support for 202507 endpoints (#37)

* [auth][api] accept the 20250424.01 client

* [2025] unstable

* 20250718.0

* correct one this time

* stubs

* more stubs

* more stubs

* [lists] add worker

* [ai] route stubs

* [api] player photo setting

* [econ] add roomEconConfig route

* [infra] update worker generators

* [worker] add cards/moderation/platformnotification workers

* [lists] updates to some endpoints

* [clubs] stub out announcement endpoint, for now

* [econ] stub out season endpoints for now

* [chat] apps/chat stub out party endpoint not sure the shape yet

* [api] stub out statsig and lockeditems

* [doc] new services

* [lists] stub the bulk endpoint

* [datacollection] add placeholder service until we can kill it

* [api] set gifting to lvl5

* update lock

* [cdn] enable cache

* [match] matchmake v2

* [lists] stub some lists

* [ai] stubs

* [rooms] new subroom save endpoint

* [econ] add bulk purchase endpoint

* [discovery] update featured creator to 1 for fun

* [api] add photo settings flag

* [chat] fixup chat permissions (sorta)

* [auth] restrictions endpoint

* [rooms] contributed endpoint

* [api] fix outfit endpoint

* [discovery] attempt to fix store

* [chat] privacy endpoints

* [api] cheered images

* [rooms] add xp endpoint (disbaled)

* [rooms] add xp endpoint (disabled)

* update images-db for cheers

* [rooms] add autocomplete endpoint

* [cdn/img] increase cache ttl for statics

* [api] bulk route for images

* [accounts] add banner image

* [api] add misc missing endpoints

* [discovery] remove AI tab

* [platformnotifications] stub some endpoints

* [lists] add some more lists

* [rooms] additional endpoints

* [chat] stub a few privacy endpoints

* [econ] stub some endpoints

* misc db fixes

* [api] tweak shape for images v6

* [rooms] dont show trending RROs

apps/accounts/src/accounts.app.ts

@@ -25,6 +25,7 @@ import { validateAndGetAccountId } from '@repo/jwt'
 import { NotificationType } from '../../notify/src/notification-types'
 import {
 	AccountDto,
+	BannerImageRequest,
 	BioRequest,
 	BioResponse,
 	CreateAccountRequest,
@@ -108,6 +109,10 @@ function toAccountDto(account: Account) {
 		username: account.username,
 		displayName: account.displayName,
 		profileImage: account.profileImage,
+		// Nothing writes these yet, and rows stored before they existed have neither
+		// key — always emit them as "" rather than letting them go missing.
+		bannerImage: account.bannerImage ?? '',
+		displayEmoji: account.displayEmoji ?? '',
 		isJunior: account.isJunior,
 		platforms: account.platforms,
 		personalPronouns: account.personalPronouns,
@@ -657,6 +662,41 @@ const app = new Hono<App>()
 		}
 	)
 
+	// The profile banner — the wide image behind the header on a player's profile. Same
+	// shape as the avatar below: the body names an image the player has already uploaded
+	// (the client posts one of their own photos, `sharecamera/<date>/<uuid>.jpg`), so this
+	// stores a key and never bytes.
+	//
+	// Broadcasts the AccountUpdate like every other profile mutation here — the banner rides
+	// along in the DTO payload, so anyone looking at the profile redraws it without a refetch.
+	.put(
+		'/account/me/bannerimage',
+		describeRoute({
+			tags: ['Profile'],
+			summary: 'Set profile banner image',
+			description:
+				'Persists the banner object key and broadcasts it in the AccountUpdate payload. The ' +
+				'key names an image the player already uploaded — typically one of their own photos ' +
+				'(`sharecamera/…`) — so nothing is uploaded here.',
+			security: AUTHED,
+			requestBody: form(BannerImageRequest, 'The banner object key'),
+			responses: {
+				200: json(SuccessResponse, 'Updated'),
+				400: { description: 'Empty imageName (empty body)' },
+				401: UNAUTHORIZED_RESPONSE,
+			},
+		}),
+		async (c) => {
+			const id = await authedId(c)
+			if (id === null) return unauthorized(c)
+			const imageName = await formField(c, 'imageName')
+			if (!imageName) return c.body(null, 400)
+			const account = await updateAccount(c.env.DB, id, { bannerImage: imageName })
+			await pushAccountUpdate(c, account)
+			return c.json({ success: true })
+		}
+	)
+
 	.put(
 		'/account/me/profileimage',
 		describeRoute({

apps/accounts/src/openapi.ts

@@ -67,6 +67,10 @@ export const AccountDto = z.object({
 	username: z.string(),
 	displayName: z.string(),
 	profileImage: z.string().describe('Avatar object key'),
+	bannerImage: z.string().describe('Profile banner key — always "" (nothing sets it yet)'),
+	displayEmoji: z
+		.string()
+		.describe('Emoji beside the display name — always "" (nothing sets it yet)'),
 	isJunior: z.boolean(),
 	platforms: z.int().describe('PlatformType bitmask of linked platforms'),
 	personalPronouns: z.int().describe('Pronoun flags bitmask'),
@@ -156,7 +160,8 @@ export const CreateAccountRequest = z.object({
 
