joinstick 0.0.0-stage → 0.2.0

package/PROTOCOL.md

@@ -0,0 +1,238 @@
+# Joinstick protocol, version 1
+
+Plain JSON text frames over one WebSocket at `/joinstick/ws`. Every message is
+an object with a string field `t`. You only need this to write a client in
+another language; browser code should use `host.js` / `client.js`.
+
+```
+ host (game)                    server                     pad (phone)
+   | create ------------------->  |                            |
+   | <------------------ created  |                            |
+   |                              | <---------------------- join
+   | <--------------------- join  | joined ------------------> |
+   | <-------------------- input  | <--------------------- input
+   | pad / send / kick ---------> | pad / message / error ---> |
+   | <------------------- leave   |          (socket closed)   |
+```
+
+A connection is a host or a pad, decided by its first message (`create` or
+`join`). Anything else first gets `bad-message`.
+
+## Common rules
+
+- Max frame size 8 KB; bigger frames close the socket with code 1009.
+- Unknown or malformed messages get `{t:'error', code:'bad-message', message}`
+  and are otherwise ignored.
+- Slots are 1-based integers. Room codes are 4 letters from
+  `BCDFGHJKLMNPQRSTVWXZ`, case-insensitive (the server upper-cases them).
+- Fatal errors are sent as `{t:'error', code}` and then the server closes the
+  socket with code 4000 and the error code as reason.
+
+## Liveness
+
+The server sends `{t:'ping'}` every 2 s to every socket. Clients answer
+`{t:'pong'}`. Any message counts as activity. The server drops a socket after
+5 s of silence; clients should drop and reconnect after 5 s without any
+message from the server.
+
+## Host → server
+
+### `create`
+
+```json
+{"t":"create","v":1,"slots":2,"layout":{"stick":"dpad","buttons":[{"id":"a","label":"A"}]},"room":"KQZX","hostToken":"…","resetPads":true}
+```
+
+| Field | |
+|---|---|
+| `v` | Must be `1`, else fatal `version`. |
+| `slots` | 1-8, default 2. |
+| `layout` | Optional. `stick`: `'dpad'` (default) or `'none'`. `orientation`: `'landscape'`, `'portrait'` or `'any'`. `arrangement`: `'grid'`, `'diamond'` or `'arc'`. `haptics`: boolean. `buttons`: ≤ 8 of `{id, label?, color?, size?, haptic?, system?}`; `id` `/^[A-Za-z0-9_-]{1,16}$/`, unique, not an `Object.prototype` name; `label` ≤ 8 chars (default id), `color` `/^#[0-9a-f]{3,8}$/i`, `size` `'large'` or `'wide'`, `haptic` integer ms 0-100, `system` boolean. Optional fields are echoed only when given; the pad applies the defaults (landscape, grid, haptics on, 10 ms). Default: d-pad + buttons `a`, `b`. |
+| `room`, `hostToken` | Optional, to resume. |
+| `resetPads` | Optional. `true` on resume clears every slot's pad state (the game was reloaded). The host SDK sends it on the first `create` of each `host()` call. |
+
+Resume-or-recreate:
+
+- `room` exists, `hostToken` matches and `slots` is the same → **resume** the
+  same room and pads. A previous host connection gets fatal `replaced`. If the
+  layout changed or `resetPads` is true, connected pads receive a fresh
+  `joined`. Right after `created`, the server sends the last `input` of every
+  connected pad, so held state survives the reload.
+- `room` does not exist, `room` is a valid code and `hostToken` is 32 hex
+  chars → **recreate** the room with that code and token (server restart case).
+- Otherwise → a new room with a new code and token.
+
+More than 1000 rooms, or 20 rooms created from the same client address →
+fatal `server-full`.
+
+### `pad`
+
+```json
+{"t":"pad","slot":1,"patch":{"title":"Ryu","color":"#e5484d","highlight":["a"],"disabled":["b"],"vibrate":200}}
+```
+
+All patch fields optional: `title` (string, trimmed to 20 chars), `color` (hex),
+`highlight` / `disabled` (arrays of ≤ 8 button ids), `vibrate` (integer
+0-2000 ms). The server merges the patch into that slot's pad state (everything
+but `vibrate`), keeps it while the room lives, and forwards the patch to the
+pad.
