Room channel and rooms list

The realtime connection now carries the IMVU chats a client is in: the hub tells each proxy in a chat which
other T5DE users are there and what community products they wear (adult products only to adult accounts), on
joining and on every change. Rooms T5DE users enter are looked up on IMVU; those that are public, listed and
whose owner turned on "List my public rooms" appear on the new Rooms page, with the T5DE users in them who
show they're online. AP rooms are shown to adults only.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/api.md

@@ -29,7 +29,7 @@ is. Codes: `invalid`, `signed_out`, `forbidden`, `not_found`, `no_such_imvu_acco
 | `POST /api/auth/device/code` | `{client_id: "t5de-proxy"}` → `{device_code, user_code, verification_uri, verification_uri_complete, interval, expires_in}` (RFC 8628). `verification_uri` is the website's `/device`. |
 | `POST /api/auth/device/token` | `{grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code, client_id}` → `{access_token}` (a session token, used as a bearer token) or `{error: authorization_pending \| slow_down \| expired_token \| access_denied}` |
 | `POST /api/v1/device/approve` | (website, signed in) `{code}`: signs the waiting proxy in as this person |
-| `GET /api/v1/realtime` | WebSocket, bearer token. Protocol in `apps/api/src/realtime.ts`. |
+| `GET /api/v1/realtime` | WebSocket, bearer token: presence, outfits, and the room channel. Protocol in `apps/api/src/realtime.ts`. |
 | `GET /.well-known/jwks.json` | the Ed25519 keys JWTs are signed with |
 
 ## Website routes (signed in unless noted)
@@ -39,11 +39,12 @@ is. Codes: `invalid`, `signed_out`, `forbidden`, `not_found`, `no_such_imvu_acco
 | `GET /api/v1/home` | (anyone) `{onlineCount, links?}` |
 | `GET /api/v1/online` | (anyone) `{online}`: accounts showing they're online (moderators see all, with `hidden`) |
 | `GET /api/v1/online/events` | (anyone) server-sent events: `online` with `{online}` now and on each change |
+| `GET /api/v1/rooms` | (anyone) `{rooms}`: listed IMVU rooms of T5DE users, with the T5DE users in each now (AP rooms for adults only) |
 | `GET /api/v1/account` | `{person, links, challenges, computers, canLink}` |
 | `POST /api/v1/account/links` | `{username}` → 201 `{challenge}` (the tagline code) |
 | `POST /api/v1/account/links/:imvu/check` | `{link, moved}` |
 | `DELETE /api/v1/account/challenges/:imvu` | cancel linking |
-| `PATCH /api/v1/account/links/:imvu` | `{showBadge?, showPresence?}` → `{link}` |
+| `PATCH /api/v1/account/links/:imvu` | `{showBadge?, showPresence?, listRooms?}` → `{link}` |
 | `POST /api/v1/account/links/:imvu/recheck` | `{link}` (age checked with IMVU again) |
 | `DELETE /api/v1/account/links/:imvu` | unlink |
 | `POST /api/v1/account/signout-computers` | signs T5DE out on all their computers |

docs/design.md

@@ -243,6 +243,20 @@ number, `productdata/<id>/<revision>/`) but hardly shows them; T5DE shows them o
 3. Other T5DE users' proxies add the items to that user's incoming `*use`, filtered by their own age settings.
    Non-T5DE users see the default.
 
+How it's built (2026-10-29):
+- The proxy sees the client's IMQ subscriptions to chat queues (`/chat/<id>`) and tells the hub which chats it's
+  in; for a room's chat, also the room (from `chat.getOrMakeChat`, `activity: publicroom-<owner>-<n>`).
+- The hub tells each proxy in a chat about the other T5DE users there and what they wear (adult products only to
+  clients whose account counts as adult), on joining and on every change.
+- The proxy delivers `*use` / `*remove` lines from those users to the client (IMQ messages of its own, without a
+  sequence number, which the client doesn't track), and adds their community products to the whole outfits they
+  send (`*use` with the body, re-sent on joins and every 30 s or so), which would otherwise put IMVU's back.
+- Products the viewer has no pack for are skipped (logged), until catalogs serve them.
+- The client also posts its outfit to IMVU's chat participant endpoint (`legacy_outfit_message`); the proxy takes
+  community products out of it and re-signs it.
+- Anyone signed in can say they're in a chat; what they learn is what T5DE users in it wear, which anyone in the
+  chat sees anyway.
+
 Saved outfits are per IMVU account (avatars differ). The library (products added, favorites, followed creators)
 is per person, shared across their accounts.
 
@@ -257,6 +271,12 @@ is per person, shared across their accounts.
 - **Chat retention** (**Decided**): not stored by default. When someone reports a conversation, the recent messages
   around the report are kept as evidence for 30 days, then deleted.
 - Room shells and furniture are ordinary products.
+- **Rooms list** (2026-10-29, the user's request): the hub's Rooms page lists IMVU rooms of T5DE users that are
+  public, listed and not expired on IMVU (`privacy: public`, `type: listed`), and whose owner turned on "List my
+  public rooms" for that IMVU account (off by default, like the badge). IMVU's public API can't list a user's rooms,
+  so the hub learns of a room when a T5DE user enters it, asks IMVU about it, and asks again hourly while it's
+  used; rooms nobody entered for 30 days drop off. AP rooms are shown only to people with an adult account. Each
+  shows the T5DE users in it now who show they're online.
 
 ## Presence and badge (**Decided**: both opt-in, per IMVU account)
 
@@ -363,9 +383,10 @@ The proxy streams and adds no waiting.
 ## Status
 
 - Phase 1 (local packs) done: t5de-api, t5de-proxy `internal/products`.
-- Phase 2 (hub identity) under way: accounts, tagline linking, age, link caps, device sign-in, presence and badge,
-  console. Not yet: periodic age re-checks (on demand only), a sign-in button in the client (the proxy's `signin`
-  command for now), deployment.
+- Phase 2 (hub identity) under way: accounts, tagline linking, age (vendor-neutral, IMVU's re-checked daily), link
+  caps, device sign-in, presence and badge, console, the room channel and the rooms list. Not yet: a sign-in button
+  in the client (the proxy's `signin` command for now), deployment, hosted rooms. The room channel is tested with
+  fake proxies and one live client; two live clients need a second throwaway account.
 - **Stack changed** (2026-10-29, the user's choice): the hub is a Bun monorepo: Elysia API, Better Auth, Drizzle on
   Postgres, Next.js website with Tailwind and shadcn/ui (README). It replaces the first version, in Go. Where this
   document says Go or templ for the hub, read that; catalogs are still to be decided (a Bun program compiled to one