biome-plugin-suitescript 0.1.1 → 0.2.0

package/README.md

@@ -37,28 +37,86 @@ npx biome-plugin-suitescript check
 Each rule has one fixed severity: `error` for things that fail at runtime or on upload, `warn` for conventions.
 Biome plugins cannot be reconfigured per project, so you choose by enabling rules, scoping them, or generating one.
 
-| Rule                           | Severity | Description                                                                        | ESLint equivalent           |
-| ------------------------------ | -------- | ---------------------------------------------------------------------------------- | --------------------------- |
-| `noAmdName` (fixable)          | error    | No module id as the first `define` argument                                        | `no-amd-name`               |
-| `noExtraModules`               | error    | Dependency array and callback parameters must match in count                       | `no-extra-modules`          |
-| `noInvalidModules`             | error    | Unknown `N/...` modules                                                            | `no-invalid-modules`        |
-| `noModuleExtensions` (fixable) | error    | No `.js` in `define` dependency names                                              | `no-module-extensions`      |
-| `moduleVars`                   | warn     | Conventional identifier per `N/` module (`N/record` → `record`)                    | `module-vars`               |
-| `logRequireTitle`              | warn     | `log.debug/audit/error/emergency({...})` needs `title`                             | `log-args` `requireTitle`   |
-| `logRequireDetails`            | warn     | ...needs `details`                                                                 | `log-args` `requireDetails` |
-| `noLogModule`                  | warn     | Use the global `log`, not `N/log`                                                  | `no-log-module`             |
-| `entryPoints`                  | error    | Returned entry points must belong to one script type and include its required ones | `entry-points`              |
+| Rule                           | Severity | Description                                                                                                          | ESLint equivalent           |
+| ------------------------------ | -------- | -------------------------------------------------------------------------------------------------------------------- | --------------------------- |
+| `noAmdName` (fixable)          | error    | No module id as the first `define` argument                                                                          | `no-amd-name`               |
+| `noExtraModules`               | error    | Dependency array and callback parameters must match in count                                                         | `no-extra-modules`          |
+| `noInvalidModules`             | error    | Unknown `N/...` modules                                                                                              | `no-invalid-modules`        |
+| `noModuleExtensions` (fixable) | error    | No `.js` in `define` dependency names                                                                                | `no-module-extensions`      |
+| `moduleVars`                   | warn     | Conventional identifier per `N/` module (`N/record` → `record`)                                                      | `module-vars`               |
+| `logRequireTitle`              | warn     | `log.debug/audit/error/emergency({...})` needs `title`                                                               | `log-args` `requireTitle`   |
+| `logRequireDetails`            | warn     | ...needs `details`                                                                                                   | `log-args` `requireDetails` |
+| `noLogModule`                  | warn     | Opt-in opposite of `noMissingModules`: use the global `log`, not `N/log`                                             | `no-log-module`             |
+| `entryPoints`                  | error    | Returned entry points must belong to one script type and include its required ones                                   | `entry-points`              |
+| `noMissingModules`             | error    | A module used (`record.load()`, `log.debug()`) must be loaded in `define`/`import`                                   | none (from Oracle's skills) |
+| `noGlobalShadowing`            | warn     | No variable named `log` or `util` other than the N/log, N/util module itself                                         | none (from Oracle's skills) |
+| `noEval`                       | error    | No `eval`, `new Function` or string-form `setTimeout`/`setInterval`                                                  | none (OWASP skill)          |
+| `noDynamicSuiteQL`             | warn     | `runSuiteQL` queries use `?` placeholders, not concatenation or template literals                                    | none (OWASP skill)          |
+| `noSuiteScript1Api`            | error    | No `nlapi*`/`nlobj*` (SuiteScript 1.0) leftovers                                                                     | none (upgrade skill)        |
+| `noModuleScopeApiCalls`        | warn     | No `N/` API calls while the `define` callback runs; initialize from entry points                                     | none (SAFE guide)           |
+| `noRecordInLoop`               | warn     | No `record.load`/`record.create` inside loops or `forEach`/`each`/`map` callbacks                                    | none (SAFE guide)           |
+| `noNativeIterators`            | warn     | No generator functions or `Symbol.iterator` (GraalJS)                                                                | none (SAFE guide)           |
+| `noWrongScriptTypeModules`     | error    | No client-only module (`N/currentRecord`, `N/ui/dialog`) in a server script, or a server-only one in a client script | none (Oracle docs)          |
+| `noBrowserGlobals`             | error    | No `document`, `window`, `localStorage`, `XMLHttpRequest`, `alert` or `navigator` in server scripts                  | none (Oracle docs)          |
+| `noBeforeSubmitRecordReload`   | error    | No `record.load`/`submitFields`/`delete` of `context.newRecord.id` inside `beforeSubmit`                             | none (Oracle docs)          |
+| `noEmptyEntryPoints`           | warn     | A returned entry point with an empty body                                                                            | none (Oracle docs)          |
+| `noMapReduceSearchResults`     | warn     | `getInputData` returns the search object, not `getRange()` results                                                   | none (Oracle docs)          |
+| `noHardcodedSecrets`           | error    | Opt-in only: no string literal assigned to `password`, `secret`, `apiKey`, ...                                       | none (Oracle docs)          |
+| `noUserEventContextSave`       | error    | No `.save()` on `context.newRecord` or `context.oldRecord` in user events                                            | none (Oracle docs)          |
+| `noInsecureHttpsUrl`           | error    | No `http://` URL passed to `https.*` (N/https refuses plain HTTP)                                                    | none (Oracle docs)          |
+| `requireCustpagePrefix`        | warn     | The `id` of a UI object added to a form (`addField`, `addTab`, ...) starts with `custpage`                           | none (Oracle docs)          |
+| `noHeaderUnderscores`          | warn     | No underscore in a custom `https.*` header name                                                                      | none (Oracle docs)          |
+| `noQueryColumnFieldAndFormula` | error    | A query column cannot set both `fieldId` and `formula`                                                               | none (Oracle docs)          |
+| `requireClientValidateReturn`  | warn     | `saveRecord` and `validate*` return a value (only a body with no `return <value>` is flagged)                        | none (Oracle docs)          |
+| `noClientLog`                  | warn     | `log.*` is ignored in client scripts attached to a form; use `console`                                               | none (Oracle docs)          |
 
 `noAmdName`, `noExtraModules` and `noModuleExtensions` only apply to `define()`. The rest cover `import` too.
 
