# fallout2-ce modification notice

This runtime was built from `roginvs/fallout2-ce` commit
`ad70dbd1de1bebc1248b79796479852cc199be01`.

The self-hosted distribution replaces the upstream `index.html` and
`config.mjs` web-shell files with local versions that remove third-party
telemetry integrations and expose only the two explicitly configured games.

The generated upstream `index.sw.js` is modified during packaging to:

- use the immutable service-worker/cache schema version
  `ad70dbd1de1bebc1248b79796479852cc199be01-emsdk-3.1.74-v5`;
- look up engine assets only in the current versioned engine cache instead of
  searching all Cache Storage entries;
- include the license page, notices, third-party license texts, provenance, and
  their checksum report in the offline cache.

The generated upstream `mainmenu.mjs` is patched during packaging so imported
save names are rendered by the local `safe-game-slot.mjs` DOM implementation.
It creates the existing slot link/name elements explicitly and assigns all save
metadata through `textContent`, preventing imported save files from injecting
HTML or event handlers while preserving the existing element IDs and UX.

The generated upstream `mainmenu.mjs` and `fetchArrayBufProgress.mjs` are also
patched to remove the implicit dependency on hi-res interface files from the
unconfigured English Nevada game. The launcher no longer inserts those
missing files into either configured game's index. First launch uses the
documented 640x480 windowed mode; the optional hi-res mode keeps a 640px
interface bar and disables side-panel artwork, so it needs no absent
`HR_IFACE_*` assets. All HTTP responses are checked for a successful 2xx status
before their body can be passed to the gzip inflator.

The compiled engine source is otherwise unchanged. The exact local patches are
stored in `patches/` in the source repository. The packaging script accepts the
XSS patch only for upstream `mainmenu.mjs` SHA-256
`0cedbbf74c83db73a96959aa56e18d068e91fcb399d0257a6aaea11d535765bc`, then
accepts the gameplay patch only for the exact XSS-patched intermediate and
pinned upstream fetch helper.