console.log(response.headers.get('X-My-Header'));
+console.log(response.statusText); // access the underlying Response object
+
+const { data: response, response: raw } = await client.health.check().withResponse();
+console.log(raw.headers.get('X-My-Header'));
+console.log(response.status);
+```
+
+### Logging
+
+> [!IMPORTANT]
+> All log messages are intended for debugging only. The format and content of log messages
+> may change between releases.
+
+#### Log levels
+
+The log level can be configured in two ways:
+
+1. Via the `HYPEMAN_LOG` environment variable
+2. Using the `logLevel` client option (overrides the environment variable if set)
+
+```ts
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  logLevel: 'debug', // Show all log messages
+});
+```
+
+Available log levels, from most to least verbose:
+
+- `'debug'` - Show debug messages, info, warnings, and errors
+- `'info'` - Show info messages, warnings, and errors
+- `'warn'` - Show warnings and errors (default)
+- `'error'` - Show only errors
+- `'off'` - Disable all logging
+
+At the `'debug'` level, all HTTP requests and responses are logged, including headers and bodies.
+Some authentication-related headers are redacted, but sensitive data in request and response bodies
+may still be visible.
+
+#### Custom logger
+
+By default, this library logs to `globalThis.console`. You can also provide a custom logger.
+Most logging libraries are supported, including [pino](https://www.npmjs.com/package/pino), [winston](https://www.npmjs.com/package/winston), [bunyan](https://www.npmjs.com/package/bunyan), [consola](https://www.npmjs.com/package/consola), [signale](https://www.npmjs.com/package/signale), and [@std/log](https://jsr.io/@std/log). If your logger doesn't work, please open an issue.
+
+When providing a custom logger, the `logLevel` option still controls which messages are emitted, messages
+below the configured level will not be sent to your logger.
+
+```ts
+import Hypeman from '@onkernel/hypeman';
+import pino from 'pino';
+
+const logger = pino();
+
+const client = new Hypeman({
+  logger: logger.child({ name: 'Hypeman' }),
+  logLevel: 'debug', // Send all messages to pino, allowing it to filter
+});
+```
+
+### Making custom/undocumented requests
+
+This library is typed for convenient access to the documented API. If you need to access undocumented
+endpoints, params, or response properties, the library can still be used.
+
+#### Undocumented endpoints
+
+To make requests to undocumented endpoints, you can use `client.get`, `client.post`, and other HTTP verbs.
+Options on the client, such as retries, will be respected when making these requests.
+
+```ts
+await client.post('/some/path', {
+  body: { some_prop: 'foo' },
+  query: { some_query_arg: 'bar' },
+});
+```
+
+#### Undocumented request params
+
+To make requests using undocumented parameters, you may use `// @ts-expect-error` on the undocumented
+parameter. This library doesn't validate at runtime that the request matches the type, so any extra values you
+send will be sent as-is.
+
+```ts
+client.health.check({
+  // ...
+  // @ts-expect-error baz is not yet public
+  baz: 'undocumented option',
+});
+```
+
+For requests with the `GET` verb, any extra params will be in the query, all other requests will send the
+extra param in the body.
+
+If you want to explicitly send an extra argument, you can do so with the `query`, `body`, and `headers` request
+options.
+
+#### Undocumented response properties
+
+To access undocumented response properties, you may access the response object with `// @ts-expect-error` on
+the response object, or cast the response object to the requisite type. Like the request params, we do not
+validate or strip extra properties from the response from the API.
+
+### Customizing the fetch client
+
+By default, this library expects a global `fetch` function is defined.
+
+If you want to use a different `fetch` function, you can either polyfill the global:
+
+```ts
+import fetch from 'my-fetch';
+
+globalThis.fetch = fetch;
+```
+
+Or pass it to the client:
+
+```ts
+import Hypeman from '@onkernel/hypeman';
+import fetch from 'my-fetch';
+
+const client = new Hypeman({ fetch });
+```
+
+### Fetch options
+
+If you want to set custom `fetch` options without overriding the `fetch` function, you can provide a `fetchOptions` object when instantiating the client or making a request. (Request-specific options override client options.)
+
+```ts
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  fetchOptions: {
+    // `RequestInit` options
+  },
+});
+```
+
+#### Configuring proxies
+
+To modify proxy behavior, you can provide custom `fetchOptions` that add runtime-specific proxy
+options to requests:
+
+<img src="https://raw.githubusercontent.com/stainless-api/sdk-assets/refs/heads/main/node.svg" align="top" width="18" height="21"> **Node** <sup>[[docs](https://github.com/nodejs/undici/blob/main/docs/docs/api/ProxyAgent.md#example---proxyagent-with-fetch)]</sup>
+
+```ts
+import Hypeman from '@onkernel/hypeman';
+import * as undici from 'undici';
+
+const proxyAgent = new undici.ProxyAgent('http://localhost:8888');
+const client = new Hypeman({
+  fetchOptions: {
+    dispatcher: proxyAgent,
+  },
+});
+```
+
+<img src="https://raw.githubusercontent.com/stainless-api/sdk-assets/refs/heads/main/bun.svg" align="top" width="18" height="21"> **Bun** <sup>[[docs](https://bun.sh/guides/http/proxy)]</sup>
+
+```ts
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  fetchOptions: {
+    proxy: 'http://localhost:8888',
+  },
+});
+```
+
+<img src="https://raw.githubusercontent.com/stainless-api/sdk-assets/refs/heads/main/deno.svg" align="top" width="18" height="21"> **Deno** <sup>[[docs](https://docs.deno.com/api/deno/~/Deno.createHttpClient)]</sup>
+
+```ts
+import Hypeman from 'npm:@onkernel/hypeman';
+
+const httpClient = Deno.createHttpClient({ proxy: { url: 'http://localhost:8888' } });
+const client = new Hypeman({
+  fetchOptions: {
+    client: httpClient,
+  },
+});
+```
+
+## Frequently Asked Questions
+
+## Semantic versioning
+
+This package generally follows [SemVer](https://semver.org/spec/v2.0.0.html) conventions, though certain backwards-incompatible changes may be released as minor versions:
+
+1. Changes that only affect static types, without breaking runtime behavior.
+2. Changes to library internals which are technically public but not intended or documented for external use. _(Please open a GitHub issue to let us know if you are relying on such internals.)_
+3. Changes that we do not expect to impact the vast majority of users in practice.
+
+We take backwards-compatibility seriously and work hard to ensure you can rely on a smooth upgrade experience.
+
+We are keen for your feedback; please open an [issue](https://www.github.com/onkernel/hypeman-ts/issues) with questions, bugs, or suggestions.
+
+## Requirements
+
+TypeScript >= 4.9 is supported.
+
+The following runtimes are supported:
+
+- Web browsers (Up-to-date Chrome, Firefox, Safari, Edge, and more)
+- Node.js 20 LTS or later ([non-EOL](https://endoflife.date/nodejs)) versions.
+- Deno v1.28.0 or higher.
+- Bun 1.0 or later.
+- Cloudflare Workers.
+- Vercel Edge Runtime.
+- Jest 28 or greater with the `"node"` environment (`"jsdom"` is not supported at this time).
+- Nitro v2.6 or greater.
+
+Note that React Native is not supported at this time.
+
+If you are interested in other runtime environments, please open or upvote an issue on GitHub.
+
+## Contributing
+
+See [the contributing documentation](./CONTRIBUTING.md).
diff --git a/sdks/ts/SECURITY.md b/sdks/ts/SECURITY.md
new file mode 100644
index 00000000..94a5b008
--- /dev/null
+++ b/sdks/ts/SECURITY.md
@@ -0,0 +1,23 @@
+# Security Policy
+
+## Reporting Security Issues
+
+This SDK is generated by [Stainless Software Inc](http://stainless.com). Stainless takes security seriously, and encourages you to report any security vulnerability promptly so that appropriate action can be taken.
+
+To report a security issue, please contact the Stainless team at security@stainless.com.
+
+## Responsible Disclosure
+
+We appreciate the efforts of security researchers and individuals who help us maintain the security of
+SDKs we generate. If you believe you have found a security vulnerability, please adhere to responsible
+disclosure practices by allowing us a reasonable amount of time to investigate and address the issue
+before making any information public.
+
+## Reporting Non-SDK Related Security Issues
+
+If you encounter security issues that are not directly related to SDKs but pertain to the services
+or products provided by Hypeman, please follow the respective company's security reporting guidelines.
+
+---
+
+Thank you for helping us keep the SDKs and systems they interact with secure.
diff --git a/sdks/ts/api.md b/sdks/ts/api.md
new file mode 100644
index 00000000..ed3b3c09
--- /dev/null
+++ b/sdks/ts/api.md
@@ -0,0 +1,104 @@
+# Health
+
+Types:
+
+- <code><a href="./src/resources/health.ts">HealthCheckResponse</a></code>
+
+Methods:
+
+- <code title="get /health">client.health.<a href="./src/resources/health.ts">check</a>() -> HealthCheckResponse</code>
+
+# Images
+
+Types:
+
+- <code><a href="./src/resources/images.ts">Image</a></code>
+- <code><a href="./src/resources/images.ts">ImageListResponse</a></code>
+
+Methods:
+
+- <code title="post /images">client.images.<a href="./src/resources/images.ts">create</a>({ ...params }) -> Image</code>
+- <code title="get /images">client.images.<a href="./src/resources/images.ts">list</a>() -> ImageListResponse</code>
+- <code title="delete /images/{name}">client.images.<a href="./src/resources/images.ts">delete</a>(name) -> void</code>
+- <code title="get /images/{name}">client.images.<a href="./src/resources/images.ts">get</a>(name) -> Image</code>
+
+# Instances
+
+Types:
+
+- <code><a href="./src/resources/instances/instances.ts">Instance</a></code>
+- <code><a href="./src/resources/instances/instances.ts">PathInfo</a></code>
+- <code><a href="./src/resources/instances/instances.ts">PortMapping</a></code>
+- <code><a href="./src/resources/instances/instances.ts">VolumeMount</a></code>
+- <code><a href="./src/resources/instances/instances.ts">InstanceListResponse</a></code>
+- <code><a href="./src/resources/instances/instances.ts">InstanceLogsResponse</a></code>
+
+Methods:
+
+- <code title="post /instances">client.instances.<a href="./src/resources/instances/instances.ts">create</a>({ ...params }) -> Instance</code>
+- <code title="get /instances">client.instances.<a href="./src/resources/instances/instances.ts">list</a>() -> InstanceListResponse</code>
+- <code title="delete /instances/{id}">client.instances.<a href="./src/resources/instances/instances.ts">delete</a>(id) -> void</code>
+- <code title="get /instances/{id}">client.instances.<a href="./src/resources/instances/instances.ts">get</a>(id) -> Instance</code>
+- <code title="get /instances/{id}/logs">client.instances.<a href="./src/resources/instances/instances.ts">logs</a>(id, { ...params }) -> string</code>
+- <code title="post /instances/{id}/restore">client.instances.<a href="./src/resources/instances/instances.ts">restore</a>(id) -> Instance</code>
+- <code title="post /instances/{id}/standby">client.instances.<a href="./src/resources/instances/instances.ts">standby</a>(id) -> Instance</code>
+- <code title="post /instances/{id}/start">client.instances.<a href="./src/resources/instances/instances.ts">start</a>(id) -> Instance</code>
+- <code title="get /instances/{id}/stat">client.instances.<a href="./src/resources/instances/instances.ts">stat</a>(id, { ...params }) -> PathInfo</code>
+- <code title="post /instances/{id}/stop">client.instances.<a href="./src/resources/instances/instances.ts">stop</a>(id) -> Instance</code>
+
+## Volumes
+
+Methods:
+
+- <code title="post /instances/{id}/volumes/{volumeId}">client.instances.volumes.<a href="./src/resources/instances/volumes.ts">attach</a>(volumeID, { ...params }) -> Instance</code>
+- <code title="delete /instances/{id}/volumes/{volumeId}">client.instances.volumes.<a href="./src/resources/instances/volumes.ts">detach</a>(volumeID, { ...params }) -> Instance</code>
+
+# Volumes
+
+Types:
+
+- <code><a href="./src/resources/volumes.ts">Volume</a></code>
+- <code><a href="./src/resources/volumes.ts">VolumeAttachment</a></code>
+- <code><a href="./src/resources/volumes.ts">VolumeListResponse</a></code>
+
+Methods:
+
+- <code title="post /volumes">client.volumes.<a href="./src/resources/volumes.ts">create</a>({ ...params }) -> Volume</code>
+- <code title="get /volumes">client.volumes.<a href="./src/resources/volumes.ts">list</a>() -> VolumeListResponse</code>
+- <code title="delete /volumes/{id}">client.volumes.<a href="./src/resources/volumes.ts">delete</a>(id) -> void</code>
+- <code title="get /volumes/{id}">client.volumes.<a href="./src/resources/volumes.ts">get</a>(id) -> Volume</code>
+
+# Devices
+
+Types:
+
+- <code><a href="./src/resources/devices.ts">AvailableDevice</a></code>
+- <code><a href="./src/resources/devices.ts">Device</a></code>
+- <code><a href="./src/resources/devices.ts">DeviceType</a></code>
+- <code><a href="./src/resources/devices.ts">DeviceListResponse</a></code>
+- <code><a href="./src/resources/devices.ts">DeviceListAvailableResponse</a></code>
+
+Methods:
+
+- <code title="post /devices">client.devices.<a href="./src/resources/devices.ts">create</a>({ ...params }) -> Device</code>
+- <code title="get /devices/{id}">client.devices.<a href="./src/resources/devices.ts">retrieve</a>(id) -> Device</code>
+- <code title="get /devices">client.devices.<a href="./src/resources/devices.ts">list</a>() -> DeviceListResponse</code>
+- <code title="delete /devices/{id}">client.devices.<a href="./src/resources/devices.ts">delete</a>(id) -> void</code>
+- <code title="get /devices/available">client.devices.<a href="./src/resources/devices.ts">listAvailable</a>() -> DeviceListAvailableResponse</code>
+
+# Ingresses
+
+Types:
+
+- <code><a href="./src/resources/ingresses.ts">Ingress</a></code>
+- <code><a href="./src/resources/ingresses.ts">IngressMatch</a></code>
+- <code><a href="./src/resources/ingresses.ts">IngressRule</a></code>
+- <code><a href="./src/resources/ingresses.ts">IngressTarget</a></code>
+- <code><a href="./src/resources/ingresses.ts">IngressListResponse</a></code>
+
+Methods:
+
+- <code title="post /ingresses">client.ingresses.<a href="./src/resources/ingresses.ts">create</a>({ ...params }) -> Ingress</code>
+- <code title="get /ingresses">client.ingresses.<a href="./src/resources/ingresses.ts">list</a>() -> IngressListResponse</code>
+- <code title="delete /ingresses/{id}">client.ingresses.<a href="./src/resources/ingresses.ts">delete</a>(id) -> void</code>
+- <code title="get /ingresses/{id}">client.ingresses.<a href="./src/resources/ingresses.ts">get</a>(id) -> Ingress</code>
diff --git a/sdks/ts/bin/check-release-environment b/sdks/ts/bin/check-release-environment
new file mode 100644
index 00000000..e4b6d58e
--- /dev/null
+++ b/sdks/ts/bin/check-release-environment
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+errors=()
+
+if [ -z "${NPM_TOKEN}" ]; then
+  errors+=("The NPM_TOKEN secret has not been set. Please set it in either this repository's secrets or your organization secrets")
+fi
+
+lenErrors=${#errors[@]}
+
+if [[ lenErrors -gt 0 ]]; then
+  echo -e "Found the following errors in the release environment:\n"
+
+  for error in "${errors[@]}"; do
+    echo -e "- $error\n"
+  done
+
+  exit 1
+fi
+
+echo "The environment is ready to push releases!"
+
diff --git a/sdks/ts/bin/publish-npm b/sdks/ts/bin/publish-npm
new file mode 100644
index 00000000..a6099896
--- /dev/null
+++ b/sdks/ts/bin/publish-npm
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+set -eux
+
+npm config set '//registry.npmjs.org/:_authToken' "$NPM_TOKEN"
+
+pnpm build
+cd dist
+
+# Get package name and version from package.json
+PACKAGE_NAME="$(jq -r -e '.name' ./package.json)"
+VERSION="$(jq -r -e '.version' ./package.json)"
+
+# Get latest version from npm
+#
+# If the package doesn't exist, npm will return:
+# {
+#   "error": {
+#     "code": "E404",
+#     "summary": "Unpublished on 2025-06-05T09:54:53.528Z",
+#     "detail": "'the_package' is not in this registry..."
+#   }
+# }
+NPM_INFO="$(npm view "$PACKAGE_NAME" version --json 2>/dev/null || true)"
+
+# Check if we got an E404 error
+if echo "$NPM_INFO" | jq -e '.error.code == "E404"' > /dev/null 2>&1; then
+  # Package doesn't exist yet, no last version
+  LAST_VERSION=""
+elif echo "$NPM_INFO" | jq -e '.error' > /dev/null 2>&1; then
+  # Report other errors
+  echo "ERROR: npm returned unexpected data:"
+  echo "$NPM_INFO"
+  exit 1
+else
+  # Success - get the version
+  LAST_VERSION=$(echo "$NPM_INFO" | jq -r '.') # strip quotes
+fi
+
+# Check if current version is pre-release (e.g. alpha / beta / rc)
+CURRENT_IS_PRERELEASE=false
+if [[ "$VERSION" =~ -([a-zA-Z]+) ]]; then
+  CURRENT_IS_PRERELEASE=true
+  CURRENT_TAG="${BASH_REMATCH[1]}"
+fi
+
+# Check if last version is a stable release
+LAST_IS_STABLE_RELEASE=true
+if [[ -z "$LAST_VERSION" || "$LAST_VERSION" =~ -([a-zA-Z]+) ]]; then
+  LAST_IS_STABLE_RELEASE=false
+fi
+
+# Use a corresponding alpha/beta tag if there already is a stable release and we're publishing a prerelease.
+if $CURRENT_IS_PRERELEASE && $LAST_IS_STABLE_RELEASE; then
+  TAG="$CURRENT_TAG"
+else
+  TAG="latest"
+fi
+
+# Publish with the appropriate tag
+pnpm publish --no-git-checks --tag "$TAG"
diff --git a/sdks/ts/eslint.config.mjs b/sdks/ts/eslint.config.mjs
new file mode 100644
index 00000000..fc2d233b
--- /dev/null
+++ b/sdks/ts/eslint.config.mjs
@@ -0,0 +1,42 @@
+// @ts-check
+import tseslint from 'typescript-eslint';
+import unusedImports from 'eslint-plugin-unused-imports';
+import prettier from 'eslint-plugin-prettier';
+
+export default tseslint.config(
+  {
+    languageOptions: {
+      parser: tseslint.parser,
+      parserOptions: { sourceType: 'module' },
+    },
+    files: ['**/*.ts', '**/*.mts', '**/*.cts', '**/*.js', '**/*.mjs', '**/*.cjs'],
+    ignores: ['dist/'],
+    plugins: {
+      '@typescript-eslint': tseslint.plugin,
+      'unused-imports': unusedImports,
+      prettier,
+    },
+    rules: {
+      'no-unused-vars': 'off',
+      'prettier/prettier': 'error',
+      'unused-imports/no-unused-imports': 'error',
+      'no-restricted-imports': [
+        'error',
+        {
+          patterns: [
+            {
+              regex: '^@onkernel/hypeman(/.*)?',
+              message: 'Use a relative import, not a package import.',
+            },
+          ],
+        },
+      ],
+    },
+  },
+  {
+    files: ['tests/**', 'examples/**'],
+    rules: {
+      'no-restricted-imports': 'off',
+    },
+  },
+);
diff --git a/sdks/ts/examples/.keep b/sdks/ts/examples/.keep
new file mode 100644
index 00000000..0651c89c
--- /dev/null
+++ b/sdks/ts/examples/.keep
@@ -0,0 +1,4 @@
+File generated from our OpenAPI spec by Stainless.
+
+This directory can be used to store example files demonstrating usage of this SDK.
+It is ignored by Stainless code generation and its content (other than this keep file) won't be touched.
diff --git a/sdks/ts/jest.config.ts b/sdks/ts/jest.config.ts
new file mode 100644
index 00000000..ecf32cee
--- /dev/null
+++ b/sdks/ts/jest.config.ts
@@ -0,0 +1,23 @@
+import type { JestConfigWithTsJest } from 'ts-jest';
+
+const config: JestConfigWithTsJest = {
+  preset: 'ts-jest/presets/default-esm',
+  testEnvironment: 'node',
+  transform: {
+    '^.+\\.(t|j)sx?$': ['@swc/jest', { sourceMaps: 'inline' }],
+  },
+  moduleNameMapper: {
+    '^@onkernel/hypeman$': '<rootDir>/src/index.ts',
+    '^@onkernel/hypeman/(.*)$': '<rootDir>/src/$1',
+  },
+  modulePathIgnorePatterns: [
+    '<rootDir>/ecosystem-tests/',
+    '<rootDir>/dist/',
+    '<rootDir>/deno/',
+    '<rootDir>/deno_tests/',
+    '<rootDir>/packages/',
+  ],
+  testPathIgnorePatterns: ['scripts'],
+};
+
+export default config;
diff --git a/sdks/ts/package.json b/sdks/ts/package.json
new file mode 100644
index 00000000..c9129a21
--- /dev/null
+++ b/sdks/ts/package.json
@@ -0,0 +1,72 @@
+{
+  "name": "@onkernel/hypeman",
+  "version": "0.1.0",
+  "description": "The official TypeScript library for the Hypeman API",
+  "author": "Hypeman <>",
+  "types": "dist/index.d.ts",
+  "main": "dist/index.js",
+  "type": "commonjs",
+  "repository": "github:onkernel/hypeman-ts",
+  "license": "Apache-2.0",
+  "packageManager": "pnpm@10.24.0",
+  "files": [
+    "**/*"
+  ],
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "test": "./scripts/test",
+    "build": "./scripts/build",
+    "prepublishOnly": "echo 'to publish, run pnpm build && (cd dist; pnpm publish)' && exit 1",
+    "format": "./scripts/format",
+    "prepare": "if ./scripts/utils/check-is-in-git-install.sh; then ./scripts/build && ./scripts/utils/git-swap.sh; fi",
+    "tsn": "ts-node -r tsconfig-paths/register",
+    "lint": "./scripts/lint",
+    "fix": "./scripts/format"
+  },
+  "dependencies": {
+    "ws": "^8.18.3"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "^0.17.0",
+    "@swc/core": "^1.3.102",
+    "@swc/jest": "^0.2.29",
+    "@types/jest": "^29.4.0",
+    "@types/node": "^20.17.6",
+    "@types/ws": "^8.18.1",
+    "@typescript-eslint/eslint-plugin": "8.31.1",
+    "@typescript-eslint/parser": "8.31.1",
+    "eslint": "^9.39.1",
+    "eslint-plugin-prettier": "^5.4.1",
+    "eslint-plugin-unused-imports": "^4.1.4",
+    "iconv-lite": "^0.6.3",
+    "jest": "^29.4.0",
+    "prettier": "^3.0.0",
+    "publint": "^0.2.12",
+    "ts-jest": "^29.1.0",
+    "ts-node": "^10.5.0",
+    "tsc-multi": "https://github.com/stainless-api/tsc-multi/releases/download/v1.1.9/tsc-multi.tgz",
+    "tsconfig-paths": "^4.0.0",
+    "tslib": "^2.8.1",
+    "typescript": "5.8.3",
+    "typescript-eslint": "8.31.1"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./*.mjs": {
+      "default": "./dist/*.mjs"
+    },
+    "./*.js": {
+      "default": "./dist/*.js"
+    },
+    "./*": {
+      "import": "./dist/*.mjs",
+      "require": "./dist/*.js"
+    }
+  }
+}
diff --git a/sdks/ts/pnpm-lock.yaml b/sdks/ts/pnpm-lock.yaml
new file mode 100644
index 00000000..4dab831e
--- /dev/null
+++ b/sdks/ts/pnpm-lock.yaml
@@ -0,0 +1,4276 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      ws:
+        specifier: ^8.18.3
+        version: 8.18.3
+    devDependencies:
+      '@arethetypeswrong/cli':
+        specifier: ^0.17.0
+        version: 0.17.0
+      '@swc/core':
+        specifier: ^1.3.102
+        version: 1.4.16
+      '@swc/jest':
+        specifier: ^0.2.29
+        version: 0.2.36(@swc/core@1.4.16)
+      '@types/jest':
+        specifier: ^29.4.0
+        version: 29.5.11
+      '@types/node':
+        specifier: ^20.17.6
+        version: 20.19.11
+      '@types/ws':
+        specifier: ^8.18.1
+        version: 8.18.1
+      '@typescript-eslint/eslint-plugin':
+        specifier: 8.31.1
+        version: 8.31.1(@typescript-eslint/parser@8.31.1(eslint@9.39.1)(typescript@5.8.3))(eslint@9.39.1)(typescript@5.8.3)
+      '@typescript-eslint/parser':
+        specifier: 8.31.1
+        version: 8.31.1(eslint@9.39.1)(typescript@5.8.3)
+      eslint:
+        specifier: ^9.39.1
+        version: 9.39.1
+      eslint-plugin-prettier:
+        specifier: ^5.4.1
+        version: 5.4.1(eslint@9.39.1)(prettier@3.1.1)
+      eslint-plugin-unused-imports:
+        specifier: ^4.1.4
+        version: 4.1.4(@typescript-eslint/eslint-plugin@8.31.1(@typescript-eslint/parser@8.31.1(eslint@9.39.1)(typescript@5.8.3))(eslint@9.39.1)(typescript@5.8.3))(eslint@9.39.1)
+      iconv-lite:
+        specifier: ^0.6.3
+        version: 0.6.3
+      jest:
+        specifier: ^29.4.0
+        version: 29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3))
+      prettier:
+        specifier: ^3.0.0
+        version: 3.1.1
+      publint:
+        specifier: ^0.2.12
+        version: 0.2.12
+      ts-jest:
+        specifier: ^29.1.0
+        version: 29.1.1(@babel/core@7.23.6)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.23.6))(jest@29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3)))(typescript@5.8.3)
+      ts-node:
+        specifier: ^10.5.0
+        version: 10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3)
+      tsc-multi:
+        specifier: https://github.com/stainless-api/tsc-multi/releases/download/v1.1.9/tsc-multi.tgz
+        version: https://github.com/stainless-api/tsc-multi/releases/download/v1.1.9/tsc-multi.tgz(typescript@5.8.3)
+      tsconfig-paths:
+        specifier: ^4.0.0
+        version: 4.2.0
+      tslib:
+        specifier: ^2.8.1
+        version: 2.8.1
+      typescript:
+        specifier: 5.8.3
+        version: 5.8.3
+      typescript-eslint:
+        specifier: 8.31.1
+        version: 8.31.1(eslint@9.39.1)(typescript@5.8.3)
+
+packages:
+
+  '@ampproject/remapping@2.2.1':
+    resolution: {integrity: sha512-lFMjJTrFL3j7L9yBxwYfCq2k6qqwHyzuUl/XBnif78PWTJYyL/dfowQHWE3sp6U6ZzqWiiIZnpTMO96zhkjwtg==}
+    engines: {node: '>=6.0.0'}
+
+  '@andrewbranch/untar.js@1.0.3':
+    resolution: {integrity: sha512-Jh15/qVmrLGhkKJBdXlK1+9tY4lZruYjsgkDFj08ZmDiWVBLJcqkok7Z0/R0In+i1rScBpJlSvrTS2Lm41Pbnw==}
+
+  '@arethetypeswrong/cli@0.17.0':
+    resolution: {integrity: sha512-xSMW7bfzVWpYw5JFgZqBXqr6PdR0/REmn3DkxCES5N0JTcB0CVgbIynJCvKBFmXaPc3hzmmTrb7+yPDRoOSZdA==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  '@arethetypeswrong/core@0.17.0':
+    resolution: {integrity: sha512-FHyhFizXNetigTVsIhqXKGYLpazPS5YNojEPpZEUcBPt9wVvoEbNIvG+hybuBR+pjlRcbyuqhukHZm1fr+bDgA==}
+    engines: {node: '>=18'}
+
+  '@babel/code-frame@7.23.5':
+    resolution: {integrity: sha512-CgH3s1a96LipHCmSUmYFPwY7MNx8C3avkq7i4Wl3cfa662ldtUe4VM1TPXX70pfmrlWTb6jLqTYrZyT2ZTJBgA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/compat-data@7.23.5':
+    resolution: {integrity: sha512-uU27kfDRlhfKl+w1U6vp16IuvSLtjAxdArVXPa9BvLkrr7CYIsxH5adpHObeAGY/41+syctUWOZ140a2Rvkgjw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/core@7.23.6':
+    resolution: {integrity: sha512-FxpRyGjrMJXh7X3wGLGhNDCRiwpWEF74sKjTLDJSG5Kyvow3QZaG0Adbqzi9ZrVjTWpsX+2cxWXD71NMg93kdw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/generator@7.23.6':
+    resolution: {integrity: sha512-qrSfCYxYQB5owCmGLbl8XRpX1ytXlpueOb0N0UmQwA073KZxejgQTzAmJezxvpwQD9uGtK2shHdi55QT+MbjIw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-compilation-targets@7.23.6':
+    resolution: {integrity: sha512-9JB548GZoQVmzrFgp8o7KxdgkTGm6xs9DW0o/Pim72UDjzr5ObUQ6ZzYPqA+g9OTS2bBQoctLJrky0RDCAWRgQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-environment-visitor@7.22.20':
+    resolution: {integrity: sha512-zfedSIzFhat/gFhWfHtgWvlec0nqB9YEIVrpuwjruLlXfUSnA8cJB0miHKwqDnQ7d32aKo2xt88/xZptwxbfhA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-function-name@7.23.0':
+    resolution: {integrity: sha512-OErEqsrxjZTJciZ4Oo+eoZqeW9UIiOcuYKRJA4ZAgV9myA+pOXhhmpfNCKjEH/auVfEYVFJ6y1Tc4r0eIApqiw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-hoist-variables@7.22.5':
+    resolution: {integrity: sha512-wGjk9QZVzvknA6yKIUURb8zY3grXCcOZt+/7Wcy8O2uctxhplmUPkOdlgoNhmdVee2c92JXbf1xpMtVNbfoxRw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-imports@7.22.15':
+    resolution: {integrity: sha512-0pYVBnDKZO2fnSPCrgM/6WMc7eS20Fbok+0r88fp+YtWVLZrp4CkafFGIp+W0VKw4a22sgebPT99y+FDNMdP4w==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-transforms@7.23.3':
+    resolution: {integrity: sha512-7bBs4ED9OmswdfDzpz4MpWgSrV7FXlc3zIagvLFjS5H+Mk7Snr21vQ6QwrsoCGMfNC4e4LQPdoULEt4ykz0SRQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-plugin-utils@7.22.5':
+    resolution: {integrity: sha512-uLls06UVKgFG9QD4OeFYLEGteMIAa5kpTPcFL28yuCIIzsf6ZyKZMllKVOCZFhiZ5ptnwX4mtKdWCBE/uT4amg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-simple-access@7.22.5':
+    resolution: {integrity: sha512-n0H99E/K+Bika3++WNL17POvo4rKWZ7lZEp1Q+fStVbUi8nxPQEBOlTmCOxW/0JsS56SKKQ+ojAe2pHKJHN35w==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-split-export-declaration@7.22.6':
+    resolution: {integrity: sha512-AsUnxuLhRYsisFiaJwvp1QF+I3KjD5FOxut14q/GzovUe6orHLesW2C7d754kRm53h5gqrz6sFl6sxc4BVtE/g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-string-parser@7.23.4':
+    resolution: {integrity: sha512-803gmbQdqwdf4olxrX4AJyFBV/RTr3rSmOj0rKwesmzlfhYNDEs+/iOcznzpNWlJlIlTJC2QfPFcHB6DlzdVLQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.22.20':
+    resolution: {integrity: sha512-Y4OZ+ytlatR8AI+8KZfKuL5urKp7qey08ha31L8b3BwewJAoJamTzyvxPR/5D+KkdJCGPq/+8TukHBlY10FX9A==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-option@7.23.5':
+    resolution: {integrity: sha512-85ttAOMLsr53VgXkTbkx8oA6YTfT4q7/HzXSLEYmjcSTJPMPQtvq1BD79Byep5xMUYbGRzEpDsjUf3dyp54IKw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helpers@7.23.6':
+    resolution: {integrity: sha512-wCfsbN4nBidDRhpDhvcKlzHWCTlgJYUUdSJfzXb2NuBssDSIjc3xcb+znA7l+zYsFljAcGM0aFkN40cR3lXiGA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/highlight@7.23.4':
+    resolution: {integrity: sha512-acGdbYSfp2WheJoJm/EBBBLh/ID8KDc64ISZ9DYtBmC8/Q204PZJLHyzeB5qMzJ5trcOkybd78M4x2KWsUq++A==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/parser@7.23.6':
+    resolution: {integrity: sha512-Z2uID7YJ7oNvAI20O9X0bblw7Qqs8Q2hFy0R9tAfnfLkp5MW0UH9eUvnDSnFwKZ0AvgS1ucqR4KzvVHgnke1VQ==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/plugin-syntax-async-generators@7.8.4':
+    resolution: {integrity: sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-bigint@7.8.3':
+    resolution: {integrity: sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-class-properties@7.12.13':
+    resolution: {integrity: sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-import-meta@7.10.4':
+    resolution: {integrity: sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-json-strings@7.8.3':
+    resolution: {integrity: sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-jsx@7.23.3':
+    resolution: {integrity: sha512-EB2MELswq55OHUoRZLGg/zC7QWUKfNLpE57m/S2yr1uEneIgsTgrSzXP3NXEsMkVn76OlaVVnzN+ugObuYGwhg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-logical-assignment-operators@7.10.4':
+    resolution: {integrity: sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-nullish-coalescing-operator@7.8.3':
+    resolution: {integrity: sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-numeric-separator@7.10.4':
+    resolution: {integrity: sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-object-rest-spread@7.8.3':
+    resolution: {integrity: sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-optional-catch-binding@7.8.3':
+    resolution: {integrity: sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-optional-chaining@7.8.3':
+    resolution: {integrity: sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-top-level-await@7.14.5':
+    resolution: {integrity: sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-syntax-typescript@7.23.3':
+    resolution: {integrity: sha512-9EiNjVJOMwCO+43TqoTrgQ8jMwcAd0sWyXi9RPfIsLTj4R2MADDDQXELhffaUx/uJv2AYcxBgPwH6j4TIA4ytQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/template@7.22.15':
+    resolution: {integrity: sha512-QPErUVm4uyJa60rkI73qneDacvdvzxshT3kksGqlGWYdOTIUOwJ7RDUL8sGqslY1uXWSL6xMFKEXDS3ox2uF0w==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/traverse@7.23.6':
+    resolution: {integrity: sha512-czastdK1e8YByZqezMPFiZ8ahwVMh/ESl9vPgvgdB9AmFMGP5jfpFax74AQgl5zj4XHzqeYAg2l8PuUeRS1MgQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.23.6':
+    resolution: {integrity: sha512-+uarb83brBzPKN38NX1MkB6vb6+mwvR6amUulqAE7ccQw1pEl+bCia9TbdG1lsnFP7lZySvUn37CHyXQdfTwzg==}
+    engines: {node: '>=6.9.0'}
+
+  '@bcoe/v8-coverage@0.2.3':
+    resolution: {integrity: sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==}
+
+  '@colors/colors@1.5.0':
+    resolution: {integrity: sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==}
+    engines: {node: '>=0.1.90'}
+
+  '@cspotcode/source-map-consumer@0.8.0':
+    resolution: {integrity: sha512-41qniHzTU8yAGbCp04ohlmSrZf8bkf/iJsl3V0dRGsQN/5GFfx+LbCSsCpp2gqrqjTVg/K6O8ycoV35JIwAzAg==}
+    engines: {node: '>= 12'}
+
+  '@cspotcode/source-map-support@0.7.0':
+    resolution: {integrity: sha512-X4xqRHqN8ACt2aHVe51OxeA2HjbcL4MqFqXkrmQszJ1NOUuUu5u6Vqx/0lZSVNku7velL5FC/s5uEAj1lsBMhA==}
+    engines: {node: '>=12'}
+
+  '@eslint-community/eslint-utils@4.4.0':
+    resolution: {integrity: sha512-1/sA4dwrzBAyeUoQ6oxahHKmrZvsnLCg4RfxW3ZFGGmQkSNQPFNLV9CUEFQP1x9EYXHTo5p6xdhZM1Ne9p/AfA==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+    peerDependencies:
+      eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
+
+  '@eslint-community/eslint-utils@4.9.0':
+    resolution: {integrity: sha512-ayVFHdtZ+hsq1t2Dy24wCmGXGe4q9Gu3smhLYALJrr473ZH27MsnSL+LKUlimp4BWJqMDMLmPpx/Q9R3OAlL4g==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+    peerDependencies:
+      eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
+
+  '@eslint-community/regexpp@4.12.1':
+    resolution: {integrity: sha512-CCZCDJuduB9OUkFkY2IgppNZMi2lBQgD2qzwXkEia16cge2pijY/aXi96CJMquDMn3nJdlPV1A5KrJEXwfLNzQ==}
+    engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
+
+  '@eslint-community/regexpp@4.12.2':
+    resolution: {integrity: sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==}
+    engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
+
+  '@eslint/config-array@0.21.1':
+    resolution: {integrity: sha512-aw1gNayWpdI/jSYVgzN5pL0cfzU02GT3NBpeT/DXbx1/1x7ZKxFPd9bwrzygx/qiwIQiJ1sw/zD8qY/kRvlGHA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/config-helpers@0.4.2':
+    resolution: {integrity: sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/core@0.17.0':
+    resolution: {integrity: sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/eslintrc@3.3.3':
+    resolution: {integrity: sha512-Kr+LPIUVKz2qkx1HAMH8q1q6azbqBAsXJUxBl/ODDuVPX45Z9DfwB8tPjTi6nNZ8BuM3nbJxC5zCAg5elnBUTQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/js@9.39.1':
+    resolution: {integrity: sha512-S26Stp4zCy88tH94QbBv3XCuzRQiZ9yXofEILmglYTh/Ug/a9/umqvgFtYBAo3Lp0nsI/5/qH1CCrbdK3AP1Tw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/object-schema@2.1.7':
+    resolution: {integrity: sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/plugin-kit@0.4.1':
+    resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@humanfs/core@0.19.1':
+    resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanfs/node@0.16.7':
+    resolution: {integrity: sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanwhocodes/module-importer@1.0.1':
+    resolution: {integrity: sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==}
+    engines: {node: '>=12.22'}
+
+  '@humanwhocodes/retry@0.4.3':
+    resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
+    engines: {node: '>=18.18'}
+
+  '@istanbuljs/load-nyc-config@1.1.0':
+    resolution: {integrity: sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==}
+    engines: {node: '>=8'}
+
+  '@istanbuljs/schema@0.1.3':
+    resolution: {integrity: sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==}
+    engines: {node: '>=8'}
+
+  '@jest/console@29.7.0':
+    resolution: {integrity: sha512-5Ni4CU7XHQi32IJ398EEP4RrB8eV09sXP2ROqD4bksHrnTree52PsxvX8tpL8LvTZ3pFzXyPbNQReSN41CAhOg==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/core@29.7.0':
+    resolution: {integrity: sha512-n7aeXWKMnGtDA48y8TLWJPJmLmmZ642Ceo78cYWEpiD7FzDgmNDV/GCVRorPABdXLJZ/9wzzgZAlHjXjxDHGsg==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    peerDependencies:
+      node-notifier: ^8.0.1 || ^9.0.0 || ^10.0.0
+    peerDependenciesMeta:
+      node-notifier:
+        optional: true
+
+  '@jest/create-cache-key-function@29.7.0':
+    resolution: {integrity: sha512-4QqS3LY5PBmTRHj9sAg1HLoPzqAI0uOX6wI/TRqHIcOxlFidy6YEmCQJk6FSZjNLGCeubDMfmkWL+qaLKhSGQA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/environment@29.7.0':
+    resolution: {integrity: sha512-aQIfHDq33ExsN4jP1NWGXhxgQ/wixs60gDiKO+XVMd8Mn0NWPWgc34ZQDTb2jKaUWQ7MuwoitXAsN2XVXNMpAw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/expect-utils@29.7.0':
+    resolution: {integrity: sha512-GlsNBWiFQFCVi9QVSx7f5AgMeLxe9YCCs5PuP2O2LdjDAA8Jh9eX7lA1Jq/xdXw3Wb3hyvlFNfZIfcRetSzYcA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/expect@29.7.0':
+    resolution: {integrity: sha512-8uMeAMycttpva3P1lBHB8VciS9V0XAr3GymPpipdyQXbBcuhkLQOSe8E/p92RyAdToS6ZD1tFkX+CkhoECE0dQ==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/fake-timers@29.7.0':
+    resolution: {integrity: sha512-q4DH1Ha4TTFPdxLsqDXK1d3+ioSL7yL5oCMJZgDYm6i+6CygW5E5xVr/D1HdsGxjt1ZWSfUAs9OxSB/BNelWrQ==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/globals@29.7.0':
+    resolution: {integrity: sha512-mpiz3dutLbkW2MNFubUGUEVLkTGiqW6yLVTA+JbP6fI6J5iL9Y0Nlg8k95pcF8ctKwCS7WVxteBs29hhfAotzQ==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/reporters@29.7.0':
+    resolution: {integrity: sha512-DApq0KJbJOEzAFYjHADNNxAE3KbhxQB1y5Kplb5Waqw6zVbuWatSnMjE5gs8FUgEPmNsnZA3NCWl9NG0ia04Pg==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    peerDependencies:
+      node-notifier: ^8.0.1 || ^9.0.0 || ^10.0.0
+    peerDependenciesMeta:
+      node-notifier:
+        optional: true
+
+  '@jest/schemas@29.6.3':
+    resolution: {integrity: sha512-mo5j5X+jIZmJQveBKeS/clAueipV7KgiX1vMgCxam1RNYiqE1w62n0/tJJnHtjW8ZHcQco5gY85jA3mi0L+nSA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/source-map@29.6.3':
+    resolution: {integrity: sha512-MHjT95QuipcPrpLM+8JMSzFx6eHp5Bm+4XeFDJlwsvVBjmKNiIAvasGK2fxz2WbGRlnvqehFbh07MMa7n3YJnw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/test-result@29.7.0':
+    resolution: {integrity: sha512-Fdx+tv6x1zlkJPcWXmMDAG2HBnaR9XPSd5aDWQVsfrZmLVT3lU1cwyxLgRmXR9yrq4NBoEm9BMsfgFzTQAbJYA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/test-sequencer@29.7.0':
+    resolution: {integrity: sha512-GQwJ5WZVrKnOJuiYiAF52UNUJXgTZx1NHjFSEB0qEMmSZKAkdMoIzw/Cj6x6NF4AvV23AUqDpFzQkN/eYCYTxw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/transform@29.7.0':
+    resolution: {integrity: sha512-ok/BTPFzFKVMwO5eOHRrvnBVHdRy9IrsrW1GpMaQ9MCnilNLXQKmAX8s1YXDFaai9xJpac2ySzV0YeRRECr2Vw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/types@29.6.3':
+    resolution: {integrity: sha512-u3UPsIilWKOM3F9CXtrG8LEJmNxwoCQC/XVj4IKYXvvpx7QIi/Kg1LI5uDmDpKlac62NUtX7eLjRh+jVZcLOzw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jridgewell/gen-mapping@0.3.3':
+    resolution: {integrity: sha512-HLhSWOLRi875zjjMG/r+Nv0oCW8umGb0BgEhyX3dDX3egwZtB8PqLnjz3yedt8R5StBrzcg4aBpnh8UA9D1BoQ==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/resolve-uri@3.1.1':
+    resolution: {integrity: sha512-dSYZh7HhCDtCKm4QakX0xFpsRDqjjtZf/kjI/v3T3Nwt5r8/qz/M19F9ySyOqU94SXBmeG9ttTul+YnR4LOxFA==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/set-array@1.1.2':
+    resolution: {integrity: sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/sourcemap-codec@1.4.15':
+    resolution: {integrity: sha512-eF2rxCRulEKXHTRiDrDy6erMYWqNw4LPdQ8UQA4huuxaQsVeRPFl2oM8oDGxMFhJUWZf9McpLtJasDDZb/Bpeg==}
+
+  '@jridgewell/trace-mapping@0.3.20':
+    resolution: {integrity: sha512-R8LcPeWZol2zR8mmH3JeKQ6QRCFb7XgUhV9ZlGhHLGyg4wpPiPZNQOOWhFZhxKw8u//yTbNGI42Bx/3paXEQ+Q==}
+
+  '@nodelib/fs.scandir@2.1.5':
+    resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.stat@2.0.5':
+    resolution: {integrity: sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.walk@1.2.8':
+    resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
+    engines: {node: '>= 8'}
+
+  '@pkgr/core@0.2.4':
+    resolution: {integrity: sha512-ROFF39F6ZrnzSUEmQQZUar0Jt4xVoP9WnDRdWwF4NNcXs3xBTLgBUDoOwW141y1jP+S8nahIbdxbFC7IShw9Iw==}
+    engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
+
+  '@sinclair/typebox@0.27.8':
+    resolution: {integrity: sha512-+Fj43pSMwJs4KRrH/938Uf+uAELIgVBmQzg/q1YG10djyfA3TnrU8N8XzqCh/okZdszqBQTZf96idMfE5lnwTA==}
+
+  '@sindresorhus/is@4.6.0':
+    resolution: {integrity: sha512-t09vSN3MdfsyCHoFcTRCH/iUtG7OJ0CsjzB8cjAmKc/va/kIgeDI/TxsigdncE/4be734m0cvIYwNaV4i2XqAw==}
+    engines: {node: '>=10'}
+
+  '@sinonjs/commons@3.0.0':
+    resolution: {integrity: sha512-jXBtWAF4vmdNmZgD5FoKsVLv3rPgDnLgPbU84LIJ3otV44vJlDRokVng5v8NFJdCf/da9legHcKaRuZs4L7faA==}
+
+  '@sinonjs/fake-timers@10.3.0':
+    resolution: {integrity: sha512-V4BG07kuYSUkTCSBHG8G8TNhM+F19jXFWnQtzj+we8DrkpSBCee9Z3Ms8yiGer/dlmhe35/Xdgyo3/0rQKg7YA==}
+
+  '@swc/core-darwin-arm64@1.4.16':
+    resolution: {integrity: sha512-UOCcH1GvjRnnM/LWT6VCGpIk0OhHRq6v1U6QXuPt5wVsgXnXQwnf5k3sG5Cm56hQHDvhRPY6HCsHi/p0oek8oQ==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@swc/core-darwin-x64@1.4.16':
+    resolution: {integrity: sha512-t3bgqFoYLWvyVtVL6KkFNCINEoOrIlyggT/kJRgi1y0aXSr0oVgcrQ4ezJpdeahZZ4N+Q6vT3ffM30yIunELNA==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@swc/core-linux-arm-gnueabihf@1.4.16':
+    resolution: {integrity: sha512-DvHuwvEF86YvSd0lwnzVcjOTZ0jcxewIbsN0vc/0fqm9qBdMMjr9ox6VCam1n3yYeRtj4VFgrjeNFksqbUejdQ==}
+    engines: {node: '>=10'}
+    cpu: [arm]
+    os: [linux]
+
+  '@swc/core-linux-arm64-gnu@1.4.16':
+    resolution: {integrity: sha512-9Uu5YlPbyCvbidjKtYEsPpyZlu16roOZ5c2tP1vHfnU9bgf5Tz5q5VovSduNxPHx+ed2iC1b1URODHvDzbbDuQ==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@swc/core-linux-arm64-musl@1.4.16':
+    resolution: {integrity: sha512-/YZq/qB1CHpeoL0eMzyqK5/tYZn/rzKoCYDviFU4uduSUIJsDJQuQA/skdqUzqbheOXKAd4mnJ1hT04RbJ8FPQ==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@swc/core-linux-x64-gnu@1.4.16':
+    resolution: {integrity: sha512-UUjaW5VTngZYDcA8yQlrFmqs1tLi1TxbKlnaJwoNhel9zRQ0yG1YEVGrzTvv4YApSuIiDK18t+Ip927bwucuVQ==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@swc/core-linux-x64-musl@1.4.16':
+    resolution: {integrity: sha512-aFhxPifevDTwEDKPi4eRYWzC0p/WYJeiFkkpNU5Uc7a7M5iMWPAbPFUbHesdlb9Jfqs5c07oyz86u+/HySBNPQ==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@swc/core-win32-arm64-msvc@1.4.16':
+    resolution: {integrity: sha512-bTD43MbhIHL2s5QgCwyleaGwl96Gk/scF2TaVKdUe4QlJCDV/YK9h5oIBAp63ckHtE8GHlH4c8dZNBiAXn4Org==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@swc/core-win32-ia32-msvc@1.4.16':
+    resolution: {integrity: sha512-/lmZeAN/qV5XbK2SEvi8e2RkIg8FQNYiSA8y2/Zb4gTUMKVO5JMLH0BSWMiIKMstKDPDSxMWgwJaQHF8UMyPmQ==}
+    engines: {node: '>=10'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@swc/core-win32-x64-msvc@1.4.16':
+    resolution: {integrity: sha512-BPAfFfODWXtUu6SwaTTftDHvcbDyWBSI/oanUeRbQR5vVWkXoQ3cxLTsDluc3H74IqXS5z1Uyoe0vNo2hB1opA==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@swc/core@1.4.16':
+    resolution: {integrity: sha512-Xaf+UBvW6JNuV131uvSNyMXHn+bh6LyKN4tbv7tOUFQpXyz/t9YWRE04emtlUW9Y0qrm/GKFCbY8n3z6BpZbTA==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@swc/helpers': ^0.5.0
+    peerDependenciesMeta:
+      '@swc/helpers':
+        optional: true
+
+  '@swc/counter@0.1.3':
+    resolution: {integrity: sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==}
+
+  '@swc/jest@0.2.36':
+    resolution: {integrity: sha512-8X80dp81ugxs4a11z1ka43FPhP+/e+mJNXJSxiNYk8gIX/jPBtY4gQTrKu/KIoco8bzKuPI5lUxjfLiGsfvnlw==}
+    engines: {npm: '>= 7.0.0'}
+    peerDependencies:
+      '@swc/core': '*'
+
+  '@swc/types@0.1.6':
+    resolution: {integrity: sha512-/JLo/l2JsT/LRd80C3HfbmVpxOAJ11FO2RCEslFrgzLltoP9j8XIbsyDcfCt2WWyX+CM96rBoNM+IToAkFOugg==}
+
+  '@tsconfig/node10@1.0.8':
+    resolution: {integrity: sha512-6XFfSQmMgq0CFLY1MslA/CPUfhIL919M1rMsa5lP2P097N2Wd1sSX0tx1u4olM16fLNhtHZpRhedZJphNJqmZg==}
+
+  '@tsconfig/node12@1.0.9':
+    resolution: {integrity: sha512-/yBMcem+fbvhSREH+s14YJi18sp7J9jpuhYByADT2rypfajMZZN4WQ6zBGgBKp53NKmqI36wFYDb3yaMPurITw==}
+
+  '@tsconfig/node14@1.0.1':
+    resolution: {integrity: sha512-509r2+yARFfHHE7T6Puu2jjkoycftovhXRqW328PDXTVGKihlb1P8Z9mMZH04ebyajfRY7dedfGynlrFHJUQCg==}
+
+  '@tsconfig/node16@1.0.2':
+    resolution: {integrity: sha512-eZxlbI8GZscaGS7kkc/trHTT5xgrjH3/1n2JDwusC9iahPKWMRvRjJSAN5mCXviuTGQ/lHnhvv8Q1YTpnfz9gA==}
+
+  '@types/babel__core@7.20.5':
+    resolution: {integrity: sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==}
+
+  '@types/babel__generator@7.6.8':
+    resolution: {integrity: sha512-ASsj+tpEDsEiFr1arWrlN6V3mdfjRMZt6LtK/Vp/kreFLnr5QH5+DhvD5nINYZXzwJvXeGq+05iUXcAzVrqWtw==}
+
+  '@types/babel__template@7.4.4':
+    resolution: {integrity: sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==}
+
+  '@types/babel__traverse@7.20.4':
+    resolution: {integrity: sha512-mSM/iKUk5fDDrEV/e83qY+Cr3I1+Q3qqTuEn++HAWYjEa1+NxZr6CNrcJGf2ZTnq4HoFGC3zaTPZTobCzCFukA==}
+
+  '@types/estree@1.0.8':
+    resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
+
+  '@types/graceful-fs@4.1.9':
+    resolution: {integrity: sha512-olP3sd1qOEe5dXTSaFvQG+02VdRXcdytWLAZsAq1PecU8uqQAhkrnbli7DagjtXKW/Bl7YJbUsa8MPcuc8LHEQ==}
+
+  '@types/istanbul-lib-coverage@2.0.6':
+    resolution: {integrity: sha512-2QF/t/auWm0lsy8XtKVPG19v3sSOQlJe/YHZgfjb/KBBHOGSV+J2q/S671rcq9uTBrLAXmZpqJiaQbMT+zNU1w==}
+
+  '@types/istanbul-lib-report@3.0.3':
+    resolution: {integrity: sha512-NQn7AHQnk/RSLOxrBbGyJM/aVQ+pjj5HCgasFxc0K/KhoATfQ/47AyUl15I2yBUpihjmas+a+VJBOqecrFH+uA==}
+
+  '@types/istanbul-reports@3.0.4':
+    resolution: {integrity: sha512-pk2B1NWalF9toCRu6gjBzR69syFjP4Od8WRAX+0mmf9lAjCRicLOWc+ZrxZHx/0XRjotgkF9t6iaMJ+aXcOdZQ==}
+
+  '@types/jest@29.5.11':
+    resolution: {integrity: sha512-S2mHmYIVe13vrm6q4kN6fLYYAka15ALQki/vgDC3mIukEOx8WJlv0kQPM+d4w8Gp6u0uSdKND04IlTXBv0rwnQ==}
+
+  '@types/json-schema@7.0.15':
+    resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
+
+  '@types/node@20.19.11':
+    resolution: {integrity: sha512-uug3FEEGv0r+jrecvUUpbY8lLisvIjg6AAic6a2bSP5OEOLeJsDSnvhCDov7ipFFMXS3orMpzlmi0ZcuGkBbow==}
+
+  '@types/stack-utils@2.0.3':
+    resolution: {integrity: sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==}
+
+  '@types/ws@8.18.1':
+    resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}
+
+  '@types/yargs-parser@21.0.3':
+    resolution: {integrity: sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ==}
+
+  '@types/yargs@17.0.32':
+    resolution: {integrity: sha512-xQ67Yc/laOG5uMfX/093MRlGGCIBzZMarVa+gfNKJxWAIgykYpVGkBdbqEzGDDfCrVUj6Hiff4mTZ5BA6TmAog==}
+
+  '@typescript-eslint/eslint-plugin@8.31.1':
+    resolution: {integrity: sha512-oUlH4h1ABavI4F0Xnl8/fOtML/eu8nI2A1nYd+f+55XI0BLu+RIqKoCiZKNo6DtqZBEQm5aNKA20G3Z5w3R6GQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      '@typescript-eslint/parser': ^8.0.0 || ^8.0.0-alpha.0
+      eslint: ^8.57.0 || ^9.0.0
+      typescript: '>=4.8.4 <5.9.0'
+
+  '@typescript-eslint/parser@8.31.1':
+    resolution: {integrity: sha512-oU/OtYVydhXnumd0BobL9rkJg7wFJ9bFFPmSmB/bf/XWN85hlViji59ko6bSKBXyseT9V8l+CN1nwmlbiN0G7Q==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0
+      typescript: '>=4.8.4 <5.9.0'
+
+  '@typescript-eslint/scope-manager@8.31.1':
+    resolution: {integrity: sha512-BMNLOElPxrtNQMIsFHE+3P0Yf1z0dJqV9zLdDxN/xLlWMlXK/ApEsVEKzpizg9oal8bAT5Sc7+ocal7AC1HCVw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/type-utils@8.31.1':
+    resolution: {integrity: sha512-fNaT/m9n0+dpSp8G/iOQ05GoHYXbxw81x+yvr7TArTuZuCA6VVKbqWYVZrV5dVagpDTtj/O8k5HBEE/p/HM5LA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0
+      typescript: '>=4.8.4 <5.9.0'
+
+  '@typescript-eslint/types@8.31.1':
+    resolution: {integrity: sha512-SfepaEFUDQYRoA70DD9GtytljBePSj17qPxFHA/h3eg6lPTqGJ5mWOtbXCk1YrVU1cTJRd14nhaXWFu0l2troQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/typescript-estree@8.31.1':
+    resolution: {integrity: sha512-kaA0ueLe2v7KunYOyWYtlf/QhhZb7+qh4Yw6Ni5kgukMIG+iP773tjgBiLWIXYumWCwEq3nLW+TUywEp8uEeag==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <5.9.0'
+
+  '@typescript-eslint/utils@8.31.1':
+    resolution: {integrity: sha512-2DSI4SNfF5T4oRveQ4nUrSjUqjMND0nLq9rEkz0gfGr3tg0S5KB6DhwR+WZPCjzkZl3cH+4x2ce3EsL50FubjQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0
+      typescript: '>=4.8.4 <5.9.0'
+
+  '@typescript-eslint/visitor-keys@8.31.1':
+    resolution: {integrity: sha512-I+/rgqOVBn6f0o7NDTmAPWWC6NuqhV174lfYvAm9fUaWeiefLdux9/YI3/nLugEn9L8fcSi0XmpKi/r5u0nmpw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  acorn-jsx@5.3.2:
+    resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
+    peerDependencies:
+      acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
+
+  acorn-walk@8.2.0:
+    resolution: {integrity: sha512-k+iyHEuPgSw6SbuDpGQM+06HQUa04DZ3o+F6CSzXMvvI5KMvnaEqXe+YVe555R9nn6GPt404fos4wcgpw12SDA==}
+    engines: {node: '>=0.4.0'}
+
+  acorn@8.14.0:
+    resolution: {integrity: sha512-cl669nCJTZBsL97OF4kUQm5g5hC2uihk0NxY3WENAC0TYdILVkAyHymAntgxGkl7K+t0cXIrH5siy5S4XkFycA==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+
+  acorn@8.15.0:
+    resolution: {integrity: sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+
+  aggregate-error@3.1.0:
+    resolution: {integrity: sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==}
+    engines: {node: '>=8'}
+
+  ajv@6.12.6:
+    resolution: {integrity: sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==}
+
+  ansi-escapes@4.3.2:
+    resolution: {integrity: sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==}
+    engines: {node: '>=8'}
+
+  ansi-escapes@7.0.0:
+    resolution: {integrity: sha512-GdYO7a61mR0fOlAsvC9/rIHf7L96sBc6dEWzeOu+KAea5bZyQRPIpojrVoI4AXGJS/ycu/fBTdLrUkA4ODrvjw==}
+    engines: {node: '>=18'}
+
+  ansi-regex@5.0.1:
+    resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
+    engines: {node: '>=8'}
+
+  ansi-regex@6.1.0:
+    resolution: {integrity: sha512-7HSX4QQb4CspciLpVFwyRe79O3xsIZDDLER21kERQ71oaPodF8jL725AgJMFAYbooIqolJoRLuM81SpeUkpkvA==}
+    engines: {node: '>=12'}
+
+  ansi-styles@3.2.1:
+    resolution: {integrity: sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==}
+    engines: {node: '>=4'}
+
+  ansi-styles@4.3.0:
+    resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
+    engines: {node: '>=8'}
+
+  ansi-styles@5.2.0:
+    resolution: {integrity: sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==}
+    engines: {node: '>=10'}
+
+  any-promise@1.3.0:
+    resolution: {integrity: sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==}
+
+  anymatch@3.1.3:
