biome-plugin-suitescript 0.1.0 → 0.2.0

package/dist/cli/analyze.js

@@ -1,6 +1,7 @@
 // Node-only analysis of a single SuiteScript source file (ESTree via oxc-parser).
 import { parseSync, } from "oxc-parser";
 import { declaredProblems, inferredProblems, inferScriptType, typeByName, } from "../lib/inference.js";
+import { misplacedModule, sideOf, unsupportedModule, } from "../lib/module-script-types.js";
 const API_VERSION = "2.1";
 const UPGRADABLE = new Set(["1.0", "2.0", "2.x"]);
 function isCallback(node) {
@@ -97,6 +98,7 @@ function exportedNames(node) {
 }
 function inspectProgram(program) {
     let isScript = false;
+    const modules = [];
     const returned = [];
     let opaque = false;
     // Only trust `returned` when an inline define() callback or ES syntax was seen;
@@ -106,8 +108,11 @@ function inspectProgram(program) {
         if (node.type === "ImportDeclaration" ||
             node.type === "ExportNamedDeclaration")
             known = true;
-        if (node.type === "ImportDeclaration" && /^N(\/|$)/.test(node.source.value))
+        if (node.type === "ImportDeclaration" &&
+            /^N(\/|$)/.test(node.source.value)) {
             isScript = true;
+            modules.push(node.source.value);
+        }
         if (node.type === "ExportNamedDeclaration")
             returned.push(...exportedNames(node));
         if (node.type === "ExpressionStatement" &&
@@ -115,6 +120,14 @@ function inspectProgram(program) {
             const call = node.expression;
             if (call.callee.type === "Identifier" && call.callee.name === "define") {
                 isScript = true;
+                const dependencies = call.arguments.at(-2);
+                if (dependencies?.type === "ArrayExpression") {
+                    for (const element of dependencies.elements) {
+                        if (element?.type === "Literal" &&
+                            typeof element.value === "string")
+                            modules.push(element.value);
+                    }
+                }
                 const callback = call.arguments.at(-1);
                 if (isCallback(callback)) {
                     const names = amdReturnedNames(callback);
@@ -132,7 +145,11 @@ function inspectProgram(program) {
             }
         }
     }
-    return { isScript, returned: opaque || !known ? undefined : returned };
+    return {
+        isScript,
+        modules,
+        returned: opaque || !known ? undefined : returned,
+    };
 }
 function findTag(comments, name) {
     const pattern = new RegExp(`${name}(?:[ \\t]+(\\S+))?`);
@@ -182,7 +199,7 @@ export function analyzeSource(filename, source) {
     }
     const apiVersion = findTag(parsed.comments, "@NApiVersion");
     const scriptType = findTag(parsed.comments, "@NScriptType");
-    const { isScript, returned } = inspectProgram(parsed.program);
+    const { isScript, modules, returned } = inspectProgram(parsed.program);
     const inferred = isScript && returned ? inferScriptType(returned) : undefined;
     // Not a script: no tags and nothing that implies an entry point.
     if (!apiVersion && !scriptType && !inferred)
@@ -223,5 +240,18 @@ export function analyzeSource(filename, source) {
         for (const message of problems)
             report("entryPoints", message, scriptType?.offset ?? 0);
     }
+    // The declared type wins; otherwise fall back to what the entry points imply.
+    const declaredType = declared ? typeByName(declared) : undefined;
+    const side = sideOf(declaredType ? [declaredType] : (inferred?.types ?? []));
+    const single = declaredType ??
+        (inferred?.types.length === 1 ? inferred.types[0] : undefined);
+    if (side || single) {
+        for (const module of modules) {
+            const message = (side && misplacedModule(side, module)) ||
+                (single && unsupportedModule(single.name, module));
+            if (message)
+                report("modules", message, scriptType?.offset ?? 0);
+        }
+    }
     return { diagnostics, upgrade };
 }

