chore: merge upstream/dev into the embed fork

.env.example

@@ -50,7 +50,7 @@ R2_SECRET_ACCESS_KEY=""
 R2_BUCKET=""
 PUBLIC_MEDIA_URL="" # Public URL of the bucket, e.g. an R2 custom domain like https://media.shiiyu.moe
 
-# Logging (evlog) - leave empty to log to stdout only
+# Logging (evlog) and tracing (src/instrumentation.server.ts) - leave empty to log to stdout only, without traces
 # Base URL of the HyperDX OTLP HTTP intake, e.g. http://skycrypt-hyperdx:4318 (on the Dokploy network)
 HYPERDX_OTLP_ENDPOINT=""
 # Ingestion key from HyperDX: Team Settings -> API Keys

.github/actions/pnpm-install/action.yml

@@ -46,7 +46,7 @@ runs:
     - name: Setup Node.js
       uses: actions/setup-node@v7
       with:
-        node-version: 24
+        node-version: 26
         cache: "pnpm"
 
     - name: Install dependencies

.github/skills/.gitignore

@@ -0,0 +1 @@
+pnpm-*

.github/workflows/clean_cache.yml

@@ -1,35 +1,49 @@
 # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#force-deleting-cache-entries
-name: Cleanup caches for closed branches
+name: Cleanup caches for closed pull requests
 
 on:
   pull_request:
     types:
       - closed
+  schedule:
+    - cron: "0 0 */3 * *"
   workflow_dispatch:
 
 jobs:
   cleanup:
     runs-on: ubuntu-latest
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v7
+    permissions:
+      actions: write
+      pull-requests: read
 
+    steps:
       - name: Cleanup
+        shell: bash
         run: |
+          set -euo pipefail
+
+          if [[ "$EVENT_NAME" == "pull_request" ]]; then
+            ref="refs/pull/$PR_NUMBER/merge"
+            echo "Deleting caches for closed pull request $PR_NUMBER"
+            gh cache delete --all --succeed-on-no-caches --repo "$REPO" --ref "$ref"
+            exit 0
+          fi
 
-          REPO=${{ github.repository }}
-          BRANCH="refs/pull/${{ github.event.pull_request.number }}/merge"
+          echo "Finding caches for closed pull requests"
+          refs=$(gh cache list --repo "$REPO" --limit 1000 --json ref --jq '.[].ref' | sort -u)
 
-          echo "Fetching list of cache key"
-          cacheKeysForPR=$(gh cache list -R $REPO -B $BRANCH | cut -f 1 )
+          while IFS= read -r ref; do
+            [[ "$ref" =~ ^refs/pull/([0-9]+)/merge$ ]] || continue
+            pr_number="${BASH_REMATCH[1]}"
+            state=$(gh pr view "$pr_number" --repo "$REPO" --json state --jq '.state')
 
-          ## Setting this to not fail the workflow while deleting cache keys. 
-          set +e
-          echo "Deleting caches..."
-          for cacheKey in $cacheKeysForPR
-          do
-              gh cache delete $cacheKey -R $REPO -B $BRANCH --confirm
-          done
-          echo "Done"
+            if [[ "$state" == "CLOSED" ]]; then
+              echo "Deleting caches for closed pull request $pr_number"
+              gh cache delete --all --succeed-on-no-caches --repo "$REPO" --ref "$ref"
+            fi
+          done <<< "$refs"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version: 26
           cache: pnpm
 
       - name: Install dependencies
@@ -68,7 +68,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version: 26
           cache: pnpm
 
       - name: Install dependencies
@@ -110,7 +110,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version: 26
           cache: pnpm
 
