
Product
Introducing Repository Access Permissions and Custom Roles
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.
QVAC SDK is the canonical entry point to develop AI applications with QVAC.
QVAC SDK is the main entry point for developing applications with QVAC. It is type-safe and exposes all QVAC capabilities through a unified interface. It runs on Node.js, Bare runtime, and Expo.
See https://docs.qvac.tether.io/sdk/getting-started for the comprehensive QVAC documentation.
For AI/LLM tools, use https://docs.qvac.tether.io/llms-full.txt as the consolidated plaintext documentation export.
Assembling a custom worker on Bare? See
@qvac/bare-sdk— the same SDK surface with no built-in plugin addons, designed for consumers wiring their own worker entry (Pear apps, bare-expo apps, direct Bare scripts).
See https://docs.qvac.tether.io/sdk/getting-started/installation
mkdir qvac-examples
cd qvac-examples
npm init -y && npm pkg set type=module
npm install @qvac/sdk
import { loadModel, LLAMA_3_2_1B_INST_Q4_0, completion, unloadModel } from "@qvac/sdk";
try {
// Load a model into memory
const modelId = await loadModel({
modelSrc: LLAMA_3_2_1B_INST_Q4_0,
modelType: "llm",
onProgress: (progress) => {
console.log(progress);
},
});
// You can use the loaded model multiple times
const history = [
{
role: "user",
content: "Explain quantum computing in one sentence",
},
];
const result = completion({ modelId, history, stream: true });
for await (const token of result.tokenStream) {
process.stdout.write(token);
}
// Unload model to free up system resources
await unloadModel({ modelId });
}
catch (error) {
console.error("❌ Error:", error);
process.exit(1);
}
node quickstart.js
In the ./examples subdirectory, you will find scripts demonstrating how to use all SDK functionalities. To try any of them:
# With Bare
bun run bare:example dist/examples/path/to/example.js
# With Node
node dist/examples/path/to/example.js
# With bun, straight from source
bun run examples/path/to/example.ts
Use the Bun package manager:
bun i
bun run build # or `watch` for hotreload
bun run build:pack
This outputs a tarball under dist/sdk-{version}.tgz that you can install in your project, e.g.:
npm i path/to/sdk-0.3.0.tgz
The SDK test suite is organized into three buckets by runtime:
| Bucket | Runtime | Location | Command |
|---|---|---|---|
| Unit | Bun / Node | test/unit/ | bun run test:unit |
| Server (Bare) | Bare | test/bare/ | bun run test:bare |
| Client (consumer) | Node / RN | e2e/ | See e2e/README.md |
See TESTING.md for the full decision tree on where new tests should land.
This repository enforces structured commit messages and PR titles to maintain consistency and generate changelogs automatically.
Commit messages:
prefix[tags]?: subject
PR titles:
TICKET prefix[tags]: subject
feat - New features or capabilitiesfix - Bug fixesdoc - Documentation changestest - Test additions or modificationsmod - Model-related changeschore - Maintenance tasksinfra - CI/CD, tooling, infrastructureTags are optional:
[api] - API changes (non-breaking)[bc] - Breaking changes (including breaking API changes)Valid commit messages:
feat: add RAG support for LanceDB
fix[api]: fix completion stream error handling
doc: update installation instructions
feat[bc]: redesign loadModel signature
chore: update dependencies
Valid PR titles:
QVAC-123 feat: add RAG support for LanceDB
QVAC-456 fix[api]: fix completion stream error handling
QVAC-789 doc: update installation instructions
QVAC-101 feat[bc]: redesign loadModel signature
When creating PRs with specific tags, you must include code examples in the PR description:
[bc] tag requirements:
Must include BEFORE/AFTER code examples showing the migration path:
## BC Changes
**BEFORE:**
```typescript
const model = await loadModel("model-path");
```
**AFTER:**
```typescript
const modelId = await loadModel("model-path", { modelType: "llm" });
```
Or using inline comments:
```typescript
// old
const model = await loadModel("model-path");
// new
const modelId = await loadModel("model-path", { modelType: "llm" });
```
[api] tag requirements (non-breaking):
Must include at least one fenced code block showing the new API usage:
## New API
```typescript
// New completion API with streaming support
for await (const token of completion({
modelId,
history: [{ role: "user", content: "Hello!" }],
}).tokenStream) {
process.stdout.write(token);
}
```
Merge pull request #123)1.0.0, v1.0.0)Revert "feat: add feature")squash! fix: bug fix)Once your PRs are merged into dev, you can generate a changelog:
npm run changelog:generate
This will:
dev and main brancheschangelog/<version>/CHANGELOG.mdchangelog/<version>/breaking.md for BC changes (with code examples)changelog/<version>/api.md for API changes (with code examples)FAQs
**QVAC SDK** is the canonical entry point to develop AI applications with QVAC.
The npm package @qvac/sdk receives a total of 7,221 weekly downloads. As such, @qvac/sdk popularity was classified as popular.
We found that @qvac/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.

Product
Socket MCP now lets AI assistants review org alerts, investigate threats using the Socket threat feed, and inspect package files in addition to dependency scoring.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.