Use script capabilities

docs/capabilities.md

@@ -0,0 +1,23 @@
+[Script capabilities] is used to sandbox Purse to ensure safety and prevent malicious code.
+
+!!! danger
+
+    Malicious clones may remove script capabilities sandboxing. Double check the [`Capabilities`][Capabilities] property and that [`Sandboxed`][Sandboxed] is enabled.
+
+  [Script capabilities]: https://create.roblox.com/docs/scripting/capabilities
+  [Capabilities]: https://create.roblox.com/docs/scripting/capabilities#capabilities
+  [Sandboxed]: https://create.roblox.com/docs/scripting/capabilities#sandboxed-container
+
+Purse uses the following capabilities:
+
+* **RunClientScript** - Run Purse on the client
+* **AccessOutsideWrite** - Access instances outside the container
+* **[AssetManagement]** - Check for latest version
+    * This capability does not allow read, create, or update operations on assets
+* **Basic** - Run Purse
+* **CreateInstances** - Create GUI instances
+* **Input** - Binding for equipping slots and toggling inventory
+* **Players** - Access player backpack
+* **UI** - Access player GUI
+
+  [AssetManagement]: https://create.roblox.com/docs/scripting/capabilities#:~:text=AssetManagement

docs/guide.md

@@ -6,10 +6,10 @@ You can change the slot's equip color, which is blue, by modifying the `SLOT_EQU
 
 The following code sample changes the equip color to red.
 
-``` lua linenums="44" hl_lines="2"
---8<-- "src/init.luau:44:44"
+``` lua linenums="49" hl_lines="2"
+--8<-- "src/init.luau:49:49"
 local SLOT_EQUIP_COLOR = Color3.new(233 / 255, 90 / 255, 90 / 255) -- (1)!
---8<-- "src/init.luau:46:49"
+--8<-- "src/init.luau:51:54"
 ```
 
 1.  Changed from blue `#!lua Color3.new(90 / 255, 142 / 255, 233 / 255)` to red `#!lua Color3.new(233 / 255, 90 / 255, 90 / 255)`
@@ -41,18 +41,18 @@ It's possible to increase the number of hotbar slots and inventory rows shown by
 
     `HOTBAR_SLOTS_VR` and `INVENTORY_ROWS_VR` are no longer used but are still included in the code. VR devices now use `INVENTORY_ROWS_FULL` and `HOTBAR_SLOTS_FULL`.
 
-``` lua linenums="62"
---8<-- "src/init.luau:62:72"
+``` lua linenums="67"
+--8<-- "src/init.luau:67:77"
 ```
 
 Constants suffixed with `_FULL` are for computer, console, and VR devices while constants suffixed with `_MINI` are for phone and tablet devices.
 
 The following code sample changes phone and tablet devices to have 5 hotbar slots.
 
-``` lua linenums="62" hl_lines="3"
---8<-- "src/init.luau:62:63"
+``` lua linenums="67" hl_lines="3"
+--8<-- "src/init.luau:67:68"
 local HOTBAR_SLOTS_MINI = 5 -- (1)!
---8<-- "src/init.luau:65:66"
+--8<-- "src/init.luau:70:71"
 ```
 
 1.  Changed from `#!lua 3` hotbar slots to `#!lua 5` hotbar slots

mkdocs.yml

@@ -67,5 +67,6 @@ nav:
   - Installation: installation.md
   - Guide: guide.md
   - Performance: performance.md
+  - Capabilities: capabilities.md
   - Philosophy: philosophy.md
   - API Reference: api-reference.md

models/Purse/init.meta.json

@@ -0,0 +1,8 @@
+{
+  "properties": {
+    "Capabilities": {
+      "SecurityCapabilities": 155727694080
+    },
+    "Sandboxed": true
+  }
+}

src/init.luau

@@ -23,7 +23,12 @@ local BackpackScript = {}
 BackpackScript.OpenClose = nil -- Function to toggle open/close
 BackpackScript.IsHotbarVisible = false
 BackpackScript.IsOpen = false
-BackpackScript.StateChanged = Instance.new("BindableEvent") -- Fires after any open/close, passes IsNowOpen
+
+-- ROBLOX deviation START: parent to script for script capabilities
+local stateChangedBindableEvent = Instance.new("BindableEvent")
+stateChangedBindableEvent.Parent = script
+BackpackScript.StateChanged = stateChangedBindableEvent -- Fires after any open/close, passes IsNowOpen
+-- ROBLOX deviation END
 
 BackpackScript.ModuleName = "Backpack"
 BackpackScript.KeepVRTopbarOpen = true
@@ -184,14 +189,17 @@ local lastEquippedSlot = nil
 
 BackpackScript.BackpackEmpty = Create("BindableEvent")({
 	Name = "BackpackEmpty",
+	Parent = script, -- ROBLOX deviation: parent to script for script capabilities
 })
 
 BackpackScript.BackpackItemAdded = Create("BindableEvent")({
 	Name = "BackpackAdded",
+	Parent = script, -- ROBLOX deviation: parent to script for script capabilities
 })
 
 BackpackScript.BackpackItemRemoved = Create("BindableEvent")({
 	Name = "BackpackRemoved",
+	Parent = script, -- ROBLOX deviation: parent to script for script capabilities
 })
 
 local function NewGui(className, objectName)