       - name: Install dependencies

.github/workflows/website.yml

@@ -2,7 +2,20 @@ name: Website
 
 on:
   push:
-    paths: ["src/**", "Dockerfile", "package.json", "vite.config.ts", ".changeset/**", ".github/workflows/website.yml"]
+    paths:
+      - "src/**"
+      - "static/**"
+      - "drizzle/**"
+      - "Dockerfile"
+      - ".dockerignore"
+      - ".env.example"
+      - ".npmrc"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "vite.config.ts"
+      - ".changeset/**"
+      - ".github/workflows/website.yml"
   workflow_dispatch:
 
 env:
@@ -107,6 +120,8 @@ jobs:
         with:
           context: .
           push: true
+          cache-from: type=gha,scope=skycrypt-frontend-${{ github.ref_name }}
+          cache-to: type=gha,mode=max,scope=skycrypt-frontend-${{ github.ref_name }}
           build-args: |
             PUBLIC_COMMIT_HASH=${{ env.SHORT_SHA }}
             PUBLIC_RELEASE_CHANNEL=${{ github.ref_name == 'prod' && 'stable' || 'beta' }}

.mcp.json

@@ -0,0 +1,9 @@
+{
+  "mcpServers": {
+    "svelte": {
+      "type": "http",
+      "url": "https://mcp.svelte.dev/mcp",
+      "tools": ["*"]
+    }
+  }
+}

AGENTS.md

@@ -11,7 +11,7 @@ Follow these instructions when working on SkyCrypt Frontend. Nested `AGENTS.md`
 ## Stack and setup
 
 - SkyCrypt is a Hypixel SkyBlock profile viewer built with SvelteKit 2, Svelte 5, strict TypeScript, and Tailwind CSS 4. Production uses the Node adapter.
-- Use Node 24 and pnpm 12, as required by `package.json` and CI. Other runtimes and package managers are unsupported. Keep `pnpm-lock.yaml` in sync with dependency changes.
+- Use Node 26 and pnpm 12, as required by `package.json` and CI. Other runtimes and package managers are unsupported. Keep `pnpm-lock.yaml` in sync with dependency changes.
 - Install with `pnpm install`. Copy `.env.example` to `.env` without overwriting an existing file. Never commit secrets or local environment files.
 - Profile data and end-to-end tests require the Go backend from the separate SkyCrypt-Backend repository. Newsroom uploads go to Cloudflare R2. See `.env.example` for service URLs.
 - Database and authentication code use PostgreSQL, Drizzle, and Better Auth. `pnpm db:start` starts local PostgreSQL. Server startup applies migrations from `drizzle/` through `src/hooks.server.ts`; builds skip migration execution.
@@ -41,14 +41,14 @@ Follow these instructions when working on SkyCrypt Frontend. Nested `AGENTS.md`
 - Write local and alias imports without `.js`/`.ts` extensions or a trailing `/index` (`#lib/server/db`, `./format`). Keep the extension on `.svelte.ts` modules so they aren't read as components. shadcn-managed files in `src/lib/components/ui/` and Orval output keep their generated style. `#lib` resolves through the Vite alias and the `#lib/*` TypeScript path, not only the `package.json` import map, which needs exact file names.
 - Keep credentials and database access in server-only code. Treat every `PUBLIC_*` environment variable as exposed to the browser.
 - `src/routes/api/internal/` holds routes only the Go backend calls (API key verification and usage reporting), guarded by `SERVER_API_TOKEN` through `requireBackendToken`. nginx must never route `/api/internal` publicly. The backend enforces API key rate limits, so Better Auth's own API key rate limiter stays disabled.
-- Log with evlog, never `console.*` in server code (ESLint enforces this). Configure it in `evlog.config.ts`; `src/hooks.server.ts` wires the hooks, Better Auth identity and drains. In a request, add context to the single wide event with `locals.log.set({ ... })` instead of extra log lines. Outside a request use `log` from `evlog`: `log.info("tag", "message")`, or `log.error({ action: "domain.event", error })` so HyperDX can filter on `action`. Output is plain text in the Dokploy Logs tab and ships to HyperDX when `HYPERDX_OTLP_ENDPOINT` is set (dev writes NDJSON to `.evlog/logs`, readable with `pnpm exec evlog logs`). Browser code logs with `log` from `evlog/client` (set up in `src/hooks.client.ts`); warnings and errors post to `/api/client-logs`, an unauthenticated endpoint that sanitizes and rate limits input, so never trust or extend its payload without updating `src/lib/server/client-logs.ts`.
+- Log with evlog, never `console.*` in server code (ESLint enforces this). Configure it in `evlog.config.ts`; `src/hooks.server.ts` wires the hooks, Better Auth identity and drains. In a request, add context to the single wide event with `locals.log.set({ ... })` instead of extra log lines. Outside a request use `log` from `evlog`: `log.info("tag", "message")`, or `log.error({ action: "domain.event", error })` so HyperDX can filter on `action`. Output is plain text in the Dokploy Logs tab and ships to HyperDX when `HYPERDX_OTLP_ENDPOINT` is set (dev writes NDJSON to `.evlog/logs`, readable with `pnpm exec evlog logs`). Server traces (SvelteKit spans plus outgoing `fetch`) go to the same HyperDX endpoint through `src/instrumentation.server.ts`, which reads `process.env` because it loads before the app; `traceHandler` in `src/hooks.server.ts` puts the trace id on each request's wide event so HyperDX links logs to traces. Browser code logs with `log` from `evlog/client` (set up in `src/hooks.client.ts`); warnings and errors post to `/api/client-logs`, an unauthenticated endpoint that sanitizes and rate limits input, so never trust or extend its payload without updating `src/lib/server/client-logs.ts`.
 