package/dist/lib/module-script-types.js

@@ -0,0 +1,70 @@
+// Which side of NetSuite a script type runs on, and the N/ modules that only
+// work on one side. From the "Supported Script Types" column of Oracle's SuiteScript
+// module reference; loading a module on the wrong side fails at runtime.
+// Pure logic shared by the Biome rules and the CLI.
+export const CLIENT_ONLY_MODULES = new Set([
+    "N/currentRecord",
+    "N/portlet",
+    "N/ui/dialog",
+    "N/ui/message",
+]);
+export const SERVER_ONLY_MODULES = new Set([
+    "N/auth",
+    "N/cache",
+    "N/certificateControl",
+    "N/compress",
+    "N/config",
+    "N/crypto",
+    "N/crypto/certificate",
+    "N/dataset",
+    "N/documentCapture",
+    "N/encode",
+    "N/error",
+    "N/file",
+    "N/https/clientCertificate",
+    "N/keyControl",
+    "N/llm",
+    "N/machineTranslation",
+    "N/pgp",
+    "N/piremoval",
+    "N/plugin",
+    "N/redirect",
+    "N/render",
+    "N/sftp",
+    "N/task",
+    "N/task/accounting/recognition",
+    "N/ui/serverWidget",
+    "N/workbook",
+    "N/workflow",
+]);
+/** The side shared by every candidate script type, or undefined when unknown or mixed. */
+export function sideOf(types) {
+    if (types.length === 0)
+        return undefined;
+    const clients = types.filter((t) => t.name === "ClientScript").length;
+    if (clients === types.length)
+        return "client";
+    return clients === 0 ? "server" : undefined;
+}
+/** A message when `module` cannot be loaded by a script on `side`. */
+export function misplacedModule(side, module) {
+    if (side === "server" && CLIENT_ONLY_MODULES.has(module))
+        return `${module} is only available in client scripts.`;
+    if (side === "client" && SERVER_ONLY_MODULES.has(module))
+        return `${module} is only available in server scripts.`;
+    return undefined;
+}
+const CUSTOM_TOOL_UNSUPPORTED = new Set([
+    "N/http",
+    "N/https",
+    "N/llm",
+    "N/sftp",
+]);
+/** A message when a single script type cannot load `module` at all. */
+export function unsupportedModule(scriptType, module) {
+    if (scriptType === "CustomTool" && CUSTOM_TOOL_UNSUPPORTED.has(module))
+        return `${module} is not supported in custom tool scripts.`;
+    if (scriptType === "BundleInstallationScript" && !/^N(\/|$)/.test(module))
+        return "Custom modules are not supported in bundle installation scripts.";
+    return undefined;
+}