-| Preset                | Contents                                                                                                    |
-| --------------------- | ----------------------------------------------------------------------------------------------------------- |
-| `presets/recommended` | every rule above except `noLogModule` and `entryPoints` (no false positives on libraries or client scripts) |
-| `presets/minimal`     | `noExtraModules`, `noInvalidModules`                                                                        |
-| `presets/all`         | `recommended` + `noLogModule` + `entryPoints`                                                               |
+| Preset                | Contents                                                                                                                                                                                                                                                                                                                               |
+| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `presets/recommended` | every rule above except the opt-in `noLogModule` and `noHardcodedSecrets` and the ones `presets/all` adds                                                                                                                                                                                                                              |
+| `presets/minimal`     | `noExtraModules`, `noInvalidModules`                                                                                                                                                                                                                                                                                                   |
+| `presets/all`         | `recommended` plus `entryPoints`, `noRecordInLoop`, `noNativeIterators`, `noBeforeSubmitRecordReload`, `noEmptyEntryPoints`, `noMapReduceSearchResults`, `requireCustpagePrefix`, `noHeaderUnderscores`, `noQueryColumnFieldAndFormula`, `requireClientValidateReturn` and `noClientLog` (never `noLogModule` or `noHardcodedSecrets`) |
 
 Suppress a diagnostic with `// biome-ignore lint/plugin: reason`.
 
+### Opt-in rules and typings
+
+`noHardcodedSecrets` is in no preset. It guesses from names (`password`, `passwd`, `pwd`, `secret`, `apiKey`,
+`clientSecret`, `tokenSecret`, `consumerSecret`, exact match only) rather than knowing a value is a credential, so it
+can misfire on look-alike names, and you should decide whether that trade is worth it: add
+`"biome-plugin-suitescript/noHardcodedSecrets"` to `plugins` yourself. Oracle says "Do not hard-code any passwords
+in scripts."
+
+The rules assume you type-check against [`@hitc/netsuite-types`](https://github.com/headintheclouddev/typings-suitescript-2.0),
+which already rejects wrong option names, missing parameters and positional-argument calls to N/ methods (their
+signatures take an options object). Plain JavaScript projects get none of that from these rules.
+
+### Logging and `N/log`
+
+Oracle's own agent skills disagree on whether `N/log` must be loaded: one says the global exists but loading is
+recommended, another says it is not global. This package takes the consistent position that a module you use
+should be loaded, so `noMissingModules` requires `N/log` when `log.` is called. `noLogModule` is the opposite style
+for projects that prefer the global, so enable only one of the two (`presets/all` omits `noLogModule`).
+
+### Rules drawn from Oracle's documentation
+
+`noWrongScriptTypeModules`, `noBrowserGlobals`, `noBeforeSubmitRecordReload`, `noEmptyEntryPoints` and
+`noMapReduceSearchResults`, plus the later additions listed in the table above marked Oracle docs, come from Oracle's SuiteScript help-center pages and cover what type checking against
+`@hitc/netsuite-types` cannot (the typings accept every signature involved). The client-only and server-only module
+lists are copied from Oracle's module reference table, and `noWrongScriptTypeModules` and `noBrowserGlobals` only fire
+when the script type can be inferred from the returned entry points. `noBeforeSubmitRecordReload` only matches calls
+whose `id` is `...newRecord.id`. `noMapReduceSearchResults` only detects `.getRange()` results.
+
+### Rules drawn from Oracle's agent skills
+
+`noMissingModules`, `noGlobalShadowing`, `noEval`, `noDynamicSuiteQL`, `noSuiteScript1Api`, `noModuleScopeApiCalls`,
+`noRecordInLoop` and `noNativeIterators` come from Oracle's
+[agent skills](https://github.com/oracle/netsuite-suitecloud-sdk/tree/master/packages/agent-skills) (SuiteScript
+upgrade, OWASP secure coding and the SAFE guide). `noMissingModules` leaves `util` alone because it is a global.
+`noDynamicSuiteQL` does not flag a bare variable, whose contents it cannot see. `noRecordInLoop` is opt-in because
+a Map/Reduce `map` entry point legitimately handles one record per call.
+
 ### `entryPoints` and script types
 
 Biome plugins cannot read comments, so the script type is **inferred from what the module returns**
@@ -98,6 +156,7 @@ It reports:
 
 - `@NApiVersion` other than `2.1` (2.0, 2.x, 1.0 and invalid values), or missing when the file is a script.
 - `@NScriptType` with no or an invalid value, or missing when the returned entry points imply one.
+- A module from the wrong side of the declared script type (for example `N/file` in a client script), or one the declared type does not support at all (`N/http`, `N/https`, `N/llm` and `N/sftp` in a custom tool; custom modules in a bundle installation script).
 - A declared script type that does not match the returned entry points, or lacks its required ones.
 
 Files with no tags and no implied entry points (libraries) are skipped. For scripts still on 1.0, 2.0 or 2.x, the