+    resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
+    engines: {node: '>= 8'}
+
+  arg@4.1.3:
+    resolution: {integrity: sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==}
+
+  argparse@1.0.10:
+    resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==}
+
+  argparse@2.0.1:
+    resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
+
+  babel-jest@29.7.0:
+    resolution: {integrity: sha512-BrvGY3xZSwEcCzKvKsCi2GgHqDqsYkOP4/by5xCgIwGXQxIEh+8ew3gmrE1y7XRR6LHZIj6yLYnUi/mm2KXKBg==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    peerDependencies:
+      '@babel/core': ^7.8.0
+
+  babel-plugin-istanbul@6.1.1:
+    resolution: {integrity: sha512-Y1IQok9821cC9onCx5otgFfRm7Lm+I+wwxOx738M/WLPZ9Q42m4IG5W0FNX8WLL2gYMZo3JkuXIH2DOpWM+qwA==}
+    engines: {node: '>=8'}
+
+  babel-plugin-jest-hoist@29.6.3:
+    resolution: {integrity: sha512-ESAc/RJvGTFEzRwOTT4+lNDk/GNHMkKbNzsvT0qKRfDyyYTskxB5rnU2njIDYVxXCBHHEI1c0YwHob3WaYujOg==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  babel-preset-current-node-syntax@1.0.1:
+    resolution: {integrity: sha512-M7LQ0bxarkxQoN+vz5aJPsLBn77n8QgTFmo8WK0/44auK2xlCXrYcUxHFxgU7qW5Yzw/CjmLRK2uJzaCd7LvqQ==}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  babel-preset-jest@29.6.3:
+    resolution: {integrity: sha512-0B3bhxR6snWXJZtR/RliHTDPRgn1sNHOR0yVtq/IiQFyuOVjFS+wuio/R4gSNkyYmKmJB4wGZv2NZanmKmTnNA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  balanced-match@1.0.2:
+    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
+
+  brace-expansion@1.1.12:
+    resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==}
+
+  brace-expansion@2.0.1:
+    resolution: {integrity: sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==}
+
+  brace-expansion@2.0.2:
+    resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==}
+
+  braces@3.0.3:
+    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
+    engines: {node: '>=8'}
+
+  browserslist@4.22.2:
+    resolution: {integrity: sha512-0UgcrvQmBDvZHFGdYUehrCNIazki7/lUP3kkoi/r3YB2amZbFM9J43ZRkJTXBUZK4gmx56+Sqk9+Vs9mwZx9+A==}
+    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
+    hasBin: true
+
+  bs-logger@0.2.6:
+    resolution: {integrity: sha512-pd8DCoxmbgc7hyPKOvxtqNcjYoOsABPQdcCUjGp3d42VR2CX1ORhk2A87oqqu5R1kk+76nsxZupkmyd+MVtCog==}
+    engines: {node: '>= 6'}
+
+  bser@2.1.1:
+    resolution: {integrity: sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==}
+
+  buffer-from@1.1.2:
+    resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}
+
+  callsites@3.1.0:
+    resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
+    engines: {node: '>=6'}
+
+  camelcase@5.3.1:
+    resolution: {integrity: sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==}
+    engines: {node: '>=6'}
+
+  camelcase@6.3.0:
+    resolution: {integrity: sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==}
+    engines: {node: '>=10'}
+
+  caniuse-lite@1.0.30001570:
+    resolution: {integrity: sha512-+3e0ASu4sw1SWaoCtvPeyXp+5PsjigkSt8OXZbF9StH5pQWbxEjLAZE3n8Aup5udop1uRiKA7a4utUk/uoSpUw==}
+
+  chalk@2.4.2:
+    resolution: {integrity: sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==}
+    engines: {node: '>=4'}
+
+  chalk@4.1.2:
+    resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
+    engines: {node: '>=10'}
+
+  chalk@5.3.0:
+    resolution: {integrity: sha512-dLitG79d+GV1Nb/VYcCDFivJeK1hiukt9QjRNVOsUtTy1rR1YJsmpGGTZ3qJos+uw7WmWF4wUwBd9jxjocFC2w==}
+    engines: {node: ^12.17.0 || ^14.13 || >=16.0.0}
+
+  char-regex@1.0.2:
+    resolution: {integrity: sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==}
+    engines: {node: '>=10'}
+
+  ci-info@3.9.0:
+    resolution: {integrity: sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==}
+    engines: {node: '>=8'}
+
+  cjs-module-lexer@1.4.1:
+    resolution: {integrity: sha512-cuSVIHi9/9E/+821Qjdvngor+xpnlwnuwIyZOaLmHBVdXL+gP+I6QQB9VkO7RI77YIcTV+S1W9AreJ5eN63JBA==}
+
+  clean-stack@2.2.0:
+    resolution: {integrity: sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==}
+    engines: {node: '>=6'}
+
+  cli-highlight@2.1.11:
+    resolution: {integrity: sha512-9KDcoEVwyUXrjcJNvHD0NFc/hiwe/WPVYIleQh2O1N2Zro5gWJZ/K+3DGn8w8P/F6FxOgzyC5bxDyHIgCSPhGg==}
+    engines: {node: '>=8.0.0', npm: '>=5.0.0'}
+    hasBin: true
+
+  cli-table3@0.6.5:
+    resolution: {integrity: sha512-+W/5efTR7y5HRD7gACw9yQjqMVvEMLBHmboM/kPWam+H+Hmyrgjh6YncVKK122YZkXrLudzTuAukUw9FnMf7IQ==}
+    engines: {node: 10.* || >= 12.*}
+
+  cliui@7.0.4:
+    resolution: {integrity: sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ==}
+
+  cliui@8.0.1:
+    resolution: {integrity: sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==}
+    engines: {node: '>=12'}
+
+  co@4.6.0:
+    resolution: {integrity: sha512-QVb0dM5HvG+uaxitm8wONl7jltx8dqhfU33DcqtOZcLSVIKSDDLDi7+0LbAKiyI8hD9u42m2YxXSkMGWThaecQ==}
+    engines: {iojs: '>= 1.0.0', node: '>= 0.12.0'}
+
+  collect-v8-coverage@1.0.2:
+    resolution: {integrity: sha512-lHl4d5/ONEbLlJvaJNtsF/Lz+WvB07u2ycqTYbdrq7UypDXailES4valYb2eWiJFxZlVmpGekfqoxQhzyFdT4Q==}
+
+  color-convert@1.9.3:
+    resolution: {integrity: sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==}
+
+  color-convert@2.0.1:
+    resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
+    engines: {node: '>=7.0.0'}
+
+  color-name@1.1.3:
+    resolution: {integrity: sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==}
+
+  color-name@1.1.4:
+    resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
+
+  commander@10.0.1:
+    resolution: {integrity: sha512-y4Mg2tXshplEbSGzx7amzPwKKOCGuoSRP/CjEdwwk0FOGlUbq6lKuoyDZTNZkmxHdJtp54hdfY/JUrdL7Xfdug==}
+    engines: {node: '>=14'}
+
+  concat-map@0.0.1:
+    resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
+
+  convert-source-map@2.0.0:
+    resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
+
+  create-jest@29.7.0:
+    resolution: {integrity: sha512-Adz2bdH0Vq3F53KEMJOoftQFutWCukm6J24wbPWRO4k1kMY7gS7ds/uoJkNuV8wDCtWWnuwGcJwpWcih+zEW1Q==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    hasBin: true
+
+  create-require@1.1.1:
+    resolution: {integrity: sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==}
+
+  cross-spawn@7.0.6:
+    resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
+    engines: {node: '>= 8'}
+
+  debug@4.4.1:
+    resolution: {integrity: sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==}
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  debug@4.4.3:
+    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  dedent@1.5.1:
+    resolution: {integrity: sha512-+LxW+KLWxu3HW3M2w2ympwtqPrqYRzU8fqi6Fhd18fBALe15blJPI/I4+UHveMVG6lJqB4JNd4UG0S5cnVHwIg==}
+    peerDependencies:
+      babel-plugin-macros: ^3.1.0
+    peerDependenciesMeta:
+      babel-plugin-macros:
+        optional: true
+
+  deep-is@0.1.4:
+    resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
+
+  deepmerge@4.3.1:
+    resolution: {integrity: sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==}
+    engines: {node: '>=0.10.0'}
+
+  detect-newline@3.1.0:
+    resolution: {integrity: sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==}
+    engines: {node: '>=8'}
+
+  diff-sequences@29.6.3:
+    resolution: {integrity: sha512-EjePK1srD3P08o2j4f0ExnylqRs5B9tJjcp9t1krH2qRi8CCdsYfwe9JgSLurFBWwq4uOlipzfk5fHNvwFKr8Q==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  diff@4.0.2:
+    resolution: {integrity: sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==}
+    engines: {node: '>=0.3.1'}
+
+  electron-to-chromium@1.4.614:
+    resolution: {integrity: sha512-X4ze/9Sc3QWs6h92yerwqv7aB/uU8vCjZcrMjA8N9R1pjMFRe44dLsck5FzLilOYvcXuDn93B+bpGYyufc70gQ==}
+
+  emittery@0.13.1:
+    resolution: {integrity: sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==}
+    engines: {node: '>=12'}
+
+  emoji-regex@8.0.0:
+    resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==}
+
+  emojilib@2.4.0:
+    resolution: {integrity: sha512-5U0rVMU5Y2n2+ykNLQqMoqklN9ICBT/KsvC1Gz6vqHbz2AXXGkG+Pm5rMWk/8Vjrr/mY9985Hi8DYzn1F09Nyw==}
+
+  environment@1.1.0:
+    resolution: {integrity: sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q==}
+    engines: {node: '>=18'}
+
+  error-ex@1.3.2:
+    resolution: {integrity: sha512-7dFHNmqeFSEt2ZBsCriorKnn3Z2pj+fd9kmI6QoWw4//DL+icEBfc0U7qJCisqrTsKTjw4fNFy2pW9OqStD84g==}
+
+  escalade@3.1.1:
+    resolution: {integrity: sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==}
+    engines: {node: '>=6'}
+
+  escape-string-regexp@1.0.5:
+    resolution: {integrity: sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==}
+    engines: {node: '>=0.8.0'}
+
+  escape-string-regexp@2.0.0:
+    resolution: {integrity: sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==}
+    engines: {node: '>=8'}
+
+  escape-string-regexp@4.0.0:
+    resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
+    engines: {node: '>=10'}
+
+  eslint-plugin-prettier@5.4.1:
+    resolution: {integrity: sha512-9dF+KuU/Ilkq27A8idRP7N2DH8iUR6qXcjF3FR2wETY21PZdBrIjwCau8oboyGj9b7etWmTGEeM8e7oOed6ZWg==}
+    engines: {node: ^14.18.0 || >=16.0.0}
+    peerDependencies:
+      '@types/eslint': '>=8.0.0'
+      eslint: '>=8.0.0'
+      eslint-config-prettier: '>= 7.0.0 <10.0.0 || >=10.1.0'
+      prettier: '>=3.0.0'
+    peerDependenciesMeta:
+      '@types/eslint':
+        optional: true
+      eslint-config-prettier:
+        optional: true
+
+  eslint-plugin-unused-imports@4.1.4:
+    resolution: {integrity: sha512-YptD6IzQjDardkl0POxnnRBhU1OEePMV0nd6siHaRBbd+lyh6NAhFEobiznKU7kTsSsDeSD62Pe7kAM1b7dAZQ==}
+    peerDependencies:
+      '@typescript-eslint/eslint-plugin': ^8.0.0-0 || ^7.0.0 || ^6.0.0 || ^5.0.0
+      eslint: ^9.0.0 || ^8.0.0
+    peerDependenciesMeta:
+      '@typescript-eslint/eslint-plugin':
+        optional: true
+
+  eslint-scope@8.4.0:
+    resolution: {integrity: sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint-visitor-keys@3.4.3:
+    resolution: {integrity: sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
+  eslint-visitor-keys@4.2.0:
+    resolution: {integrity: sha512-UyLnSehNt62FFhSwjZlHmeokpRK59rcz29j+F1/aDgbkbRTk7wIc9XzdoasMUbRNKDM0qQt/+BJ4BrpFeABemw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint-visitor-keys@4.2.1:
+    resolution: {integrity: sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint@9.39.1:
+    resolution: {integrity: sha512-BhHmn2yNOFA9H9JmmIVKJmd288g9hrVRDkdoIgRCRuSySRUHH7r/DI6aAXW9T1WwUuY3DFgrcaqB+deURBLR5g==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    hasBin: true
+    peerDependencies:
+      jiti: '*'
+    peerDependenciesMeta:
+      jiti:
+        optional: true
+
+  espree@10.4.0:
+    resolution: {integrity: sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  esprima@4.0.1:
+    resolution: {integrity: sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  esquery@1.6.0:
+    resolution: {integrity: sha512-ca9pw9fomFcKPvFLXhBKUK90ZvGibiGOvRJNbjljY7s7uq/5YO4BOzcYtJqExdx99rF6aAcnRxHmcUHcz6sQsg==}
+    engines: {node: '>=0.10'}
+
+  esrecurse@4.3.0:
+    resolution: {integrity: sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==}
+    engines: {node: '>=4.0'}
+
+  estraverse@5.3.0:
+    resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
+    engines: {node: '>=4.0'}
+
+  esutils@2.0.3:
+    resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
+    engines: {node: '>=0.10.0'}
+
+  execa@5.1.1:
+    resolution: {integrity: sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==}
+    engines: {node: '>=10'}
+
+  exit@0.1.2:
+    resolution: {integrity: sha512-Zk/eNKV2zbjpKzrsQ+n1G6poVbErQxJ0LBOJXaKZ1EViLzH+hrLu9cdXI4zw9dBQJslwBEpbQ2P1oS7nDxs6jQ==}
+    engines: {node: '>= 0.8.0'}
+
+  expect@29.7.0:
+    resolution: {integrity: sha512-2Zks0hf1VLFYI1kbh0I5jP3KHHyCHpkfyHBzsSXRFgl/Bg9mWYfMW8oD+PdMPlEwy5HNsR9JutYy6pMeOh61nw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  fast-deep-equal@3.1.3:
+    resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
+
+  fast-diff@1.3.0:
+    resolution: {integrity: sha512-VxPP4NqbUjj6MaAOafWeUn2cXWLcCtljklUtZf0Ind4XQ+QPtmA0b18zZy0jIQx+ExRVCR/ZQpBmik5lXshNsw==}
+
+  fast-glob@3.3.2:
+    resolution: {integrity: sha512-oX2ruAFQwf/Orj8m737Y5adxDQO0LAB7/S5MnxCdTNDd4p6BsyIVsv9JQsATbTSq8KHRpLwIHbVlUNatxd+1Ow==}
+    engines: {node: '>=8.6.0'}
+
+  fast-json-stable-stringify@2.1.0:
+    resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==}
+
+  fast-levenshtein@2.0.6:
+    resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
+
+  fastq@1.17.1:
+    resolution: {integrity: sha512-sRVD3lWVIXWg6By68ZN7vho9a1pQcN/WBFaAAsDDFzlJjvoGx0P8z7V1t72grFJfJhu3YPZBuu25f7Kaw2jN1w==}
+
+  fb-watchman@2.0.2:
+    resolution: {integrity: sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==}
+
+  fflate@0.8.2:
+    resolution: {integrity: sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A==}
+
+  file-entry-cache@8.0.0:
+    resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
+    engines: {node: '>=16.0.0'}
+
+  fill-range@7.1.1:
+    resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
+    engines: {node: '>=8'}
+
+  find-up@4.1.0:
+    resolution: {integrity: sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==}
+    engines: {node: '>=8'}
+
+  find-up@5.0.0:
+    resolution: {integrity: sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==}
+    engines: {node: '>=10'}
+
+  flat-cache@4.0.1:
+    resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
+    engines: {node: '>=16'}
+
+  flatted@3.3.3:
+    resolution: {integrity: sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==}
+
+  fs.realpath@1.0.0:
+    resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  function-bind@1.1.2:
+    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
+  gensync@1.0.0-beta.2:
+    resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
+    engines: {node: '>=6.9.0'}
+
+  get-caller-file@2.0.5:
+    resolution: {integrity: sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==}
+    engines: {node: 6.* || 8.* || >= 10.*}
+
+  get-package-type@0.1.0:
+    resolution: {integrity: sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==}
+    engines: {node: '>=8.0.0'}
+
+  get-stdin@8.0.0:
+    resolution: {integrity: sha512-sY22aA6xchAzprjyqmSEQv4UbAAzRN0L2dQB0NlN5acTTK9Don6nhoc3eAbUnpZiCANAMfd/+40kVdKfFygohg==}
+    engines: {node: '>=10'}
+
+  get-stream@6.0.1:
+    resolution: {integrity: sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==}
+    engines: {node: '>=10'}
+
+  glob-parent@5.1.2:
+    resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
+    engines: {node: '>= 6'}
+
+  glob-parent@6.0.2:
+    resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
+    engines: {node: '>=10.13.0'}
+
+  glob@7.2.3:
+    resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
+    deprecated: Glob versions prior to v9 are no longer supported
+
+  glob@8.1.0:
+    resolution: {integrity: sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==}
+    engines: {node: '>=12'}
+    deprecated: Glob versions prior to v9 are no longer supported
+
+  globals@11.12.0:
+    resolution: {integrity: sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==}
+    engines: {node: '>=4'}
+
+  globals@14.0.0:
+    resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==}
+    engines: {node: '>=18'}
+
+  graceful-fs@4.2.11:
+    resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
+
+  graphemer@1.4.0:
+    resolution: {integrity: sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==}
+
+  has-flag@3.0.0:
+    resolution: {integrity: sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==}
+    engines: {node: '>=4'}
+
+  has-flag@4.0.0:
+    resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
+    engines: {node: '>=8'}
+
+  hasown@2.0.0:
+    resolution: {integrity: sha512-vUptKVTpIJhcczKBbgnS+RtcuYMB8+oNzPK2/Hp3hanz8JmpATdmmgLgSaadVREkDm+e2giHwY3ZRkyjSIDDFA==}
+    engines: {node: '>= 0.4'}
+
+  highlight.js@10.7.3:
+    resolution: {integrity: sha512-tzcUFauisWKNHaRkN4Wjl/ZA07gENAjFl3J/c480dprkGTg5EQstgaNFqBfUqCq54kZRIEcreTsAgF/m2quD7A==}
+
+  html-escaper@2.0.2:
+    resolution: {integrity: sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==}
+
+  human-signals@2.1.0:
+    resolution: {integrity: sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==}
+    engines: {node: '>=10.17.0'}
+
+  iconv-lite@0.6.3:
+    resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==}
+    engines: {node: '>=0.10.0'}
+
+  ignore-walk@5.0.1:
+    resolution: {integrity: sha512-yemi4pMf51WKT7khInJqAvsIGzoqYXblnsz0ql8tM+yi1EKYTY1evX4NAbJrLL/Aanr2HyZeluqU+Oi7MGHokw==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+
+  ignore@5.3.2:
+    resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
+    engines: {node: '>= 4'}
+
+  import-fresh@3.3.1:
+    resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
+    engines: {node: '>=6'}
+
+  import-local@3.1.0:
+    resolution: {integrity: sha512-ASB07uLtnDs1o6EHjKpX34BKYDSqnFerfTOJL2HvMqF70LnxpjkzDB8J44oT9pu4AMPkQwf8jl6szgvNd2tRIg==}
+    engines: {node: '>=8'}
+    hasBin: true
+
+  imurmurhash@0.1.4:
+    resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
+    engines: {node: '>=0.8.19'}
+
+  indent-string@4.0.0:
+    resolution: {integrity: sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==}
+    engines: {node: '>=8'}
+
+  inflight@1.0.6:
+    resolution: {integrity: sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==}
+    deprecated: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
+
+  inherits@2.0.4:
+    resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
+
+  is-arrayish@0.2.1:
+    resolution: {integrity: sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==}
+
+  is-core-module@2.13.1:
+    resolution: {integrity: sha512-hHrIjvZsftOsvKSn2TRYl63zvxsgE0K+0mYMoH6gD4omR5IWB2KynivBQczo3+wF1cCkjzvptnI9Q0sPU66ilw==}
+
+  is-extglob@2.1.1:
+    resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
+    engines: {node: '>=0.10.0'}
+
+  is-fullwidth-code-point@3.0.0:
+    resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
+    engines: {node: '>=8'}
+
+  is-generator-fn@2.1.0:
+    resolution: {integrity: sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==}
+    engines: {node: '>=6'}
+
+  is-glob@4.0.3:
+    resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
+    engines: {node: '>=0.10.0'}
+
+  is-number@7.0.0:
+    resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
+    engines: {node: '>=0.12.0'}
+
+  is-stream@2.0.1:
+    resolution: {integrity: sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==}
+    engines: {node: '>=8'}
+
+  isexe@2.0.0:
+    resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
+
+  istanbul-lib-coverage@3.2.2:
+    resolution: {integrity: sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==}
+    engines: {node: '>=8'}
+
+  istanbul-lib-instrument@5.2.1:
+    resolution: {integrity: sha512-pzqtp31nLv/XFOzXGuvhCb8qhjmTVo5vjVk19XE4CRlSWz0KoeJ3bw9XsA7nOp9YBf4qHjwBxkDzKcME/J29Yg==}
+    engines: {node: '>=8'}
+
+  istanbul-lib-instrument@6.0.1:
+    resolution: {integrity: sha512-EAMEJBsYuyyztxMxW3g7ugGPkrZsV57v0Hmv3mm1uQsmB+QnZuepg731CRaIgeUVSdmsTngOkSnauNF8p7FIhA==}
+    engines: {node: '>=10'}
+
+  istanbul-lib-report@3.0.1:
+    resolution: {integrity: sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==}
+    engines: {node: '>=10'}
+
+  istanbul-lib-source-maps@4.0.1:
+    resolution: {integrity: sha512-n3s8EwkdFIJCG3BPKBYvskgXGoy88ARzvegkitk60NxRdwltLOTaH7CUiMRXvwYorl0Q712iEjcWB+fK/MrWVw==}
+    engines: {node: '>=10'}
+
+  istanbul-reports@3.1.6:
+    resolution: {integrity: sha512-TLgnMkKg3iTDsQ9PbPTdpfAK2DzjF9mqUG7RMgcQl8oFjad8ob4laGxv5XV5U9MAfx8D6tSJiUyuAwzLicaxlg==}
+    engines: {node: '>=8'}
+
+  jest-changed-files@29.7.0:
+    resolution: {integrity: sha512-fEArFiwf1BpQ+4bXSprcDc3/x4HSzL4al2tozwVpDFpsxALjLYdyiIK4e5Vz66GQJIbXJ82+35PtysofptNX2w==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-circus@29.7.0:
+    resolution: {integrity: sha512-3E1nCMgipcTkCocFwM90XXQab9bS+GMsjdpmPrlelaxwD93Ad8iVEjX/vvHPdLPnFf+L40u+5+iutRdA1N9myw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-cli@29.7.0:
+    resolution: {integrity: sha512-OVVobw2IubN/GSYsxETi+gOe7Ka59EFMR/twOU3Jb2GnKKeMGJB5SGUUrEz3SFVmJASUdZUzy83sLNNQ2gZslg==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    hasBin: true
+    peerDependencies:
+      node-notifier: ^8.0.1 || ^9.0.0 || ^10.0.0
+    peerDependenciesMeta:
+      node-notifier:
+        optional: true
+
+  jest-config@29.7.0:
+    resolution: {integrity: sha512-uXbpfeQ7R6TZBqI3/TxCU4q4ttk3u0PJeC+E0zbfSoSjq6bJ7buBPxzQPL0ifrkY4DNu4JUdk0ImlBUYi840eQ==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    peerDependencies:
+      '@types/node': '*'
+      ts-node: '>=9.0.0'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      ts-node:
+        optional: true
+
+  jest-diff@29.7.0:
+    resolution: {integrity: sha512-LMIgiIrhigmPrs03JHpxUh2yISK3vLFPkAodPeo0+BuF7wA2FoQbkEg1u8gBYBThncu7e1oEDUfIXVuTqLRUjw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-docblock@29.7.0:
+    resolution: {integrity: sha512-q617Auw3A612guyaFgsbFeYpNP5t2aoUNLwBUbc/0kD1R4t9ixDbyFTHd1nok4epoVFpr7PmeWHrhvuV3XaJ4g==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-each@29.7.0:
+    resolution: {integrity: sha512-gns+Er14+ZrEoC5fhOfYCY1LOHHr0TI+rQUHZS8Ttw2l7gl+80eHc/gFf2Ktkw0+SIACDTeWvpFcv3B04VembQ==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-environment-node@29.7.0:
+    resolution: {integrity: sha512-DOSwCRqXirTOyheM+4d5YZOrWcdu0LNZ87ewUoywbcb2XR4wKgqiG8vNeYwhjFMbEkfju7wx2GYH0P2gevGvFw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-get-type@29.6.3:
+    resolution: {integrity: sha512-zrteXnqYxfQh7l5FHyL38jL39di8H8rHoecLH3JNxH3BwOrBsNeabdap5e0I23lD4HHI8W5VFBZqG4Eaq5LNcw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-haste-map@29.7.0:
+    resolution: {integrity: sha512-fP8u2pyfqx0K1rGn1R9pyE0/KTn+G7PxktWidOBTqFPLYX0b9ksaMFkhK5vrS3DVun09pckLdlx90QthlW7AmA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-leak-detector@29.7.0:
+    resolution: {integrity: sha512-kYA8IJcSYtST2BY9I+SMC32nDpBT3J2NvWJx8+JCuCdl/CR1I4EKUJROiP8XtCcxqgTTBGJNdbB1A8XRKbTetw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-matcher-utils@29.7.0:
+    resolution: {integrity: sha512-sBkD+Xi9DtcChsI3L3u0+N0opgPYnCRPtGcQYrgXmR+hmt/fYfWAL0xRXYU8eWOdfuLgBe0YCW3AFtnRLagq/g==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-message-util@29.7.0:
+    resolution: {integrity: sha512-GBEV4GRADeP+qtB2+6u61stea8mGcOT4mCtrYISZwfu9/ISHFJ/5zOMXYbpBE9RsS5+Gb63DW4FgmnKJ79Kf6w==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-mock@29.7.0:
+    resolution: {integrity: sha512-ITOMZn+UkYS4ZFh83xYAOzWStloNzJFO2s8DWrE4lhtGD+AorgnbkiKERe4wQVBydIGPx059g6riW5Btp6Llnw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-pnp-resolver@1.2.3:
+    resolution: {integrity: sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==}
+    engines: {node: '>=6'}
+    peerDependencies:
+      jest-resolve: '*'
+    peerDependenciesMeta:
+      jest-resolve:
+        optional: true
+
+  jest-regex-util@29.6.3:
+    resolution: {integrity: sha512-KJJBsRCyyLNWCNBOvZyRDnAIfUiRJ8v+hOBQYGn8gDyF3UegwiP4gwRR3/SDa42g1YbVycTidUF3rKjyLFDWbg==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-resolve-dependencies@29.7.0:
+    resolution: {integrity: sha512-un0zD/6qxJ+S0et7WxeI3H5XSe9lTBBR7bOHCHXkKR6luG5mwDDlIzVQ0V5cZCuoTgEdcdwzTghYkTWfubi+nA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-resolve@29.7.0:
+    resolution: {integrity: sha512-IOVhZSrg+UvVAshDSDtHyFCCBUl/Q3AAJv8iZ6ZjnZ74xzvwuzLXid9IIIPgTnY62SJjfuupMKZsZQRsCvxEgA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-runner@29.7.0:
+    resolution: {integrity: sha512-fsc4N6cPCAahybGBfTRcq5wFR6fpLznMg47sY5aDpsoejOcVYFb07AHuSnR0liMcPTgBsA3ZJL6kFOjPdoNipQ==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-runtime@29.7.0:
+    resolution: {integrity: sha512-gUnLjgwdGqW7B4LvOIkbKs9WGbn+QLqRQQ9juC6HndeDiezIwhDP+mhMwHWCEcfQ5RUXa6OPnFF8BJh5xegwwQ==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-snapshot@29.7.0:
+    resolution: {integrity: sha512-Rm0BMWtxBcioHr1/OX5YCP8Uov4riHvKPknOGs804Zg9JGZgmIBkbtlxJC/7Z4msKYVbIJtfU+tKb8xlYNfdkw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-util@29.7.0:
+    resolution: {integrity: sha512-z6EbKajIpqGKU56y5KBUgy1dt1ihhQJgWzUlZHArA/+X2ad7Cb5iF+AK1EWVL/Bo7Rz9uurpqw6SiBCefUbCGA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-validate@29.7.0:
+    resolution: {integrity: sha512-ZB7wHqaRGVw/9hST/OuFUReG7M8vKeq0/J2egIGLdvjHCmYqGARhzXmtgi+gVeZ5uXFF219aOc3Ls2yLg27tkw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-watcher@29.7.0:
+    resolution: {integrity: sha512-49Fg7WXkU3Vl2h6LbLtMQ/HyB6rXSIX7SqvBLQmssRBGN9I0PNvPmAmCWSOY6SOvrjhI/F7/bGAv9RtnsPA03g==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-worker@29.7.0:
+    resolution: {integrity: sha512-eIz2msL/EzL9UFTFFx7jBTkeZfku0yUAyZZZmJ93H2TYEiroIx2PQjEXcwYtYl8zXCxb+PAmA2hLIt/6ZEkPHw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest@29.7.0:
+    resolution: {integrity: sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    hasBin: true
+    peerDependencies:
+      node-notifier: ^8.0.1 || ^9.0.0 || ^10.0.0
+    peerDependenciesMeta:
+      node-notifier:
+        optional: true
+
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
+  js-yaml@3.14.2:
+    resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==}
+    hasBin: true
+
+  js-yaml@4.1.1:
+    resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
+    hasBin: true
+
+  jsesc@2.5.2:
+    resolution: {integrity: sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  json-buffer@3.0.1:
+    resolution: {integrity: sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==}
+
+  json-parse-even-better-errors@2.3.1:
+    resolution: {integrity: sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==}
+
+  json-schema-traverse@0.4.1:
+    resolution: {integrity: sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==}
+
+  json-stable-stringify-without-jsonify@1.0.1:
+    resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
+
+  json5@2.2.3:
+    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  jsonc-parser@3.2.1:
+    resolution: {integrity: sha512-AilxAyFOAcK5wA1+LeaySVBrHsGQvUFCDWXKpZjzaL0PqW+xfBOttn8GNtWKFWqneyMZj41MWF9Kl6iPWLwgOA==}
+
+  keyv@4.5.4:
+    resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
+
+  kleur@3.0.3:
+    resolution: {integrity: sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==}
+    engines: {node: '>=6'}
+
+  leven@3.1.0:
+    resolution: {integrity: sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==}
+    engines: {node: '>=6'}
+
+  levn@0.4.1:
+    resolution: {integrity: sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
+    engines: {node: '>= 0.8.0'}
+
+  lines-and-columns@1.2.4:
+    resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
+
+  locate-path@5.0.0:
+    resolution: {integrity: sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==}
+    engines: {node: '>=8'}
+
+  locate-path@6.0.0:
+    resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
+    engines: {node: '>=10'}
+
+  lodash.memoize@4.1.2:
+    resolution: {integrity: sha512-t7j+NzmgnQzTAYXcsHYLgimltOV1MXHtlOWf6GjL9Kj8GK5FInw5JotxvbOs+IvV1/Dzo04/fCGfLVs7aXb4Ag==}
+
+  lodash.merge@4.6.2:
+    resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==}
+
+  lru-cache@10.4.3:
+    resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
+
+  lru-cache@5.1.1:
+    resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
+
+  make-dir@4.0.0:
+    resolution: {integrity: sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==}
+    engines: {node: '>=10'}
+
+  make-error@1.3.6:
+    resolution: {integrity: sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==}
+
+  makeerror@1.0.12:
+    resolution: {integrity: sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==}
+
+  marked-terminal@7.2.1:
+    resolution: {integrity: sha512-rQ1MoMFXZICWNsKMiiHwP/Z+92PLKskTPXj+e7uwXmuMPkNn7iTqC+IvDekVm1MPeC9wYQeLxeFaOvudRR/XbQ==}
+    engines: {node: '>=16.0.0'}
+    peerDependencies:
+      marked: '>=1 <15'
+
+  marked@9.1.6:
+    resolution: {integrity: sha512-jcByLnIFkd5gSXZmjNvS1TlmRhCXZjIzHYlaGkPlLIekG55JDR2Z4va9tZwCiP+/RDERiNhMOFu01xd6O5ct1Q==}
+    engines: {node: '>= 16'}
+    hasBin: true
+
+  merge-stream@2.0.0:
+    resolution: {integrity: sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==}
+
+  merge2@1.4.1:
+    resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
+    engines: {node: '>= 8'}
+
+  micromatch@4.0.8:
+    resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
+    engines: {node: '>=8.6'}
+
+  mimic-fn@2.1.0:
+    resolution: {integrity: sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==}
+    engines: {node: '>=6'}
+
+  minimatch@3.1.2:
+    resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}
+
+  minimatch@5.1.6:
+    resolution: {integrity: sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==}
+    engines: {node: '>=10'}
+
+  minimatch@9.0.5:
+    resolution: {integrity: sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==}
+    engines: {node: '>=16 || 14 >=14.17'}
+
+  minimist@1.2.6:
+    resolution: {integrity: sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q==}
+
+  mri@1.2.0:
+    resolution: {integrity: sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==}
+    engines: {node: '>=4'}
+
+  ms@2.1.3:
+    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
+
+  mz@2.7.0:
+    resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
+
+  natural-compare@1.4.0:
+    resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
+
+  node-emoji@2.1.3:
+    resolution: {integrity: sha512-E2WEOVsgs7O16zsURJ/eH8BqhF029wGpEOnv7Urwdo2wmQanOACwJQh0devF9D9RhoZru0+9JXIS0dBXIAz+lA==}
+    engines: {node: '>=18'}
+
+  node-int64@0.4.0:
+    resolution: {integrity: sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==}
+
+  node-releases@2.0.14:
+    resolution: {integrity: sha512-y10wOWt8yZpqXmOgRo77WaHEmhYQYGNA6y421PKsKYWEK8aW+cqAphborZDhqfyKrbZEN92CN1X2KbafY2s7Yw==}
+
+  normalize-path@3.0.0:
+    resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
+    engines: {node: '>=0.10.0'}
+
+  npm-bundled@2.0.1:
+    resolution: {integrity: sha512-gZLxXdjEzE/+mOstGDqR6b0EkhJ+kM6fxM6vUuckuctuVPh80Q6pw/rSZj9s4Gex9GxWtIicO1pc8DB9KZWudw==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+
+  npm-normalize-package-bin@2.0.0:
+    resolution: {integrity: sha512-awzfKUO7v0FscrSpRoogyNm0sajikhBWpU0QMrW09AMi9n1PoKU6WaIqUzuJSQnpciZZmJ/jMZ2Egfmb/9LiWQ==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+
+  npm-packlist@5.1.3:
+    resolution: {integrity: sha512-263/0NGrn32YFYi4J533qzrQ/krmmrWwhKkzwTuM4f/07ug51odoaNjUexxO4vxlzURHcmYMH1QjvHjsNDKLVg==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+    hasBin: true
+
+  npm-run-path@4.0.1:
+    resolution: {integrity: sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==}
+    engines: {node: '>=8'}
+
+  object-assign@4.1.1:
+    resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
+    engines: {node: '>=0.10.0'}
+
+  once@1.4.0:
+    resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
+
+  onetime@5.1.2:
+    resolution: {integrity: sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==}
+    engines: {node: '>=6'}
+
+  optionator@0.9.4:
+    resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
+    engines: {node: '>= 0.8.0'}
+
+  p-all@3.0.0:
+    resolution: {integrity: sha512-qUZbvbBFVXm6uJ7U/WDiO0fv6waBMbjlCm4E66oZdRR+egswICarIdHyVSZZHudH8T5SF8x/JG0q0duFzPnlBw==}
+    engines: {node: '>=10'}
+
+  p-limit@2.3.0:
+    resolution: {integrity: sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==}
+    engines: {node: '>=6'}
+
+  p-limit@3.1.0:
+    resolution: {integrity: sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==}
+    engines: {node: '>=10'}
+
+  p-locate@4.1.0:
+    resolution: {integrity: sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==}
+    engines: {node: '>=8'}
+
+  p-locate@5.0.0:
+    resolution: {integrity: sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==}
+    engines: {node: '>=10'}
+
+  p-map@4.0.0:
+    resolution: {integrity: sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==}
+    engines: {node: '>=10'}
+
+  p-try@2.2.0:
+    resolution: {integrity: sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==}
+    engines: {node: '>=6'}
+
+  parent-module@1.0.1:
+    resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
+    engines: {node: '>=6'}
+
+  parse-json@5.2.0:
+    resolution: {integrity: sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==}
+    engines: {node: '>=8'}
+
+  parse5-htmlparser2-tree-adapter@6.0.1:
+    resolution: {integrity: sha512-qPuWvbLgvDGilKc5BoicRovlT4MtYT6JfJyBOMDsKoiT+GiuP5qyrPCnR9HcPECIJJmZh5jRndyNThnhhb/vlA==}
+
+  parse5@5.1.1:
+    resolution: {integrity: sha512-ugq4DFI0Ptb+WWjAdOK16+u/nHfiIrcE+sh8kZMaM0WllQKLI9rOUq6c2b7cwPkXdzfQESqvoqK6ug7U/Yyzug==}
+
+  parse5@6.0.1:
+    resolution: {integrity: sha512-Ofn/CTFzRGTTxwpNEs9PP93gXShHcTq255nzRYSKe8AkVpZY7e1fpmTfOyoIvjP5HG7Z2ZM7VS9PPhQGW2pOpw==}
+
+  path-exists@4.0.0:
+    resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
+    engines: {node: '>=8'}
+
+  path-is-absolute@1.0.1:
+    resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==}
+    engines: {node: '>=0.10.0'}
+
+  path-key@3.1.1:
+    resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
+    engines: {node: '>=8'}
+
+  path-parse@1.0.7:
+    resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@2.3.1:
+    resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==}
+    engines: {node: '>=8.6'}
+
+  pirates@4.0.6:
+    resolution: {integrity: sha512-saLsH7WeYYPiD25LDuLRRY/i+6HaPYr6G1OUlN39otzkSTxKnubR9RTxS3/Kk50s1g2JTgFwWQDQyplC5/SHZg==}
+    engines: {node: '>= 6'}
+
+  pkg-dir@4.2.0:
+    resolution: {integrity: sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==}
+    engines: {node: '>=8'}
+
+  prelude-ls@1.2.1:
+    resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
+    engines: {node: '>= 0.8.0'}
+
+  prettier-linter-helpers@1.0.0:
+    resolution: {integrity: sha512-GbK2cP9nraSSUF9N2XwUwqfzlAFlMNYYl+ShE/V+H8a9uNl/oUqB1w2EL54Jh0OlyRSd8RfWYJ3coVS4TROP2w==}
+    engines: {node: '>=6.0.0'}
+
+  prettier@3.1.1:
+    resolution: {integrity: sha512-22UbSzg8luF4UuZtzgiUOfcGM8s4tjBv6dJRT7j275NXsy2jb4aJa4NNveul5x4eqlF1wuhuR2RElK71RvmVaw==}
+    engines: {node: '>=14'}
+    hasBin: true
+
+  pretty-format@29.7.0:
+    resolution: {integrity: sha512-Pdlw/oPxN+aXdmM9R00JVC9WVFoCLTKJvDVLgmJ+qAffBMxsV85l/Lu7sNx4zSzPyoL2euImuEwHhOXdEgNFZQ==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  prompts@2.4.2:
+    resolution: {integrity: sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==}
+    engines: {node: '>= 6'}
+
+  publint@0.2.12:
+    resolution: {integrity: sha512-YNeUtCVeM4j9nDiTT2OPczmlyzOkIXNtdDZnSuajAxS/nZ6j3t7Vs9SUB4euQNddiltIwu7Tdd3s+hr08fAsMw==}
+    engines: {node: '>=16'}
+    hasBin: true
+
+  punycode@2.3.1:
+    resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
+    engines: {node: '>=6'}
+
+  pure-rand@6.0.4:
+    resolution: {integrity: sha512-LA0Y9kxMYv47GIPJy6MI84fqTd2HmYZI83W/kM/SkKfDlajnZYfmXFTxkbY+xSBPkLJxltMa9hIkmdc29eguMA==}
+
+  queue-microtask@1.2.3:
+    resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
+
+  react-is@18.2.0:
+    resolution: {integrity: sha512-xWGDIW6x921xtzPkhiULtthJHoJvBbF3q26fzloPCK0hsvxtPVelvftw3zjbHWSkR2km9Z+4uxbDDK/6Zw9B8w==}
+
+  readable-stream@3.6.2:
+    resolution: {integrity: sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==}
+    engines: {node: '>= 6'}
+
+  require-directory@2.1.1:
+    resolution: {integrity: sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==}
+    engines: {node: '>=0.10.0'}
+
+  resolve-cwd@3.0.0:
+    resolution: {integrity: sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==}
+    engines: {node: '>=8'}
+
+  resolve-from@4.0.0:
+    resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
+    engines: {node: '>=4'}
+
+  resolve-from@5.0.0:
+    resolution: {integrity: sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==}
+    engines: {node: '>=8'}
+
+  resolve.exports@2.0.2:
+    resolution: {integrity: sha512-X2UW6Nw3n/aMgDVy+0rSqgHlv39WZAlZrXCdnbyEiKm17DSqHX4MmQMaST3FbeWR5FTuRcUwYAziZajji0Y7mg==}
+    engines: {node: '>=10'}
+
+  resolve@1.22.8:
+    resolution: {integrity: sha512-oKWePCxqpd6FlLvGV1VU0x7bkPmmCNolxzjMf4NczoDnQcIWrAF+cPtZn5i6n+RfD2d9i0tzpKnG6Yk168yIyw==}
+    hasBin: true
+
+  reusify@1.0.4:
+    resolution: {integrity: sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  run-parallel@1.2.0:
+    resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
+
+  sade@1.8.1:
+    resolution: {integrity: sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A==}
+    engines: {node: '>=6'}
+
+  safe-buffer@5.2.1:
+    resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
+
+  safer-buffer@2.1.2:
+    resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
+
+  semver@6.3.1:
+    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
+    hasBin: true
+
+  semver@7.7.1:
+    resolution: {integrity: sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  shebang-command@2.0.0:
+    resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
+    engines: {node: '>=8'}
+
+  shebang-regex@3.0.0:
+    resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
+    engines: {node: '>=8'}
+
+  signal-exit@3.0.7:
+    resolution: {integrity: sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==}
+
+  sisteransi@1.0.5:
+    resolution: {integrity: sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==}
+
+  skin-tone@2.0.0:
+    resolution: {integrity: sha512-kUMbT1oBJCpgrnKoSr0o6wPtvRWT9W9UKvGLwfJYO2WuahZRHOpEyL1ckyMGgMWh0UdpmaoFqKKD29WTomNEGA==}
+    engines: {node: '>=8'}
+
+  slash@3.0.0:
+    resolution: {integrity: sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==}
+    engines: {node: '>=8'}
+
+  source-map-support@0.5.13:
+    resolution: {integrity: sha512-SHSKFHadjVA5oR4PPqhtAVdcBWwRYVd6g6cAXnIbRiIwc2EhPrTuKUBdSLvlEKyIP3GCf89fltvcZiP9MMFA1w==}
+
+  source-map@0.6.1:
+    resolution: {integrity: sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==}
+    engines: {node: '>=0.10.0'}
+
+  sprintf-js@1.0.3:
+    resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
+
+  stack-utils@2.0.6:
+    resolution: {integrity: sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==}
+    engines: {node: '>=10'}
+
+  string-length@4.0.2:
+    resolution: {integrity: sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==}
+    engines: {node: '>=10'}
+
+  string-to-stream@3.0.1:
+    resolution: {integrity: sha512-Hl092MV3USJuUCC6mfl9sPzGloA3K5VwdIeJjYIkXY/8K+mUvaeEabWJgArp+xXrsWxCajeT2pc4axbVhIZJyg==}
+
+  string-width@4.2.3:
+    resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
+    engines: {node: '>=8'}
+
+  string_decoder@1.3.0:
+    resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==}
+
+  strip-ansi@6.0.1:
+    resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
+    engines: {node: '>=8'}
+
+  strip-bom@3.0.0:
+    resolution: {integrity: sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==}
+    engines: {node: '>=4'}
+
+  strip-bom@4.0.0:
+    resolution: {integrity: sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==}
+    engines: {node: '>=8'}
+
+  strip-final-newline@2.0.0:
+    resolution: {integrity: sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==}
+    engines: {node: '>=6'}
+
+  strip-json-comments@3.1.1:
+    resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
+    engines: {node: '>=8'}
+
+  superstruct@1.0.4:
+    resolution: {integrity: sha512-7JpaAoX2NGyoFlI9NBh66BQXGONc+uE+MRS5i2iOBKuS4e+ccgMDjATgZldkah+33DakBxDHiss9kvUcGAO8UQ==}
+    engines: {node: '>=14.0.0'}
+
+  supports-color@5.5.0:
+    resolution: {integrity: sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==}
+    engines: {node: '>=4'}
+
+  supports-color@7.2.0:
+    resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
+    engines: {node: '>=8'}
+
+  supports-color@8.1.1:
+    resolution: {integrity: sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==}
+    engines: {node: '>=10'}
+
+  supports-hyperlinks@3.1.0:
+    resolution: {integrity: sha512-2rn0BZ+/f7puLOHZm1HOJfwBggfaHXUpPUSSG/SWM4TWp5KCfmNYwnC3hruy2rZlMnmWZ+QAGpZfchu3f3695A==}
+    engines: {node: '>=14.18'}
+
+  supports-preserve-symlinks-flag@1.0.0:
+    resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
+    engines: {node: '>= 0.4'}
+
+  synckit@0.11.8:
+    resolution: {integrity: sha512-+XZ+r1XGIJGeQk3VvXhT6xx/VpbHsRzsTkGgF6E5RX9TTXD0118l87puaEBZ566FhqblC6U0d4XnubznJDm30A==}
+    engines: {node: ^14.18.0 || >=16.0.0}
+
+  test-exclude@6.0.0:
+    resolution: {integrity: sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==}
+    engines: {node: '>=8'}
+
+  thenify-all@1.6.0:
+    resolution: {integrity: sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
+    engines: {node: '>=0.8'}
+
+  thenify@3.3.1:
+    resolution: {integrity: sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==}
+
+  tmpl@1.0.5:
+    resolution: {integrity: sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==}
+
+  to-fast-properties@2.0.0:
+    resolution: {integrity: sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==}
+    engines: {node: '>=4'}
+
+  to-regex-range@5.0.1:
+    resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
+    engines: {node: '>=8.0'}
+
+  ts-api-utils@2.0.1:
+    resolution: {integrity: sha512-dnlgjFSVetynI8nzgJ+qF62efpglpWRk8isUEWZGWlJYySCTD6aKvbUDu+zbPeDakk3bg5H4XpitHukgfL1m9w==}
+    engines: {node: '>=18.12'}
+    peerDependencies:
+      typescript: '>=4.8.4'
+
+  ts-jest@29.1.1:
+    resolution: {integrity: sha512-D6xjnnbP17cC85nliwGiL+tpoKN0StpgE0TeOjXQTU6MVCfsB4v7aW05CgQ/1OywGb0x/oy9hHFnN+sczTiRaA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    hasBin: true
+    peerDependencies:
+      '@babel/core': '>=7.0.0-beta.0 <8'
+      '@jest/types': ^29.0.0
+      babel-jest: ^29.0.0
+      esbuild: '*'
+      jest: ^29.0.0
+      typescript: '>=4.3 <6'
+    peerDependenciesMeta:
+      '@babel/core':
+        optional: true
+      '@jest/types':
+        optional: true
+      babel-jest:
+        optional: true
+      esbuild:
+        optional: true
+
+  ts-node@10.7.0:
+    resolution: {integrity: sha512-TbIGS4xgJoX2i3do417KSaep1uRAW/Lu+WAL2doDHC0D6ummjirVOXU5/7aiZotbQ5p1Zp9tP7U6cYhA0O7M8A==}
+    hasBin: true
+    peerDependencies:
+      '@swc/core': '>=1.2.50'
+      '@swc/wasm': '>=1.2.50'
+      '@types/node': '*'
+      typescript: '>=2.7'
+    peerDependenciesMeta:
+      '@swc/core':
+        optional: true
+      '@swc/wasm':
+        optional: true
+
+  tsc-multi@https://github.com/stainless-api/tsc-multi/releases/download/v1.1.9/tsc-multi.tgz:
+    resolution: {tarball: https://github.com/stainless-api/tsc-multi/releases/download/v1.1.9/tsc-multi.tgz}
+    version: 1.1.9
+    engines: {node: '>=14'}
+    hasBin: true
+    peerDependencies:
+      typescript: '>=4.3.0'
+
+  tsconfig-paths@4.2.0:
+    resolution: {integrity: sha512-NoZ4roiN7LnbKn9QqE1amc9DJfzvZXxF4xDavcOWt1BPkdx+m+0gJuPM+S0vCe7zTJMYUP0R8pO2XMr+Y8oLIg==}
+    engines: {node: '>=6'}
+
+  tslib@2.8.1:
+    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
+
+  type-check@0.4.0:
+    resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
+    engines: {node: '>= 0.8.0'}
+
+  type-detect@4.0.8:
+    resolution: {integrity: sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==}
+    engines: {node: '>=4'}
+
+  type-fest@0.21.3:
+    resolution: {integrity: sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==}
+    engines: {node: '>=10'}
+
+  typescript-eslint@8.31.1:
+    resolution: {integrity: sha512-j6DsEotD/fH39qKzXTQRwYYWlt7D+0HmfpOK+DVhwJOFLcdmn92hq3mBb7HlKJHbjjI/gTOqEcc9d6JfpFf/VA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0
+      typescript: '>=4.8.4 <5.9.0'
+
+  typescript@5.6.1-rc:
+    resolution: {integrity: sha512-E3b2+1zEFu84jB0YQi9BORDjz9+jGbwwy1Zi3G0LUNw7a7cePUrHMRNy8aPh53nXpkFGVHSxIZo5vKTfYaFiBQ==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  typescript@5.8.3:
+    resolution: {integrity: sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  undici-types@6.21.0:
+    resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
+
+  unicode-emoji-modifier-base@1.0.0:
+    resolution: {integrity: sha512-yLSH4py7oFH3oG/9K+XWrz1pSi3dfUrWEnInbxMfArOfc1+33BlGPQtLsOYwvdMy11AwUBetYuaRxSPqgkq+8g==}
+    engines: {node: '>=4'}
+
+  update-browserslist-db@1.0.13:
+    resolution: {integrity: sha512-xebP81SNcPuNpPP3uzeW1NYXxI3rxyJzF3pD6sH4jE7o/IX+WtSpwnVU+qIsDPyk0d3hmFQ7mjqc6AtV604hbg==}
+    hasBin: true
+    peerDependencies:
+      browserslist: '>= 4.21.0'
+
+  uri-js@4.4.1:
+    resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
+
+  util-deprecate@1.0.2:
+    resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
+
+  v8-compile-cache-lib@3.0.0:
+    resolution: {integrity: sha512-mpSYqfsFvASnSn5qMiwrr4VKfumbPyONLCOPmsR3A6pTY/r0+tSaVbgPWSAIuzbk3lCTa+FForeTiO+wBQGkjA==}
+
+  v8-to-istanbul@9.2.0:
+    resolution: {integrity: sha512-/EH/sDgxU2eGxajKdwLCDmQ4FWq+kpi3uCmBGpw1xJtnAxEjlD8j8PEiGWpCIMIs3ciNAgH0d3TTJiUkYzyZjA==}
+    engines: {node: '>=10.12.0'}
+
+  validate-npm-package-name@5.0.1:
+    resolution: {integrity: sha512-OljLrQ9SQdOUqTaQxqL5dEfZWrXExyyWsozYlAWFawPVNuD83igl7uJD2RTkNMbniIYgt8l81eCJGIdQF7avLQ==}
+    engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
+
+  walker@1.0.8:
+    resolution: {integrity: sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==}
+
+  which@2.0.2:
+    resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
+    engines: {node: '>= 8'}
+    hasBin: true
+
+  word-wrap@1.2.5:
+    resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
+    engines: {node: '>=0.10.0'}
+
+  wrap-ansi@7.0.0:
+    resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
+    engines: {node: '>=10'}
+
+  wrappy@1.0.2:
+    resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
+
+  write-file-atomic@4.0.2:
+    resolution: {integrity: sha512-7KxauUdBmSdWnmpaGFg+ppNjKF8uNLry8LyzjauQDOVONfFLNKrKvQOxZ/VuTIcS/gge/YNahf5RIIQWTSarlg==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+
+  ws@8.18.3:
+    resolution: {integrity: sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==}
+    engines: {node: '>=10.0.0'}
+    peerDependencies:
+      bufferutil: ^4.0.1
+      utf-8-validate: '>=5.0.2'
+    peerDependenciesMeta:
+      bufferutil:
+        optional: true
+      utf-8-validate:
+        optional: true
+
+  y18n@5.0.8:
+    resolution: {integrity: sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==}
+    engines: {node: '>=10'}
+
+  yallist@3.1.1:
+    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
+
+  yargs-parser@20.2.9:
+    resolution: {integrity: sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==}
+    engines: {node: '>=10'}
+
+  yargs-parser@21.1.1:
+    resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
+    engines: {node: '>=12'}
+
+  yargs@16.2.0:
+    resolution: {integrity: sha512-D1mvvtDG0L5ft/jGWkLpG1+m0eQxOfaBvTNELraWj22wSVUMWxZUvYgJYcKh6jGGIkJFhH4IZPQhR4TKpc8mBw==}
+    engines: {node: '>=10'}
+
+  yargs@17.7.2:
+    resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
+    engines: {node: '>=12'}
+
+  yn@3.1.1:
+    resolution: {integrity: sha512-Ux4ygGWsu2c7isFWe8Yu1YluJmqVhxqK2cLXNQA5AcC3QfbGNpM7fu0Y8b/z16pXLnFxZYvWhd3fhBY9DLmC6Q==}
+    engines: {node: '>=6'}
+
+  yocto-queue@0.1.0:
+    resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
+    engines: {node: '>=10'}
+
+snapshots:
+
+  '@ampproject/remapping@2.2.1':
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.3
+      '@jridgewell/trace-mapping': 0.3.20
+
+  '@andrewbranch/untar.js@1.0.3': {}
+
+  '@arethetypeswrong/cli@0.17.0':
+    dependencies:
+      '@arethetypeswrong/core': 0.17.0
+      chalk: 4.1.2
+      cli-table3: 0.6.5
+      commander: 10.0.1
+      marked: 9.1.6
+      marked-terminal: 7.2.1(marked@9.1.6)
+      semver: 7.7.1
+
+  '@arethetypeswrong/core@0.17.0':
+    dependencies:
+      '@andrewbranch/untar.js': 1.0.3
+      cjs-module-lexer: 1.4.1
+      fflate: 0.8.2
+      lru-cache: 10.4.3
+      semver: 7.7.1
+      typescript: 5.6.1-rc
+      validate-npm-package-name: 5.0.1
+
+  '@babel/code-frame@7.23.5':
+    dependencies:
+      '@babel/highlight': 7.23.4
+      chalk: 2.4.2
+
+  '@babel/compat-data@7.23.5': {}
+
+  '@babel/core@7.23.6':
+    dependencies:
+      '@ampproject/remapping': 2.2.1
+      '@babel/code-frame': 7.23.5
+      '@babel/generator': 7.23.6
+      '@babel/helper-compilation-targets': 7.23.6
+      '@babel/helper-module-transforms': 7.23.3(@babel/core@7.23.6)
+      '@babel/helpers': 7.23.6
+      '@babel/parser': 7.23.6
+      '@babel/template': 7.22.15
+      '@babel/traverse': 7.23.6
+      '@babel/types': 7.23.6
+      convert-source-map: 2.0.0
+      debug: 4.4.3
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/generator@7.23.6':
+    dependencies:
+      '@babel/types': 7.23.6
+      '@jridgewell/gen-mapping': 0.3.3
+      '@jridgewell/trace-mapping': 0.3.20
+      jsesc: 2.5.2
+
+  '@babel/helper-compilation-targets@7.23.6':
+    dependencies:
+      '@babel/compat-data': 7.23.5
+      '@babel/helper-validator-option': 7.23.5
+      browserslist: 4.22.2
+      lru-cache: 5.1.1
+      semver: 6.3.1
+
+  '@babel/helper-environment-visitor@7.22.20': {}
+
+  '@babel/helper-function-name@7.23.0':
+    dependencies:
+      '@babel/template': 7.22.15
+      '@babel/types': 7.23.6
+
+  '@babel/helper-hoist-variables@7.22.5':
+    dependencies:
+      '@babel/types': 7.23.6
+
+  '@babel/helper-module-imports@7.22.15':
+    dependencies:
+      '@babel/types': 7.23.6
+
+  '@babel/helper-module-transforms@7.23.3(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-module-imports': 7.22.15
+      '@babel/helper-simple-access': 7.22.5
+      '@babel/helper-split-export-declaration': 7.22.6
+      '@babel/helper-validator-identifier': 7.22.20
+
+  '@babel/helper-plugin-utils@7.22.5': {}
+
+  '@babel/helper-simple-access@7.22.5':
