support for 202507 endpoints (#37)

* [auth][api] accept the 20250424.01 client

Version check now answers "current" for a set of builds rather than one:
SUPPORTED_GAME_VERSIONS carries 20230414 and 20250424.01. GAME_VERSION is
unchanged and still what the server reports for itself (presence, rn.ver).

Adds GET /api/versioncheck/islandedversions, always [] — we never island a
build off into its own matchmaking pool.

The 2025 build POSTs /cachedlogin/forplatformid/:platform/:id with a
deviceId/platformAuth/time form body where the 2023 build GETs it, so that
route now takes both methods. The body is accepted and ignored for now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* [2025] unstable

* 20250718.0

* correct one this time

* stubs

* more stubs

* more stubs

* [lists] add worker

* [ai] route stubs

* [api] player photo setting

* [econ] add roomEconConfig route

* [infra] update worker generators

* [worker] add cards/moderation/platformnotification workers

* [lists] updates to some endpoints

* [clubs] stub out announcement endpoint, for now

* [econ] stub out season endpoints for now

* [chat] apps/chat stub out party endpoint not sure the shape yet

* [api] stub out statsig and lockeditems

* [doc] new services

* [lists] stub the bulk endpoint

* [datacollection] add placeholder service until we can kill it

* [api] set gifting to lvl5

* update lock

* [cdn] enable cache

* [match] matchmake v2

* [lists] stub some lists

* [ai] stubs

* [rooms] new subroom save endpoint

* [econ] add bulk purchase endpoint

* [discovery] update featured creator to 1 for fun

* [api] add photo settings flag

* [chat] fixup chat permissions (sorta)

* [auth] restrictions endpoint

* [rooms] contributed endpoint

* [api] fix outfit endpoint

* [discovery] attempt to fix store

* [chat] privacy endpoints

* [api] cheered images

* [rooms] add xp endpoint (disbaled)

* [rooms] add xp endpoint (disabled)

* update images-db for cheers

* [rooms] add autocomplete endpoint

* [cdn/img] increase cache ttl for statics

* [api] bulk route for images

* [accounts] add banner image

* [api] add misc missing endpoints

* [discovery] remove AI tab

* [platformnotifications] stub some endpoints

* [lists] add some more lists

* [rooms] additional endpoints

* [chat] stub a few privacy endpoints

* [econ] stub some endpoints

* misc db fixes

* [api] tweak shape for images v6

* [rooms] dont show trending RROs

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

apps/auth/src/openapi.ts

@@ -170,6 +170,14 @@ export const TokenRequest = z.object({
 		.optional()
 		.describe('Client-chosen, unverified. Recorded on the account, never trusted'),
 	device_class: z.string().optional().describe('Integer string; defaults to 0'),
+	ver: z
+		.string()
+		.optional()
+		.describe(
+			'The client’s build, e.g. `20250718.01`. Stamped into the token’s `rn.ver` claim and ' +
+				'read back by `match` when it writes presence, so a player reports the build they ' +
+				'are running. Absent (or empty) falls back to the server’s GAME_VERSION'
+		),
 })
 
 /** `POST /account/me/changepassword` form body. */
@@ -192,6 +200,47 @@ export const ChangePasswordResponse = z.object({
  * Both return a BARE JSON boolean rather than an object — the client reads the whole
  * body as a bool — and 404 an unknown player, mirroring the reference API.
  */
+/**
+ * The report category a moderation restriction was issued under, by value. Recorded in
+ * full from the client's enum so a restriction this server starts issuing can name the
+ * right one; nothing here reads it back.
+ *
+ * -1 Moderator · 0 Unknown · 1 DEPRECATED_MicrophoneAbuse · 2 Harassment · 3 Cheating ·
+ * 4 DEPRECATED_ImmatureBehavior · 5 AFK · 6 Misc · 7 Underage · 10 VoteKick ·
+ * 11 MisleadingPurchases · 100 CoC_Underage · 101 CoC_Sexual · 102 CoC_Discrimination ·
+ * 103 CoC_Trolling · 104 CoC_NameOrProfile · 200 InappropriateClothing ·
+ * 1000 IssuingInaccurateReports · 1100 RoomInventoryItems · 1101 InappropriateRooms ·
+ * 1102 InappropriateInventions · 1103 RoomOffers · 1200 Spam
+ */
+export const ReportCategory = z
+	.int()
+	.describe(
+		'ReportCategory: -1 Moderator · 0 Unknown · 1 DEPRECATED_MicrophoneAbuse · 2 Harassment · 3 Cheating · 4 DEPRECATED_ImmatureBehavior · 5 AFK · 6 Misc · 7 Underage · 10 VoteKick · 11 MisleadingPurchases · 100 CoC_Underage · 101 CoC_Sexual · 102 CoC_Discrimination · 103 CoC_Trolling · 104 CoC_NameOrProfile · 200 InappropriateClothing · 1000 IssuingInaccurateReports · 1100 RoomInventoryItems · 1101 InappropriateRooms · 1102 InappropriateInventions · 1103 RoomOffers · 1200 Spam'
+	)
+
+/**
+ * One moderation restriction on an account — a chat mute, say — as
+ * `GET /privileges/me/restrictions` lists them.
+ *
+ * `Name`, `Description` and `DisplayReason` are free display text: the client clears and
+ * refills its list from these and matches none of them against anything, so the wording is
+ * this server's to choose. What the client acts on is a record being PRESENT, and its
+ * `EndDate` — null for a restriction that never lifts.
+ */
+export const RestrictionDto = z.object({
+	AccountId: z.int().describe('The restricted account'),
+	Name: z.string().describe('Display name of the restriction, e.g. `Chat Mute`. Free text'),
+	Description: z.string().describe('What the player may no longer do. Free text'),
+	EndDate: z
+		.string()
+		.nullable()
+		.describe('When it lifts (ISO 8601 UTC); null for one that never does'),
+	AssociatedAccountId: z.int().nullable().describe('The other account involved, when there is one'),
+	AssociatedAccountUsername: z.string().nullable(),
+	ReportCategory: ReportCategory.nullable().describe('The category it was issued under'),
+	DisplayReason: z.string().nullable().describe('Reason shown to the player. Free text'),
+})
+
 export function roleLookup(role: 'developer' | 'moderator') {
 	return {
 		tags: ['Roles'],