support for 202507 endpoints (#37)

* [auth][api] accept the 20250424.01 client

* [2025] unstable

* 20250718.0

* correct one this time

* stubs

* more stubs

* more stubs

* [lists] add worker

* [ai] route stubs

* [api] player photo setting

* [econ] add roomEconConfig route

* [infra] update worker generators

* [worker] add cards/moderation/platformnotification workers

* [lists] updates to some endpoints

* [clubs] stub out announcement endpoint, for now

* [econ] stub out season endpoints for now

* [chat] apps/chat stub out party endpoint not sure the shape yet

* [api] stub out statsig and lockeditems

* [doc] new services

* [lists] stub the bulk endpoint

* [datacollection] add placeholder service until we can kill it

* [api] set gifting to lvl5

* update lock

* [cdn] enable cache

* [match] matchmake v2

* [lists] stub some lists

* [ai] stubs

* [rooms] new subroom save endpoint

* [econ] add bulk purchase endpoint

* [discovery] update featured creator to 1 for fun

* [api] add photo settings flag

* [chat] fixup chat permissions (sorta)

* [auth] restrictions endpoint

* [rooms] contributed endpoint

* [api] fix outfit endpoint

* [discovery] attempt to fix store

* [chat] privacy endpoints

* [api] cheered images

* [rooms] add xp endpoint (disbaled)

* [rooms] add xp endpoint (disabled)

* update images-db for cheers

* [rooms] add autocomplete endpoint

* [cdn/img] increase cache ttl for statics

* [api] bulk route for images

* [accounts] add banner image

* [api] add misc missing endpoints

* [discovery] remove AI tab

* [platformnotifications] stub some endpoints

* [lists] add some more lists

* [rooms] additional endpoints

* [chat] stub a few privacy endpoints

* [econ] stub some endpoints

* misc db fixes

* [api] tweak shape for images v6

* [rooms] dont show trending RROs

apps/accounts/src/test/integration/api.test.ts

@@ -164,6 +164,10 @@ describe('auth-gated endpoints', () => {
 			// An unset email is "", not null — the client reads it as a string, and the
 			// hub frame this DTO also rides drops null values outright.
 			email: '',
+			// Nothing sets these yet, but the key has to be present — the client reads
+			// both off the account DTO.
+			bannerImage: '',
+			displayEmoji: '',
 		})
 		// juniorState + parentAccountId must be omitted when null, not emitted as
 		// null, or the client's enum parser throws on `juniorState`. `phone` isn't
@@ -297,6 +301,46 @@ describe('auth-gated endpoints', () => {
 		expect(((await me.json()) as { profileImage: string }).profileImage).toBe('deadbeef.jpg')
 	})
 
+	test('PUT /account/me/bannerimage persists the banner and pushes the profile update', async () => {
+		type Sent = { playerId: number; notificationType: string | number; data: unknown }
+		const hub = () => env.RECFLARE_NOTIFICATIONS_HUB.getByName('global')
+		await hub().fetch('http://do/', { method: 'DELETE' })
+
+		const key = 'sharecamera/2026-08-18/75c295fd-8f1b-402e-961d-5c277fd56690.jpg'
+		const res = await exports.default.fetch(`${ORIGIN}/account/me/bannerimage`, {
+			...form({ imageName: key }),
+			headers: { ...(await bearer('778')), 'Content-Type': 'application/x-www-form-urlencoded' },
+		})
+		expect(res.status).toBe(200)
+		expect(await res.json()).toEqual({ success: true })
+
+		// Stored on the account, and served back by both the self and public reads.
+		const me = await exports.default.fetch(`${ORIGIN}/account/me`, { headers: await bearer('778') })
+		expect(((await me.json()) as { bannerImage: string }).bannerImage).toBe(key)
+		const pub = await exports.default.fetch(`${ORIGIN}/account/778`)
+		expect(((await pub.json()) as { bannerImage: string }).bannerImage).toBe(key)
+
+		// And the profile-update notification fired, carrying the new banner — so anyone
+		// looking at the profile redraws it without refetching.
+		const sent = (await (await hub().fetch('http://do/all')).json()) as Sent[]
+		expect(sent.length).toBeGreaterThan(0)
+		expect(sent.every((n) => n.playerId === 778)).toBe(true)
+		expect(sent.map((n) => (n.data as { bannerImage?: string }).bannerImage)).toContain(key)
+	})
+
+	test('PUT /account/me/bannerimage 401s without a token, 400s without an imageName', async () => {
+		const anon = await exports.default.fetch(`${ORIGIN}/account/me/bannerimage`, {
+			...form({ imageName: 'x.jpg' }),
+		})
+		expect(anon.status).toBe(401)
+
+		const empty = await exports.default.fetch(`${ORIGIN}/account/me/bannerimage`, {
+			...form({}),
+			headers: { ...(await bearer('778')), 'Content-Type': 'application/x-www-form-urlencoded' },
+		})
+		expect(empty.status).toBe(400)
+	})
+
 	test('PUT /account/me/identityflags 401s without a token', async () => {
 		const res = await exports.default.fetch(`${ORIGIN}/account/me/identityflags`, {
 			...form({ identityFlags: '384' }),
@@ -448,6 +492,7 @@ describe('auth-gated endpoints', () => {
 			'POST /account/create',
 			'POST /account/me/email',
 			'POST /account/me/phone',
+			'PUT /account/me/bannerimage',
 			'PUT /account/me/bio',
 			'PUT /account/me/displayname',
 			'PUT /account/me/identityflags',