package/biome-manifest.json

@@ -15,8 +15,27 @@
         "moduleVars",
         "logRequireTitle",
         "logRequireDetails",
-        "noLogModule",
-        "entryPoints"
+        "noMissingModules",
+        "noGlobalShadowing",
+        "noEval",
+        "noDynamicSuiteQL",
+        "noSuiteScript1Api",
+        "noModuleScopeApiCalls",
+        "noWrongScriptTypeModules",
+        "noBrowserGlobals",
+        "noUserEventContextSave",
+        "noInsecureHttpsUrl",
+        "entryPoints",
+        "noRecordInLoop",
+        "noNativeIterators",
+        "noBeforeSubmitRecordReload",
+        "noEmptyEntryPoints",
+        "noMapReduceSearchResults",
+        "requireCustpagePrefix",
+        "noHeaderUnderscores",
+        "noQueryColumnFieldAndFormula",
+        "requireClientValidateReturn",
+        "noClientLog"
       ],
       "minimal": ["noExtraModules", "noInvalidModules"],
       "recommended": [
@@ -26,7 +45,17 @@
         "noModuleExtensions",
         "moduleVars",
         "logRequireTitle",
-        "logRequireDetails"
+        "logRequireDetails",
+        "noMissingModules",
+        "noGlobalShadowing",
+        "noEval",
+        "noDynamicSuiteQL",
+        "noSuiteScript1Api",
+        "noModuleScopeApiCalls",
+        "noWrongScriptTypeModules",
+        "noBrowserGlobals",
+        "noUserEventContextSave",
+        "noInsecureHttpsUrl"
       ]
     },
     "rules": [
@@ -45,17 +74,80 @@
       {
         "noAmdName": "./dist/rules/noAmdName.grit"
       },
+      {
+        "noBeforeSubmitRecordReload": "./dist/rules/noBeforeSubmitRecordReload.js"
+      },
+      {
+        "noBrowserGlobals": "./dist/rules/noBrowserGlobals.js"
+      },
+      {
+        "noClientLog": "./dist/rules/noClientLog.js"
+      },
+      {
+        "noDynamicSuiteQL": "./dist/rules/noDynamicSuiteQL.js"
+      },
+      {
+        "noEmptyEntryPoints": "./dist/rules/noEmptyEntryPoints.js"
+      },
+      {
+        "noEval": "./dist/rules/noEval.js"
+      },
       {
         "noExtraModules": "./dist/rules/noExtraModules.js"
       },
+      {
+        "noGlobalShadowing": "./dist/rules/noGlobalShadowing.js"
+      },
+      {
+        "noHardcodedSecrets": "./dist/rules/noHardcodedSecrets.js"
+      },
+      {
+        "noHeaderUnderscores": "./dist/rules/noHeaderUnderscores.js"
+      },
+      {
+        "noInsecureHttpsUrl": "./dist/rules/noInsecureHttpsUrl.js"
+      },
       {
         "noInvalidModules": "./dist/rules/noInvalidModules.js"
       },
       {
         "noLogModule": "./dist/rules/noLogModule.js"
       },
+      {
+        "noMapReduceSearchResults": "./dist/rules/noMapReduceSearchResults.js"
+      },
+      {
+        "noMissingModules": "./dist/rules/noMissingModules.js"
+      },
       {
         "noModuleExtensions": "./dist/rules/noModuleExtensions.grit"
+      },
+      {
+        "noModuleScopeApiCalls": "./dist/rules/noModuleScopeApiCalls.js"
+      },
+      {
+        "noNativeIterators": "./dist/rules/noNativeIterators.js"
+      },
+      {
+        "noQueryColumnFieldAndFormula": "./dist/rules/noQueryColumnFieldAndFormula.js"
+      },
+      {
+        "noRecordInLoop": "./dist/rules/noRecordInLoop.js"
+      },
+      {
+        "noSuiteScript1Api": "./dist/rules/noSuiteScript1Api.js"
+      },
+      {
+        "noUserEventContextSave": "./dist/rules/noUserEventContextSave.js"
+      },
+      {
+        "noWrongScriptTypeModules": "./dist/rules/noWrongScriptTypeModules.js"
+      },
+      {
+        "requireClientValidateReturn": "./dist/rules/requireClientValidateReturn.js"
+      },
+      {
+        "requireCustpagePrefix": "./dist/rules/requireCustpagePrefix.js"
       }
     ]
   },

package/dist/cli/analyze.js

@@ -1,6 +1,7 @@
 // Node-only analysis of a single SuiteScript source file (ESTree via oxc-parser).
 import { parseSync, } from "oxc-parser";
 import { declaredProblems, inferredProblems, inferScriptType, typeByName, } from "../lib/inference.js";
+import { misplacedModule, sideOf, unsupportedModule, } from "../lib/module-script-types.js";
 const API_VERSION = "2.1";
 const UPGRADABLE = new Set(["1.0", "2.0", "2.x"]);
 function isCallback(node) {
@@ -97,6 +98,7 @@ function exportedNames(node) {
 }
 function inspectProgram(program) {
     let isScript = false;
+    const modules = [];
     const returned = [];
     let opaque = false;
     // Only trust `returned` when an inline define() callback or ES syntax was seen;
@@ -106,8 +108,11 @@ function inspectProgram(program) {
         if (node.type === "ImportDeclaration" ||
             node.type === "ExportNamedDeclaration")
             known = true;
-        if (node.type === "ImportDeclaration" && /^N(\/|$)/.test(node.source.value))
+        if (node.type === "ImportDeclaration" &&
+            /^N(\/|$)/.test(node.source.value)) {
             isScript = true;
+            modules.push(node.source.value);
+        }
         if (node.type === "ExportNamedDeclaration")
             returned.push(...exportedNames(node));
         if (node.type === "ExpressionStatement" &&
@@ -115,6 +120,14 @@ function inspectProgram(program) {
             const call = node.expression;
             if (call.callee.type === "Identifier" && call.callee.name === "define") {
                 isScript = true;
+                const dependencies = call.arguments.at(-2);
+                if (dependencies?.type === "ArrayExpression") {
+                    for (const element of dependencies.elements) {
+                        if (element?.type === "Literal" &&
+                            typeof element.value === "string")
+                            modules.push(element.value);
+                    }
+                }
                 const callback = call.arguments.at(-1);
                 if (isCallback(callback)) {
                     const names = amdReturnedNames(callback);
@@ -132,7 +145,11 @@ function inspectProgram(program) {
             }
         }
     }
-    return { isScript, returned: opaque || !known ? undefined : returned };
+    return {
+        isScript,
+        modules,
+        returned: opaque || !known ? undefined : returned,
+    };
 }
 function findTag(comments, name) {
     const pattern = new RegExp(`${name}(?:[ \\t]+(\\S+))?`);
@@ -182,7 +199,7 @@ export function analyzeSource(filename, source) {
     }
     const apiVersion = findTag(parsed.comments, "@NApiVersion");
     const scriptType = findTag(parsed.comments, "@NScriptType");
-    const { isScript, returned } = inspectProgram(parsed.program);
+    const { isScript, modules, returned } = inspectProgram(parsed.program);
     const inferred = isScript && returned ? inferScriptType(returned) : undefined;
     // Not a script: no tags and nothing that implies an entry point.
     if (!apiVersion && !scriptType && !inferred)
@@ -223,5 +240,18 @@ export function analyzeSource(filename, source) {
         for (const message of problems)
             report("entryPoints", message, scriptType?.offset ?? 0);
     }
+    // The declared type wins; otherwise fall back to what the entry points imply.
+    const declaredType = declared ? typeByName(declared) : undefined;
+    const side = sideOf(declaredType ? [declaredType] : (inferred?.types ?? []));
+    const single = declaredType ??
+        (inferred?.types.length === 1 ? inferred.types[0] : undefined);
+    if (side || single) {
+        for (const module of modules) {
+            const message = (side && misplacedModule(side, module)) ||
+                (single && unsupportedModule(single.name, module));
+            if (message)
+                report("modules", message, scriptType?.offset ?? 0);
+        }
+    }
     return { diagnostics, upgrade };
 }