+
+### `send`
+
+```json
+{"t":"send","slot":1,"data":{"any":"json"}}
+{"t":"send","slot":null,"data":"to every pad"}
+```
+
+### `kick`
+
+```json
+{"t":"kick","slot":1}
+```
+
+The pad gets fatal `kicked`; the host gets `leave` with reason `kicked`.
+
+## Server → host
+
+### `created`
+
+```json
+{"t":"created","room":"KQZX","hostToken":"9f…32 hex","joinBase":"http://192.168.1.20:3000","layout":{…validated…},"slots":[{"slot":1,"connected":false,"name":""}]}
+```
+
+Pads join at `${joinBase}/j/${room}/${slot}`, or at `${joinBase}/j/${room}` to
+get the first free slot. The QR for a slot is
+`/joinstick/qr.svg?room=KQZX&slot=1` on the Joinstick server; without `slot`
+it encodes the slot-less link.
+
+### `join`
+
+```json
+{"t":"join","slot":1,"name":"Ana","rejoin":false}
+```
+
+`rejoin` is true when the token is the same as the slot's previous occupant
+(same phone coming back, or taking over from another tab).
+
+### `leave`
+
+```json
+{"t":"leave","slot":1,"reason":"left"}
+```
+
+`reason`: `left` (pad closed with code 1000), `disconnected` (any other
+close, including a locked phone), `timeout` (no pong for 5 s), `kicked`.
+
+### `input`
+
+```json
+{"t":"input","slot":1,"x":-1,"y":0,"b":{"a":true,"b":false}}
+```
+
+Full state, forwarded as sent by the pad (x, y clamped to [-1, 1]). The first
+`input` after a `join` (or after `created` on resume) is the slot's baseline:
+buttons already down in it are held, not new presses. The client SDK always
+sends one right after `joined`.
+
+### `message`
+
+```json
+{"t":"message","slot":1,"data":{"any":"json"}}
+```
+
+## Pad → server
+
+### `join`
+
+```json
+{"t":"join","v":1,"room":"KQZX","slot":1,"token":"32 hex chars","name":"Ana"}
+```
+
+| Field | |
+|---|---|
+| `v` | Must be `1`, else fatal `version`. |
+| `room` | Case-insensitive. Unknown → `room-not-found`. |
+| `slot` | Optional. Omitted/null → the slot this token held before, else the first free one. Not 1..slots → `bad-slot`. |
+| `token` | `/^[A-Za-z0-9_-]{16,64}$/`, generated and stored by the client. Identifies the phone. |
+| `name` | Optional, control chars stripped, trimmed to 20 chars. |
+
+The first join and a rejoin are the same message. Outcomes:
+
+- Slot empty → taken.
+- Slot occupied by the **same token** → the new connection wins; the old one
+  gets fatal `replaced`.
+- Slot occupied by **another token** → `{t:'error', code:'slot-taken', free:[2,3]}`.
+
+After 5 failed joins on one socket the server closes it. After 20 failed
+joins from one client address within a minute, every further `join` from
+that address gets fatal `rate-limited` until the minute is over. Failures in
+the first minute after the server starts are not counted: phones are still
+waiting for their game to recreate its room.
+
+### `input`
+
+```json
+{"t":"input","x":0,"y":-1,"b":{"a":true}}
+```
+
+Full state on every change. `x`, `y` are finite numbers (clamped to [-1, 1];
+`y` = -1 is up). `b` maps ≤ 16 button ids to booleans (`Object.prototype`
+names are refused). While the host is away it is not forwarded, but the
+server keeps the latest one per slot for the host's resume. Send your current
+state right after every `joined`.
+
+### `msg`
+
+```json
+{"t":"msg","data":{"any":"json"}}
+```
+
+Delivered to the host as `message` with the pad's slot.
+
+## Server → pad
+
+### `joined`
+
+```json
+{"t":"joined","room":"KQZX","slot":1,"layout":{…},"pad":{"title":"Ryu","color":"#e5484d"}}
+```
+
+`pad` is the slot's current pad state. Sent again (same shape) when the host
+resumes with a different layout or with `resetPads`.
