Skip to content

Home

Jump to bottom
Edgar Cano edited this page Oct 5, 2026 · 4 revisions

3va Wiki

Veni, Vidi, Vici, Abiit — He came, he saw, he conquered, he left.

3va is a secure-by-default JavaScript and TypeScript runtime written in Rust. It reimagines the runtime from the ground up with a deny-by-default permission model, post-quantum cryptography, and a sandboxed package manager.

Runtime, package manager, process manager, test runner, bundler and dev server live in a single Rust binary.

Navigation

Get started

Page Description
Installation npm, Cargo, Scoop, Chocolatey, winget, Snap, Nix, or a prebuilt binary
Migrate Move an npm, Yarn, pnpm, Bun or Deno project — tested status per framework
CLI Reference All commands and flags
Examples 13 runnable projects with real output and gotchas

The model

Page Description
Permissions Deny-by-default capability model, CLI flags, package.json grants
Package Manager Installs, forced reinstall, updates, dedup storage, audit pipeline
Security Reporting vulnerabilities and the security model
HTTP Performance Default rate/connection limits and the built-in firewall

The toolchain

Page Description
Process Manager start / stop / status / logs, backoff and restart semantics
Dev Tooling Test runner, bundler, dev server + HMR, profiler, debugger, sandbox

Reference

Page Description
Architecture Crate structure and responsibilities
Comparison 3va vs Node.js vs Bun — feature matrix and CI benchmarks
Roadmap Known limitations, platform support, Node.js API compatibility
FAQ Frequently asked questions
Contributing Development workflow and CI gates

Core Philosophy

  • Deny by default. No filesystem, network, env, or child-process access unless explicitly granted. This applies uniformly to application code and to every dependency it pulls in.
  • Capability-based permissions. Every sensitive operation requires a flag, scoped to specific hosts, paths, or variables. Grants can also live in package.json and are enforced per-dependency, not per-process.
  • Untrusted dependencies. Lifecycle scripts (preinstall/install/postinstall) are blocked by default. A project can allow them per package (onlyBuiltDependencies), and even then only single-JS-file scripts run, inside the sandbox.
  • Post-quantum ready. The vvva_crypto crate is built with post-quantum primitives (ML-KEM-768, ML-DSA).

Quick Example

# Run a script with scoped permissions
3va run app.ts --allow-net=api.example.com --allow-read=/app/config

# Or declare them once in package.json under "3va" (see [[Permissions]])
3va run app.ts

# The rest of the toolchain lives in the same binary
3va install express --allow-net=registry.npmjs.org   # post-install scripts blocked
3va audit --secrets                                  # malware + secrets + OSV CVEs
3va start app.js --name my-api                       # built-in process manager
3va test · 3va bundle · 3va dev

No flag = no access. Simple.

Where these docs come from

Content in this wiki is sourced from the same verified facts as the 3va docs site and the 3va repository — its code, its test suite, and its docs/ folder. Where the README and the code disagree, the code wins.

Clone this wiki locally