package/dist/lib/module-script-types.js

@@ -0,0 +1,70 @@
+// Which side of NetSuite a script type runs on, and the N/ modules that only
+// work on one side. From the "Supported Script Types" column of Oracle's SuiteScript
+// module reference; loading a module on the wrong side fails at runtime.
+// Pure logic shared by the Biome rules and the CLI.
+export const CLIENT_ONLY_MODULES = new Set([
+    "N/currentRecord",
+    "N/portlet",
+    "N/ui/dialog",
+    "N/ui/message",
+]);
+export const SERVER_ONLY_MODULES = new Set([
+    "N/auth",
+    "N/cache",
+    "N/certificateControl",
+    "N/compress",
+    "N/config",
+    "N/crypto",
+    "N/crypto/certificate",
+    "N/dataset",
+    "N/documentCapture",
+    "N/encode",
+    "N/error",
+    "N/file",
+    "N/https/clientCertificate",
+    "N/keyControl",
+    "N/llm",
+    "N/machineTranslation",
+    "N/pgp",
+    "N/piremoval",
+    "N/plugin",
+    "N/redirect",
+    "N/render",
+    "N/sftp",
+    "N/task",
+    "N/task/accounting/recognition",
+    "N/ui/serverWidget",
+    "N/workbook",
+    "N/workflow",
+]);
+/** The side shared by every candidate script type, or undefined when unknown or mixed. */
+export function sideOf(types) {
+    if (types.length === 0)
+        return undefined;
+    const clients = types.filter((t) => t.name === "ClientScript").length;
+    if (clients === types.length)
+        return "client";
+    return clients === 0 ? "server" : undefined;
+}
+/** A message when `module` cannot be loaded by a script on `side`. */
+export function misplacedModule(side, module) {
+    if (side === "server" && CLIENT_ONLY_MODULES.has(module))
+        return `${module} is only available in client scripts.`;
+    if (side === "client" && SERVER_ONLY_MODULES.has(module))
+        return `${module} is only available in server scripts.`;
+    return undefined;
+}
+const CUSTOM_TOOL_UNSUPPORTED = new Set([
+    "N/http",
+    "N/https",
+    "N/llm",
+    "N/sftp",
+]);
+/** A message when a single script type cannot load `module` at all. */
+export function unsupportedModule(scriptType, module) {
+    if (scriptType === "CustomTool" && CUSTOM_TOOL_UNSUPPORTED.has(module))
+        return `${module} is not supported in custom tool scripts.`;
+    if (scriptType === "BundleInstallationScript" && !/^N(\/|$)/.test(module))
+        return "Custom modules are not supported in bundle installation scripts.";
+    return undefined;
+}

package/dist/lib/script-side.js

@@ -0,0 +1,83 @@
+import { esExportNames } from "./biome-modules.js";
+import { parseDefine } from "./define.js";
+import { amdReturnedNames } from "./entry-points.js";
+import { inferScriptType } from "./inference.js";
+import { sideOf } from "./module-script-types.js";
+/**
+ * Script types the module containing `node` (a define() call or an ES module)
+ * could be, judged from the entry points it returns. Undefined for libraries
+ * and for entry points that cannot be analysed.
+ */
+export function inferredTypes(node) {
+    for (const candidate of [node, ...node.ancestors()]) {
+        let names;
+        if (candidate.kind === "JS_CALL_EXPRESSION") {
+            const def = parseDefine(candidate);
+            if (!def)
+                continue;
+            names = amdReturnedNames(def);
+        }
+        else if (candidate.kind === "JS_MODULE") {
+            names = esExportNames(candidate);
+        }
+        else {
+            continue;
+        }
+        return (names && inferScriptType(names))?.types;
+    }
+    return undefined;
+}
+/** Whether that module is a client or server script. Undefined when unknown or mixed. */
+export function scriptSide(node) {
+    const types = inferredTypes(node);
+    return types && sideOf(types);
+}
+const FUNCTION_KINDS = [
+    "JS_FUNCTION_DECLARATION",
+    "JS_FUNCTION_EXPRESSION",
+    "JS_ARROW_FUNCTION_EXPRESSION",
+    "JS_METHOD_OBJECT_MEMBER",
+];
+const unquote = (text) => text.replace(/^['"]|['"]$/g, "");
+/** The name a function is bound to: its declaration, variable, object key or `o.name =` target. */
+export function functionName(fn) {
+    if (fn.kind === "JS_FUNCTION_DECLARATION")
+        return fn.children().find((c) => c.kind === "JS_IDENTIFIER_BINDING")?.text;
+    if (fn.kind === "JS_METHOD_OBJECT_MEMBER") {
+        const name = fn.children()[0]?.text;
+        return name ? unquote(name) : undefined;
+    }
+    const parent = fn.parent;
+    if (parent?.kind === "JS_PROPERTY_OBJECT_MEMBER") {
+        const name = parent.children()[0]?.text;
+        return name ? unquote(name) : undefined;
+    }
+    if (parent?.kind === "JS_INITIALIZER_CLAUSE")
+        return parent.parent
+            ?.children()
+            .find((c) => c.kind === "JS_IDENTIFIER_BINDING")?.text;
+    if (parent?.kind === "JS_ASSIGNMENT_EXPRESSION") {
+        const target = parent.children()[0];
+        if (target?.kind === "JS_STATIC_MEMBER_ASSIGNMENT")
+            return target.children()[1]?.text;
+    }
+    return undefined;
+}
+/** Names of the functions enclosing `node`, innermost first. */
+export function enclosingFunctionNames(node) {
+    return node
+        .ancestors()
+        .filter((a) => FUNCTION_KINDS.includes(a.kind))
+        .map(functionName)
+        .filter((n) => !!n);
+}
+export function isFunction(node) {
+    return FUNCTION_KINDS.includes(node.kind);
+}
+/** Every node below `node`, depth first. */
+export function* descendants(node) {
+    for (const child of node.children()) {
+        yield child;
+        yield* descendants(child);
+    }
+}