+
+### `pad`
+
+```json
+{"t":"pad","patch":{"highlight":["a"],"vibrate":200}}
+```
+
+### `message`
+
+```json
+{"t":"message","data":{"any":"json"}}
+```
+
+## Errors
+
+| Code | Fatal | When |
+|---|---|---|
+| `room-not-found` | no | `join` with an unknown room. |
+| `slot-taken` | no | Slot held by another token. Includes `free`. |
+| `bad-slot` | no | Slot is not an integer in 1..slots. |
+| `bad-message` | no | Invalid JSON, shape or values. Includes `message`. |
+| `replaced` | yes | Same host token or pad token connected again. |
+| `kicked` | yes | Host kicked this pad. |
+| `room-closed` | yes | Host gone for 60 s; room deleted. |
+| `version` | yes | `v` is not 1. |
+| `server-full` | yes | Room limit reached (1000 total, 20 per client address). |
+| `rate-limited` | yes | 20 failed joins from this client address in the last minute. |
+
+"Fatal" means the server closes the socket right after the error. Failed
+joins (the non-fatal join errors) count toward the 5-failure limit.
+
+## Host disconnects
+
+When the host socket closes, the room stays for 60 s. Pads stay connected
+(their input is dropped). A host that sends `create` with the same `room` and
+`hostToken` within that time resumes it; otherwise every pad gets
+`room-closed` and the room is deleted.

package/README.md

@@ -1,3 +1,283 @@
-# Temporary Holding Version
+# Joinstick
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Use phones as gamepads for browser games.** The game shows a QR code, each
+player scans it, and their phone becomes a controller. No accounts, no app
+install: one small self-hosted Node server and a few lines in your game. Made
+for local multiplayer and party games on a laptop or TV.
+
+[![npm](https://img.shields.io/npm/v/joinstick)](https://www.npmjs.com/package/joinstick)
+[![license: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+[![node >= 22](https://img.shields.io/badge/node-%3E%3D22-339933)](package.json)
+[![CI](https://github.com/raprav/joinstick/actions/workflows/ci.yml/badge.svg)](https://github.com/raprav/joinstick/actions/workflows/ci.yml)
+
+<p align="center"><a href="https://joinstick.fly.dev/demo/paint-party"><img src="https://raw.githubusercontent.com/raprav/joinstick/main/docs/hero.png" alt="Left: Paint Party on a TV mid-round, four paint blobs covering the floor and one QR code in the corner that every player scans. Right: a phone held sideways showing player 1's orange pad with a d-pad and BOMB and DASH buttons." width="800"></a></p>
+
+**[Live demo: Paint Party](https://joinstick.fly.dev/demo/paint-party)**. Open it on a big screen and scan the QR
+with phones: one QR for everyone, drop in or out anytime, 1-8 players, haptics
+on Android. Its source is a single file in
+[`examples/paint-party`](examples/paint-party) that uses only the public SDK.
+
+## Quick start
+
+Save this as `my-game/index.html`:
+
+```html
+<!doctype html>
+<meta charset="utf-8">
+<img id="qr" width="240">
+<script type="module">
+  import { host } from '/joinstick/host.js';
+  const room = await host({ slots: 2 });          // default pad: d-pad + A, B
+  document.getElementById('qr').src = room.qr();  // every player scans this
+  (function frame() {
+    const p1 = room.input(1);                     // { x, y, buttons, pressed }, never undefined
+    if (p1.pressed.a) console.log('jump!');       // x, y in [-1, 1]; pressed = went down since last read
+    requestAnimationFrame(frame);
+  })();
+</script>
+```
+
+Then run (Node 22 or newer):
+
+```sh
+npx joinstick --static ./my-game
+```
+
+Open `http://localhost:3000` on the computer, scan the QR with a phone on the
+same Wi-Fi, and press A. Embedding in your own Node server or using
+TypeScript: `npm i joinstick`. A complete example game is in
+[`examples/basic`](examples/basic).
+[`examples/paint-party`](examples/paint-party) is a party game for 1-8 phones
+that join and leave at any time through one QR code
+([play it live](https://joinstick.fly.dev/demo/paint-party): open it on a big
+screen, then scan the QR with phones).
