tetherto · opaninakuffo · May 14, 2026 · May 13, 2026
@@ -1,5 +1,142 @@
 # Changelog
 
+## [0.4.0]
+
+Release Date: 2026-05-13
+
+📦 **NPM:** https://www.npmjs.com/package/@qvac/cli/v/0.4.0
+
+This release adds a new `qvac verify` command group for native-addon hygiene (lockfile diffs and bundle/ABI validation before things break on-device), wires image generation into the OpenAI-compatible HTTP server, and surfaces the new SDK `reasoning_budget` and Qwen3.5 / Gemma4 tool-call dialects through `qvac serve`.
+
+---
+
+## 🔌 New APIs
+
+### `qvac verify deps` — catch native addon lockfile churn early
+
+Worker bundles can silently inherit new native Bare addons through transitive lockfile changes, and the breakage only shows up later in the bundle step or on-device. `qvac verify deps` is a CI-friendly guardrail that compares two git refs' `package-lock.json` and reports added/removed native addons before packaging.
+
+```bash
+qvac verify deps --base upstream/main --head HEAD
+qvac verify deps --base origin/main --head HEAD --quiet
+qvac verify deps --base upstream/main --head HEAD \
+  --lockfile packages/sdk/package-lock.json
+```
+
+Exit codes are designed for CI guardrails: `0` for no native changes (or no npm lockfile present at either ref), `1` for added/removed natives or a removed package whose native status could not be determined, and `2` for tool errors (missing args, unsupported lockfile, unresolvable git ref). Detection is npm-only — `package-lock.json` is the source of truth.
+
+### `qvac verify bundle` — validate prebuilds and ABI before shipping
+
+A companion to `verify deps`: where the former flags lockfile churn, `verify bundle` validates the actual artifact. Given a `worker.bundle.js` or a `node_modules` directory, and one or more target hosts, it checks that every native addon ships a `.bare` prebuild for each host and that each addon's `engines.bare` range is compatible with the resolved Bare runtime.
+
+```bash
+qvac verify bundle --addons-source qvac/worker.bundle.js \
+  --host ios-arm64 \
+  --host ios-arm64-simulator \
+  --host ios-x64-simulator \
+  --host android-arm64
+
+qvac verify bundle --addons-source ./node_modules \
+  --host darwin-arm64 \
+  --host linux-x64 \
+  --host win32-x64
+
+qvac verify bundle --addons-source qvac/worker.bundle.js \
+  --host ios-arm64 \
+  --bare-runtime-version 1.26.0
+```
+
+The Bare runtime version is resolved in order: explicit `--bare-runtime-version` flag, then `bare-runtime/package.json`, then `bare/package.json`. Mobile and Expo CI should pass `--bare-runtime-version` explicitly — `react-native-bare-kit` does not expose embedded runtime metadata.
+
+Pinning the runtime version also works via a `qvac.config.{json,js,mjs,ts}` file auto-detected from the current directory (or pointed at with `--config <path>`):
+
+```json
+// qvac.config.json
+{ "bareRuntimeVersion": "1.26.0" }
+```
+
+```bash
+qvac verify bundle --addons-source qvac/worker.bundle.js --host ios-arm64
+```
+
+Issue codes:
+
+- **Errors** (exit `1`): `missing-prebuild`, `abi-mismatch`, `invalid-runtime-version`, `invalid-source`.
+- **Warnings** (exit `0`): `unknown-runtime-version`, `malformed-engines-bare`.
+
+### `POST /v1/images/generations` on `qvac serve openai`
+
+The OpenAI-compatible HTTP server now exposes image generation, backed by the SDK `diffusion()` primitive. The startup banner lists `POST /v1/images/generations` whenever an `image`-category model is configured. The route is a stateless adapter — request → SDK → response, no storage, no re-encoding.
+
+Configure a diffusion model (and, optionally, alias common OpenAI model names like `gpt-image-2` to it for drop-in client compatibility):
+
+```json
+// qvac.config.json
+{
+  "serve": {
+    "models": {
+      "sd21": {
+        "model": "SD_V2_1_1B_Q4_0",
+        "default": true,
+        "preload": true,
+        "config": { "prediction": "v" }
+      }
+    }
+  }
+}
+```
+
+Blocking JSON response (default):
+
+```json
+{
+  "created": 1718000000,
+  "output_format": "png",
+  "size": "1024x1024",
+  "data": [
+    { "b64_json": "iVBORw0KGgoAAAANSUhEUgAA..." }
+  ]
+}
+```
+
+Streaming (`stream: true`) returns a single `image_generation.completed` SSE event followed by `[DONE]`, matching OpenAI's documented `partial_images: 0` behaviour:
+
+```
+event: image_generation.completed
+data: {"type":"image_generation.completed","created_at":1718000000,"output_format":"png","size":"1024x1024","b64_json":"iVBORw0KGgoAAAANSUhEUgAA..."}
+
+data: [DONE]
+```
+
+Behaviour notes:
+
+- `size = "WxH"` (multiples of 8) or `"auto"`; absent → SDK defaults.
+- `n` is a positive integer, forwarded as-is to SDK `batch_count` (no upper clamp). `n < 1`, non-integer, or non-number → `400 invalid_n`.
+- `response_format` defaults to `b64_json`; `"url"` returns `data:image/png;base64,...`. Ignored when `stream: true`.
+- `output_format=jpeg|webp` is accepted but the body is still PNG; the response echoes `output_format: "png"` so clients can detect the mismatch and decide whether to fall back. Honoring other encodings server-side will likely require an encoder dependency (e.g. `sharp`) and is tracked separately.
+- `quality`, `style`, `background`, `moderation`, `output_compression`, `partial_images`, and `user` are accepted and warned.
+
+### Qwen3.5 / Gemma4 tool-call dialects and `reasoning_budget` through `qvac serve`
+
+The SDK now parses Qwen3.5 / Qwen3.6 (Pythonic-XML: `<tool_call><function=NAME><parameter=KEY>VALUE</parameter></function></tool_call>`) and Gemma4 (`<|tool_call>call:NAME{...}<tool_call|>`) tool-call output formats, with auto-detection from the model name/path. The CLI exposes this transparently through the OpenAI chat-completions surface and adds `reasoning_budget` to the request body as a boolean (`true` → `-1` unrestricted, `false` → `0` disabled):
+
+```json
+POST /v1/chat/completions
+{
+  "model": "qwen35",
+  "messages": [{ "role": "user", "content": "Think step by step." }],
+  "reasoning_budget": false
+}
+```
+
+Requires `@qvac/sdk@^0.10.0`. Tool-call examples for both dialects live under the SDK's `examples/tools/`.
+
+---
+
+## 🧹 Maintenance
+
+The repo-wide PR template consolidation deleted the stale `packages/cli/PULL_REQUEST_TEMPLATE.md` (along with 18 other unused per-package copies). GitHub only ever auto-discovered the two canonical templates at `.github/PULL_REQUEST_TEMPLATE/{sdk-pod,addon}.md`, and the CLI's per-package template was invisible to the GitHub UI; only ad-hoc tooling that read it was ever affected, and that tooling now points at the canonical addon template. No behaviour change for end users of `@qvac/cli`.
+
 ## [0.3.0]
 