+    dependencies:
+      '@babel/types': 7.23.6
+
+  '@babel/helper-split-export-declaration@7.22.6':
+    dependencies:
+      '@babel/types': 7.23.6
+
+  '@babel/helper-string-parser@7.23.4': {}
+
+  '@babel/helper-validator-identifier@7.22.20': {}
+
+  '@babel/helper-validator-option@7.23.5': {}
+
+  '@babel/helpers@7.23.6':
+    dependencies:
+      '@babel/template': 7.22.15
+      '@babel/traverse': 7.23.6
+      '@babel/types': 7.23.6
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/highlight@7.23.4':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.22.20
+      chalk: 2.4.2
+      js-tokens: 4.0.0
+
+  '@babel/parser@7.23.6':
+    dependencies:
+      '@babel/types': 7.23.6
+
+  '@babel/plugin-syntax-async-generators@7.8.4(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-bigint@7.8.3(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-class-properties@7.12.13(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-import-meta@7.10.4(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-json-strings@7.8.3(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-jsx@7.23.3(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-logical-assignment-operators@7.10.4(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-nullish-coalescing-operator@7.8.3(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-numeric-separator@7.10.4(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-object-rest-spread@7.8.3(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-optional-catch-binding@7.8.3(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-optional-chaining@7.8.3(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-top-level-await@7.14.5(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/plugin-syntax-typescript@7.23.3(@babel/core@7.23.6)':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/helper-plugin-utils': 7.22.5
+
+  '@babel/template@7.22.15':
+    dependencies:
+      '@babel/code-frame': 7.23.5
+      '@babel/parser': 7.23.6
+      '@babel/types': 7.23.6
+
+  '@babel/traverse@7.23.6':
+    dependencies:
+      '@babel/code-frame': 7.23.5
+      '@babel/generator': 7.23.6
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-function-name': 7.23.0
+      '@babel/helper-hoist-variables': 7.22.5
+      '@babel/helper-split-export-declaration': 7.22.6
+      '@babel/parser': 7.23.6
+      '@babel/types': 7.23.6
+      debug: 4.4.3
+      globals: 11.12.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/types@7.23.6':
+    dependencies:
+      '@babel/helper-string-parser': 7.23.4
+      '@babel/helper-validator-identifier': 7.22.20
+      to-fast-properties: 2.0.0
+
+  '@bcoe/v8-coverage@0.2.3': {}
+
+  '@colors/colors@1.5.0':
+    optional: true
+
+  '@cspotcode/source-map-consumer@0.8.0': {}
+
+  '@cspotcode/source-map-support@0.7.0':
+    dependencies:
+      '@cspotcode/source-map-consumer': 0.8.0
+
+  '@eslint-community/eslint-utils@4.4.0(eslint@9.39.1)':
+    dependencies:
+      eslint: 9.39.1
+      eslint-visitor-keys: 3.4.3
+
+  '@eslint-community/eslint-utils@4.9.0(eslint@9.39.1)':
+    dependencies:
+      eslint: 9.39.1
+      eslint-visitor-keys: 3.4.3
+
+  '@eslint-community/regexpp@4.12.1': {}
+
+  '@eslint-community/regexpp@4.12.2': {}
+
+  '@eslint/config-array@0.21.1':
+    dependencies:
+      '@eslint/object-schema': 2.1.7
+      debug: 4.4.3
+      minimatch: 3.1.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@eslint/config-helpers@0.4.2':
+    dependencies:
+      '@eslint/core': 0.17.0
+
+  '@eslint/core@0.17.0':
+    dependencies:
+      '@types/json-schema': 7.0.15
+
+  '@eslint/eslintrc@3.3.3':
+    dependencies:
+      ajv: 6.12.6
+      debug: 4.4.3
+      espree: 10.4.0
+      globals: 14.0.0
+      ignore: 5.3.2
+      import-fresh: 3.3.1
+      js-yaml: 4.1.1
+      minimatch: 3.1.2
+      strip-json-comments: 3.1.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@eslint/js@9.39.1': {}
+
+  '@eslint/object-schema@2.1.7': {}
+
+  '@eslint/plugin-kit@0.4.1':
+    dependencies:
+      '@eslint/core': 0.17.0
+      levn: 0.4.1
+
+  '@humanfs/core@0.19.1': {}
+
+  '@humanfs/node@0.16.7':
+    dependencies:
+      '@humanfs/core': 0.19.1
+      '@humanwhocodes/retry': 0.4.3
+
+  '@humanwhocodes/module-importer@1.0.1': {}
+
+  '@humanwhocodes/retry@0.4.3': {}
+
+  '@istanbuljs/load-nyc-config@1.1.0':
+    dependencies:
+      camelcase: 5.3.1
+      find-up: 4.1.0
+      get-package-type: 0.1.0
+      js-yaml: 3.14.2
+      resolve-from: 5.0.0
+
+  '@istanbuljs/schema@0.1.3': {}
+
+  '@jest/console@29.7.0':
+    dependencies:
+      '@jest/types': 29.6.3
+      '@types/node': 20.19.11
+      chalk: 4.1.2
+      jest-message-util: 29.7.0
+      jest-util: 29.7.0
+      slash: 3.0.0
+
+  '@jest/core@29.7.0(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3))':
+    dependencies:
+      '@jest/console': 29.7.0
+      '@jest/reporters': 29.7.0
+      '@jest/test-result': 29.7.0
+      '@jest/transform': 29.7.0
+      '@jest/types': 29.6.3
+      '@types/node': 20.19.11
+      ansi-escapes: 4.3.2
+      chalk: 4.1.2
+      ci-info: 3.9.0
+      exit: 0.1.2
+      graceful-fs: 4.2.11
+      jest-changed-files: 29.7.0
+      jest-config: 29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3))
+      jest-haste-map: 29.7.0
+      jest-message-util: 29.7.0
+      jest-regex-util: 29.6.3
+      jest-resolve: 29.7.0
+      jest-resolve-dependencies: 29.7.0
+      jest-runner: 29.7.0
+      jest-runtime: 29.7.0
+      jest-snapshot: 29.7.0
+      jest-util: 29.7.0
+      jest-validate: 29.7.0
+      jest-watcher: 29.7.0
+      micromatch: 4.0.8
+      pretty-format: 29.7.0
+      slash: 3.0.0
+      strip-ansi: 6.0.1
+    transitivePeerDependencies:
+      - babel-plugin-macros
+      - supports-color
+      - ts-node
+
+  '@jest/create-cache-key-function@29.7.0':
+    dependencies:
+      '@jest/types': 29.6.3
+
+  '@jest/environment@29.7.0':
+    dependencies:
+      '@jest/fake-timers': 29.7.0
+      '@jest/types': 29.6.3
+      '@types/node': 20.19.11
+      jest-mock: 29.7.0
+
+  '@jest/expect-utils@29.7.0':
+    dependencies:
+      jest-get-type: 29.6.3
+
+  '@jest/expect@29.7.0':
+    dependencies:
+      expect: 29.7.0
+      jest-snapshot: 29.7.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@jest/fake-timers@29.7.0':
+    dependencies:
+      '@jest/types': 29.6.3
+      '@sinonjs/fake-timers': 10.3.0
+      '@types/node': 20.19.11
+      jest-message-util: 29.7.0
+      jest-mock: 29.7.0
+      jest-util: 29.7.0
+
+  '@jest/globals@29.7.0':
+    dependencies:
+      '@jest/environment': 29.7.0
+      '@jest/expect': 29.7.0
+      '@jest/types': 29.6.3
+      jest-mock: 29.7.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@jest/reporters@29.7.0':
+    dependencies:
+      '@bcoe/v8-coverage': 0.2.3
+      '@jest/console': 29.7.0
+      '@jest/test-result': 29.7.0
+      '@jest/transform': 29.7.0
+      '@jest/types': 29.6.3
+      '@jridgewell/trace-mapping': 0.3.20
+      '@types/node': 20.19.11
+      chalk: 4.1.2
+      collect-v8-coverage: 1.0.2
+      exit: 0.1.2
+      glob: 7.2.3
+      graceful-fs: 4.2.11
+      istanbul-lib-coverage: 3.2.2
+      istanbul-lib-instrument: 6.0.1
+      istanbul-lib-report: 3.0.1
+      istanbul-lib-source-maps: 4.0.1
+      istanbul-reports: 3.1.6
+      jest-message-util: 29.7.0
+      jest-util: 29.7.0
+      jest-worker: 29.7.0
+      slash: 3.0.0
+      string-length: 4.0.2
+      strip-ansi: 6.0.1
+      v8-to-istanbul: 9.2.0
+    transitivePeerDependencies:
+      - supports-color
+
+  '@jest/schemas@29.6.3':
+    dependencies:
+      '@sinclair/typebox': 0.27.8
+
+  '@jest/source-map@29.6.3':
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.20
+      callsites: 3.1.0
+      graceful-fs: 4.2.11
+
+  '@jest/test-result@29.7.0':
+    dependencies:
+      '@jest/console': 29.7.0
+      '@jest/types': 29.6.3
+      '@types/istanbul-lib-coverage': 2.0.6
+      collect-v8-coverage: 1.0.2
+
+  '@jest/test-sequencer@29.7.0':
+    dependencies:
+      '@jest/test-result': 29.7.0
+      graceful-fs: 4.2.11
+      jest-haste-map: 29.7.0
+      slash: 3.0.0
+
+  '@jest/transform@29.7.0':
+    dependencies:
+      '@babel/core': 7.23.6
+      '@jest/types': 29.6.3
+      '@jridgewell/trace-mapping': 0.3.20
+      babel-plugin-istanbul: 6.1.1
+      chalk: 4.1.2
+      convert-source-map: 2.0.0
+      fast-json-stable-stringify: 2.1.0
+      graceful-fs: 4.2.11
+      jest-haste-map: 29.7.0
+      jest-regex-util: 29.6.3
+      jest-util: 29.7.0
+      micromatch: 4.0.8
+      pirates: 4.0.6
+      slash: 3.0.0
+      write-file-atomic: 4.0.2
+    transitivePeerDependencies:
+      - supports-color
+
+  '@jest/types@29.6.3':
+    dependencies:
+      '@jest/schemas': 29.6.3
+      '@types/istanbul-lib-coverage': 2.0.6
+      '@types/istanbul-reports': 3.0.4
+      '@types/node': 20.19.11
+      '@types/yargs': 17.0.32
+      chalk: 4.1.2
+
+  '@jridgewell/gen-mapping@0.3.3':
+    dependencies:
+      '@jridgewell/set-array': 1.1.2
+      '@jridgewell/sourcemap-codec': 1.4.15
+      '@jridgewell/trace-mapping': 0.3.20
+
+  '@jridgewell/resolve-uri@3.1.1': {}
+
+  '@jridgewell/set-array@1.1.2': {}
+
+  '@jridgewell/sourcemap-codec@1.4.15': {}
+
+  '@jridgewell/trace-mapping@0.3.20':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.1
+      '@jridgewell/sourcemap-codec': 1.4.15
+
+  '@nodelib/fs.scandir@2.1.5':
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      run-parallel: 1.2.0
+
+  '@nodelib/fs.stat@2.0.5': {}
+
+  '@nodelib/fs.walk@1.2.8':
+    dependencies:
+      '@nodelib/fs.scandir': 2.1.5
+      fastq: 1.17.1
+
+  '@pkgr/core@0.2.4': {}
+
+  '@sinclair/typebox@0.27.8': {}
+
+  '@sindresorhus/is@4.6.0': {}
+
+  '@sinonjs/commons@3.0.0':
+    dependencies:
+      type-detect: 4.0.8
+
+  '@sinonjs/fake-timers@10.3.0':
+    dependencies:
+      '@sinonjs/commons': 3.0.0
+
+  '@swc/core-darwin-arm64@1.4.16':
+    optional: true
+
+  '@swc/core-darwin-x64@1.4.16':
+    optional: true
+
+  '@swc/core-linux-arm-gnueabihf@1.4.16':
+    optional: true
+
+  '@swc/core-linux-arm64-gnu@1.4.16':
+    optional: true
+
+  '@swc/core-linux-arm64-musl@1.4.16':
+    optional: true
+
+  '@swc/core-linux-x64-gnu@1.4.16':
+    optional: true
+
+  '@swc/core-linux-x64-musl@1.4.16':
+    optional: true
+
+  '@swc/core-win32-arm64-msvc@1.4.16':
+    optional: true
+
+  '@swc/core-win32-ia32-msvc@1.4.16':
+    optional: true
+
+  '@swc/core-win32-x64-msvc@1.4.16':
+    optional: true
+
+  '@swc/core@1.4.16':
+    dependencies:
+      '@swc/counter': 0.1.3
+      '@swc/types': 0.1.6
+    optionalDependencies:
+      '@swc/core-darwin-arm64': 1.4.16
+      '@swc/core-darwin-x64': 1.4.16
+      '@swc/core-linux-arm-gnueabihf': 1.4.16
+      '@swc/core-linux-arm64-gnu': 1.4.16
+      '@swc/core-linux-arm64-musl': 1.4.16
+      '@swc/core-linux-x64-gnu': 1.4.16
+      '@swc/core-linux-x64-musl': 1.4.16
+      '@swc/core-win32-arm64-msvc': 1.4.16
+      '@swc/core-win32-ia32-msvc': 1.4.16
+      '@swc/core-win32-x64-msvc': 1.4.16
+
+  '@swc/counter@0.1.3': {}
+
+  '@swc/jest@0.2.36(@swc/core@1.4.16)':
+    dependencies:
+      '@jest/create-cache-key-function': 29.7.0
+      '@swc/core': 1.4.16
+      '@swc/counter': 0.1.3
+      jsonc-parser: 3.2.1
+
+  '@swc/types@0.1.6':
+    dependencies:
+      '@swc/counter': 0.1.3
+
+  '@tsconfig/node10@1.0.8': {}
+
+  '@tsconfig/node12@1.0.9': {}
+
+  '@tsconfig/node14@1.0.1': {}
+
+  '@tsconfig/node16@1.0.2': {}
+
+  '@types/babel__core@7.20.5':
+    dependencies:
+      '@babel/parser': 7.23.6
+      '@babel/types': 7.23.6
+      '@types/babel__generator': 7.6.8
+      '@types/babel__template': 7.4.4
+      '@types/babel__traverse': 7.20.4
+
+  '@types/babel__generator@7.6.8':
+    dependencies:
+      '@babel/types': 7.23.6
+
+  '@types/babel__template@7.4.4':
+    dependencies:
+      '@babel/parser': 7.23.6
+      '@babel/types': 7.23.6
+
+  '@types/babel__traverse@7.20.4':
+    dependencies:
+      '@babel/types': 7.23.6
+
+  '@types/estree@1.0.8': {}
+
+  '@types/graceful-fs@4.1.9':
+    dependencies:
+      '@types/node': 20.19.11
+
+  '@types/istanbul-lib-coverage@2.0.6': {}
+
+  '@types/istanbul-lib-report@3.0.3':
+    dependencies:
+      '@types/istanbul-lib-coverage': 2.0.6
+
+  '@types/istanbul-reports@3.0.4':
+    dependencies:
+      '@types/istanbul-lib-report': 3.0.3
+
+  '@types/jest@29.5.11':
+    dependencies:
+      expect: 29.7.0
+      pretty-format: 29.7.0
+
+  '@types/json-schema@7.0.15': {}
+
+  '@types/node@20.19.11':
+    dependencies:
+      undici-types: 6.21.0
+
+  '@types/stack-utils@2.0.3': {}
+
+  '@types/ws@8.18.1':
+    dependencies:
+      '@types/node': 20.19.11
+
+  '@types/yargs-parser@21.0.3': {}
+
+  '@types/yargs@17.0.32':
+    dependencies:
+      '@types/yargs-parser': 21.0.3
+
+  '@typescript-eslint/eslint-plugin@8.31.1(@typescript-eslint/parser@8.31.1(eslint@9.39.1)(typescript@5.8.3))(eslint@9.39.1)(typescript@5.8.3)':
+    dependencies:
+      '@eslint-community/regexpp': 4.12.1
+      '@typescript-eslint/parser': 8.31.1(eslint@9.39.1)(typescript@5.8.3)
+      '@typescript-eslint/scope-manager': 8.31.1
+      '@typescript-eslint/type-utils': 8.31.1(eslint@9.39.1)(typescript@5.8.3)
+      '@typescript-eslint/utils': 8.31.1(eslint@9.39.1)(typescript@5.8.3)
+      '@typescript-eslint/visitor-keys': 8.31.1
+      eslint: 9.39.1
+      graphemer: 1.4.0
+      ignore: 5.3.2
+      natural-compare: 1.4.0
+      ts-api-utils: 2.0.1(typescript@5.8.3)
+      typescript: 5.8.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/parser@8.31.1(eslint@9.39.1)(typescript@5.8.3)':
+    dependencies:
+      '@typescript-eslint/scope-manager': 8.31.1
+      '@typescript-eslint/types': 8.31.1
+      '@typescript-eslint/typescript-estree': 8.31.1(typescript@5.8.3)
+      '@typescript-eslint/visitor-keys': 8.31.1
+      debug: 4.4.1
+      eslint: 9.39.1
+      typescript: 5.8.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/scope-manager@8.31.1':
+    dependencies:
+      '@typescript-eslint/types': 8.31.1
+      '@typescript-eslint/visitor-keys': 8.31.1
+
+  '@typescript-eslint/type-utils@8.31.1(eslint@9.39.1)(typescript@5.8.3)':
+    dependencies:
+      '@typescript-eslint/typescript-estree': 8.31.1(typescript@5.8.3)
+      '@typescript-eslint/utils': 8.31.1(eslint@9.39.1)(typescript@5.8.3)
+      debug: 4.4.1
+      eslint: 9.39.1
+      ts-api-utils: 2.0.1(typescript@5.8.3)
+      typescript: 5.8.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/types@8.31.1': {}
+
+  '@typescript-eslint/typescript-estree@8.31.1(typescript@5.8.3)':
+    dependencies:
+      '@typescript-eslint/types': 8.31.1
+      '@typescript-eslint/visitor-keys': 8.31.1
+      debug: 4.4.1
+      fast-glob: 3.3.2
+      is-glob: 4.0.3
+      minimatch: 9.0.5
+      semver: 7.7.1
+      ts-api-utils: 2.0.1(typescript@5.8.3)
+      typescript: 5.8.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.31.1(eslint@9.39.1)(typescript@5.8.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.4.0(eslint@9.39.1)
+      '@typescript-eslint/scope-manager': 8.31.1
+      '@typescript-eslint/types': 8.31.1
+      '@typescript-eslint/typescript-estree': 8.31.1(typescript@5.8.3)
+      eslint: 9.39.1
+      typescript: 5.8.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/visitor-keys@8.31.1':
+    dependencies:
+      '@typescript-eslint/types': 8.31.1
+      eslint-visitor-keys: 4.2.0
+
+  acorn-jsx@5.3.2(acorn@8.15.0):
+    dependencies:
+      acorn: 8.15.0
+
+  acorn-walk@8.2.0: {}
+
+  acorn@8.14.0: {}
+
+  acorn@8.15.0: {}
+
+  aggregate-error@3.1.0:
+    dependencies:
+      clean-stack: 2.2.0
+      indent-string: 4.0.0
+
+  ajv@6.12.6:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-json-stable-stringify: 2.1.0
+      json-schema-traverse: 0.4.1
+      uri-js: 4.4.1
+
+  ansi-escapes@4.3.2:
+    dependencies:
+      type-fest: 0.21.3
+
+  ansi-escapes@7.0.0:
+    dependencies:
+      environment: 1.1.0
+
+  ansi-regex@5.0.1: {}
+
+  ansi-regex@6.1.0: {}
+
+  ansi-styles@3.2.1:
+    dependencies:
+      color-convert: 1.9.3
+
+  ansi-styles@4.3.0:
+    dependencies:
+      color-convert: 2.0.1
+
+  ansi-styles@5.2.0: {}
+
+  any-promise@1.3.0: {}
+
+  anymatch@3.1.3:
+    dependencies:
+      normalize-path: 3.0.0
+      picomatch: 2.3.1
+
+  arg@4.1.3: {}
+
+  argparse@1.0.10:
+    dependencies:
+      sprintf-js: 1.0.3
+
+  argparse@2.0.1: {}
+
+  babel-jest@29.7.0(@babel/core@7.23.6):
+    dependencies:
+      '@babel/core': 7.23.6
+      '@jest/transform': 29.7.0
+      '@types/babel__core': 7.20.5
+      babel-plugin-istanbul: 6.1.1
+      babel-preset-jest: 29.6.3(@babel/core@7.23.6)
+      chalk: 4.1.2
+      graceful-fs: 4.2.11
+      slash: 3.0.0
+    transitivePeerDependencies:
+      - supports-color
+
+  babel-plugin-istanbul@6.1.1:
+    dependencies:
+      '@babel/helper-plugin-utils': 7.22.5
+      '@istanbuljs/load-nyc-config': 1.1.0
+      '@istanbuljs/schema': 0.1.3
+      istanbul-lib-instrument: 5.2.1
+      test-exclude: 6.0.0
+    transitivePeerDependencies:
+      - supports-color
+
+  babel-plugin-jest-hoist@29.6.3:
+    dependencies:
+      '@babel/template': 7.22.15
+      '@babel/types': 7.23.6
+      '@types/babel__core': 7.20.5
+      '@types/babel__traverse': 7.20.4
+
+  babel-preset-current-node-syntax@1.0.1(@babel/core@7.23.6):
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.23.6)
+      '@babel/plugin-syntax-bigint': 7.8.3(@babel/core@7.23.6)
+      '@babel/plugin-syntax-class-properties': 7.12.13(@babel/core@7.23.6)
+      '@babel/plugin-syntax-import-meta': 7.10.4(@babel/core@7.23.6)
+      '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.23.6)
+      '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.23.6)
+      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.23.6)
+      '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.23.6)
+      '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.23.6)
+      '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.23.6)
+      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.23.6)
+      '@babel/plugin-syntax-top-level-await': 7.14.5(@babel/core@7.23.6)
+
+  babel-preset-jest@29.6.3(@babel/core@7.23.6):
+    dependencies:
+      '@babel/core': 7.23.6
+      babel-plugin-jest-hoist: 29.6.3
+      babel-preset-current-node-syntax: 1.0.1(@babel/core@7.23.6)
+
+  balanced-match@1.0.2: {}
+
+  brace-expansion@1.1.12:
+    dependencies:
+      balanced-match: 1.0.2
+      concat-map: 0.0.1
+
+  brace-expansion@2.0.1:
+    dependencies:
+      balanced-match: 1.0.2
+
+  brace-expansion@2.0.2:
+    dependencies:
+      balanced-match: 1.0.2
+
+  braces@3.0.3:
+    dependencies:
+      fill-range: 7.1.1
+
+  browserslist@4.22.2:
+    dependencies:
+      caniuse-lite: 1.0.30001570
+      electron-to-chromium: 1.4.614
+      node-releases: 2.0.14
+      update-browserslist-db: 1.0.13(browserslist@4.22.2)
+
+  bs-logger@0.2.6:
+    dependencies:
+      fast-json-stable-stringify: 2.1.0
+
+  bser@2.1.1:
+    dependencies:
+      node-int64: 0.4.0
+
+  buffer-from@1.1.2: {}
+
+  callsites@3.1.0: {}
+
+  camelcase@5.3.1: {}
+
+  camelcase@6.3.0: {}
+
+  caniuse-lite@1.0.30001570: {}
+
+  chalk@2.4.2:
+    dependencies:
+      ansi-styles: 3.2.1
+      escape-string-regexp: 1.0.5
+      supports-color: 5.5.0
+
+  chalk@4.1.2:
+    dependencies:
+      ansi-styles: 4.3.0
+      supports-color: 7.2.0
+
+  chalk@5.3.0: {}
+
+  char-regex@1.0.2: {}
+
+  ci-info@3.9.0: {}
+
+  cjs-module-lexer@1.4.1: {}
+
+  clean-stack@2.2.0: {}
+
+  cli-highlight@2.1.11:
+    dependencies:
+      chalk: 4.1.2
+      highlight.js: 10.7.3
+      mz: 2.7.0
+      parse5: 5.1.1
+      parse5-htmlparser2-tree-adapter: 6.0.1
+      yargs: 16.2.0
+
+  cli-table3@0.6.5:
+    dependencies:
+      string-width: 4.2.3
+    optionalDependencies:
+      '@colors/colors': 1.5.0
+
+  cliui@7.0.4:
+    dependencies:
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+      wrap-ansi: 7.0.0
+
+  cliui@8.0.1:
+    dependencies:
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+      wrap-ansi: 7.0.0
+
+  co@4.6.0: {}
+
+  collect-v8-coverage@1.0.2: {}
+
+  color-convert@1.9.3:
+    dependencies:
+      color-name: 1.1.3
+
+  color-convert@2.0.1:
+    dependencies:
+      color-name: 1.1.4
+
+  color-name@1.1.3: {}
+
+  color-name@1.1.4: {}
+
+  commander@10.0.1: {}
+
+  concat-map@0.0.1: {}
+
+  convert-source-map@2.0.0: {}
+
+  create-jest@29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3)):
+    dependencies:
+      '@jest/types': 29.6.3
+      chalk: 4.1.2
+      exit: 0.1.2
+      graceful-fs: 4.2.11
+      jest-config: 29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3))
+      jest-util: 29.7.0
+      prompts: 2.4.2
+    transitivePeerDependencies:
+      - '@types/node'
+      - babel-plugin-macros
+      - supports-color
+      - ts-node
+
+  create-require@1.1.1: {}
+
+  cross-spawn@7.0.6:
+    dependencies:
+      path-key: 3.1.1
+      shebang-command: 2.0.0
+      which: 2.0.2
+
+  debug@4.4.1:
+    dependencies:
+      ms: 2.1.3
+
+  debug@4.4.3:
+    dependencies:
+      ms: 2.1.3
+
+  dedent@1.5.1: {}
+
+  deep-is@0.1.4: {}
+
+  deepmerge@4.3.1: {}
+
+  detect-newline@3.1.0: {}
+
+  diff-sequences@29.6.3: {}
+
+  diff@4.0.2: {}
+
+  electron-to-chromium@1.4.614: {}
+
+  emittery@0.13.1: {}
+
+  emoji-regex@8.0.0: {}
+
+  emojilib@2.4.0: {}
+
+  environment@1.1.0: {}
+
+  error-ex@1.3.2:
+    dependencies:
+      is-arrayish: 0.2.1
+
+  escalade@3.1.1: {}
+
+  escape-string-regexp@1.0.5: {}
+
+  escape-string-regexp@2.0.0: {}
+
+  escape-string-regexp@4.0.0: {}
+
+  eslint-plugin-prettier@5.4.1(eslint@9.39.1)(prettier@3.1.1):
+    dependencies:
+      eslint: 9.39.1
+      prettier: 3.1.1
+      prettier-linter-helpers: 1.0.0
+      synckit: 0.11.8
+
+  eslint-plugin-unused-imports@4.1.4(@typescript-eslint/eslint-plugin@8.31.1(@typescript-eslint/parser@8.31.1(eslint@9.39.1)(typescript@5.8.3))(eslint@9.39.1)(typescript@5.8.3))(eslint@9.39.1):
+    dependencies:
+      eslint: 9.39.1
+    optionalDependencies:
+      '@typescript-eslint/eslint-plugin': 8.31.1(@typescript-eslint/parser@8.31.1(eslint@9.39.1)(typescript@5.8.3))(eslint@9.39.1)(typescript@5.8.3)
+
+  eslint-scope@8.4.0:
+    dependencies:
+      esrecurse: 4.3.0
+      estraverse: 5.3.0
+
+  eslint-visitor-keys@3.4.3: {}
+
+  eslint-visitor-keys@4.2.0: {}
+
+  eslint-visitor-keys@4.2.1: {}
+
+  eslint@9.39.1:
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.0(eslint@9.39.1)
+      '@eslint-community/regexpp': 4.12.2
+      '@eslint/config-array': 0.21.1
+      '@eslint/config-helpers': 0.4.2
+      '@eslint/core': 0.17.0
+      '@eslint/eslintrc': 3.3.3
+      '@eslint/js': 9.39.1
+      '@eslint/plugin-kit': 0.4.1
+      '@humanfs/node': 0.16.7
+      '@humanwhocodes/module-importer': 1.0.1
+      '@humanwhocodes/retry': 0.4.3
+      '@types/estree': 1.0.8
+      ajv: 6.12.6
+      chalk: 4.1.2
+      cross-spawn: 7.0.6
+      debug: 4.4.3
+      escape-string-regexp: 4.0.0
+      eslint-scope: 8.4.0
+      eslint-visitor-keys: 4.2.1
+      espree: 10.4.0
+      esquery: 1.6.0
+      esutils: 2.0.3
+      fast-deep-equal: 3.1.3
+      file-entry-cache: 8.0.0
+      find-up: 5.0.0
+      glob-parent: 6.0.2
+      ignore: 5.3.2
+      imurmurhash: 0.1.4
+      is-glob: 4.0.3
+      json-stable-stringify-without-jsonify: 1.0.1
+      lodash.merge: 4.6.2
+      minimatch: 3.1.2
+      natural-compare: 1.4.0
+      optionator: 0.9.4
+    transitivePeerDependencies:
+      - supports-color
+
+  espree@10.4.0:
+    dependencies:
+      acorn: 8.15.0
+      acorn-jsx: 5.3.2(acorn@8.15.0)
+      eslint-visitor-keys: 4.2.1
+
+  esprima@4.0.1: {}
+
+  esquery@1.6.0:
+    dependencies:
+      estraverse: 5.3.0
+
+  esrecurse@4.3.0:
+    dependencies:
+      estraverse: 5.3.0
+
+  estraverse@5.3.0: {}
+
+  esutils@2.0.3: {}
+
+  execa@5.1.1:
+    dependencies:
+      cross-spawn: 7.0.6
+      get-stream: 6.0.1
+      human-signals: 2.1.0
+      is-stream: 2.0.1
+      merge-stream: 2.0.0
+      npm-run-path: 4.0.1
+      onetime: 5.1.2
+      signal-exit: 3.0.7
+      strip-final-newline: 2.0.0
+
+  exit@0.1.2: {}
+
+  expect@29.7.0:
+    dependencies:
+      '@jest/expect-utils': 29.7.0
+      jest-get-type: 29.6.3
+      jest-matcher-utils: 29.7.0
+      jest-message-util: 29.7.0
+      jest-util: 29.7.0
+
+  fast-deep-equal@3.1.3: {}
+
+  fast-diff@1.3.0: {}
+
+  fast-glob@3.3.2:
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      '@nodelib/fs.walk': 1.2.8
+      glob-parent: 5.1.2
+      merge2: 1.4.1
+      micromatch: 4.0.8
+
+  fast-json-stable-stringify@2.1.0: {}
+
+  fast-levenshtein@2.0.6: {}
+
+  fastq@1.17.1:
+    dependencies:
+      reusify: 1.0.4
+
+  fb-watchman@2.0.2:
+    dependencies:
+      bser: 2.1.1
+
+  fflate@0.8.2: {}
+
+  file-entry-cache@8.0.0:
+    dependencies:
+      flat-cache: 4.0.1
+
+  fill-range@7.1.1:
+    dependencies:
+      to-regex-range: 5.0.1
+
+  find-up@4.1.0:
+    dependencies:
+      locate-path: 5.0.0
+      path-exists: 4.0.0
+
+  find-up@5.0.0:
+    dependencies:
+      locate-path: 6.0.0
+      path-exists: 4.0.0
+
+  flat-cache@4.0.1:
+    dependencies:
+      flatted: 3.3.3
+      keyv: 4.5.4
+
+  flatted@3.3.3: {}
+
+  fs.realpath@1.0.0: {}
+
+  fsevents@2.3.3:
+    optional: true
+
+  function-bind@1.1.2: {}
+
+  gensync@1.0.0-beta.2: {}
+
+  get-caller-file@2.0.5: {}
+
+  get-package-type@0.1.0: {}
+
+  get-stdin@8.0.0: {}
+
+  get-stream@6.0.1: {}
+
+  glob-parent@5.1.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  glob-parent@6.0.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  glob@7.2.3:
+    dependencies:
+      fs.realpath: 1.0.0
+      inflight: 1.0.6
+      inherits: 2.0.4
+      minimatch: 3.1.2
+      once: 1.4.0
+      path-is-absolute: 1.0.1
+
+  glob@8.1.0:
+    dependencies:
+      fs.realpath: 1.0.0
+      inflight: 1.0.6
+      inherits: 2.0.4
+      minimatch: 5.1.6
+      once: 1.4.0
+
+  globals@11.12.0: {}
+
+  globals@14.0.0: {}
+
+  graceful-fs@4.2.11: {}
+
+  graphemer@1.4.0: {}
+
+  has-flag@3.0.0: {}
+
+  has-flag@4.0.0: {}
+
+  hasown@2.0.0:
+    dependencies:
+      function-bind: 1.1.2
+
+  highlight.js@10.7.3: {}
+
+  html-escaper@2.0.2: {}
+
+  human-signals@2.1.0: {}
+
+  iconv-lite@0.6.3:
+    dependencies:
+      safer-buffer: 2.1.2
+
+  ignore-walk@5.0.1:
+    dependencies:
+      minimatch: 5.1.6
+
+  ignore@5.3.2: {}
+
+  import-fresh@3.3.1:
+    dependencies:
+      parent-module: 1.0.1
+      resolve-from: 4.0.0
+
+  import-local@3.1.0:
+    dependencies:
+      pkg-dir: 4.2.0
+      resolve-cwd: 3.0.0
+
+  imurmurhash@0.1.4: {}
+
+  indent-string@4.0.0: {}
+
+  inflight@1.0.6:
+    dependencies:
+      once: 1.4.0
+      wrappy: 1.0.2
+
+  inherits@2.0.4: {}
+
+  is-arrayish@0.2.1: {}
+
+  is-core-module@2.13.1:
+    dependencies:
+      hasown: 2.0.0
+
+  is-extglob@2.1.1: {}
+
+  is-fullwidth-code-point@3.0.0: {}
+
+  is-generator-fn@2.1.0: {}
+
+  is-glob@4.0.3:
+    dependencies:
+      is-extglob: 2.1.1
+
+  is-number@7.0.0: {}
+
+  is-stream@2.0.1: {}
+
+  isexe@2.0.0: {}
+
+  istanbul-lib-coverage@3.2.2: {}
+
+  istanbul-lib-instrument@5.2.1:
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/parser': 7.23.6
+      '@istanbuljs/schema': 0.1.3
+      istanbul-lib-coverage: 3.2.2
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  istanbul-lib-instrument@6.0.1:
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/parser': 7.23.6
+      '@istanbuljs/schema': 0.1.3
+      istanbul-lib-coverage: 3.2.2
+      semver: 7.7.1
+    transitivePeerDependencies:
+      - supports-color
+
+  istanbul-lib-report@3.0.1:
+    dependencies:
+      istanbul-lib-coverage: 3.2.2
+      make-dir: 4.0.0
+      supports-color: 7.2.0
+
+  istanbul-lib-source-maps@4.0.1:
+    dependencies:
+      debug: 4.4.3
+      istanbul-lib-coverage: 3.2.2
+      source-map: 0.6.1
+    transitivePeerDependencies:
+      - supports-color
+
+  istanbul-reports@3.1.6:
+    dependencies:
+      html-escaper: 2.0.2
+      istanbul-lib-report: 3.0.1
+
+  jest-changed-files@29.7.0:
+    dependencies:
+      execa: 5.1.1
+      jest-util: 29.7.0
+      p-limit: 3.1.0
+
+  jest-circus@29.7.0:
+    dependencies:
+      '@jest/environment': 29.7.0
+      '@jest/expect': 29.7.0
+      '@jest/test-result': 29.7.0
+      '@jest/types': 29.6.3
+      '@types/node': 20.19.11
+      chalk: 4.1.2
+      co: 4.6.0
+      dedent: 1.5.1
+      is-generator-fn: 2.1.0
+      jest-each: 29.7.0
+      jest-matcher-utils: 29.7.0
+      jest-message-util: 29.7.0
+      jest-runtime: 29.7.0
+      jest-snapshot: 29.7.0
+      jest-util: 29.7.0
+      p-limit: 3.1.0
+      pretty-format: 29.7.0
+      pure-rand: 6.0.4
+      slash: 3.0.0
+      stack-utils: 2.0.6
+    transitivePeerDependencies:
+      - babel-plugin-macros
+      - supports-color
+
+  jest-cli@29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3)):
+    dependencies:
+      '@jest/core': 29.7.0(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3))
+      '@jest/test-result': 29.7.0
+      '@jest/types': 29.6.3
+      chalk: 4.1.2
+      create-jest: 29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3))
+      exit: 0.1.2
+      import-local: 3.1.0
+      jest-config: 29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3))
+      jest-util: 29.7.0
+      jest-validate: 29.7.0
+      yargs: 17.7.2
+    transitivePeerDependencies:
+      - '@types/node'
+      - babel-plugin-macros
+      - supports-color
+      - ts-node
+
+  jest-config@29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3)):
+    dependencies:
+      '@babel/core': 7.23.6
+      '@jest/test-sequencer': 29.7.0
+      '@jest/types': 29.6.3
+      babel-jest: 29.7.0(@babel/core@7.23.6)
+      chalk: 4.1.2
+      ci-info: 3.9.0
+      deepmerge: 4.3.1
+      glob: 7.2.3
+      graceful-fs: 4.2.11
+      jest-circus: 29.7.0
+      jest-environment-node: 29.7.0
+      jest-get-type: 29.6.3
+      jest-regex-util: 29.6.3
+      jest-resolve: 29.7.0
+      jest-runner: 29.7.0
+      jest-util: 29.7.0
+      jest-validate: 29.7.0
+      micromatch: 4.0.8
+      parse-json: 5.2.0
+      pretty-format: 29.7.0
+      slash: 3.0.0
+      strip-json-comments: 3.1.1
+    optionalDependencies:
+      '@types/node': 20.19.11
+      ts-node: 10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3)
+    transitivePeerDependencies:
+      - babel-plugin-macros
+      - supports-color
+
+  jest-diff@29.7.0:
+    dependencies:
+      chalk: 4.1.2
+      diff-sequences: 29.6.3
+      jest-get-type: 29.6.3
+      pretty-format: 29.7.0
+
+  jest-docblock@29.7.0:
+    dependencies:
+      detect-newline: 3.1.0
+
+  jest-each@29.7.0:
+    dependencies:
+      '@jest/types': 29.6.3
+      chalk: 4.1.2
+      jest-get-type: 29.6.3
+      jest-util: 29.7.0
+      pretty-format: 29.7.0
+
+  jest-environment-node@29.7.0:
+    dependencies:
+      '@jest/environment': 29.7.0
+      '@jest/fake-timers': 29.7.0
+      '@jest/types': 29.6.3
+      '@types/node': 20.19.11
+      jest-mock: 29.7.0
+      jest-util: 29.7.0
+
+  jest-get-type@29.6.3: {}
+
+  jest-haste-map@29.7.0:
+    dependencies:
+      '@jest/types': 29.6.3
+      '@types/graceful-fs': 4.1.9
+      '@types/node': 20.19.11
+      anymatch: 3.1.3
+      fb-watchman: 2.0.2
+      graceful-fs: 4.2.11
+      jest-regex-util: 29.6.3
+      jest-util: 29.7.0
+      jest-worker: 29.7.0
+      micromatch: 4.0.8
+      walker: 1.0.8
+    optionalDependencies:
+      fsevents: 2.3.3
+
+  jest-leak-detector@29.7.0:
+    dependencies:
+      jest-get-type: 29.6.3
+      pretty-format: 29.7.0
+
+  jest-matcher-utils@29.7.0:
+    dependencies:
+      chalk: 4.1.2
+      jest-diff: 29.7.0
+      jest-get-type: 29.6.3
+      pretty-format: 29.7.0
+
+  jest-message-util@29.7.0:
+    dependencies:
+      '@babel/code-frame': 7.23.5
+      '@jest/types': 29.6.3
+      '@types/stack-utils': 2.0.3
+      chalk: 4.1.2
+      graceful-fs: 4.2.11
+      micromatch: 4.0.8
+      pretty-format: 29.7.0
+      slash: 3.0.0
+      stack-utils: 2.0.6
+
+  jest-mock@29.7.0:
+    dependencies:
+      '@jest/types': 29.6.3
+      '@types/node': 20.19.11
+      jest-util: 29.7.0
+
+  jest-pnp-resolver@1.2.3(jest-resolve@29.7.0):
+    optionalDependencies:
+      jest-resolve: 29.7.0
+
+  jest-regex-util@29.6.3: {}
+
+  jest-resolve-dependencies@29.7.0:
+    dependencies:
+      jest-regex-util: 29.6.3
+      jest-snapshot: 29.7.0
+    transitivePeerDependencies:
+      - supports-color
+
+  jest-resolve@29.7.0:
+    dependencies:
+      chalk: 4.1.2
+      graceful-fs: 4.2.11
+      jest-haste-map: 29.7.0
+      jest-pnp-resolver: 1.2.3(jest-resolve@29.7.0)
+      jest-util: 29.7.0
+      jest-validate: 29.7.0
+      resolve: 1.22.8
+      resolve.exports: 2.0.2
+      slash: 3.0.0
+
+  jest-runner@29.7.0:
+    dependencies:
+      '@jest/console': 29.7.0
+      '@jest/environment': 29.7.0
+      '@jest/test-result': 29.7.0
+      '@jest/transform': 29.7.0
+      '@jest/types': 29.6.3
+      '@types/node': 20.19.11
+      chalk: 4.1.2
+      emittery: 0.13.1
+      graceful-fs: 4.2.11
+      jest-docblock: 29.7.0
+      jest-environment-node: 29.7.0
+      jest-haste-map: 29.7.0
+      jest-leak-detector: 29.7.0
+      jest-message-util: 29.7.0
+      jest-resolve: 29.7.0
+      jest-runtime: 29.7.0
+      jest-util: 29.7.0
+      jest-watcher: 29.7.0
+      jest-worker: 29.7.0
+      p-limit: 3.1.0
+      source-map-support: 0.5.13
+    transitivePeerDependencies:
+      - supports-color
+
+  jest-runtime@29.7.0:
+    dependencies:
+      '@jest/environment': 29.7.0
+      '@jest/fake-timers': 29.7.0
+      '@jest/globals': 29.7.0
+      '@jest/source-map': 29.6.3
+      '@jest/test-result': 29.7.0
+      '@jest/transform': 29.7.0
+      '@jest/types': 29.6.3
+      '@types/node': 20.19.11
+      chalk: 4.1.2
+      cjs-module-lexer: 1.4.1
+      collect-v8-coverage: 1.0.2
+      glob: 7.2.3
+      graceful-fs: 4.2.11
+      jest-haste-map: 29.7.0
+      jest-message-util: 29.7.0
+      jest-mock: 29.7.0
+      jest-regex-util: 29.6.3
+      jest-resolve: 29.7.0
+      jest-snapshot: 29.7.0
+      jest-util: 29.7.0
+      slash: 3.0.0
+      strip-bom: 4.0.0
+    transitivePeerDependencies:
+      - supports-color
+
+  jest-snapshot@29.7.0:
+    dependencies:
+      '@babel/core': 7.23.6
+      '@babel/generator': 7.23.6
+      '@babel/plugin-syntax-jsx': 7.23.3(@babel/core@7.23.6)
+      '@babel/plugin-syntax-typescript': 7.23.3(@babel/core@7.23.6)
+      '@babel/types': 7.23.6
+      '@jest/expect-utils': 29.7.0
+      '@jest/transform': 29.7.0
+      '@jest/types': 29.6.3
+      babel-preset-current-node-syntax: 1.0.1(@babel/core@7.23.6)
+      chalk: 4.1.2
+      expect: 29.7.0
+      graceful-fs: 4.2.11
+      jest-diff: 29.7.0
+      jest-get-type: 29.6.3
+      jest-matcher-utils: 29.7.0
+      jest-message-util: 29.7.0
+      jest-util: 29.7.0
+      natural-compare: 1.4.0
+      pretty-format: 29.7.0
+      semver: 7.7.1
+    transitivePeerDependencies:
+      - supports-color
+
+  jest-util@29.7.0:
+    dependencies:
+      '@jest/types': 29.6.3
+      '@types/node': 20.19.11
+      chalk: 4.1.2
+      ci-info: 3.9.0
+      graceful-fs: 4.2.11
+      picomatch: 2.3.1
+
+  jest-validate@29.7.0:
+    dependencies:
+      '@jest/types': 29.6.3
+      camelcase: 6.3.0
+      chalk: 4.1.2
+      jest-get-type: 29.6.3
+      leven: 3.1.0
+      pretty-format: 29.7.0
+
+  jest-watcher@29.7.0:
+    dependencies:
+      '@jest/test-result': 29.7.0
+      '@jest/types': 29.6.3
+      '@types/node': 20.19.11
+      ansi-escapes: 4.3.2
+      chalk: 4.1.2
+      emittery: 0.13.1
+      jest-util: 29.7.0
+      string-length: 4.0.2
+
+  jest-worker@29.7.0:
+    dependencies:
+      '@types/node': 20.19.11
+      jest-util: 29.7.0
+      merge-stream: 2.0.0
+      supports-color: 8.1.1
+
+  jest@29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3)):
+    dependencies:
+      '@jest/core': 29.7.0(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3))
+      '@jest/types': 29.6.3
+      import-local: 3.1.0
+      jest-cli: 29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3))
+    transitivePeerDependencies:
+      - '@types/node'
+      - babel-plugin-macros
+      - supports-color
+      - ts-node
+
+  js-tokens@4.0.0: {}
+
+  js-yaml@3.14.2:
+    dependencies:
+      argparse: 1.0.10
+      esprima: 4.0.1
+
+  js-yaml@4.1.1:
+    dependencies:
+      argparse: 2.0.1
+
+  jsesc@2.5.2: {}
+
+  json-buffer@3.0.1: {}
+
+  json-parse-even-better-errors@2.3.1: {}
+
+  json-schema-traverse@0.4.1: {}
+
+  json-stable-stringify-without-jsonify@1.0.1: {}
+
+  json5@2.2.3: {}
+
+  jsonc-parser@3.2.1: {}
+
+  keyv@4.5.4:
+    dependencies:
+      json-buffer: 3.0.1
+
+  kleur@3.0.3: {}
+
+  leven@3.1.0: {}
+
+  levn@0.4.1:
+    dependencies:
+      prelude-ls: 1.2.1
+      type-check: 0.4.0
+
+  lines-and-columns@1.2.4: {}
+
+  locate-path@5.0.0:
+    dependencies:
+      p-locate: 4.1.0
+
+  locate-path@6.0.0:
+    dependencies:
+      p-locate: 5.0.0
+
+  lodash.memoize@4.1.2: {}
+
+  lodash.merge@4.6.2: {}
+
+  lru-cache@10.4.3: {}
+
+  lru-cache@5.1.1:
+    dependencies:
+      yallist: 3.1.1
+
+  make-dir@4.0.0:
+    dependencies:
+      semver: 7.7.1
+
+  make-error@1.3.6: {}
+
+  makeerror@1.0.12:
+    dependencies:
+      tmpl: 1.0.5
+
+  marked-terminal@7.2.1(marked@9.1.6):
+    dependencies:
+      ansi-escapes: 7.0.0
+      ansi-regex: 6.1.0
+      chalk: 5.3.0
+      cli-highlight: 2.1.11
+      cli-table3: 0.6.5
+      marked: 9.1.6
+      node-emoji: 2.1.3
+      supports-hyperlinks: 3.1.0
+
+  marked@9.1.6: {}
+
+  merge-stream@2.0.0: {}
+
+  merge2@1.4.1: {}
+
+  micromatch@4.0.8:
+    dependencies:
+      braces: 3.0.3
+      picomatch: 2.3.1
+
+  mimic-fn@2.1.0: {}
+
+  minimatch@3.1.2:
+    dependencies:
+      brace-expansion: 1.1.12
+
+  minimatch@5.1.6:
+    dependencies:
+      brace-expansion: 2.0.2
+
+  minimatch@9.0.5:
+    dependencies:
+      brace-expansion: 2.0.1
+
+  minimist@1.2.6: {}
+
+  mri@1.2.0: {}
+
+  ms@2.1.3: {}
+
+  mz@2.7.0:
+    dependencies:
+      any-promise: 1.3.0
+      object-assign: 4.1.1
+      thenify-all: 1.6.0
+
+  natural-compare@1.4.0: {}
+
+  node-emoji@2.1.3:
+    dependencies:
+      '@sindresorhus/is': 4.6.0
+      char-regex: 1.0.2
+      emojilib: 2.4.0
+      skin-tone: 2.0.0
+
+  node-int64@0.4.0: {}
+
+  node-releases@2.0.14: {}
+
+  normalize-path@3.0.0: {}
+
+  npm-bundled@2.0.1:
+    dependencies:
+      npm-normalize-package-bin: 2.0.0
+
+  npm-normalize-package-bin@2.0.0: {}
+
+  npm-packlist@5.1.3:
+    dependencies:
+      glob: 8.1.0
+      ignore-walk: 5.0.1
+      npm-bundled: 2.0.1
+      npm-normalize-package-bin: 2.0.0
+
+  npm-run-path@4.0.1:
+    dependencies:
+      path-key: 3.1.1
+
+  object-assign@4.1.1: {}
+
+  once@1.4.0:
+    dependencies:
+      wrappy: 1.0.2
+
+  onetime@5.1.2:
+    dependencies:
+      mimic-fn: 2.1.0
+
+  optionator@0.9.4:
+    dependencies:
+      deep-is: 0.1.4
+      fast-levenshtein: 2.0.6
+      levn: 0.4.1
+      prelude-ls: 1.2.1
+      type-check: 0.4.0
+      word-wrap: 1.2.5
+
+  p-all@3.0.0:
+    dependencies:
+      p-map: 4.0.0
+
+  p-limit@2.3.0:
+    dependencies:
+      p-try: 2.2.0
+
+  p-limit@3.1.0:
+    dependencies:
+      yocto-queue: 0.1.0
+
+  p-locate@4.1.0:
+    dependencies:
+      p-limit: 2.3.0
+
+  p-locate@5.0.0:
+    dependencies:
+      p-limit: 3.1.0
+
+  p-map@4.0.0:
+    dependencies:
+      aggregate-error: 3.1.0
+
+  p-try@2.2.0: {}
+
+  parent-module@1.0.1:
+    dependencies:
+      callsites: 3.1.0
+
+  parse-json@5.2.0:
+    dependencies:
+      '@babel/code-frame': 7.23.5
+      error-ex: 1.3.2
+      json-parse-even-better-errors: 2.3.1
+      lines-and-columns: 1.2.4
+
+  parse5-htmlparser2-tree-adapter@6.0.1:
+    dependencies:
+      parse5: 6.0.1
+
+  parse5@5.1.1: {}
+
+  parse5@6.0.1: {}
+
+  path-exists@4.0.0: {}
+
+  path-is-absolute@1.0.1: {}
+
+  path-key@3.1.1: {}
+
+  path-parse@1.0.7: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@2.3.1: {}
+
+  pirates@4.0.6: {}
+
+  pkg-dir@4.2.0:
+    dependencies:
+      find-up: 4.1.0
+
+  prelude-ls@1.2.1: {}
+
+  prettier-linter-helpers@1.0.0:
+    dependencies:
+      fast-diff: 1.3.0
+
+  prettier@3.1.1: {}
+
+  pretty-format@29.7.0:
+    dependencies:
+      '@jest/schemas': 29.6.3
+      ansi-styles: 5.2.0
+      react-is: 18.2.0
+
+  prompts@2.4.2:
+    dependencies:
+      kleur: 3.0.3
+      sisteransi: 1.0.5
+
+  publint@0.2.12:
+    dependencies:
+      npm-packlist: 5.1.3
+      picocolors: 1.1.1
+      sade: 1.8.1
+
+  punycode@2.3.1: {}
+
+  pure-rand@6.0.4: {}
+
+  queue-microtask@1.2.3: {}
+
+  react-is@18.2.0: {}
+
+  readable-stream@3.6.2:
+    dependencies:
+      inherits: 2.0.4
+      string_decoder: 1.3.0
+      util-deprecate: 1.0.2
+
+  require-directory@2.1.1: {}
+
+  resolve-cwd@3.0.0:
+    dependencies:
+      resolve-from: 5.0.0
+
+  resolve-from@4.0.0: {}
+
+  resolve-from@5.0.0: {}
+
+  resolve.exports@2.0.2: {}
+
+  resolve@1.22.8:
+    dependencies:
+      is-core-module: 2.13.1
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+
+  reusify@1.0.4: {}
+
+  run-parallel@1.2.0:
+    dependencies:
+      queue-microtask: 1.2.3
+
+  sade@1.8.1:
+    dependencies:
+      mri: 1.2.0
+
+  safe-buffer@5.2.1: {}
+
+  safer-buffer@2.1.2: {}
+
+  semver@6.3.1: {}
+
+  semver@7.7.1: {}
+
+  shebang-command@2.0.0:
+    dependencies:
+      shebang-regex: 3.0.0
+
+  shebang-regex@3.0.0: {}
+
+  signal-exit@3.0.7: {}
+
+  sisteransi@1.0.5: {}
+
+  skin-tone@2.0.0:
+    dependencies:
+      unicode-emoji-modifier-base: 1.0.0
+
+  slash@3.0.0: {}
+
+  source-map-support@0.5.13:
+    dependencies:
+      buffer-from: 1.1.2
+      source-map: 0.6.1
+
+  source-map@0.6.1: {}
+
+  sprintf-js@1.0.3: {}
+
+  stack-utils@2.0.6:
+    dependencies:
+      escape-string-regexp: 2.0.0
+
+  string-length@4.0.2:
+    dependencies:
+      char-regex: 1.0.2
+      strip-ansi: 6.0.1
+
+  string-to-stream@3.0.1:
+    dependencies:
+      readable-stream: 3.6.2
+
+  string-width@4.2.3:
+    dependencies:
+      emoji-regex: 8.0.0
+      is-fullwidth-code-point: 3.0.0
+      strip-ansi: 6.0.1
+
+  string_decoder@1.3.0:
+    dependencies:
+      safe-buffer: 5.2.1
+
+  strip-ansi@6.0.1:
+    dependencies:
+      ansi-regex: 5.0.1
+
+  strip-bom@3.0.0: {}
+
+  strip-bom@4.0.0: {}
+
+  strip-final-newline@2.0.0: {}
+
+  strip-json-comments@3.1.1: {}
+
+  superstruct@1.0.4: {}
+
+  supports-color@5.5.0:
+    dependencies:
+      has-flag: 3.0.0
+
+  supports-color@7.2.0:
+    dependencies:
+      has-flag: 4.0.0
+
+  supports-color@8.1.1:
+    dependencies:
+      has-flag: 4.0.0
+
+  supports-hyperlinks@3.1.0:
+    dependencies:
+      has-flag: 4.0.0
+      supports-color: 7.2.0
+
+  supports-preserve-symlinks-flag@1.0.0: {}
+
+  synckit@0.11.8:
+    dependencies:
+      '@pkgr/core': 0.2.4
+
+  test-exclude@6.0.0:
+    dependencies:
+      '@istanbuljs/schema': 0.1.3
+      glob: 7.2.3
+      minimatch: 3.1.2
+
+  thenify-all@1.6.0:
+    dependencies:
+      thenify: 3.3.1
+
+  thenify@3.3.1:
+    dependencies:
+      any-promise: 1.3.0
+
+  tmpl@1.0.5: {}
+
+  to-fast-properties@2.0.0: {}
+
+  to-regex-range@5.0.1:
+    dependencies:
+      is-number: 7.0.0
+
+  ts-api-utils@2.0.1(typescript@5.8.3):
+    dependencies:
+      typescript: 5.8.3
+
+  ts-jest@29.1.1(@babel/core@7.23.6)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.23.6))(jest@29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3)))(typescript@5.8.3):
+    dependencies:
+      bs-logger: 0.2.6
+      fast-json-stable-stringify: 2.1.0
+      jest: 29.7.0(@types/node@20.19.11)(ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3))
+      jest-util: 29.7.0
+      json5: 2.2.3
+      lodash.memoize: 4.1.2
+      make-error: 1.3.6
+      semver: 7.7.1
+      typescript: 5.8.3
+      yargs-parser: 21.1.1
+    optionalDependencies:
+      '@babel/core': 7.23.6
+      '@jest/types': 29.6.3
+      babel-jest: 29.7.0(@babel/core@7.23.6)
+
+  ts-node@10.7.0(@swc/core@1.4.16)(@types/node@20.19.11)(typescript@5.8.3):
+    dependencies:
+      '@cspotcode/source-map-support': 0.7.0
+      '@tsconfig/node10': 1.0.8
+      '@tsconfig/node12': 1.0.9
+      '@tsconfig/node14': 1.0.1
+      '@tsconfig/node16': 1.0.2
+      '@types/node': 20.19.11
+      acorn: 8.14.0
+      acorn-walk: 8.2.0
+      arg: 4.1.3
+      create-require: 1.1.1
+      diff: 4.0.2
+      make-error: 1.3.6
+      typescript: 5.8.3
+      v8-compile-cache-lib: 3.0.0
+      yn: 3.1.1
+    optionalDependencies:
+      '@swc/core': 1.4.16
+
+  tsc-multi@https://github.com/stainless-api/tsc-multi/releases/download/v1.1.9/tsc-multi.tgz(typescript@5.8.3):
+    dependencies:
+      debug: 4.4.1
+      fast-glob: 3.3.2
+      get-stdin: 8.0.0
+      p-all: 3.0.0
+      picocolors: 1.1.1
+      signal-exit: 3.0.7
+      string-to-stream: 3.0.1
+      superstruct: 1.0.4
+      tslib: 2.8.1
+      typescript: 5.8.3
+      yargs: 17.7.2
+    transitivePeerDependencies:
+      - supports-color
+
+  tsconfig-paths@4.2.0:
+    dependencies:
+      json5: 2.2.3
+      minimist: 1.2.6
+      strip-bom: 3.0.0
+
+  tslib@2.8.1: {}
+
+  type-check@0.4.0:
+    dependencies:
+      prelude-ls: 1.2.1
+
+  type-detect@4.0.8: {}
+
+  type-fest@0.21.3: {}
+
+  typescript-eslint@8.31.1(eslint@9.39.1)(typescript@5.8.3):
+    dependencies:
+      '@typescript-eslint/eslint-plugin': 8.31.1(@typescript-eslint/parser@8.31.1(eslint@9.39.1)(typescript@5.8.3))(eslint@9.39.1)(typescript@5.8.3)
+      '@typescript-eslint/parser': 8.31.1(eslint@9.39.1)(typescript@5.8.3)
+      '@typescript-eslint/utils': 8.31.1(eslint@9.39.1)(typescript@5.8.3)
+      eslint: 9.39.1
+      typescript: 5.8.3
+    transitivePeerDependencies:
+      - supports-color
+
+  typescript@5.6.1-rc: {}
+
+  typescript@5.8.3: {}
+
+  undici-types@6.21.0: {}
+
+  unicode-emoji-modifier-base@1.0.0: {}
+
+  update-browserslist-db@1.0.13(browserslist@4.22.2):
+    dependencies:
+      browserslist: 4.22.2
+      escalade: 3.1.1
+      picocolors: 1.1.1
+
+  uri-js@4.4.1:
+    dependencies:
+      punycode: 2.3.1
+
+  util-deprecate@1.0.2: {}
+
+  v8-compile-cache-lib@3.0.0: {}
+
+  v8-to-istanbul@9.2.0:
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.20
+      '@types/istanbul-lib-coverage': 2.0.6
+      convert-source-map: 2.0.0
+
+  validate-npm-package-name@5.0.1: {}
+
+  walker@1.0.8:
+    dependencies:
+      makeerror: 1.0.12
+
+  which@2.0.2:
+    dependencies:
+      isexe: 2.0.0
+
+  word-wrap@1.2.5: {}
+
+  wrap-ansi@7.0.0:
+    dependencies:
+      ansi-styles: 4.3.0
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+
+  wrappy@1.0.2: {}
+
+  write-file-atomic@4.0.2:
+    dependencies:
+      imurmurhash: 0.1.4
+      signal-exit: 3.0.7
+
+  ws@8.18.3: {}
+
+  y18n@5.0.8: {}
+
+  yallist@3.1.1: {}
+
+  yargs-parser@20.2.9: {}
+
+  yargs-parser@21.1.1: {}
+
+  yargs@16.2.0:
+    dependencies:
+      cliui: 7.0.4
+      escalade: 3.1.1
+      get-caller-file: 2.0.5
+      require-directory: 2.1.1
+      string-width: 4.2.3
+      y18n: 5.0.8
+      yargs-parser: 20.2.9
+
+  yargs@17.7.2:
+    dependencies:
+      cliui: 8.0.1
+      escalade: 3.1.1
+      get-caller-file: 2.0.5
+      require-directory: 2.1.1
+      string-width: 4.2.3
+      y18n: 5.0.8
+      yargs-parser: 21.1.1
+
+  yn@3.1.1: {}
+
+  yocto-queue@0.1.0: {}
diff --git a/sdks/ts/pnpm-workspace.yaml b/sdks/ts/pnpm-workspace.yaml
new file mode 100644
index 00000000..ef58d28a
--- /dev/null
+++ b/sdks/ts/pnpm-workspace.yaml
@@ -0,0 +1,5 @@
+onlyBuiltDependencies:
+  - '@swc/core'
+minimumReleaseAge: 1440
+minimumReleaseAgeExclude:
+  - '@onkernel/hypeman'
diff --git a/sdks/ts/release-please-config.json b/sdks/ts/release-please-config.json
new file mode 100644
index 00000000..1ebd0bde
--- /dev/null
+++ b/sdks/ts/release-please-config.json
@@ -0,0 +1,64 @@
+{
+  "packages": {
+    ".": {}
+  },
+  "$schema": "https://raw.githubusercontent.com/stainless-api/release-please/main/schemas/config.json",
+  "include-v-in-tag": true,
+  "include-component-in-tag": false,
+  "versioning": "prerelease",
+  "prerelease": true,
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": false,
+  "pull-request-header": "Automated Release PR",
+  "pull-request-title-pattern": "release: ${version}",
+  "changelog-sections": [
+    {
+      "type": "feat",
+      "section": "Features"
+    },
+    {
+      "type": "fix",
+      "section": "Bug Fixes"
+    },
+    {
+      "type": "perf",
+      "section": "Performance Improvements"
+    },
+    {
+      "type": "revert",
+      "section": "Reverts"
+    },
+    {
+      "type": "chore",
+      "section": "Chores"
+    },
+    {
+      "type": "docs",
+      "section": "Documentation"
+    },
+    {
+      "type": "style",
+      "section": "Styles"
+    },
+    {
+      "type": "refactor",
+      "section": "Refactors"
+    },
+    {
+      "type": "test",
+      "section": "Tests",
+      "hidden": true
+    },
+    {
+      "type": "build",
+      "section": "Build System"
+    },
+    {
+      "type": "ci",
+      "section": "Continuous Integration",
+      "hidden": true
+    }
+  ],
+  "release-type": "node",
+  "extra-files": ["src/version.ts", "README.md"]
+}
diff --git a/sdks/ts/scripts/bootstrap b/sdks/ts/scripts/bootstrap
new file mode 100755
index 00000000..2bb3c941
--- /dev/null
+++ b/sdks/ts/scripts/bootstrap
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+if [ -f "Brewfile" ] && [ "$(uname -s)" = "Darwin" ] && [ "$SKIP_BREW" != "1" ] && [ -t 0 ]; then
+  brew bundle check >/dev/null 2>&1 || {
+    echo -n "==> Install Homebrew dependencies? (y/N): "
+    read -r response
+    case "$response" in
+      [yY][eE][sS]|[yY])
+        brew bundle
+        ;;
+      *)
+        ;;
+    esac
+    echo
+  }
+fi
+
+echo "==> Installing Node dependencies…"
+
+PACKAGE_MANAGER=$(command -v pnpm >/dev/null 2>&1 && echo "pnpm" || echo "npm")
+
+$PACKAGE_MANAGER install "$@"
diff --git a/sdks/ts/scripts/build b/sdks/ts/scripts/build
new file mode 100755
index 00000000..eeb39b36
--- /dev/null
+++ b/sdks/ts/scripts/build
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+set -exuo pipefail
+
+cd "$(dirname "$0")/.."