+
+### Using a bundler or your own dev server
+
+Run Joinstick on its own port next to your dev server (Vite, webpack...) and
+tell the SDK where it is:
+
+```sh
+npm i joinstick
+npx joinstick                 # Joinstick alone on :3000
+```
+
+```js
+import { host } from 'joinstick/host'; // typed
+
+const room = await host({ slots: 2, server: `http://${location.hostname}:3000` });
+```
+
+QR codes then point at that server. If your dev server uses HTTPS, Joinstick
+needs HTTPS too (see Self-hosting).
+
+## How it works
+
+```
+  laptop / TV                     Joinstick server                 phones
+ ┌─────────────┐   WebSocket    ┌──────────────────┐  WebSocket   ┌──────────┐
+ │ your game   │ ◄────────────► │ rooms, relay,    │ ◄──────────► │ pad page │
+ │ + host.js   │  input, joins  │ QR codes, pad    │  pad state   │ /j/KQZX/1│
+ └─────────────┘                │ page, SDKs       │              └──────────┘
+                                └──────────────────┘
+```
+
+The game creates a room (`KQZX`) with up to 8 player slots. One QR code opens
+`/j/KQZX` on any phone, which takes the first free slot (`/j/KQZX/<slot>` asks
+for a specific one). The phone sends its controller
+state on every change; your game reads `room.input(n)` once per frame. All
+traffic goes through your server; nothing leaves your network unless you put
+it on the internet.
+
+## Features
+
+- **Zero install for players**: a QR code (or `http://<laptop-ip>:3000/j` and
+  a 4-letter code) opens the controller in the phone's browser.
+- **Small and self-hosted**: one Node process, two runtime dependencies
+  (`ws`, `uqr`), plain ES modules in the browser, no build step.
+- **Reconnects automatically**: phones that lock or drop Wi-Fi leave and rejoin
+  their own slot; game page reloads and server restarts keep the room code.
+  Your game gets `join`/`leave` events to pause and resume.
+- **Configurable pad**: d-pad plus up to 8 buttons with labels, colors and
+  sizes; the game can retitle, recolor, highlight or disable buttons live.
+- **Landscape by default**: held upright, the pad shows rotated, so it works
+  with the phone's rotation lock on (on Android Chrome the first tap also
+  tries fullscreen and an orientation lock).
+- **Haptics**: a short tick on every press (Android; best effort on iOS 18+,
+  see the FAQ), plus game-driven vibration on Android.
+- **Bring your own controller**: the pad is just one client of a documented
+  JSON/WebSocket protocol; `client.js` lets you build your own or drive pads
+  from tests.
+
+## Pad layouts
+
+```js
+await host({
+  slots: 2,
+  layout: {
+    arrangement: 'arc',               // 'grid' (default) | 'diamond' | 'arc'
+    buttons: [
+      { id: 'punch', label: 'PUNCH' }, // in 'arc' the first button is the big one
+      { id: 'kick', label: 'KICK' },
+      { id: 'ult', label: 'ULT', size: 'large' },
+      { id: 'block', label: 'BLOCK', size: 'wide' },   // a bar to rest a thumb on
+      { id: 'start', label: 'START', system: true },   // a pill in the top bar
+    ],
+  },
+});
+```
+
+<p align="center"><img src="https://raw.githubusercontent.com/raprav/joinstick/main/docs/layouts.png" alt="Four pad screenshots: grid, diamond, arc, and arc with a wide BLOCK bar. Each has a d-pad on the left and a START pill in the top bar." width="800"></p>
+
+Also: `stick: 'none'` (buttons only), `orientation: 'landscape' | 'portrait' |
+'any'`, `haptics: false`, per-button `color` and `haptic` (ms). Taps between
+buttons go to the nearest one, and several fingers work at once (move, hold
+a button, tap another). Full schema in [AGENTS.md](AGENTS.md#5-layout).
