@homaiohq/napi-quickfix 0.0.0-stage → 0.1.0

package/CMakeLists.txt

@@ -0,0 +1,131 @@
+cmake_minimum_required(VERSION 3.15)
+
+project(napi_quickfix CXX)
+
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_POSITION_INDEPENDENT_CODE ON)
+
+include(FetchContent)
+
+# ---------------------------------------------------------------------------
+# QuickFIX (build-time dependency, nothing vendored). Pinned to v1.16.0.
+# ---------------------------------------------------------------------------
+# Force QuickFIX build options BEFORE MakeAvailable so add_subdirectory picks
+# them up from the cache.
+set(QUICKFIX_SHARED_LIBS OFF CACHE BOOL "" FORCE)
+set(QUICKFIX_EXAMPLES OFF CACHE BOOL "" FORCE)
+set(QUICKFIX_TESTS OFF CACHE BOOL "" FORCE)
+set(HAVE_SSL OFF CACHE BOOL "" FORCE)
+set(HAVE_MYSQL OFF CACHE BOOL "" FORCE)
+set(HAVE_POSTGRESQL OFF CACHE BOOL "" FORCE)
+
+FetchContent_Declare(
+  quickfix
+  GIT_REPOSITORY https://github.com/quickfix/quickfix.git
+  GIT_TAG v1.16.0
+  GIT_SHALLOW TRUE
+)
+FetchContent_MakeAvailable(quickfix)
+
+# Give musl the same clock as glibc. QuickFIX picks its clock in
+# src/C++/FieldTypes.cpp:
+#     #if defined(_POSIX_SOURCE) || defined(HAVE_GETTIMEOFDAY)   -> gettimeofday, us
+#     #elif defined(HAVE_FTIME)                                  -> ftime, ms only
+# glibc's <features.h> defines _POSIX_SOURCE whenever _GNU_SOURCE is set (and g++
+# always sets it), so glibc takes the gettimeofday branch for free. musl never
+# defines _POSIX_SOURCE, and QuickFIX -- although it probes gettimeofday in
+# cmake/QuickfixPlatformSettings.cmake -- never propagates HAVE_GETTIMEOFDAY to the
+# compiler (it is absent from cmake_config.h.in). musl does get HAVE_FTIME, so it
+# lands on the obsolete ftime() branch and is capped at MILLISECOND resolution.
+# That is invisible at the default TimestampPrecision=3, but with
+# TimestampPrecision=6 a musl build emits .NNN000 where glibc emits true
+# microseconds. Forcing the probe result on removes that divergence.
+# No-op on glibc, which already takes the first branch.
+#
+# UNIX-only on purpose: MSVC has no gettimeofday() to point HAVE_GETTIMEOFDAY at, and
+# upstream QuickFIX does propagate HAVE_FTIME on Windows (it probes for it in
+# src/C++/CMakeLists.txt), so Windows is millisecond-capped by design. The loopback
+# test's microsecond-tail assertion is POSIX-gated to match.
+if(UNIX AND TARGET quickfix)
+  target_compile_definitions(quickfix PRIVATE HAVE_GETTIMEOFDAY)
+endif()
+
+# ---------------------------------------------------------------------------
+# Include-tree shim (risk #1): QuickFIX ships headers flat in src/C++/*.h but
+# code includes them as "quickfix/Message.h". Assemble a quickfix/ include tree
+# at configure time (Windows-safe: file copies, no symlinks).
+# ---------------------------------------------------------------------------
+set(QF_INCLUDE_ROOT "${CMAKE_BINARY_DIR}/qf_include")
+file(GLOB QF_HEADERS "${quickfix_SOURCE_DIR}/src/C++/*.h")
+foreach(_qf_hdr ${QF_HEADERS})
+  get_filename_component(_qf_name "${_qf_hdr}" NAME)
+  configure_file("${_qf_hdr}" "${QF_INCLUDE_ROOT}/quickfix/${_qf_name}" COPYONLY)
+endforeach()
+
+# Copy any generated config.h (may live in the binary dir after configure).
+file(GLOB_RECURSE QF_GENERATED_CONFIG "${quickfix_BINARY_DIR}/*config.h")
+foreach(_qf_cfg ${QF_GENERATED_CONFIG})
+  get_filename_component(_qf_cfg_name "${_qf_cfg}" NAME)
+  configure_file("${_qf_cfg}" "${QF_INCLUDE_ROOT}/quickfix/${_qf_cfg_name}" COPYONLY)
+endforeach()
+
+# ---------------------------------------------------------------------------
+# node-addon-api include dir (resolved via node).
