QR reader (policy & empty state)
Scan results show text first; only http/https opens after an explicit click, unsafe schemes are refused, a missing code is a normal empty result, and leaving the page releases camera tracks.
Inputs and parameters
image— Upload an image with a QR codedecodedText— Decoded text (policy demo input)
Real example
decodedText=javascript:alert(1) or https://ailounge.top/ or (empty)
→ javascript: → text only, openable=false, no button; https:// → text plus a confirm button, opens only after click; empty/no code → normal empty result suggesting image upload.Limits and failure handling
html5-qrcode is not bundled; camera/image decoding untested. A missing code is a normal empty result, never an error; no URL opens automatically.
FAQ
Can it decode an uploaded image this round?
No. Zero dependencies and no browser: html5-qrcode is not bundled. The upload entry and policy are provided; no result is fabricated. Paste decoded text to verify text-first behaviour and the protocol whitelist.
When is camera permission requested?
Only on click; denial keeps upload available; leave/reset/pagehide stops the stream and releases tracks with the indicator off. The state machine is covered by node:test.