# t5de-hub

T5DE's hub (see README.md and docs/design.md). Related repositories, usually checked out beside this one: `t5de`
(patches), `t5de-proxy` (local proxy, Go; it signs in to the hub), `t5de-api` (shared definitions), later
`t5de-catalog`.

## Rules

- Never commit IMVU's code or captured traffic with account data. Our own declarations of IMVU's protocols and notes
  in our own words are fine.
- Test with a throwaway IMVU account, never a real one.
- Commits: author "dhkatz <dev@t5de.dev>"; never the user's real name or email.
- IMVU session keys never leave the user's machine; the hub never asks for them.

## Notes

- Stack (the user's choice, 2026-10-29): Bun, Elysia, Better Auth, Drizzle (Postgres; PGlite in development and
  tests), Next.js 16 with Tailwind 4 and shadcn/ui, Turborepo. Must stay self-hostable (docker compose) and deployable
  to Vercel/Heroku-style hosts. Go was used first and replaced.
- The website's look: modern and neutral, light/dark following the system, color only for status. Not IMVU Classic's
  style (T5DE's setup keeps that).
- Better Auth's tables must match its plugins: when changing plugins, compare with `getAuthTables` (Better Auth logs
  "Drizzle schema mismatch" otherwise), then `bun x drizzle-kit generate` in packages/db.
- Device sign-in: the person's viewing a code (`deviceVerify`) claims it, then `deviceApprove`; the hub's
  `/api/v1/device/approve` does both and logs it. Proxies' sessions are told apart by their User-Agent
  (`t5de-proxy...`).
- On this VM, Bun and Node are portable installs in `%LOCALAPPDATA%\Programs\bun` and `...\nodejs` (not on PATH; no
  `bunx`: use `bun x`).
- Calls to IMVU (`apps/api/src/imvu.ts`, its public API) are rare and rate-limited: linking, age re-checks, rooms,
  and the IMVU products T5 products derive from (`parent_info`, looked up once per revision).