Document community products

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CLAUDE.md

@@ -24,3 +24,11 @@ in the `t5de` repository (git.t5de.dev/t5de/t5de, usually checked out beside thi
 - t5de's `tools/drive.py` starts the built client, takes screenshots, clicks, and sends `imvu:` commands
   (`showMode?mode=shop`, ...), so the proxy can be tested in the real client without a person; the test
   account's saved login signs in by itself. The log is `%TEMP%\t5de-proxy.log`.
+- Community products (README): `internal/products`. What the client needs was worked out from captures
+  (t5de-hub's `docs/imq-rooms.md` and this repo's README): a product's CFL holds `index.xml` (deriving from a
+  parent with `__DATAIMPORT product://<id>/index.xml`), materials and textures; `_contents.json` would make the
+  client fetch files separately, so packs don't use it. Outfit saves happen only from some modes (Dress Up, not
+  rooms). Test packs (never committed: they're built on IMVU products' templates) live outside the repo; tests use
+  synthetic files.
+- Debugging: `-trace` (or `T5DE_PROXY_TRACE=1`) logs full URLs and IMQ frame types; changes to community products
+  are logged as `products: ...`.

README.md

@@ -12,6 +12,8 @@ connects to IMVU through it:
   gateway over TLS.
 - **IMVU's reporting endpoints refused**, as T5DE's patches already do in the client.
 
+- **Community products** from local packs (t5de-api's pack format), kept away from IMVU (below).
+
 If the proxy isn't there or stops, the client connects directly, as before.
 
 Unofficial: not made by or affiliated with IMVU.
@@ -32,6 +34,27 @@ The client starts it as `t5de-proxy -parent <pid> -ready <file> -log %TEMP%\t5de
 address and token to the ready file once listening, and exits with the client. Setting `T5DE_PROXY_TRACE=1`
 before starting the client adds full URLs (with queries) and every IMQ frame to the log.
 
+## Community products
+
+Phase 1 of T5DE's community products (design: t5de-hub's `docs/design.md`): products in local packs, a folder
+each, in `%APPDATA%\T5DE\packs` and the folders in `T5DE_PACKS` (separated by `;`). Each product gets a local ID
+from 2,000,000,000 up, kept in `%APPDATA%\T5DE\proxy\products.json`. For those IDs the proxy answers the client
+itself:
+
+- `test.inventoryProductBatch` (product info) and `test.authorizeProducts2` (permission, the CFL's address and
+  checksum): for a product deriving from an IMVU product, IMVU is asked about the parent and the proxy adds its own
+  entry (the client needs the parent's derivation chain).
+- `productdata/<local ID>/<revision>`: the pack built into a CFL.
+- `api/shop/product.php` (putting a product on asks whether it's a bundle).
+
+IMVU never sees community products: they're taken out of outfit saves (`api/base_look.php`) and outfit chat
+commands (`*use`, `*putOn`, `*putOnOutfit`, `*remove`, `*takeOff` on `/chat/` queues; a command left empty is
+answered by the proxy), so IMVU and everyone else see the defaults. The proxy remembers each account's community
+products with the outfit they were saved with, and adds them back when the client loads that same outfit
+(`base_look.php`, and `look` in the login response); an outfit changed elsewhere comes back without them.
+Requests it changes are re-signed (`X-imvu-auth`) with the session key from the login response, which never
+leaves the machine.
+
 ## Building
 
     go test ./...