[imconnorngl]

Merges the latest SkyCryptWebsite/SkyCrypt-Frontend dev (68 commits since #26, up to 51edd5656) into the fork.

Merge base

#26 was squash-merged, so git no longer knew which upstream commits were already in dev. A plain merge fell back to the August merge base and raised 87 conflicts that redid #26's work. #26 had merged upstream at a4856f897, and its squash kept the PR head's tree exactly. So I resolved this merge against that base and committed the result with dev and upstream/dev as parents. Only 8 files conflicted.

This repo only allows squash merges, so merging this PR will drop the upstream ancestry again. For the next sync, the upstream commit this PR merged is 51edd5656.

What upstream brought in

• Huma API client: the generated client now follows the backend's OpenAPI spec. Errors come back as RFC 9457 application/problem+json with a code (PLAYER_NOT_FOUND, NOT_CACHED, ...), and fetchSection maps each code to a message for users.
• Server tracing and Early Hints: tracing.server, a trace handler that adds trace IDs to the evlog wide event, output.linkHeaderPreload, and a Node OTel SDK in src/instrumentation.server.ts.
• Brand: new logo and favicons. static/img/app-icons is gone, replaced by apple-touch-icon.png and site.webmanifest.
• Themes: the theme list draws a local swatch instead of calling the getThemeIcons remote, which upstream deleted.
• Node 26 in CI and engines, dependency updates, API policy page edits, and admin dashboard and newsroom changes.

How the embed behaviour was kept

• API errors: the fork's readApiResponse threw on every non-2xx response, so upstream's code-to-message mapping never ran. Users would have seen the generic "unsuccessful response" text. It now returns application/problem+json bodies so fetchSection can handle them. HTML, WAF challenges, non-JSON and invalid JSON still fail early.
• Tracing: I dropped src/instrumentation.server.ts. It statically imports @opentelemetry/sdk-node, which would go into the Worker bundle and doesn't run on workerd. tracing.server and upstream's traceHandler are kept. Without an SDK the spans are no-ops, so the handler adds nothing. I checked that the built Worker has no sdk-node code.
• Hooks: still no better-auth, protected-route redirects or frame-locking. The handleFetch User-Agent override is kept, and handle is now evlogHandle, traceHandler, headersHandler.
• Framing: upstream now sends frame-ancestors https://u.shiiyu.moe with X-Frame-Options: DENY. Both stay out, and the embed's vite.config.ts comment is kept.
• app.html: this takes upstream's new icon and manifest links and keeps the GameUI HTMLMediaElement shim and the transparent body.
• Themes: this takes upstream's swatch and leaves out the custom-theme editor again.
• layout.css: the transparent, non-selectable body stays, next to upstream's Firefox scroll-fade fix.
• package.json: svelte-interactions and wrangler stay, and takumi goes to ^2.18.2. The lockfile was regenerated from upstream's version. The OTel packages stay in dependencies to keep future merges clean. Nothing in the Worker imports the Node SDK.

Texture proxy fix (also affects production)

The API now resolves items to cached renders on beta-api.shiiyu.moe, even when it's called on api.shiiyu.moe. Those files only exist on beta-api. The proxy rewrote every public API host to /textures/<path> and fetched from api.shiiyu.moe, so those items showed as broken images. It's the same on production today: /textures/cache/rendered/... returns 404 on skycrypt-embed.lunarclient.com.

Proxy paths for hosts other than the configured origin now keep the host (/textures/beta-api.shiiyu.moe/...). The route only fetches from the allowlisted public hosts, so it can't be used as an open proxy. In local workerd, /resolve returns host-prefixed paths and those renders load (200, image/webp).

Checks run locally

• pnpm check: 0 errors. The 2 warnings are in upstream's tiptap component.
• eslint: clean. oxfmt --check: clean apart from the CLAUDE.md symlink on a Windows checkout.
• pnpm test: 361/361 passing.
• pnpm build with adapter-cloudflare succeeds. wrangler deploy --dry-run passes for production and development and shows the Secrets Store binding. Upload is 3.89 MiB gzipped.
• Local workerd: / returns 200 with Link preload headers and no X-Frame-Options or frame-ancestors.

Still needs checking on the preview deploy

• Stats pages weren't tested end to end. The local Secrets Store has no skycrypt-server-api-key, so /stats/<ign> returns 500 locally. On the preview, check that /stats/<ign> and /stats/<ign>/card render.
• The API's 401 message without a key says to send x-api-key, but the fork, like upstream, sends X-API-Token. If stats pages come back 401 on the preview, that header is the first thing to check.
• The API spec now says uncached players and profiles return 404 NOT_CACHED. I couldn't check whether this applies to the server token. The page would say "SkyCrypt hasn't loaded this player yet."

[cursor]

Not approved: Cursor Security Agent: Security Reviewer was still running after the 8-minute wait, so that required check did not reach a terminal state. Human review is needed, and no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}