Made of little things.

// The game code in src/game runs inside the napplet sandbox: no direct storage or network.
import assert from 'node:assert/strict';
import { readdir, readFile } from 'node:fs/promises';
import { dirname, join } from 'node:path';
import test from 'node:test';
import { fileURLToPath } from 'node:url';

const gameDir = join(dirname(dirname(fileURLToPath(import.meta.url))), 'src', 'game');
const BANNED = ['localStorage', 'sessionStorage', 'indexedDB', 'fetch(', 'XMLHttpRequest', 'WebSocket', 'EventSource', 'document.cookie'];

test('game code uses no direct browser storage or network APIs', async () => {
  const files = (await readdir(gameDir)).filter((f) => f.endsWith('.js'));
  assert.ok(files.length > 0);
  for (const file of files) {
    const code = await readFile(join(gameDir, file), 'utf8');
    for (const api of BANNED) assert.ok(!code.includes(api), `src/game/${file} uses ${api}, which is not allowed in a napplet`);
  }
});

test('saved data goes through the shell-backed store', async () => {
  const ui = await readFile(join(gameDir, 'ui.js'), 'utf8');
  assert.match(ui, /const store = globalThis\.BLACKSITE_STORE;/);
});