# Cuberun source and packaging record

- Game and author: **Cuberun by Adam Karlsten**.
- Repository: https://github.com/akarlsten/cuberun
- Pinned source: https://github.com/akarlsten/cuberun/tree/b3581ac0fbaa4293c571d8935c11cb454b29be03
- Upstream license: MIT, Copyright (c) 2023 Adam Karlsten. Full text: [LICENSE.txt](./LICENSE.txt).
- Third-party runtime notices, including Draco: [THIRD-PARTY-NOTICES.txt](./THIRD-PARTY-NOTICES.txt).
- Adapted editable source and dependency lock: [source.tar.gz](./source.tar.gz). The packaging reference in that archive records this site's build layout and needs its source/output paths adjusted when rebuilt elsewhere.

## What this game is

Cuberun is the author's own complete 3D arcade runner, inspired by Cubefield. It is not the original Cubefield, Y8 Slope, Snow Rider, or Escape Road. Its code is React/Three.js, not a downloaded Unity build of another publisher's game.

The upstream README explicitly describes the music as self-composed. The distributed models, textures, logo, and four audio files come from the pinned game repository under its MIT license. This package does not import assets or music from those commercial games. The original photosensitivity warning, music toggle, scoring, increasing speed, collision, restart, and touch controls are retained.

## Packaging changes, 2026-09-14

1. Bundle the existing game into a static JavaScript/CSS package; do not add levels or change gameplay.
2. Pin the principal dependencies to the upstream lockfile's versions. Use the site's esbuild 0.28.2 instead of installing the old Create React App build toolchain. The isolated dependency installation used `--ignore-scripts --legacy-peer-deps`.
3. Self-host the Draco decoder supplied by `three@0.129.0`. Its Apache-2.0 license and third-party notices are included. Blob workers and WebAssembly are needed to decode the original ship; no Google decoder request is made.
4. Omit `commando.ttf` and `Road_Rage.otf`, which did not have separate font licenses in the repository. Retain the existing system-font fallbacks; normalize three decorative text strings for readability without those fonts.
5. Prefix only the music preference and high-score storage keys with `playlane:cuberun:`. Storage remains local to the visitor's browser.
6. Add the local host bridge and a read-only `window.playlaneCuberun.snapshot()` diagnostic accessor. The accessor returns copied primitive data and does not expose game setters, stores, or mutable references.
7. Exclude the upstream favicon, PWA manifest, font preloads, screenshots and unrelated files from runtime loading. The game's original logo remains visible.

## Dependency audit scope

The isolated old dependency tree reports two high-severity entries: `lodash.pick` and `@react-three/drei` inheriting that dependency finding (GHSA-p6mc-m468-83gw). The esbuild output metadata was checked: **no lodash module contributes bytes to the shipped game bundle**. This is a tree-shaken, unused build dependency, not a claim that the whole historic dependency tree has a clean audit. Preserve this check when rebundling or adding new imports.

## Browser requirements and controls

- A modern browser with WebGL, WebAssembly and JavaScript.
- Desktop: A / Left Arrow and D / Right Arrow.
- Mobile: the game's existing on-screen left/right touch controls. The upstream game detects mobile user agents; desktop browser device emulation must also supply a mobile user agent to exercise them.
- Music is off by default. Audio files load locally; playback is controlled by the original in-game music button.
- Restart reloads the isolated game frame, as in the original implementation.
- Contains flashing lights. Chromium touch emulation does not establish compatibility with every physical phone or Safari version.

## Readiness

Wait for a positive-size canvas, a non-null `snapshot().ship`, and either the visible `START` button or `snapshot().started`. The original menu only shows START after its asset-loading progress reaches 100 percent.