support for 202507 endpoints (#37)

* [auth][api] accept the 20250424.01 client

* [2025] unstable

* 20250718.0

* correct one this time

* stubs

* more stubs

* more stubs

* [lists] add worker

* [ai] route stubs

* [api] player photo setting

* [econ] add roomEconConfig route

* [infra] update worker generators

* [worker] add cards/moderation/platformnotification workers

* [lists] updates to some endpoints

* [clubs] stub out announcement endpoint, for now

* [econ] stub out season endpoints for now

* [chat] apps/chat stub out party endpoint not sure the shape yet

* [api] stub out statsig and lockeditems

* [doc] new services

* [lists] stub the bulk endpoint

* [datacollection] add placeholder service until we can kill it

* [api] set gifting to lvl5

* update lock

* [cdn] enable cache

* [match] matchmake v2

* [lists] stub some lists

* [ai] stubs

* [rooms] new subroom save endpoint

* [econ] add bulk purchase endpoint

* [discovery] update featured creator to 1 for fun

* [api] add photo settings flag

* [chat] fixup chat permissions (sorta)

* [auth] restrictions endpoint

* [rooms] contributed endpoint

* [api] fix outfit endpoint

* [discovery] attempt to fix store

* [chat] privacy endpoints

* [api] cheered images

* [rooms] add xp endpoint (disbaled)

* [rooms] add xp endpoint (disabled)

* update images-db for cheers

* [rooms] add autocomplete endpoint

* [cdn/img] increase cache ttl for statics

* [api] bulk route for images

* [accounts] add banner image

* [api] add misc missing endpoints

* [discovery] remove AI tab

* [platformnotifications] stub some endpoints

* [lists] add some more lists

* [rooms] additional endpoints

* [chat] stub a few privacy endpoints

* [econ] stub some endpoints

* misc db fixes

* [api] tweak shape for images v6

* [rooms] dont show trending RROs

apps/datacollection/src/context.ts

@@ -0,0 +1,19 @@
+import type { HonoApp } from '@repo/hono-helpers'
+import type { SharedHonoEnv, SharedHonoVariables } from '@repo/hono-helpers/src/types'
+
+export type Env = SharedHonoEnv & {
+	/**
+	 * Shared Secrets Store binding for the HS256 JWT signing key. Resolve the value with
+	 * `await env.JWT_SECRET.get()`; every worker binds the same store, so tokens signed by
+	 * `auth` verify here.
+	 */
+	JWT_SECRET: SecretsStoreSecret
+}
+
+/** Variables can be extended */
+export type Variables = SharedHonoVariables
+
+export interface App extends HonoApp {
+	Bindings: Env
+	Variables: Variables
+}

apps/datacollection/src/datacollection.app.ts

@@ -0,0 +1,59 @@
+import { Hono } from 'hono'
+import { useWorkersLogger } from 'workers-tagged-logger'
+
+import { withNotFound, withOnError } from '@repo/hono-helpers'
+
+import type { App } from './context'
+
+/**
+ * DataCollection Worker. The client's telemetry sink: it batches gameplay/analytics events
+ * and posts them here, and asks on startup how heavily to sample them. Nothing here stores
+ * or forwards anything — there is no analytics backend behind this server — so both routes
+ * are acknowledgements.
+ *
+ * Neither is auth-gated. Telemetry is fire-and-forget from the client's side and it posts
+ * before a session is fully established, so a 401 buys nothing and costs a retry loop.
+ */
+const app = new Hono<App>()
+	.use(
+		'*',
+		// middleware
+		(c, next) =>
+			useWorkersLogger(c.env.NAME, {
+				environment: c.env.ENVIRONMENT,
+				release: c.env.SENTRY_RELEASE,
+			})(c, next)
+	)
+
+	.onError(withOnError())
+	.notFound(withNotFound())
+
+	.get('/', async (c) => {
+		return c.text('hello, world!')
+	})
+
+	// Event drop-off, singular. The client posts one event here and only checks that the
+	// call succeeded — the response body is never read — so an empty object is a complete
+	// answer. Events are discarded; nothing collects them.
+	.post('/data/event', async (c) => {
+		return c.json({})
+	})
+
+	// The same drop-off for a BATCH of events. Separate route rather than an alias: the
+	// client sends an array here and the answer is an array, mirroring the request one
+	// per-event result at a time. Empty says "nothing to report back about any of them".
+	// Don't collapse the two — a `{}` on this path is not the shape the client's decoder
+	// expects for a batch.
+	.post('/data/events', async (c) => {
+		return c.json([])
+	})
+
+	// Sampling configuration, asked for once per session (`?sessionId=<guid>`). An empty
+	// object carries no per-event overrides, which the client reads as "sample everything
+	// at the built-in default rates". Since the events are discarded anyway, the rate it
+	// picks makes no difference here.
+	.get('/sampling', async (c) => {
+		return c.json({})
+	})
+
+export default app

apps/datacollection/src/test/integration/api.test.ts

@@ -0,0 +1,61 @@
+import { SELF } from 'cloudflare:test'
+import { expect, it } from 'vitest'
+
+const ORIGIN = 'https://example.com'
+
+it('response with hello world', async () => {
+	const res = await SELF.fetch(ORIGIN)
+	expect(res.status).toBe(200)
+	expect(await res.text()).toMatchInlineSnapshot(`"hello, world!"`)
+})
+
+it('acknowledges a single event', async () => {
+	const res = await SELF.fetch(`${ORIGIN}/data/event`, {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify({ EventName: 'SessionStart', SessionId: crypto.randomUUID() }),
+	})
+	expect(res.status).toBe(200)
+	expect(await res.json()).toEqual({})
+})
+
+// The batch path answers with an ARRAY, not the singular path's object — the client
+// decodes the two differently, so this asserts the shape, not just the status.
+it('acknowledges an event batch', async () => {
+	const res = await SELF.fetch(`${ORIGIN}/data/events`, {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify([
+			{ EventName: 'SessionStart', SessionId: crypto.randomUUID() },
+			{ EventName: 'RoomEntered', SessionId: crypto.randomUUID() },
+		]),
+	})
+	expect(res.status).toBe(200)
+	expect(await res.json()).toEqual([])
+})
+
+// The sink takes whatever the client sends — an unparseable body still has to succeed on
+// either path, since the client treats a failed post as a reason to retry the batch.
+it('acknowledges an unreadable body on both event paths', async () => {
+	const single = await SELF.fetch(`${ORIGIN}/data/event`, { method: 'POST', body: 'not json' })
+	expect(single.status).toBe(200)
+	expect(await single.json()).toEqual({})
+
+	const batch = await SELF.fetch(`${ORIGIN}/data/events`, { method: 'POST', body: 'not json' })
+	expect(batch.status).toBe(200)
+	expect(await batch.json()).toEqual([])
+})
+
+it('serves an empty sampling configuration', async () => {
+	const res = await SELF.fetch(`${ORIGIN}/sampling?sessionId=e9a899ce-ce46-447d-bb22-11e82ed68f8d`)
+	expect(res.status).toBe(200)
+	expect(await res.json()).toEqual({})
+})
+
+// The client always sends `sessionId`, but nothing here reads it, so a missing one must
+// not turn into a 400 the client would have to handle.
+it('serves the sampling configuration without a sessionId', async () => {
+	const res = await SELF.fetch(`${ORIGIN}/sampling`)
+	expect(res.status).toBe(200)
+	expect(await res.json()).toEqual({})
+})