# Upstream Dependencies

## Portal
- Next.js 15 (App Router)
- TypeScript
- Axios (API calls)
- WebSocket console (`TerminalView` / `ServerConsole`)
- Multipart `FormData` upload

## API
- Node.js (ESM)
- Express
- Raw `http.request` for upload proxy (not `fetch`)
- Prisma (DB ORM)
- JWT token auth
- Redis (agent telemetry cache)

## Agent
- Go
- Runtime root sandboxing (`internal/files`)
- Atomic file writes (`os.Rename`)
- `.zlh_metadata.json` provenance tracking
- Shadow backup system (`.zlh-shadow`)
- PTY-backed console over WebSocket
- Mod management endpoints
- Agent update system (versioned, SHA-verified)

---

## Modrinth API

Used for mod resolution and search.

- Base: `api.modrinth.com/v2`
- Rate limit: 300 req/min
- Requires `User-Agent` header
- No API key required for public endpoints
- SHA512 provided on all artifacts (SHA1 fallback)

Agent host allowlist:
- `cdn.modrinth.com` — artifact downloads
- `api.modrinth.com` — search/resolve (API-level)

---

## Artifact Store

Location (VM filesystem): `/opt/zlh/zpacks/minecraft/`

Loader coverage:
- Vanilla, Paper, Purpur, Forge, Quilt, NeoForge

No external reverse proxy required for internal upload path.

---

## Repo Registry

| Repo | Role |
|------|------|
| `zlh-grind` | Architecture alignment, session logs, constraints, open threads |
| `zlh-api` | Control plane (Node + Express) |
| `zlh-portal` | Frontend (Next.js) |
| `zlh-agent` | Go runtime inside containers |
| `knowledge-base` | Canonical architecture docs |