+
+node scripts/utils/check-version.cjs
+
+# Build into dist and will publish the package from there,
+# so that src/resources/foo.ts becomes <package root>/resources/foo.js
+# This way importing from `"@onkernel/hypeman/resources/foo"` works
+# even with `"moduleResolution": "node"`
+
+rm -rf dist; mkdir dist
+# Copy src to dist/src and build from dist/src into dist, so that
+# the source map for index.js.map will refer to ./src/index.ts etc
+cp -rp src README.md dist
+for file in LICENSE CHANGELOG.md; do
+  if [ -e "${file}" ]; then cp "${file}" dist; fi
+done
+if [ -e "bin/cli" ]; then
+  mkdir -p dist/bin
+  cp -p "bin/cli" dist/bin/;
+fi
+if [ -e "bin/migration-config.json" ]; then
+  mkdir -p dist/bin
+  cp -p "bin/migration-config.json" dist/bin/;
+fi
+# this converts the export map paths for the dist directory
+# and does a few other minor things
+node scripts/utils/make-dist-package-json.cjs > dist/package.json
+
+# build to .js/.mjs/.d.ts files
+./node_modules/.bin/tsc-multi
+# we need to patch index.js so that `new module.exports()` works for cjs backwards
+# compat. No way to get that from index.ts because it would cause compile errors
+# when building .mjs
+node scripts/utils/fix-index-exports.cjs
+cp tsconfig.dist-src.json dist/src/tsconfig.json
+
+node scripts/utils/postprocess-files.cjs
+
+# make sure that nothing crashes when we require the output CJS or
+# import the output ESM
+(cd dist && node -e 'require("@onkernel/hypeman")')
+(cd dist && node -e 'import("@onkernel/hypeman")' --input-type=module)
+
+if [ -e ./scripts/build-deno ]
+then
+  ./scripts/build-deno
+fi
diff --git a/sdks/ts/scripts/fast-format b/sdks/ts/scripts/fast-format
new file mode 100755
index 00000000..53721ac0
--- /dev/null
+++ b/sdks/ts/scripts/fast-format
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo "Script started with $# arguments"
+echo "Arguments: $*"
+echo "Script location: $(dirname "$0")"
+
+cd "$(dirname "$0")/.."
+echo "Changed to directory: $(pwd)"
+
+if [ $# -eq 0 ]; then
+    echo "Usage: $0 <file-with-paths> [additional-formatter-args...]"
+    echo "The file should contain one file path per line"
+    exit 1
+fi
+
+FILE_LIST="$1"
+
+echo "Looking for file: $FILE_LIST"
+
+if [ ! -f "$FILE_LIST" ]; then
+    echo "Error: File '$FILE_LIST' not found"
+    exit 1
+fi
+
+echo "==> Running eslint --fix"
+ESLINT_FILES="$(grep '\.ts$' "$FILE_LIST" || true)"
+if ! [ -z "$ESLINT_FILES" ]; then
+   echo "$ESLINT_FILES" | xargs ./node_modules/.bin/eslint --cache --fix
+fi
+
+echo "==> Running prettier --write"
+# format things eslint didn't
+PRETTIER_FILES="$(grep '\.\(js\|json\)$' "$FILE_LIST" || true)"
+if ! [ -z "$PRETTIER_FILES" ]; then
+   echo "$PRETTIER_FILES" | xargs ./node_modules/.bin/prettier \
+      --write --cache --cache-strategy metadata --no-error-on-unmatched-pattern \
+      '!**/dist' '!**/*.ts' '!**/*.mts' '!**/*.cts' '!**/*.js' '!**/*.mjs' '!**/*.cjs'
+fi
diff --git a/sdks/ts/scripts/format b/sdks/ts/scripts/format
new file mode 100755
index 00000000..7a756401
--- /dev/null
+++ b/sdks/ts/scripts/format
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+echo "==> Running eslint --fix"
+./node_modules/.bin/eslint --fix .
+
+echo "==> Running prettier --write"
+# format things eslint didn't
+./node_modules/.bin/prettier --write --cache --cache-strategy metadata . '!**/dist' '!**/*.ts' '!**/*.mts' '!**/*.cts' '!**/*.js' '!**/*.mjs' '!**/*.cjs'
diff --git a/sdks/ts/scripts/lint b/sdks/ts/scripts/lint
new file mode 100755
index 00000000..3ffb78a6
--- /dev/null
+++ b/sdks/ts/scripts/lint
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+echo "==> Running eslint"
+./node_modules/.bin/eslint .
+
+echo "==> Building"
+./scripts/build
+
+echo "==> Checking types"
+./node_modules/typescript/bin/tsc
+
+echo "==> Running Are The Types Wrong?"
+./node_modules/.bin/attw --pack dist -f json >.attw.json || true
+node scripts/utils/attw-report.cjs
+
+echo "==> Running publint"
+./node_modules/.bin/publint dist
diff --git a/sdks/ts/scripts/mock b/sdks/ts/scripts/mock
new file mode 100755
index 00000000..0b28f6ea
--- /dev/null
+++ b/sdks/ts/scripts/mock
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+if [[ -n "$1" && "$1" != '--'* ]]; then
+  URL="$1"
+  shift
+else
+  URL="$(grep 'openapi_spec_url' .stats.yml | cut -d' ' -f2)"
+fi
+
+# Check if the URL is empty
+if [ -z "$URL" ]; then
+  echo "Error: No OpenAPI spec path/url provided or found in .stats.yml"
+  exit 1
+fi
+
+echo "==> Starting mock server with URL ${URL}"
+
+# Run prism mock on the given spec
+if [ "$1" == "--daemon" ]; then
+  npm exec --package=@stainless-api/prism-cli@5.15.0 -- prism mock "$URL" &> .prism.log &
+
+  # Wait for server to come online
+  echo -n "Waiting for server"
+  while ! grep -q "✖  fatal\|Prism is listening" ".prism.log" ; do
+    echo -n "."
+    sleep 0.1
+  done
+
+  if grep -q "✖  fatal" ".prism.log"; then
+    cat .prism.log
+    exit 1
+  fi
+
+  echo
+else
+  npm exec --package=@stainless-api/prism-cli@5.15.0 -- prism mock "$URL"
+fi
diff --git a/sdks/ts/scripts/test b/sdks/ts/scripts/test
new file mode 100755
index 00000000..7bce0516
--- /dev/null
+++ b/sdks/ts/scripts/test
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[0;33m'
+NC='\033[0m' # No Color
+
+function prism_is_running() {
+  curl --silent "http://localhost:4010" >/dev/null 2>&1
+}
+
+kill_server_on_port() {
+  pids=$(lsof -t -i tcp:"$1" || echo "")
+  if [ "$pids" != "" ]; then
+    kill "$pids"
+    echo "Stopped $pids."
+  fi
+}
+
+function is_overriding_api_base_url() {
+  [ -n "$TEST_API_BASE_URL" ]
+}
+
+if ! is_overriding_api_base_url && ! prism_is_running ; then
+  # When we exit this script, make sure to kill the background mock server process
+  trap 'kill_server_on_port 4010' EXIT
+
+  # Start the dev server
+  ./scripts/mock --daemon
+fi
+
+if is_overriding_api_base_url ; then
+  echo -e "${GREEN}✔ Running tests against ${TEST_API_BASE_URL}${NC}"
+  echo
+elif ! prism_is_running ; then
+  echo -e "${RED}ERROR:${NC} The test suite will not run without a mock Prism server"
+  echo -e "running against your OpenAPI spec."
+  echo
+  echo -e "To run the server, pass in the path or url of your OpenAPI"
+  echo -e "spec to the prism command:"
+  echo
+  echo -e "  \$ ${YELLOW}npm exec --package=@stainless-api/prism-cli@5.15.0 -- prism mock path/to/your.openapi.yml${NC}"
+  echo
+
+  exit 1
+else
+  echo -e "${GREEN}✔ Mock prism server is running with your OpenAPI spec${NC}"
+  echo
+fi
+
+echo "==> Running tests"
+./node_modules/.bin/jest "$@"
diff --git a/sdks/ts/scripts/utils/attw-report.cjs b/sdks/ts/scripts/utils/attw-report.cjs
new file mode 100644
index 00000000..b3477c0e
--- /dev/null
+++ b/sdks/ts/scripts/utils/attw-report.cjs
@@ -0,0 +1,24 @@
+const fs = require('fs');
+const problems = Object.values(JSON.parse(fs.readFileSync('.attw.json', 'utf-8')).problems)
+  .flat()
+  .filter(
+    (problem) =>
+      !(
+        // This is intentional, if the user specifies .mjs they get ESM.
+        (
+          (problem.kind === 'CJSResolvesToESM' && problem.entrypoint.endsWith('.mjs')) ||
+          // This is intentional for backwards compat reasons.
+          (problem.kind === 'MissingExportEquals' && problem.implementationFileName.endsWith('/index.js')) ||
+          // this is intentional, we deliberately attempt to import types that may not exist from parent node_modules
+          // folders to better support various runtimes without triggering automatic type acquisition.
+          (problem.kind === 'InternalResolutionError' && problem.moduleSpecifier.includes('node_modules'))
+        )
+      ),
+  );
+fs.unlinkSync('.attw.json');
+if (problems.length) {
+  process.stdout.write('The types are wrong!\n' + JSON.stringify(problems, null, 2) + '\n');
+  process.exitCode = 1;
+} else {
+  process.stdout.write('Types ok!\n');
+}
diff --git a/sdks/ts/scripts/utils/check-is-in-git-install.sh b/sdks/ts/scripts/utils/check-is-in-git-install.sh
new file mode 100755
index 00000000..1354eb43
--- /dev/null
+++ b/sdks/ts/scripts/utils/check-is-in-git-install.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Check if you happen to call prepare for a repository that's already in node_modules.
+[ "$(basename "$(dirname "$PWD")")" = 'node_modules' ] ||
+# The name of the containing directory that 'npm` uses, which looks like
+# $HOME/.npm/_cacache/git-cloneXXXXXX
+[ "$(basename "$(dirname "$PWD")")" = 'tmp' ] ||
+# The name of the containing directory that 'yarn` uses, which looks like
+# $(yarn cache dir)/.tmp/XXXXX
+[ "$(basename "$(dirname "$PWD")")" = '.tmp' ]
diff --git a/sdks/ts/scripts/utils/check-version.cjs b/sdks/ts/scripts/utils/check-version.cjs
new file mode 100644
index 00000000..86c56dfd
--- /dev/null
+++ b/sdks/ts/scripts/utils/check-version.cjs
@@ -0,0 +1,20 @@
+const fs = require('fs');
+const path = require('path');
+
+const main = () => {
+  const pkg = require('../../package.json');
+  const version = pkg['version'];
+  if (!version) throw 'The version property is not set in the package.json file';
+  if (typeof version !== 'string') {
+    throw `Unexpected type for the package.json version field; got ${typeof version}, expected string`;
+  }
+
+  const versionFile = path.resolve(__dirname, '..', '..', 'src', 'version.ts');
+  const contents = fs.readFileSync(versionFile, 'utf8');
+  const output = contents.replace(/(export const VERSION = ')(.*)(')/g, `$1${version}$3`);
+  fs.writeFileSync(versionFile, output);
+};
+
+if (require.main === module) {
+  main();
+}
diff --git a/sdks/ts/scripts/utils/fix-index-exports.cjs b/sdks/ts/scripts/utils/fix-index-exports.cjs
new file mode 100644
index 00000000..e5e10b3e
--- /dev/null
+++ b/sdks/ts/scripts/utils/fix-index-exports.cjs
@@ -0,0 +1,17 @@
+const fs = require('fs');
+const path = require('path');
+
+const indexJs =
+  process.env['DIST_PATH'] ?
+    path.resolve(process.env['DIST_PATH'], 'index.js')
+  : path.resolve(__dirname, '..', '..', 'dist', 'index.js');
+
+let before = fs.readFileSync(indexJs, 'utf8');
+let after = before.replace(
+  /^(\s*Object\.defineProperty\s*\(exports,\s*["']__esModule["'].+)$/m,
+  `exports = module.exports = function (...args) {
+    return new exports.default(...args)
+  }
+  $1`.replace(/^  /gm, ''),
+);
+fs.writeFileSync(indexJs, after, 'utf8');
diff --git a/sdks/ts/scripts/utils/git-swap.sh b/sdks/ts/scripts/utils/git-swap.sh
new file mode 100755
index 00000000..79d1888e
--- /dev/null
+++ b/sdks/ts/scripts/utils/git-swap.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -exuo pipefail
+# the package is published to NPM from ./dist
+# we want the final file structure for git installs to match the npm installs, so we
+
+# delete everything except ./dist and ./node_modules
+find . -maxdepth 1 -mindepth 1 ! -name 'dist' ! -name 'node_modules' -exec rm -rf '{}' +
+
+# move everything from ./dist to .
+mv dist/* .
+
+# delete the now-empty ./dist
+rmdir dist
diff --git a/sdks/ts/scripts/utils/make-dist-package-json.cjs b/sdks/ts/scripts/utils/make-dist-package-json.cjs
new file mode 100644
index 00000000..7c24f56e
--- /dev/null
+++ b/sdks/ts/scripts/utils/make-dist-package-json.cjs
@@ -0,0 +1,21 @@
+const pkgJson = require(process.env['PKG_JSON_PATH'] || '../../package.json');
+
+function processExportMap(m) {
+  for (const key in m) {
+    const value = m[key];
+    if (typeof value === 'string') m[key] = value.replace(/^\.\/dist\//, './');
+    else processExportMap(value);
+  }
+}
+processExportMap(pkgJson.exports);
+
+for (const key of ['types', 'main', 'module']) {
+  if (typeof pkgJson[key] === 'string') pkgJson[key] = pkgJson[key].replace(/^(\.\/)?dist\//, './');
+}
+
+delete pkgJson.devDependencies;
+delete pkgJson.scripts.prepack;
+delete pkgJson.scripts.prepublishOnly;
+delete pkgJson.scripts.prepare;
+
+console.log(JSON.stringify(pkgJson, null, 2));
diff --git a/sdks/ts/scripts/utils/postprocess-files.cjs b/sdks/ts/scripts/utils/postprocess-files.cjs
new file mode 100644
index 00000000..deae575e
--- /dev/null
+++ b/sdks/ts/scripts/utils/postprocess-files.cjs
@@ -0,0 +1,94 @@
+// @ts-check
+const fs = require('fs');
+const path = require('path');
+
+const distDir =
+  process.env['DIST_PATH'] ?
+    path.resolve(process.env['DIST_PATH'])
+  : path.resolve(__dirname, '..', '..', 'dist');
+
+async function* walk(dir) {
+  for await (const d of await fs.promises.opendir(dir)) {
+    const entry = path.join(dir, d.name);
+    if (d.isDirectory()) yield* walk(entry);
+    else if (d.isFile()) yield entry;
+  }
+}
+
+async function postprocess() {
+  for await (const file of walk(distDir)) {
+    if (!/(\.d)?[cm]?ts$/.test(file)) continue;
+
+    const code = await fs.promises.readFile(file, 'utf8');
+
+    // strip out lib="dom", types="node", and types="react" references; these
+    // are needed at build time, but would pollute the user's TS environment
+    const transformed = code.replace(
+      /^ *\/\/\/ *<reference +(lib="dom"|types="(node|react)").*?\n/gm,
+      // replace with same number of characters to avoid breaking source maps
+      (match) => ' '.repeat(match.length - 1) + '\n',
+    );
+
+    if (transformed !== code) {
+      console.error(`wrote ${path.relative(process.cwd(), file)}`);
+      await fs.promises.writeFile(file, transformed, 'utf8');
+    }
+  }
+
+  const newExports = {
+    '.': {
+      require: {
+        types: './index.d.ts',
+        default: './index.js',
+      },
+      types: './index.d.mts',
+      default: './index.mjs',
+    },
+  };
+
+  for (const entry of await fs.promises.readdir(distDir, { withFileTypes: true })) {
+    if (entry.isDirectory() && entry.name !== 'src' && entry.name !== 'internal' && entry.name !== 'bin') {
+      const subpath = './' + entry.name;
+      newExports[subpath + '/*.mjs'] = {
+        default: subpath + '/*.mjs',
+      };
+      newExports[subpath + '/*.js'] = {
+        default: subpath + '/*.js',
+      };
+      newExports[subpath + '/*'] = {
+        import: subpath + '/*.mjs',
+        require: subpath + '/*.js',
+      };
+    } else if (entry.isFile() && /\.[cm]?js$/.test(entry.name)) {
+      const { name, ext } = path.parse(entry.name);
+      const subpathWithoutExt = './' + name;
+      const subpath = './' + entry.name;
+      newExports[subpathWithoutExt] ||= { import: undefined, require: undefined };
+      const isModule = ext[1] === 'm';
+      if (isModule) {
+        newExports[subpathWithoutExt].import = subpath;
+      } else {
+        newExports[subpathWithoutExt].require = subpath;
+      }
+      newExports[subpath] = {
+        default: subpath,
+      };
+    }
+  }
+  await fs.promises.writeFile(
+    'dist/package.json',
+    JSON.stringify(
+      Object.assign(
+        /** @type {Record<String, unknown>} */ (
+          JSON.parse(await fs.promises.readFile('dist/package.json', 'utf-8'))
+        ),
+        {
+          exports: newExports,
+        },
+      ),
+      null,
+      2,
+    ),
+  );
+}
+postprocess();
diff --git a/sdks/ts/scripts/utils/upload-artifact.sh b/sdks/ts/scripts/utils/upload-artifact.sh
new file mode 100755
index 00000000..7aa918e3
--- /dev/null
+++ b/sdks/ts/scripts/utils/upload-artifact.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -exuo pipefail
+
+RESPONSE=$(curl -X POST "$URL" \
+  -H "Authorization: Bearer $AUTH" \
+  -H "Content-Type: application/json")
+
+SIGNED_URL=$(echo "$RESPONSE" | jq -r '.url')
+
+if [[ "$SIGNED_URL" == "null" ]]; then
+  echo -e "\033[31mFailed to get signed URL.\033[0m"
+  exit 1
+fi
+
+TARBALL=$(cd dist && npm pack --silent)
+
+UPLOAD_RESPONSE=$(curl -v -X PUT \
+  -H "Content-Type: application/gzip" \
+  --data-binary "@dist/$TARBALL" "$SIGNED_URL" 2>&1)
+
+if echo "$UPLOAD_RESPONSE" | grep -q "HTTP/[0-9.]* 200"; then
+  echo -e "\033[32mUploaded build to Stainless storage.\033[0m"
+  echo -e "\033[32mInstallation: npm install 'https://pkg.stainless.com/s/hypeman-typescript/$SHA'\033[0m"
+else
+  echo -e "\033[31mFailed to upload artifact.\033[0m"
+  exit 1
+fi
diff --git a/sdks/ts/src/api-promise.ts b/sdks/ts/src/api-promise.ts
new file mode 100644
index 00000000..8c775ee6
--- /dev/null
+++ b/sdks/ts/src/api-promise.ts
@@ -0,0 +1,2 @@
+/** @deprecated Import from ./core/api-promise instead */
+export * from './core/api-promise';
diff --git a/sdks/ts/src/client.ts b/sdks/ts/src/client.ts
new file mode 100644
index 00000000..928c8e94
--- /dev/null
+++ b/sdks/ts/src/client.ts
@@ -0,0 +1,822 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import type { RequestInit, RequestInfo, BodyInit } from './internal/builtin-types';
+import type { HTTPMethod, PromiseOrValue, MergedRequestInit, FinalizedRequestInit } from './internal/types';
+import { uuid4 } from './internal/utils/uuid';
+import { validatePositiveInteger, isAbsoluteURL, safeJSON } from './internal/utils/values';
+import { sleep } from './internal/utils/sleep';
+export type { Logger, LogLevel } from './internal/utils/log';
+import { castToError, isAbortError } from './internal/errors';
+import type { APIResponseProps } from './internal/parse';
+import { getPlatformHeaders } from './internal/detect-platform';
+import * as Shims from './internal/shims';
+import * as Opts from './internal/request-options';
+import { VERSION } from './version';
+import * as Errors from './core/error';
+import * as Uploads from './core/uploads';
+import * as API from './resources/index';
+import { APIPromise } from './core/api-promise';
+import {
+  AvailableDevice,
+  Device,
+  DeviceCreateParams,
+  DeviceListAvailableResponse,
+  DeviceListResponse,
+  DeviceType,
+  Devices,
+} from './resources/devices';
+import { Health, HealthCheckResponse } from './resources/health';
+import { Image, ImageCreateParams, ImageListResponse, Images } from './resources/images';
+import {
+  Ingress,
+  IngressCreateParams,
+  IngressListResponse,
+  IngressMatch,
+  IngressRule,
+  IngressTarget,
+  Ingresses,
+} from './resources/ingresses';
+import {
+  Volume,
+  VolumeAttachment,
+  VolumeCreateParams,
+  VolumeListResponse,
+  Volumes,
+} from './resources/volumes';
+import {
+  Instance,
+  InstanceCreateParams,
+  InstanceListResponse,
+  InstanceLogsParams,
+  InstanceLogsResponse,
+  InstanceStatParams,
+  Instances,
+  PathInfo,
+  PortMapping,
+  VolumeMount,
+} from './resources/instances/instances';
+import { type Fetch } from './internal/builtin-types';
+import { HeadersLike, NullableHeaders, buildHeaders } from './internal/headers';
+import { FinalRequestOptions, RequestOptions } from './internal/request-options';
+import { readEnv } from './internal/utils/env';
+import {
+  type LogLevel,
+  type Logger,
+  formatRequestDetails,
+  loggerFor,
+  parseLogLevel,
+} from './internal/utils/log';
+import { isEmptyObj } from './internal/utils/values';
+
+export interface ClientOptions {
+  /**
+   * Defaults to process.env['HYPEMAN_API_KEY'].
+   */
+  apiKey?: string | undefined;
+
+  /**
+   * Override the default base URL for the API, e.g., "https://api.example.com/v2/"
+   *
+   * Defaults to process.env['HYPEMAN_BASE_URL'].
+   */
+  baseURL?: string | null | undefined;
+
+  /**
+   * The maximum amount of time (in milliseconds) that the client should wait for a response
+   * from the server before timing out a single request.
+   *
+   * Note that request timeouts are retried by default, so in a worst-case scenario you may wait
+   * much longer than this timeout before the promise succeeds or fails.
+   *
+   * @unit milliseconds
+   */
+  timeout?: number | undefined;
+  /**
+   * Additional `RequestInit` options to be passed to `fetch` calls.
+   * Properties will be overridden by per-request `fetchOptions`.
+   */
+  fetchOptions?: MergedRequestInit | undefined;
+
+  /**
+   * Specify a custom `fetch` function implementation.
+   *
+   * If not provided, we expect that `fetch` is defined globally.
+   */
+  fetch?: Fetch | undefined;
+
+  /**
+   * The maximum number of times that the client will retry a request in case of a
+   * temporary failure, like a network error or a 5XX error from the server.
+   *
+   * @default 2
+   */
+  maxRetries?: number | undefined;
+
+  /**
+   * Default headers to include with every request to the API.
+   *
+   * These can be removed in individual requests by explicitly setting the
+   * header to `null` in request options.
+   */
+  defaultHeaders?: HeadersLike | undefined;
+
+  /**
+   * Default query parameters to include with every request to the API.
+   *
+   * These can be removed in individual requests by explicitly setting the
+   * param to `undefined` in request options.
+   */
+  defaultQuery?: Record<string, string | undefined> | undefined;
+
+  /**
+   * Set the log level.
+   *
+   * Defaults to process.env['HYPEMAN_LOG'] or 'warn' if it isn't set.
+   */
+  logLevel?: LogLevel | undefined;
+
+  /**
+   * Set the logger.
+   *
+   * Defaults to globalThis.console.
+   */
+  logger?: Logger | undefined;
+}
+
+/**
+ * API Client for interfacing with the Hypeman API.
+ */
+export class Hypeman {
+  apiKey: string;
+
+  baseURL: string;
+  maxRetries: number;
+  timeout: number;
+  logger: Logger;
+  logLevel: LogLevel | undefined;
+  fetchOptions: MergedRequestInit | undefined;
+
+  private fetch: Fetch;
+  #encoder: Opts.RequestEncoder;
+  protected idempotencyHeader?: string;
+  private _options: ClientOptions;
+
+  /**
+   * API Client for interfacing with the Hypeman API.
+   *
+   * @param {string | undefined} [opts.apiKey=process.env['HYPEMAN_API_KEY'] ?? undefined]
+   * @param {string} [opts.baseURL=process.env['HYPEMAN_BASE_URL'] ?? http://localhost:8080] - Override the default base URL for the API.
+   * @param {number} [opts.timeout=1 minute] - The maximum amount of time (in milliseconds) the client will wait for a response before timing out.
+   * @param {MergedRequestInit} [opts.fetchOptions] - Additional `RequestInit` options to be passed to `fetch` calls.
+   * @param {Fetch} [opts.fetch] - Specify a custom `fetch` function implementation.
+   * @param {number} [opts.maxRetries=2] - The maximum number of times the client will retry a request.
+   * @param {HeadersLike} opts.defaultHeaders - Default headers to include with every request to the API.
+   * @param {Record<string, string | undefined>} opts.defaultQuery - Default query parameters to include with every request to the API.
+   */
+  constructor({
+    baseURL = readEnv('HYPEMAN_BASE_URL'),
+    apiKey = readEnv('HYPEMAN_API_KEY'),
+    ...opts
+  }: ClientOptions = {}) {
+    if (apiKey === undefined) {
+      throw new Errors.HypemanError(
+        "The HYPEMAN_API_KEY environment variable is missing or empty; either provide it, or instantiate the Hypeman client with an apiKey option, like new Hypeman({ apiKey: 'My API Key' }).",
+      );
+    }
+
+    const options: ClientOptions = {
+      apiKey,
+      ...opts,
+      baseURL: baseURL || `http://localhost:8080`,
+    };
+
+    this.baseURL = options.baseURL!;
+    this.timeout = options.timeout ?? Hypeman.DEFAULT_TIMEOUT /* 1 minute */;
+    this.logger = options.logger ?? console;
+    const defaultLogLevel = 'warn';
+    // Set default logLevel early so that we can log a warning in parseLogLevel.
+    this.logLevel = defaultLogLevel;
+    this.logLevel =
+      parseLogLevel(options.logLevel, 'ClientOptions.logLevel', this) ??
+      parseLogLevel(readEnv('HYPEMAN_LOG'), "process.env['HYPEMAN_LOG']", this) ??
+      defaultLogLevel;
+    this.fetchOptions = options.fetchOptions;
+    this.maxRetries = options.maxRetries ?? 2;
+    this.fetch = options.fetch ?? Shims.getDefaultFetch();
+    this.#encoder = Opts.FallbackEncoder;
+
+    this._options = options;
+
+    this.apiKey = apiKey;
+  }
+
+  /**
+   * Create a new client instance re-using the same options given to the current client with optional overriding.
+   */
+  withOptions(options: Partial<ClientOptions>): this {
+    const client = new (this.constructor as any as new (props: ClientOptions) => typeof this)({
+      ...this._options,
+      baseURL: this.baseURL,
+      maxRetries: this.maxRetries,
+      timeout: this.timeout,
+      logger: this.logger,
+      logLevel: this.logLevel,
+      fetch: this.fetch,
+      fetchOptions: this.fetchOptions,
+      apiKey: this.apiKey,
+      ...options,
+    });
+    return client;
+  }
+
+  /**
+   * Check whether the base URL is set to its default.
+   */
+  #baseURLOverridden(): boolean {
+    return this.baseURL !== 'http://localhost:8080';
+  }
+
+  protected defaultQuery(): Record<string, string | undefined> | undefined {
+    return this._options.defaultQuery;
+  }
+
+  protected validateHeaders({ values, nulls }: NullableHeaders) {
+    return;
+  }
+
+  protected async authHeaders(opts: FinalRequestOptions): Promise<NullableHeaders | undefined> {
+    return buildHeaders([{ Authorization: `Bearer ${this.apiKey}` }]);
+  }
+
+  /**
+   * Basic re-implementation of `qs.stringify` for primitive types.
+   */
+  protected stringifyQuery(query: Record<string, unknown>): string {
+    return Object.entries(query)
+      .filter(([_, value]) => typeof value !== 'undefined')
+      .map(([key, value]) => {
+        if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
+          return `${encodeURIComponent(key)}=${encodeURIComponent(value)}`;
+        }
+        if (value === null) {
+          return `${encodeURIComponent(key)}=`;
+        }
+        throw new Errors.HypemanError(
+          `Cannot stringify type ${typeof value}; Expected string, number, boolean, or null. If you need to pass nested query parameters, you can manually encode them, e.g. { query: { 'foo[key1]': value1, 'foo[key2]': value2 } }, and please open a GitHub issue requesting better support for your use case.`,
+        );
+      })
+      .join('&');
+  }
+
+  private getUserAgent(): string {
+    return `${this.constructor.name}/JS ${VERSION}`;
+  }
+
+  protected defaultIdempotencyKey(): string {
+    return `stainless-node-retry-${uuid4()}`;
+  }
+
+  protected makeStatusError(
+    status: number,
+    error: Object,
+    message: string | undefined,
+    headers: Headers,
+  ): Errors.APIError {
+    return Errors.APIError.generate(status, error, message, headers);
+  }
+
+  buildURL(
+    path: string,
+    query: Record<string, unknown> | null | undefined,
+    defaultBaseURL?: string | undefined,
+  ): string {
+    const baseURL = (!this.#baseURLOverridden() && defaultBaseURL) || this.baseURL;
+    const url =
+      isAbsoluteURL(path) ?
+        new URL(path)
+      : new URL(baseURL + (baseURL.endsWith('/') && path.startsWith('/') ? path.slice(1) : path));
+
+    const defaultQuery = this.defaultQuery();
+    if (!isEmptyObj(defaultQuery)) {
+      query = { ...defaultQuery, ...query };
+    }
+
+    if (typeof query === 'object' && query && !Array.isArray(query)) {
+      url.search = this.stringifyQuery(query as Record<string, unknown>);
+    }
+
+    return url.toString();
+  }
+
+  /**
+   * Used as a callback for mutating the given `FinalRequestOptions` object.
+   */
+  protected async prepareOptions(options: FinalRequestOptions): Promise<void> {}
+
+  /**
+   * Used as a callback for mutating the given `RequestInit` object.
+   *
+   * This is useful for cases where you want to add certain headers based off of
+   * the request properties, e.g. `method` or `url`.
+   */
+  protected async prepareRequest(
+    request: RequestInit,
+    { url, options }: { url: string; options: FinalRequestOptions },
+  ): Promise<void> {}
+
+  get<Rsp>(path: string, opts?: PromiseOrValue<RequestOptions>): APIPromise<Rsp> {
+    return this.methodRequest('get', path, opts);
+  }
+
+  post<Rsp>(path: string, opts?: PromiseOrValue<RequestOptions>): APIPromise<Rsp> {
+    return this.methodRequest('post', path, opts);
+  }
+
+  patch<Rsp>(path: string, opts?: PromiseOrValue<RequestOptions>): APIPromise<Rsp> {
+    return this.methodRequest('patch', path, opts);
+  }
+
+  put<Rsp>(path: string, opts?: PromiseOrValue<RequestOptions>): APIPromise<Rsp> {
+    return this.methodRequest('put', path, opts);
+  }
+
+  delete<Rsp>(path: string, opts?: PromiseOrValue<RequestOptions>): APIPromise<Rsp> {
+    return this.methodRequest('delete', path, opts);
+  }
+
+  private methodRequest<Rsp>(
+    method: HTTPMethod,
+    path: string,
+    opts?: PromiseOrValue<RequestOptions>,
+  ): APIPromise<Rsp> {
+    return this.request(
+      Promise.resolve(opts).then((opts) => {
+        return { method, path, ...opts };
+      }),
+    );
+  }
+
+  request<Rsp>(
+    options: PromiseOrValue<FinalRequestOptions>,
+    remainingRetries: number | null = null,
+  ): APIPromise<Rsp> {
+    return new APIPromise(this, this.makeRequest(options, remainingRetries, undefined));
+  }
+
+  private async makeRequest(
+    optionsInput: PromiseOrValue<FinalRequestOptions>,
+    retriesRemaining: number | null,
+    retryOfRequestLogID: string | undefined,
+  ): Promise<APIResponseProps> {
+    const options = await optionsInput;
+    const maxRetries = options.maxRetries ?? this.maxRetries;
+    if (retriesRemaining == null) {
+      retriesRemaining = maxRetries;
+    }
+
+    await this.prepareOptions(options);
+
+    const { req, url, timeout } = await this.buildRequest(options, {
+      retryCount: maxRetries - retriesRemaining,
+    });
+
+    await this.prepareRequest(req, { url, options });
+
+    /** Not an API request ID, just for correlating local log entries. */
+    const requestLogID = 'log_' + ((Math.random() * (1 << 24)) | 0).toString(16).padStart(6, '0');
+    const retryLogStr = retryOfRequestLogID === undefined ? '' : `, retryOf: ${retryOfRequestLogID}`;
+    const startTime = Date.now();
+
+    loggerFor(this).debug(
+      `[${requestLogID}] sending request`,
+      formatRequestDetails({
+        retryOfRequestLogID,
+        method: options.method,
+        url,
+        options,
+        headers: req.headers,
+      }),
+    );
+
+    if (options.signal?.aborted) {
+      throw new Errors.APIUserAbortError();
+    }
+
+    const controller = new AbortController();
+    const response = await this.fetchWithTimeout(url, req, timeout, controller).catch(castToError);
+    const headersTime = Date.now();
+
+    if (response instanceof globalThis.Error) {
+      const retryMessage = `retrying, ${retriesRemaining} attempts remaining`;
+      if (options.signal?.aborted) {
+        throw new Errors.APIUserAbortError();
+      }
+      // detect native connection timeout errors
+      // deno throws "TypeError: error sending request for url (https://example/): client error (Connect): tcp connect error: Operation timed out (os error 60): Operation timed out (os error 60)"
+      // undici throws "TypeError: fetch failed" with cause "ConnectTimeoutError: Connect Timeout Error (attempted address: example:443, timeout: 1ms)"
+      // others do not provide enough information to distinguish timeouts from other connection errors
+      const isTimeout =
+        isAbortError(response) ||
+        /timed? ?out/i.test(String(response) + ('cause' in response ? String(response.cause) : ''));
+      if (retriesRemaining) {
+        loggerFor(this).info(
+          `[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} - ${retryMessage}`,
+        );
+        loggerFor(this).debug(
+          `[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} (${retryMessage})`,
+          formatRequestDetails({
+            retryOfRequestLogID,
+            url,
+            durationMs: headersTime - startTime,
+            message: response.message,
+          }),
+        );
+        return this.retryRequest(options, retriesRemaining, retryOfRequestLogID ?? requestLogID);
+      }
+      loggerFor(this).info(
+        `[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} - error; no more retries left`,
+      );
+      loggerFor(this).debug(
+        `[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} (error; no more retries left)`,
+        formatRequestDetails({
+          retryOfRequestLogID,
+          url,
+          durationMs: headersTime - startTime,
+          message: response.message,
+        }),
+      );
+      if (isTimeout) {
+        throw new Errors.APIConnectionTimeoutError();
+      }
+      throw new Errors.APIConnectionError({ cause: response });
+    }
+
+    const responseInfo = `[${requestLogID}${retryLogStr}] ${req.method} ${url} ${
+      response.ok ? 'succeeded' : 'failed'
+    } with status ${response.status} in ${headersTime - startTime}ms`;
+
+    if (!response.ok) {
+      const shouldRetry = await this.shouldRetry(response);
+      if (retriesRemaining && shouldRetry) {
+        const retryMessage = `retrying, ${retriesRemaining} attempts remaining`;
+
+        // We don't need the body of this response.
+        await Shims.CancelReadableStream(response.body);
+        loggerFor(this).info(`${responseInfo} - ${retryMessage}`);
+        loggerFor(this).debug(
+          `[${requestLogID}] response error (${retryMessage})`,
+          formatRequestDetails({
+            retryOfRequestLogID,
+            url: response.url,
+            status: response.status,
+            headers: response.headers,
+            durationMs: headersTime - startTime,
+          }),
+        );
+        return this.retryRequest(
+          options,
+          retriesRemaining,
+          retryOfRequestLogID ?? requestLogID,
+          response.headers,
+        );
+      }
+
+      const retryMessage = shouldRetry ? `error; no more retries left` : `error; not retryable`;
+
+      loggerFor(this).info(`${responseInfo} - ${retryMessage}`);
+
+      const errText = await response.text().catch((err: any) => castToError(err).message);
+      const errJSON = safeJSON(errText);
+      const errMessage = errJSON ? undefined : errText;
+
+      loggerFor(this).debug(
+        `[${requestLogID}] response error (${retryMessage})`,
+        formatRequestDetails({
+          retryOfRequestLogID,
+          url: response.url,
+          status: response.status,
+          headers: response.headers,
+          message: errMessage,
+          durationMs: Date.now() - startTime,
+        }),
+      );
+
+      const err = this.makeStatusError(response.status, errJSON, errMessage, response.headers);
+      throw err;
+    }
+
+    loggerFor(this).info(responseInfo);
+    loggerFor(this).debug(
+      `[${requestLogID}] response start`,
+      formatRequestDetails({
+        retryOfRequestLogID,
+        url: response.url,
+        status: response.status,
+        headers: response.headers,
+        durationMs: headersTime - startTime,
+      }),
+    );
+
+    return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
+  }
+
+  async fetchWithTimeout(
+    url: RequestInfo,
+    init: RequestInit | undefined,
+    ms: number,
+    controller: AbortController,
+  ): Promise<Response> {
+    const { signal, method, ...options } = init || {};
+    if (signal) signal.addEventListener('abort', () => controller.abort());
+
+    const timeout = setTimeout(() => controller.abort(), ms);
+
+    const isReadableBody =
+      ((globalThis as any).ReadableStream && options.body instanceof (globalThis as any).ReadableStream) ||
+      (typeof options.body === 'object' && options.body !== null && Symbol.asyncIterator in options.body);
+
+    const fetchOptions: RequestInit = {
+      signal: controller.signal as any,
+      ...(isReadableBody ? { duplex: 'half' } : {}),
+      method: 'GET',
+      ...options,
+    };
+    if (method) {
+      // Custom methods like 'patch' need to be uppercased
+      // See https://github.com/nodejs/undici/issues/2294
+      fetchOptions.method = method.toUpperCase();
+    }
+
+    try {
+      // use undefined this binding; fetch errors if bound to something else in browser/cloudflare
+      return await this.fetch.call(undefined, url, fetchOptions);
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+
+  private async shouldRetry(response: Response): Promise<boolean> {
+    // Note this is not a standard header.
+    const shouldRetryHeader = response.headers.get('x-should-retry');
+
+    // If the server explicitly says whether or not to retry, obey.
+    if (shouldRetryHeader === 'true') return true;
+    if (shouldRetryHeader === 'false') return false;
+
+    // Retry on request timeouts.
+    if (response.status === 408) return true;
+
+    // Retry on lock timeouts.
+    if (response.status === 409) return true;
+
+    // Retry on rate limits.
+    if (response.status === 429) return true;
+
+    // Retry internal errors.
+    if (response.status >= 500) return true;
+
+    return false;
+  }
+
+  private async retryRequest(
+    options: FinalRequestOptions,
+    retriesRemaining: number,
+    requestLogID: string,
+    responseHeaders?: Headers | undefined,
+  ): Promise<APIResponseProps> {
+    let timeoutMillis: number | undefined;
+
+    // Note the `retry-after-ms` header may not be standard, but is a good idea and we'd like proactive support for it.
+    const retryAfterMillisHeader = responseHeaders?.get('retry-after-ms');
+    if (retryAfterMillisHeader) {
+      const timeoutMs = parseFloat(retryAfterMillisHeader);
+      if (!Number.isNaN(timeoutMs)) {
+        timeoutMillis = timeoutMs;
+      }
+    }
+
+    // About the Retry-After header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Retry-After
+    const retryAfterHeader = responseHeaders?.get('retry-after');
+    if (retryAfterHeader && !timeoutMillis) {
+      const timeoutSeconds = parseFloat(retryAfterHeader);
+      if (!Number.isNaN(timeoutSeconds)) {
+        timeoutMillis = timeoutSeconds * 1000;
+      } else {
+        timeoutMillis = Date.parse(retryAfterHeader) - Date.now();
+      }
+    }
+
+    // If the API asks us to wait a certain amount of time (and it's a reasonable amount),
+    // just do what it says, but otherwise calculate a default
+    if (!(timeoutMillis && 0 <= timeoutMillis && timeoutMillis < 60 * 1000)) {
+      const maxRetries = options.maxRetries ?? this.maxRetries;
+      timeoutMillis = this.calculateDefaultRetryTimeoutMillis(retriesRemaining, maxRetries);
+    }
+    await sleep(timeoutMillis);
+
+    return this.makeRequest(options, retriesRemaining - 1, requestLogID);
+  }
+
+  private calculateDefaultRetryTimeoutMillis(retriesRemaining: number, maxRetries: number): number {
+    const initialRetryDelay = 0.5;
+    const maxRetryDelay = 8.0;
+
+    const numRetries = maxRetries - retriesRemaining;
+
+    // Apply exponential backoff, but not more than the max.
+    const sleepSeconds = Math.min(initialRetryDelay * Math.pow(2, numRetries), maxRetryDelay);
+
+    // Apply some jitter, take up to at most 25 percent of the retry time.