+# ---------------------------------------------------------------------------
+execute_process(
+  COMMAND node -p "require('node-addon-api').include_dir"
+  WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+  OUTPUT_VARIABLE NODE_ADDON_API_DIR
+  OUTPUT_STRIP_TRAILING_WHITESPACE
+)
+string(REPLACE "\"" "" NODE_ADDON_API_DIR ${NODE_ADDON_API_DIR})
+string(REPLACE "\n" "" NODE_ADDON_API_DIR ${NODE_ADDON_API_DIR})
+
+# ---------------------------------------------------------------------------
+# The native addon.
+# ---------------------------------------------------------------------------
+file(GLOB ADDON_SOURCES "${CMAKE_SOURCE_DIR}/cpp/*.cpp")
+
+add_library(napi_quickfix SHARED ${ADDON_SOURCES} ${CMAKE_JS_SRC})
+set_target_properties(napi_quickfix PROPERTIES PREFIX "" SUFFIX ".node")
+
+target_include_directories(napi_quickfix PRIVATE
+  ${CMAKE_JS_INC}
+  ${QF_INCLUDE_ROOT}
+  ${quickfix_SOURCE_DIR}/src/C++
+  ${NODE_ADDON_API_DIR}
+)
+
+target_compile_definitions(napi_quickfix PRIVATE
+  NAPI_VERSION=9
+  NAPI_CPP_EXCEPTIONS
+  NODE_ADDON_API_DISABLE_DEPRECATED
+)
+
+target_link_libraries(napi_quickfix PRIVATE ${CMAKE_JS_LIB} quickfix)
+
+if(UNIX AND NOT APPLE)
+  find_package(Threads REQUIRED)
+  target_link_libraries(napi_quickfix PRIVATE Threads::Threads)
+  # Statically absorb libstdc++/libgcc so a prebuild does not pin consumers to the
+  # build image's GLIBCXX version. This matters most for musl: docker-node only keeps
+  # the newest Alpine bases, so node:22-alpine's GCC keeps advancing (already 15.2 on
+  # Alpine 3.24) and a consumer on an older node:22-alpineX.Y would otherwise hit
+  # "GLIBCXX_3.4.3x not found". Safe here because the addon is a leaf: C++ exceptions
+  # and RTTI never cross out of the .node (Node's addon ABI is C, and QuickFIX is
+  # statically linked into this same object), and Node dlopen()s addons RTLD_LOCAL, so
+  # the absorbed symbols stay private to this module.
+  target_link_options(napi_quickfix PRIVATE -static-libstdc++ -static-libgcc)
+endif()
+
+if(APPLE)
+  find_package(Threads REQUIRED)
+  target_link_libraries(napi_quickfix PRIVATE Threads::Threads)
+  target_link_options(napi_quickfix PRIVATE -undefined dynamic_lookup)
+endif()
+
+if(WIN32)
+  target_link_libraries(napi_quickfix PRIVATE ws2_32)
+  target_compile_definitions(napi_quickfix PRIVATE NOMINMAX _WIN32_WINNT=0x0601)
+endif()

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Homaio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,422 @@
-# Temporary Holding Version
+# @homaiohq/napi-quickfix
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![CI](https://github.com/homaiohq/napi-quickfix/actions/workflows/ci.yml/badge.svg)](https://github.com/homaiohq/napi-quickfix/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/@homaiohq/napi-quickfix.svg)](https://www.npmjs.com/package/@homaiohq/napi-quickfix)
+[![Node.js](https://img.shields.io/node/v/@homaiohq/napi-quickfix.svg)](https://nodejs.org)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE)
+
+A modern **Node-API** (N-API / `node-addon-api`) C++ binding for the
+[QuickFIX](https://github.com/quickfix/quickfix) FIX-protocol engine. It exposes
+both the *pure* message layer (build, parse, and validate FIX messages) and the
+full *session engine* (socket initiator/acceptor with `FIX::Application`
+callbacks bridged to JavaScript) — with prebuilt binaries so most consumers need
+**no C++ compiler**, dual **ESM + CommonJS** entry points, and TypeScript types
+included.
+
+## Features
+
+- **Modern Node-API** — built on `node-addon-api` (N-API v9), not the legacy
+  NAN/node-gyp stack. One prebuild per platform serves every supported Node LTS.