package/dist/lib/script-types.js

@@ -37,6 +37,10 @@ export const SCRIPT_TYPES = [
         entryPoints: ["customizeGlImpact"],
         name: "CustomGLPlugin",
     },
+    {
+        entryPoints: [],
+        name: "CustomTool",
+    },
     {
         entryPoints: ["createDataset"],
         name: "DatasetBuilderPlugin",
@@ -86,6 +90,14 @@ export const SCRIPT_TYPES = [
         entryPoints: ["run"],
         name: "SDFInstallationScript",
     },
+    {
+        entryPoints: ["run"],
+        name: "SpaClientScript",
+    },
+    {
+        entryPoints: ["initializeSpa"],
+        name: "SpaServerScript",
+    },
     {
         entryPoints: ["onRequest"],
         name: "Suitelet",

package/dist/lib/suitescript.js

@@ -0,0 +1,23 @@
+import { importsNetSuite } from "./biome-modules.js";
+import { parseDefine } from "./define.js";
+/** Whether a node is inside an AMD `define([...], fn)` or an ES module importing `N/` modules. */
+export function inSuiteScriptModule(node) {
+    return node.ancestors().some((a) => {
+        if (a.kind === "JS_CALL_EXPRESSION")
+            return !!parseDefine(a);
+        return a.kind === "JS_MODULE" && importsNetSuite(a);
+    });
+}
+/** Whether an expression is built only from string literals (and `+`). */
+export function isStaticString(node) {
+    if (!node)
+        return false;
+    if (node.kind === "JS_STRING_LITERAL_EXPRESSION")
+        return true;
+    if (node.kind === "JS_TEMPLATE_EXPRESSION")
+        return !node.text.includes("${");
+    if (node.kind === "JS_BINARY_EXPRESSION" ||
+        node.kind === "JS_PARENTHESIZED_EXPRESSION")
+        return node.children().every(isStaticString);
+    return false;
+}

package/dist/rules/noBeforeSubmitRecordReload.js

@@ -0,0 +1,19 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { enclosingFunctionNames } from "../lib/script-side.js";
+const RECORD_CALLS = ["record.load", "record.submitFields", "record.delete"];
+// Reloading or editing the record being saved from its own beforeSubmit fails
+// with "Record has been changed". Only calls whose id is the context's
+// newRecord.id are reported; other records are fine.
+export const noBeforeSubmitRecordReload = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!RECORD_CALLS.includes(node.callee?.text ?? ""))
+            return;
+        const options = node.arguments?.children()[0]?.children()[0];
+        if (!options || !/\bid\s*:\s*[\w.]*newRecord\.id\b/.test(options.text))
+            return;
+        if (!enclosingFunctionNames(node).includes("beforeSubmit"))
+            return;
+        registerDiagnostic(node, "error", `${node.callee?.text}() on the record being saved is not allowed in beforeSubmit.`);
+    },
+});

package/dist/rules/noBrowserGlobals.js

@@ -0,0 +1,23 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { scriptSide } from "../lib/script-side.js";
+const BROWSER_GLOBALS = new Set([
+    "document",
+    "window",
+    "localStorage",
+    "sessionStorage",
+    "XMLHttpRequest",
+    "alert",
+    "navigator",
+]);
+// Server scripts run outside a browser, but TypeScript's DOM library lets
+// these names compile. Locals that reuse a name resolve to a binding and are left alone.
+export const noBrowserGlobals = defineRule({
+    query: semantic("JS_REFERENCE_IDENTIFIER"),
+    run(node, { model }) {
+        if (!BROWSER_GLOBALS.has(node.text) || model.binding(node))
+            return;
+        if (scriptSide(node) !== "server")
+            return;
+        registerDiagnostic(node, "error", `'${node.text}' does not exist in server scripts.`);
+    },
+});

package/dist/rules/noClientLog.js

@@ -0,0 +1,14 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { logCall } from "../lib/log.js";
+import { scriptSide } from "../lib/script-side.js";
+// Oracle (N/log): in a client script attached to a form, "calls to any log
+// function ... are ignored". It cannot tell whether a form is attached.
+export const noClientLog = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const info = logCall(node);
+        if (!info || scriptSide(node) !== "client")
+            return;
+        registerDiagnostic(node, "warning", `log.${info.prop}() is ignored in client scripts attached to a form; use console.`);
+    },
+});

package/dist/rules/noDynamicSuiteQL.js

@@ -0,0 +1,24 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { isStaticString } from "../lib/suitescript.js";
+// Matches query.runSuiteQL, runSuiteQLPaged and their .promise forms.
+const SUITEQL = /(^|\.)runSuiteQL(Paged)?(\.promise)?$/;
+// Building SuiteQL from variables invites injection and defeats query plan
+// caching; pass values through `params` placeholders instead. A bare variable
+// is not flagged because its contents are unknown.
+export const noDynamicSuiteQL = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!SUITEQL.test(node.callee?.text ?? ""))
+            return;
+        let sql = node.arguments?.children()[0]?.children()[0];
+        if (sql?.kind === "JS_OBJECT_EXPRESSION") {
+            const member = (sql.children()[0]?.children() ?? []).find((m) => m.children()[0]?.text.replace(/^['"]|['"]$/g, "") === "query");
+            sql = member?.children()[1];
+        }
+        if (sql &&
+            !isStaticString(sql) &&
+            sql.kind !== "JS_IDENTIFIER_EXPRESSION") {
+            registerDiagnostic(sql, "warning", "Build SuiteQL with ? placeholders and params, not string concatenation.");
+        }
+    },
+});

package/dist/rules/noEmptyEntryPoints.js

@@ -0,0 +1,19 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { ALL_ENTRY_POINTS, GENERIC_ENTRY_POINTS } from "../lib/inference.js";
+import { functionName, scriptSide } from "../lib/script-side.js";
+// Oracle: "Do not deploy scripts with blank entry functions. They still load and
+// may affect performance without doing any work." Only modules whose script type
+// is inferred are checked, so libraries with an empty `get` or `run` are ignored.
+export const noEmptyEntryPoints = defineRule({
+    query: ast("JS_FUNCTION_DECLARATION", "JS_FUNCTION_EXPRESSION", "JS_ARROW_FUNCTION_EXPRESSION", "JS_METHOD_OBJECT_MEMBER"),
+    run(node) {
+        const name = functionName(node);
+        if (!name || !ALL_ENTRY_POINTS.has(name) || GENERIC_ENTRY_POINTS.has(name))
+            return;
+        const body = node.children().find((c) => c.kind === "JS_FUNCTION_BODY");
+        const empty = body?.children().every((c) => c.children().length === 0);
+        if (!empty || !scriptSide(node))
+            return;
+        registerDiagnostic(node, "warning", `Entry point '${name}' is empty.`);
+    },
+});