package/dist/lib/script-side.js

@@ -0,0 +1,83 @@
+import { esExportNames } from "./biome-modules.js";
+import { parseDefine } from "./define.js";
+import { amdReturnedNames } from "./entry-points.js";
+import { inferScriptType } from "./inference.js";
+import { sideOf } from "./module-script-types.js";
+/**
+ * Script types the module containing `node` (a define() call or an ES module)
+ * could be, judged from the entry points it returns. Undefined for libraries
+ * and for entry points that cannot be analysed.
+ */
+export function inferredTypes(node) {
+    for (const candidate of [node, ...node.ancestors()]) {
+        let names;
+        if (candidate.kind === "JS_CALL_EXPRESSION") {
+            const def = parseDefine(candidate);
+            if (!def)
+                continue;
+            names = amdReturnedNames(def);
+        }
+        else if (candidate.kind === "JS_MODULE") {
+            names = esExportNames(candidate);
+        }
+        else {
+            continue;
+        }
+        return (names && inferScriptType(names))?.types;
+    }
+    return undefined;
+}
+/** Whether that module is a client or server script. Undefined when unknown or mixed. */
+export function scriptSide(node) {
+    const types = inferredTypes(node);
+    return types && sideOf(types);
+}
+const FUNCTION_KINDS = [
+    "JS_FUNCTION_DECLARATION",
+    "JS_FUNCTION_EXPRESSION",
+    "JS_ARROW_FUNCTION_EXPRESSION",
+    "JS_METHOD_OBJECT_MEMBER",
+];
+const unquote = (text) => text.replace(/^['"]|['"]$/g, "");
+/** The name a function is bound to: its declaration, variable, object key or `o.name =` target. */
+export function functionName(fn) {
+    if (fn.kind === "JS_FUNCTION_DECLARATION")
+        return fn.children().find((c) => c.kind === "JS_IDENTIFIER_BINDING")?.text;
+    if (fn.kind === "JS_METHOD_OBJECT_MEMBER") {
+        const name = fn.children()[0]?.text;
+        return name ? unquote(name) : undefined;
+    }
+    const parent = fn.parent;
+    if (parent?.kind === "JS_PROPERTY_OBJECT_MEMBER") {
+        const name = parent.children()[0]?.text;
+        return name ? unquote(name) : undefined;
+    }
+    if (parent?.kind === "JS_INITIALIZER_CLAUSE")
+        return parent.parent
+            ?.children()
+            .find((c) => c.kind === "JS_IDENTIFIER_BINDING")?.text;
+    if (parent?.kind === "JS_ASSIGNMENT_EXPRESSION") {
+        const target = parent.children()[0];
+        if (target?.kind === "JS_STATIC_MEMBER_ASSIGNMENT")
+            return target.children()[1]?.text;
+    }
+    return undefined;
+}
+/** Names of the functions enclosing `node`, innermost first. */
+export function enclosingFunctionNames(node) {
+    return node
+        .ancestors()
+        .filter((a) => FUNCTION_KINDS.includes(a.kind))
+        .map(functionName)
+        .filter((n) => !!n);
+}
+export function isFunction(node) {
+    return FUNCTION_KINDS.includes(node.kind);
+}
+/** Every node below `node`, depth first. */
+export function* descendants(node) {
+    for (const child of node.children()) {
+        yield child;
+        yield* descendants(child);
+    }
+}

package/dist/lib/script-types.js

@@ -37,6 +37,10 @@ export const SCRIPT_TYPES = [
         entryPoints: ["customizeGlImpact"],
         name: "CustomGLPlugin",
     },
+    {
+        entryPoints: [],
+        name: "CustomTool",
+    },
     {
         entryPoints: ["createDataset"],
         name: "DatasetBuilderPlugin",
@@ -86,6 +90,14 @@ export const SCRIPT_TYPES = [
         entryPoints: ["run"],
         name: "SDFInstallationScript",
     },
+    {
+        entryPoints: ["run"],
+        name: "SpaClientScript",
+    },
+    {
+        entryPoints: ["initializeSpa"],
+        name: "SpaServerScript",
+    },
     {
         entryPoints: ["onRequest"],
         name: "Suitelet",

package/dist/lib/suitescript.js

@@ -0,0 +1,23 @@
+import { importsNetSuite } from "./biome-modules.js";
+import { parseDefine } from "./define.js";
+/** Whether a node is inside an AMD `define([...], fn)` or an ES module importing `N/` modules. */
+export function inSuiteScriptModule(node) {
+    return node.ancestors().some((a) => {
+        if (a.kind === "JS_CALL_EXPRESSION")
+            return !!parseDefine(a);
+        return a.kind === "JS_MODULE" && importsNetSuite(a);
+    });
+}
+/** Whether an expression is built only from string literals (and `+`). */
+export function isStaticString(node) {
+    if (!node)
+        return false;
+    if (node.kind === "JS_STRING_LITERAL_EXPRESSION")
+        return true;
+    if (node.kind === "JS_TEMPLATE_EXPRESSION")
+        return !node.text.includes("${");
+    if (node.kind === "JS_BINARY_EXPRESSION" ||
+        node.kind === "JS_PARENTHESIZED_EXPRESSION")
+        return node.children().every(isStaticString);
+    return false;
+}

package/dist/rules/noAmdName.grit

@@ -1,9 +1,9 @@
-engine biome(1.0)
-language js(typescript, jsx)
-
-// Anonymous AMD modules only: NetSuite/bundlers assign the module ID.
-`define($id, $deps, $cb)` as $call where {
-  $id <: JsStringLiteralExpression(),
-  register_diagnostic(span=$id, message="No AMD module name should be provided.", severity="error", fix_kind="safe"),
-  $call => `define($deps, $cb)`
-}
+engine biome(1.0)
+language js(typescript, jsx)
+
+// Anonymous AMD modules only: NetSuite/bundlers assign the module ID.
+`define($id, $deps, $cb)` as $call where {
+  $id <: JsStringLiteralExpression(),
+  register_diagnostic(span=$id, message="No AMD module name should be provided.", severity="error", fix_kind="safe"),
+  $call => `define($deps, $cb)`
+}

