feat(gameplay): add versioned SRD rules migration

Co-authored-by: multica-agent <github@multica.ai>

apps/web/server/api/v1/campaigns/[id].get.ts

@@ -16,7 +16,7 @@ export default defineEventHandler(async (event) => {
         `campaign_members?select=id,user_id,role,active,ai_takeover_allowed,joined_at&campaign_id=eq.${campaignId}&order=joined_at.asc`,
       ),
       stageTwoDatabase<Array<Record<string, unknown>>>(
-        `characters?select=id,campaign_id,user_id,name,concept,controller,abilities,hp,max_hp,defense,proficiency,inventory,statuses,persona,created_at&campaign_id=eq.${campaignId}&order=created_at.asc`,
+        `characters?select=id,campaign_id,user_id,name,concept,controller,abilities,hp,max_hp,defense,proficiency,inventory,statuses,persona,rules_state,created_at&campaign_id=eq.${campaignId}&order=created_at.asc`,
       ),
       stageTwoDatabase<Array<Record<string, unknown>>>(
         `rounds?select=id,campaign_id,number,status,forced_by,narration,next_prompt,queued_at,resolved_at,error,created_at&campaign_id=eq.${campaignId}&status=eq.open&order=number.desc&limit=1`,

apps/web/server/api/v1/campaigns/[id]/characters.post.ts

@@ -1,4 +1,4 @@
-import { AbilityScoresSchema } from '@dng/shared'
+import { AbilityKeySchema, AbilityScoresSchema, SkillKeySchema } from '@dng/shared'
 import { z } from 'zod'
 import { requireCampaignAccess, requireStageTwoSafeText, requireStageTwoUser, stageTwoApiError, stageTwoDatabase, stageTwoRpc, stageTwoUuid } from '~/server/utils/stage-two-supabase'
 
@@ -13,8 +13,15 @@ const BodySchema = z.object({
   proficiency: z.number().int().min(1).max(10).default(2),
   inventory: z.array(z.string().trim().min(1).max(120)).max(50).default([]),
   statuses: z.array(z.string().trim().min(1).max(80)).max(12).default([]),
+  skillProficiencies: z.array(SkillKeySchema).max(8).default([]),
+  skillExpertise: z.array(SkillKeySchema).max(4).default([]),
+  savingThrowProficiencies: z.array(AbilityKeySchema).max(3).default([]),
   persona: z.record(z.string(), z.unknown()).default({}),
-}).strict().refine(value => value.hp <= value.maxHp, { message: 'hp must not exceed maxHp', path: ['hp'] })
+}).strict()
+  .refine(value => value.hp <= value.maxHp, { message: 'hp must not exceed maxHp', path: ['hp'] })
+  .refine(value => value.skillExpertise.every(skill => value.skillProficiencies.includes(skill)), {
+    message: 'expertise requires skill proficiency', path: ['skillExpertise'],
+  })
 
 export default defineEventHandler(async (event) => {
   try {
@@ -26,7 +33,7 @@ export default defineEventHandler(async (event) => {
       throw createError({ statusCode: 403, statusMessage: 'Only the campaign owner can add AI heroes.' })
     }
     requireStageTwoSafeText([body.name, body.concept, ...body.inventory, ...body.statuses, JSON.stringify(body.persona)].join('\n'))
-    const characterId = await stageTwoRpc<string>('stage_four_create_character', {
+    const characterId = await stageTwoRpc<string>('stage_five_create_character', {
       p_campaign_id: campaignId,
       p_actor_id: user.id,
       p_controller: body.controller,
@@ -40,6 +47,21 @@ export default defineEventHandler(async (event) => {
       p_inventory: body.inventory,
       p_statuses: body.statuses,
       p_persona: body.persona,
+      p_rules_state: {
+        version: 2,
+        level: 1,
+        skillProficiencies: body.skillProficiencies,
+        skillExpertise: body.skillExpertise,
+        savingThrowProficiencies: body.savingThrowProficiencies,
+        temporaryHp: 0,
+        deathSaves: { successes: 0, failures: 0 },
+        exhaustion: 0,
+        damageResistances: [],
+        damageVulnerabilities: [],
+        damageImmunities: [],
+        resources: { hitDice: { current: 1, max: 1, recovery: 'longRest' } },
+        legacyProficiencyFallback: false,
+      },
     })
     const rows = await stageTwoDatabase<Array<Record<string, unknown>>>(
       `characters?select=*&id=eq.${characterId}&campaign_id=eq.${campaignId}&limit=1`,

apps/web/server/api/v1/campaigns/[id]/characters/suggest.post.ts

@@ -34,7 +34,7 @@ export default defineEventHandler(async (event) => {
     if (!world) throw createError({ statusCode: 404, statusMessage: 'Campaign world not found.' })
 
     const completion = buildJsonCompletion(useRuntimeConfig(), {
-      system: `You create an original, editable Dungeons & Ground character draft for a private 13+ TTRPG campaign. Adapt archetype, equipment and voice to the supplied genre, but always use STR, DEX, CON, INT, WIS and CHA. Keep an alpha hero grounded: ability scores 7–16, max HP 8–20, Armor Class (AC) 10–16, proficiency 2. Give 2–5 useful starting items and a distinctive persona. Never use protected franchise characters. Return only the requested JSON.`,
+      system: `You create an original, editable Dungeons & Ground character draft for a private 13+ SRD 5.2.1 TTRPG campaign. Adapt archetype, equipment and voice to the supplied genre, but always use STR, DEX, CON, INT, WIS and CHA. Keep an alpha hero grounded: ability scores 7–16, max HP 8–20, Armor Class (AC) 10–16, proficiency 2. Choose exactly four fitting skill proficiencies and two saving throw proficiencies; expertise may contain at most one of the chosen skills. Give 2–5 useful starting items and a distinctive persona. Never use protected franchise characters. Return only the requested JSON.`,
       messages: [{
         role: 'user',
         content: JSON.stringify({

apps/web/server/api/v1/campaigns/index.get.ts

@@ -8,7 +8,7 @@ export default defineEventHandler(async (event) => {
     )
     const filters = [`owner_id.eq.${user.id}`, ...memberships.map(item => `id.eq.${item.campaign_id}`)]
     const campaigns = await stageTwoDatabase<Array<Record<string, unknown>>>(
-      `campaigns?select=id,world_id,owner_id,title,current_scene,next_prompt,status,created_at,updated_at&or=(${filters.join(',')})&order=updated_at.desc`,
+      `campaigns?select=id,world_id,owner_id,title,current_scene,next_prompt,status,ruleset_version,created_at,updated_at&or=(${filters.join(',')})&order=updated_at.desc`,
     )
     return { campaigns }
   } catch (error) {