+    const jitter = 1 - Math.random() * 0.25;
+
+    return sleepSeconds * jitter * 1000;
+  }
+
+  async buildRequest(
+    inputOptions: FinalRequestOptions,
+    { retryCount = 0 }: { retryCount?: number } = {},
+  ): Promise<{ req: FinalizedRequestInit; url: string; timeout: number }> {
+    const options = { ...inputOptions };
+    const { method, path, query, defaultBaseURL } = options;
+
+    const url = this.buildURL(path!, query as Record<string, unknown>, defaultBaseURL);
+    if ('timeout' in options) validatePositiveInteger('timeout', options.timeout);
+    options.timeout = options.timeout ?? this.timeout;
+    const { bodyHeaders, body } = this.buildBody({ options });
+    const reqHeaders = await this.buildHeaders({ options: inputOptions, method, bodyHeaders, retryCount });
+
+    const req: FinalizedRequestInit = {
+      method,
+      headers: reqHeaders,
+      ...(options.signal && { signal: options.signal }),
+      ...((globalThis as any).ReadableStream &&
+        body instanceof (globalThis as any).ReadableStream && { duplex: 'half' }),
+      ...(body && { body }),
+      ...((this.fetchOptions as any) ?? {}),
+      ...((options.fetchOptions as any) ?? {}),
+    };
+
+    return { req, url, timeout: options.timeout };
+  }
+
+  private async buildHeaders({
+    options,
+    method,
+    bodyHeaders,
+    retryCount,
+  }: {
+    options: FinalRequestOptions;
+    method: HTTPMethod;
+    bodyHeaders: HeadersLike;
+    retryCount: number;
+  }): Promise<Headers> {
+    let idempotencyHeaders: HeadersLike = {};
+    if (this.idempotencyHeader && method !== 'get') {
+      if (!options.idempotencyKey) options.idempotencyKey = this.defaultIdempotencyKey();
+      idempotencyHeaders[this.idempotencyHeader] = options.idempotencyKey;
+    }
+
+    const headers = buildHeaders([
+      idempotencyHeaders,
+      {
+        Accept: 'application/json',
+        'User-Agent': this.getUserAgent(),
+        'X-Stainless-Retry-Count': String(retryCount),
+        ...(options.timeout ? { 'X-Stainless-Timeout': String(Math.trunc(options.timeout / 1000)) } : {}),
+        ...getPlatformHeaders(),
+      },
+      await this.authHeaders(options),
+      this._options.defaultHeaders,
+      bodyHeaders,
+      options.headers,
+    ]);
+
+    this.validateHeaders(headers);
+
+    return headers.values;
+  }
+
+  private buildBody({ options: { body, headers: rawHeaders } }: { options: FinalRequestOptions }): {
+    bodyHeaders: HeadersLike;
+    body: BodyInit | undefined;
+  } {
+    if (!body) {
+      return { bodyHeaders: undefined, body: undefined };
+    }
+    const headers = buildHeaders([rawHeaders]);
+    if (
+      // Pass raw type verbatim
+      ArrayBuffer.isView(body) ||
+      body instanceof ArrayBuffer ||
+      body instanceof DataView ||
+      (typeof body === 'string' &&
+        // Preserve legacy string encoding behavior for now
+        headers.values.has('content-type')) ||
+      // `Blob` is superset of `File`
+      ((globalThis as any).Blob && body instanceof (globalThis as any).Blob) ||
+      // `FormData` -> `multipart/form-data`
+      body instanceof FormData ||
+      // `URLSearchParams` -> `application/x-www-form-urlencoded`
+      body instanceof URLSearchParams ||
+      // Send chunked stream (each chunk has own `length`)
+      ((globalThis as any).ReadableStream && body instanceof (globalThis as any).ReadableStream)
+    ) {
+      return { bodyHeaders: undefined, body: body as BodyInit };
+    } else if (
+      typeof body === 'object' &&
+      (Symbol.asyncIterator in body ||
+        (Symbol.iterator in body && 'next' in body && typeof body.next === 'function'))
+    ) {
+      return { bodyHeaders: undefined, body: Shims.ReadableStreamFrom(body as AsyncIterable<Uint8Array>) };
+    } else {
+      return this.#encoder({ body, headers });
+    }
+  }
+
+  static Hypeman = this;
+  static DEFAULT_TIMEOUT = 60000; // 1 minute
+
+  static HypemanError = Errors.HypemanError;
+  static APIError = Errors.APIError;
+  static APIConnectionError = Errors.APIConnectionError;
+  static APIConnectionTimeoutError = Errors.APIConnectionTimeoutError;
+  static APIUserAbortError = Errors.APIUserAbortError;
+  static NotFoundError = Errors.NotFoundError;
+  static ConflictError = Errors.ConflictError;
+  static RateLimitError = Errors.RateLimitError;
+  static BadRequestError = Errors.BadRequestError;
+  static AuthenticationError = Errors.AuthenticationError;
+  static InternalServerError = Errors.InternalServerError;
+  static PermissionDeniedError = Errors.PermissionDeniedError;
+  static UnprocessableEntityError = Errors.UnprocessableEntityError;
+
+  static toFile = Uploads.toFile;
+
+  health: API.Health = new API.Health(this);
+  images: API.Images = new API.Images(this);
+  instances: API.Instances = new API.Instances(this);
+  volumes: API.Volumes = new API.Volumes(this);
+  devices: API.Devices = new API.Devices(this);
+  ingresses: API.Ingresses = new API.Ingresses(this);
+}
+
+Hypeman.Health = Health;
+Hypeman.Images = Images;
+Hypeman.Instances = Instances;
+Hypeman.Volumes = Volumes;
+Hypeman.Devices = Devices;
+Hypeman.Ingresses = Ingresses;
+
+export declare namespace Hypeman {
+  export type RequestOptions = Opts.RequestOptions;
+
+  export { Health as Health, type HealthCheckResponse as HealthCheckResponse };
+
+  export {
+    Images as Images,
+    type Image as Image,
+    type ImageListResponse as ImageListResponse,
+    type ImageCreateParams as ImageCreateParams,
+  };
+
+  export {
+    Instances as Instances,
+    type Instance as Instance,
+    type PathInfo as PathInfo,
+    type PortMapping as PortMapping,
+    type VolumeMount as VolumeMount,
+    type InstanceListResponse as InstanceListResponse,
+    type InstanceLogsResponse as InstanceLogsResponse,
+    type InstanceCreateParams as InstanceCreateParams,
+    type InstanceLogsParams as InstanceLogsParams,
+    type InstanceStatParams as InstanceStatParams,
+  };
+
+  export {
+    Volumes as Volumes,
+    type Volume as Volume,
+    type VolumeAttachment as VolumeAttachment,
+    type VolumeListResponse as VolumeListResponse,
+    type VolumeCreateParams as VolumeCreateParams,
+  };
+
+  export {
+    Devices as Devices,
+    type AvailableDevice as AvailableDevice,
+    type Device as Device,
+    type DeviceType as DeviceType,
+    type DeviceListResponse as DeviceListResponse,
+    type DeviceListAvailableResponse as DeviceListAvailableResponse,
+    type DeviceCreateParams as DeviceCreateParams,
+  };
+
+  export {
+    Ingresses as Ingresses,
+    type Ingress as Ingress,
+    type IngressMatch as IngressMatch,
+    type IngressRule as IngressRule,
+    type IngressTarget as IngressTarget,
+    type IngressListResponse as IngressListResponse,
+    type IngressCreateParams as IngressCreateParams,
+  };
+}
diff --git a/sdks/ts/src/core/README.md b/sdks/ts/src/core/README.md
new file mode 100644
index 00000000..485fce86
--- /dev/null
+++ b/sdks/ts/src/core/README.md
@@ -0,0 +1,3 @@
+# `core`
+
+This directory holds public modules implementing non-resource-specific SDK functionality.
diff --git a/sdks/ts/src/core/api-promise.ts b/sdks/ts/src/core/api-promise.ts
new file mode 100644
index 00000000..73e66b68
--- /dev/null
+++ b/sdks/ts/src/core/api-promise.ts
@@ -0,0 +1,92 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { type Hypeman } from '../client';
+
+import { type PromiseOrValue } from '../internal/types';
+import { APIResponseProps, defaultParseResponse } from '../internal/parse';
+
+/**
+ * A subclass of `Promise` providing additional helper methods
+ * for interacting with the SDK.
+ */
+export class APIPromise<T> extends Promise<T> {
+  private parsedPromise: Promise<T> | undefined;
+  #client: Hypeman;
+
+  constructor(
+    client: Hypeman,
+    private responsePromise: Promise<APIResponseProps>,
+    private parseResponse: (
+      client: Hypeman,
+      props: APIResponseProps,
+    ) => PromiseOrValue<T> = defaultParseResponse,
+  ) {
+    super((resolve) => {
+      // this is maybe a bit weird but this has to be a no-op to not implicitly
+      // parse the response body; instead .then, .catch, .finally are overridden
+      // to parse the response
+      resolve(null as any);
+    });
+    this.#client = client;
+  }
+
+  _thenUnwrap<U>(transform: (data: T, props: APIResponseProps) => U): APIPromise<U> {
+    return new APIPromise(this.#client, this.responsePromise, async (client, props) =>
+      transform(await this.parseResponse(client, props), props),
+    );
+  }
+
+  /**
+   * Gets the raw `Response` instance instead of parsing the response
+   * data.
+   *
+   * If you want to parse the response body but still get the `Response`
+   * instance, you can use {@link withResponse()}.
+   *
+   * 👋 Getting the wrong TypeScript type for `Response`?
+   * Try setting `"moduleResolution": "NodeNext"` or add `"lib": ["DOM"]`
+   * to your `tsconfig.json`.
+   */
+  asResponse(): Promise<Response> {
+    return this.responsePromise.then((p) => p.response);
+  }
+
+  /**
+   * Gets the parsed response data and the raw `Response` instance.
+   *
+   * If you just want to get the raw `Response` instance without parsing it,
+   * you can use {@link asResponse()}.
+   *
+   * 👋 Getting the wrong TypeScript type for `Response`?
+   * Try setting `"moduleResolution": "NodeNext"` or add `"lib": ["DOM"]`
+   * to your `tsconfig.json`.
+   */
+  async withResponse(): Promise<{ data: T; response: Response }> {
+    const [data, response] = await Promise.all([this.parse(), this.asResponse()]);
+    return { data, response };
+  }
+
+  private parse(): Promise<T> {
+    if (!this.parsedPromise) {
+      this.parsedPromise = this.responsePromise.then((data) => this.parseResponse(this.#client, data));
+    }
+    return this.parsedPromise;
+  }
+
+  override then<TResult1 = T, TResult2 = never>(
+    onfulfilled?: ((value: T) => TResult1 | PromiseLike<TResult1>) | undefined | null,
+    onrejected?: ((reason: any) => TResult2 | PromiseLike<TResult2>) | undefined | null,
+  ): Promise<TResult1 | TResult2> {
+    return this.parse().then(onfulfilled, onrejected);
+  }
+
+  override catch<TResult = never>(
+    onrejected?: ((reason: any) => TResult | PromiseLike<TResult>) | undefined | null,
+  ): Promise<T | TResult> {
+    return this.parse().catch(onrejected);
+  }
+
+  override finally(onfinally?: (() => void) | undefined | null): Promise<T> {
+    return this.parse().finally(onfinally);
+  }
+}
diff --git a/sdks/ts/src/core/error.ts b/sdks/ts/src/core/error.ts
new file mode 100644
index 00000000..9943788c
--- /dev/null
+++ b/sdks/ts/src/core/error.ts
@@ -0,0 +1,130 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { castToError } from '../internal/errors';
+
+export class HypemanError extends Error {}
+
+export class APIError<
+  TStatus extends number | undefined = number | undefined,
+  THeaders extends Headers | undefined = Headers | undefined,
+  TError extends Object | undefined = Object | undefined,
+> extends HypemanError {
+  /** HTTP status for the response that caused the error */
+  readonly status: TStatus;
+  /** HTTP headers for the response that caused the error */
+  readonly headers: THeaders;
+  /** JSON body of the response that caused the error */
+  readonly error: TError;
+
+  constructor(status: TStatus, error: TError, message: string | undefined, headers: THeaders) {
+    super(`${APIError.makeMessage(status, error, message)}`);
+    this.status = status;
+    this.headers = headers;
+    this.error = error;
+  }
+
+  private static makeMessage(status: number | undefined, error: any, message: string | undefined) {
+    const msg =
+      error?.message ?
+        typeof error.message === 'string' ?
+          error.message
+        : JSON.stringify(error.message)
+      : error ? JSON.stringify(error)
+      : message;
+
+    if (status && msg) {
+      return `${status} ${msg}`;
+    }
+    if (status) {
+      return `${status} status code (no body)`;
+    }
+    if (msg) {
+      return msg;
+    }
+    return '(no status code or body)';
+  }
+
+  static generate(
+    status: number | undefined,
+    errorResponse: Object | undefined,
+    message: string | undefined,
+    headers: Headers | undefined,
+  ): APIError {
+    if (!status || !headers) {
+      return new APIConnectionError({ message, cause: castToError(errorResponse) });
+    }
+
+    const error = errorResponse as Record<string, any>;
+
+    if (status === 400) {
+      return new BadRequestError(status, error, message, headers);
+    }
+
+    if (status === 401) {
+      return new AuthenticationError(status, error, message, headers);
+    }
+
+    if (status === 403) {
+      return new PermissionDeniedError(status, error, message, headers);
+    }
+
+    if (status === 404) {
+      return new NotFoundError(status, error, message, headers);
+    }
+
+    if (status === 409) {
+      return new ConflictError(status, error, message, headers);
+    }
+
+    if (status === 422) {
+      return new UnprocessableEntityError(status, error, message, headers);
+    }
+
+    if (status === 429) {
+      return new RateLimitError(status, error, message, headers);
+    }
+
+    if (status >= 500) {
+      return new InternalServerError(status, error, message, headers);
+    }
+
+    return new APIError(status, error, message, headers);
+  }
+}
+
+export class APIUserAbortError extends APIError<undefined, undefined, undefined> {
+  constructor({ message }: { message?: string } = {}) {
+    super(undefined, undefined, message || 'Request was aborted.', undefined);
+  }
+}
+
+export class APIConnectionError extends APIError<undefined, undefined, undefined> {
+  constructor({ message, cause }: { message?: string | undefined; cause?: Error | undefined }) {
+    super(undefined, undefined, message || 'Connection error.', undefined);
+    // in some environments the 'cause' property is already declared
+    // @ts-ignore
+    if (cause) this.cause = cause;
+  }
+}
+
+export class APIConnectionTimeoutError extends APIConnectionError {
+  constructor({ message }: { message?: string } = {}) {
+    super({ message: message ?? 'Request timed out.' });
+  }
+}
+
+export class BadRequestError extends APIError<400, Headers> {}
+
+export class AuthenticationError extends APIError<401, Headers> {}
+
+export class PermissionDeniedError extends APIError<403, Headers> {}
+
+export class NotFoundError extends APIError<404, Headers> {}
+
+export class ConflictError extends APIError<409, Headers> {}
+
+export class UnprocessableEntityError extends APIError<422, Headers> {}
+
+export class RateLimitError extends APIError<429, Headers> {}
+
+export class InternalServerError extends APIError<number, Headers> {}
diff --git a/sdks/ts/src/core/resource.ts b/sdks/ts/src/core/resource.ts
new file mode 100644
index 00000000..a65a4cea
--- /dev/null
+++ b/sdks/ts/src/core/resource.ts
@@ -0,0 +1,11 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import type { Hypeman } from '../client';
+
+export abstract class APIResource {
+  protected _client: Hypeman;
+
+  constructor(client: Hypeman) {
+    this._client = client;
+  }
+}
diff --git a/sdks/ts/src/core/streaming.ts b/sdks/ts/src/core/streaming.ts
new file mode 100644
index 00000000..a2b26770
--- /dev/null
+++ b/sdks/ts/src/core/streaming.ts
@@ -0,0 +1,315 @@
+import { HypemanError } from './error';
+import { type ReadableStream } from '../internal/shim-types';
+import { makeReadableStream } from '../internal/shims';
+import { findDoubleNewlineIndex, LineDecoder } from '../internal/decoders/line';
+import { ReadableStreamToAsyncIterable } from '../internal/shims';
+import { isAbortError } from '../internal/errors';
+import { encodeUTF8 } from '../internal/utils/bytes';
+import { loggerFor } from '../internal/utils/log';
+import type { Hypeman } from '../client';
+
+type Bytes = string | ArrayBuffer | Uint8Array | null | undefined;
+
+export type ServerSentEvent = {
+  event: string | null;
+  data: string;
+  raw: string[];
+};
+
+export class Stream<Item> implements AsyncIterable<Item> {
+  controller: AbortController;
+  #client: Hypeman | undefined;
+
+  constructor(
+    private iterator: () => AsyncIterator<Item>,
+    controller: AbortController,
+    client?: Hypeman,
+  ) {
+    this.controller = controller;
+    this.#client = client;
+  }
+
+  static fromSSEResponse<Item>(
+    response: Response,
+    controller: AbortController,
+    client?: Hypeman,
+  ): Stream<Item> {
+    let consumed = false;
+    const logger = client ? loggerFor(client) : console;
+
+    async function* iterator(): AsyncIterator<Item, any, undefined> {
+      if (consumed) {
+        throw new HypemanError('Cannot iterate over a consumed stream, use `.tee()` to split the stream.');
+      }
+      consumed = true;
+      let done = false;
+      try {
+        for await (const sse of _iterSSEMessages(response, controller)) {
+          try {
+            yield JSON.parse(sse.data);
+          } catch (e) {
+            logger.error(`Could not parse message into JSON:`, sse.data);
+            logger.error(`From chunk:`, sse.raw);
+            throw e;
+          }
+        }
+        done = true;
+      } catch (e) {
+        // If the user calls `stream.controller.abort()`, we should exit without throwing.
+        if (isAbortError(e)) return;
+        throw e;
+      } finally {
+        // If the user `break`s, abort the ongoing request.
+        if (!done) controller.abort();
+      }
+    }
+
+    return new Stream(iterator, controller, client);
+  }
+
+  /**
+   * Generates a Stream from a newline-separated ReadableStream
+   * where each item is a JSON value.
+   */
+  static fromReadableStream<Item>(
+    readableStream: ReadableStream,
+    controller: AbortController,
+    client?: Hypeman,
+  ): Stream<Item> {
+    let consumed = false;
+
+    async function* iterLines(): AsyncGenerator<string, void, unknown> {
+      const lineDecoder = new LineDecoder();
+
+      const iter = ReadableStreamToAsyncIterable<Bytes>(readableStream);
+      for await (const chunk of iter) {
+        for (const line of lineDecoder.decode(chunk)) {
+          yield line;
+        }
+      }
+
+      for (const line of lineDecoder.flush()) {
+        yield line;
+      }
+    }
+
+    async function* iterator(): AsyncIterator<Item, any, undefined> {
+      if (consumed) {
+        throw new HypemanError('Cannot iterate over a consumed stream, use `.tee()` to split the stream.');
+      }
+      consumed = true;
+      let done = false;
+      try {
+        for await (const line of iterLines()) {
+          if (done) continue;
+          if (line) yield JSON.parse(line);
+        }
+        done = true;
+      } catch (e) {
+        // If the user calls `stream.controller.abort()`, we should exit without throwing.
+        if (isAbortError(e)) return;
+        throw e;
+      } finally {
+        // If the user `break`s, abort the ongoing request.
+        if (!done) controller.abort();
+      }
+    }
+
+    return new Stream(iterator, controller, client);
+  }
+
+  [Symbol.asyncIterator](): AsyncIterator<Item> {
+    return this.iterator();
+  }
+
+  /**
+   * Splits the stream into two streams which can be
+   * independently read from at different speeds.
+   */
+  tee(): [Stream<Item>, Stream<Item>] {
+    const left: Array<Promise<IteratorResult<Item>>> = [];
+    const right: Array<Promise<IteratorResult<Item>>> = [];
+    const iterator = this.iterator();
+
+    const teeIterator = (queue: Array<Promise<IteratorResult<Item>>>): AsyncIterator<Item> => {
+      return {
+        next: () => {
+          if (queue.length === 0) {
+            const result = iterator.next();
+            left.push(result);
+            right.push(result);
+          }
+          return queue.shift()!;
+        },
+      };
+    };
+
+    return [
+      new Stream(() => teeIterator(left), this.controller, this.#client),
+      new Stream(() => teeIterator(right), this.controller, this.#client),
+    ];
+  }
+
+  /**
+   * Converts this stream to a newline-separated ReadableStream of
+   * JSON stringified values in the stream
+   * which can be turned back into a Stream with `Stream.fromReadableStream()`.
+   */
+  toReadableStream(): ReadableStream {
+    const self = this;
+    let iter: AsyncIterator<Item>;
+
+    return makeReadableStream({
+      async start() {
+        iter = self[Symbol.asyncIterator]();
+      },
+      async pull(ctrl: any) {
+        try {
+          const { value, done } = await iter.next();
+          if (done) return ctrl.close();
+
+          const bytes = encodeUTF8(JSON.stringify(value) + '\n');
+
+          ctrl.enqueue(bytes);
+        } catch (err) {
+          ctrl.error(err);
+        }
+      },
+      async cancel() {
+        await iter.return?.();
+      },
+    });
+  }
+}
+
+export async function* _iterSSEMessages(
+  response: Response,
+  controller: AbortController,
+): AsyncGenerator<ServerSentEvent, void, unknown> {
+  if (!response.body) {
+    controller.abort();
+    if (
+      typeof (globalThis as any).navigator !== 'undefined' &&
+      (globalThis as any).navigator.product === 'ReactNative'
+    ) {
+      throw new HypemanError(
+        `The default react-native fetch implementation does not support streaming. Please use expo/fetch: https://docs.expo.dev/versions/latest/sdk/expo/#expofetch-api`,
+      );
+    }
+    throw new HypemanError(`Attempted to iterate over a response with no body`);
+  }
+
+  const sseDecoder = new SSEDecoder();
+  const lineDecoder = new LineDecoder();
+
+  const iter = ReadableStreamToAsyncIterable<Bytes>(response.body);
+  for await (const sseChunk of iterSSEChunks(iter)) {
+    for (const line of lineDecoder.decode(sseChunk)) {
+      const sse = sseDecoder.decode(line);
+      if (sse) yield sse;
+    }
+  }
+
+  for (const line of lineDecoder.flush()) {
+    const sse = sseDecoder.decode(line);
+    if (sse) yield sse;
+  }
+}
+
+/**
+ * Given an async iterable iterator, iterates over it and yields full
+ * SSE chunks, i.e. yields when a double new-line is encountered.
+ */
+async function* iterSSEChunks(iterator: AsyncIterableIterator<Bytes>): AsyncGenerator<Uint8Array> {
+  let data = new Uint8Array();
+
+  for await (const chunk of iterator) {
+    if (chunk == null) {
+      continue;
+    }
+
+    const binaryChunk =
+      chunk instanceof ArrayBuffer ? new Uint8Array(chunk)
+      : typeof chunk === 'string' ? encodeUTF8(chunk)
+      : chunk;
+
+    let newData = new Uint8Array(data.length + binaryChunk.length);
+    newData.set(data);
+    newData.set(binaryChunk, data.length);
+    data = newData;
+
+    let patternIndex;
+    while ((patternIndex = findDoubleNewlineIndex(data)) !== -1) {
+      yield data.slice(0, patternIndex);
+      data = data.slice(patternIndex);
+    }
+  }
+
+  if (data.length > 0) {
+    yield data;
+  }
+}
+
+class SSEDecoder {
+  private data: string[];
+  private event: string | null;
+  private chunks: string[];
+
+  constructor() {
+    this.event = null;
+    this.data = [];
+    this.chunks = [];
+  }
+
+  decode(line: string) {
+    if (line.endsWith('\r')) {
+      line = line.substring(0, line.length - 1);
+    }
+
+    if (!line) {
+      // empty line and we didn't previously encounter any messages
+      if (!this.event && !this.data.length) return null;
+
+      const sse: ServerSentEvent = {
+        event: this.event,
+        data: this.data.join('\n'),
+        raw: this.chunks,
+      };
+
+      this.event = null;
+      this.data = [];
+      this.chunks = [];
+
+      return sse;
+    }
+
+    this.chunks.push(line);
+
+    if (line.startsWith(':')) {
+      return null;
+    }
+
+    let [fieldname, _, value] = partition(line, ':');
+
+    if (value.startsWith(' ')) {
+      value = value.substring(1);
+    }
+
+    if (fieldname === 'event') {
+      this.event = value;
+    } else if (fieldname === 'data') {
+      this.data.push(value);
+    }
+
+    return null;
+  }
+}
+
+function partition(str: string, delimiter: string): [string, string, string] {
+  const index = str.indexOf(delimiter);
+  if (index !== -1) {
+    return [str.substring(0, index), delimiter, str.substring(index + delimiter.length)];
+  }
+
+  return [str, '', ''];
+}
diff --git a/sdks/ts/src/core/uploads.ts b/sdks/ts/src/core/uploads.ts
new file mode 100644
index 00000000..2882ca6d
--- /dev/null
+++ b/sdks/ts/src/core/uploads.ts
@@ -0,0 +1,2 @@
+export { type Uploadable } from '../internal/uploads';
+export { toFile, type ToFileInput } from '../internal/to-file';
diff --git a/sdks/ts/src/error.ts b/sdks/ts/src/error.ts
new file mode 100644
index 00000000..fc55f46c
--- /dev/null
+++ b/sdks/ts/src/error.ts
@@ -0,0 +1,2 @@
+/** @deprecated Import from ./core/error instead */
+export * from './core/error';
diff --git a/sdks/ts/src/index.ts b/sdks/ts/src/index.ts
new file mode 100644
index 00000000..34a0b699
--- /dev/null
+++ b/sdks/ts/src/index.ts
@@ -0,0 +1,22 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export { Hypeman as default } from './client';
+
+export { type Uploadable, toFile } from './core/uploads';
+export { APIPromise } from './core/api-promise';
+export { Hypeman, type ClientOptions } from './client';
+export {
+  HypemanError,
+  APIError,
+  APIConnectionError,
+  APIConnectionTimeoutError,
+  APIUserAbortError,
+  NotFoundError,
+  ConflictError,
+  RateLimitError,
+  BadRequestError,
+  AuthenticationError,
+  InternalServerError,
+  PermissionDeniedError,
+  UnprocessableEntityError,
+} from './core/error';
diff --git a/sdks/ts/src/internal/README.md b/sdks/ts/src/internal/README.md
new file mode 100644
index 00000000..3ef5a25b
--- /dev/null
+++ b/sdks/ts/src/internal/README.md
@@ -0,0 +1,3 @@
+# `internal`
+
+The modules in this directory are not importable outside this package and will change between releases.
diff --git a/sdks/ts/src/internal/builtin-types.ts b/sdks/ts/src/internal/builtin-types.ts
new file mode 100644
index 00000000..c23d3bde
--- /dev/null
+++ b/sdks/ts/src/internal/builtin-types.ts
@@ -0,0 +1,93 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export type Fetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+
+/**
+ * An alias to the builtin `RequestInit` type so we can
+ * easily alias it in import statements if there are name clashes.
+ *
+ * https://developer.mozilla.org/docs/Web/API/RequestInit
+ */
+type _RequestInit = RequestInit;
+
+/**
+ * An alias to the builtin `Response` type so we can
+ * easily alias it in import statements if there are name clashes.
+ *
+ * https://developer.mozilla.org/docs/Web/API/Response
+ */
+type _Response = Response;
+
+/**
+ * The type for the first argument to `fetch`.
+ *
+ * https://developer.mozilla.org/docs/Web/API/Window/fetch#resource
+ */
+type _RequestInfo = Request | URL | string;
+
+/**
+ * The type for constructing `RequestInit` Headers.
+ *
+ * https://developer.mozilla.org/docs/Web/API/RequestInit#setting_headers
+ */
+type _HeadersInit = RequestInit['headers'];
+
+/**
+ * The type for constructing `RequestInit` body.
+ *
+ * https://developer.mozilla.org/docs/Web/API/RequestInit#body
+ */
+type _BodyInit = RequestInit['body'];
+
+/**
+ * An alias to the builtin `Array<T>` type so we can
+ * easily alias it in import statements if there are name clashes.
+ */
+type _Array<T> = Array<T>;
+
+/**
+ * An alias to the builtin `Record<K, T>` type so we can
+ * easily alias it in import statements if there are name clashes.
+ */
+type _Record<K extends keyof any, T> = Record<K, T>;
+
+export type {
+  _Array as Array,
+  _BodyInit as BodyInit,
+  _HeadersInit as HeadersInit,
+  _Record as Record,
+  _RequestInfo as RequestInfo,
+  _RequestInit as RequestInit,
+  _Response as Response,
+};
+
+/**
+ * A copy of the builtin `EndingType` type as it isn't fully supported in certain
+ * environments and attempting to reference the global version will error.
+ *
+ * https://github.com/microsoft/TypeScript/blob/49ad1a3917a0ea57f5ff248159256e12bb1cb705/src/lib/dom.generated.d.ts#L27941
+ */
+type EndingType = 'native' | 'transparent';
+
+/**
+ * A copy of the builtin `BlobPropertyBag` type as it isn't fully supported in certain
+ * environments and attempting to reference the global version will error.
+ *
+ * https://github.com/microsoft/TypeScript/blob/49ad1a3917a0ea57f5ff248159256e12bb1cb705/src/lib/dom.generated.d.ts#L154
+ * https://developer.mozilla.org/en-US/docs/Web/API/Blob/Blob#options
+ */
+export interface BlobPropertyBag {
+  endings?: EndingType;
+  type?: string;
+}
+
+/**
+ * A copy of the builtin `FilePropertyBag` type as it isn't fully supported in certain
+ * environments and attempting to reference the global version will error.
+ *
+ * https://github.com/microsoft/TypeScript/blob/49ad1a3917a0ea57f5ff248159256e12bb1cb705/src/lib/dom.generated.d.ts#L503
+ * https://developer.mozilla.org/en-US/docs/Web/API/File/File#options
+ */
+export interface FilePropertyBag extends BlobPropertyBag {
+  lastModified?: number;
+}
diff --git a/sdks/ts/src/internal/decoders/line.ts b/sdks/ts/src/internal/decoders/line.ts
new file mode 100644
index 00000000..b3bfa97c
--- /dev/null
+++ b/sdks/ts/src/internal/decoders/line.ts
@@ -0,0 +1,135 @@
+import { concatBytes, decodeUTF8, encodeUTF8 } from '../utils/bytes';
+
+export type Bytes = string | ArrayBuffer | Uint8Array | null | undefined;
+
+/**
+ * A re-implementation of httpx's `LineDecoder` in Python that handles incrementally
+ * reading lines from text.
+ *
+ * https://github.com/encode/httpx/blob/920333ea98118e9cf617f246905d7b202510941c/httpx/_decoders.py#L258
+ */
+export class LineDecoder {
+  // prettier-ignore
+  static NEWLINE_CHARS = new Set(['\n', '\r']);
+  static NEWLINE_REGEXP = /\r\n|[\n\r]/g;
+
+  #buffer: Uint8Array;
+  #carriageReturnIndex: number | null;
+
+  constructor() {
+    this.#buffer = new Uint8Array();
+    this.#carriageReturnIndex = null;
+  }
+
+  decode(chunk: Bytes): string[] {
+    if (chunk == null) {
+      return [];
+    }
+
+    const binaryChunk =
+      chunk instanceof ArrayBuffer ? new Uint8Array(chunk)
+      : typeof chunk === 'string' ? encodeUTF8(chunk)
+      : chunk;
+
+    this.#buffer = concatBytes([this.#buffer, binaryChunk]);
+
+    const lines: string[] = [];
+    let patternIndex;
+    while ((patternIndex = findNewlineIndex(this.#buffer, this.#carriageReturnIndex)) != null) {
+      if (patternIndex.carriage && this.#carriageReturnIndex == null) {
+        // skip until we either get a corresponding `\n`, a new `\r` or nothing
+        this.#carriageReturnIndex = patternIndex.index;
+        continue;
+      }
+
+      // we got double \r or \rtext\n
+      if (
+        this.#carriageReturnIndex != null &&
+        (patternIndex.index !== this.#carriageReturnIndex + 1 || patternIndex.carriage)
+      ) {
+        lines.push(decodeUTF8(this.#buffer.subarray(0, this.#carriageReturnIndex - 1)));
+        this.#buffer = this.#buffer.subarray(this.#carriageReturnIndex);
+        this.#carriageReturnIndex = null;
+        continue;
+      }
+
+      const endIndex =
+        this.#carriageReturnIndex !== null ? patternIndex.preceding - 1 : patternIndex.preceding;
+
+      const line = decodeUTF8(this.#buffer.subarray(0, endIndex));
+      lines.push(line);
+
+      this.#buffer = this.#buffer.subarray(patternIndex.index);
+      this.#carriageReturnIndex = null;
+    }
+
+    return lines;
+  }
+
+  flush(): string[] {
+    if (!this.#buffer.length) {
+      return [];
+    }
+    return this.decode('\n');
+  }
+}
+
+/**
+ * This function searches the buffer for the end patterns, (\r or \n)
+ * and returns an object with the index preceding the matched newline and the
+ * index after the newline char. `null` is returned if no new line is found.
+ *
+ * ```ts
+ * findNewLineIndex('abc\ndef') -> { preceding: 2, index: 3 }
+ * ```
+ */
+function findNewlineIndex(
+  buffer: Uint8Array,
+  startIndex: number | null,
+): { preceding: number; index: number; carriage: boolean } | null {
+  const newline = 0x0a; // \n
+  const carriage = 0x0d; // \r
+
+  for (let i = startIndex ?? 0; i < buffer.length; i++) {
+    if (buffer[i] === newline) {
+      return { preceding: i, index: i + 1, carriage: false };
+    }
+
+    if (buffer[i] === carriage) {
+      return { preceding: i, index: i + 1, carriage: true };
+    }
+  }
+
+  return null;
+}
+
+export function findDoubleNewlineIndex(buffer: Uint8Array): number {
+  // This function searches the buffer for the end patterns (\r\r, \n\n, \r\n\r\n)
+  // and returns the index right after the first occurrence of any pattern,
+  // or -1 if none of the patterns are found.
+  const newline = 0x0a; // \n
+  const carriage = 0x0d; // \r
+
+  for (let i = 0; i < buffer.length - 1; i++) {
+    if (buffer[i] === newline && buffer[i + 1] === newline) {
+      // \n\n
+      return i + 2;
+    }
+    if (buffer[i] === carriage && buffer[i + 1] === carriage) {
+      // \r\r
+      return i + 2;
+    }
+    if (
+      buffer[i] === carriage &&
+      buffer[i + 1] === newline &&
+      i + 3 < buffer.length &&
+      buffer[i + 2] === carriage &&
+      buffer[i + 3] === newline
+    ) {
+      // \r\n\r\n
+      return i + 4;
+    }
+  }
+
+  return -1;
+}
diff --git a/sdks/ts/src/internal/detect-platform.ts b/sdks/ts/src/internal/detect-platform.ts
new file mode 100644
index 00000000..e82d95c9
--- /dev/null
+++ b/sdks/ts/src/internal/detect-platform.ts
@@ -0,0 +1,196 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { VERSION } from '../version';
+
+export const isRunningInBrowser = () => {
+  return (
+    // @ts-ignore
+    typeof window !== 'undefined' &&
+    // @ts-ignore
+    typeof window.document !== 'undefined' &&
+    // @ts-ignore
+    typeof navigator !== 'undefined'
+  );
+};
+
+type DetectedPlatform = 'deno' | 'node' | 'edge' | 'unknown';
+
+/**
+ * Note this does not detect 'browser'; for that, use getBrowserInfo().
+ */
+function getDetectedPlatform(): DetectedPlatform {
+  if (typeof Deno !== 'undefined' && Deno.build != null) {
+    return 'deno';
+  }
+  if (typeof EdgeRuntime !== 'undefined') {
+    return 'edge';
+  }
+  if (
+    Object.prototype.toString.call(
+      typeof (globalThis as any).process !== 'undefined' ? (globalThis as any).process : 0,
+    ) === '[object process]'
+  ) {
+    return 'node';
+  }
+  return 'unknown';
+}
+
+declare const Deno: any;
+declare const EdgeRuntime: any;
+type Arch = 'x32' | 'x64' | 'arm' | 'arm64' | `other:${string}` | 'unknown';
+type PlatformName =
+  | 'MacOS'
+  | 'Linux'
+  | 'Windows'
+  | 'FreeBSD'
+  | 'OpenBSD'
+  | 'iOS'
+  | 'Android'
+  | `Other:${string}`
+  | 'Unknown';
+type Browser = 'ie' | 'edge' | 'chrome' | 'firefox' | 'safari';
+type PlatformProperties = {
+  'X-Stainless-Lang': 'js';
+  'X-Stainless-Package-Version': string;
+  'X-Stainless-OS': PlatformName;
+  'X-Stainless-Arch': Arch;
+  'X-Stainless-Runtime': 'node' | 'deno' | 'edge' | `browser:${Browser}` | 'unknown';
+  'X-Stainless-Runtime-Version': string;
+};
+const getPlatformProperties = (): PlatformProperties => {
+  const detectedPlatform = getDetectedPlatform();
+  if (detectedPlatform === 'deno') {
+    return {
+      'X-Stainless-Lang': 'js',
+      'X-Stainless-Package-Version': VERSION,
+      'X-Stainless-OS': normalizePlatform(Deno.build.os),
+      'X-Stainless-Arch': normalizeArch(Deno.build.arch),
+      'X-Stainless-Runtime': 'deno',
+      'X-Stainless-Runtime-Version':
+        typeof Deno.version === 'string' ? Deno.version : Deno.version?.deno ?? 'unknown',
+    };
+  }
+  if (typeof EdgeRuntime !== 'undefined') {
+    return {
+      'X-Stainless-Lang': 'js',
+      'X-Stainless-Package-Version': VERSION,
+      'X-Stainless-OS': 'Unknown',
+      'X-Stainless-Arch': `other:${EdgeRuntime}`,
+      'X-Stainless-Runtime': 'edge',
+      'X-Stainless-Runtime-Version': (globalThis as any).process.version,
+    };
+  }
+  // Check if Node.js
+  if (detectedPlatform === 'node') {
+    return {
+      'X-Stainless-Lang': 'js',
+      'X-Stainless-Package-Version': VERSION,
+      'X-Stainless-OS': normalizePlatform((globalThis as any).process.platform ?? 'unknown'),
+      'X-Stainless-Arch': normalizeArch((globalThis as any).process.arch ?? 'unknown'),
+      'X-Stainless-Runtime': 'node',
+      'X-Stainless-Runtime-Version': (globalThis as any).process.version ?? 'unknown',
+    };
+  }
+
+  const browserInfo = getBrowserInfo();
+  if (browserInfo) {
+    return {
+      'X-Stainless-Lang': 'js',
+      'X-Stainless-Package-Version': VERSION,
+      'X-Stainless-OS': 'Unknown',
+      'X-Stainless-Arch': 'unknown',
+      'X-Stainless-Runtime': `browser:${browserInfo.browser}`,
+      'X-Stainless-Runtime-Version': browserInfo.version,
+    };
+  }
+
+  // TODO add support for Cloudflare workers, etc.
+  return {
+    'X-Stainless-Lang': 'js',
+    'X-Stainless-Package-Version': VERSION,
+    'X-Stainless-OS': 'Unknown',
+    'X-Stainless-Arch': 'unknown',
+    'X-Stainless-Runtime': 'unknown',
+    'X-Stainless-Runtime-Version': 'unknown',
+  };
+};
+
+type BrowserInfo = {
+  browser: Browser;
+  version: string;
+};
+
+declare const navigator: { userAgent: string } | undefined;
+
+// Note: modified from https://github.com/JS-DevTools/host-environment/blob/b1ab79ecde37db5d6e163c050e54fe7d287d7c92/src/isomorphic.browser.ts
+function getBrowserInfo(): BrowserInfo | null {
+  if (typeof navigator === 'undefined' || !navigator) {
+    return null;
+  }
+
+  // NOTE: The order matters here!
+  const browserPatterns = [
+    { key: 'edge' as const, pattern: /Edge(?:\W+(\d+)\.(\d+)(?:\.(\d+))?)?/ },
+    { key: 'ie' as const, pattern: /MSIE(?:\W+(\d+)\.(\d+)(?:\.(\d+))?)?/ },
+    { key: 'ie' as const, pattern: /Trident(?:.*rv\:(\d+)\.(\d+)(?:\.(\d+))?)?/ },
+    { key: 'chrome' as const, pattern: /Chrome(?:\W+(\d+)\.(\d+)(?:\.(\d+))?)?/ },
+    { key: 'firefox' as const, pattern: /Firefox(?:\W+(\d+)\.(\d+)(?:\.(\d+))?)?/ },
+    { key: 'safari' as const, pattern: /(?:Version\W+(\d+)\.(\d+)(?:\.(\d+))?)?(?:\W+Mobile\S*)?\W+Safari/ },
+  ];
+
+  // Find the FIRST matching browser
+  for (const { key, pattern } of browserPatterns) {
+    const match = pattern.exec(navigator.userAgent);
+    if (match) {
+      const major = match[1] || 0;
+      const minor = match[2] || 0;
+      const patch = match[3] || 0;
+
+      return { browser: key, version: `${major}.${minor}.${patch}` };
+    }
+  }
+
+  return null;
+}
+
+const normalizeArch = (arch: string): Arch => {
+  // Node docs:
+  // - https://nodejs.org/api/process.html#processarch
+  // Deno docs:
+  // - https://doc.deno.land/deno/stable/~/Deno.build
+  if (arch === 'x32') return 'x32';
+  if (arch === 'x86_64' || arch === 'x64') return 'x64';
+  if (arch === 'arm') return 'arm';
+  if (arch === 'aarch64' || arch === 'arm64') return 'arm64';
+  if (arch) return `other:${arch}`;
+  return 'unknown';
+};
+
+const normalizePlatform = (platform: string): PlatformName => {
+  // Node platforms:
+  // - https://nodejs.org/api/process.html#processplatform
+  // Deno platforms:
+  // - https://doc.deno.land/deno/stable/~/Deno.build
+  // - https://github.com/denoland/deno/issues/14799
+
+  platform = platform.toLowerCase();
+
+  // NOTE: this iOS check is untested and may not work
+  // Node does not work natively on IOS, there is a fork at
+  // https://github.com/nodejs-mobile/nodejs-mobile
+  // however it is unknown at the time of writing how to detect if it is running
+  if (platform.includes('ios')) return 'iOS';
+  if (platform === 'android') return 'Android';
+  if (platform === 'darwin') return 'MacOS';
+  if (platform === 'win32') return 'Windows';
+  if (platform === 'freebsd') return 'FreeBSD';
+  if (platform === 'openbsd') return 'OpenBSD';
+  if (platform === 'linux') return 'Linux';
+  if (platform) return `Other:${platform}`;
+  return 'Unknown';
+};
+
+let _platformHeaders: PlatformProperties;
+export const getPlatformHeaders = () => {
+  return (_platformHeaders ??= getPlatformProperties());
+};
diff --git a/sdks/ts/src/internal/errors.ts b/sdks/ts/src/internal/errors.ts
new file mode 100644
index 00000000..82c7b14d
--- /dev/null
+++ b/sdks/ts/src/internal/errors.ts
@@ -0,0 +1,33 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export function isAbortError(err: unknown) {
+  return (
+    typeof err === 'object' &&
+    err !== null &&
+    // Spec-compliant fetch implementations
+    (('name' in err && (err as any).name === 'AbortError') ||
+      // Expo fetch
+      ('message' in err && String((err as any).message).includes('FetchRequestCanceledException')))
+  );
+}
+
+export const castToError = (err: any): Error => {
+  if (err instanceof Error) return err;
+  if (typeof err === 'object' && err !== null) {
+    try {
+      if (Object.prototype.toString.call(err) === '[object Error]') {
+        // @ts-ignore - not all envs have native support for cause yet
+        const error = new Error(err.message, err.cause ? { cause: err.cause } : {});
+        if (err.stack) error.stack = err.stack;
+        // @ts-ignore - not all envs have native support for cause yet
+        if (err.cause && !error.cause) error.cause = err.cause;
+        if (err.name) error.name = err.name;
+        return error;
+      }
+    } catch {}
+    try {
+      return new Error(JSON.stringify(err));
+    } catch {}
+  }
+  return new Error(err);
+};
diff --git a/sdks/ts/src/internal/headers.ts b/sdks/ts/src/internal/headers.ts
new file mode 100644
index 00000000..c724a9d2
--- /dev/null
+++ b/sdks/ts/src/internal/headers.ts
@@ -0,0 +1,97 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { isReadonlyArray } from './utils/values';
+
+type HeaderValue = string | undefined | null;
+export type HeadersLike =
+  | Headers
+  | readonly HeaderValue[][]
+  | Record<string, HeaderValue | readonly HeaderValue[]>
+  | undefined
+  | null
+  | NullableHeaders;
+
+const brand_privateNullableHeaders = /* @__PURE__ */ Symbol('brand.privateNullableHeaders');
+
+/**
+ * @internal
+ * Users can pass explicit nulls to unset default headers. When we parse them
+ * into a standard headers type we need to preserve that information.
+ */
+export type NullableHeaders = {
+  /** Brand check, prevent users from creating a NullableHeaders. */
+  [brand_privateNullableHeaders]: true;
+  /** Parsed headers. */
+  values: Headers;
+  /** Set of lowercase header names explicitly set to null. */
+  nulls: Set<string>;
+};
+
+function* iterateHeaders(headers: HeadersLike): IterableIterator<readonly [string, string | null]> {
+  if (!headers) return;
+
+  if (brand_privateNullableHeaders in headers) {
+    const { values, nulls } = headers;
+    yield* values.entries();
+    for (const name of nulls) {
+      yield [name, null];
+    }
+    return;
+  }
+
+  let shouldClear = false;
+  let iter: Iterable<readonly (HeaderValue | readonly HeaderValue[])[]>;
+  if (headers instanceof Headers) {
+    iter = headers.entries();
+  } else if (isReadonlyArray(headers)) {
+    iter = headers;
+  } else {
+    shouldClear = true;
+    iter = Object.entries(headers ?? {});
+  }
+  for (let row of iter) {
+    const name = row[0];
+    if (typeof name !== 'string') throw new TypeError('expected header name to be a string');
+    const values = isReadonlyArray(row[1]) ? row[1] : [row[1]];
+    let didClear = false;
+    for (const value of values) {
+      if (value === undefined) continue;
+
+      // Objects keys always overwrite older headers, they never append.
+      // Yield a null to clear the header before adding the new values.
+      if (shouldClear && !didClear) {
+        didClear = true;
+        yield [name, null];
+      }
+      yield [name, value];
+    }
+  }
+}
+
+export const buildHeaders = (newHeaders: HeadersLike[]): NullableHeaders => {
+  const targetHeaders = new Headers();
+  const nullHeaders = new Set<string>();
+  for (const headers of newHeaders) {
+    const seenHeaders = new Set<string>();
+    for (const [name, value] of iterateHeaders(headers)) {
+      const lowerName = name.toLowerCase();
+      if (!seenHeaders.has(lowerName)) {
+        targetHeaders.delete(name);
+        seenHeaders.add(lowerName);
+      }
+      if (value === null) {
+        targetHeaders.delete(name);
+        nullHeaders.add(lowerName);
+      } else {
+        targetHeaders.append(name, value);
+        nullHeaders.delete(lowerName);
+      }
+    }
+  }
+  return { [brand_privateNullableHeaders]: true, values: targetHeaders, nulls: nullHeaders };
+};
+
+export const isEmptyHeaders = (headers: HeadersLike) => {
+  for (const _ of iterateHeaders(headers)) return false;
+  return true;
+};
diff --git a/sdks/ts/src/internal/parse.ts b/sdks/ts/src/internal/parse.ts
new file mode 100644
index 00000000..da4a9956
--- /dev/null
+++ b/sdks/ts/src/internal/parse.ts
@@ -0,0 +1,64 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import type { FinalRequestOptions } from './request-options';
+import { Stream } from '../core/streaming';
+import { type Hypeman } from '../client';
+import { formatRequestDetails, loggerFor } from './utils/log';
+
+export type APIResponseProps = {
+  response: Response;
+  options: FinalRequestOptions;
+  controller: AbortController;
+  requestLogID: string;
+  retryOfRequestLogID: string | undefined;
+  startTime: number;
+};
+
+export async function defaultParseResponse<T>(client: Hypeman, props: APIResponseProps): Promise<T> {
+  const { response, requestLogID, retryOfRequestLogID, startTime } = props;
+  const body = await (async () => {
+    if (props.options.stream) {
+      loggerFor(client).debug('response', response.status, response.url, response.headers, response.body);
+
+      // Note: there is an invariant here that isn't represented in the type system
+      // that if you set `stream: true` the response type must also be `Stream<T>`
+
+      if (props.options.__streamClass) {
+        return props.options.__streamClass.fromSSEResponse(response, props.controller, client) as any;
+      }
+
+      return Stream.fromSSEResponse(response, props.controller, client) as any;
+    }
+
+    // fetch refuses to read the body when the status code is 204.
+    if (response.status === 204) {
+      return null as T;
+    }
+
+    if (props.options.__binaryResponse) {
+      return response as unknown as T;
+    }
+
+    const contentType = response.headers.get('content-type');
+    const mediaType = contentType?.split(';')[0]?.trim();
+    const isJSON = mediaType?.includes('application/json') || mediaType?.endsWith('+json');
+    if (isJSON) {
+      const json = await response.json();
+      return json as T;
+    }
+
+    const text = await response.text();
+    return text as unknown as T;
+  })();
+  loggerFor(client).debug(
+    `[${requestLogID}] response parsed`,
+    formatRequestDetails({
+      retryOfRequestLogID,
+      url: response.url,
+      status: response.status,
+      body,
+      durationMs: Date.now() - startTime,
+    }),
+  );
+  return body;
+}
diff --git a/sdks/ts/src/internal/request-options.ts b/sdks/ts/src/internal/request-options.ts
new file mode 100644
index 00000000..56765e5a
--- /dev/null
+++ b/sdks/ts/src/internal/request-options.ts
@@ -0,0 +1,93 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { NullableHeaders } from './headers';
+
+import type { BodyInit } from './builtin-types';
+import { Stream } from '../core/streaming';
+import type { HTTPMethod, MergedRequestInit } from './types';
+import { type HeadersLike } from './headers';
+
+export type FinalRequestOptions = RequestOptions & { method: HTTPMethod; path: string };
+
+export type RequestOptions = {
+  /**
+   * The HTTP method for the request (e.g., 'get', 'post', 'put', 'delete').
+   */
+  method?: HTTPMethod;
+
+  /**
+   * The URL path for the request.
+   *
+   * @example "/v1/foo"
+   */
+  path?: string;
+
+  /**
+   * Query parameters to include in the request URL.
+   */
+  query?: object | undefined | null;
+
+  /**
+   * The request body. Can be a string, JSON object, FormData, or other supported types.
+   */
+  body?: unknown;
+
+  /**
+   * HTTP headers to include with the request. Can be a Headers object, plain object, or array of tuples.
+   */
+  headers?: HeadersLike;
+
+  /**
+   * The maximum number of times that the client will retry a request in case of a
+   * temporary failure, like a network error or a 5XX error from the server.
+   *
+   * @default 2
+   */
+  maxRetries?: number;
+
+  stream?: boolean | undefined;
+
+  /**
+   * The maximum amount of time (in milliseconds) that the client should wait for a response
+   * from the server before timing out a single request.
+   *
+   * @unit milliseconds
+   */
+  timeout?: number;
+
+  /**
+   * Additional `RequestInit` options to be passed to the underlying `fetch` call.
+   * These options will be merged with the client's default fetch options.
+   */
+  fetchOptions?: MergedRequestInit;
+
+  /**
+   * An AbortSignal that can be used to cancel the request.
+   */
+  signal?: AbortSignal | undefined | null;
+
+  /**
+   * A unique key for this request to enable idempotency.
+   */
+  idempotencyKey?: string;
+
+  /**
+   * Override the default base URL for this specific request.
+   */
+  defaultBaseURL?: string | undefined;
+
+  __binaryResponse?: boolean | undefined;
+  __streamClass?: typeof Stream;
+};
+
+export type EncodedContent = { bodyHeaders: HeadersLike; body: BodyInit };
+export type RequestEncoder = (request: { headers: NullableHeaders; body: unknown }) => EncodedContent;
+
+export const FallbackEncoder: RequestEncoder = ({ headers, body }) => {
+  return {
+    bodyHeaders: {
+      'content-type': 'application/json',
+    },
+    body: JSON.stringify(body),
+  };
+};
diff --git a/sdks/ts/src/internal/shim-types.ts b/sdks/ts/src/internal/shim-types.ts
new file mode 100644
index 00000000..8ddf7b0a
--- /dev/null
+++ b/sdks/ts/src/internal/shim-types.ts
@@ -0,0 +1,26 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+/**
+ * Shims for types that we can't always rely on being available globally.
+ *
+ * Note: these only exist at the type-level, there is no corresponding runtime
+ * version for any of these symbols.
+ */
+
+type NeverToAny<T> = T extends never ? any : T;
+
+/** @ts-ignore */
+type _DOMReadableStream<R = any> = globalThis.ReadableStream<R>;
+
+/** @ts-ignore */
+type _NodeReadableStream<R = any> = import('stream/web').ReadableStream<R>;
+
+type _ConditionalNodeReadableStream<R = any> =
+  typeof globalThis extends { ReadableStream: any } ? never : _NodeReadableStream<R>;
+
+type _ReadableStream<R = any> = NeverToAny<
+  | ([0] extends [1 & _DOMReadableStream<R>] ? never : _DOMReadableStream<R>)
+  | ([0] extends [1 & _ConditionalNodeReadableStream<R>] ? never : _ConditionalNodeReadableStream<R>)
+>;
+
+export type { _ReadableStream as ReadableStream };
diff --git a/sdks/ts/src/internal/shims.ts b/sdks/ts/src/internal/shims.ts
new file mode 100644
index 00000000..d228dc82
--- /dev/null
+++ b/sdks/ts/src/internal/shims.ts
@@ -0,0 +1,107 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+/**
+ * This module provides internal shims and utility functions for environments where certain Node.js or global types may not be available.
+ *
+ * These are used to ensure we can provide a consistent behaviour between different JavaScript environments and good error
+ * messages in cases where an environment isn't fully supported.
+ */
+
+import type { Fetch } from './builtin-types';
+import type { ReadableStream } from './shim-types';
+
+export function getDefaultFetch(): Fetch {
+  if (typeof fetch !== 'undefined') {
+    return fetch as any;
+  }
+
+  throw new Error(
+    '`fetch` is not defined as a global; Either pass `fetch` to the client, `new Hypeman({ fetch })` or polyfill the global, `globalThis.fetch = fetch`',
+  );
+}
+
+type ReadableStreamArgs = ConstructorParameters<typeof ReadableStream>;
+
+export function makeReadableStream(...args: ReadableStreamArgs): ReadableStream {
+  const ReadableStream = (globalThis as any).ReadableStream;
+  if (typeof ReadableStream === 'undefined') {
+    // Note: All of the platforms / runtimes we officially support already define
+    // `ReadableStream` as a global, so this should only ever be hit on unsupported runtimes.
+    throw new Error(
+      '`ReadableStream` is not defined as a global; You will need to polyfill it, `globalThis.ReadableStream = ReadableStream`',
+    );
+  }
+
+  return new ReadableStream(...args);
+}
+
+export function ReadableStreamFrom<T>(iterable: Iterable<T> | AsyncIterable<T>): ReadableStream<T> {
+  let iter: AsyncIterator<T> | Iterator<T> =
+    Symbol.asyncIterator in iterable ? iterable[Symbol.asyncIterator]() : iterable[Symbol.iterator]();
+
+  return makeReadableStream({
+    start() {},
+    async pull(controller: any) {
+      const { done, value } = await iter.next();
+      if (done) {
+        controller.close();
+      } else {
+        controller.enqueue(value);
+      }
+    },
+    async cancel() {
+      await iter.return?.();
+    },
+  });
+}
+
+/**
+ * Most browsers don't yet have async iterable support for ReadableStream,
+ * and Node has a very different way of reading bytes from its "ReadableStream".
+ *
+ * This polyfill was pulled from https://github.com/MattiasBuelens/web-streams-polyfill/pull/122#issuecomment-1627354490
+ */
+export function ReadableStreamToAsyncIterable<T>(stream: any): AsyncIterableIterator<T> {
+  if (stream[Symbol.asyncIterator]) return stream;
+
+  const reader = stream.getReader();
+  return {
+    async next() {
+      try {
+        const result = await reader.read();
+        if (result?.done) reader.releaseLock(); // release lock when stream becomes closed
+        return result;
+      } catch (e) {
+        reader.releaseLock(); // release lock when stream becomes errored
+        throw e;
+      }
+    },
+    async return() {
+      const cancelPromise = reader.cancel();
+      reader.releaseLock();
+      await cancelPromise;
+      return { done: true, value: undefined };
+    },
+    [Symbol.asyncIterator]() {
+      return this;
+    },
+  };
+}
+
+/**
+ * Cancels a ReadableStream we don't need to consume.
+ * See https://undici.nodejs.org/#/?id=garbage-collection
+ */
+export async function CancelReadableStream(stream: any): Promise<void> {
+  if (stream === null || typeof stream !== 'object') return;
+
+  if (stream[Symbol.asyncIterator]) {
+    await stream[Symbol.asyncIterator]().return?.();
+    return;
+  }
+
+  const reader = stream.getReader();
+  const cancelPromise = reader.cancel();
+  reader.releaseLock();
+  await cancelPromise;
+}
diff --git a/sdks/ts/src/internal/to-file.ts b/sdks/ts/src/internal/to-file.ts
new file mode 100644
index 00000000..30eada32
--- /dev/null
+++ b/sdks/ts/src/internal/to-file.ts
@@ -0,0 +1,154 @@
+import { BlobPart, getName, makeFile, isAsyncIterable } from './uploads';
+import type { FilePropertyBag } from './builtin-types';
+import { checkFileSupport } from './uploads';
+
+type BlobLikePart = string | ArrayBuffer | ArrayBufferView | BlobLike | DataView;
+
+/**
+ * Intended to match DOM Blob, node-fetch Blob, node:buffer Blob, etc.
+ * Don't add arrayBuffer here, node-fetch doesn't have it
+ */
+interface BlobLike {
+  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/size) */
+  readonly size: number;
+  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/type) */
+  readonly type: string;
+  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/text) */
+  text(): Promise<string>;
+  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/slice) */
+  slice(start?: number, end?: number): BlobLike;
+}
+
+/**
+ * This check adds the arrayBuffer() method type because it is available and used at runtime
+ */
+const isBlobLike = (value: any): value is BlobLike & { arrayBuffer(): Promise<ArrayBuffer> } =>
+  value != null &&
+  typeof value === 'object' &&
+  typeof value.size === 'number' &&
+  typeof value.type === 'string' &&
+  typeof value.text === 'function' &&
+  typeof value.slice === 'function' &&
+  typeof value.arrayBuffer === 'function';
+
+/**
+ * Intended to match DOM File, node:buffer File, undici File, etc.
+ */
+interface FileLike extends BlobLike {
+  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/File/lastModified) */
+  readonly lastModified: number;
+  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/File/name) */
+  readonly name?: string | undefined;
+}
+
+/**
+ * This check adds the arrayBuffer() method type because it is available and used at runtime
+ */
+const isFileLike = (value: any): value is FileLike & { arrayBuffer(): Promise<ArrayBuffer> } =>
+  value != null &&
+  typeof value === 'object' &&
+  typeof value.name === 'string' &&
+  typeof value.lastModified === 'number' &&
+  isBlobLike(value);
+
+/**
+ * Intended to match DOM Response, node-fetch Response, undici Response, etc.
