support for 202507 endpoints (#37)

* [auth][api] accept the 20250424.01 client

* [2025] unstable

* 20250718.0

* correct one this time

* stubs

* more stubs

* more stubs

* [lists] add worker

* [ai] route stubs

* [api] player photo setting

* [econ] add roomEconConfig route

* [infra] update worker generators

* [worker] add cards/moderation/platformnotification workers

* [lists] updates to some endpoints

* [clubs] stub out announcement endpoint, for now

* [econ] stub out season endpoints for now

* [chat] apps/chat stub out party endpoint not sure the shape yet

* [api] stub out statsig and lockeditems

* [doc] new services

* [lists] stub the bulk endpoint

* [datacollection] add placeholder service until we can kill it

* [api] set gifting to lvl5

* update lock

* [cdn] enable cache

* [match] matchmake v2

* [lists] stub some lists

* [ai] stubs

* [rooms] new subroom save endpoint

* [econ] add bulk purchase endpoint

* [discovery] update featured creator to 1 for fun

* [api] add photo settings flag

* [chat] fixup chat permissions (sorta)

* [auth] restrictions endpoint

* [rooms] contributed endpoint

* [api] fix outfit endpoint

* [discovery] attempt to fix store

* [chat] privacy endpoints

* [api] cheered images

* [rooms] add xp endpoint (disbaled)

* [rooms] add xp endpoint (disabled)

* update images-db for cheers

* [rooms] add autocomplete endpoint

* [cdn/img] increase cache ttl for statics

* [api] bulk route for images

* [accounts] add banner image

* [api] add misc missing endpoints

* [discovery] remove AI tab

* [platformnotifications] stub some endpoints

* [lists] add some more lists

* [rooms] additional endpoints

* [chat] stub a few privacy endpoints

* [econ] stub some endpoints

* misc db fixes

* [api] tweak shape for images v6

* [rooms] dont show trending RROs

apps/img/src/img.app.ts

@@ -19,11 +19,12 @@ const FALLBACK_ASSET_PATH = '/DefaultProfileImage.jpg'
 const CDN_IMAGE_PREFIX = 'image/'
 
 /**
- * Cache-Control for served images. Uploaded images are immutable once written,
- * so cache for a year and mark `immutable` so browsers never revalidate. A new
- * image simply uses a new key.
+ * Cache-Control for served images — 30 days (86400 × 30), matching what `cdn` serves its
+ * blobs with. `immutable` rides along because an uploaded image never changes under its
+ * key: a new image simply uses a new one, so there is nothing for a browser to revalidate
+ * inside the window.
  */
-const CACHE_CONTROL = 'public, max-age=31536000, immutable'
+const CACHE_CONTROL = `public, max-age=${86400 * 30}, immutable`
 
 /**
  * Allowed output dimensions. Restricting resizes to a small fixed set caps the

apps/img/src/test/integration/api.test.ts

@@ -77,6 +77,25 @@ describe('img endpoints', () => {
 		expect(new Uint8Array(await res.arrayBuffer())).toEqual(IMAGE_BYTES)
 	})
 
+	// Images are served with the same 30-day window `cdn` uses for its blobs, plus
+	// `immutable` — an image never changes under its key, a new one takes a new key.
+	it('every served image carries the 30-day Cache-Control', async () => {
+		const CACHE_CONTROL = `public, max-age=${86400 * 30}, immutable`
+
+		// The stored object, a static asset, and the fallback for a key in neither.
+		for (const path of [`/${R2_KEY}`, `/${CDN_NAME}`, '/does-not-exist-anywhere.jpg']) {
+			const res = await SELF.fetch(`${ORIGIN}${path}`)
+			expect(res.status, path).toBe(200)
+			expect(res.headers.get('cache-control'), path).toBe(CACHE_CONTROL)
+		}
+
+		// And the transformed variant, which is rebuilt rather than streamed. Uses a real
+		// (decodable) JPEG, since a resize has to actually run for this path to be reached.
+		const resized = await SELF.fetch(`${ORIGIN}/3DCharades.jpg?width=128`)
+		expect(resized.status).toBe(200)
+		expect(resized.headers.get('cache-control')).toBe(CACHE_CONTROL)
+	})
+
 	it('serves an extensionless key from the cdn bucket under image/', async () => {
 		const res = await SELF.fetch(`${ORIGIN}/${CDN_NAME}`)
 		expect(res.status).toBe(200)