+
+## API in one screen
+
+| Game side (`/joinstick/host.js`) | |
+|---|---|
+| `host({ slots, layout, server })` | Create (or after a reload, resume) a room. `server` is the Joinstick URL when the game is served elsewhere. |
+| `room.input(n)` | `{ x, y, buttons, pressed }` for player `n`. Read it every frame. |
+| `room.qr(n?)`, `room.joinUrl(n?)` | QR image URL and plain join link for player `n`. Without `n`: one link for everyone, each phone gets the first free slot. |
+| `room.connected(n)`, `room.on('join' \| 'leave', fn)` | Who is here; pause when someone drops. |
+| `room.pad(n, { title, color, highlight, disabled, vibrate })` | Change what a phone shows. |
+| `room.send(n, data)`, `room.broadcast(data)`, `room.on('message', fn)` | Custom messages both ways. |
+| `room.kick(n)`, `room.close()` | Remove a player; end the room. |
+| `room.on('status' \| 'error', fn)` | Connection to the server (`connected`, `reconnecting`...) and fatal errors. |
+
+| Server side (`import { attach } from 'joinstick'`) | |
+|---|---|
+| `attach(httpServer, { static, publicUrl })` | Add Joinstick to your own Node HTTP server. |
+
+Types: [`host.d.ts`](public/host.d.ts), [`client.d.ts`](public/client.d.ts),
+[`server.d.ts`](src/server.d.ts). Wire protocol: [PROTOCOL.md](PROTOCOL.md).
+Everything else (input contract, pausing, error codes, testing without
+phones): [AGENTS.md](AGENTS.md).
+
+## CLI
+
+```
+joinstick [--port 3000] [--static ./dir] [--public-url URL] [--client-ip-header NAME] [--version]
+```
+
+| Flag | Env | |
+|---|---|---|
+| `--port` | `PORT` | Port to listen on. Default 3000. |
+| `--static <dir>` | | Also serve your game from this directory. |
+| `--public-url <url>` | `PUBLIC_URL` | Origin that QR codes and join links use (no path). Default: the host the game page connected with, unless it is `localhost`/loopback; then the detected LAN address. |
+| `--client-ip-header <name>` | `CLIENT_IP_HEADER` | Header a reverse proxy sets to the visitor's address (`fly-client-ip`, `x-real-ip`). The per-address limits use it instead of the proxy's address. Only set it behind a proxy that overwrites the header. |
+| `-v`, `--version` | | Print the version. |
+
+## Self-hosting
+
+- **LAN (the usual case)**: run it on the laptop that shows the game. Phones
+  on the same Wi-Fi open the printed "Phones join at" URL. Plain HTTP is fine.
+- **Behind a reverse proxy with TLS**: proxy everything (or at least `/j`,
+  `/joinstick/`) to Joinstick, let the proxy pass WebSocket upgrades on
+  `/joinstick/ws`, and start Joinstick with `--public-url https://your.domain`
+  so QR codes point at the public address. Behind a proxy every game shares
+  the proxy's IP address, so the 20-rooms-per-IP cap applies to all of them
+  together unless you pass `--client-ip-header` with a header your proxy
+  overwrites with the visitor's address (Fly.io: `fly-client-ip`).
+  With Caddy (which passes WebSockets through by default):
+
+  ```
+  your.domain {
+    reverse_proxy localhost:3000
+  }
+  ```
+
+- **Docker**: the repo has a small [Dockerfile](Dockerfile) (non-root,
+  Node 22 Alpine; it is not in the npm package). Inside a container the LAN
+  address cannot be detected, so pass `--public-url`. From a clone of the repo:
+
+  ```sh
+  docker build -t joinstick .
+  docker run --rm -p 3000:3000 -v "$PWD/my-game:/site:ro" joinstick \
+    --static /site --public-url http://<your-lan-ip>:3000
+  ```
+
+## Remote play
+
+What works today: put the server on a public URL (a tunnel such as
+`cloudflared tunnel --url http://localhost:3000`, or a reverse proxy) and pass
+that URL as `--public-url`. Remote phones then join like local ones.
+
+What it does not do: Joinstick only carries controller input. Remote players
+still need to see the game (screen sharing, a video call). Input is relayed
+through your server, not peer to peer, so each remote player adds their
+network delay to the server.
+
+Security on a public URL, plainly:
+
+- The room code is the only credential. Codes are 4 letters from 20
+  consonants, so 160,000 possible codes. Anyone who guesses a live code can
+  take a **free** slot (a taken slot also needs that phone's secret token).