 ## Implementation conventions
 
 - Use Svelte 5 runes (`$state`, `$derived`, `$props`) and snippets. Avoid legacy reactive declarations, `export let`, and slots in new code.
 - Use the Svelte MCP to get the latest svelte documentation and conventions. Use the async flag to get the latest SvelteKit documentation and conventions for async svelte and remote functions, as that is the default for this project (instead of +page.server.ts way of loading data).
 - The project enables async Svelte compilation and SvelteKit remote functions. Use `--async` when validating with Svelte MCP/CLI tooling.
-- Check official documentation before implementing: the Svelte MCP for Svelte and SvelteKit, the library's own docs (for example takumi, Better Auth, Cloudflare) and the Node 24 docs for server code. Prefer SvelteKit features, then Node 24 built-ins, then library features, then hand-written code. Context7 can lag behind official docs. Say which docs you checked when reporting.
+- Check official documentation before implementing: the Svelte MCP for Svelte and SvelteKit, the library's own docs (for example takumi, Better Auth, Cloudflare) and the Node 26 docs for server code. Prefer SvelteKit features, then Node 26 built-ins, then library features, then hand-written code. Context7 can lag behind official docs. Say which docs you checked when reporting.
 - Use SvelteKit remote functions in `*.remote.ts` for new data loading and mutations instead of adding `+page.server.ts`. Migrate existing server route files only when the task calls for it.
 - Validate remote-function inputs and check authentication and authorization on the server. Follow nearby implementations, and check permissions in each protected mutation even when route guards or hidden controls restrict access.
 - Use Tailwind utilities, the shared `cn()` helper, and existing theme tokens and UI primitives. UI changes must work with a keyboard, show focus, adapt to screen size, and support existing themes.
@@ -69,7 +69,7 @@ Follow these instructions when working on SkyCrypt Frontend. Nested `AGENTS.md`
 ## Generated code and database changes
 
 - Do not manually edit Orval-generated API clients or schemas in `src/lib/shared/api/`. Change `orval.config.ts`, custom mutators, or the upstream API definition, then regenerate the relevant target.
-- Run `pnpm exec orval --project <target>` for `skycrypt`, `skycryptZod`, or `patreon`. SkyCrypt targets read `http://localhost:8080/api/openapi/doc.json`; Patreon reads its configured upstream spec. Required services must be available.
+- Run `pnpm exec orval --project <target>` for `skycrypt`, `skycryptZod`, or `patreon`. SkyCrypt targets read `http://localhost:8080/openapi.json`; Patreon reads its configured upstream spec. Required services must be available.
 - Edit database schemas in `src/lib/server/db/schema/`, then run `pnpm db:generate` and review the SQL and metadata in `drizzle/`. Do not rewrite applied migrations.
 - `pnpm auth:schema` regenerates the Better Auth schema from `src/lib/server/auth.ts`. Review the generated changes and generate any required database migration separately.
 - `pnpm db:push` directly changes the configured database; use it only for local schema work. Commit migrations for schema changes. Drizzle CLI commands require `DATABASE_URL` in the process environment.
@@ -102,7 +102,9 @@ Follow these instructions when working on SkyCrypt Frontend. Nested `AGENTS.md`
 ## Commits, pull requests, and releases
 