 /** Zod check that defers to the shared name rule, message and all. */
 const nameCheck = (label: string, max: number) =>
-	z.string()
+	z
+		.string()
 		.trim()
 		.superRefine((value, ctx) => {
 			const rejection = nameRejection(value, label, max)
@@ -172,9 +177,7 @@ export const DisplayNameRequest = z.object({
 export const UsernameRequest = z.object({
 	username: nameCheck('username', MAX_USERNAME_LENGTH)
 		.min(1, 'You must enter a username.')
-		.describe(
-			'Trimmed; letters and digits only, max 50. Must be unique and changes must remain'
-		),
+		.describe('Trimmed; letters and digits only, max 50. Must be unique and changes must remain'),
 })
 
 export const EmailRequest = z.object({
@@ -207,3 +210,12 @@ export const BioRequest = z.object({
 export const ProfileImageRequest = z.object({
 	imageName: z.string().describe('Avatar object key; empty is rejected (400)'),
 })
+
+/**
+ * `PUT /account/me/bannerimage` form body. The key of an image the player already
+ * uploaded — the client posts a `sharecamera/<date>/<uuid>.jpg` key, i.e. one of their own
+ * photos — so this only names an image, it never carries one.
+ */
+export const BannerImageRequest = z.object({
+	imageName: z.string().describe('Banner object key; empty is rejected (400)'),
+})

apps/accounts/src/test/integration/api.test.ts

@@ -164,6 +164,10 @@ describe('auth-gated endpoints', () => {
 			// An unset email is "", not null — the client reads it as a string, and the
 			// hub frame this DTO also rides drops null values outright.
 			email: '',
+			// Nothing sets these yet, but the key has to be present — the client reads
+			// both off the account DTO.
+			bannerImage: '',
+			displayEmoji: '',
 		})
 		// juniorState + parentAccountId must be omitted when null, not emitted as
 		// null, or the client's enum parser throws on `juniorState`. `phone` isn't
@@ -297,6 +301,46 @@ describe('auth-gated endpoints', () => {
 		expect(((await me.json()) as { profileImage: string }).profileImage).toBe('deadbeef.jpg')
 	})
 
+	test('PUT /account/me/bannerimage persists the banner and pushes the profile update', async () => {
+		type Sent = { playerId: number; notificationType: string | number; data: unknown }
+		const hub = () => env.RECFLARE_NOTIFICATIONS_HUB.getByName('global')
+		await hub().fetch('http://do/', { method: 'DELETE' })
+
+		const key = 'sharecamera/2026-08-18/75c295fd-8f1b-402e-961d-5c277fd56690.jpg'
+		const res = await exports.default.fetch(`${ORIGIN}/account/me/bannerimage`, {
+			...form({ imageName: key }),
+			headers: { ...(await bearer('778')), 'Content-Type': 'application/x-www-form-urlencoded' },
+		})
+		expect(res.status).toBe(200)
+		expect(await res.json()).toEqual({ success: true })
+
+		// Stored on the account, and served back by both the self and public reads.
+		const me = await exports.default.fetch(`${ORIGIN}/account/me`, { headers: await bearer('778') })
+		expect(((await me.json()) as { bannerImage: string }).bannerImage).toBe(key)
+		const pub = await exports.default.fetch(`${ORIGIN}/account/778`)
+		expect(((await pub.json()) as { bannerImage: string }).bannerImage).toBe(key)
+
+		// And the profile-update notification fired, carrying the new banner — so anyone
+		// looking at the profile redraws it without refetching.
+		const sent = (await (await hub().fetch('http://do/all')).json()) as Sent[]
+		expect(sent.length).toBeGreaterThan(0)
+		expect(sent.every((n) => n.playerId === 778)).toBe(true)
+		expect(sent.map((n) => (n.data as { bannerImage?: string }).bannerImage)).toContain(key)
+	})
+
+	test('PUT /account/me/bannerimage 401s without a token, 400s without an imageName', async () => {
+		const anon = await exports.default.fetch(`${ORIGIN}/account/me/bannerimage`, {
+			...form({ imageName: 'x.jpg' }),
+		})
+		expect(anon.status).toBe(401)
+
+		const empty = await exports.default.fetch(`${ORIGIN}/account/me/bannerimage`, {
+			...form({}),
+			headers: { ...(await bearer('778')), 'Content-Type': 'application/x-www-form-urlencoded' },
+		})
+		expect(empty.status).toBe(400)
+	})
+
 	test('PUT /account/me/identityflags 401s without a token', async () => {
 		const res = await exports.default.fetch(`${ORIGIN}/account/me/identityflags`, {
 			...form({ identityFlags: '384' }),
@@ -448,6 +492,7 @@ describe('auth-gated endpoints', () => {
 			'POST /account/create',
 			'POST /account/me/email',
 			'POST /account/me/phone',
+			'PUT /account/me/bannerimage',
 			'PUT /account/me/bio',
 			'PUT /account/me/displayname',
 			'PUT /account/me/identityflags',

apps/accounts/vitest.config.ts

@@ -21,11 +21,26 @@ export default defineConfig({
 						compatibilityDate: '2026-06-16',
 						compatibilityFlags: ['nodejs_compat'],
 						durableObjects: { RECFLARE_NOTIFICATIONS_HUB: 'NotificationsHub' },
+						// notifyPlayer records every call so a test can assert the AccountUpdate the
+						// worker pushed (who it went to, and the payload it carried). GET the DO for
+						// the most recent one, GET /all for the whole list, DELETE to reset.
 						script: `
 							import { DurableObject } from 'cloudflare:workers'
 							export class NotificationsHub extends DurableObject {
-								async notifyPlayer() { return { delivered: 0, queued: true } }
+								sent = []
+								async notifyPlayer(playerId, notificationType, data) {
+									this.sent.push({ playerId, notificationType, data })
+									return { delivered: 0, queued: true }
+								}
 								async broadcast() { return { delivered: 0 } }
+								async fetch(request) {
+									if (request.method === 'DELETE') {
+										this.sent = []
+										return new Response(null, { status: 204 })
+									}
+									if (new URL(request.url).pathname === '/all') return Response.json(this.sent)
+									return Response.json(this.sent.at(-1) ?? null)
+								}
 							}
 							export default { fetch() { return new Response('ok') } }
 						`,