+- Guessing is slowed down: after 20 failed joins in a minute, an address is
+  refused for the rest of that minute (not counted in the first minute after
+  the server starts, while phones rejoin). Behind a tunnel or proxy every phone
+  shares the proxy's address, so a guesser also delays real players by up to
+  a minute.
+- The server does not check the `Origin` header: any web page that knows the
+  server's address can open a connection to it, like any other client.
+
+Fine for playing with friends; not for anything secret.
+
+## For AI coding agents
+
+Point your agent at [AGENTS.md](AGENTS.md): integration checklist, full API,
+input contract, pitfalls, and how to test with scripted pads instead of
+phones. A running server also serves a condensed version at `/llms.txt`.
+
+## FAQ
+
+**The phone can't connect.** It must reach the laptop: same Wi-Fi, and allow
+Node through the firewall prompt on first run (macOS/Windows). Guest, hotel
+and office networks often isolate devices; use a phone hotspot or a tunnel.
+If the printed "Phones join at" URL doesn't open on the phone, nothing else will.
+
+**Do players need the same Wi-Fi?** For local play, yes (or any network where
+the phone can reach the server). For remote play, see above.
+
+**Does vibration work on iPhone?** Partly. Android gets tap feedback and
+game-driven vibration. iOS Safari has no vibration API; on iOS 18+ the pad
+plays the system's single haptic tick on presses as a best effort (length is
+ignored, game-driven vibration does nothing). Older iOS and desktops: none.
+
+**How much latency?** Input is sent the moment it changes, with no polling or
+batching. On a LAN the delay is about one Wi-Fi hop from the phone to the
+laptop. The server's own relay is small: measured on loopback (pad socket to
+server to game socket, same machine, 500 inputs) the median was 0.06 ms. We
+have not published phone-to-screen numbers.
+
+**Which browsers?**
+
+| | Chrome / Android | Safari / iOS | Firefox | Samsung Internet |
+|---|---|---|---|---|
+| Phone pad | 87 | 14.5 | 79 | 14 |
+| Game page (`host.js`) | 93 | 15.4 | 92 | 17 |
+
+Derived, not tested on each version: these are the first versions that
+support the newest feature each side needs, looked up in MDN's
+[browser-compat-data](https://github.com/mdn/browser-compat-data) 8.1.4. Pad:
+CSS `inset` (Chrome 87, iOS 14.5), `??=` (Firefox 79), plus Pointer Events,
+ES modules and WebSocket. Game page: `Object.hasOwn` in `host.js`; the
+Quick start snippet also uses top-level `await` (Chrome 89, Safari 15,
+Firefox 89). Newer browsers additionally get `color-mix()` colors (Chrome 111,
+Safari 16.2, Firefox 113); older ones show plainer colors. The iOS haptic tick
+needs iOS 18.
+
+**Limits?** 8 players per room, 8 buttons per pad, 1000 rooms per server
+(20 per IP address), 8 KB per message. A room closes 60 s after the game page
+goes away.
+
+**HTTPS game page?** A page served over HTTPS cannot open a plain `ws://`
+connection. Serve the game with `--static`, or put both behind HTTPS.
+
+## License
+
+[MIT](LICENSE) © 2026 Rafa Prats. Third-party notices:
+[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+QR Code is a registered trademark of DENSO WAVE INCORPORATED.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,66 @@
+# Third-party notices
+
+Joinstick's own code is MIT licensed, © 2026 Rafa Prats (see [LICENSE](LICENSE)).
+Every file in `src/` and `public/` is original to this project.
+
+Joinstick does not bundle third-party code. It depends on the npm packages
+below, which npm installs next to it (the Docker image includes them). Both
+are MIT licensed; their notices follow.
+
+QR Code is a registered trademark of DENSO WAVE INCORPORATED.
+
+## ws
+
+https://github.com/websockets/ws (MIT)
+
+```
+Copyright (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
+Copyright (c) 2013 Arnout Kazemier and contributors
+Copyright (c) 2016 Luigi Pinca and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## uqr
+
+https://github.com/unjs/uqr (MIT; based on the QR Code generator library by Project Nayuki)
+
+```
+MIT License
+
+Copyright (c) Project Nayuki
+Copyright (c) 2023 Anthony Fu <https://github.com/antfu>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```