package/dist/rules/noEval.js

@@ -0,0 +1,21 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+const TIMERS = ["setTimeout", "setInterval"];
+// eval(), new Function() and string-form timers run arbitrary code.
+export const noEval = defineRule({
+    query: ast("JS_CALL_EXPRESSION", "JS_NEW_EXPRESSION"),
+    run(node) {
+        const callee = node.callee?.text;
+        if (!callee)
+            return;
+        if (callee === "eval" || callee === "Function") {
+            registerDiagnostic(node, "error", `Do not use ${callee}().`);
+        }
+        else if (node.kind === "JS_CALL_EXPRESSION" && TIMERS.includes(callee)) {
+            const first = node.arguments?.children()[0]?.children()[0];
+            if (first?.kind === "JS_STRING_LITERAL_EXPRESSION" ||
+                first?.kind === "JS_TEMPLATE_EXPRESSION") {
+                registerDiagnostic(node, "error", `Do not pass a string to ${callee}(); it is evaluated as code.`);
+            }
+        }
+    },
+});

package/dist/rules/noGlobalShadowing.js

@@ -0,0 +1,34 @@
+import { ast, defineRule, registerDiagnostic, } from "@biomejs/runtime/plugin";
+import { dependencies } from "../lib/biome-modules.js";
+import { parseDefine } from "../lib/define.js";
+// `log` and `util` are SuiteScript 2.1 globals. The one allowed binding is the
+// module they come from: N/log as `log`, N/util as `util`. `error` is not listed
+// because moduleVars names the N/error identifier `error`.
+const GLOBALS = { log: "N/log", util: "N/util" };
+function isModuleBinding(node, module) {
+    const ancestors = node.ancestors();
+    for (const ancestor of ancestors) {
+        if (ancestor.kind === "JS_CALL_EXPRESSION") {
+            const def = parseDefine(ancestor);
+            if (!def)
+                continue;
+            const index = def.params.findIndex((p) => p?.text === node.text);
+            const isParameter = ancestors.some((a) => a.kind === "JS_FORMAL_PARAMETER");
+            const name = def.elements[index]?.text.slice(1, -1);
+            return isParameter && index >= 0 && name === module;
+        }
+        if (ancestor.kind === "JS_IMPORT") {
+            return dependencies(ancestor).some((d) => d.name === module);
+        }
+    }
+    return false;
+}
+export const noGlobalShadowing = defineRule({
+    query: ast("JS_IDENTIFIER_BINDING"),
+    run(node) {
+        const module = GLOBALS[node.text];
+        if (module && !isModuleBinding(node, module)) {
+            registerDiagnostic(node, "warning", `'${node.text}' shadows the global ${node.text}.`);
+        }
+    },
+});

package/dist/rules/noHardcodedSecrets.js

@@ -0,0 +1,38 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+const SECRET_NAMES = /^(password|passwd|pwd|secret|api_?key|client_?secret|token_?secret|consumer_?secret)$/i;
+const unquote = (text) => text.replace(/^['"]|['"]$/g, "");
+// Oracle: "Do not hard-code any passwords in scripts." A heuristic on names, so
+// no preset includes it; enable it explicitly. Only exact secret-like names with
+// a non-empty string literal are flagged (not `passwordId` or `tokenName`).
+export const noHardcodedSecrets = defineRule({
+    query: ast("JS_VARIABLE_DECLARATOR", "JS_PROPERTY_OBJECT_MEMBER", "JS_ASSIGNMENT_EXPRESSION"),
+    run(node) {
+        const children = node.children();
+        let name;
+        let value;
+        if (node.kind === "JS_VARIABLE_DECLARATOR") {
+            name = children.find((c) => c.kind === "JS_IDENTIFIER_BINDING")?.text;
+            value = children
+                .find((c) => c.kind === "JS_INITIALIZER_CLAUSE")
+                ?.children()[0];
+        }
+        else if (node.kind === "JS_PROPERTY_OBJECT_MEMBER") {
+            name = children[0] && unquote(children[0].text);
+            value = children[1];
+        }
+        else {
+            const target = children[0];
+            name =
+                target?.kind === "JS_STATIC_MEMBER_ASSIGNMENT"
+                    ? target.children()[1]?.text
+                    : target?.text;
+            value = children[1];
+        }
+        if (name &&
+            SECRET_NAMES.test(name) &&
+            value?.kind === "JS_STRING_LITERAL_EXPRESSION" &&
+            value.text.length > 2) {
+            registerDiagnostic(value, "error", `Do not hard-code '${name}'; read it from a script parameter or credentials.`);
+        }
+    },
+});

package/dist/rules/noHeaderUnderscores.js

@@ -0,0 +1,23 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// Oracle: "When you define custom headers, don't include underscores in the name."
+export const noHeaderUnderscores = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^https\.[a-zA-Z]+(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const options = node.arguments?.children()[0]?.children()[0];
+        if (options?.kind !== "JS_OBJECT_EXPRESSION")
+            return;
+        for (const member of options.children()[0]?.children() ?? []) {
+            const [name, headers] = member.children();
+            if (name?.text !== "headers" || headers?.kind !== "JS_OBJECT_EXPRESSION")
+                continue;
+            for (const header of headers.children()[0]?.children() ?? []) {
+                const key = header.children()[0];
+                if (key?.text.replace(/^['"]|['"]$/g, "").includes("_")) {
+                    registerDiagnostic(key, "warning", "Header names must not contain underscores.");
+                }
+            }
+        }
+    },
+});

package/dist/rules/noInsecureHttpsUrl.js

@@ -0,0 +1,20 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// Oracle: the N/https module "does not allow the HTTP protocol".
+export const noInsecureHttpsUrl = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^https\.[a-zA-Z]+(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const options = node.arguments?.children()[0]?.children()[0];
+        if (options?.kind !== "JS_OBJECT_EXPRESSION")
+            return;
+        for (const member of options.children()[0]?.children() ?? []) {
+            const [name, value] = member.children();
+            if (name?.text === "url" &&
+                value?.kind === "JS_STRING_LITERAL_EXPRESSION" &&
+                /^['"]http:\/\//i.test(value.text)) {
+                registerDiagnostic(value, "error", "N/https does not allow http:// URLs.");
+            }
+        }
+    },
+});

