Ecosystem

The packages that ship in this repo and how they fit together.

SDKs

• @cvfile/sdk — JavaScript / TypeScript pack/extract/inspect/validate. Browser + Node.
• cvfile — Python equivalent. Same API surface, idiomatic naming.
• cv-go — Go equivalent. Reader path complete; pack writer landing in v0.2.

CLI

• cv — single Go binary. Subcommands: extract, inspect, validate, search.

Embeddings

• @cvfile/embed — JS chunker + transformers.js + HF Inference backends. Default model BAAI/bge-m3 (1024-dim, MIT, multilingual).
• cvfile[embed] — Python equivalent.

Viewer

• @cvfile/viewer-web — Lit web component (<cv-embed>) with PDF/MD/HTML tabs, lazy PDF.js worker, dark/light theming, keyboard nav, mobile layout.

Server middleware

• @cvfile/server — Node Express/Fastify/Hono adapters + vanilla http handler.
• cvfile.server — Python ASGI (FastAPI/Starlette) and WSGI (Flask/Django).
• cv-go/middleware — Go net/http handler.

AI tooling integrations

• langchain-cvfile (PyPI) — CVFileLoader emits LangChain Documents, optionally one per embedding chunk.
• llama-index-readers-cvfile (PyPI) — CVFileReader emits LlamaIndex Documents with .embedding populated.
• cvfile-haystack (PyPI) — Haystack 2.x CVFileToDocument converter component.
• cvfile-cv-detector (PyPI / npm / Go) — 200 line reference sniffer that detects .cv wrapping inside any application/pdf and unwraps the /AF markdown payload. Designed for crawler vendors who want .cv awareness without adopting an SDK.

Compatibility verified

The same .cv file built by any SDK reads byte-identically in the others. The embeddings.cbor payload survives a round trip through CBOR encoders/decoders in JS, Python, and Go. Server middleware in three languages negotiates the same Accept header to the same response.

Production gates

• veraPDF — every shipped fixture passes PDF/A-3u conformance. CI runs the gate via the tools/verapdf-runner/ Docker image.
• Malicious corpus — 7 mutated fixtures under spec/test-vectors/malicious/. All three SDK validators reject every one with the same documented error code.
• Cross-SDK interop — the producer/consumer matrix is exercised on every PR.