package/dist/rules/noBeforeSubmitRecordReload.js

@@ -0,0 +1,19 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { enclosingFunctionNames } from "../lib/script-side.js";
+const RECORD_CALLS = ["record.load", "record.submitFields", "record.delete"];
+// Reloading or editing the record being saved from its own beforeSubmit fails
+// with "Record has been changed". Only calls whose id is the context's
+// newRecord.id are reported; other records are fine.
+export const noBeforeSubmitRecordReload = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!RECORD_CALLS.includes(node.callee?.text ?? ""))
+            return;
+        const options = node.arguments?.children()[0]?.children()[0];
+        if (!options || !/\bid\s*:\s*[\w.]*newRecord\.id\b/.test(options.text))
+            return;
+        if (!enclosingFunctionNames(node).includes("beforeSubmit"))
+            return;
+        registerDiagnostic(node, "error", `${node.callee?.text}() on the record being saved is not allowed in beforeSubmit.`);
+    },
+});

package/dist/rules/noBrowserGlobals.js

@@ -0,0 +1,23 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { scriptSide } from "../lib/script-side.js";
+const BROWSER_GLOBALS = new Set([
+    "document",
+    "window",
+    "localStorage",
+    "sessionStorage",
+    "XMLHttpRequest",
+    "alert",
+    "navigator",
+]);
+// Server scripts run outside a browser, but TypeScript's DOM library lets
+// these names compile. Locals that reuse a name resolve to a binding and are left alone.
+export const noBrowserGlobals = defineRule({
+    query: semantic("JS_REFERENCE_IDENTIFIER"),
+    run(node, { model }) {
+        if (!BROWSER_GLOBALS.has(node.text) || model.binding(node))
+            return;
+        if (scriptSide(node) !== "server")
+            return;
+        registerDiagnostic(node, "error", `'${node.text}' does not exist in server scripts.`);
+    },
+});

package/dist/rules/noClientLog.js

@@ -0,0 +1,14 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { logCall } from "../lib/log.js";
+import { scriptSide } from "../lib/script-side.js";
+// Oracle (N/log): in a client script attached to a form, "calls to any log
+// function ... are ignored". It cannot tell whether a form is attached.
+export const noClientLog = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const info = logCall(node);
+        if (!info || scriptSide(node) !== "client")
+            return;
+        registerDiagnostic(node, "warning", `log.${info.prop}() is ignored in client scripts attached to a form; use console.`);
+    },
+});

package/dist/rules/noDynamicSuiteQL.js

@@ -0,0 +1,24 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { isStaticString } from "../lib/suitescript.js";
+// Matches query.runSuiteQL, runSuiteQLPaged and their .promise forms.
+const SUITEQL = /(^|\.)runSuiteQL(Paged)?(\.promise)?$/;
+// Building SuiteQL from variables invites injection and defeats query plan
+// caching; pass values through `params` placeholders instead. A bare variable
+// is not flagged because its contents are unknown.
+export const noDynamicSuiteQL = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!SUITEQL.test(node.callee?.text ?? ""))
+            return;
+        let sql = node.arguments?.children()[0]?.children()[0];
+        if (sql?.kind === "JS_OBJECT_EXPRESSION") {
+            const member = (sql.children()[0]?.children() ?? []).find((m) => m.children()[0]?.text.replace(/^['"]|['"]$/g, "") === "query");
+            sql = member?.children()[1];
+        }
+        if (sql &&
+            !isStaticString(sql) &&
+            sql.kind !== "JS_IDENTIFIER_EXPRESSION") {
+            registerDiagnostic(sql, "warning", "Build SuiteQL with ? placeholders and params, not string concatenation.");
+        }
+    },
+});