 - Use Conventional Commits, for example `fix(theme): preserve contrast`. The commit-message hook runs commitlint.
+- Before committing or pushing, ask whether the change goes directly on `dev` or on a new branch. The answer depends on the change, so never choose on your own.
+- Never stage changes (`git add`, `git mv`, `git rm`) unless asked. The user stages after reviewing; rename or delete files with plain `mv`/`rm`.
 - Follow `.github/PULL_REQUEST_TEMPLATE.md`: explain the problem and resulting behavior, link relevant issues, list verification, and include before/after screenshots for visible UI changes. Note migration or environment requirements.
 - Add a changeset with `pnpm changeset` when the change belongs in the release changelog. Documentation-only agent guidance does not need one.
 - Changesets target `dev`. Automation creates beta releases on `dev` and stable releases on `prod`. Follow `CONTRIBUTING.md` for promotion and changeset cleanup. Run release scripts only for an explicit release task.
-- Preserve applicable license notices. New contributions default to AGPLv3; brand assets explicitly listed in `NOTICE` and `static/BRAND_ASSETS_LICENSE` retain their MIT exception.
+- Preserve applicable license notices. New contributions default to AGPLv3; brand assets listed in `NOTICE` are proprietary (`LICENSES/LicenseRef-SkyCrypt-Brand.txt`). `NOTICE` is the authoritative list; mirror changes in `static/BRAND_ASSETS_LICENSE`, `REUSE.toml` and the README list.