 Release Date: 2026-04-30
@@ -17,15 +154,6 @@ Release Date: 2026-04-27
 - Update `SDKModule.embed` type and `sdkEmbed()` to handle the new `{ embedding, stats? }` return shape introduced in `@qvac/sdk` 0.9+. The CLI's internal `number[] | number[][]` contract is preserved so callers (notably the OpenAI embeddings route) stay unchanged. (see PR [#1596](https://github.com/tetherto/qvac/pull/1596))
 - Extract nested `node_modules` packages when generating the addons manifest in `qvac bundle sdk`, so deeply-hoisted addon dependencies are correctly included in the mobile worker bundle. (see PR [#1731](https://github.com/tetherto/qvac/pull/1731))
 
-## [0.2.3]
-
-Release Date: 2026-04-06
-
-## 🐞 Fixes
-
-- Add `sdcpp-generation` (diffusion) to `BUILTIN_PLUGINS` for mobile worker bundle. Without this, mobile apps using `qvac bundle sdk` would get "Plugin not found" errors for the diffusion model type. (see PR [#1338](https://github.com/tetherto/qvac/pull/1338))
-- Update README built-in plugins list to include `parakeet-transcription` and `sdcpp-generation`.
-
 ## [0.2.2]
 
 Release Date: 2026-03-19
@@ -49,41 +177,3 @@ Release Date: 2026-03-19
 ## ⚙️ Infrastructure
 
 - Add explicit build step to CLI publish workflow. (see PR [#1010](https://github.com/tetherto/qvac/pull/1010))
-
-## [0.1.3]
-
-Release Date: 2026-02-17
-
-### ✨ Features
-
-- Add `--sdk-path` option to explicitly specify SDK location instead of auto-detecting from `node_modules/@qvac/sdk` (see PR [#384](https://github.com/tetherto/qvac/pull/384))
-
-### 🐛 Fixes
-
-- Use dynamic module resolution for `bare-pack` and `tsx` dependencies — fixes resolution failures when CLI dependencies are hoisted to project root (see PR [#392](https://github.com/tetherto/qvac/pull/392))
-
-## [0.1.2]
-
-Release Date: 2026-02-14
-
-### 🔧 Changed
-
-- Make `bare-pack` resolution self-contained — CLI now resolves `bare-pack` from its own `node_modules` instead of relying on consumer project
-- Use explicit SDK exports in worker entry generation (`@qvac/sdk/worker-core`, `@qvac/sdk/plugins`, `@qvac/sdk/logging`) to align with SDK's tightened package boundaries
-
-### 📝 Documentation
-
-- Updated README to reflect that `bare-pack` is bundled with CLI (no longer a user dependency)
-
-## [0.1.1]
-
-Release Date: 2026-02-11
-
-### 🧹 Chores
-
-- Add cli to sdk pod & remove manual CHANGELOG. (see PR [#228](https://github.com/tetherto/qvac/pull/228))
-- Standardize logger & log levels. (see PR [#257](https://github.com/tetherto/qvac/pull/257))
-
-### ⚙️ Infrastructure
-
-- Add GPR scope rewrite action and rename CLI to @qvac/cli. (see PR [#230](https://github.com/tetherto/qvac/pull/230))
@@ -12,41 +12,51 @@ JavaScript Dependencies
 