package/dist/rules/noEmptyEntryPoints.js

@@ -0,0 +1,19 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { ALL_ENTRY_POINTS, GENERIC_ENTRY_POINTS } from "../lib/inference.js";
+import { functionName, scriptSide } from "../lib/script-side.js";
+// Oracle: "Do not deploy scripts with blank entry functions. They still load and
+// may affect performance without doing any work." Only modules whose script type
+// is inferred are checked, so libraries with an empty `get` or `run` are ignored.
+export const noEmptyEntryPoints = defineRule({
+    query: ast("JS_FUNCTION_DECLARATION", "JS_FUNCTION_EXPRESSION", "JS_ARROW_FUNCTION_EXPRESSION", "JS_METHOD_OBJECT_MEMBER"),
+    run(node) {
+        const name = functionName(node);
+        if (!name || !ALL_ENTRY_POINTS.has(name) || GENERIC_ENTRY_POINTS.has(name))
+            return;
+        const body = node.children().find((c) => c.kind === "JS_FUNCTION_BODY");
+        const empty = body?.children().every((c) => c.children().length === 0);
+        if (!empty || !scriptSide(node))
+            return;
+        registerDiagnostic(node, "warning", `Entry point '${name}' is empty.`);
+    },
+});

package/dist/rules/noEval.js

@@ -0,0 +1,21 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+const TIMERS = ["setTimeout", "setInterval"];
+// eval(), new Function() and string-form timers run arbitrary code.
+export const noEval = defineRule({
+    query: ast("JS_CALL_EXPRESSION", "JS_NEW_EXPRESSION"),
+    run(node) {
+        const callee = node.callee?.text;
+        if (!callee)
+            return;
+        if (callee === "eval" || callee === "Function") {
+            registerDiagnostic(node, "error", `Do not use ${callee}().`);
+        }
+        else if (node.kind === "JS_CALL_EXPRESSION" && TIMERS.includes(callee)) {
+            const first = node.arguments?.children()[0]?.children()[0];
+            if (first?.kind === "JS_STRING_LITERAL_EXPRESSION" ||
+                first?.kind === "JS_TEMPLATE_EXPRESSION") {
+                registerDiagnostic(node, "error", `Do not pass a string to ${callee}(); it is evaluated as code.`);
+            }
+        }
+    },
+});

package/dist/rules/noGlobalShadowing.js

@@ -0,0 +1,34 @@
+import { ast, defineRule, registerDiagnostic, } from "@biomejs/runtime/plugin";
+import { dependencies } from "../lib/biome-modules.js";
+import { parseDefine } from "../lib/define.js";
+// `log` and `util` are SuiteScript 2.1 globals. The one allowed binding is the
+// module they come from: N/log as `log`, N/util as `util`. `error` is not listed
+// because moduleVars names the N/error identifier `error`.
+const GLOBALS = { log: "N/log", util: "N/util" };
+function isModuleBinding(node, module) {
+    const ancestors = node.ancestors();
+    for (const ancestor of ancestors) {
+        if (ancestor.kind === "JS_CALL_EXPRESSION") {
+            const def = parseDefine(ancestor);
+            if (!def)
+                continue;
+            const index = def.params.findIndex((p) => p?.text === node.text);
+            const isParameter = ancestors.some((a) => a.kind === "JS_FORMAL_PARAMETER");
+            const name = def.elements[index]?.text.slice(1, -1);
+            return isParameter && index >= 0 && name === module;
+        }
+        if (ancestor.kind === "JS_IMPORT") {
+            return dependencies(ancestor).some((d) => d.name === module);
+        }
+    }
+    return false;
+}
+export const noGlobalShadowing = defineRule({
+    query: ast("JS_IDENTIFIER_BINDING"),
+    run(node) {
+        const module = GLOBALS[node.text];
+        if (module && !isModuleBinding(node, module)) {
+            registerDiagnostic(node, "warning", `'${node.text}' shadows the global ${node.text}.`);
+        }
+    },
+});