package/dist/rules/noLogModule.js

@@ -1,6 +1,9 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
 import { dependencies } from "../lib/biome-modules.js";
-// Use the global `log` instead of loading N/log. The global is not available in
+// Opt-in style: use the global `log` instead of loading N/log. It is the opposite
+// of noMissingModules, which requires loading N/log, so enable only one of them.
+// Oracle's skills disagree on this (upgrade: the global exists but importing is
+// recommended; learning: it is not global). The global is not available in
 // client scripts, so scope this rule away from them with the plugin `includes`.
 export const noLogModule = defineRule({
     query: ast("JS_CALL_EXPRESSION", "JS_IMPORT"),

package/dist/rules/noMapReduceSearchResults.js

@@ -0,0 +1,33 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { descendants, enclosingFunctionNames, isFunction, } from "../lib/script-side.js";
+const RESULTS = /\.getRange\(/;
+// Oracle: running a search in getInputData and returning its results risks a
+// timeout; return the search.create()/search.load() object instead. Detects
+// `.getRange()` results returned directly or through a local variable.
+export const noMapReduceSearchResults = defineRule({
+    query: ast("JS_RETURN_STATEMENT"),
+    run(node) {
+        if (!enclosingFunctionNames(node).includes("getInputData"))
+            return;
+        const argument = node.children()[0];
+        if (!argument)
+            return;
+        let flagged = RESULTS.test(argument.text);
+        if (!flagged && argument.kind === "JS_IDENTIFIER_EXPRESSION") {
+            const fn = node.ancestors().find(isFunction);
+            for (const d of fn ? descendants(fn) : []) {
+                if (d.kind !== "JS_VARIABLE_DECLARATOR")
+                    continue;
+                const id = d.children().find((c) => c.kind === "JS_IDENTIFIER_BINDING");
+                const init = d
+                    .children()
+                    .find((c) => c.kind === "JS_INITIALIZER_CLAUSE");
+                if (id?.text === argument.text && init && RESULTS.test(init.text))
+                    flagged = true;
+            }
+        }
+        if (flagged) {
+            registerDiagnostic(argument, "warning", "Return the search object from getInputData instead of its results.");
+        }
+    },
+});

package/dist/rules/noMissingModules.js

@@ -0,0 +1,26 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { MODULES } from "../lib/modules.js";
+import { inSuiteScriptModule } from "../lib/suitescript.js";
+// `util` is a global in SuiteScript 2.1, so it never needs loading. `log` is
+// treated like every other module: load N/log when you call it.
+const ALIASES = new Map(Object.entries(MODULES)
+    .filter(([, identifier]) => identifier !== "util")
+    .map(([name, identifier]) => [identifier, name]));
+// Reports `record.load()` when `record` resolves to no binding, meaning the
+// module was never added to `define()` or imported. Locals that shadow the
+// name resolve to a binding and are left alone.
+export const noMissingModules = defineRule({
+    query: semantic("JS_REFERENCE_IDENTIFIER"),
+    run(node, { model }) {
+        const module = ALIASES.get(node.text);
+        if (!module || model.binding(node))
+            return;
+        const member = node.parent?.parent;
+        if (member?.kind !== "JS_STATIC_MEMBER_EXPRESSION" ||
+            member.children()[0]?.text !== node.text)
+            return;
+        if (!inSuiteScriptModule(node))
+            return;
+        registerDiagnostic(node, "error", `'${node.text}' is used but ${module} is not loaded.`);
+    },
+});

package/dist/rules/noModuleScopeApiCalls.js

@@ -0,0 +1,39 @@
+import { ast, defineRule, registerDiagnostic, } from "@biomejs/runtime/plugin";
+import { pairs, parseDefine } from "../lib/define.js";
+const FUNCTIONS = [
+    "JS_FUNCTION_EXPRESSION",
+    "JS_ARROW_FUNCTION_EXPRESSION",
+    "JS_FUNCTION_DECLARATION",
+    "JS_METHOD_OBJECT_MEMBER",
+    "JS_METHOD_CLASS_MEMBER",
+];
+// N/ APIs called while the define() callback runs (module scope) can fail on
+// deploy; initialize lazily from an entry point instead. N/log is exempt.
+export const noModuleScopeApiCalls = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const def = parseDefine(node);
+        if (!def?.body)
+            return;
+        const aliases = new Set(pairs(def)
+            .filter((d) => d.name?.startsWith("N/") && d.name !== "N/log")
+            .map((d) => d.param?.text));
+        const visit = (n) => {
+            if (FUNCTIONS.includes(n.kind))
+                return;
+            if (n.kind === "JS_CALL_EXPRESSION") {
+                const callee = n.children()[0];
+                const object = callee?.kind === "JS_STATIC_MEMBER_EXPRESSION"
+                    ? callee.children()[0]?.text
+                    : undefined;
+                if (object && aliases.has(object)) {
+                    registerDiagnostic(n, "warning", `${callee?.text}() runs at module scope; call it from an entry point.`);
+                }
+            }
+            for (const child of n.children())
+                visit(child);
+        };
+        for (const child of def.body.children())
+            visit(child);
+    },
+});

package/dist/rules/noNativeIterators.js

@@ -0,0 +1,16 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// NetSuite runs GraalJS; Oracle's guidance is to use array methods, not
+// generators or Symbol.iterator.
+export const noNativeIterators = defineRule({
+    query: ast("JS_FUNCTION_DECLARATION", "JS_FUNCTION_EXPRESSION", "JS_STATIC_MEMBER_EXPRESSION"),
+    run(node) {
+        if (node.kind === "JS_STATIC_MEMBER_EXPRESSION") {
+            if (node.text === "Symbol.iterator") {
+                registerDiagnostic(node, "warning", "Avoid Symbol.iterator.");
+            }
+        }
+        else if (node.starToken) {
+            registerDiagnostic(node, "warning", "Avoid generator functions.");
+        }
+    },
+});

package/dist/rules/noQueryColumnFieldAndFormula.js

@@ -0,0 +1,19 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { hasProperty } from "../lib/log.js";
+// Oracle (N/query): a column's `formula` and `fieldId` "cannot be set at the same time."
+export const noQueryColumnFieldAndFormula = defineRule({
+    query: ast("JS_OBJECT_EXPRESSION"),
+    run(node) {
+        if (!hasProperty(node, "fieldId") || !hasProperty(node, "formula"))
+            return;
+        const inColumn = node.ancestors().some((a) => {
+            if (a.kind === "JS_CALL_EXPRESSION")
+                return /createColumn$/.test(a.children()[0]?.text ?? "");
+            return (a.kind === "JS_PROPERTY_OBJECT_MEMBER" &&
+                a.children()[0]?.text === "columns");
+        });
+        if (inColumn) {
+            registerDiagnostic(node, "error", "A query column cannot set both fieldId and formula.");
+        }
+    },
+});

