
Company News
/Security News
Socket Selected for OpenAI's Cybersecurity Grant Program
Socket is an initial recipient of OpenAI's Cybersecurity Grant Program, which commits $10M in API credits to defenders securing open source software.
QVAC is an open-source, cross-platform ecosystem for local-first, peer-to-peer AI. QVAC runs on Bare by Holepunch, a lightweight, cross-platform JavaScript runtime.
QVAC SDK is the canonical entry point to develop AI applications with QVAC.
Written in TypeScript, it provides all QVAC capabilities through a unified interface while also abstracting away the complexity of running your application in a JS environment other than Bare.
For the comprehensive reference, see official QVAC documentation.
Supported JS environments: Bare, Node.js, Expo and Bun.
npm install @qvac/sdk
OS peer dependency:
apt install vulkan-sdk
npm i expo-file-system react-native-bare-kit
On Android, bump minSdkVersion to 29, by adding ext { minSdkVersion=29 } to android/build.gradle or using expo-build-properties.
Add the QVAC Expo plugin to app.json:
export default {
expo: {
plugins: ["@qvac/sdk/expo-plugin"],
},
};
npx expo prebuild
npx expo run:ios --device
# or
npx expo run:android --device
[!IMPORTANT]
Due to limitations withllamacpp, QVAC currently does not run on emulators. You must use a physical device.
import {
completion,
LLAMA_3_2_1B_INST_Q4_0,
loadModel,
downloadAsset,
unloadModel,
VERBOSITY,
} from "@qvac/sdk";
try {
// First just cache the model
await downloadAsset({
assetSrc: LLAMA_3_2_1B_INST_Q4_0,
onProgress: (progress) => {
console.log(progress);
},
});
// Then load it in memory from cache
const modelId = await loadModel({
modelSrc: LLAMA_3_2_1B_INST_Q4_0,
modelType: "llm",
modelConfig: {
device: "gpu",
ctx_size: 2048,
verbosity: VERBOSITY.ERROR,
},
});
const history = [
{
role: "user",
content: "Explain quantum computing in one sentence, use lots of emojis",
},
];
const result = completion({ modelId, history, stream: true });
for await (const token of result.tokenStream) {
process.stdout.write(token);
}
const stats = await result.stats;
console.log("\n📊 Performance Stats:", stats);
// Change `clearStorage: true` to delete cached model files
await unloadModel({ modelId, clearStorage: false });
} catch (error) {
console.error("❌ Error:", error);
process.exit(1);
}
llama.cpp.whisper.cpp.llama.cpp, for RAG.llama.cpp] — i.e., process and understand multiple types of media within the same conversation context.qvac.config.json, .js, or .ts).In the ./examples subdirectory, you will find scripts demonstrating how to use all SDK functionalities. To try any of them:
# With Bare
bun run bare:example dist/examples/path/to/example.js
# With Node
node dist/examples/path/to/example.js
# With bun, straight from source
bun run examples/path/to/example.ts
llama.cpp with local files: examples/llamacpp-filesystem.tsllama.cpp with Hyperdrive: examples/llamacpp-hyperdrive.tsllama.cpp with HTTP: examples/llamacpp-http.tsllama.cpp with tools/function calls: examples/llamacpp-native-tools.tsllama.cpp with multimodal inference: examples/llamacpp-multimodal.tsllama.cpp with KV cache: examples/kv-cache-example.tswhisper.cpp transcription: examples/whispercpp-filesystem.tsexamples/whispercpp-microphone-record.tsexamples/embed-hyperdrive.tsRAG with HyperDB (cross-platform):
examples/rag/rag-hyperdb/ingest.tsexamples/rag/rag-hyperdb/pipeline.ts (Segregated flow: chunk → embed → save)examples/rag/rag-hyperdb/workspaces.ts (Workspace lifecycle: list, close, delete)examples/rag/rag-hyperdb/cancellation.ts (progress + cancel)RAG with other backends (desktop only):
examples/rag/rag-lancedb.tsexamples/rag/rag-chromadb.ts (requires ChromaDB server)examples/rag/rag-sqlite.ts (SQLite-Vector WASM)examples/translation/translation-opus.tsexamples/translation/translation-indic.tsexamples/translation/translation-llm.tsexamples/tts/chatterbox.ts (voice cloning with reference audio)examples/tts/supertonic.ts (general-purpose, no voice cloning)examples/multi-model-demo.tsexamples/delegated-inference/provider.tsexamples/delegated-inference/consumer.ts[!TIP] Set
QVAC_HYPERSWARM_SEEDenv var to ensure that the provider uses the same keypair (i.e., public key doesn't change on every run).
[!NOTE] Consumer does not handle reconnection yet.
Stream real-time logs from the SDK server and native addons:
import { loggingStream, SDK_LOG_ID } from "@qvac/sdk";
// SDK server logs (general operations)
for await (const log of loggingStream({ id: SDK_LOG_ID })) {
console.log(`[${log.level}] ${log.namespace}: ${log.message}`);
}
// Addon logs per model (llamacpp, whispercpp, etc.)
for await (const log of loggingStream({ id: modelId })) {
console.log(`[${log.level}] ${log.namespace}: ${log.message}`);
}
examples/logging-streaming.tsexamples/logging-file-transport.tsCustomize SDK behavior using a config file. The SDK auto-discovers qvac.config.{json,js,ts} in your project root, or you can specify a path via QVAC_CONFIG_PATH environment variable.