package/dist/rules/noHardcodedSecrets.js

@@ -0,0 +1,38 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+const SECRET_NAMES = /^(password|passwd|pwd|secret|api_?key|client_?secret|token_?secret|consumer_?secret)$/i;
+const unquote = (text) => text.replace(/^['"]|['"]$/g, "");
+// Oracle: "Do not hard-code any passwords in scripts." A heuristic on names, so
+// no preset includes it; enable it explicitly. Only exact secret-like names with
+// a non-empty string literal are flagged (not `passwordId` or `tokenName`).
+export const noHardcodedSecrets = defineRule({
+    query: ast("JS_VARIABLE_DECLARATOR", "JS_PROPERTY_OBJECT_MEMBER", "JS_ASSIGNMENT_EXPRESSION"),
+    run(node) {
+        const children = node.children();
+        let name;
+        let value;
+        if (node.kind === "JS_VARIABLE_DECLARATOR") {
+            name = children.find((c) => c.kind === "JS_IDENTIFIER_BINDING")?.text;
+            value = children
+                .find((c) => c.kind === "JS_INITIALIZER_CLAUSE")
+                ?.children()[0];
+        }
+        else if (node.kind === "JS_PROPERTY_OBJECT_MEMBER") {
+            name = children[0] && unquote(children[0].text);
+            value = children[1];
+        }
+        else {
+            const target = children[0];
+            name =
+                target?.kind === "JS_STATIC_MEMBER_ASSIGNMENT"
+                    ? target.children()[1]?.text
+                    : target?.text;
+            value = children[1];
+        }
+        if (name &&
+            SECRET_NAMES.test(name) &&
+            value?.kind === "JS_STRING_LITERAL_EXPRESSION" &&
+            value.text.length > 2) {
+            registerDiagnostic(value, "error", `Do not hard-code '${name}'; read it from a script parameter or credentials.`);
+        }
+    },
+});

package/dist/rules/noHeaderUnderscores.js

@@ -0,0 +1,23 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// Oracle: "When you define custom headers, don't include underscores in the name."
+export const noHeaderUnderscores = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^https\.[a-zA-Z]+(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const options = node.arguments?.children()[0]?.children()[0];
+        if (options?.kind !== "JS_OBJECT_EXPRESSION")
+            return;
+        for (const member of options.children()[0]?.children() ?? []) {
+            const [name, headers] = member.children();
+            if (name?.text !== "headers" || headers?.kind !== "JS_OBJECT_EXPRESSION")
+                continue;
+            for (const header of headers.children()[0]?.children() ?? []) {
+                const key = header.children()[0];
+                if (key?.text.replace(/^['"]|['"]$/g, "").includes("_")) {
+                    registerDiagnostic(key, "warning", "Header names must not contain underscores.");
+                }
+            }
+        }
+    },
+});

package/dist/rules/noInsecureHttpsUrl.js

@@ -0,0 +1,20 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// Oracle: the N/https module "does not allow the HTTP protocol".
+export const noInsecureHttpsUrl = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^https\.[a-zA-Z]+(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const options = node.arguments?.children()[0]?.children()[0];
+        if (options?.kind !== "JS_OBJECT_EXPRESSION")
+            return;
+        for (const member of options.children()[0]?.children() ?? []) {
+            const [name, value] = member.children();
+            if (name?.text === "url" &&
+                value?.kind === "JS_STRING_LITERAL_EXPRESSION" &&
+                /^['"]http:\/\//i.test(value.text)) {
+                registerDiagnostic(value, "error", "N/https does not allow http:// URLs.");
+            }
+        }
+    },
+});

package/dist/rules/noLogModule.js

@@ -1,6 +1,9 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
 import { dependencies } from "../lib/biome-modules.js";
-// Use the global `log` instead of loading N/log. The global is not available in
+// Opt-in style: use the global `log` instead of loading N/log. It is the opposite
+// of noMissingModules, which requires loading N/log, so enable only one of them.
+// Oracle's skills disagree on this (upgrade: the global exists but importing is
+// recommended; learning: it is not global). The global is not available in
 // client scripts, so scope this rule away from them with the plugin `includes`.
 export const noLogModule = defineRule({
     query: ast("JS_CALL_EXPRESSION", "JS_IMPORT"),