package/dist/rules/noRecordInLoop.js

@@ -0,0 +1,31 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+const LOOPS = [
+    "JS_FOR_STATEMENT",
+    "JS_FOR_OF_STATEMENT",
+    "JS_FOR_IN_STATEMENT",
+    "JS_WHILE_STATEMENT",
+    "JS_DO_WHILE_STATEMENT",
+];
+const ITERATORS = /\.(forEach|each|map)$/;
+const RECORD_CALLS = ["record.load", "record.create"];
+// Loading or creating a record per iteration burns governance; search or
+// submitFields in bulk instead. Opt-in: Map/Reduce `map` handles one record per call.
+export const noRecordInLoop = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!RECORD_CALLS.includes(node.callee?.text ?? ""))
+            return;
+        const inLoop = node.ancestors().some((a) => {
+            if (LOOPS.includes(a.kind))
+                return true;
+            if (a.kind !== "JS_CALL_ARGUMENT_LIST")
+                return false;
+            const call = a.parent?.parent;
+            return (call?.kind === "JS_CALL_EXPRESSION" &&
+                ITERATORS.test(call.children()[0]?.text ?? ""));
+        });
+        if (inLoop) {
+            registerDiagnostic(node, "warning", `${node.callee?.text}() inside a loop; use a search or submitFields instead.`);
+        }
+    },
+});

package/dist/rules/noSuiteScript1Api.js

@@ -0,0 +1,10 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// SuiteScript 2.1 only: nlapiXxx functions and nlobjXxx objects are 1.0 leftovers.
+export const noSuiteScript1Api = defineRule({
+    query: ast("JS_REFERENCE_IDENTIFIER"),
+    run(node) {
+        if (/^(nlapi|nlobj)[A-Z]/.test(node.text)) {
+            registerDiagnostic(node, "error", `'${node.text}' is SuiteScript 1.0; use the SuiteScript 2.1 N/ modules.`);
+        }
+    },
+});

package/dist/rules/noUserEventContextSave.js

@@ -0,0 +1,12 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// Oracle: "You can't use record.Record.save() here" for the newRecord and
+// oldRecord of a user event context; load the record to change it instead.
+export const noUserEventContextSave = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const callee = node.callee?.text ?? "";
+        if (/(^|\.)(newRecord|oldRecord)\.save$/.test(callee)) {
+            registerDiagnostic(node, "error", `${callee}() is not allowed; the context record is read-only.`);
+        }
+    },
+});

package/dist/rules/noWrongScriptTypeModules.js

@@ -0,0 +1,28 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { dependencies } from "../lib/biome-modules.js";
+import { misplacedModule, sideOf, unsupportedModule, } from "../lib/module-script-types.js";
+import { inferredTypes } from "../lib/script-side.js";
+// Loading a client-only module in a server script (or the reverse), or a module
+// a script type does not support, fails at runtime. The type comes from the
+// entry points the module returns, so libraries and uninferable modules are
+// never flagged.
+export const noWrongScriptTypeModules = defineRule({
+    query: ast("JS_CALL_EXPRESSION", "JS_IMPORT"),
+    run(node) {
+        const deps = dependencies(node);
+        if (deps.length === 0)
+            return;
+        const types = inferredTypes(node);
+        if (!types)
+            return;
+        const side = sideOf(types);
+        const single = types.length === 1 ? types[0]?.name : undefined;
+        for (const { name, nameNode } of deps) {
+            const message = name &&
+                ((side && misplacedModule(side, name)) ||
+                    (single && unsupportedModule(single, name)));
+            if (message && nameNode)
+                registerDiagnostic(nameNode, "error", message);
+        }
+    },
+});

package/dist/rules/requireClientValidateReturn.js

@@ -0,0 +1,27 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { descendants, functionName, scriptSide } from "../lib/script-side.js";
+const VALIDATORS = [
+    "saveRecord",
+    "validateField",
+    "validateLine",
+    "validateInsert",
+    "validateDelete",
+];
+// Oracle: saveRecord and validateField return "true ... false otherwise". Only a
+// body with no `return <value>` at all is flagged; code paths are not analysed.
+export const requireClientValidateReturn = defineRule({
+    query: ast("JS_FUNCTION_DECLARATION", "JS_FUNCTION_EXPRESSION", "JS_ARROW_FUNCTION_EXPRESSION", "JS_METHOD_OBJECT_MEMBER"),
+    run(node) {
+        const name = functionName(node);
+        if (!name || !VALIDATORS.includes(name))
+            return;
+        const body = node.children().find((c) => c.kind === "JS_FUNCTION_BODY");
+        if (!body || scriptSide(node) !== "client")
+            return;
+        for (const d of descendants(body)) {
+            if (d.kind === "JS_RETURN_STATEMENT" && d.children().length > 0)
+                return;
+        }
+        registerDiagnostic(node, "warning", `'${name}' must return true or false.`);
+    },
+});

package/dist/rules/requireCustpagePrefix.js

@@ -0,0 +1,22 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+const ADDERS = /\.(addField|addFieldGroup|addSublist|addTab|addSubtab|addButton)$/;
+// Oracle: the internal ID of a UI object added to a page "must be prefixed with
+// custpage". Only a string literal `id` is checked.
+export const requireCustpagePrefix = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!ADDERS.test(node.callee?.text ?? ""))
+            return;
+        const options = node.arguments?.children()[0]?.children()[0];
+        if (options?.kind !== "JS_OBJECT_EXPRESSION")
+            return;
+        for (const member of options.children()[0]?.children() ?? []) {
+            const [name, value] = member.children();
+            if (name?.text === "id" &&
+                value?.kind === "JS_STRING_LITERAL_EXPRESSION" &&
+                !/^['"]custpage/.test(value.text)) {
+                registerDiagnostic(value, "warning", "The id of a UI object must start with 'custpage'.");
+            }
+        }
+    },
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "biome-plugin-suitescript",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Biome lint plugins and a tag checker for NetSuite SuiteScript 2.1, ported from eslint-plugin-suitescript.",
   "keywords": [
     "biome-plugin",