
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
**QVAC SDK** is the canonical entry point to develop AI applications with QVAC.
QVAC SDK is the canonical entry point to develop AI applications with QVAC.
QVAC SDK is the main entry point for developing applications with QVAC. It is type-safe and exposes all QVAC capabilities through a unified interface. It runs on Node.js and Expo.
See https://docs.qvac.tether.io/sdk/getting-started for the comprehensive QVAC documentation.
For AI/LLM tools, use https://docs.qvac.tether.io/llms-full.txt as the consolidated plaintext documentation export.
In-process Bare: use
@qvac/inference.@qvac/bare-sdkis deprecated; last release is 0.18.2.
See https://docs.qvac.tether.io/sdk/getting-started/installation
mkdir qvac-examples
cd qvac-examples
npm init -y && npm pkg set type=module
npm install @qvac/sdk
import { loadModel, LLAMA_3_2_1B_INST_Q4_0, completion, unloadModel } from '@qvac/sdk'
try {
// Load a model into memory
const modelId = await loadModel({
modelSrc: LLAMA_3_2_1B_INST_Q4_0,
onProgress: (progress) => {
console.log(progress)
}
})
// You can use the loaded model multiple times
const history = [
{
role: 'user',
content: 'Explain quantum computing in one sentence'
}
]
const result = completion({ modelId, history, stream: true })
for await (const token of result.tokenStream) {
process.stdout.write(token)
}
// Unload model to free up system resources
await unloadModel({ modelId })
} catch (error) {
console.error('❌ Error:', error)
process.exit(1)
}
node quickstart.js
Use getSystemResources to inspect locally observed CPU, system-memory, GPU, and
driver capabilities. Pass sample: true only when you also need a fresh usage
sample:
import { getSystemResources } from '@qvac/sdk'
const resources = await getSystemResources({ sample: true })
if (resources.capabilities.memory.totalBytes.status === 'supported') {
console.log('System memory:', resources.capabilities.memory.totalBytes.value)
}
if (resources.sample?.cpu.status === 'supported') {
console.log('CPU utilization:', resources.sample.cpu.value)
}
See the system resources support matrix for metric-level evidence and platform limitations.
Every metric reports supported, unavailable, unverified, or failed.
Supported values include provenance with a source and optional scope. These
values are diagnostics; they do not reserve memory or guarantee that a model
can be loaded.
GPU capabilities expose observed driver names, versions, and graphics APIs. These observations do not prove that an inference backend is compatible.
Profiled inference operation events may include event.backend with the
selected backend and device, graphics API, driver, fallback reason, and probe
result. Addons attach backend metadata with attachBackendDiagnostics; the SDK
validates it before recording the operation event. gpuId, when present,
identifies a GPU from the current worker resource collector and is stable only
for that collector's lifetime. The SDK does not infer compatibility from driver
inventory or log text.
Resource gauges are disabled by default. Enable them explicitly to attach one worker resource sample to each profiled operation:
import { profiler } from '@qvac/sdk'
profiler.enable({ mode: 'verbose', includeResourceGauges: true })
// Run SDK operations, then inspect recentEvents[].resources.
const profile = profiler.exportJSON()
The sample uses the same status, provenance, and scope semantics as
getSystemResources({ sample: true }). Its sampledAt uses the same monotonic
clock as the profiling event's ts, so the two timestamps are comparable.
resources.origin records that the sample was taken on the local worker.
Samples are delivered to profiler.onRecord; they
are retained in exportJSON().recentEvents only in verbose mode. Enabling
gauges in summary mode still incurs the sampling cost without retaining them.
Disabling profiling or omitting includeResourceGauges performs no resource
sampling. Enabling gauges adds one CPU query and one query per GPU to each
profiled operation's response path. If the worker resource collector is not
initialized, the event omits the resource block.
Use assessModelFit to check, before downloading anything, whether models are
likely to fit in this device's memory. It reads generated catalog metadata plus a
fresh memory sample — no weights, no load, no native probe:
import { assessModelFit, QWEN3_8B_INST_Q4_K_M } from '@qvac/sdk'
const result = await assessModelFit({
models: [{ model: QWEN3_8B_INST_Q4_K_M, workload: { kind: 'llm', contextTokens: 8192 } }],
execution: 'sequential',
policy: 'interactive-v1'
})
console.log(result.verdict) // 'likely-fits' | 'likely-too-large' | 'unknown'
The result is advisory: it does not block loadModel, reserve memory, or make a
performance claim. unknown is a real answer meaning the evidence does not
support a call either way — show it as "can't say", not as "no".