+- **No compiler needed** — prebuilt native binaries ship in the npm package (via
+  `prebuildify` + `node-gyp-build`); a source build via CMake is only a fallback.
+- **Dual ESM + CJS** — a proper `exports` map with `import` and `require` entry
+  points.
+- **TypeScript types included** — hand-written `.d.ts` for the full public API.
+- **Full FIX surface** — the session engine (`Initiator`/`Acceptor` +
+  synchronous application handlers) *and* the pure layer (`Message`,
+  `SessionSettings`, `DataDictionary`, `SessionID`).
+- **Ergonomic, safe API** — chainable message building with automatic
+  header/trailer field routing, typed rejections, and C++ exceptions surfaced as
+  JavaScript `Error`s.
+
+## Install
+
+```sh
+yarn add @homaiohq/napi-quickfix
+# or
+npm install @homaiohq/napi-quickfix
+# or
+pnpm add @homaiohq/napi-quickfix
+```
+
+Prebuilt binaries are published for **Linux x64** (both **glibc** and
+**musl/Alpine**), **macOS** x64 + arm64, and **Windows** x64. On these platforms
+installation requires no toolchain.
+
+The two Linux binaries are libc-tagged and picked automatically: `node-gyp-build`
+selects the musl build when `/etc/alpine-release` exists. On a musl distro that
+is *not* Alpine, set `LIBC=musl` to force it.
+
+If a matching prebuild is not available for your platform/arch, the install
+falls back to building from source, which requires:
+
+- **CMake** (>= 3.12)
+- A **C++17** compiler (GCC / Clang / MSVC)
+
+  On Alpine/musl that is `apk add build-base cmake git` — `build-base` supplies
+  g++/make, and `git` is needed for the QuickFIX `FetchContent` clone.
+
+QuickFIX itself is fetched at build time via CMake `FetchContent` (pinned to
+`v1.16.0`) — nothing is vendored or committed to this repository.
+
+Releases are published from GitHub Actions via npm Trusted Publishing with
+[provenance](https://docs.npmjs.com/generating-provenance-statements), so you can
+check that an installed version was built from this repository:
+
+```sh
+npm audit signatures
+```
+
+## Quick start
+
+### ESM
+
+```ts
+import {
+  Message,
+  SessionSettings,
+  Initiator,
+  FixReject,
+  sendToTarget,
+  FIELD,
+  MsgType,
+} from '@homaiohq/napi-quickfix';
+
+// Build a message. Header/trailer fields (e.g. MsgType) auto-route to the right
+// section, so setField is all you usually need. setField is chainable.
+const order = new Message()
+  .setField(FIELD.MsgType, MsgType.NewOrderSingle)
+  .setField(FIELD.ClOrdID, 'order-1')
+  .setField(FIELD.Symbol, 'AAPL')
+  .setField(FIELD.OrderQty, 100);
+
+console.log(order.getMsgType()); // 'D'
+console.log(order.toPretty());
+
+// Parse a raw FIX wire string back into a Message.
+const parsed = Message.parse(order.toString());
+
+// Load session settings from an in-memory config.
+const settings = SessionSettings.fromString(`
+[DEFAULT]
+ConnectionType=initiator
+SocketConnectHost=127.0.0.1
+SocketConnectPort=5001
+HeartBtInt=30
+UseDataDictionary=N
+StartTime=00:00:00
+EndTime=00:00:00
+
+[SESSION]
+BeginString=FIX.4.4
+SenderCompID=CLIENT
+TargetCompID=BROKER
+`);
+
+// Create the initiator with synchronous application handlers.
+const initiator = new Initiator({
+  settings,
+  store: 'memory',
+  log: 'none',
+  handlers: {
+    onLogon(sessionID) {
+      console.log('logged on:', sessionID.toString());
+      // sessionID.toString() -> "FIX.4.4:CLIENT->BROKER"
+      sendToTarget(order, sessionID);
+    },
+    toAdmin(msg) {
+      // Handlers run synchronously and may MUTATE the outbound message.
+      if (msg.getMsgType() === MsgType.Logon) {
+        msg.setField(FIELD.Username, 'user');
+        msg.setField(FIELD.Password, 'secret');
+      }
+    },
+    fromApp(msg) {
+      // Reject an inbound message by THROWING a typed rejection.
+      if (msg.getMsgType() === 'X') {
+        throw new FixReject('UnsupportedMessageType');
+      }
+      console.log('received:', msg.getMsgType());
+    },
+  },
+});
+
+// Observe-only events (cannot mutate/reject) are also emitted.