+ */
+export interface ResponseLike {
+  url: string;
+  blob(): Promise<BlobLike>;
+}
+
+const isResponseLike = (value: any): value is ResponseLike =>
+  value != null &&
+  typeof value === 'object' &&
+  typeof value.url === 'string' &&
+  typeof value.blob === 'function';
+
+export type ToFileInput =
+  | FileLike
+  | ResponseLike
+  | Exclude<BlobLikePart, string>
+  | AsyncIterable<BlobLikePart>;
+
+/**
+ * Helper for creating a {@link File} to pass to an SDK upload method from a variety of different data formats
+ * @param value the raw content of the file. Can be an {@link Uploadable}, BlobLikePart, or AsyncIterable of BlobLikeParts
+ * @param {string=} name the name of the file. If omitted, toFile will try to determine a file name from bits if possible
+ * @param {Object=} options additional properties
+ * @param {string=} options.type the MIME type of the content
+ * @param {number=} options.lastModified the last modified timestamp
+ * @returns a {@link File} with the given properties
+ */
+export async function toFile(
+  value: ToFileInput | PromiseLike<ToFileInput>,
+  name?: string | null | undefined,
+  options?: FilePropertyBag | undefined,
+): Promise<File> {
+  checkFileSupport();
+
+  // If it's a promise, resolve it.
+  value = await value;
+
+  // If we've been given a `File` we don't need to do anything
+  if (isFileLike(value)) {
+    if (value instanceof File) {
+      return value;
+    }
+    return makeFile([await value.arrayBuffer()], value.name);
+  }
+
+  if (isResponseLike(value)) {
+    const blob = await value.blob();
+    name ||= new URL(value.url).pathname.split(/[\\/]/).pop();
+
+    return makeFile(await getBytes(blob), name, options);
+  }
+
+  const parts = await getBytes(value);
+
+  name ||= getName(value);
+
+  if (!options?.type) {
+    const type = parts.find((part) => typeof part === 'object' && 'type' in part && part.type);
+    if (typeof type === 'string') {
+      options = { ...options, type };
+    }
+  }
+
+  return makeFile(parts, name, options);
+}
+
+async function getBytes(value: BlobLikePart | AsyncIterable<BlobLikePart>): Promise<Array<BlobPart>> {
+  let parts: Array<BlobPart> = [];
+  if (
+    typeof value === 'string' ||
+    ArrayBuffer.isView(value) || // includes Uint8Array, Buffer, etc.
+    value instanceof ArrayBuffer
+  ) {
+    parts.push(value);
+  } else if (isBlobLike(value)) {
+    parts.push(value instanceof Blob ? value : await value.arrayBuffer());
+  } else if (
+    isAsyncIterable(value) // includes Readable, ReadableStream, etc.
+  ) {
+    for await (const chunk of value) {
+      parts.push(...(await getBytes(chunk as BlobLikePart))); // TODO, consider validating?
+    }
+  } else {
+    const constructor = value?.constructor?.name;
+    throw new Error(
+      `Unexpected data type: ${typeof value}${
+        constructor ? `; constructor: ${constructor}` : ''
+      }${propsForError(value)}`,
+    );
+  }
+
+  return parts;
+}
+
+function propsForError(value: unknown): string {
+  if (typeof value !== 'object' || value === null) return '';
+  const props = Object.getOwnPropertyNames(value);
+  return `; props: [${props.map((p) => `"${p}"`).join(', ')}]`;
+}
diff --git a/sdks/ts/src/internal/types.ts b/sdks/ts/src/internal/types.ts
new file mode 100644
index 00000000..b668dfc0
--- /dev/null
+++ b/sdks/ts/src/internal/types.ts
@@ -0,0 +1,95 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export type PromiseOrValue<T> = T | Promise<T>;
+export type HTTPMethod = 'get' | 'post' | 'put' | 'patch' | 'delete';
+
+export type KeysEnum<T> = { [P in keyof Required<T>]: true };
+
+export type FinalizedRequestInit = RequestInit & { headers: Headers };
+
+type NotAny<T> = [0] extends [1 & T] ? never : T;
+
+/**
+ * Some environments overload the global fetch function, and Parameters<T> only gets the last signature.
+ */
+type OverloadedParameters<T> =
+  T extends (
+    {
+      (...args: infer A): unknown;
+      (...args: infer B): unknown;
+      (...args: infer C): unknown;
+      (...args: infer D): unknown;
+    }
+  ) ?
+    A | B | C | D
+  : T extends (
+    {
+      (...args: infer A): unknown;
+      (...args: infer B): unknown;
+      (...args: infer C): unknown;
+    }
+  ) ?
+    A | B | C
+  : T extends (
+    {
+      (...args: infer A): unknown;
+      (...args: infer B): unknown;
+    }
+  ) ?
+    A | B
+  : T extends (...args: infer A) => unknown ? A
+  : never;
+
+/* eslint-disable */
+/**
+ * These imports attempt to get types from a parent package's dependencies.
+ * Unresolved bare specifiers can trigger [automatic type acquisition][1] in some projects, which
+ * would cause typescript to show types not present at runtime. To avoid this, we import
+ * directly from parent node_modules folders.
+ *
+ * We need to check multiple levels because we don't know what directory structure we'll be in.
+ * For example, pnpm generates directories like this:
+ * ```
+ * node_modules
+ * ├── .pnpm
+ * │   └── pkg@1.0.0
+ * │       └── node_modules
+ * │           └── pkg
+ * │               └── internal
+ * │                   └── types.d.ts
+ * ├── pkg -> .pnpm/pkg@1.0.0/node_modules/pkg
+ * └── undici
+ * ```
+ *
+ * [1]: https://www.typescriptlang.org/tsconfig/#typeAcquisition
+ */
+/** @ts-ignore For users with \@types/node */
+type UndiciTypesRequestInit = NotAny<import('../node_modules/undici-types/index.d.ts').RequestInit> | NotAny<import('../../node_modules/undici-types/index.d.ts').RequestInit> | NotAny<import('../../../node_modules/undici-types/index.d.ts').RequestInit> | NotAny<import('../../../../node_modules/undici-types/index.d.ts').RequestInit> | NotAny<import('../../../../../node_modules/undici-types/index.d.ts').RequestInit> | NotAny<import('../../../../../../node_modules/undici-types/index.d.ts').RequestInit> | NotAny<import('../../../../../../../node_modules/undici-types/index.d.ts').RequestInit> | NotAny<import('../../../../../../../../node_modules/undici-types/index.d.ts').RequestInit> | NotAny<import('../../../../../../../../../node_modules/undici-types/index.d.ts').RequestInit> | NotAny<import('../../../../../../../../../../node_modules/undici-types/index.d.ts').RequestInit>;
+/** @ts-ignore For users with undici */
+type UndiciRequestInit = NotAny<import('../node_modules/undici/index.d.ts').RequestInit> | NotAny<import('../../node_modules/undici/index.d.ts').RequestInit> | NotAny<import('../../../node_modules/undici/index.d.ts').RequestInit> | NotAny<import('../../../../node_modules/undici/index.d.ts').RequestInit> | NotAny<import('../../../../../node_modules/undici/index.d.ts').RequestInit> | NotAny<import('../../../../../../node_modules/undici/index.d.ts').RequestInit> | NotAny<import('../../../../../../../node_modules/undici/index.d.ts').RequestInit> | NotAny<import('../../../../../../../../node_modules/undici/index.d.ts').RequestInit> | NotAny<import('../../../../../../../../../node_modules/undici/index.d.ts').RequestInit> | NotAny<import('../../../../../../../../../../node_modules/undici/index.d.ts').RequestInit>;
+/** @ts-ignore For users with \@types/bun */
+type BunRequestInit = globalThis.FetchRequestInit;
+/** @ts-ignore For users with node-fetch@2 */
+type NodeFetch2RequestInit = NotAny<import('../node_modules/@types/node-fetch/index.d.ts').RequestInit> | NotAny<import('../../node_modules/@types/node-fetch/index.d.ts').RequestInit> | NotAny<import('../../../node_modules/@types/node-fetch/index.d.ts').RequestInit> | NotAny<import('../../../../node_modules/@types/node-fetch/index.d.ts').RequestInit> | NotAny<import('../../../../../node_modules/@types/node-fetch/index.d.ts').RequestInit> | NotAny<import('../../../../../../node_modules/@types/node-fetch/index.d.ts').RequestInit> | NotAny<import('../../../../../../../node_modules/@types/node-fetch/index.d.ts').RequestInit> | NotAny<import('../../../../../../../../node_modules/@types/node-fetch/index.d.ts').RequestInit> | NotAny<import('../../../../../../../../../node_modules/@types/node-fetch/index.d.ts').RequestInit> | NotAny<import('../../../../../../../../../../node_modules/@types/node-fetch/index.d.ts').RequestInit>;
+/** @ts-ignore For users with node-fetch@3, doesn't need file extension because types are at ./@types/index.d.ts */
+type NodeFetch3RequestInit =  NotAny<import('../node_modules/node-fetch').RequestInit> | NotAny<import('../../node_modules/node-fetch').RequestInit> | NotAny<import('../../../node_modules/node-fetch').RequestInit> | NotAny<import('../../../../node_modules/node-fetch').RequestInit> | NotAny<import('../../../../../node_modules/node-fetch').RequestInit> | NotAny<import('../../../../../../node_modules/node-fetch').RequestInit> | NotAny<import('../../../../../../../node_modules/node-fetch').RequestInit> | NotAny<import('../../../../../../../../node_modules/node-fetch').RequestInit> | NotAny<import('../../../../../../../../../node_modules/node-fetch').RequestInit> | NotAny<import('../../../../../../../../../../node_modules/node-fetch').RequestInit>;
+/** @ts-ignore For users who use Deno */
+type FetchRequestInit = NonNullable<OverloadedParameters<typeof fetch>[1]>;
+/* eslint-enable */
+
+type RequestInits =
+  | NotAny<UndiciTypesRequestInit>
+  | NotAny<UndiciRequestInit>
+  | NotAny<BunRequestInit>
+  | NotAny<NodeFetch2RequestInit>
+  | NotAny<NodeFetch3RequestInit>
+  | NotAny<RequestInit>
+  | NotAny<FetchRequestInit>;
+
+/**
+ * This type contains `RequestInit` options that may be available on the current runtime,
+ * including per-platform extensions like `dispatcher`, `agent`, `client`, etc.
+ */
+export type MergedRequestInit = RequestInits &
+  /** We don't include these in the types as they'll be overridden for every request. */
+  Partial<Record<'body' | 'headers' | 'method' | 'signal', never>>;
diff --git a/sdks/ts/src/internal/uploads.ts b/sdks/ts/src/internal/uploads.ts
new file mode 100644
index 00000000..df50d07f
--- /dev/null
+++ b/sdks/ts/src/internal/uploads.ts
@@ -0,0 +1,187 @@
+import { type RequestOptions } from './request-options';
+import type { FilePropertyBag, Fetch } from './builtin-types';
+import type { Hypeman } from '../client';
+import { ReadableStreamFrom } from './shims';
+
+export type BlobPart = string | ArrayBuffer | ArrayBufferView | Blob | DataView;
+type FsReadStream = AsyncIterable<Uint8Array> & { path: string | { toString(): string } };
+
+// https://github.com/oven-sh/bun/issues/5980
+interface BunFile extends Blob {
+  readonly name?: string | undefined;
+}
+
+export const checkFileSupport = () => {
+  if (typeof File === 'undefined') {
+    const { process } = globalThis as any;
+    const isOldNode =
+      typeof process?.versions?.node === 'string' && parseInt(process.versions.node.split('.')) < 20;
+    throw new Error(
+      '`File` is not defined as a global, which is required for file uploads.' +
+        (isOldNode ?
+          " Update to Node 20 LTS or newer, or set `globalThis.File` to `import('node:buffer').File`."
+        : ''),
+    );
+  }
+};
+
+/**
+ * Typically, this is a native "File" class.
+ *
+ * We provide the {@link toFile} utility to convert a variety of objects
+ * into the File class.
+ *
+ * For convenience, you can also pass a fetch Response, or in Node,
+ * the result of fs.createReadStream().
+ */
+export type Uploadable = File | Response | FsReadStream | BunFile;
+
+/**
+ * Construct a `File` instance. This is used to ensure a helpful error is thrown
+ * for environments that don't define a global `File` yet.
+ */
+export function makeFile(
+  fileBits: BlobPart[],
+  fileName: string | undefined,
+  options?: FilePropertyBag,
+): File {
+  checkFileSupport();
+  return new File(fileBits as any, fileName ?? 'unknown_file', options);
+}
+
+export function getName(value: any): string | undefined {
+  return (
+    (
+      (typeof value === 'object' &&
+        value !== null &&
+        (('name' in value && value.name && String(value.name)) ||
+          ('url' in value && value.url && String(value.url)) ||
+          ('filename' in value && value.filename && String(value.filename)) ||
+          ('path' in value && value.path && String(value.path)))) ||
+      ''
+    )
+      .split(/[\\/]/)
+      .pop() || undefined
+  );
+}
+
+export const isAsyncIterable = (value: any): value is AsyncIterable<any> =>
+  value != null && typeof value === 'object' && typeof value[Symbol.asyncIterator] === 'function';
+
+/**
+ * Returns a multipart/form-data request if any part of the given request body contains a File / Blob value.
+ * Otherwise returns the request as is.
+ */
+export const maybeMultipartFormRequestOptions = async (
+  opts: RequestOptions,
+  fetch: Hypeman | Fetch,
+): Promise<RequestOptions> => {
+  if (!hasUploadableValue(opts.body)) return opts;
+
+  return { ...opts, body: await createForm(opts.body, fetch) };
+};
+
+type MultipartFormRequestOptions = Omit<RequestOptions, 'body'> & { body: unknown };
+
+export const multipartFormRequestOptions = async (
+  opts: MultipartFormRequestOptions,
+  fetch: Hypeman | Fetch,
+): Promise<RequestOptions> => {
+  return { ...opts, body: await createForm(opts.body, fetch) };
+};
+
+const supportsFormDataMap = /* @__PURE__ */ new WeakMap<Fetch, Promise<boolean>>();
+
+/**
+ * node-fetch doesn't support the global FormData object in recent node versions. Instead of sending
+ * properly-encoded form data, it just stringifies the object, resulting in a request body of "[object FormData]".
+ * This function detects if the fetch function provided supports the global FormData object to avoid
+ * confusing error messages later on.
+ */
+function supportsFormData(fetchObject: Hypeman | Fetch): Promise<boolean> {
+  const fetch: Fetch = typeof fetchObject === 'function' ? fetchObject : (fetchObject as any).fetch;
+  const cached = supportsFormDataMap.get(fetch);
+  if (cached) return cached;
+  const promise = (async () => {
+    try {
+      const FetchResponse = (
+        'Response' in fetch ?
+          fetch.Response
+        : (await fetch('data:,')).constructor) as typeof Response;
+      const data = new FormData();
+      if (data.toString() === (await new FetchResponse(data).text())) {
+        return false;
+      }
+      return true;
+    } catch {
+      // avoid false negatives
+      return true;
+    }
+  })();
+  supportsFormDataMap.set(fetch, promise);
+  return promise;
+}
+
+export const createForm = async <T = Record<string, unknown>>(
+  body: T | undefined,
+  fetch: Hypeman | Fetch,
+): Promise<FormData> => {
+  if (!(await supportsFormData(fetch))) {
+    throw new TypeError(
+      'The provided fetch function does not support file uploads with the current global FormData class.',
+    );
+  }
+  const form = new FormData();
+  await Promise.all(Object.entries(body || {}).map(([key, value]) => addFormValue(form, key, value)));
+  return form;
+};
+
+// We check for Blob not File because Bun.File doesn't inherit from File,
+// but they both inherit from Blob and have a `name` property at runtime.
+const isNamedBlob = (value: unknown) => value instanceof Blob && 'name' in value;
+
+const isUploadable = (value: unknown) =>
+  typeof value === 'object' &&
+  value !== null &&
+  (value instanceof Response || isAsyncIterable(value) || isNamedBlob(value));
+
+const hasUploadableValue = (value: unknown): boolean => {
+  if (isUploadable(value)) return true;
+  if (Array.isArray(value)) return value.some(hasUploadableValue);
+  if (value && typeof value === 'object') {
+    for (const k in value) {
+      if (hasUploadableValue((value as any)[k])) return true;
+    }
+  }
+  return false;
+};
+
+const addFormValue = async (form: FormData, key: string, value: unknown): Promise<void> => {
+  if (value === undefined) return;
+  if (value == null) {
+    throw new TypeError(
+      `Received null for "${key}"; to pass null in FormData, you must use the string 'null'`,
+    );
+  }
+
+  // TODO: make nested formats configurable
+  if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
+    form.append(key, String(value));
+  } else if (value instanceof Response) {
+    form.append(key, makeFile([await value.blob()], getName(value)));
+  } else if (isAsyncIterable(value)) {
+    form.append(key, makeFile([await new Response(ReadableStreamFrom(value)).blob()], getName(value)));
+  } else if (isNamedBlob(value)) {
+    form.append(key, value, getName(value));
+  } else if (Array.isArray(value)) {
+    await Promise.all(value.map((entry) => addFormValue(form, key + '[]', entry)));
+  } else if (typeof value === 'object') {
+    await Promise.all(
+      Object.entries(value).map(([name, prop]) => addFormValue(form, `${key}[${name}]`, prop)),
+    );
+  } else {
+    throw new TypeError(
+      `Invalid value given to form, expected a string, number, boolean, object, Array, File or Blob but got ${value} instead`,
+    );
+  }
+};
diff --git a/sdks/ts/src/internal/utils.ts b/sdks/ts/src/internal/utils.ts
new file mode 100644
index 00000000..3cbfacce
--- /dev/null
+++ b/sdks/ts/src/internal/utils.ts
@@ -0,0 +1,8 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export * from './utils/values';
+export * from './utils/base64';
+export * from './utils/env';
+export * from './utils/log';
+export * from './utils/uuid';
+export * from './utils/sleep';
diff --git a/sdks/ts/src/internal/utils/base64.ts b/sdks/ts/src/internal/utils/base64.ts
new file mode 100644
index 00000000..c42f21bd
--- /dev/null
+++ b/sdks/ts/src/internal/utils/base64.ts
@@ -0,0 +1,40 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { HypemanError } from '../../core/error';
+import { encodeUTF8 } from './bytes';
+
+export const toBase64 = (data: string | Uint8Array | null | undefined): string => {
+  if (!data) return '';
+
+  if (typeof (globalThis as any).Buffer !== 'undefined') {
+    return (globalThis as any).Buffer.from(data).toString('base64');
+  }
+
+  if (typeof data === 'string') {
+    data = encodeUTF8(data);
+  }
+
+  if (typeof btoa !== 'undefined') {
+    return btoa(String.fromCharCode.apply(null, data as any));
+  }
+
+  throw new HypemanError('Cannot generate base64 string; Expected `Buffer` or `btoa` to be defined');
+};
+
+export const fromBase64 = (str: string): Uint8Array => {
+  if (typeof (globalThis as any).Buffer !== 'undefined') {
+    const buf = (globalThis as any).Buffer.from(str, 'base64');
+    return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+  }
+
+  if (typeof atob !== 'undefined') {
+    const bstr = atob(str);
+    const buf = new Uint8Array(bstr.length);
+    for (let i = 0; i < bstr.length; i++) {
+      buf[i] = bstr.charCodeAt(i);
+    }
+    return buf;
+  }
+
+  throw new HypemanError('Cannot decode base64 string; Expected `Buffer` or `atob` to be defined');
+};
diff --git a/sdks/ts/src/internal/utils/bytes.ts b/sdks/ts/src/internal/utils/bytes.ts
new file mode 100644
index 00000000..8da627ab
--- /dev/null
+++ b/sdks/ts/src/internal/utils/bytes.ts
@@ -0,0 +1,32 @@
+export function concatBytes(buffers: Uint8Array[]): Uint8Array {
+  let length = 0;
+  for (const buffer of buffers) {
+    length += buffer.length;
+  }
+  const output = new Uint8Array(length);
+  let index = 0;
+  for (const buffer of buffers) {
+    output.set(buffer, index);
+    index += buffer.length;
+  }
+
+  return output;
+}
+
+let encodeUTF8_: (str: string) => Uint8Array;
+export function encodeUTF8(str: string) {
+  let encoder;
+  return (
+    encodeUTF8_ ??
+    ((encoder = new (globalThis as any).TextEncoder()), (encodeUTF8_ = encoder.encode.bind(encoder)))
+  )(str);
+}
+
+let decodeUTF8_: (bytes: Uint8Array) => string;
+export function decodeUTF8(bytes: Uint8Array) {
+  let decoder;
+  return (
+    decodeUTF8_ ??
+    ((decoder = new (globalThis as any).TextDecoder()), (decodeUTF8_ = decoder.decode.bind(decoder)))
+  )(bytes);
+}
diff --git a/sdks/ts/src/internal/utils/env.ts b/sdks/ts/src/internal/utils/env.ts
new file mode 100644
index 00000000..2d848007
--- /dev/null
+++ b/sdks/ts/src/internal/utils/env.ts
@@ -0,0 +1,18 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+/**
+ * Read an environment variable.
+ *
+ * Trims beginning and trailing whitespace.
+ *
+ * Will return undefined if the environment variable doesn't exist or cannot be accessed.
+ */
+export const readEnv = (env: string): string | undefined => {
+  if (typeof (globalThis as any).process !== 'undefined') {
+    return (globalThis as any).process.env?.[env]?.trim() ?? undefined;
+  }
+  if (typeof (globalThis as any).Deno !== 'undefined') {
+    return (globalThis as any).Deno.env?.get?.(env)?.trim();
+  }
+  return undefined;
+};
diff --git a/sdks/ts/src/internal/utils/log.ts b/sdks/ts/src/internal/utils/log.ts
new file mode 100644
index 00000000..7b1aa688
--- /dev/null
+++ b/sdks/ts/src/internal/utils/log.ts
@@ -0,0 +1,126 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { hasOwn } from './values';
+import { type Hypeman } from '../../client';
+import { RequestOptions } from '../request-options';
+
+type LogFn = (message: string, ...rest: unknown[]) => void;
+export type Logger = {
+  error: LogFn;
+  warn: LogFn;
+  info: LogFn;
+  debug: LogFn;
+};
+export type LogLevel = 'off' | 'error' | 'warn' | 'info' | 'debug';
+
+const levelNumbers = {
+  off: 0,
+  error: 200,
+  warn: 300,
+  info: 400,
+  debug: 500,
+};
+
+export const parseLogLevel = (
+  maybeLevel: string | undefined,
+  sourceName: string,
+  client: Hypeman,
+): LogLevel | undefined => {
+  if (!maybeLevel) {
+    return undefined;
+  }
+  if (hasOwn(levelNumbers, maybeLevel)) {
+    return maybeLevel;
+  }
+  loggerFor(client).warn(
+    `${sourceName} was set to ${JSON.stringify(maybeLevel)}, expected one of ${JSON.stringify(
+      Object.keys(levelNumbers),
+    )}`,
+  );
+  return undefined;
+};
+
+function noop() {}
+
+function makeLogFn(fnLevel: keyof Logger, logger: Logger | undefined, logLevel: LogLevel) {
+  if (!logger || levelNumbers[fnLevel] > levelNumbers[logLevel]) {
+    return noop;
+  } else {
+    // Don't wrap logger functions, we want the stacktrace intact!
+    return logger[fnLevel].bind(logger);
+  }
+}
+
+const noopLogger = {
+  error: noop,
+  warn: noop,
+  info: noop,
+  debug: noop,
+};
+
+let cachedLoggers = /* @__PURE__ */ new WeakMap<Logger, [LogLevel, Logger]>();
+
+export function loggerFor(client: Hypeman): Logger {
+  const logger = client.logger;
+  const logLevel = client.logLevel ?? 'off';
+  if (!logger) {
+    return noopLogger;
+  }
+
+  const cachedLogger = cachedLoggers.get(logger);
+  if (cachedLogger && cachedLogger[0] === logLevel) {
+    return cachedLogger[1];
+  }
+
+  const levelLogger = {
+    error: makeLogFn('error', logger, logLevel),
+    warn: makeLogFn('warn', logger, logLevel),
+    info: makeLogFn('info', logger, logLevel),
+    debug: makeLogFn('debug', logger, logLevel),
+  };
+
+  cachedLoggers.set(logger, [logLevel, levelLogger]);
+
+  return levelLogger;
+}
+
+export const formatRequestDetails = (details: {
+  options?: RequestOptions | undefined;
+  headers?: Headers | Record<string, string> | undefined;
+  retryOfRequestLogID?: string | undefined;
+  retryOf?: string | undefined;
+  url?: string | undefined;
+  status?: number | undefined;
+  method?: string | undefined;
+  durationMs?: number | undefined;
+  message?: unknown;
+  body?: unknown;
+}) => {
+  if (details.options) {
+    details.options = { ...details.options };
+    delete details.options['headers']; // redundant + leaks internals
+  }
+  if (details.headers) {
+    details.headers = Object.fromEntries(
+      (details.headers instanceof Headers ? [...details.headers] : Object.entries(details.headers)).map(
+        ([name, value]) => [
+          name,
+          (
+            name.toLowerCase() === 'authorization' ||
+            name.toLowerCase() === 'cookie' ||
+            name.toLowerCase() === 'set-cookie'
+          ) ?
+            '***'
+          : value,
+        ],
+      ),
+    );
+  }
+  if ('retryOfRequestLogID' in details) {
+    if (details.retryOfRequestLogID) {
+      details.retryOf = details.retryOfRequestLogID;
+    }
+    delete details.retryOfRequestLogID;
+  }
+  return details;
+};
diff --git a/sdks/ts/src/internal/utils/path.ts b/sdks/ts/src/internal/utils/path.ts
new file mode 100644
index 00000000..1d95c06f
--- /dev/null
+++ b/sdks/ts/src/internal/utils/path.ts
@@ -0,0 +1,88 @@
+import { HypemanError } from '../../core/error';
+
+/**
+ * Percent-encode everything that isn't safe to have in a path without encoding safe chars.
+ *
+ * Taken from https://datatracker.ietf.org/doc/html/rfc3986#section-3.3:
+ * > unreserved  = ALPHA / DIGIT / "-" / "." / "_" / "~"
+ * > sub-delims  = "!" / "$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / ";" / "="
+ * > pchar       = unreserved / pct-encoded / sub-delims / ":" / "@"
+ */
+export function encodeURIPath(str: string) {
+  return str.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
+}
+
+const EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null));
+
+export const createPathTagFunction = (pathEncoder = encodeURIPath) =>
+  function path(statics: readonly string[], ...params: readonly unknown[]): string {
+    // If there are no params, no processing is needed.
+    if (statics.length === 1) return statics[0]!;
+
+    let postPath = false;
+    const invalidSegments = [];
+    const path = statics.reduce((previousValue, currentValue, index) => {
+      if (/[?#]/.test(currentValue)) {
+        postPath = true;
+      }
+      const value = params[index];
+      let encoded = (postPath ? encodeURIComponent : pathEncoder)('' + value);
+      if (
+        index !== params.length &&
+        (value == null ||
+          (typeof value === 'object' &&
+            // handle values from other realms
+            value.toString ===
+              Object.getPrototypeOf(Object.getPrototypeOf((value as any).hasOwnProperty ?? EMPTY) ?? EMPTY)
+                ?.toString))
+      ) {
+        encoded = value + '';
+        invalidSegments.push({
+          start: previousValue.length + currentValue.length,
+          length: encoded.length,
+          error: `Value of type ${Object.prototype.toString
+            .call(value)
+            .slice(8, -1)} is not a valid path parameter`,
+        });
+      }
+      return previousValue + currentValue + (index === params.length ? '' : encoded);
+    }, '');
+
+    const pathOnly = path.split(/[?#]/, 1)[0]!;
+    const invalidSegmentPattern = /(?<=^|\/)(?:\.|%2e){1,2}(?=\/|$)/gi;
+    let match;
+
+    // Find all invalid segments
+    while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {
+      invalidSegments.push({
+        start: match.index,
+        length: match[0].length,
+        error: `Value "${match[0]}" can\'t be safely passed as a path parameter`,
+      });
+    }
+
+    invalidSegments.sort((a, b) => a.start - b.start);
+
+    if (invalidSegments.length > 0) {
+      let lastEnd = 0;
+      const underline = invalidSegments.reduce((acc, segment) => {
+        const spaces = ' '.repeat(segment.start - lastEnd);
+        const arrows = '^'.repeat(segment.length);
+        lastEnd = segment.start + segment.length;
+        return acc + spaces + arrows;
+      }, '');
+
+      throw new HypemanError(
+        `Path parameters result in path with invalid segments:\n${invalidSegments
+          .map((e) => e.error)
+          .join('\n')}\n${path}\n${underline}`,
+      );
+    }
+
+    return path;
+  };
+
+/**
+ * URI-encodes path params and ensures no unsafe /./ or /../ path segments are introduced.
+ */
+export const path = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
diff --git a/sdks/ts/src/internal/utils/sleep.ts b/sdks/ts/src/internal/utils/sleep.ts
new file mode 100644
index 00000000..65e52962
--- /dev/null
+++ b/sdks/ts/src/internal/utils/sleep.ts
@@ -0,0 +1,3 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export const sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
diff --git a/sdks/ts/src/internal/utils/uuid.ts b/sdks/ts/src/internal/utils/uuid.ts
new file mode 100644
index 00000000..b0e53aaf
--- /dev/null
+++ b/sdks/ts/src/internal/utils/uuid.ts
@@ -0,0 +1,17 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+/**
+ * https://stackoverflow.com/a/2117523
+ */
+export let uuid4 = function () {
+  const { crypto } = globalThis as any;
+  if (crypto?.randomUUID) {
+    uuid4 = crypto.randomUUID.bind(crypto);
+    return crypto.randomUUID();
+  }
+  const u8 = new Uint8Array(1);
+  const randomByte = crypto ? () => crypto.getRandomValues(u8)[0]! : () => (Math.random() * 0xff) & 0xff;
+  return '10000000-1000-4000-8000-100000000000'.replace(/[018]/g, (c) =>
+    (+c ^ (randomByte() & (15 >> (+c / 4)))).toString(16),
+  );
+};
diff --git a/sdks/ts/src/internal/utils/values.ts b/sdks/ts/src/internal/utils/values.ts
new file mode 100644
index 00000000..1019e8c9
--- /dev/null
+++ b/sdks/ts/src/internal/utils/values.ts
@@ -0,0 +1,105 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { HypemanError } from '../../core/error';
+
+// https://url.spec.whatwg.org/#url-scheme-string
+const startsWithSchemeRegexp = /^[a-z][a-z0-9+.-]*:/i;
+
+export const isAbsoluteURL = (url: string): boolean => {
+  return startsWithSchemeRegexp.test(url);
+};
+
+export let isArray = (val: unknown): val is unknown[] => ((isArray = Array.isArray), isArray(val));
+export let isReadonlyArray = isArray as (val: unknown) => val is readonly unknown[];
+
+/** Returns an object if the given value isn't an object, otherwise returns as-is */
+export function maybeObj(x: unknown): object {
+  if (typeof x !== 'object') {
+    return {};
+  }
+
+  return x ?? {};
+}
+
+// https://stackoverflow.com/a/34491287
+export function isEmptyObj(obj: Object | null | undefined): boolean {
+  if (!obj) return true;
+  for (const _k in obj) return false;
+  return true;
+}
+
+// https://eslint.org/docs/latest/rules/no-prototype-builtins
+export function hasOwn<T extends object = object>(obj: T, key: PropertyKey): key is keyof T {
+  return Object.prototype.hasOwnProperty.call(obj, key);
+}
+
+export function isObj(obj: unknown): obj is Record<string, unknown> {
+  return obj != null && typeof obj === 'object' && !Array.isArray(obj);
+}
+
+export const ensurePresent = <T>(value: T | null | undefined): T => {
+  if (value == null) {
+    throw new HypemanError(`Expected a value to be given but received ${value} instead.`);
+  }
+
+  return value;
+};
+
+export const validatePositiveInteger = (name: string, n: unknown): number => {
+  if (typeof n !== 'number' || !Number.isInteger(n)) {
+    throw new HypemanError(`${name} must be an integer`);
+  }
+  if (n < 0) {
+    throw new HypemanError(`${name} must be a positive integer`);
+  }
+  return n;
+};
+
+export const coerceInteger = (value: unknown): number => {
+  if (typeof value === 'number') return Math.round(value);
+  if (typeof value === 'string') return parseInt(value, 10);
+
+  throw new HypemanError(`Could not coerce ${value} (type: ${typeof value}) into a number`);
+};
+
+export const coerceFloat = (value: unknown): number => {
+  if (typeof value === 'number') return value;
+  if (typeof value === 'string') return parseFloat(value);
+
+  throw new HypemanError(`Could not coerce ${value} (type: ${typeof value}) into a number`);
+};
+
+export const coerceBoolean = (value: unknown): boolean => {
+  if (typeof value === 'boolean') return value;
+  if (typeof value === 'string') return value === 'true';
+  return Boolean(value);
+};
+
+export const maybeCoerceInteger = (value: unknown): number | undefined => {
+  if (value == null) {
+    return undefined;
+  }
+  return coerceInteger(value);
+};
+
+export const maybeCoerceFloat = (value: unknown): number | undefined => {
+  if (value == null) {
+    return undefined;
+  }
+  return coerceFloat(value);
+};
+
+export const maybeCoerceBoolean = (value: unknown): boolean | undefined => {
+  if (value == null) {
+    return undefined;
+  }
+  return coerceBoolean(value);
+};
+
+export const safeJSON = (text: string) => {
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    return undefined;
+  }
+};
diff --git a/sdks/ts/src/lib/.keep b/sdks/ts/src/lib/.keep
new file mode 100644
index 00000000..7554f8b2
--- /dev/null
+++ b/sdks/ts/src/lib/.keep
@@ -0,0 +1,4 @@
+File generated from our OpenAPI spec by Stainless.
+
+This directory can be used to store custom files to expand the SDK.
+It is ignored by Stainless code generation and its content (other than this keep file) won't be touched.
diff --git a/sdks/ts/src/lib/cp.ts b/sdks/ts/src/lib/cp.ts
new file mode 100644
index 00000000..88ebbfaa
--- /dev/null
+++ b/sdks/ts/src/lib/cp.ts
@@ -0,0 +1,613 @@
+/**
+ * Copy operations for transferring files to/from running instances.
+ *
+ * This module provides functions for copying files between the local filesystem
+ * and running hypeman instances, similar to `docker cp`.
+ */
+
+import * as fs from 'fs';
+import * as path from 'path';
+
+/**
+ * Configuration for copy operations.
+ */
+export interface CpConfig {
+  /** Base URL for the hypeman API */
+  baseURL: string;
+  /** API key (JWT token) for authentication */
+  apiKey: string;
+}
+
+/**
+ * Options for copying files to an instance.
+ */
+export interface CpToInstanceOptions {
+  /** Instance ID to copy to */
+  instanceId: string;
+  /** Local source path */
+  srcPath: string;
+  /** Destination path in guest */
+  dstPath: string;
+  /** Optional: override file mode/permissions */
+  mode?: number;
+}
+
+/**
+ * Options for copying files from an instance.
+ */
+export interface CpFromInstanceOptions {
+  /** Instance ID to copy from */
+  instanceId: string;
+  /** Source path in guest */
+  srcPath: string;
+  /** Local destination path */
+  dstPath: string;
+  /** Follow symbolic links */
+  followLinks?: boolean;
+}
+
+interface CpRequest {
+  direction: 'to' | 'from';
+  guest_path: string;
+  is_dir?: boolean;
+  mode?: number;
+  follow_links?: boolean;
+}
+
+interface CpFileHeader {
+  type: 'header';
+  path: string;
+  mode: number;
+  is_dir: boolean;
+  is_symlink?: boolean;
+  link_target?: string;
+  size: number;
+  mtime: number;
+}
+
+interface CpEndMarker {
+  type: 'end';
+  final: boolean;
+}
+
+interface CpResult {
+  type: 'result';
+  success: boolean;
+  error?: string;
+  bytes_written?: number;
+}
+
+interface CpError {
+  type: 'error';
+  message: string;
+  path?: string;
+}
+
+type CpMessage = CpFileHeader | CpEndMarker | CpResult | CpError;
+
+/**
+ * Sanitizes a path from the server to prevent path traversal attacks.
+ * Ensures the path stays within the destination directory.
+ */
+function sanitizePath(base: string, relativePath: string): string {
+  // Normalize the path to resolve . and .. components
+  const normalized = path.normalize(relativePath);
+
+  // Reject absolute paths
+  if (path.isAbsolute(normalized)) {
+    throw new Error(`Invalid path: absolute paths not allowed: ${relativePath}`);
+  }
+
+  // Reject paths that escape the destination
+  if (normalized.startsWith('..')) {
+    throw new Error(`Invalid path: path escapes destination: ${relativePath}`);
+  }
+
+  // Join with base and verify the result is under base
+  const result = path.join(base, normalized);
+  const absBase = path.resolve(base);
+  const absResult = path.resolve(result);
+
+  if (!absResult.startsWith(absBase + path.sep) && absResult !== absBase) {
+    throw new Error(`Invalid path: path escapes destination: ${relativePath}`);
+  }
+
+  return result;
+}
+
+/**
+ * Builds the WebSocket URL for the cp endpoint.
+ */
+function buildWsURL(baseURL: string, instanceId: string): string {
+  const url = new URL(baseURL);
+  // Append to existing pathname instead of overwriting
+  const existingPath = url.pathname.endsWith('/') ? url.pathname.slice(0, -1) : url.pathname;
+  url.pathname = `${existingPath}/instances/${instanceId}/cp`;
+
+  if (url.protocol === 'https:') {
+    url.protocol = 'wss:';
+  } else if (url.protocol === 'http:') {
+    url.protocol = 'ws:';
+  }
+
+  return url.toString();
+}
+
+/**
+ * Copy a file or directory to a running instance.
+ *
+ * @example
+ * ```typescript
+ * import { cpToInstance } from 'hypeman/lib/cp';
+ *
+ * await cpToInstance({
+ *   baseURL: 'https://api.hypeman.dev',
+ *   apiKey: 'your-api-key',
+ * }, {
+ *   instanceId: 'inst_123',
+ *   srcPath: './local-file.txt',
+ *   dstPath: '/app/file.txt',
+ * });
+ * ```
+ */
+export async function cpToInstance(cfg: CpConfig, opts: CpToInstanceOptions): Promise<void> {
+  // Use internal implementation with cycle detection
+  const visited = new Set<string>();
+  await cpToInstanceInternal(cfg, opts, visited);
+}
+
+/**
+ * Internal recursive implementation with cycle detection.
+ */
+async function cpToInstanceInternal(
+  cfg: CpConfig,
+  opts: CpToInstanceOptions,
+  visited: Set<string>,
+): Promise<void> {
+  // Use lstatSync to not follow symlinks - this lets us detect symlinks
+  const lstats = fs.lstatSync(opts.srcPath);
+
+  if (lstats.isSymbolicLink()) {
+    // For symlinks, check what they point to
+    try {
+      const targetStats = fs.statSync(opts.srcPath);
+      if (targetStats.isDirectory()) {
+        // Skip directory symlinks to prevent potential cycles
+        // The directory could point to an ancestor, causing infinite recursion
+        return;
+      }
+      // For file symlinks, copy the target file contents
+      await cpSingleFileToInstance(cfg, {
+        ...opts,
+        isDir: false,
+      });
+    } catch {
+      // Broken symlink - skip it
+      return;
+    }
+    return;
+  }
+
+  if (lstats.isDirectory()) {
+    // Check for cycles using device + inode
+    const dirId = `${lstats.dev}:${lstats.ino}`;
+    if (visited.has(dirId)) {
+      // Already visited this directory - skip to prevent infinite recursion
+      return;
+    }
+    visited.add(dirId);
+
+    // For directories, first create the directory, then recursively copy contents
+    await cpSingleFileToInstance(cfg, {
+      ...opts,
+      isDir: true,
+    });
+
+    // Now recursively copy all contents
+    const entries = fs.readdirSync(opts.srcPath, { withFileTypes: true });
+    for (const entry of entries) {
+      const srcEntryPath = path.join(opts.srcPath, entry.name);
+      // Use path.posix.join for guest paths to ensure forward slashes
+      const dstEntryPath = path.posix.join(opts.dstPath, entry.name);
+
+      await cpToInstanceInternal(
+        cfg,
+        {
+          instanceId: opts.instanceId,
+          srcPath: srcEntryPath,
+          dstPath: dstEntryPath,
+          ...(opts.mode !== undefined && { mode: opts.mode }),
+        },
+        visited,
+      );
+    }
+  } else {
+    // For files, copy directly
+    await cpSingleFileToInstance(cfg, {
+      ...opts,
+      isDir: false,
+    });
+  }
+}
+
+/**
+ * Internal function to copy a single file or create a directory.
+ */
+async function cpSingleFileToInstance(
+  cfg: CpConfig,
+  opts: CpToInstanceOptions & { isDir: boolean },
+): Promise<void> {
+  // Check if WebSocket is available (Node.js vs browser)
+  const WebSocket = getWebSocket();
+
+  const wsURL = buildWsURL(cfg.baseURL, opts.instanceId);
+
+  // Get file stats
+  const stats = fs.statSync(opts.srcPath);
+  const mode = opts.mode ?? stats.mode & 0o777;
+
+  // Connect to WebSocket
+  const ws = new WebSocket(wsURL, {
+    headers: {
+      Authorization: `Bearer ${cfg.apiKey}`,
+    },
+  });
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let fileStream: fs.ReadStream | null = null;
+
+    const doResolve = () => {
+      if (!settled) {
+        settled = true;
+        resolve();
+      }
+    };
+
+    const doReject = (err: Error) => {
+      if (!settled) {
+        settled = true;
+        // Clean up file stream if open
+        if (fileStream) {
+          fileStream.destroy();
+          fileStream = null;
+        }
+        reject(err);
+      }
+    };
+
+    ws.on('open', () => {
+      // Send initial request
+      const req: CpRequest = {
+        direction: 'to',
+        guest_path: opts.dstPath,
+        is_dir: opts.isDir,
+        mode: mode,
+      };
+      ws.send(JSON.stringify(req));
+
+      if (opts.isDir) {
+        // For directories, just send end marker - the directory will be created
+        ws.send(JSON.stringify({ type: 'end' }));
+      } else {
+        // Stream file content
+        fileStream = fs.createReadStream(opts.srcPath, {
+          highWaterMark: 32 * 1024,
+        });
+
+        fileStream.on('data', (chunk: any) => {
+          // Check WebSocket is still open before sending
+          // Queued events can fire after close is initiated
+          if (ws.readyState === ws.OPEN) {
+            ws.send(chunk as Buffer);
+          }
+        });
+
+        fileStream.on('end', () => {
+          // Check WebSocket is still open before sending
+          if (ws.readyState === ws.OPEN) {
+            ws.send(JSON.stringify({ type: 'end' }));
+          }
+        });
+
+        fileStream.on('error', (err) => {
+          ws.close();
+          doReject(err);
+        });
+      }
+    });
+
+    ws.on('message', (data: Buffer | string) => {
+      try {
+        const msg = JSON.parse(data.toString()) as CpMessage;
+
+        if (msg.type === 'result') {
+          if (msg.success) {
+            ws.close();
+            doResolve();
+          } else {
+            ws.close();
+            doReject(new Error(`Copy failed: ${msg.error}`));
+          }
+        } else if (msg.type === 'error') {
+          ws.close();
+          doReject(new Error(`Copy error at ${msg.path}: ${msg.message}`));
+        }
+      } catch {
+        // Ignore non-JSON messages
+      }
+    });
+
+    ws.on('error', (err) => {
+      doReject(err);
+    });
+
+    ws.on('close', (code, reason) => {
+      if (!settled) {
+        if (code === 1000) {
+          doReject(new Error('WebSocket closed before receiving result'));
+        } else {
+          doReject(new Error(`WebSocket closed: ${code} ${reason}`));
+        }
+      }
+    });
+  });
+}
+
+/**
+ * Copy a file or directory from a running instance.
+ *
+ * @example
+ * ```typescript
+ * import { cpFromInstance } from 'hypeman/lib/cp';
+ *
+ * await cpFromInstance({
+ *   baseURL: 'https://api.hypeman.dev',
+ *   apiKey: 'your-api-key',
+ * }, {
+ *   instanceId: 'inst_123',
+ *   srcPath: '/app/output.txt',
+ *   dstPath: './local-output.txt',
+ * });
+ * ```
+ */
+export async function cpFromInstance(cfg: CpConfig, opts: CpFromInstanceOptions): Promise<void> {
+  const WebSocket = getWebSocket();
+  const wsURL = buildWsURL(cfg.baseURL, opts.instanceId);
+
+  const ws = new WebSocket(wsURL, {
+    headers: {
+      Authorization: `Bearer ${cfg.apiKey}`,
+    },
+  });
+
+  return new Promise((resolve, reject) => {
+    let currentFile: fs.WriteStream | null = null;
+    let currentHeader: CpFileHeader | null = null;
+    let settled = false;
+
+    const doResolve = () => {
+      if (!settled) {
+        settled = true;
+        resolve();
+      }
+    };
+
+    const doReject = (err: Error) => {
+      if (!settled) {
+        settled = true;
+        reject(err);
+      }
+    };
+
+    // Helper to close file and wait for it to complete
+    const closeCurrentFile = (): Promise<void> => {
+      return new Promise((res) => {
+        if (currentFile) {
+          currentFile.end(() => res());
+        } else {
+          res();
+        }
+      });
+    };
+
+    ws.on('open', () => {
+      // Send initial request
+      const req: CpRequest = {
+        direction: 'from',
+        guest_path: opts.srcPath,
+        follow_links: opts.followLinks ?? false,
+      };
+      ws.send(JSON.stringify(req));
+    });
+
+    ws.on('message', (data: Buffer | string) => {
+      // Don't process messages after the operation has settled
+      if (settled) {
+        return;
+      }
+
+      // Try to parse as JSON first
+      let msg: CpMessage | null = null;
+      if (typeof data === 'string' || (Buffer.isBuffer(data) && !isBinaryData(data))) {
+        try {
+          msg = JSON.parse(data.toString()) as CpMessage;
+        } catch {
+          // Not JSON, treat as binary data below
+        }
+      }
+
+      // Handle parsed message (outside try-catch so FS errors propagate)
+      if (msg) {
+        try {
+          switch (msg.type) {
+            case 'header': {
+              // Close previous file if any (synchronously for simplicity in message handler)
+              if (currentFile) {
+                currentFile.close();
+                currentFile = null;
+              }
+
+              currentHeader = msg as CpFileHeader;
+              // Sanitize server-provided path to prevent path traversal attacks
+              const targetPath = sanitizePath(opts.dstPath, currentHeader.path);
+
+              if (currentHeader.is_dir) {
+                fs.mkdirSync(targetPath, { recursive: true, mode: currentHeader.mode });
+              } else if (currentHeader.is_symlink) {
+                // Handle symlink - ensure link_target is present
+                if (!currentHeader.link_target) {
+                  doReject(new Error(`Symlink ${currentHeader.path} missing link target`));
+                  ws.close();
+                  return;
+                }
+                // Validate symlink target
+                const linkTarget = currentHeader.link_target;
+                // Use path.posix.isAbsolute to detect Unix absolute paths even on Windows
+                if (path.posix.isAbsolute(linkTarget) || path.isAbsolute(linkTarget)) {
+                  doReject(new Error(`Invalid symlink target (absolute path): ${linkTarget}`));
+                  ws.close();
+                  return;
+                }
+                // Check if the symlink target escapes the destination directory
+                // Resolve relative to the symlink's parent directory
+                const linkDir = path.dirname(targetPath);
+                const resolvedTarget = path.resolve(linkDir, linkTarget);
+                const dstPathNorm = path.resolve(opts.dstPath);
+                // For root destination, just ensure resolved target is absolute
+                // For other destinations, ensure resolved target is within dstPath
+                if (dstPathNorm !== '/' && dstPathNorm !== path.sep) {
+                  if (!resolvedTarget.startsWith(dstPathNorm + path.sep) && resolvedTarget !== dstPathNorm) {
+                    doReject(new Error(`Invalid symlink target (escapes destination): ${linkTarget}`));
+                    ws.close();
+                    return;
+                  }
+                }
+                // Create parent directory if needed
+                fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+                try {
+                  fs.unlinkSync(targetPath);
+                } catch {
+                  // Ignore if doesn't exist
+                }
+                fs.symlinkSync(linkTarget, targetPath);
+              } else {
+                fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+                currentFile = fs.createWriteStream(targetPath, { mode: currentHeader.mode });
+                // Add error handler to prevent unhandled 'error' events from crashing
+                // Capture reference to avoid race condition if error fires after we've moved to next file
+                const fileBeingWritten = currentFile;
+                currentFile.on('error', (err) => {
+                  fileBeingWritten.destroy();
+                  // Only nullify currentFile if it's still pointing to this stream
+                  // This prevents orphaning a subsequent file's stream if this error fires late
+                  if (currentFile === fileBeingWritten) {
+                    currentFile = null;
+                  }
+                  doReject(new Error(`Failed to write file ${targetPath}: ${err.message}`));
+                  ws.close();
+                });
+              }
+              break;
+            }
+
+            case 'end': {
+              const endMsg = msg as CpEndMarker;
+              if (currentFile) {
+                const fileToClose = currentFile;
+                const headerToUse = currentHeader;
+                currentFile = null;
+                currentHeader = null;
+
+                // Wait for file to close before setting mtime
+                fileToClose.end(() => {
+                  if (headerToUse && headerToUse.mtime > 0) {
+                    try {
+                      const targetPath = sanitizePath(opts.dstPath, headerToUse.path);
+                      const mtime = new Date(headerToUse.mtime * 1000);
+                      fs.utimesSync(targetPath, mtime, mtime);
+                    } catch (err) {
+                      // Log but don't fail for mtime errors
+                    }
+                  }
+                  if (endMsg.final) {
+                    ws.close();
+                    doResolve();
+                  }
+                });
+                return; // Exit early since we handle resolution in callback
+              }
+
+              if (endMsg.final) {
+                ws.close();
+                doResolve();
+              }
+              break;
+            }
+
+            case 'error': {
+              const errMsg = msg as CpError;
+              ws.close();
+              doReject(new Error(`Copy error at ${errMsg.path}: ${errMsg.message}`));
+              break;
+            }
+
+            default:
+              // Unrecognized JSON message type - log and ignore
+              // This can happen if the protocol evolves with new message types
+              break;
+          }
+        } catch (err) {
+          // FS operation failed - propagate the error
+          ws.close();
+          doReject(err as Error);
+        }
+        return;
+      }
+
+      // Binary data - write to current file
+      if (currentFile && Buffer.isBuffer(data)) {
+        currentFile.write(data);
+      }
+    });
+
+    ws.on('error', (err) => {
+      if (currentFile) {
+        currentFile.close();
+      }
+      doReject(err);
+    });
+
+    ws.on('close', (code, reason) => {
+      if (currentFile) {
+        currentFile.close();
+      }
+      if (!settled) {
+        if (code === 1000) {
+          doReject(new Error('WebSocket closed before receiving final marker'));
+        } else {
+          doReject(new Error(`WebSocket closed: ${code} ${reason}`));
+        }
+      }
+    });
+  });
+}
+
+/**
+ * Helper to determine if data looks like binary (not JSON).
+ */
+function isBinaryData(data: Buffer): boolean {
+  // If it starts with '{' or '[', it's likely JSON
+  if (data.length > 0 && (data[0] === 0x7b || data[0] === 0x5b)) {
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Get WebSocket implementation (works in Node.js).
+ */
+function getWebSocket(): typeof import('ws') {
+  // In Node.js, we use the 'ws' package
+  return require('ws');
+}
diff --git a/sdks/ts/src/lib/index.ts b/sdks/ts/src/lib/index.ts
new file mode 100644
index 00000000..e56ea98a
--- /dev/null
+++ b/sdks/ts/src/lib/index.ts
@@ -0,0 +1,8 @@
+/**
+ * Manually-maintained library functionality.
+ *
+ * This directory contains custom functionality that extends the auto-generated SDK.
+ * Files in this directory are not modified by the Stainless generator.
+ */
+
+export * from './cp';
diff --git a/sdks/ts/src/resource.ts b/sdks/ts/src/resource.ts
new file mode 100644
index 00000000..363e3516
--- /dev/null
+++ b/sdks/ts/src/resource.ts
@@ -0,0 +1,2 @@
+/** @deprecated Import from ./core/resource instead */
+export * from './core/resource';
diff --git a/sdks/ts/src/resources.ts b/sdks/ts/src/resources.ts
new file mode 100644
index 00000000..b283d578
--- /dev/null
+++ b/sdks/ts/src/resources.ts
@@ -0,0 +1 @@
+export * from './resources/index';
diff --git a/sdks/ts/src/resources/devices.ts b/sdks/ts/src/resources/devices.ts
new file mode 100644
index 00000000..4b0bfcee
--- /dev/null
+++ b/sdks/ts/src/resources/devices.ts
@@ -0,0 +1,203 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../core/resource';
+import { APIPromise } from '../core/api-promise';
+import { buildHeaders } from '../internal/headers';
+import { RequestOptions } from '../internal/request-options';
+import { path } from '../internal/utils/path';
+
+export class Devices extends APIResource {
+  /**
+   * Register a device for passthrough
+   *
+   * @example
+   * ```ts
+   * const device = await client.devices.create({
+   *   pci_address: '0000:a2:00.0',
+   * });
+   * ```
+   */
+  create(body: DeviceCreateParams, options?: RequestOptions): APIPromise<Device> {
+    return this._client.post('/devices', { body, ...options });
+  }
+
+  /**
+   * Get device details
+   *
+   * @example
+   * ```ts
+   * const device = await client.devices.retrieve('id');
+   * ```
+   */
+  retrieve(id: string, options?: RequestOptions): APIPromise<Device> {
+    return this._client.get(path`/devices/${id}`, options);
+  }
+
+  /**
+   * List registered devices
+   *
+   * @example
+   * ```ts
+   * const devices = await client.devices.list();
+   * ```
+   */
+  list(options?: RequestOptions): APIPromise<DeviceListResponse> {
+    return this._client.get('/devices', options);
+  }
+
+  /**
+   * Unregister device
+   *
+   * @example
+   * ```ts
+   * await client.devices.delete('id');
+   * ```
+   */
+  delete(id: string, options?: RequestOptions): APIPromise<void> {
+    return this._client.delete(path`/devices/${id}`, {
+      ...options,
+      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
+    });
+  }
+
+  /**
+   * Discover passthrough-capable devices on host
+   *
+   * @example
+   * ```ts
+   * const availableDevices =
+   *   await client.devices.listAvailable();
+   * ```
+   */
+  listAvailable(options?: RequestOptions): APIPromise<DeviceListAvailableResponse> {
+    return this._client.get('/devices/available', options);
+  }
+}
+
+export interface AvailableDevice {
+  /**
+   * PCI device ID (hex)
+   */
+  device_id: string;
+
+  /**
+   * IOMMU group number
+   */
+  iommu_group: number;
+
+  /**
+   * PCI address
+   */
+  pci_address: string;
+
+  /**
+   * PCI vendor ID (hex)
+   */
+  vendor_id: string;
+
+  /**
+   * Currently bound driver (null if none)
+   */
+  current_driver?: string | null;
+
+  /**
+   * Human-readable device name
+   */
+  device_name?: string;
+
+  /**
+   * Human-readable vendor name
+   */
+  vendor_name?: string;
+}
+
+export interface Device {
+  /**
+   * Auto-generated unique identifier (CUID2 format)
+   */
+  id: string;
+
+  /**
+   * Whether the device is currently bound to the vfio-pci driver, which is required
+   * for VM passthrough.
+   *
+   * - true: Device is bound to vfio-pci and ready for (or currently in use by) a VM.
+   *   The device's native driver has been unloaded.
+   * - false: Device is using its native driver (e.g., nvidia) or no driver. Hypeman
+   *   will automatically bind to vfio-pci when attaching to an instance.