See pre-download model fit assessment for the budget arithmetic, why estimates are ranges, the supported engine and workload matrix, and the current calibration status.
Whisper and Parakeet duplex transcription sessions expose terminal engine statistics after their event iterator completes:
const session = await transcribeStream({ modelId })
for await (const text of session) {
process.stdout.write(text)
}
const stats = await session.stats
console.log(stats?.audioDuration, stats?.realTimeFactor)
session.stats resolves to undefined when the engine does not report
statistics.
In the ./examples subdirectory, you will find scripts demonstrating how to use all SDK functionalities. To try any of them:
# With Bare
bun run bare:example dist/examples/path/to/example.js
# With Node
node dist/examples/path/to/example.js
# With bun, straight from source
bun run examples/path/to/example.ts
examples/abot-world.ts has a companion guide covering the hardware
requirements, scene-pack lifecycle, cancellation semantics and concurrency rules
of an interactive world session: see
ABot-World interactive world sessions.
Use the Bun package manager:
bun i
@qvac/inference resolves to its published release by default. To build and test against the in-repo engine at the same commit, link it first:
bun run sdk-source:workspace
bun run build # or `watch` for hotreload
bun run build:pack
This outputs a tarball under dist/sdk-{version}.tgz that you can install in your project, e.g.:
npm i path/to/sdk-0.3.0.tgz
The SDK test suite is organized into two buckets by runtime:
| Bucket | Runtime | Location | Command |
|---|---|---|---|
| Unit | Bun / Node | test/ | bun run test:unit |
| Client (consumer) | Node / RN | e2e/ | See e2e/README.md |
See TESTING.md for the full decision tree on where new tests should land.
This repository enforces structured commit messages and PR titles to maintain consistency and generate changelogs automatically.
Commit messages:
prefix[tags]?: subject
PR titles:
TICKET prefix[tags]: subject
feat - New features or capabilitiesfix - Bug fixesdoc - Documentation changestest - Test additions or modificationsmod - Model-related changeschore - Maintenance tasksinfra - CI/CD, tooling, infrastructureTags are optional:
[api] - API changes (non-breaking)[bc] - Breaking changes (including breaking API changes)Valid commit messages:
feat: add RAG support for LanceDB
fix[api]: fix completion stream error handling
doc: update installation instructions
feat[bc]: redesign loadModel signature
chore: update dependencies
Valid PR titles:
QVAC-123 feat: add RAG support for LanceDB
QVAC-456 fix[api]: fix completion stream error handling
QVAC-789 doc: update installation instructions
QVAC-101 feat[bc]: redesign loadModel signature
When creating PRs with specific tags, you must include code examples in the PR description:
[bc] tag requirements:
Must include BEFORE/AFTER code examples showing the migration path:
## BC Changes
**BEFORE:**
```typescript
const model = await loadModel('model-path')
```
**AFTER:**
```typescript
const modelId = await loadModel('model-path', { modelType: 'llm' })
```
Or using inline comments:
```typescript
// old
const model = await loadModel('model-path')
// new
const modelId = await loadModel('model-path', { modelType: 'llm' })
```
[api] tag requirements (non-breaking):
Must include at least one fenced code block showing the new API usage:
## New API
```typescript
// New completion API with streaming support
for await (const token of completion({
modelId,
history: [{ role: 'user', content: 'Hello!' }]
}).tokenStream) {
process.stdout.write(token)
}
```
Merge pull request #123)1.0.0, v1.0.0)Revert "feat: add feature")squash! fix: bug fix)Once your PRs are merged into dev, you can generate a changelog:
npm run changelog:generate
This will:
dev and main brancheschangelog/<version>/CHANGELOG.mdchangelog/<version>/breaking.md for BC changes (with code examples)changelog/<version>/api.md for API changes (with code examples)FAQs
**QVAC SDK** is the canonical entry point to develop AI applications with QVAC.
The npm package @qvac/sdk receives a total of 0 weekly downloads. As such, @qvac/sdk popularity was classified as not popular.
We found that @qvac/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.