+initiator.on('logout', (id) => console.log('logged out:', id.toString()));
+
+initiator.start();
+
+// ... later, shut down cleanly (drain gracefully).
+process.on('SIGINT', () => {
+  initiator.stop();
+});
+```
+
+### CommonJS
+
+```js
+const {
+  Message,
+  SessionSettings,
+  Initiator,
+  FIELD,
+  MsgType,
+} = require('@homaiohq/napi-quickfix');
+
+const order = new Message()
+  .setField(FIELD.MsgType, MsgType.NewOrderSingle)
+  .setField(FIELD.ClOrdID, 'order-1')
+  .setField(FIELD.Symbol, 'AAPL');
+
+const settings = SessionSettings.fromString(`
+[DEFAULT]
+ConnectionType=initiator
+SocketConnectHost=127.0.0.1
+SocketConnectPort=5001
+HeartBtInt=30
+UseDataDictionary=N
+StartTime=00:00:00
+EndTime=00:00:00
+
+[SESSION]
+BeginString=FIX.4.4
+SenderCompID=CLIENT
+TargetCompID=BROKER
+`);
+
+const initiator = new Initiator({
+  settings,
+  store: 'memory',
+  log: 'none',
+  handlers: {
+    onLogon: (id) => console.log('logged on:', id.toString()),
+  },
+});
+
+initiator.start();
+// initiator.stop() when done.
+```
+
+## API overview
+
+The full type surface is documented in the shipped TypeScript declarations
+(`dist/esm/index.d.ts`); the reference below is a concise summary. All exports
+come from `@homaiohq/napi-quickfix`.
+
+### Message
+
+```ts
+new Message(raw?: string, opts?: { validate?: boolean });
+Message.parse(raw: string, opts?: { validate?: boolean }): Message;
+
+message.setField(tag: number, value: string | number): this; // chainable, auto-routes header/trailer fields
+message.getField(tag: number): string;
+message.setHeaderField(tag, value): this;   message.getHeaderField(tag): string;
+message.setTrailerField(tag, value): this;  message.getTrailerField(tag): string;
+message.getMsgType(): string;
+message.toString(): string;   // raw SOH-delimited wire string
+message.toPretty(): string;   // human-readable
+message.toJSON(): { msgType?: string; raw: string };
+
+createMessage(fields?: Record<number, string | number>): Message;
+parseMessage(raw: string, opts?: { validate?: boolean }): Message;
+```
+
+Field values are accepted as `string | number` (numbers are stringified) and
+always returned as `string`. Header/trailer fields such as `MsgType`,
+`BeginString`, and `CheckSum` are **automatically routed** to the correct
+section by `setField`, so you rarely need `setHeaderField`/`setTrailerField`
+directly.
+
+### SessionID
+
+```ts
+new SessionID(beginString: string, senderCompID: string, targetCompID: string, qualifier?: string);
+sessionID.beginString;   sessionID.senderCompID;
+sessionID.targetCompID;  sessionID.sessionQualifier;
+sessionID.toString();    // e.g. "FIX.4.4:CLIENT->BROKER"
+```
+
+### SessionSettings
+
+```ts
+SessionSettings.fromString(cfg: string): SessionSettings;
+SessionSettings.fromFile(path: string): SessionSettings;
+settings.getSessions(): SessionID[];
+```
+
+### DataDictionary
+
+```ts
+DataDictionary.fromString(xml: string): DataDictionary;
+DataDictionary.fromFile(xmlPath: string): DataDictionary;
+dictionary.validate(msg: Message): void; // throws QuickFixError if invalid
+```
+
+### Initiator / Acceptor (the session engine)
+
+Both extend Node's `EventEmitter` and share the same options and lifecycle:
+
+```ts
+new Initiator({ settings, handlers?, store?: 'file' | 'memory', log?: 'screen' | 'file' | 'none' });
+new Acceptor({ settings, handlers?, store?, log? });
+
+engine.start(): void;
+engine.stop(force?: boolean): void;   // graceful drain by default; force to abort
+engine.isLoggedOn(): boolean;
+engine.ref(): void;    // keep the event loop alive while running (default)
+engine.unref(): void;  // let a short script / test exit
+```
+
+### Handlers vs. events
+
+This is the key distinction to understand:
+
+- **`handlers`** (passed in the constructor options) run **synchronously** on the
+  engine's callback path. They are the *only* place you can affect a message:
+  - `toAdmin` / `toApp` may **mutate** the outbound message in place (e.g. add
+    credentials to a Logon in `toAdmin`).