CHANGELOG.md

@@ -1,5 +1,75 @@
 # Changelog
 
+## 4.6.0
+
+### Minor Changes
+
+- Feat(brand): replace logo and relicense brand assets _[`#382`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/pull/382) [`045a365`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/commit/045a365b03cfc59fcfb54a19e8a72c13c5ffead7) [@DarthGigi](https://github.com/DarthGigi)_
+
+### Patch Changes
+
+- Feat(newsroom): add a refresh cache option to post images _[`#382`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/pull/382) [`ce08456`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/commit/ce084568770cef680a116bbaf243a2b244aeaab1) [@DarthGigi](https://github.com/DarthGigi)_
+
+## 4.6.0-beta.1
+
+### Patch Changes
+
+- Feat(newsroom): add a refresh cache option to post images _[`ce08456`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/commit/ce084568770cef680a116bbaf243a2b244aeaab1) [@DarthGigi](https://github.com/DarthGigi)_
+
+## 4.6.0-beta.0
+
+### Minor Changes
+
+- Feat(brand): replace logo and relicense brand assets _[`045a365`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/commit/045a365b03cfc59fcfb54a19e8a72c13c5ffead7) [@DarthGigi](https://github.com/DarthGigi)_
+
+## 4.5.2
+
+### Patch Changes
+
+- Stop scroll areas from fading their edges in Firefox when there is nothing to scroll _[`#379`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/pull/379) [`a6ab980`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/commit/a6ab9802f9b810a7a76f478fc292e148966b7465) [@DarthGigi](https://github.com/DarthGigi)_
+
+## 4.5.2-beta.0
+
+### Patch Changes
+
+- Stop scroll areas from fading their edges in Firefox when there is nothing to scroll _[`a6ab980`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/commit/a6ab9802f9b810a7a76f478fc292e148966b7465) [@DarthGigi](https://github.com/DarthGigi)_
+
+## 4.5.1
+
+### Patch Changes
+
+- Fix every page returning a 500 error when server tracing is enabled _[`#377`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/pull/377) [`dfc474c`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/commit/dfc474c59cd705eb80766a979359330dcba6c1a9) [@DarthGigi](https://github.com/DarthGigi)_
+
+## 4.5.1-beta.0
+
+### Patch Changes
+
+- Fix every page returning a 500 error when server tracing is enabled _[`#377`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/pull/377) [`dfc474c`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/commit/dfc474c59cd705eb80766a979359330dcba6c1a9) [@DarthGigi](https://github.com/DarthGigi)_
+
+## 4.5.0
+
+### Minor Changes
+
+- Show API key, banner, session and developer mode changes immediately while they save, fix the API key page breaking after enabling, disabling or changing a key's rate limit, and send server traces to HyperDX _[`#375`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/pull/375) [`5d4653d`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/commit/5d4653d9705caa7bdc00562409c233e91ab44a24) [@DarthGigi](https://github.com/DarthGigi)_
+
+## 4.5.0-beta.0
+
+### Minor Changes
+
+- Show API key, banner, session and developer mode changes immediately while they save, fix the API key page breaking after enabling, disabling or changing a key's rate limit, and send server traces to HyperDX _[`5d4653d`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/commit/5d4653d9705caa7bdc00562409c233e91ab44a24) [@DarthGigi](https://github.com/DarthGigi)_
+
+## 4.4.1
+
+### Patch Changes
+
+- Error messages now say what went wrong, such as an unknown player or a missing profile, instead of showing the backend's raw error. The frontend uses the client generated from the backend's new Huma spec. _[`#373`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/pull/373) [`d2e81d3`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/commit/d2e81d377c6cdbda5ee92b2beb925ce216a0f9a7) [@DarthGigi](https://github.com/DarthGigi)_
+
+## 4.4.1-beta.0
+
+### Patch Changes
+
+- Error messages now say what went wrong, such as an unknown player or a missing profile, instead of showing the backend's raw error. The frontend uses the client generated from the backend's new Huma spec. _[`d2e81d3`](https://github.com/SkyCryptWebsite/SkyCrypt-Frontend/commit/d2e81d377c6cdbda5ee92b2beb925ce216a0f9a7) [@DarthGigi](https://github.com/DarthGigi)_
+
 ## 4.4.0
 
 ### Minor Changes

CONTRIBUTING.md

@@ -4,7 +4,7 @@ Before contributing to SkyCrypt, make sure you install the development environme
 
 ## Prerequisite Software
 
-- [Node.js](https://nodejs.org) (at least v24, as of February 2026)
+- [Node.js](https://nodejs.org) (at least v26, as of October 2026)
 - [pnpm](https://pnpm.io/) (Package manager)
 
 ## Backend
@@ -121,9 +121,7 @@ If you find a bug or have a feature request, please open an issue on GitHub or o
 
 By contributing to SkyCrypt Frontend, you agree that your contribution is licensed under the repository's current default license, [GNU AGPLv3](https://www.gnu.org/licenses/agpl-3.0.en.html), unless a more specific license notice applies.
 
-SkyCrypt brand/logo assets listed in [`static/BRAND_ASSETS_LICENSE`](./static/BRAND_ASSETS_LICENSE) remain under the MIT License and are not relicensed under AGPLv3.
-
-Changes to those MIT brand assets must preserve the MIT notice. Non-mechanical changes to those assets require maintainer review before merge.
+SkyCrypt brand/logo assets listed in [`NOTICE`](./NOTICE) are proprietary to SkyCrypt LLC under [`LICENSES/LicenseRef-SkyCrypt-Brand.txt`](./LICENSES/LicenseRef-SkyCrypt-Brand.txt). They are not licensed under AGPLv3 or MIT. Only maintainers may change those assets, and you may not submit replacements unless you transfer the rights in them to SkyCrypt LLC.
 
 Do not submit code, assets, textures, fonts, generated files, or other materials unless you have the right to license them under the applicable SkyCrypt Frontend license terms.