Document community products

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -12,6 +12,8 @@ connects to IMVU through it:
   gateway over TLS.
 - **IMVU's reporting endpoints refused**, as T5DE's patches already do in the client.
 
+- **Community products** from local packs (t5de-api's pack format), kept away from IMVU (below).
+
 If the proxy isn't there or stops, the client connects directly, as before.
 
 Unofficial: not made by or affiliated with IMVU.
@@ -32,6 +34,27 @@ The client starts it as `t5de-proxy -parent <pid> -ready <file> -log %TEMP%\t5de
 address and token to the ready file once listening, and exits with the client. Setting `T5DE_PROXY_TRACE=1`
 before starting the client adds full URLs (with queries) and every IMQ frame to the log.
 
+## Community products
+
+Phase 1 of T5DE's community products (design: t5de-hub's `docs/design.md`): products in local packs, a folder
+each, in `%APPDATA%\T5DE\packs` and the folders in `T5DE_PACKS` (separated by `;`). Each product gets a local ID
+from 2,000,000,000 up, kept in `%APPDATA%\T5DE\proxy\products.json`. For those IDs the proxy answers the client
+itself:
+
+- `test.inventoryProductBatch` (product info) and `test.authorizeProducts2` (permission, the CFL's address and
+  checksum): for a product deriving from an IMVU product, IMVU is asked about the parent and the proxy adds its own
+  entry (the client needs the parent's derivation chain).
+- `productdata/<local ID>/<revision>`: the pack built into a CFL.
+- `api/shop/product.php` (putting a product on asks whether it's a bundle).
+
+IMVU never sees community products: they're taken out of outfit saves (`api/base_look.php`) and outfit chat
+commands (`*use`, `*putOn`, `*putOnOutfit`, `*remove`, `*takeOff` on `/chat/` queues; a command left empty is
+answered by the proxy), so IMVU and everyone else see the defaults. The proxy remembers each account's community
+products with the outfit they were saved with, and adds them back when the client loads that same outfit
+(`base_look.php`, and `look` in the login response); an outfit changed elsewhere comes back without them.
+Requests it changes are re-signed (`X-imvu-auth`) with the session key from the login response, which never
+leaves the machine.
+
 ## Building
 
     go test ./...