[!WARNING] This package is in a very early stage of development and is only published for pre-saving the name from being taken by somebody else. This release uses version 0.0.2.

zforge

The internal development toolkit for Zdev. zforge provides the foundational infrastructure for developer tools, including the shared dev server, dev-client injection, and the devtools module registry.

Core Capabilities

• Shared Dev Server: Orchestrates a single devtools server that can handle multiple Zdev applications simultaneously.
• Client Injection: Automatically injects development scripts and overlays into HTML responses during development mode.
• Module Registry: A flexible system to register and manage devtools modules, complete with API and WebSocket handlers.
• Event Bus: A robust event broadcaster for hot-updates and real-time communication between the server and the browser.
• Security: Integrated with @zeruxjs/security to ensure devtools access is authorized and safe.

Key APIs

App Registration

import { registerSharedDevApp } from 'zforge';

const devInfo = await registerSharedDevApp({
    appName: 'my-app',
    appPort: 3000,
    rootDir: process.cwd()
});

Client Injection

import { injectDevClient } from 'zforge';

const polyfilledHtml = injectDevClient(originalHtml, {
    routeName: 'my-app',
    devServerUrl: 'http://localhost:4000'
});

Module Definition

import { defineDevtoolsModule } from 'zforge';

export default defineDevtoolsModule({
    name: 'my-module',
    // ... config and handlers
});

Internal Architecture

zforge is designed to be the "brain" behind the Zdev development experience. It manages the lifecycle of the dev server and provides the bridge between the framework's internal services and the developer-facing dashboard.

Request boundaries (Section 7)

The HTTP devtools server enforces a 1 MiB streamed request-body limit via src/request.ts, with cleanup on completion, failure, or aborted requests. Local development hostname checks reject crafted authorities. Focused tests: node --test test/request.test.mjs after building. Devtools should be restricted to trusted networks; configure firewall and proxy access appropriately.

Security and live reload diagnostics

The shared development server is loopback-only by default. To listen on a different interface, set ZDEV_BIND_HOST only with trusted access controls, such as an authenticated reverse proxy. Devtools and its APIs are not an Internet-facing administration service.

State and registry JSON files are private, bounded, atomic and reject symlink destinations. Client HTML injection escapes script-breaking values. Snapshot and bootstrap JSON include a reload status object containing the attempt count, generation and last failure message when available.

Release 0.0.2

Prepared to validate npm trusted publishing through GitHub Actions.

Release 0.0.3

Synchronized ecosystem release, including Zuixs CSS-entry support and documentation updates. Existing placeholder packages retain their documented limitations.