+   */
+  bound_to_vfio: boolean;
+
+  /**
+   * Registration timestamp (RFC3339)
+   */
+  created_at: string;
+
+  /**
+   * PCI device ID (hex)
+   */
+  device_id: string;
+
+  /**
+   * IOMMU group number
+   */
+  iommu_group: number;
+
+  /**
+   * PCI address
+   */
+  pci_address: string;
+
+  /**
+   * Type of PCI device
+   */
+  type: DeviceType;
+
+  /**
+   * PCI vendor ID (hex)
+   */
+  vendor_id: string;
+
+  /**
+   * Instance ID if attached
+   */
+  attached_to?: string | null;
+
+  /**
+   * Device name (user-provided or auto-generated from PCI address)
+   */
+  name?: string;
+}
+
+/**
+ * Type of PCI device
+ */
+export type DeviceType = 'gpu' | 'pci';
+
+export type DeviceListResponse = Array<Device>;
+
+export type DeviceListAvailableResponse = Array<AvailableDevice>;
+
+export interface DeviceCreateParams {
+  /**
+   * PCI address of the device (required, e.g., "0000:a2:00.0")
+   */
+  pci_address: string;
+
+  /**
+   * Optional globally unique device name. If not provided, a name is auto-generated
+   * from the PCI address (e.g., "pci-0000-a2-00-0")
+   */
+  name?: string;
+}
+
+export declare namespace Devices {
+  export {
+    type AvailableDevice as AvailableDevice,
+    type Device as Device,
+    type DeviceType as DeviceType,
+    type DeviceListResponse as DeviceListResponse,
+    type DeviceListAvailableResponse as DeviceListAvailableResponse,
+    type DeviceCreateParams as DeviceCreateParams,
+  };
+}
diff --git a/sdks/ts/src/resources/health.ts b/sdks/ts/src/resources/health.ts
new file mode 100644
index 00000000..7dedec6f
--- /dev/null
+++ b/sdks/ts/src/resources/health.ts
@@ -0,0 +1,22 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../core/resource';
+import { APIPromise } from '../core/api-promise';
+import { RequestOptions } from '../internal/request-options';
+
+export class Health extends APIResource {
+  /**
+   * Health check
+   */
+  check(options?: RequestOptions): APIPromise<HealthCheckResponse> {
+    return this._client.get('/health', options);
+  }
+}
+
+export interface HealthCheckResponse {
+  status: 'ok';
+}
+
+export declare namespace Health {
+  export { type HealthCheckResponse as HealthCheckResponse };
+}
diff --git a/sdks/ts/src/resources/images.ts b/sdks/ts/src/resources/images.ts
new file mode 100644
index 00000000..34f5042d
--- /dev/null
+++ b/sdks/ts/src/resources/images.ts
@@ -0,0 +1,136 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../core/resource';
+import { APIPromise } from '../core/api-promise';
+import { buildHeaders } from '../internal/headers';
+import { RequestOptions } from '../internal/request-options';
+import { path } from '../internal/utils/path';
+
+export class Images extends APIResource {
+  /**
+   * Pull and convert OCI image
+   *
+   * @example
+   * ```ts
+   * const image = await client.images.create({
+   *   name: 'docker.io/library/nginx:latest',
+   * });
+   * ```
+   */
+  create(body: ImageCreateParams, options?: RequestOptions): APIPromise<Image> {
+    return this._client.post('/images', { body, ...options });
+  }
+
+  /**
+   * List images
+   *
+   * @example
+   * ```ts
+   * const images = await client.images.list();
+   * ```
+   */
+  list(options?: RequestOptions): APIPromise<ImageListResponse> {
+    return this._client.get('/images', options);
+  }
+
+  /**
+   * Delete image
+   *
+   * @example
+   * ```ts
+   * await client.images.delete('name');
+   * ```
+   */
+  delete(name: string, options?: RequestOptions): APIPromise<void> {
+    return this._client.delete(path`/images/${name}`, {
+      ...options,
+      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
+    });
+  }
+
+  /**
+   * Get image details
+   *
+   * @example
+   * ```ts
+   * const image = await client.images.get('name');
+   * ```
+   */
+  get(name: string, options?: RequestOptions): APIPromise<Image> {
+    return this._client.get(path`/images/${name}`, options);
+  }
+}
+
+export interface Image {
+  /**
+   * Creation timestamp (RFC3339)
+   */
+  created_at: string;
+
+  /**
+   * Resolved manifest digest
+   */
+  digest: string;
+
+  /**
+   * Normalized OCI image reference (tag or digest)
+   */
+  name: string;
+
+  /**
+   * Build status
+   */
+  status: 'pending' | 'pulling' | 'converting' | 'ready' | 'failed';
+
+  /**
+   * CMD from container metadata
+   */
+  cmd?: Array<string> | null;
+
+  /**
+   * Entrypoint from container metadata
+   */
+  entrypoint?: Array<string> | null;
+
+  /**
+   * Environment variables from container metadata
+   */
+  env?: { [key: string]: string };
+
+  /**
+   * Error message if status is failed
+   */
+  error?: string | null;
+
+  /**
+   * Position in build queue (null if not queued)
+   */
+  queue_position?: number | null;
+
+  /**
+   * Disk size in bytes (null until ready)
+   */
+  size_bytes?: number | null;
+
+  /**
+   * Working directory from container metadata
+   */
+  working_dir?: string | null;
+}
+
+export type ImageListResponse = Array<Image>;
+
+export interface ImageCreateParams {
+  /**
+   * OCI image reference (e.g., docker.io/library/nginx:latest)
+   */
+  name: string;
+}
+
+export declare namespace Images {
+  export {
+    type Image as Image,
+    type ImageListResponse as ImageListResponse,
+    type ImageCreateParams as ImageCreateParams,
+  };
+}
diff --git a/sdks/ts/src/resources/index.ts b/sdks/ts/src/resources/index.ts
new file mode 100644
index 00000000..7d565457
--- /dev/null
+++ b/sdks/ts/src/resources/index.ts
@@ -0,0 +1,41 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export {
+  Devices,
+  type AvailableDevice,
+  type Device,
+  type DeviceType,
+  type DeviceListResponse,
+  type DeviceListAvailableResponse,
+  type DeviceCreateParams,
+} from './devices';
+export { Health, type HealthCheckResponse } from './health';
+export { Images, type Image, type ImageListResponse, type ImageCreateParams } from './images';
+export {
+  Ingresses,
+  type Ingress,
+  type IngressMatch,
+  type IngressRule,
+  type IngressTarget,
+  type IngressListResponse,
+  type IngressCreateParams,
+} from './ingresses';
+export {
+  Instances,
+  type Instance,
+  type PathInfo,
+  type PortMapping,
+  type VolumeMount,
+  type InstanceListResponse,
+  type InstanceLogsResponse,
+  type InstanceCreateParams,
+  type InstanceLogsParams,
+  type InstanceStatParams,
+} from './instances/instances';
+export {
+  Volumes,
+  type Volume,
+  type VolumeAttachment,
+  type VolumeListResponse,
+  type VolumeCreateParams,
+} from './volumes';
diff --git a/sdks/ts/src/resources/ingresses.ts b/sdks/ts/src/resources/ingresses.ts
new file mode 100644
index 00000000..b694a628
--- /dev/null
+++ b/sdks/ts/src/resources/ingresses.ts
@@ -0,0 +1,171 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../core/resource';
+import { APIPromise } from '../core/api-promise';
+import { buildHeaders } from '../internal/headers';
+import { RequestOptions } from '../internal/request-options';
+import { path } from '../internal/utils/path';
+
+export class Ingresses extends APIResource {
+  /**
+   * Create ingress
+   *
+   * @example
+   * ```ts
+   * const ingress = await client.ingresses.create({
+   *   name: 'my-api-ingress',
+   *   rules: [
+   *     {
+   *       match: { hostname: '{instance}.example.com' },
+   *       target: { instance: '{instance}', port: 8080 },
+   *     },
+   *   ],
+   * });
+   * ```
+   */
+  create(body: IngressCreateParams, options?: RequestOptions): APIPromise<Ingress> {
+    return this._client.post('/ingresses', { body, ...options });
+  }
+
+  /**
+   * List ingresses
+   *
+   * @example
+   * ```ts
+   * const ingresses = await client.ingresses.list();
+   * ```
+   */
+  list(options?: RequestOptions): APIPromise<IngressListResponse> {
+    return this._client.get('/ingresses', options);
+  }
+
+  /**
+   * Delete ingress
+   *
+   * @example
+   * ```ts
+   * await client.ingresses.delete('id');
+   * ```
+   */
+  delete(id: string, options?: RequestOptions): APIPromise<void> {
+    return this._client.delete(path`/ingresses/${id}`, {
+      ...options,
+      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
+    });
+  }
+
+  /**
+   * Get ingress details
+   *
+   * @example
+   * ```ts
+   * const ingress = await client.ingresses.get('id');
+   * ```
+   */
+  get(id: string, options?: RequestOptions): APIPromise<Ingress> {
+    return this._client.get(path`/ingresses/${id}`, options);
+  }
+}
+
+export interface Ingress {
+  /**
+   * Auto-generated unique identifier
+   */
+  id: string;
+
+  /**
+   * Creation timestamp (RFC3339)
+   */
+  created_at: string;
+
+  /**
+   * Human-readable name
+   */
+  name: string;
+
+  /**
+   * Routing rules for this ingress
+   */
+  rules: Array<IngressRule>;
+}
+
+export interface IngressMatch {
+  /**
+   * Hostname to match. Can be:
+   *
+   * - Literal: "api.example.com" (exact match on Host header)
+   * - Pattern: "{instance}.example.com" (dynamic routing based on subdomain)
+   *
+   * Pattern hostnames use named captures in curly braces (e.g., {instance}, {app})
+   * that extract parts of the hostname for routing. The extracted values can be
+   * referenced in the target.instance field.
+   */
+  hostname: string;
+
+  /**
+   * Host port to listen on for this rule (default 80)
+   */
+  port?: number;
+}
+
+export interface IngressRule {
+  match: IngressMatch;
+
+  target: IngressTarget;
+
+  /**
+   * Auto-create HTTP to HTTPS redirect for this hostname (only applies when tls is
+   * enabled)
+   */
+  redirect_http?: boolean;
+
+  /**
+   * Enable TLS termination (certificate auto-issued via ACME).
+   */
+  tls?: boolean;
+}
+
+export interface IngressTarget {
+  /**
+   * Target instance name, ID, or capture reference.
+   *
+   * - For literal hostnames: Use the instance name or ID directly (e.g., "my-api")
+   * - For pattern hostnames: Reference a capture from the hostname (e.g.,
+   *   "{instance}")
+   *
+   * When using pattern hostnames, the instance is resolved dynamically at request
+   * time.
+   */
+  instance: string;
+
+  /**
+   * Target port on the instance
+   */
+  port: number;
+}
+
+export type IngressListResponse = Array<Ingress>;
+
+export interface IngressCreateParams {
+  /**
+   * Human-readable name (lowercase letters, digits, and dashes only; cannot start or
+   * end with a dash)
+   */
+  name: string;
+
+  /**
+   * Routing rules for this ingress
+   */
+  rules: Array<IngressRule>;
+}
+
+export declare namespace Ingresses {
+  export {
+    type Ingress as Ingress,
+    type IngressMatch as IngressMatch,
+    type IngressRule as IngressRule,
+    type IngressTarget as IngressTarget,
+    type IngressListResponse as IngressListResponse,
+    type IngressCreateParams as IngressCreateParams,
+  };
+}
diff --git a/sdks/ts/src/resources/instances.ts b/sdks/ts/src/resources/instances.ts
new file mode 100644
index 00000000..e3873a74
--- /dev/null
+++ b/sdks/ts/src/resources/instances.ts
@@ -0,0 +1,3 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export * from './instances/index';
diff --git a/sdks/ts/src/resources/instances/index.ts b/sdks/ts/src/resources/instances/index.ts
new file mode 100644
index 00000000..28ca90a6
--- /dev/null
+++ b/sdks/ts/src/resources/instances/index.ts
@@ -0,0 +1,15 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export {
+  Instances,
+  type Instance,
+  type PathInfo,
+  type PortMapping,
+  type VolumeMount,
+  type InstanceListResponse,
+  type InstanceLogsResponse,
+  type InstanceCreateParams,
+  type InstanceLogsParams,
+  type InstanceStatParams,
+} from './instances';
+export { Volumes, type VolumeAttachParams, type VolumeDetachParams } from './volumes';
diff --git a/sdks/ts/src/resources/instances/instances.ts b/sdks/ts/src/resources/instances/instances.ts
new file mode 100644
index 00000000..9efb40e1
--- /dev/null
+++ b/sdks/ts/src/resources/instances/instances.ts
@@ -0,0 +1,496 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../core/resource';
+import * as VolumesAPI from './volumes';
+import { VolumeAttachParams, VolumeDetachParams, Volumes } from './volumes';
+import { APIPromise } from '../../core/api-promise';
+import { Stream } from '../../core/streaming';
+import { buildHeaders } from '../../internal/headers';
+import { RequestOptions } from '../../internal/request-options';
+import { path } from '../../internal/utils/path';
+
+export class Instances extends APIResource {
+  volumes: VolumesAPI.Volumes = new VolumesAPI.Volumes(this._client);
+
+  /**
+   * Create and start instance
+   *
+   * @example
+   * ```ts
+   * const instance = await client.instances.create({
+   *   image: 'docker.io/library/alpine:latest',
+   *   name: 'my-workload-1',
+   * });
+   * ```
+   */
+  create(body: InstanceCreateParams, options?: RequestOptions): APIPromise<Instance> {
+    return this._client.post('/instances', { body, ...options });
+  }
+
+  /**
+   * List instances
+   *
+   * @example
+   * ```ts
+   * const instances = await client.instances.list();
+   * ```
+   */
+  list(options?: RequestOptions): APIPromise<InstanceListResponse> {
+    return this._client.get('/instances', options);
+  }
+
+  /**
+   * Stop and delete instance
+   *
+   * @example
+   * ```ts
+   * await client.instances.delete('id');
+   * ```
+   */
+  delete(id: string, options?: RequestOptions): APIPromise<void> {
+    return this._client.delete(path`/instances/${id}`, {
+      ...options,
+      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
+    });
+  }
+
+  /**
+   * Get instance details
+   *
+   * @example
+   * ```ts
+   * const instance = await client.instances.get('id');
+   * ```
+   */
+  get(id: string, options?: RequestOptions): APIPromise<Instance> {
+    return this._client.get(path`/instances/${id}`, options);
+  }
+
+  /**
+   * Streams instance logs as Server-Sent Events. Use the `source` parameter to
+   * select which log to stream:
+   *
+   * - `app` (default): Guest application logs (serial console)
+   * - `vmm`: Cloud Hypervisor VMM logs
+   * - `hypeman`: Hypeman operations log
+   *
+   * Returns the last N lines (controlled by `tail` parameter), then optionally
+   * continues streaming new lines if `follow=true`.
+   *
+   * @example
+   * ```ts
+   * const response = await client.instances.logs('id');
+   * ```
+   */
+  logs(
+    id: string,
+    query: InstanceLogsParams | undefined = {},
+    options?: RequestOptions,
+  ): APIPromise<Stream<InstanceLogsResponse>> {
+    return this._client.get(path`/instances/${id}/logs`, {
+      query,
+      ...options,
+      headers: buildHeaders([{ Accept: 'text/event-stream' }, options?.headers]),
+      stream: true,
+    }) as APIPromise<Stream<InstanceLogsResponse>>;
+  }
+
+  /**
+   * Restore instance from standby
+   *
+   * @example
+   * ```ts
+   * const instance = await client.instances.restore('id');
+   * ```
+   */
+  restore(id: string, options?: RequestOptions): APIPromise<Instance> {
+    return this._client.post(path`/instances/${id}/restore`, options);
+  }
+
+  /**
+   * Put instance in standby (pause, snapshot, delete VMM)
+   *
+   * @example
+   * ```ts
+   * const instance = await client.instances.standby('id');
+   * ```
+   */
+  standby(id: string, options?: RequestOptions): APIPromise<Instance> {
+    return this._client.post(path`/instances/${id}/standby`, options);
+  }
+
+  /**
+   * Start a stopped instance
+   *
+   * @example
+   * ```ts
+   * const instance = await client.instances.start('id');
+   * ```
+   */
+  start(id: string, options?: RequestOptions): APIPromise<Instance> {
+    return this._client.post(path`/instances/${id}/start`, options);
+  }
+
+  /**
+   * Returns information about a path in the guest filesystem. Useful for checking if
+   * a path exists, its type, and permissions before performing file operations.
+   *
+   * @example
+   * ```ts
+   * const pathInfo = await client.instances.stat('id', {
+   *   path: 'path',
+   * });
+   * ```
+   */
+  stat(id: string, query: InstanceStatParams, options?: RequestOptions): APIPromise<PathInfo> {
+    return this._client.get(path`/instances/${id}/stat`, { query, ...options });
+  }
+
+  /**
+   * Stop instance (graceful shutdown)
+   *
+   * @example
+   * ```ts
+   * const instance = await client.instances.stop('id');
+   * ```
+   */
+  stop(id: string, options?: RequestOptions): APIPromise<Instance> {
+    return this._client.post(path`/instances/${id}/stop`, options);
+  }
+}
+
+export interface Instance {
+  /**
+   * Auto-generated unique identifier (CUID2 format)
+   */
+  id: string;
+
+  /**
+   * Creation timestamp (RFC3339)
+   */
+  created_at: string;
+
+  /**
+   * OCI image reference
+   */
+  image: string;
+
+  /**
+   * Human-readable name
+   */
+  name: string;
+
+  /**
+   * Instance state:
+   *
+   * - Created: VMM created but not started (Cloud Hypervisor native)
+   * - Running: VM is actively running (Cloud Hypervisor native)
+   * - Paused: VM is paused (Cloud Hypervisor native)
+   * - Shutdown: VM shut down but VMM exists (Cloud Hypervisor native)
+   * - Stopped: No VMM running, no snapshot exists
+   * - Standby: No VMM running, snapshot exists (can be restored)
+   * - Unknown: Failed to determine state (see state_error for details)
+   */
+  state: 'Created' | 'Running' | 'Paused' | 'Shutdown' | 'Stopped' | 'Standby' | 'Unknown';
+
+  /**
+   * Environment variables
+   */
+  env?: { [key: string]: string };
+
+  /**
+   * Whether a snapshot exists for this instance
+   */
+  has_snapshot?: boolean;
+
+  /**
+   * Hotplug memory size (human-readable)
+   */
+  hotplug_size?: string;
+
+  /**
+   * Hypervisor running this instance
+   */
+  hypervisor?: 'cloud-hypervisor' | 'qemu';
+
+  /**
+   * Network configuration of the instance
+   */
+  network?: Instance.Network;
+
+  /**
+   * Writable overlay disk size (human-readable)
+   */
+  overlay_size?: string;
+
+  /**
+   * Base memory size (human-readable)
+   */
+  size?: string;
+
+  /**
+   * Start timestamp (RFC3339)
+   */
+  started_at?: string | null;
+
+  /**
+   * Error message if state couldn't be determined (only set when state is Unknown)
+   */
+  state_error?: string | null;
+
+  /**
+   * Stop timestamp (RFC3339)
+   */
+  stopped_at?: string | null;
+
+  /**
+   * Number of virtual CPUs
+   */
+  vcpus?: number;
+
+  /**
+   * Volumes attached to the instance
+   */
+  volumes?: Array<VolumeMount>;
+}
+
+export namespace Instance {
+  /**
+   * Network configuration of the instance
+   */
+  export interface Network {
+    /**
+     * Whether instance is attached to the default network
+     */
+    enabled?: boolean;
+
+    /**
+     * Assigned IP address (null if no network)
+     */
+    ip?: string | null;
+
+    /**
+     * Assigned MAC address (null if no network)
+     */
+    mac?: string | null;
+
+    /**
+     * Network name (always "default" when enabled)
+     */
+    name?: string;
+  }
+}
+
+export interface PathInfo {
+  /**
+   * Whether the path exists
+   */
+  exists: boolean;
+
+  /**
+   * Error message if stat failed (e.g., permission denied). Only set when exists is
+   * false due to an error rather than the path not existing.
+   */
+  error?: string | null;
+
+  /**
+   * True if this is a directory
+   */
+  is_dir?: boolean;
+
+  /**
+   * True if this is a regular file
+   */
+  is_file?: boolean;
+
+  /**
+   * True if this is a symbolic link (only set when follow_links=false)
+   */
+  is_symlink?: boolean;
+
+  /**
+   * Symlink target path (only set when is_symlink=true)
+   */
+  link_target?: string | null;
+
+  /**
+   * File mode (Unix permissions)
+   */
+  mode?: number;
+
+  /**
+   * File size in bytes
+   */
+  size?: number;
+}
+
+export interface PortMapping {
+  /**
+   * Port in the guest VM
+   */
+  guest_port: number;
+
+  /**
+   * Port on the host
+   */
+  host_port: number;
+
+  protocol?: 'tcp' | 'udp';
+}
+
+export interface VolumeMount {
+  /**
+   * Path where volume is mounted in the guest
+   */
+  mount_path: string;
+
+  /**
+   * Volume identifier
+   */
+  volume_id: string;
+
+  /**
+   * Create per-instance overlay for writes (requires readonly=true)
+   */
+  overlay?: boolean;
+
+  /**
+   * Max overlay size as human-readable string (e.g., "1GB"). Required if
+   * overlay=true.
+   */
+  overlay_size?: string;
+
+  /**
+   * Whether volume is mounted read-only
+   */
+  readonly?: boolean;
+}
+
+export type InstanceListResponse = Array<Instance>;
+
+export type InstanceLogsResponse = string;
+
+export interface InstanceCreateParams {
+  /**
+   * OCI image reference
+   */
+  image: string;
+
+  /**
+   * Human-readable name (lowercase letters, digits, and dashes only; cannot start or
+   * end with a dash)
+   */
+  name: string;
+
+  /**
+   * Device IDs or names to attach for GPU/PCI passthrough
+   */
+  devices?: Array<string>;
+
+  /**
+   * Environment variables
+   */
+  env?: { [key: string]: string };
+
+  /**
+   * Additional memory for hotplug (human-readable format like "3GB", "1G")
+   */
+  hotplug_size?: string;
+
+  /**
+   * Hypervisor to use for this instance. Defaults to server configuration.
+   */
+  hypervisor?: 'cloud-hypervisor' | 'qemu';
+
+  /**
+   * Network configuration for the instance
+   */
+  network?: InstanceCreateParams.Network;
+
+  /**
+   * Writable overlay disk size (human-readable format like "10GB", "50G")
+   */
+  overlay_size?: string;
+
+  /**
+   * Base memory size (human-readable format like "1GB", "512MB", "2G")
+   */
+  size?: string;
+
+  /**
+   * Number of virtual CPUs
+   */
+  vcpus?: number;
+
+  /**
+   * Volumes to attach to the instance at creation time
+   */
+  volumes?: Array<VolumeMount>;
+}
+
+export namespace InstanceCreateParams {
+  /**
+   * Network configuration for the instance
+   */
+  export interface Network {
+    /**
+     * Whether to attach instance to the default network
+     */
+    enabled?: boolean;
+  }
+}
+
+export interface InstanceLogsParams {
+  /**
+   * Continue streaming new lines after initial output
+   */
+  follow?: boolean;
+
+  /**
+   * Log source to stream:
+   *
+   * - app: Guest application logs (serial console output)
+   * - vmm: Cloud Hypervisor VMM logs (hypervisor stdout+stderr)
+   * - hypeman: Hypeman operations log (actions taken on this instance)
+   */
+  source?: 'app' | 'vmm' | 'hypeman';
+
+  /**
+   * Number of lines to return from end
+   */
+  tail?: number;
+}
+
+export interface InstanceStatParams {
+  /**
+   * Path to stat in the guest filesystem
+   */
+  path: string;
+
+  /**
+   * Follow symbolic links (like stat vs lstat)
+   */
+  follow_links?: boolean;
+}
+
+Instances.Volumes = Volumes;
+
+export declare namespace Instances {
+  export {
+    type Instance as Instance,
+    type PathInfo as PathInfo,
+    type PortMapping as PortMapping,
+    type VolumeMount as VolumeMount,
+    type InstanceListResponse as InstanceListResponse,
+    type InstanceLogsResponse as InstanceLogsResponse,
+    type InstanceCreateParams as InstanceCreateParams,
+    type InstanceLogsParams as InstanceLogsParams,
+    type InstanceStatParams as InstanceStatParams,
+  };
+
+  export {
+    Volumes as Volumes,
+    type VolumeAttachParams as VolumeAttachParams,
+    type VolumeDetachParams as VolumeDetachParams,
+  };
+}
diff --git a/sdks/ts/src/resources/instances/volumes.ts b/sdks/ts/src/resources/instances/volumes.ts
new file mode 100644
index 00000000..00f81d5d
--- /dev/null
+++ b/sdks/ts/src/resources/instances/volumes.ts
@@ -0,0 +1,77 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../core/resource';
+import * as InstancesAPI from './instances';
+import { APIPromise } from '../../core/api-promise';
+import { RequestOptions } from '../../internal/request-options';
+import { path } from '../../internal/utils/path';
+
+export class Volumes extends APIResource {
+  /**
+   * Attach volume to instance
+   *
+   * @example
+   * ```ts
+   * const instance = await client.instances.volumes.attach(
+   *   'volumeId',
+   *   { id: 'id', mount_path: '/mnt/data' },
+   * );
+   * ```
+   */
+  attach(
+    volumeID: string,
+    params: VolumeAttachParams,
+    options?: RequestOptions,
+  ): APIPromise<InstancesAPI.Instance> {
+    const { id, ...body } = params;
+    return this._client.post(path`/instances/${id}/volumes/${volumeID}`, { body, ...options });
+  }
+
+  /**
+   * Detach volume from instance
+   *
+   * @example
+   * ```ts
+   * const instance = await client.instances.volumes.detach(
+   *   'volumeId',
+   *   { id: 'id' },
+   * );
+   * ```
+   */
+  detach(
+    volumeID: string,
+    params: VolumeDetachParams,
+    options?: RequestOptions,
+  ): APIPromise<InstancesAPI.Instance> {
+    const { id } = params;
+    return this._client.delete(path`/instances/${id}/volumes/${volumeID}`, options);
+  }
+}
+
+export interface VolumeAttachParams {
+  /**
+   * Path param: Instance ID or name
+   */
+  id: string;
+
+  /**
+   * Body param: Path where volume should be mounted
+   */
+  mount_path: string;
+
+  /**
+   * Body param: Mount as read-only
+   */
+  readonly?: boolean;
+}
+
+export interface VolumeDetachParams {
+  /**
+   * Instance ID or name
+   */
+  id: string;
+}
+
+export declare namespace Volumes {
+  export { type VolumeAttachParams as VolumeAttachParams, type VolumeDetachParams as VolumeDetachParams };
+}
diff --git a/sdks/ts/src/resources/volumes.ts b/sdks/ts/src/resources/volumes.ts
new file mode 100644
index 00000000..7811d4a9
--- /dev/null
+++ b/sdks/ts/src/resources/volumes.ts
@@ -0,0 +1,143 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../core/resource';
+import { APIPromise } from '../core/api-promise';
+import { buildHeaders } from '../internal/headers';
+import { RequestOptions } from '../internal/request-options';
+import { maybeMultipartFormRequestOptions } from '../internal/uploads';
+import { path } from '../internal/utils/path';
+
+export class Volumes extends APIResource {
+  /**
+   * Creates a new volume. Supports two modes:
+   *
+   * - JSON body: Creates an empty volume of the specified size
+   * - Multipart form: Creates a volume pre-populated with content from a tar.gz
+   *   archive
+   *
+   * @example
+   * ```ts
+   * const volume = await client.volumes.create({
+   *   name: 'my-data-volume',
+   *   size_gb: 10,
+   * });
+   * ```
+   */
+  create(body: VolumeCreateParams, options?: RequestOptions): APIPromise<Volume> {
+    return this._client.post(
+      '/volumes',
+      maybeMultipartFormRequestOptions({ body, ...options }, this._client),
+    );
+  }
+
+  /**
+   * List volumes
+   *
+   * @example
+   * ```ts
+   * const volumes = await client.volumes.list();
+   * ```
+   */
+  list(options?: RequestOptions): APIPromise<VolumeListResponse> {
+    return this._client.get('/volumes', options);
+  }
+
+  /**
+   * Delete volume
+   *
+   * @example
+   * ```ts
+   * await client.volumes.delete('id');
+   * ```
+   */
+  delete(id: string, options?: RequestOptions): APIPromise<void> {
+    return this._client.delete(path`/volumes/${id}`, {
+      ...options,
+      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
+    });
+  }
+
+  /**
+   * Get volume details
+   *
+   * @example
+   * ```ts
+   * const volume = await client.volumes.get('id');
+   * ```
+   */
+  get(id: string, options?: RequestOptions): APIPromise<Volume> {
+    return this._client.get(path`/volumes/${id}`, options);
+  }
+}
+
+export interface Volume {
+  /**
+   * Unique identifier
+   */
+  id: string;
+
+  /**
+   * Creation timestamp (RFC3339)
+   */
+  created_at: string;
+
+  /**
+   * Volume name
+   */
+  name: string;
+
+  /**
+   * Size in gigabytes
+   */
+  size_gb: number;
+
+  /**
+   * List of current attachments (empty if not attached)
+   */
+  attachments?: Array<VolumeAttachment>;
+}
+
+export interface VolumeAttachment {
+  /**
+   * ID of the instance this volume is attached to
+   */
+  instance_id: string;
+
+  /**
+   * Mount path in the guest
+   */
+  mount_path: string;
+
+  /**
+   * Whether the attachment is read-only
+   */
+  readonly: boolean;
+}
+
+export type VolumeListResponse = Array<Volume>;
+
+export interface VolumeCreateParams {
+  /**
+   * Volume name
+   */
+  name: string;
+
+  /**
+   * Size in gigabytes
+   */
+  size_gb: number;
+
+  /**
+   * Optional custom identifier (auto-generated if not provided)
+   */
+  id?: string;
+}
+
+export declare namespace Volumes {
+  export {
+    type Volume as Volume,
+    type VolumeAttachment as VolumeAttachment,
+    type VolumeListResponse as VolumeListResponse,
+    type VolumeCreateParams as VolumeCreateParams,
+  };
+}
diff --git a/sdks/ts/src/streaming.ts b/sdks/ts/src/streaming.ts
new file mode 100644
index 00000000..9e6da106
--- /dev/null
+++ b/sdks/ts/src/streaming.ts
@@ -0,0 +1,2 @@
+/** @deprecated Import from ./core/streaming instead */
+export * from './core/streaming';
diff --git a/sdks/ts/src/uploads.ts b/sdks/ts/src/uploads.ts
new file mode 100644
index 00000000..b2ef6471
--- /dev/null
+++ b/sdks/ts/src/uploads.ts
@@ -0,0 +1,2 @@
+/** @deprecated Import from ./core/uploads instead */
+export * from './core/uploads';
diff --git a/sdks/ts/src/version.ts b/sdks/ts/src/version.ts
new file mode 100644
index 00000000..1baa2286
--- /dev/null
+++ b/sdks/ts/src/version.ts
@@ -0,0 +1 @@
+export const VERSION = '0.1.0'; // x-release-please-version
diff --git a/sdks/ts/tests/api-resources/devices.test.ts b/sdks/ts/tests/api-resources/devices.test.ts
new file mode 100644
index 00000000..502e1888
--- /dev/null
+++ b/sdks/ts/tests/api-resources/devices.test.ts
@@ -0,0 +1,75 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  apiKey: 'My API Key',
+  baseURL: process.env['TEST_API_BASE_URL'] ?? 'http://127.0.0.1:4010',
+});
+
+describe('resource devices', () => {
+  // Prism tests are disabled
+  test.skip('create: only required params', async () => {
+    const responsePromise = client.devices.create({ pci_address: '0000:a2:00.0' });
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('create: required and optional params', async () => {
+    const response = await client.devices.create({ pci_address: '0000:a2:00.0', name: 'l4-gpu' });
+  });
+
+  // Prism tests are disabled
+  test.skip('retrieve', async () => {
+    const responsePromise = client.devices.retrieve('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('list', async () => {
+    const responsePromise = client.devices.list();
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('delete', async () => {
+    const responsePromise = client.devices.delete('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('listAvailable', async () => {
+    const responsePromise = client.devices.listAvailable();
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+});
diff --git a/sdks/ts/tests/api-resources/health.test.ts b/sdks/ts/tests/api-resources/health.test.ts
new file mode 100644
index 00000000..64472e4c
--- /dev/null
+++ b/sdks/ts/tests/api-resources/health.test.ts
@@ -0,0 +1,22 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  apiKey: 'My API Key',
+  baseURL: process.env['TEST_API_BASE_URL'] ?? 'http://127.0.0.1:4010',
+});
+
+describe('resource health', () => {
+  // Prism tests are disabled
+  test.skip('check', async () => {
+    const responsePromise = client.health.check();
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+});
diff --git a/sdks/ts/tests/api-resources/images.test.ts b/sdks/ts/tests/api-resources/images.test.ts
new file mode 100644
index 00000000..9a9cfbab
--- /dev/null
+++ b/sdks/ts/tests/api-resources/images.test.ts
@@ -0,0 +1,63 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  apiKey: 'My API Key',
+  baseURL: process.env['TEST_API_BASE_URL'] ?? 'http://127.0.0.1:4010',
+});
+
+describe('resource images', () => {
+  // Prism tests are disabled
+  test.skip('create: only required params', async () => {
+    const responsePromise = client.images.create({ name: 'docker.io/library/nginx:latest' });
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('create: required and optional params', async () => {
+    const response = await client.images.create({ name: 'docker.io/library/nginx:latest' });
+  });
+
+  // Prism tests are disabled
+  test.skip('list', async () => {
+    const responsePromise = client.images.list();
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('delete', async () => {
+    const responsePromise = client.images.delete('name');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('get', async () => {
+    const responsePromise = client.images.get('name');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+});
diff --git a/sdks/ts/tests/api-resources/ingresses.test.ts b/sdks/ts/tests/api-resources/ingresses.test.ts
new file mode 100644
index 00000000..677139c8
--- /dev/null
+++ b/sdks/ts/tests/api-resources/ingresses.test.ts
@@ -0,0 +1,78 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  apiKey: 'My API Key',
+  baseURL: process.env['TEST_API_BASE_URL'] ?? 'http://127.0.0.1:4010',
+});
+
+describe('resource ingresses', () => {
+  // Prism tests are disabled
+  test.skip('create: only required params', async () => {
+    const responsePromise = client.ingresses.create({
+      name: 'my-api-ingress',
+      rules: [
+        { match: { hostname: '{instance}.example.com' }, target: { instance: '{instance}', port: 8080 } },
+      ],
+    });
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('create: required and optional params', async () => {
+    const response = await client.ingresses.create({
+      name: 'my-api-ingress',
+      rules: [
+        {
+          match: { hostname: '{instance}.example.com', port: 8080 },
+          target: { instance: '{instance}', port: 8080 },
+          redirect_http: true,
+          tls: true,
+        },
+      ],
+    });
+  });
+
+  // Prism tests are disabled
+  test.skip('list', async () => {
+    const responsePromise = client.ingresses.list();
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('delete', async () => {
+    const responsePromise = client.ingresses.delete('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('get', async () => {
+    const responsePromise = client.ingresses.get('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+});
diff --git a/sdks/ts/tests/api-resources/instances/instances.test.ts b/sdks/ts/tests/api-resources/instances/instances.test.ts
new file mode 100644
index 00000000..a5fd6580
--- /dev/null
+++ b/sdks/ts/tests/api-resources/instances/instances.test.ts
@@ -0,0 +1,175 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  apiKey: 'My API Key',
+  baseURL: process.env['TEST_API_BASE_URL'] ?? 'http://127.0.0.1:4010',
+});
+
+describe('resource instances', () => {
+  // Prism tests are disabled
+  test.skip('create: only required params', async () => {
+    const responsePromise = client.instances.create({
+      image: 'docker.io/library/alpine:latest',
+      name: 'my-workload-1',
+    });
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('create: required and optional params', async () => {
+    const response = await client.instances.create({
+      image: 'docker.io/library/alpine:latest',
+      name: 'my-workload-1',
+      devices: ['l4-gpu'],
+      env: { PORT: '3000', NODE_ENV: 'production' },
+      hotplug_size: '2GB',
+      hypervisor: 'cloud-hypervisor',
+      network: { enabled: true },
+      overlay_size: '20GB',
+      size: '2GB',
+      vcpus: 2,
+      volumes: [
+        {
+          mount_path: '/mnt/data',
+          volume_id: 'vol-abc123',
+          overlay: true,
+          overlay_size: '1GB',
+          readonly: true,
+        },
+      ],
+    });
+  });
+
+  // Prism tests are disabled
+  test.skip('list', async () => {
+    const responsePromise = client.instances.list();
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('delete', async () => {
+    const responsePromise = client.instances.delete('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('get', async () => {
+    const responsePromise = client.instances.get('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism doesn't support text/event-stream responses
+  test.skip('logs', async () => {
+    const responsePromise = client.instances.logs('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism doesn't support text/event-stream responses
+  test.skip('logs: request options and params are passed correctly', async () => {
+    // ensure the request options are being passed correctly by passing an invalid HTTP method in order to cause an error
+    await expect(
+      client.instances.logs(
+        'id',
+        { follow: true, source: 'app', tail: 0 },
+        { path: '/_stainless_unknown_path' },
+      ),
+    ).rejects.toThrow(Hypeman.NotFoundError);
+  });
+
+  // Prism tests are disabled
+  test.skip('restore', async () => {
+    const responsePromise = client.instances.restore('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('standby', async () => {
+    const responsePromise = client.instances.standby('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('start', async () => {
+    const responsePromise = client.instances.start('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('stat: only required params', async () => {
+    const responsePromise = client.instances.stat('id', { path: 'path' });
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('stat: required and optional params', async () => {
+    const response = await client.instances.stat('id', { path: 'path', follow_links: true });
+  });
+
+  // Prism tests are disabled
+  test.skip('stop', async () => {
+    const responsePromise = client.instances.stop('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+});
diff --git a/sdks/ts/tests/api-resources/instances/volumes.test.ts b/sdks/ts/tests/api-resources/instances/volumes.test.ts
new file mode 100644
index 00000000..4a4ced0b
--- /dev/null
+++ b/sdks/ts/tests/api-resources/instances/volumes.test.ts
@@ -0,0 +1,51 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  apiKey: 'My API Key',
+  baseURL: process.env['TEST_API_BASE_URL'] ?? 'http://127.0.0.1:4010',
+});
+
+describe('resource volumes', () => {
+  // Prism tests are disabled
+  test.skip('attach: only required params', async () => {
+    const responsePromise = client.instances.volumes.attach('volumeId', {
+      id: 'id',
+      mount_path: '/mnt/data',
+    });
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('attach: required and optional params', async () => {
+    const response = await client.instances.volumes.attach('volumeId', {
+      id: 'id',
+      mount_path: '/mnt/data',
+      readonly: true,
+    });
+  });
+
+  // Prism tests are disabled
+  test.skip('detach: only required params', async () => {
+    const responsePromise = client.instances.volumes.detach('volumeId', { id: 'id' });
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('detach: required and optional params', async () => {
+    const response = await client.instances.volumes.detach('volumeId', { id: 'id' });
+  });
+});
diff --git a/sdks/ts/tests/api-resources/volumes.test.ts b/sdks/ts/tests/api-resources/volumes.test.ts
new file mode 100644
index 00000000..8f4d87de
--- /dev/null
+++ b/sdks/ts/tests/api-resources/volumes.test.ts
@@ -0,0 +1,63 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import Hypeman from '@onkernel/hypeman';
+
+const client = new Hypeman({
+  apiKey: 'My API Key',
+  baseURL: process.env['TEST_API_BASE_URL'] ?? 'http://127.0.0.1:4010',
+});
+
+describe('resource volumes', () => {
+  // Prism tests are disabled
+  test.skip('create: only required params', async () => {
+    const responsePromise = client.volumes.create({ name: 'my-data-volume', size_gb: 10 });
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('create: required and optional params', async () => {
+    const response = await client.volumes.create({ name: 'my-data-volume', size_gb: 10, id: 'vol-data-1' });
+  });
+
+  // Prism tests are disabled
+  test.skip('list', async () => {
+    const responsePromise = client.volumes.list();
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('delete', async () => {
+    const responsePromise = client.volumes.delete('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+
+  // Prism tests are disabled
+  test.skip('get', async () => {
+    const responsePromise = client.volumes.get('id');
+    const rawResponse = await responsePromise.asResponse();
+    expect(rawResponse).toBeInstanceOf(Response);
+    const response = await responsePromise;
+    expect(response).not.toBeInstanceOf(Response);
+    const dataAndResponse = await responsePromise.withResponse();
+    expect(dataAndResponse.data).toBe(response);
+    expect(dataAndResponse.response).toBe(rawResponse);
+  });
+});
diff --git a/sdks/ts/tests/base64.test.ts b/sdks/ts/tests/base64.test.ts
new file mode 100644
index 00000000..53063e66
--- /dev/null
+++ b/sdks/ts/tests/base64.test.ts
@@ -0,0 +1,80 @@
+import { fromBase64, toBase64 } from '@onkernel/hypeman/internal/utils/base64';
+
+describe.each(['Buffer', 'atob'])('with %s', (mode) => {
+  let originalBuffer: BufferConstructor;
+  beforeAll(() => {
+    if (mode === 'atob') {
+      originalBuffer = globalThis.Buffer;
+      // @ts-expect-error Can't assign undefined to BufferConstructor
+      delete globalThis.Buffer;
+    }
+  });
+  afterAll(() => {
+    if (mode === 'atob') {
+      globalThis.Buffer = originalBuffer;
+    }
+  });
+  test('toBase64', () => {
+    const testCases = [
+      {
+        input: 'hello world',
+        expected: 'aGVsbG8gd29ybGQ=',
+      },
+      {
+        input: new Uint8Array([104, 101, 108, 108, 111, 32, 119, 111, 114, 108, 100]),
+        expected: 'aGVsbG8gd29ybGQ=',
+      },
+      {
+        input: undefined,
+        expected: '',
+      },
+      {
+        input: new Uint8Array([
+          229, 102, 215, 230, 65, 22, 46, 87, 243, 176, 99, 99, 31, 174, 8, 242, 83, 142, 169, 64, 122, 123,
+          193, 71,
+        ]),
+        expected: '5WbX5kEWLlfzsGNjH64I8lOOqUB6e8FH',
+      },
+      {
+        input: '✓',
+        expected: '4pyT',
+      },
+      {
+        input: new Uint8Array([226, 156, 147]),
+        expected: '4pyT',
+      },
+    ];
+
+    testCases.forEach(({ input, expected }) => {
+      expect(toBase64(input)).toBe(expected);
+    });
+  });
+
+  test('fromBase64', () => {
+    const testCases = [
+      {
+        input: 'aGVsbG8gd29ybGQ=',
+        expected: new Uint8Array([104, 101, 108, 108, 111, 32, 119, 111, 114, 108, 100]),
+      },
+      {
+        input: '',
+        expected: new Uint8Array([]),
+      },
+      {
+        input: '5WbX5kEWLlfzsGNjH64I8lOOqUB6e8FH',
+        expected: new Uint8Array([
+          229, 102, 215, 230, 65, 22, 46, 87, 243, 176, 99, 99, 31, 174, 8, 242, 83, 142, 169, 64, 122, 123,
+          193, 71,
+        ]),
+      },
+      {
+        input: '4pyT',
+        expected: new Uint8Array([226, 156, 147]),
+      },
+    ];
+
+    testCases.forEach(({ input, expected }) => {
+      expect(fromBase64(input)).toEqual(expected);
+    });
+  });
+});
diff --git a/sdks/ts/tests/buildHeaders.test.ts b/sdks/ts/tests/buildHeaders.test.ts
new file mode 100644
index 00000000..fadf51e4
--- /dev/null
+++ b/sdks/ts/tests/buildHeaders.test.ts
@@ -0,0 +1,88 @@
+import { inspect } from 'node:util';
+import { buildHeaders, type HeadersLike, type NullableHeaders } from '@onkernel/hypeman/internal/headers';
+
+function inspectNullableHeaders(headers: NullableHeaders) {
+  return `NullableHeaders {${[
+    ...[...headers.values.entries()].map(([name, value]) => ` ${inspect(name)}: ${inspect(value)}`),
+    ...[...headers.nulls].map((name) => ` ${inspect(name)}: null`),
+  ].join(', ')} }`;
+}
+
+describe('buildHeaders', () => {
+  const cases: [HeadersLike[], string][] = [
+    [[new Headers({ 'content-type': 'text/plain' })], `NullableHeaders { 'content-type': 'text/plain' }`],
+    [
+      [
+        {
+          'content-type': 'text/plain',
+        },
+        {
+          'Content-Type': undefined,
+        },
+      ],
+      `NullableHeaders { 'content-type': 'text/plain' }`,
+    ],
+    [
+      [
+        {
+          'content-type': 'text/plain',
+        },
+        {
+          'Content-Type': null,
+        },
+      ],
+      `NullableHeaders { 'content-type': null }`,
+    ],
+    [
+      [
+        {
+          cookie: 'name1=value1',
+          Cookie: 'name2=value2',
+        },
+      ],
+      `NullableHeaders { 'cookie': 'name2=value2' }`,
+    ],
+    [
+      [
+        {
+          cookie: 'name1=value1',
+          Cookie: undefined,
+        },
+      ],
+      `NullableHeaders { 'cookie': 'name1=value1' }`,
+    ],
+    [
+      [
+        {
+          cookie: ['name1=value1', 'name2=value2'],
+        },
+      ],
+      `NullableHeaders { 'cookie': 'name1=value1; name2=value2' }`,
+    ],
+    [
+      [
+        {
+          'x-foo': ['name1=value1', 'name2=value2'],
+        },
+      ],
+      `NullableHeaders { 'x-foo': 'name1=value1, name2=value2' }`,
+    ],
+    [
+      [
+        [
+          ['cookie', 'name1=value1'],
+          ['cookie', 'name2=value2'],
+          ['Cookie', 'name3=value3'],
+        ],
+      ],
+      `NullableHeaders { 'cookie': 'name1=value1; name2=value2; name3=value3' }`,
+    ],
+    [[undefined], `NullableHeaders { }`],
+    [[null], `NullableHeaders { }`],
+  ];
+  for (const [input, expected] of cases) {
+    test(expected, () => {
+      expect(inspectNullableHeaders(buildHeaders(input))).toEqual(expected);
+    });
+  }
+});
diff --git a/sdks/ts/tests/form.test.ts b/sdks/ts/tests/form.test.ts
new file mode 100644
index 00000000..ba6f3828
--- /dev/null
+++ b/sdks/ts/tests/form.test.ts
@@ -0,0 +1,85 @@
+import { multipartFormRequestOptions, createForm } from '@onkernel/hypeman/internal/uploads';
+import { toFile } from '@onkernel/hypeman/core/uploads';
+
+describe('form data validation', () => {
+  test('valid values do not error', async () => {
+    await multipartFormRequestOptions(
+      {
+        body: {
+          foo: 'foo',
+          string: 1,
+          bool: true,
+          file: await toFile(Buffer.from('some-content')),
+          blob: new Blob(['Some content'], { type: 'text/plain' }),
+        },
+      },
+      fetch,
+    );
+  });
+
+  test('null', async () => {
+    await expect(() =>
+      multipartFormRequestOptions(
+        {
+          body: {
+            null: null,
+          },
+        },
+        fetch,
+      ),
+    ).rejects.toThrow(TypeError);
+  });
+
+  test('undefined is stripped', async () => {
+    const form = await createForm(
+      {
+        foo: undefined,
+        bar: 'baz',
+      },
+      fetch,
+    );
+    expect(form.has('foo')).toBe(false);
+    expect(form.get('bar')).toBe('baz');
+  });
+
+  test('nested undefined property is stripped', async () => {
+    const form = await createForm(
+      {
+        bar: {
+          baz: undefined,
+        },
+      },
+      fetch,
+    );
+    expect(Array.from(form.entries())).toEqual([]);
+
+    const form2 = await createForm(
+      {
+        bar: {
+          foo: 'string',
+          baz: undefined,
+        },
+      },
+      fetch,
+    );
+    expect(Array.from(form2.entries())).toEqual([['bar[foo]', 'string']]);
+  });
+
+  test('nested undefined array item is stripped', async () => {
+    const form = await createForm(
+      {
+        bar: [undefined, undefined],
+      },
+      fetch,
+    );
+    expect(Array.from(form.entries())).toEqual([]);
+
+    const form2 = await createForm(
+      {
+        bar: [undefined, 'foo'],
+      },
+      fetch,
+    );
+    expect(Array.from(form2.entries())).toEqual([['bar[]', 'foo']]);
+  });
+});
diff --git a/sdks/ts/tests/index.test.ts b/sdks/ts/tests/index.test.ts
new file mode 100644
index 00000000..eec16d10
--- /dev/null
+++ b/sdks/ts/tests/index.test.ts
@@ -0,0 +1,722 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIPromise } from '@onkernel/hypeman/core/api-promise';
+
+import util from 'node:util';
+import Hypeman from '@onkernel/hypeman';
+import { APIUserAbortError } from '@onkernel/hypeman';
+const defaultFetch = fetch;
+
+describe('instantiate client', () => {
+  const env = process.env;
+
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = { ...env };
+  });
+
+  afterEach(() => {
+    process.env = env;
+  });
+
+  describe('defaultHeaders', () => {
+    const client = new Hypeman({
+      baseURL: 'http://localhost:5000/',
+      defaultHeaders: { 'X-My-Default-Header': '2' },
+      apiKey: 'My API Key',
+    });
+
+    test('they are used in the request', async () => {
+      const { req } = await client.buildRequest({ path: '/foo', method: 'post' });
+      expect(req.headers.get('x-my-default-header')).toEqual('2');
+    });
+
+    test('can ignore `undefined` and leave the default', async () => {
+      const { req } = await client.buildRequest({
+        path: '/foo',
+        method: 'post',
+        headers: { 'X-My-Default-Header': undefined },
+      });
+      expect(req.headers.get('x-my-default-header')).toEqual('2');
+    });
+
+    test('can be removed with `null`', async () => {
+      const { req } = await client.buildRequest({
+        path: '/foo',
+        method: 'post',
+        headers: { 'X-My-Default-Header': null },
+      });
+      expect(req.headers.has('x-my-default-header')).toBe(false);
+    });
+  });
+  describe('logging', () => {
+    const env = process.env;
+
+    beforeEach(() => {
+      process.env = { ...env };
+      process.env['HYPEMAN_LOG'] = undefined;
+    });
+
+    afterEach(() => {
+      process.env = env;
+    });
+
+    const forceAPIResponseForClient = async (client: Hypeman) => {
+      await new APIPromise(
+        client,
+        Promise.resolve({
+          response: new Response(),
+          controller: new AbortController(),
+          requestLogID: 'log_000000',
+          retryOfRequestLogID: undefined,
+          startTime: Date.now(),
+          options: {
+            method: 'get',
+            path: '/',
+          },
+        }),
+      );
+    };
+
+    test('debug logs when log level is debug', async () => {
+      const debugMock = jest.fn();
+      const logger = {
+        debug: debugMock,
+        info: jest.fn(),
+        warn: jest.fn(),
+        error: jest.fn(),
+      };
+
+      const client = new Hypeman({ logger: logger, logLevel: 'debug', apiKey: 'My API Key' });
+
+      await forceAPIResponseForClient(client);
+      expect(debugMock).toHaveBeenCalled();
+    });
+
+    test('default logLevel is warn', async () => {
+      const client = new Hypeman({ apiKey: 'My API Key' });
+      expect(client.logLevel).toBe('warn');
+    });
+
+    test('debug logs are skipped when log level is info', async () => {
+      const debugMock = jest.fn();
+      const logger = {
+        debug: debugMock,
+        info: jest.fn(),
+        warn: jest.fn(),
+        error: jest.fn(),
+      };
+
+      const client = new Hypeman({ logger: logger, logLevel: 'info', apiKey: 'My API Key' });
+
+      await forceAPIResponseForClient(client);
+      expect(debugMock).not.toHaveBeenCalled();
+    });
+
+    test('debug logs happen with debug env var', async () => {
+      const debugMock = jest.fn();
+      const logger = {
+        debug: debugMock,
+        info: jest.fn(),
+        warn: jest.fn(),
+        error: jest.fn(),
+      };
+
+      process.env['HYPEMAN_LOG'] = 'debug';
+      const client = new Hypeman({ logger: logger, apiKey: 'My API Key' });
+      expect(client.logLevel).toBe('debug');
+
+      await forceAPIResponseForClient(client);
+      expect(debugMock).toHaveBeenCalled();
+    });
+
+    test('warn when env var level is invalid', async () => {
+      const warnMock = jest.fn();
+      const logger = {
+        debug: jest.fn(),
+        info: jest.fn(),
+        warn: warnMock,
+        error: jest.fn(),
+      };
+
+      process.env['HYPEMAN_LOG'] = 'not a log level';
+      const client = new Hypeman({ logger: logger, apiKey: 'My API Key' });
+      expect(client.logLevel).toBe('warn');
+      expect(warnMock).toHaveBeenCalledWith(
+        'process.env[\'HYPEMAN_LOG\'] was set to "not a log level", expected one of ["off","error","warn","info","debug"]',
+      );
+    });
+
+    test('client log level overrides env var', async () => {
+      const debugMock = jest.fn();
+      const logger = {
+        debug: debugMock,
+        info: jest.fn(),
+        warn: jest.fn(),
+        error: jest.fn(),
+      };
+
+      process.env['HYPEMAN_LOG'] = 'debug';
+      const client = new Hypeman({ logger: logger, logLevel: 'off', apiKey: 'My API Key' });
+
+      await forceAPIResponseForClient(client);
+      expect(debugMock).not.toHaveBeenCalled();
+    });
+
+    test('no warning logged for invalid env var level + valid client level', async () => {
+      const warnMock = jest.fn();
+      const logger = {
+        debug: jest.fn(),
+        info: jest.fn(),
+        warn: warnMock,
+        error: jest.fn(),
+      };
+
+      process.env['HYPEMAN_LOG'] = 'not a log level';
+      const client = new Hypeman({ logger: logger, logLevel: 'debug', apiKey: 'My API Key' });
+      expect(client.logLevel).toBe('debug');
+      expect(warnMock).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('defaultQuery', () => {
+    test('with null query params given', () => {
+      const client = new Hypeman({
+        baseURL: 'http://localhost:5000/',
+        defaultQuery: { apiVersion: 'foo' },
+        apiKey: 'My API Key',
+      });
+      expect(client.buildURL('/foo', null)).toEqual('http://localhost:5000/foo?apiVersion=foo');
+    });
+
+    test('multiple default query params', () => {
+      const client = new Hypeman({
+        baseURL: 'http://localhost:5000/',
+        defaultQuery: { apiVersion: 'foo', hello: 'world' },
+        apiKey: 'My API Key',
+      });
+      expect(client.buildURL('/foo', null)).toEqual('http://localhost:5000/foo?apiVersion=foo&hello=world');
+    });
+
+    test('overriding with `undefined`', () => {
+      const client = new Hypeman({
+        baseURL: 'http://localhost:5000/',
+        defaultQuery: { hello: 'world' },
+        apiKey: 'My API Key',
+      });
+      expect(client.buildURL('/foo', { hello: undefined })).toEqual('http://localhost:5000/foo');
+    });
+  });
+
+  test('custom fetch', async () => {
+    const client = new Hypeman({
+      baseURL: 'http://localhost:5000/',
+      apiKey: 'My API Key',
+      fetch: (url) => {
+        return Promise.resolve(
+          new Response(JSON.stringify({ url, custom: true }), {
+            headers: { 'Content-Type': 'application/json' },
+          }),
+        );
+      },
+    });
+
+    const response = await client.get('/foo');
+    expect(response).toEqual({ url: 'http://localhost:5000/foo', custom: true });
+  });
+
+  test('explicit global fetch', async () => {
+    // make sure the global fetch type is assignable to our Fetch type