Supported formats:
qvac.config.json - JSON formatqvac.config.js - JavaScript with export defaultqvac.config.ts - TypeScript with export defaultAvailable options:
| Option | Type | Default | Description |
|---|---|---|---|
cacheDirectory | string | ~/.qvac/models | Where models and assets are stored |
swarmRelays | string[] | [] | Hyperswarm relay public keys for P2P |
loggerLevel | string | "info" | Log level: "error", "warn", "info", "debug" |
loggerConsoleOutput | boolean | true | Enable/disable console output |
httpDownloadConcurrency | number | 3 | Max concurrent HTTP downloads for sharded models |
httpConnectionTimeoutMs | number | 10000 | HTTP connection timeout in milliseconds |
examples/default-config-usage.tsexamples/download-with-cancel.tsBlind relays help establish peer connections through NAT/firewalls by routing traffic through relay nodes.
examples/download-with-blind-relays.tsswarmRelays to your config file before starting your provider/consumer.[!NOTE] The examples use mock relay keys. For real deployments, you must use your own relay servers or trusted public relays.
Sharded models are split into multiple files following the pattern: <name>-00001-of-0000X.<ext>. The SDK automatically downloads and loads all parts with detailed progress tracking.
Supported formats:
.tar, .tar.gz, .tgz): HTTP or local with automatic extractionSee: examples/llamacpp-sharded.ts
sequenceDiagram
participant User as User
participant SDK as QVAC SDK
participant RPC as RPC Client (singleton)
participant Worker as Bare Worker (singleton)
User->>SDK: Call loadModel("llama-3", options)
SDK->>RPC: Create runtime-specific RPC client
RPC->>Worker: Spawn worker (if needed) and send loadModel request
Worker->>Worker: Download and load model into memory
Worker->>RPC: Return success response
RPC->>SDK: Model loaded successfully
SDK->>User: loadModel() resolves with modelId
Note: The example uses mock relay keys. In real deployments, you must use your own relay servers or trusted public relays.
Hot config reload allows you to update model configurations on-the-fly without unloading the model. Pass modelId (instead of modelSrc) to loadModel with the modelType and new modelConfig to apply changes instantly.
examples/config-reload.tsNote: Config reload is currently supported for Whisper models. All config parameters except contextParams (GPU settings, flash attention) can be hot reloaded. contextParams are load-time only and require full model reload. More model types coming soon.
This repository enforces structured commit messages and PR titles to maintain consistency and generate changelogs automatically.
Commit messages:
prefix[tags]?: subject
PR titles:
TICKET prefix[tags]: subject
feat - New features or capabilitiesfix - Bug fixesdoc - Documentation changestest - Test additions or modificationsmod - Model-related changeschore - Maintenance tasksinfra - CI/CD, tooling, infrastructureTags are optional:
[api] - API changes (non-breaking)[bc] - Breaking changes (including breaking API changes)Valid commit messages:
feat: add RAG support for LanceDB
fix[api]: fix completion stream error handling
doc: update installation instructions
feat[bc]: redesign loadModel signature
chore: update dependencies
Valid PR titles:
QVAC-123 feat: add RAG support for LanceDB
QVAC-456 fix[api]: fix completion stream error handling
QVAC-789 doc: update installation instructions
QVAC-101 feat[bc]: redesign loadModel signature
When creating PRs with specific tags, you must include code examples in the PR description:
[bc] tag requirements:
Must include BEFORE/AFTER code examples showing the migration path:
## BC Changes
**BEFORE:**
```typescript
const model = await loadModel("model-path");
```
**AFTER:**
```typescript
const modelId = await loadModel("model-path", { modelType: "llm" });
```
Or using inline comments:
```typescript
// old
const model = await loadModel("model-path");
// new
const modelId = await loadModel("model-path", { modelType: "llm" });
```
[api] tag requirements (non-breaking):
Must include at least one fenced code block showing the new API usage:
## New API
```typescript
// New completion API with streaming support
for await (const token of completion({
modelId,
history: [{ role: "user", content: "Hello!" }],
}).tokenStream) {
process.stdout.write(token);
}
```
Merge pull request #123)1.0.0, v1.0.0)Revert "feat: add feature")squash! fix: bug fix)Once your PRs are merged into dev, you can generate a changelog:
npm run changelog:generate
This will:
dev and main brancheschangelog/<version>/CHANGELOG.mdchangelog/<version>/breaking.md for BC changes (with code examples)changelog/<version>/api.md for API changes (with code examples)Note: Requires a GitHub token (GITHUB_TOKEN or GH_TOKEN environment variable) to fetch PR metadata.
Use the Bun package manager:
bun i
bun run build # or `watch` for hotreload
bun run build:pack
This outputs a tarball under dist/qvac-sdk-{version}.tgz that you can install in your project, e.g.:
npm i path/to/qvac-sdk-0.3.0.tgz
FAQs
**QVAC SDK** is the canonical entry point to develop AI applications with QVAC.
The npm package @qvac/sdk receives a total of 1,654 weekly downloads. As such, @qvac/sdk popularity was classified as popular.
We found that @qvac/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
/Security News
Socket is an initial recipient of OpenAI's Cybersecurity Grant Program, which commits $10M in API credits to defenders securing open source software.

Security News
Socket CEO Feross Aboukhadijeh joins 10 Minutes or Less, a podcast by Ali Rohde, to discuss the recent surge in open source supply chain attacks.

Research
/Security News
Campaign of 108 extensions harvests identities, steals sessions, and adds backdoors to browsers, all tied to the same C2 infrastructure.