One service, distinct responsibilities #
The current deployment is a FastAPI service with persistent SQLite and self-hosted browser assets. The dashboard and docs are normal HTML; character/campsite presentation uses pinned Phaser4.2.1. There is no separate custom3D engine.
WEBSITEDashboardCreator & player controls
TWITCHNative panelLinked viewer + channel
PHASERRaidervilleAccepted room state
Persistent SQLite storageShared appearance / community-owned gameplay records
| Layer | Owns | Does not own |
|---|---|---|
| Twitch | Verified platform identity and approved platform integrations | Community inventory, combat results or our XP rules |
| FastAPI | Authentication, community binding, validation, accepted mutations and room lifecycle | Client-supplied grants or client-decided rewards |
| SQLite | Player/community records, shared appearance, scoped gear/progression and session data | Browser layout or animation state |
| Browser / Phaser | Inputs, previews, interpolation and rendering accepted state | Authoritative identity, inventory or rewards |
Where to work #
| Concern | Source seam |
|---|---|
| Application and routes | app/main.py, app/config.py |
| Website identity/community context | app/auth.py, app/player_login.py, app/player_context.py |
| Shared appearance and community inventory | app/player_appearance.py, app/outfits.py, app/viewer_inventory.py |
| Native panel | app/extension_auth.py and app/static/extension/ |
| Raiderville | app/raiderville.py, app/raiderville_web.py and app/static/raiderville/ |
| Chat permission setup | app/chat_authorization.py; transport activation is separate |
Current runtime limits #
The runtime command uses one worker. Pending account-login intents and streamer activity/live caches include process-local state; this is not a claim of multi-instance readiness. Do not increase workers or split services without reviewing those ownership and persistence boundaries.
The API and creator website use separate configured origins. The Extension uses its own approved origins and cookie-free viewer requests. The docs hostname is read-only public content, not another authenticated API origin.