+  - `toApp` may **throw** `new FixReject('DoNotSend')` to suppress sending.
+  - `fromAdmin` / `fromApp` may **throw** a `FixReject` to reject an inbound
+    message (e.g. `'RejectLogon'`, `'UnsupportedMessageType'`).
+  - `onCreate` / `onLogon` / `onLogout` are fire-and-forget notifications.
+
+- **Events** (`engine.on('logon', ...)`, etc.) are **observe-only**. The engine
+  emits `'create' | 'logon' | 'logout' | 'toAdmin' | 'fromAdmin' | 'toApp' | 'fromApp'`
+  *after* the corresponding handler runs. Event listeners **cannot** mutate a
+  message or reject it — use `handlers` for that.
+
+### Rejections
+
+Throw a `FixReject` from a handler to reject:
+
+```ts
+import { FixReject, fixReject } from '@homaiohq/napi-quickfix';
+
+throw new FixReject('DoNotSend');
+throw new FixReject('RejectLogon', 'bad credentials');
+throw fixReject('UnsupportedMessageType'); // convenience factory
+```
+
+Recognized kinds: `'DoNotSend'`, `'RejectLogon'`, `'UnsupportedMessageType'`,
+`'IncorrectDataFormat'`, `'IncorrectTagValue'`, `'FieldNotFound'`.
+
+### Module functions and constants
+
+```ts
+sendToTarget(message: Message, sessionID: SessionID): boolean;
+version(): string;               // engine / addon version string
+
+FIELD    // field-name -> tag number, e.g. FIELD.MsgType === 35, FIELD.Password === 554
+MsgType  // MsgType values, e.g. MsgType.Logon === 'A'
+Side     // Side values, e.g. Side.Buy === '1'
+enums    // the full frozen tree of FIX constants
+```
+
+`FIELD` is generated from the bundled QuickFIX's `FixFieldNumbers.h`, so it has every
+`FIX::FIELD::*` name the engine knows (6000+). Values are literal types: `FIELD.Password`
+is typed `554`, and a misspelt field name is a compile error. `FieldName` is the union of
+all field names.
+
+The table is also exposed as a subpath export that does **not** load the native addon,
+for tooling that only needs tag numbers (log parsers, test helpers, bundles for platforms
+without a prebuild):
+
+```ts
+import { FIELD } from '@homaiohq/napi-quickfix/fields';
+```
+
+### Errors
+
+Errors thrown by native calls are `Error`s with `name === 'QuickFixError'`,
+carrying a `fixError` discriminator (a stable string such as `'ConfigError'`,
+`'FieldNotFound'`, `'InvalidMessage'`, `'IncorrectTagValue'`) plus a `detail`
+string, so you can branch on the failure kind:
+
+```ts
+try {
+  dictionary.validate(msg);
+} catch (err) {
+  if (err.name === 'QuickFixError' && err.fixError === 'FieldNotFound') {
+    // handle a missing required field
+  }
+}
+```
+
+## Building from source / Contributing
+
+Development uses **Yarn (Berry 4)** with the `node-modules` linker, via corepack.
+
+```sh
+corepack enable
+yarn install
+yarn build   # cmake-js native build + dual (ESM + CJS) TypeScript build
+yarn test    # node --test
+```
+
+QuickFIX is fetched at build time via CMake `FetchContent` (pinned to
+`v1.16.0`) — nothing is vendored or committed. The native build therefore needs
+CMake (>= 3.12) and a C++17 compiler; the QuickFIX sources are downloaded
+automatically on first configure.
+
+See [CONTRIBUTING.md](./CONTRIBUTING.md) for more detail, and
+[ARCHITECTURE.md](./ARCHITECTURE.md) for a diagrammed walkthrough of how the
+TypeScript API, the C++ Node-API addon, and the QuickFIX engine fit together
+(layers, build pipeline, the threading/async model, and CI).
+
+## Compatibility
+
+| | |
+| --- | --- |
+| **Node.js** | LTS **22**, **24** and **26** (current) |
+| **N-API version** | 9 |
+| **Platforms** | Linux (glibc + musl/Alpine), macOS, Windows |
+| **Prebuilt targets** | `linux-x64` (glibc, musl), `darwin-x64`, `darwin-arm64`, `win32-x64` |
+| **libc (Linux)** | glibc **and** musl — separate libc-tagged prebuilds; musl is x64-only |
+| **QuickFIX** | v1.16.0 (statically linked into prebuilds) |
+| **Timestamp resolution** | microseconds on Linux (glibc + musl) and macOS; **milliseconds on Windows** |
+
+Because prebuilds are N-API-tagged (not ABI-tagged), a single binary per
+platform serves all supported Node LTS versions.