package/dist/rules/noMapReduceSearchResults.js

@@ -0,0 +1,33 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { descendants, enclosingFunctionNames, isFunction, } from "../lib/script-side.js";
+const RESULTS = /\.getRange\(/;
+// Oracle: running a search in getInputData and returning its results risks a
+// timeout; return the search.create()/search.load() object instead. Detects
+// `.getRange()` results returned directly or through a local variable.
+export const noMapReduceSearchResults = defineRule({
+    query: ast("JS_RETURN_STATEMENT"),
+    run(node) {
+        if (!enclosingFunctionNames(node).includes("getInputData"))
+            return;
+        const argument = node.children()[0];
+        if (!argument)
+            return;
+        let flagged = RESULTS.test(argument.text);
+        if (!flagged && argument.kind === "JS_IDENTIFIER_EXPRESSION") {
+            const fn = node.ancestors().find(isFunction);
+            for (const d of fn ? descendants(fn) : []) {
+                if (d.kind !== "JS_VARIABLE_DECLARATOR")
+                    continue;
+                const id = d.children().find((c) => c.kind === "JS_IDENTIFIER_BINDING");
+                const init = d
+                    .children()
+                    .find((c) => c.kind === "JS_INITIALIZER_CLAUSE");
+                if (id?.text === argument.text && init && RESULTS.test(init.text))
+                    flagged = true;
+            }
+        }
+        if (flagged) {
+            registerDiagnostic(argument, "warning", "Return the search object from getInputData instead of its results.");
+        }
+    },
+});

package/dist/rules/noMissingModules.js

@@ -0,0 +1,26 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { MODULES } from "../lib/modules.js";
+import { inSuiteScriptModule } from "../lib/suitescript.js";
+// `util` is a global in SuiteScript 2.1, so it never needs loading. `log` is
+// treated like every other module: load N/log when you call it.
+const ALIASES = new Map(Object.entries(MODULES)
+    .filter(([, identifier]) => identifier !== "util")
+    .map(([name, identifier]) => [identifier, name]));
+// Reports `record.load()` when `record` resolves to no binding, meaning the
+// module was never added to `define()` or imported. Locals that shadow the
+// name resolve to a binding and are left alone.
+export const noMissingModules = defineRule({
+    query: semantic("JS_REFERENCE_IDENTIFIER"),
+    run(node, { model }) {
+        const module = ALIASES.get(node.text);
+        if (!module || model.binding(node))
+            return;
+        const member = node.parent?.parent;
+        if (member?.kind !== "JS_STATIC_MEMBER_EXPRESSION" ||
+            member.children()[0]?.text !== node.text)
+            return;
+        if (!inSuiteScriptModule(node))
+            return;
+        registerDiagnostic(node, "error", `'${node.text}' is used but ${module} is not loaded.`);
+    },
+});

package/dist/rules/noModuleExtensions.grit

@@ -1,12 +1,12 @@
-engine biome(1.0)
-language js(typescript, jsx)
-
-// Dependencies in the define() array must not carry a `.js` extension.
-`define($args)` where {
-  $args <: contains JsArrayExpression() as $deps,
-  $deps <: contains JsStringLiteralExpression() as $dep where {
-    $dep <: r"(['\"])(.*)\.js(['\"])"($q1, $name, $q2),
-    register_diagnostic(span=$dep, message="Module name should not include file extension.", severity="error", fix_kind="safe"),
-    $dep => `$q1$name$q2`
-  }
-}
+engine biome(1.0)
+language js(typescript, jsx)
+
+// Dependencies in the define() array must not carry a `.js` extension.
+`define($args)` where {
+  $args <: contains JsArrayExpression() as $deps,
+  $deps <: contains JsStringLiteralExpression() as $dep where {
+    $dep <: r"(['\"])(.*)\.js(['\"])"($q1, $name, $q2),
+    register_diagnostic(span=$dep, message="Module name should not include file extension.", severity="error", fix_kind="safe"),
+    $dep => `$q1$name$q2`
+  }
+}