+    const client = new Hypeman({
+      baseURL: 'http://localhost:5000/',
+      apiKey: 'My API Key',
+      fetch: defaultFetch,
+    });
+  });
+
+  test('custom signal', async () => {
+    const client = new Hypeman({
+      baseURL: process.env['TEST_API_BASE_URL'] ?? 'http://127.0.0.1:4010',
+      apiKey: 'My API Key',
+      fetch: (...args) => {
+        return new Promise((resolve, reject) =>
+          setTimeout(
+            () =>
+              defaultFetch(...args)
+                .then(resolve)
+                .catch(reject),
+            300,
+          ),
+        );
+      },
+    });
+
+    const controller = new AbortController();
+    setTimeout(() => controller.abort(), 200);
+
+    const spy = jest.spyOn(client, 'request');
+
+    await expect(client.get('/foo', { signal: controller.signal })).rejects.toThrowError(APIUserAbortError);
+    expect(spy).toHaveBeenCalledTimes(1);
+  });
+
+  test('normalized method', async () => {
+    let capturedRequest: RequestInit | undefined;
+    const testFetch = async (url: string | URL | Request, init: RequestInit = {}): Promise<Response> => {
+      capturedRequest = init;
+      return new Response(JSON.stringify({}), { headers: { 'Content-Type': 'application/json' } });
+    };
+
+    const client = new Hypeman({ baseURL: 'http://localhost:5000/', apiKey: 'My API Key', fetch: testFetch });
+
+    await client.patch('/foo');
+    expect(capturedRequest?.method).toEqual('PATCH');
+  });
+
+  describe('baseUrl', () => {
+    test('trailing slash', () => {
+      const client = new Hypeman({ baseURL: 'http://localhost:5000/custom/path/', apiKey: 'My API Key' });
+      expect(client.buildURL('/foo', null)).toEqual('http://localhost:5000/custom/path/foo');
+    });
+
+    test('no trailing slash', () => {
+      const client = new Hypeman({ baseURL: 'http://localhost:5000/custom/path', apiKey: 'My API Key' });
+      expect(client.buildURL('/foo', null)).toEqual('http://localhost:5000/custom/path/foo');
+    });
+
+    afterEach(() => {
+      process.env['HYPEMAN_BASE_URL'] = undefined;
+    });
+
+    test('explicit option', () => {
+      const client = new Hypeman({ baseURL: 'https://example.com', apiKey: 'My API Key' });
+      expect(client.baseURL).toEqual('https://example.com');
+    });
+
+    test('env variable', () => {
+      process.env['HYPEMAN_BASE_URL'] = 'https://example.com/from_env';
+      const client = new Hypeman({ apiKey: 'My API Key' });
+      expect(client.baseURL).toEqual('https://example.com/from_env');
+    });
+
+    test('empty env variable', () => {
+      process.env['HYPEMAN_BASE_URL'] = ''; // empty
+      const client = new Hypeman({ apiKey: 'My API Key' });
+      expect(client.baseURL).toEqual('http://localhost:8080');
+    });
+
+    test('blank env variable', () => {
+      process.env['HYPEMAN_BASE_URL'] = '  '; // blank
+      const client = new Hypeman({ apiKey: 'My API Key' });
+      expect(client.baseURL).toEqual('http://localhost:8080');
+    });
+
+    test('in request options', () => {
+      const client = new Hypeman({ apiKey: 'My API Key' });
+      expect(client.buildURL('/foo', null, 'http://localhost:5000/option')).toEqual(
+        'http://localhost:5000/option/foo',
+      );
+    });
+
+    test('in request options overridden by client options', () => {
+      const client = new Hypeman({ apiKey: 'My API Key', baseURL: 'http://localhost:5000/client' });
+      expect(client.buildURL('/foo', null, 'http://localhost:5000/option')).toEqual(
+        'http://localhost:5000/client/foo',
+      );
+    });
+
+    test('in request options overridden by env variable', () => {
+      process.env['HYPEMAN_BASE_URL'] = 'http://localhost:5000/env';
+      const client = new Hypeman({ apiKey: 'My API Key' });
+      expect(client.buildURL('/foo', null, 'http://localhost:5000/option')).toEqual(
+        'http://localhost:5000/env/foo',
+      );
+    });
+  });
+
+  test('maxRetries option is correctly set', () => {
+    const client = new Hypeman({ maxRetries: 4, apiKey: 'My API Key' });
+    expect(client.maxRetries).toEqual(4);
+
+    // default
+    const client2 = new Hypeman({ apiKey: 'My API Key' });
+    expect(client2.maxRetries).toEqual(2);
+  });
+
+  describe('withOptions', () => {
+    test('creates a new client with overridden options', async () => {
+      const client = new Hypeman({ baseURL: 'http://localhost:5000/', maxRetries: 3, apiKey: 'My API Key' });
+
+      const newClient = client.withOptions({
+        maxRetries: 5,
+        baseURL: 'http://localhost:5001/',
+      });
+
+      // Verify the new client has updated options
+      expect(newClient.maxRetries).toEqual(5);
+      expect(newClient.baseURL).toEqual('http://localhost:5001/');
+
+      // Verify the original client is unchanged
+      expect(client.maxRetries).toEqual(3);
+      expect(client.baseURL).toEqual('http://localhost:5000/');
+
+      // Verify it's a different instance
+      expect(newClient).not.toBe(client);
+      expect(newClient.constructor).toBe(client.constructor);
+    });
+
+    test('inherits options from the parent client', async () => {
+      const client = new Hypeman({
+        baseURL: 'http://localhost:5000/',
+        defaultHeaders: { 'X-Test-Header': 'test-value' },
+        defaultQuery: { 'test-param': 'test-value' },
+        apiKey: 'My API Key',
+      });
+
+      const newClient = client.withOptions({
+        baseURL: 'http://localhost:5001/',
+      });
+
+      // Test inherited options remain the same
+      expect(newClient.buildURL('/foo', null)).toEqual('http://localhost:5001/foo?test-param=test-value');
+
+      const { req } = await newClient.buildRequest({ path: '/foo', method: 'get' });
+      expect(req.headers.get('x-test-header')).toEqual('test-value');
+    });
+
+    test('respects runtime property changes when creating new client', () => {
+      const client = new Hypeman({ baseURL: 'http://localhost:5000/', timeout: 1000, apiKey: 'My API Key' });
+
+      // Modify the client properties directly after creation
+      client.baseURL = 'http://localhost:6000/';
+      client.timeout = 2000;
+
+      // Create a new client with withOptions
+      const newClient = client.withOptions({
+        maxRetries: 10,
+      });
+
+      // Verify the new client uses the updated properties, not the original ones
+      expect(newClient.baseURL).toEqual('http://localhost:6000/');
+      expect(newClient.timeout).toEqual(2000);
+      expect(newClient.maxRetries).toEqual(10);
+
+      // Original client should still have its modified properties
+      expect(client.baseURL).toEqual('http://localhost:6000/');
+      expect(client.timeout).toEqual(2000);
+      expect(client.maxRetries).not.toEqual(10);
+
+      // Verify URL building uses the updated baseURL
+      expect(newClient.buildURL('/bar', null)).toEqual('http://localhost:6000/bar');
+    });
+  });
+
+  test('with environment variable arguments', () => {
+    // set options via env var
+    process.env['HYPEMAN_API_KEY'] = 'My API Key';
+    const client = new Hypeman();
+    expect(client.apiKey).toBe('My API Key');
+  });
+
+  test('with overridden environment variable arguments', () => {
+    // set options via env var
+    process.env['HYPEMAN_API_KEY'] = 'another My API Key';
+    const client = new Hypeman({ apiKey: 'My API Key' });
+    expect(client.apiKey).toBe('My API Key');
+  });
+});
+
+describe('request building', () => {
+  const client = new Hypeman({ apiKey: 'My API Key' });
+
+  describe('custom headers', () => {
+    test('handles undefined', async () => {
+      const { req } = await client.buildRequest({
+        path: '/foo',
+        method: 'post',
+        body: { value: 'hello' },
+        headers: { 'X-Foo': 'baz', 'x-foo': 'bar', 'x-Foo': undefined, 'x-baz': 'bam', 'X-Baz': null },
+      });
+      expect(req.headers.get('x-foo')).toEqual('bar');
+      expect(req.headers.get('x-Foo')).toEqual('bar');
+      expect(req.headers.get('X-Foo')).toEqual('bar');
+      expect(req.headers.get('x-baz')).toEqual(null);
+    });
+  });
+});
+
+describe('default encoder', () => {
+  const client = new Hypeman({ apiKey: 'My API Key' });
+
+  class Serializable {
+    toJSON() {
+      return { $type: 'Serializable' };
+    }
+  }
+  class Collection<T> {
+    #things: T[];
+    constructor(things: T[]) {
+      this.#things = Array.from(things);
+    }
+    toJSON() {
+      return Array.from(this.#things);
+    }
+    [Symbol.iterator]() {
+      return this.#things[Symbol.iterator];
+    }
+  }
+  for (const jsonValue of [{}, [], { __proto__: null }, new Serializable(), new Collection(['item'])]) {
+    test(`serializes ${util.inspect(jsonValue)} as json`, async () => {
+      const { req } = await client.buildRequest({
+        path: '/foo',
+        method: 'post',
+        body: jsonValue,
+      });
+      expect(req.headers).toBeInstanceOf(Headers);
+      expect(req.headers.get('content-type')).toEqual('application/json');
+      expect(req.body).toBe(JSON.stringify(jsonValue));
+    });
+  }
+
+  const encoder = new TextEncoder();
+  const asyncIterable = (async function* () {
+    yield encoder.encode('a\n');
+    yield encoder.encode('b\n');
+    yield encoder.encode('c\n');
+  })();
+  for (const streamValue of [
+    [encoder.encode('a\nb\nc\n')][Symbol.iterator](),
+    new Response('a\nb\nc\n').body,
+    asyncIterable,
+  ]) {
+    test(`converts ${util.inspect(streamValue)} to ReadableStream`, async () => {
+      const { req } = await client.buildRequest({
+        path: '/foo',
+        method: 'post',
+        body: streamValue,
+      });
+      expect(req.headers).toBeInstanceOf(Headers);
+      expect(req.headers.get('content-type')).toEqual(null);
+      expect(req.body).toBeInstanceOf(ReadableStream);
+      expect(await new Response(req.body).text()).toBe('a\nb\nc\n');
+    });
+  }
+
+  test(`can set content-type for ReadableStream`, async () => {
+    const { req } = await client.buildRequest({
+      path: '/foo',
+      method: 'post',
+      body: new Response('a\nb\nc\n').body,
+      headers: { 'Content-Type': 'text/plain' },
+    });
+    expect(req.headers).toBeInstanceOf(Headers);
+    expect(req.headers.get('content-type')).toEqual('text/plain');
+    expect(req.body).toBeInstanceOf(ReadableStream);
+    expect(await new Response(req.body).text()).toBe('a\nb\nc\n');
+  });
+});
+
+describe('retries', () => {
+  test('retry on timeout', async () => {
+    let count = 0;
+    const testFetch = async (
+      url: string | URL | Request,
+      { signal }: RequestInit = {},
+    ): Promise<Response> => {
+      if (count++ === 0) {
+        return new Promise(
+          (resolve, reject) => signal?.addEventListener('abort', () => reject(new Error('timed out'))),
+        );
+      }
+      return new Response(JSON.stringify({ a: 1 }), { headers: { 'Content-Type': 'application/json' } });
+    };
+
+    const client = new Hypeman({ apiKey: 'My API Key', timeout: 10, fetch: testFetch });
+
+    expect(await client.request({ path: '/foo', method: 'get' })).toEqual({ a: 1 });
+    expect(count).toEqual(2);
+    expect(
+      await client
+        .request({ path: '/foo', method: 'get' })
+        .asResponse()
+        .then((r) => r.text()),
+    ).toEqual(JSON.stringify({ a: 1 }));
+    expect(count).toEqual(3);
+  });
+
+  test('retry count header', async () => {
+    let count = 0;
+    let capturedRequest: RequestInit | undefined;
+    const testFetch = async (url: string | URL | Request, init: RequestInit = {}): Promise<Response> => {
+      count++;
+      if (count <= 2) {
+        return new Response(undefined, {
+          status: 429,
+          headers: {
+            'Retry-After': '0.1',
+          },
+        });
+      }
+      capturedRequest = init;
+      return new Response(JSON.stringify({ a: 1 }), { headers: { 'Content-Type': 'application/json' } });
+    };
+
+    const client = new Hypeman({ apiKey: 'My API Key', fetch: testFetch, maxRetries: 4 });
+
+    expect(await client.request({ path: '/foo', method: 'get' })).toEqual({ a: 1 });
+
+    expect((capturedRequest!.headers as Headers).get('x-stainless-retry-count')).toEqual('2');
+    expect(count).toEqual(3);
+  });
+
+  test('omit retry count header', async () => {
+    let count = 0;
+    let capturedRequest: RequestInit | undefined;
+    const testFetch = async (url: string | URL | Request, init: RequestInit = {}): Promise<Response> => {
+      count++;
+      if (count <= 2) {
+        return new Response(undefined, {
+          status: 429,
+          headers: {
+            'Retry-After': '0.1',
+          },
+        });
+      }
+      capturedRequest = init;
+      return new Response(JSON.stringify({ a: 1 }), { headers: { 'Content-Type': 'application/json' } });
+    };
+    const client = new Hypeman({ apiKey: 'My API Key', fetch: testFetch, maxRetries: 4 });
+
+    expect(
+      await client.request({
+        path: '/foo',
+        method: 'get',
+        headers: { 'X-Stainless-Retry-Count': null },
+      }),
+    ).toEqual({ a: 1 });
+
+    expect((capturedRequest!.headers as Headers).has('x-stainless-retry-count')).toBe(false);
+  });
+
+  test('omit retry count header by default', async () => {
+    let count = 0;
+    let capturedRequest: RequestInit | undefined;
+    const testFetch = async (url: string | URL | Request, init: RequestInit = {}): Promise<Response> => {
+      count++;
+      if (count <= 2) {
+        return new Response(undefined, {
+          status: 429,
+          headers: {
+            'Retry-After': '0.1',
+          },
+        });
+      }
+      capturedRequest = init;
+      return new Response(JSON.stringify({ a: 1 }), { headers: { 'Content-Type': 'application/json' } });
+    };
+    const client = new Hypeman({
+      apiKey: 'My API Key',
+      fetch: testFetch,
+      maxRetries: 4,
+      defaultHeaders: { 'X-Stainless-Retry-Count': null },
+    });
+
+    expect(
+      await client.request({
+        path: '/foo',
+        method: 'get',
+      }),
+    ).toEqual({ a: 1 });
+
+    expect(capturedRequest!.headers as Headers).not.toHaveProperty('x-stainless-retry-count');
+  });
+
+  test('overwrite retry count header', async () => {
+    let count = 0;
+    let capturedRequest: RequestInit | undefined;
+    const testFetch = async (url: string | URL | Request, init: RequestInit = {}): Promise<Response> => {
+      count++;
+      if (count <= 2) {
+        return new Response(undefined, {
+          status: 429,
+          headers: {
+            'Retry-After': '0.1',
+          },
+        });
+      }
+      capturedRequest = init;
+      return new Response(JSON.stringify({ a: 1 }), { headers: { 'Content-Type': 'application/json' } });
+    };
+    const client = new Hypeman({ apiKey: 'My API Key', fetch: testFetch, maxRetries: 4 });
+
+    expect(
+      await client.request({
+        path: '/foo',
+        method: 'get',
+        headers: { 'X-Stainless-Retry-Count': '42' },
+      }),
+    ).toEqual({ a: 1 });
+
+    expect((capturedRequest!.headers as Headers).get('x-stainless-retry-count')).toEqual('42');
+  });
+
+  test('retry on 429 with retry-after', async () => {
+    let count = 0;
+    const testFetch = async (
+      url: string | URL | Request,
+      { signal }: RequestInit = {},
+    ): Promise<Response> => {
+      if (count++ === 0) {
+        return new Response(undefined, {
+          status: 429,
+          headers: {
+            'Retry-After': '0.1',
+          },
+        });
+      }
+      return new Response(JSON.stringify({ a: 1 }), { headers: { 'Content-Type': 'application/json' } });
+    };
+
+    const client = new Hypeman({ apiKey: 'My API Key', fetch: testFetch });
+
+    expect(await client.request({ path: '/foo', method: 'get' })).toEqual({ a: 1 });
+    expect(count).toEqual(2);
+    expect(
+      await client
+        .request({ path: '/foo', method: 'get' })
+        .asResponse()
+        .then((r) => r.text()),
+    ).toEqual(JSON.stringify({ a: 1 }));
+    expect(count).toEqual(3);
+  });
+
+  test('retry on 429 with retry-after-ms', async () => {
+    let count = 0;
+    const testFetch = async (
+      url: string | URL | Request,
+      { signal }: RequestInit = {},
+    ): Promise<Response> => {
+      if (count++ === 0) {
+        return new Response(undefined, {
+          status: 429,
+          headers: {
+            'Retry-After-Ms': '10',
+          },
+        });
+      }
+      return new Response(JSON.stringify({ a: 1 }), { headers: { 'Content-Type': 'application/json' } });
+    };
+
+    const client = new Hypeman({ apiKey: 'My API Key', fetch: testFetch });
+
+    expect(await client.request({ path: '/foo', method: 'get' })).toEqual({ a: 1 });
+    expect(count).toEqual(2);
+    expect(
+      await client
+        .request({ path: '/foo', method: 'get' })
+        .asResponse()
+        .then((r) => r.text()),
+    ).toEqual(JSON.stringify({ a: 1 }));
+    expect(count).toEqual(3);
+  });
+});
diff --git a/sdks/ts/tests/internal/decoders/line.test.ts b/sdks/ts/tests/internal/decoders/line.test.ts
new file mode 100644
index 00000000..a4750d3c
--- /dev/null
+++ b/sdks/ts/tests/internal/decoders/line.test.ts
@@ -0,0 +1,128 @@
+import { findDoubleNewlineIndex, LineDecoder } from '@onkernel/hypeman/internal/decoders/line';
+
+function decodeChunks(chunks: string[], { flush }: { flush: boolean } = { flush: false }): string[] {
+  const decoder = new LineDecoder();
+  const lines: string[] = [];
+  for (const chunk of chunks) {
+    lines.push(...decoder.decode(chunk));
+  }
+
+  if (flush) {
+    lines.push(...decoder.flush());
+  }
+
+  return lines;
+}
+
+describe('line decoder', () => {
+  test('basic', () => {
+    // baz is not included because the line hasn't ended yet
+    expect(decodeChunks(['foo', ' bar\nbaz'])).toEqual(['foo bar']);
+  });
+
+  test('basic with \\r', () => {
+    expect(decodeChunks(['foo', ' bar\r\nbaz'])).toEqual(['foo bar']);
+    expect(decodeChunks(['foo', ' bar\r\nbaz'], { flush: true })).toEqual(['foo bar', 'baz']);
+  });
+
+  test('trailing new lines', () => {
+    expect(decodeChunks(['foo', ' bar', 'baz\n', 'thing\n'])).toEqual(['foo barbaz', 'thing']);
+  });
+
+  test('trailing new lines with \\r', () => {
+    expect(decodeChunks(['foo', ' bar', 'baz\r\n', 'thing\r\n'])).toEqual(['foo barbaz', 'thing']);
+  });
+
+  test('escaped new lines', () => {
+    expect(decodeChunks(['foo', ' bar\\nbaz\n'])).toEqual(['foo bar\\nbaz']);
+  });
+
+  test('escaped new lines with \\r', () => {
+    expect(decodeChunks(['foo', ' bar\\r\\nbaz\n'])).toEqual(['foo bar\\r\\nbaz']);
+  });
+
+  test('\\r & \\n split across multiple chunks', () => {
+    expect(decodeChunks(['foo\r', '\n', 'bar'], { flush: true })).toEqual(['foo', 'bar']);
+  });
+
+  test('single \\r', () => {
+    expect(decodeChunks(['foo\r', 'bar'], { flush: true })).toEqual(['foo', 'bar']);
+  });
+
+  test('double \\r', () => {
+    expect(decodeChunks(['foo\r', 'bar\r'], { flush: true })).toEqual(['foo', 'bar']);
+    expect(decodeChunks(['foo\r', '\r', 'bar'], { flush: true })).toEqual(['foo', '', 'bar']);
+    // implementation detail that we don't yield the single \r line until a new \r or \n is encountered
+    expect(decodeChunks(['foo\r', '\r', 'bar'], { flush: false })).toEqual(['foo']);
+  });
+
+  test('double \\r then \\r\\n', () => {
+    expect(decodeChunks(['foo\r', '\r', '\r', '\n', 'bar', '\n'])).toEqual(['foo', '', '', 'bar']);
+    expect(decodeChunks(['foo\n', '\n', '\n', 'bar', '\n'])).toEqual(['foo', '', '', 'bar']);
+  });
+
+  test('double newline', () => {
+    expect(decodeChunks(['foo\n\nbar'], { flush: true })).toEqual(['foo', '', 'bar']);
+    expect(decodeChunks(['foo', '\n', '\nbar'], { flush: true })).toEqual(['foo', '', 'bar']);
+    expect(decodeChunks(['foo\n', '\n', 'bar'], { flush: true })).toEqual(['foo', '', 'bar']);
+    expect(decodeChunks(['foo', '\n', '\n', 'bar'], { flush: true })).toEqual(['foo', '', 'bar']);
+  });
+
+  test('multi-byte characters across chunks', () => {
+    const decoder = new LineDecoder();
+
+    // bytes taken from the string 'известни' and arbitrarily split
+    // so that some multi-byte characters span multiple chunks
+    expect(decoder.decode(new Uint8Array([0xd0]))).toHaveLength(0);
+    expect(decoder.decode(new Uint8Array([0xb8, 0xd0, 0xb7, 0xd0]))).toHaveLength(0);
+    expect(
+      decoder.decode(new Uint8Array([0xb2, 0xd0, 0xb5, 0xd1, 0x81, 0xd1, 0x82, 0xd0, 0xbd, 0xd0, 0xb8])),
+    ).toHaveLength(0);
+
+    const decoded = decoder.decode(new Uint8Array([0xa]));
+    expect(decoded).toEqual(['известни']);
+  });
+
+  test('flushing trailing newlines', () => {
+    expect(decodeChunks(['foo\n', '\nbar'], { flush: true })).toEqual(['foo', '', 'bar']);
+  });
+
+  test('flushing empty buffer', () => {
+    expect(decodeChunks([], { flush: true })).toEqual([]);
+  });
+});
+
+describe('findDoubleNewlineIndex', () => {
+  test('finds \\n\\n', () => {
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('foo\n\nbar'))).toBe(5);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('\n\nbar'))).toBe(2);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('foo\n\n'))).toBe(5);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('\n\n'))).toBe(2);
+  });
+
+  test('finds \\r\\r', () => {
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('foo\r\rbar'))).toBe(5);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('\r\rbar'))).toBe(2);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('foo\r\r'))).toBe(5);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('\r\r'))).toBe(2);
+  });
+
+  test('finds \\r\\n\\r\\n', () => {
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('foo\r\n\r\nbar'))).toBe(7);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('\r\n\r\nbar'))).toBe(4);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('foo\r\n\r\n'))).toBe(7);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('\r\n\r\n'))).toBe(4);
+  });
+
+  test('returns -1 when no double newline found', () => {
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('foo\nbar'))).toBe(-1);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('foo\rbar'))).toBe(-1);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('foo\r\nbar'))).toBe(-1);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode(''))).toBe(-1);
+  });
+
+  test('handles incomplete patterns', () => {
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('foo\r\n\r'))).toBe(-1);
+    expect(findDoubleNewlineIndex(new TextEncoder().encode('foo\r\n'))).toBe(-1);
+  });
+});
diff --git a/sdks/ts/tests/path.test.ts b/sdks/ts/tests/path.test.ts
new file mode 100644
index 00000000..dc7c6a4d
--- /dev/null
+++ b/sdks/ts/tests/path.test.ts
@@ -0,0 +1,462 @@
+import { createPathTagFunction, encodeURIPath } from '@onkernel/hypeman/internal/utils/path';
+import { inspect } from 'node:util';
+import { runInNewContext } from 'node:vm';
+
+describe('path template tag function', () => {
+  test('validates input', () => {
+    const testParams = ['', '.', '..', 'x', '%2e', '%2E', '%2e%2e', '%2E%2e', '%2e%2E', '%2E%2E'];
+    const testCases = [
+      ['/path_params/', '/a'],
+      ['/path_params/', '/'],
+      ['/path_params/', ''],
+      ['', '/a'],
+      ['', '/'],
+      ['', ''],
+      ['a'],
+      [''],
+      ['/path_params/', ':initiate'],
+      ['/path_params/', '.json'],
+      ['/path_params/', '?beta=true'],
+      ['/path_params/', '.?beta=true'],
+      ['/path_params/', '/', '/download'],
+      ['/path_params/', '-', '/download'],
+      ['/path_params/', '', '/download'],
+      ['/path_params/', '.', '/download'],
+      ['/path_params/', '..', '/download'],
+      ['/plain/path'],
+    ];
+
+    function paramPermutations(len: number): string[][] {
+      if (len === 0) return [];
+      if (len === 1) return testParams.map((e) => [e]);
+      const rest = paramPermutations(len - 1);
+      return testParams.flatMap((e) => rest.map((r) => [e, ...r]));
+    }
+
+    // We need to test how %2E is handled, so we use a custom encoder that does no escaping.
+    const rawPath = createPathTagFunction((s) => s);
+
+    const emptyObject = {};
+    const mathObject = Math;
+    const numberObject = new Number();
+    const stringObject = new String();
+    const basicClass = new (class {})();
+    const classWithToString = new (class {
+      toString() {
+        return 'ok';
+      }
+    })();
+
+    // Invalid values
+    expect(() => rawPath`/a/${null}/b`).toThrow(
+      'Path parameters result in path with invalid segments:\n' +
+        'Value of type Null is not a valid path parameter\n' +
+        '/a/null/b\n' +
+        '   ^^^^',
+    );
+    expect(() => rawPath`/a/${undefined}/b`).toThrow(
+      'Path parameters result in path with invalid segments:\n' +
+        'Value of type Undefined is not a valid path parameter\n' +
+        '/a/undefined/b\n' +
+        '   ^^^^^^^^^',
+    );
+    expect(() => rawPath`/a/${emptyObject}/b`).toThrow(
+      'Path parameters result in path with invalid segments:\n' +
+        'Value of type Object is not a valid path parameter\n' +
+        '/a/[object Object]/b\n' +
+        '   ^^^^^^^^^^^^^^^',
+    );
+    expect(() => rawPath`?${mathObject}`).toThrow(
+      'Path parameters result in path with invalid segments:\n' +
+        'Value of type Math is not a valid path parameter\n' +
+        '?[object Math]\n' +
+        ' ^^^^^^^^^^^^^',
+    );
+    expect(() => rawPath`/${basicClass}`).toThrow(
+      'Path parameters result in path with invalid segments:\n' +
+        'Value of type Object is not a valid path parameter\n' +
+        '/[object Object]\n' +
+        ' ^^^^^^^^^^^^^^',
+    );
+    expect(() => rawPath`/../${''}`).toThrow(
+      'Path parameters result in path with invalid segments:\n' +
+        'Value ".." can\'t be safely passed as a path parameter\n' +
+        '/../\n' +
+        ' ^^',
+    );
+    expect(() => rawPath`/../${{}}`).toThrow(
+      'Path parameters result in path with invalid segments:\n' +
+        'Value ".." can\'t be safely passed as a path parameter\n' +
+        'Value of type Object is not a valid path parameter\n' +
+        '/../[object Object]\n' +
+        ' ^^ ^^^^^^^^^^^^^^',
+    );
+
+    // Valid values
+    expect(rawPath`/${0}`).toBe('/0');
+    expect(rawPath`/${''}`).toBe('/');
+    expect(rawPath`/${numberObject}`).toBe('/0');
+    expect(rawPath`${stringObject}/`).toBe('/');
+    expect(rawPath`/${classWithToString}`).toBe('/ok');
+
+    // We need to check what happens with cross-realm values, which we might get from
+    // Jest or other frames in a browser.
+
+    const newRealm = runInNewContext('globalThis');
+    expect(newRealm.Object).not.toBe(Object);
+
+    const crossRealmObject = newRealm.Object();
+    const crossRealmMathObject = newRealm.Math;
+    const crossRealmNumber = new newRealm.Number();
+    const crossRealmString = new newRealm.String();
+    const crossRealmClass = new (class extends newRealm.Object {})();
+    const crossRealmClassWithToString = new (class extends newRealm.Object {
+      toString() {
+        return 'ok';
+      }
+    })();
+
+    // Invalid cross-realm values
+    expect(() => rawPath`/a/${crossRealmObject}/b`).toThrow(
+      'Path parameters result in path with invalid segments:\n' +
+        'Value of type Object is not a valid path parameter\n' +
+        '/a/[object Object]/b\n' +
+        '   ^^^^^^^^^^^^^^^',
+    );
+    expect(() => rawPath`?${crossRealmMathObject}`).toThrow(
+      'Path parameters result in path with invalid segments:\n' +
+        'Value of type Math is not a valid path parameter\n' +
+        '?[object Math]\n' +
+        ' ^^^^^^^^^^^^^',
+    );
+    expect(() => rawPath`/${crossRealmClass}`).toThrow(
+      'Path parameters result in path with invalid segments:\n' +
+        'Value of type Object is not a valid path parameter\n' +
+        '/[object Object]\n' +
+        ' ^^^^^^^^^^^^^^^',
+    );
+
+    // Valid cross-realm values
+    expect(rawPath`/${crossRealmNumber}`).toBe('/0');
+    expect(rawPath`${crossRealmString}/`).toBe('/');
+    expect(rawPath`/${crossRealmClassWithToString}`).toBe('/ok');
+
+    const results: {
+      [pathParts: string]: {
+        [params: string]: { valid: boolean; result?: string; error?: string };
+      };
+    } = {};
+
+    for (const pathParts of testCases) {
+      const pathResults: Record<string, { valid: boolean; result?: string; error?: string }> = {};
+      results[JSON.stringify(pathParts)] = pathResults;
+      for (const params of paramPermutations(pathParts.length - 1)) {
+        const stringRaw = String.raw({ raw: pathParts }, ...params);
+        const plainString = String.raw(
+          { raw: pathParts.map((e) => e.replace(/\./g, 'x')) },
+          ...params.map((e) => 'X'.repeat(e.length)),
+        );
+        const normalizedStringRaw = new URL(stringRaw, 'https://example.com').href;
+        const normalizedPlainString = new URL(plainString, 'https://example.com').href;
+        const pathResultsKey = JSON.stringify(params);
+        try {
+          const result = rawPath(pathParts, ...params);
+          expect(result).toBe(stringRaw);
+          // there are no special segments, so the length of the normalized path is
+          // equal to the length of the normalized plain path.
+          expect(normalizedStringRaw.length).toBe(normalizedPlainString.length);
+          pathResults[pathResultsKey] = {
+            valid: true,
+            result,
+          };
+        } catch (e) {
+          const error = String(e);
+          expect(error).toMatch(/Path parameters result in path with invalid segment/);
+          // there are special segments, so the length of the normalized path is
+          // different than the length of the normalized plain path.
+          expect(normalizedStringRaw.length).not.toBe(normalizedPlainString.length);
+          pathResults[pathResultsKey] = {
+            valid: false,
+            error,
+          };
+        }
+      }
+    }
+
+    expect(results).toMatchObject({
+      '["/path_params/","/a"]': {
+        '["x"]': { valid: true, result: '/path_params/x/a' },
+        '[""]': { valid: true, result: '/path_params//a' },
+        '["%2E%2e"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2E%2e" can\'t be safely passed as a path parameter\n' +
+            '/path_params/%2E%2e/a\n' +
+            '             ^^^^^^',
+        },
+        '["%2E"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2E" can\'t be safely passed as a path parameter\n' +
+            '/path_params/%2E/a\n' +
+            '             ^^^',
+        },
+      },
+      '["/path_params/","/"]': {
+        '["x"]': { valid: true, result: '/path_params/x/' },
+        '[""]': { valid: true, result: '/path_params//' },
+        '["%2e%2E"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2e%2E" can\'t be safely passed as a path parameter\n' +
+            '/path_params/%2e%2E/\n' +
+            '             ^^^^^^',
+        },
+        '["%2e"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2e" can\'t be safely passed as a path parameter\n' +
+            '/path_params/%2e/\n' +
+            '             ^^^',
+        },
+      },
+      '["/path_params/",""]': {
+        '[""]': { valid: true, result: '/path_params/' },
+        '["x"]': { valid: true, result: '/path_params/x' },
+        '["%2E"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2E" can\'t be safely passed as a path parameter\n' +
+            '/path_params/%2E\n' +
+            '             ^^^',
+        },
+        '["%2E%2e"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2E%2e" can\'t be safely passed as a path parameter\n' +
+            '/path_params/%2E%2e\n' +
+            '             ^^^^^^',
+        },
+      },
+      '["","/a"]': {
+        '[""]': { valid: true, result: '/a' },
+        '["x"]': { valid: true, result: 'x/a' },
+        '["%2E"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2E" can\'t be safely passed as a path parameter\n%2E/a\n^^^',
+        },
+        '["%2e%2E"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2e%2E" can\'t be safely passed as a path parameter\n' +
+            '%2e%2E/a\n' +
+            '^^^^^^',
+        },
+      },
+      '["","/"]': {
+        '["x"]': { valid: true, result: 'x/' },
+        '[""]': { valid: true, result: '/' },
+        '["%2E%2e"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2E%2e" can\'t be safely passed as a path parameter\n' +
+            '%2E%2e/\n' +
+            '^^^^^^',
+        },
+        '["."]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "." can\'t be safely passed as a path parameter\n' +
+            './\n^',
+        },
+      },
+      '["",""]': {
+        '[""]': { valid: true, result: '' },
+        '["x"]': { valid: true, result: 'x' },
+        '[".."]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value ".." can\'t be safely passed as a path parameter\n' +
+            '..\n^^',
+        },
+        '["."]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "." can\'t be safely passed as a path parameter\n' +
+            '.\n^',
+        },
+      },
+      '["a"]': {},
+      '[""]': {},
+      '["/path_params/",":initiate"]': {
+        '[""]': { valid: true, result: '/path_params/:initiate' },
+        '["."]': { valid: true, result: '/path_params/.:initiate' },
+      },
+      '["/path_params/",".json"]': {
+        '["x"]': { valid: true, result: '/path_params/x.json' },
+        '["."]': { valid: true, result: '/path_params/..json' },
+      },
+      '["/path_params/","?beta=true"]': {
+        '["x"]': { valid: true, result: '/path_params/x?beta=true' },
+        '[""]': { valid: true, result: '/path_params/?beta=true' },
+        '["%2E%2E"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2E%2E" can\'t be safely passed as a path parameter\n' +
+            '/path_params/%2E%2E?beta=true\n' +
+            '             ^^^^^^',
+        },
+        '["%2e%2E"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2e%2E" can\'t be safely passed as a path parameter\n' +
+            '/path_params/%2e%2E?beta=true\n' +
+            '             ^^^^^^',
+        },
+      },
+      '["/path_params/",".?beta=true"]': {
+        '[".."]': { valid: true, result: '/path_params/...?beta=true' },
+        '["x"]': { valid: true, result: '/path_params/x.?beta=true' },
+        '[""]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "." can\'t be safely passed as a path parameter\n' +
+            '/path_params/.?beta=true\n' +
+            '             ^',
+        },
+        '["%2e"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2e." can\'t be safely passed as a path parameter\n' +
+            '/path_params/%2e.?beta=true\n' +
+            '             ^^^^',
+        },
+      },
+      '["/path_params/","/","/download"]': {
+        '["",""]': { valid: true, result: '/path_params///download' },
+        '["","x"]': { valid: true, result: '/path_params//x/download' },
+        '[".","%2e"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "." can\'t be safely passed as a path parameter\n' +
+            'Value "%2e" can\'t be safely passed as a path parameter\n' +
+            '/path_params/./%2e/download\n' +
+            '             ^ ^^^',
+        },
+        '["%2E%2e","%2e"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2E%2e" can\'t be safely passed as a path parameter\n' +
+            'Value "%2e" can\'t be safely passed as a path parameter\n' +
+            '/path_params/%2E%2e/%2e/download\n' +
+            '             ^^^^^^ ^^^',
+        },
+      },
+      '["/path_params/","-","/download"]': {
+        '["","%2e"]': { valid: true, result: '/path_params/-%2e/download' },
+        '["%2E",".."]': { valid: true, result: '/path_params/%2E-../download' },
+      },
+      '["/path_params/","","/download"]': {
+        '["%2E%2e","%2e%2E"]': { valid: true, result: '/path_params/%2E%2e%2e%2E/download' },
+        '["%2E",".."]': { valid: true, result: '/path_params/%2E../download' },
+        '["","%2E"]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2E" can\'t be safely passed as a path parameter\n' +
+            '/path_params/%2E/download\n' +
+            '             ^^^',
+        },
+        '["%2E","."]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "%2E." can\'t be safely passed as a path parameter\n' +
+            '/path_params/%2E./download\n' +
+            '             ^^^^',
+        },
+      },
+      '["/path_params/",".","/download"]': {
+        '["%2e%2e",""]': { valid: true, result: '/path_params/%2e%2e./download' },
+        '["","%2e%2e"]': { valid: true, result: '/path_params/.%2e%2e/download' },
+        '["",""]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value "." can\'t be safely passed as a path parameter\n' +
+            '/path_params/./download\n' +
+            '             ^',
+        },
+        '["","."]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value ".." can\'t be safely passed as a path parameter\n' +
+            '/path_params/../download\n' +
+            '             ^^',
+        },
+      },
+      '["/path_params/","..","/download"]': {
+        '["","%2E"]': { valid: true, result: '/path_params/..%2E/download' },
+        '["","x"]': { valid: true, result: '/path_params/..x/download' },
+        '["",""]': {
+          valid: false,
+          error:
+            'Error: Path parameters result in path with invalid segments:\n' +
+            'Value ".." can\'t be safely passed as a path parameter\n' +
+            '/path_params/../download\n' +
+            '             ^^',
+        },
+      },
+    });
+  });
+});
+
+describe('encodeURIPath', () => {
+  const testCases: string[] = [
+    '',
+    // Every ASCII character
+    ...Array.from({ length: 0x7f }, (_, i) => String.fromCharCode(i)),
+    // Unicode BMP codepoint
+    'å',
+    // Unicode supplementary codepoint
+    '😃',
+  ];
+
+  for (const param of testCases) {
+    test('properly encodes ' + inspect(param), () => {
+      const encoded = encodeURIPath(param);
+      const naiveEncoded = encodeURIComponent(param);
+      // we should never encode more characters than encodeURIComponent
+      expect(naiveEncoded.length).toBeGreaterThanOrEqual(encoded.length);
+      expect(decodeURIComponent(encoded)).toBe(param);
+    });
+  }
+
+  test("leaves ':' intact", () => {
+    expect(encodeURIPath(':')).toBe(':');
+  });
+
+  test("leaves '@' intact", () => {
+    expect(encodeURIPath('@')).toBe('@');
+  });
+});
diff --git a/sdks/ts/tests/streaming.test.ts b/sdks/ts/tests/streaming.test.ts
new file mode 100644
index 00000000..e0da3e91
--- /dev/null
+++ b/sdks/ts/tests/streaming.test.ts
@@ -0,0 +1,219 @@
+import assert from 'assert';
+import { _iterSSEMessages } from '@onkernel/hypeman/core/streaming';
+import { ReadableStreamFrom } from '@onkernel/hypeman/internal/shims';
+
+describe('streaming decoding', () => {
+  test('basic', async () => {
+    async function* body(): AsyncGenerator<Buffer> {
+      yield Buffer.from('event: completion\n');
+      yield Buffer.from('data: {"foo":true}\n');
+      yield Buffer.from('\n');
+    }
+
+    const stream = _iterSSEMessages(new Response(ReadableStreamFrom(body())), new AbortController())[
+      Symbol.asyncIterator
+    ]();
+
+    let event = await stream.next();
+    assert(event.value);
+    expect(JSON.parse(event.value.data)).toEqual({ foo: true });
+
+    event = await stream.next();
+    expect(event.done).toBeTruthy();
+  });
+
+  test('data without event', async () => {
+    async function* body(): AsyncGenerator<Buffer> {
+      yield Buffer.from('data: {"foo":true}\n');
+      yield Buffer.from('\n');
+    }
+
+    const stream = _iterSSEMessages(new Response(ReadableStreamFrom(body())), new AbortController())[
+      Symbol.asyncIterator
+    ]();
+
+    let event = await stream.next();
+    assert(event.value);
+    expect(event.value.event).toBeNull();
+    expect(JSON.parse(event.value.data)).toEqual({ foo: true });
+
+    event = await stream.next();
+    expect(event.done).toBeTruthy();
+  });
+
+  test('event without data', async () => {
+    async function* body(): AsyncGenerator<Buffer> {
+      yield Buffer.from('event: foo\n');
+      yield Buffer.from('\n');
+    }
+
+    const stream = _iterSSEMessages(new Response(ReadableStreamFrom(body())), new AbortController())[
+      Symbol.asyncIterator
+    ]();
+
+    let event = await stream.next();
+    assert(event.value);
+    expect(event.value.event).toEqual('foo');
+    expect(event.value.data).toEqual('');
+
+    event = await stream.next();
+    expect(event.done).toBeTruthy();
+  });
+
+  test('multiple events', async () => {
+    async function* body(): AsyncGenerator<Buffer> {
+      yield Buffer.from('event: foo\n');
+      yield Buffer.from('\n');
+      yield Buffer.from('event: ping\n');
+      yield Buffer.from('\n');
+    }
+
+    const stream = _iterSSEMessages(new Response(ReadableStreamFrom(body())), new AbortController())[
+      Symbol.asyncIterator
+    ]();
+
+    let event = await stream.next();
+    assert(event.value);
+    expect(event.value.event).toEqual('foo');
+    expect(event.value.data).toEqual('');
+
+    event = await stream.next();
+    assert(event.value);
+    expect(event.value.event).toEqual('ping');
+    expect(event.value.data).toEqual('');
+
+    event = await stream.next();
+    expect(event.done).toBeTruthy();
+  });
+
+  test('multiple events with data', async () => {
+    async function* body(): AsyncGenerator<Buffer> {
+      yield Buffer.from('event: foo\n');
+      yield Buffer.from('data: {"foo":true}\n');
+      yield Buffer.from('\n');
+      yield Buffer.from('event: ping\n');
+      yield Buffer.from('data: {"bar":false}\n');
+      yield Buffer.from('\n');
+    }
+
+    const stream = _iterSSEMessages(new Response(ReadableStreamFrom(body())), new AbortController())[
+      Symbol.asyncIterator
+    ]();
+
+    let event = await stream.next();
+    assert(event.value);
+    expect(event.value.event).toEqual('foo');
+    expect(JSON.parse(event.value.data)).toEqual({ foo: true });
+
+    event = await stream.next();
+    assert(event.value);
+    expect(event.value.event).toEqual('ping');
+    expect(JSON.parse(event.value.data)).toEqual({ bar: false });
+
+    event = await stream.next();
+    expect(event.done).toBeTruthy();
+  });
+
+  test('multiple data lines with empty line', async () => {
+    async function* body(): AsyncGenerator<Buffer> {
+      yield Buffer.from('event: ping\n');
+      yield Buffer.from('data: {\n');
+      yield Buffer.from('data: "foo":\n');
+      yield Buffer.from('data: \n');
+      yield Buffer.from('data:\n');
+      yield Buffer.from('data: true}\n');
+      yield Buffer.from('\n\n');
+    }
+
+    const stream = _iterSSEMessages(new Response(ReadableStreamFrom(body())), new AbortController())[
+      Symbol.asyncIterator
+    ]();
+
+    let event = await stream.next();
+    assert(event.value);
+    expect(event.value.event).toEqual('ping');
+    expect(JSON.parse(event.value.data)).toEqual({ foo: true });
+    expect(event.value.data).toEqual('{\n"foo":\n\n\ntrue}');
+
+    event = await stream.next();
+    expect(event.done).toBeTruthy();
+  });
+
+  test('data json escaped double new line', async () => {
+    async function* body(): AsyncGenerator<Buffer> {
+      yield Buffer.from('event: ping\n');
+      yield Buffer.from('data: {"foo": "my long\\n\\ncontent"}');
+      yield Buffer.from('\n\n');
+    }
+
+    const stream = _iterSSEMessages(new Response(ReadableStreamFrom(body())), new AbortController())[
+      Symbol.asyncIterator
+    ]();
+
+    let event = await stream.next();
+    assert(event.value);
+    expect(event.value.event).toEqual('ping');
+    expect(JSON.parse(event.value.data)).toEqual({ foo: 'my long\n\ncontent' });
+
+    event = await stream.next();
+    expect(event.done).toBeTruthy();
+  });
+
+  test('special new line characters', async () => {
+    async function* body(): AsyncGenerator<Buffer> {
+      yield Buffer.from('data: {"content": "culpa "}\n');
+      yield Buffer.from('\n');
+      yield Buffer.from('data: {"content": "');
+      yield Buffer.from([0xe2, 0x80, 0xa8]);
+      yield Buffer.from('"}\n');
+      yield Buffer.from('\n');
+      yield Buffer.from('data: {"content": "foo"}\n');
+      yield Buffer.from('\n');
+    }
+
+    const stream = _iterSSEMessages(new Response(ReadableStreamFrom(body())), new AbortController())[
+      Symbol.asyncIterator
+    ]();
+
+    let event = await stream.next();
+    assert(event.value);
+    expect(JSON.parse(event.value.data)).toEqual({ content: 'culpa ' });
+
+    event = await stream.next();
+    assert(event.value);
+    expect(JSON.parse(event.value.data)).toEqual({ content: Buffer.from([0xe2, 0x80, 0xa8]).toString() });
+
+    event = await stream.next();
+    assert(event.value);
+    expect(JSON.parse(event.value.data)).toEqual({ content: 'foo' });
+
+    event = await stream.next();
+    expect(event.done).toBeTruthy();
+  });
+
+  test('multi-byte characters across chunks', async () => {
+    async function* body(): AsyncGenerator<Buffer> {
+      yield Buffer.from('event: completion\n');
+      yield Buffer.from('data: {"content": "');
+      // bytes taken from the string 'известни' and arbitrarily split
+      // so that some multi-byte characters span multiple chunks
+      yield Buffer.from([0xd0]);
+      yield Buffer.from([0xb8, 0xd0, 0xb7, 0xd0]);
+      yield Buffer.from([0xb2, 0xd0, 0xb5, 0xd1, 0x81, 0xd1, 0x82, 0xd0, 0xbd, 0xd0, 0xb8]);
+      yield Buffer.from('"}\n');
+      yield Buffer.from('\n');
+    }
+
+    const stream = _iterSSEMessages(new Response(ReadableStreamFrom(body())), new AbortController())[
+      Symbol.asyncIterator
+    ]();
+
+    let event = await stream.next();
+    assert(event.value);
+    expect(event.value.event).toEqual('completion');
+    expect(JSON.parse(event.value.data)).toEqual({ content: 'известни' });
+
+    event = await stream.next();
+    expect(event.done).toBeTruthy();
+  });
+});
diff --git a/sdks/ts/tests/stringifyQuery.test.ts b/sdks/ts/tests/stringifyQuery.test.ts
new file mode 100644
index 00000000..b74ddb0a
--- /dev/null
+++ b/sdks/ts/tests/stringifyQuery.test.ts
@@ -0,0 +1,29 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { Hypeman } from '@onkernel/hypeman';
+
+const { stringifyQuery } = Hypeman.prototype as any;
+
+describe(stringifyQuery, () => {
+  for (const [input, expected] of [
+    [{ a: '1', b: 2, c: true }, 'a=1&b=2&c=true'],
+    [{ a: null, b: false, c: undefined }, 'a=&b=false'],
+    [{ 'a/b': 1.28341 }, `${encodeURIComponent('a/b')}=1.28341`],
+    [
+      { 'a/b': 'c/d', 'e=f': 'g&h' },
+      `${encodeURIComponent('a/b')}=${encodeURIComponent('c/d')}&${encodeURIComponent(
+        'e=f',
+      )}=${encodeURIComponent('g&h')}`,
+    ],
+  ]) {
+    it(`${JSON.stringify(input)} -> ${expected}`, () => {
+      expect(stringifyQuery(input)).toEqual(expected);
+    });
+  }
+
+  for (const value of [[], {}, new Date()]) {
+    it(`${JSON.stringify(value)} -> <error>`, () => {
+      expect(() => stringifyQuery({ value })).toThrow(`Cannot stringify type ${typeof value}`);
+    });
+  }
+});
diff --git a/sdks/ts/tests/uploads.test.ts b/sdks/ts/tests/uploads.test.ts
new file mode 100644
index 00000000..b403e027
--- /dev/null
+++ b/sdks/ts/tests/uploads.test.ts
@@ -0,0 +1,107 @@
+import fs from 'fs';
+import type { ResponseLike } from '@onkernel/hypeman/internal/to-file';
+import { toFile } from '@onkernel/hypeman/core/uploads';
+import { File } from 'node:buffer';
+
+class MyClass {
+  name: string = 'foo';
+}
+
+function mockResponse({ url, content }: { url: string; content?: Blob }): ResponseLike {
+  return {
+    url,
+    blob: async () => content || new Blob([]),
+  };
+}
+
+describe('toFile', () => {
+  it('throws a helpful error for mismatched types', async () => {
+    await expect(
+      // @ts-expect-error intentionally mismatched type
+      toFile({ foo: 'string' }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `"Unexpected data type: object; constructor: Object; props: ["foo"]"`,
+    );
+
+    await expect(
+      // @ts-expect-error intentionally mismatched type
+      toFile(new MyClass()),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `"Unexpected data type: object; constructor: MyClass; props: ["name"]"`,
+    );
+  });
+
+  it('disallows string at the type-level', async () => {
+    // @ts-expect-error we intentionally do not type support for `string`
+    // to help people avoid passing a file path
+    const file = await toFile('contents');
+    expect(file.text()).resolves.toEqual('contents');
+  });
+
+  it('extracts a file name from a Response', async () => {
+    const response = mockResponse({ url: 'https://example.com/my/audio.mp3' });
+    const file = await toFile(response);
+    expect(file.name).toEqual('audio.mp3');
+  });
+
+  it('extracts a file name from a File', async () => {
+    const input = new File(['foo'], 'input.jsonl');
+    const file = await toFile(input);
+    expect(file.name).toEqual('input.jsonl');
+  });
+
+  it('extracts a file name from a ReadStream', async () => {
+    const input = fs.createReadStream('tests/uploads.test.ts');
+    const file = await toFile(input);
+    expect(file.name).toEqual('uploads.test.ts');
+  });
+
+  it('does not copy File objects', async () => {
+    const input = new File(['foo'], 'input.jsonl', { type: 'jsonl' });
+    const file = await toFile(input);
+    expect(file).toBe(input);
+    expect(file.name).toEqual('input.jsonl');
+    expect(file.type).toBe('jsonl');
+  });
+
+  it('is assignable to File and Blob', async () => {
+    const input = new File(['foo'], 'input.jsonl', { type: 'jsonl' });
+    const result = await toFile(input);
+    const file: File = result;
+    const blob: Blob = result;
+    void file, blob;
+  });
+});
+
+describe('missing File error message', () => {
+  let prevGlobalFile: unknown;
+  let prevNodeFile: unknown;
+  beforeEach(() => {
+    // The file shim captures the global File object when it's first imported.
+    // Reset modules before each test so we can test the error thrown when it's undefined.
+    jest.resetModules();
+    const buffer = require('node:buffer');
+    // @ts-ignore
+    prevGlobalFile = globalThis.File;
+    prevNodeFile = buffer.File;
+    // @ts-ignore
+    globalThis.File = undefined;
+    buffer.File = undefined;
+  });
+  afterEach(() => {
+    // Clean up
+    // @ts-ignore
+    globalThis.File = prevGlobalFile;
+    require('node:buffer').File = prevNodeFile;
+    jest.resetModules();
+  });
+
+  test('is thrown', async () => {
+    const uploads = await import('@onkernel/hypeman/core/uploads');
+    await expect(
+      uploads.toFile(mockResponse({ url: 'https://example.com/my/audio.mp3' })),
+    ).rejects.toMatchInlineSnapshot(
+      `[Error: \`File\` is not defined as a global, which is required for file uploads.]`,
+    );
+  });
+});
diff --git a/sdks/ts/tsc-multi.json b/sdks/ts/tsc-multi.json
new file mode 100644
index 00000000..384ddac5
--- /dev/null
+++ b/sdks/ts/tsc-multi.json
@@ -0,0 +1,15 @@
+{
+  "targets": [
+    {
+      "extname": ".js",
+      "module": "commonjs",
+      "shareHelpers": "internal/tslib.js"
+    },
+    {
+      "extname": ".mjs",
+      "module": "esnext",
+      "shareHelpers": "internal/tslib.mjs"
+    }
+  ],
+  "projects": ["tsconfig.build.json"]
+}
diff --git a/sdks/ts/tsconfig.build.json b/sdks/ts/tsconfig.build.json
new file mode 100644
index 00000000..fc237302
--- /dev/null
+++ b/sdks/ts/tsconfig.build.json
@@ -0,0 +1,18 @@
+{
+  "extends": "./tsconfig.json",
+  "include": ["dist/src"],
+  "exclude": [],
+  "compilerOptions": {
+    "rootDir": "./dist/src",
+    "paths": {
+      "@onkernel/hypeman/*": ["./dist/src/*"],
+      "@onkernel/hypeman": ["./dist/src/index.ts"]
+    },
+    "noEmit": false,
+    "declaration": true,
+    "declarationMap": true,
+    "outDir": "dist",
+    "pretty": true,
+    "sourceMap": true
+  }
+}
diff --git a/sdks/ts/tsconfig.deno.json b/sdks/ts/tsconfig.deno.json
new file mode 100644
index 00000000..849e070d
--- /dev/null
+++ b/sdks/ts/tsconfig.deno.json
@@ -0,0 +1,15 @@
+{
+  "extends": "./tsconfig.json",
+  "include": ["dist-deno"],
+  "exclude": [],
+  "compilerOptions": {
+    "rootDir": "./dist-deno",
+    "lib": ["es2020", "DOM"],
+    "noEmit": true,
+    "declaration": true,
+    "declarationMap": true,
+    "outDir": "dist-deno",
+    "pretty": true,
+    "sourceMap": true
+  }
+}
diff --git a/sdks/ts/tsconfig.dist-src.json b/sdks/ts/tsconfig.dist-src.json
new file mode 100644
index 00000000..c550e299
--- /dev/null
+++ b/sdks/ts/tsconfig.dist-src.json
@@ -0,0 +1,11 @@
+{
+  // this config is included in the published src directory to prevent TS errors
+  // from appearing when users go to source, and VSCode opens the source .ts file
+  // via declaration maps
+  "include": ["index.ts"],
+  "compilerOptions": {
+    "target": "ES2015",
+    "lib": ["DOM", "DOM.Iterable", "ES2018"],
+    "moduleResolution": "node"
+  }
+}
diff --git a/sdks/ts/tsconfig.json b/sdks/ts/tsconfig.json
new file mode 100644
index 00000000..49d58169
--- /dev/null
+++ b/sdks/ts/tsconfig.json
@@ -0,0 +1,37 @@
+{
+  "include": ["src", "tests", "examples"],
+  "exclude": [],
+  "compilerOptions": {
+    "target": "es2020",
+    "lib": ["es2020"],
+    "module": "commonjs",
+    "moduleResolution": "node",
+    "esModuleInterop": true,
+    "paths": {
+      "@onkernel/hypeman/*": ["./src/*"],
+      "@onkernel/hypeman": ["./src/index.ts"]
+    },
+    "noEmit": true,
+
+    "resolveJsonModule": true,
+
+    "forceConsistentCasingInFileNames": true,
+
+    "strict": true,
+    "noImplicitAny": true,
+    "strictNullChecks": true,
+    "strictFunctionTypes": true,
+    "strictBindCallApply": true,
+    "strictPropertyInitialization": true,
+    "noImplicitThis": true,
+    "noImplicitReturns": true,
+    "alwaysStrict": true,
+    "exactOptionalPropertyTypes": true,
+    "noUncheckedIndexedAccess": true,
+    "noImplicitOverride": true,
+    "noPropertyAccessFromIndexSignature": true,
+    "isolatedModules": false,
+
+    "skipLibCheck": true
+  }
+}
diff --git a/stainless.yaml b/stainless.yaml
index 24ac9d63..50110341 100644
--- a/stainless.yaml
+++ b/stainless.yaml
@@ -21,13 +21,13 @@ targets:
     # [docs]: https://www.stainless.com/docs/reference/editions
     edition: go.2025-10-08
     package_name: hypeman
-    production_repo: kernel/hypeman-go
+    production_repo: kernel/hypeman#stl-go-main
     options:
       enable_v2: true
   typescript:
     edition: typescript.2025-10-10
     package_name: "@onkernel/hypeman"
-    production_repo: onkernel/hypeman-ts
+    production_repo: kernel/hypeman#stl-ts-main
     publish:
       npm: true