 --- apache-2.0 (Apache License 2.0) ---
 
-  b4a@1.7.5
+  b4a@1.8.0
     https://github.com/holepunchto/b4a
+  bare-abort-controller@1.1.1
+    https://github.com/holepunchto/bare-abort-controller
   bare-addon-resolve@1.10.0
     https://github.com/holepunchto/bare-addon-resolve
-  bare-buffer@3.4.4
+  bare-ansi-escapes@2.2.3
+    https://github.com/holepunchto/bare-ansi-escapes
+  bare-assert@1.2.0
+    https://github.com/holepunchto/bare-assert
+  bare-buffer@3.6.0
     https://github.com/holepunchto/bare-buffer
   bare-bundle@1.10.0
     https://github.com/holepunchto/bare-bundle
   bare-bundle-id@1.0.2
     https://github.com/holepunchto/bare-bundle-id
   bare-events@2.8.2
     https://github.com/holepunchto/bare-events
-  bare-fs@4.5.4
+  bare-fs@4.7.1
     https://github.com/holepunchto/bare-fs
+  bare-inspect@3.1.4
+    https://github.com/holepunchto/bare-inspect
   bare-module-lexer@1.4.7
     https://github.com/holepunchto/bare-module-lexer
   bare-module-resolve@1.12.1
     https://github.com/holepunchto/bare-module-resolve
   bare-module-traverse@2.0.1
     https://github.com/holepunchto/bare-module-traverse
-  bare-os@3.6.2
+  bare-os@3.8.0
     https://github.com/holepunchto/bare-os
-  bare-pack@2.0.0
+  bare-pack@2.0.1
     https://github.com/holepunchto/bare-pack
   bare-path@3.0.0
     https://github.com/holepunchto/bare-path
   bare-semver@1.0.2
     https://github.com/holepunchto/bare-semver
-  bare-stream@2.7.0
+  bare-stream@2.13.1
     https://github.com/holepunchto/bare-stream
-  bare-url@2.3.2
+  bare-type@1.1.0
+    https://github.com/holepunchto/bare-type
+  bare-url@2.4.3
     https://github.com/holepunchto/bare-url
   events-universal@1.0.1
     https://github.com/holepunchto/events-universal
-  paparam@1.10.0
+  paparam@1.10.1
     https://github.com/holepunchto/paparam
   require-addon@1.2.0
     https://github.com/holepunchto/require-addon
@@ -57,11 +67,11 @@ JavaScript Dependencies
 
 --- mit (MIT License) ---
 
-  @esbuild/darwin-arm64@0.27.3
+  @esbuild/darwin-arm64@0.27.4
     https://github.com/evanw/esbuild
   commander@14.0.3
     https://github.com/tj/commander.js
-  esbuild@0.27.3
+  esbuild@0.27.4
     https://github.com/evanw/esbuild
   fast-fifo@1.3.2
     https://github.com/mafintosh/fast-fifo
@@ -73,10 +83,12 @@ JavaScript Dependencies
     https://github.com/mafintosh/promaphore
   resolve-pkg-maps@1.0.0
     https://github.com/privatenumber/resolve-pkg-maps
-  sodium-native@5.0.10
+  sodium-native@5.1.0
     https://github.com/holepunchto/sodium-native
-  streamx@2.23.0
+  streamx@2.25.0
     https://github.com/mafintosh/streamx
+  teex@1.0.1
+    https://github.com/mafintosh/teex
   tsx@4.21.0
     https://github.com/privatenumber/tsx
 
@@ -0,0 +1,15 @@
+# Changelog v0.4.0
+
+Release Date: 2026-05-13
+
+## 🔌 API
+
+- Add qvac verify deps to detect native addon lockfile changes. (see PR [#1969](https://github.com/tetherto/qvac/pull/1969)) - See [API changes](./api.md)
+- Add Qwen3.5, Gemma4 tool-call dialects and reasoning_budget param. (see PR [#1974](https://github.com/tetherto/qvac/pull/1974)) - See [API changes](./api.md)
+- Add qvac verify bundle command for prebuild and ABI verification. (see PR [#1984](https://github.com/tetherto/qvac/pull/1984)) - See [API changes](./api.md)
+- Add POST /v1/images/generations to qvac serve OpenAI adapter. (see PR [#2008](https://github.com/tetherto/qvac/pull/2008)) - See [API changes](./api.md)
+
+## 🧹 Chores
+
+- Consolidate PR templates and hide style note in HTML comment — delete the 19 unused per-package `PULL_REQUEST_TEMPLATE.md` files (including `packages/cli/PULL_REQUEST_TEMPLATE.md`) and centralise on `.github/PULL_REQUEST_TEMPLATE/{sdk-pod,addon}.md` plus a minimal default. (see PR [#1924](https://github.com/tetherto/qvac/pull/1924))
+