+
+On Windows, QuickFIX has no microsecond clock available (it falls back to
+`ftime()`), so sub-second `SendingTime` digits beyond milliseconds are always
+zero — a `TimestampPrecision=6` session emits `.NNN000`. Setting a higher
+precision is still valid and interoperable; only the extra digits are padding.
+
+## Versioning
+
+This package follows [Semantic Versioning](https://semver.org/) and is currently
+in the **`0.x`** (pre-1.0) phase. While in `0.x`, **minor releases may include
+breaking changes** — pre-1.0 has no separate major channel — so review the
+[CHANGELOG](./CHANGELOG.md) before upgrading across a minor bump. Note that npm's
+caret range locks the minor for `0.x`: `^0.1.0` resolves to `>=0.1.0 <0.2.0`.
+
+The package version tracks *this binding's* API and behavior, not the bundled
+QuickFIX release (statically linked, currently `v1.16.0` — see the table above).
+See [VERSIONING.md](./VERSIONING.md) for the full policy.
+
+## License
+
+This package (`@homaiohq/napi-quickfix`) is licensed under the **MIT License** —
+see [LICENSE](./LICENSE). Copyright (c) 2026 Homaio.
+
+### Third-party licenses
+
+The published prebuilt binaries **statically link** the QuickFIX C++ engine,
+which is distributed under the **QuickFIX Software License, Version 1.0** (a
+permissive, BSD-style license). Its full text and the required attribution are
+reproduced in [THIRD_PARTY_LICENSES](./THIRD_PARTY_LICENSES).
+
+As required by that license:
+
+> This product includes software developed by quickfixengine.org
+> (http://www.quickfixengine.org/).
+
+### Acknowledgements / Naming
+
+This is an **independent, unaffiliated** Node.js binding. It is not produced,
+sponsored, or endorsed by quickfixengine.org or the QuickFIX project. The name
+"QuickFIX" is used here **nominatively** — solely to describe the C++ library
+that this package wraps — and does not imply any affiliation or endorsement. All
+QuickFIX trademarks and names remain the property of their respective owners.

package/THIRD_PARTY_LICENSES

@@ -0,0 +1,48 @@
+THIRD-PARTY LICENSES
+====================
+
+This file lists the licenses of third-party software that is bundled with, or
+statically linked into, the distributed artifacts of @homaiohq/napi-quickfix.
+
+The npm package ships prebuilt native binaries (`prebuilds/`) that statically
+link the QuickFIX C++ FIX-protocol engine. QuickFIX itself is NOT vendored in
+this source repository — it is fetched at build time from its upstream Git tag
+via CMake FetchContent — but because its compiled code is embedded in the
+published binaries, its license and the acknowledgement below are reproduced
+here as required by that license.
+
+--------------------------------------------------------------------------------
+
+QuickFIX (https://github.com/quickfix/quickfix)
+-----------------------------------------------
+
+Version linked: v1.16.0
+License: QuickFIX Software License, Version 1.0
+License source: https://raw.githubusercontent.com/quickfix/quickfix/v1.16.0/LICENSE
+
+This product includes software developed by quickfixengine.org
+(http://www.quickfixengine.org/).
+
+The full, verbatim text of the QuickFIX Software License, Version 1.0 follows:
+
+--------------------------------------------------------------------------------
+
+# QuickFIX Software License, Version 1.0
+
+The complete text of this license is as follows:
+
+Copyright (c) 2001-2020 Oren Miller
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+3. The end-user documentation included with the redistribution, if any, must include the following acknowledgment: "This product includes software developed by quickfixengine.org (http://www.quickfixengine.org/)." Alternately, this acknowledgment may appear in the software itself, if and wherever such third-party acknowledgments normally appear.
+
+4. The names "QuickFIX" and "quickfixengine.org" must not be used to endorse or promote products derived from this software without prior written permission. For written permission, please contact ask@quickfixengine.org
+
+5. Products derived from this software may not be called "QuickFIX", nor may "QuickFIX" appear in their name, without prior written permission of quickfixengine.org
+
+THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL QUICKFIXENGINE.ORG OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.