biome-plugin-suitescript 0.1.1 → 0.3.0

package/dist/lib/typings.js

@@ -0,0 +1,2 @@
+// The shape of the data generated from @hitc/netsuite-types (see typings-data.ts).
+export {};

package/dist/rules/logRequireDetails.js

@@ -1,5 +1,9 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
 import { hasProperty, logCall } from "../lib/log.js";
+// Tier 0: docs/adr/0002-options-are-separate-rules.md.
+// Oracle's help center marks log `details` optional on all four log method pages;
+// requiring it does not contradict that, it is a house practice from the ESLint
+// log-args rules. As the lowest-precedence kind of source it is in `all` only.
 export const logRequireDetails = defineRule({
     query: ast("JS_CALL_EXPRESSION"),
     run(node) {

package/dist/rules/logRequireTitle.js

@@ -1,5 +1,6 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
 import { hasProperty, logCall } from "../lib/log.js";
+// Tier 0: docs/adr/0002-options-are-separate-rules.md.
 export const logRequireTitle = defineRule({
     query: ast("JS_CALL_EXPRESSION"),
     run(node) {

package/dist/rules/noAuthorizationHeaderInInternalRequest.js

@@ -0,0 +1,24 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { objectMembers, optionsObject, propertyValue } from "../lib/options.js";
+const INTERNAL = /^https\.(requestRestlet|requestSuitelet|requestSuiteTalkRest)(\.promise)?$/;
+// Oracle (https.requestRestlet, requestSuitelet, requestSuiteTalkRest): "Sends an
+// HTTPS request to a RESTlet and returns the response. Authentication headers are
+// automatically added." (the type definitions in N/https.d.ts say the same) and the error SSS_AUTHORIZATION_HEADER_NOT_ALLOWED: "The
+// authorization header is set."
+export const noAuthorizationHeaderInInternalRequest = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!INTERNAL.test(node.callee?.text ?? ""))
+            return;
+        const options = optionsObject(node);
+        const headers = options && propertyValue(options, "headers");
+        if (headers?.kind !== "JS_OBJECT_EXPRESSION")
+            return;
+        for (const member of objectMembers(headers)) {
+            const name = member.children()[0]?.text.replace(/^['"]|['"]$/g, "");
+            if (name?.toLowerCase() === "authorization") {
+                registerDiagnostic(member, "error", "Do not set an Authorization header; NetSuite adds authentication to internal requests.");
+            }
+        }
+    },
+});

package/dist/rules/noBeforeSubmitRecordReload.js

@@ -0,0 +1,19 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { enclosingFunctionNames } from "../lib/script-side.js";
+const RECORD_CALLS = ["record.load", "record.submitFields", "record.delete"];
+// Reloading or editing the record being saved from its own beforeSubmit fails
+// with "Record has been changed". Only calls whose id is the context's
+// newRecord.id are reported; other records are fine.
+export const noBeforeSubmitRecordReload = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!RECORD_CALLS.includes(node.callee?.text ?? ""))
+            return;
+        const options = node.arguments?.children()[0]?.children()[0];
+        if (!options || !/\bid\s*:\s*[\w.]*newRecord\.id\b/.test(options.text))
+            return;
+        if (!enclosingFunctionNames(node).includes("beforeSubmit"))
+            return;
+        registerDiagnostic(node, "error", `${node.callee?.text}() on the record being saved is not allowed in beforeSubmit.`);
+    },
+});

package/dist/rules/noBlockedHttpsHeader.js

@@ -0,0 +1,32 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { objectMembers, optionsObject, propertyValue } from "../lib/options.js";
+const BLOCKED = new Set([
+    "connection",
+    "content-length",
+    "host",
+    "jsessionid",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "via",
+]);
+// Oracle (N/https, General Blocked HTTPS Headers): "certain headers cannot be set
+// manually when using N/https module methods. If a script attempts to set values
+// for any of the following headers, the values are discarded."
+export const noBlockedHttpsHeader = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^https\.\w+(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const options = optionsObject(node);
+        const headers = options && propertyValue(options, "headers");
+        if (headers?.kind !== "JS_OBJECT_EXPRESSION")
+            return;
+        for (const member of objectMembers(headers)) {
+            const name = member.children()[0]?.text.replace(/^['"]|['"]$/g, "");
+            if (name && BLOCKED.has(name.toLowerCase())) {
+                registerDiagnostic(member, "warning", `NetSuite discards the ${name} header set in an N/https request.`);
+            }
+        }
+    },
+});

package/dist/rules/noBlockedResponseHeader.js

@@ -0,0 +1,35 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { headerCall } from "../lib/headers.js";
+const BLOCKED = new Set([
+    "allow",
+    "content-location",
+    "content-md5",
+    "content-range",
+    "date",
+    "location",
+    "proxy-authenticate",
+    "public-key-pins",
+    "public-key-pins-report-only",
+    "retry-after",
+    "server",
+    "strict-transport-security",
+    "upgrade-insecure-requests",
+    "warning",
+    "www-authenticate",
+]);
+// Oracle (N/https, HTTPS Header Information): "certain headers cannot be set
+// manually when interacting with the https.ServerResponse Objects sent by
+// Suitelets. If a script attempts to set values for any of these headers, the
+// system throws an SSS_INVALID_HEADER error." Only calls on a receiver named like
+// a response are checked.
+export const noBlockedResponseHeader = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/response\.(setHeader|addHeader)$/i.test(node.callee?.text ?? ""))
+            return;
+        const header = headerCall(node);
+        if (header && BLOCKED.has(header.name)) {
+            registerDiagnostic(header.nameNode, "error", `A Suitelet cannot set the ${header.name} header; NetSuite throws SSS_INVALID_HEADER.`);
+        }
+    },
+});

package/dist/rules/noBrowserGlobals.js

@@ -0,0 +1,25 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { scriptSide } from "../lib/script-side.js";
+const BROWSER_GLOBALS = new Set([
+    "document",
+    "window",
+    "localStorage",
+    "sessionStorage",
+    "XMLHttpRequest",
+    "alert",
+    "navigator",
+    "URLSearchParams",
+    "fetch",
+]);
+// Server scripts run outside a browser, but TypeScript's DOM library lets
+// these names compile. Locals that reuse a name resolve to a binding and are left alone.
+export const noBrowserGlobals = defineRule({
+    query: semantic("JS_REFERENCE_IDENTIFIER"),
+    run(node, { model }) {
+        if (!BROWSER_GLOBALS.has(node.text) || model.binding(node))
+            return;
+        if (scriptSide(node) !== "server")
+            return;
+        registerDiagnostic(node, "error", `'${node.text}' does not exist in server scripts.`);
+    },
+});

package/dist/rules/noClientLog.js

@@ -0,0 +1,14 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { logCall } from "../lib/log.js";
+import { scriptSide } from "../lib/script-side.js";
+// Oracle (N/log): in a client script attached to a form, "calls to any log
+// function ... are ignored". It cannot tell whether a form is attached.
+export const noClientLog = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const info = logCall(node);
+        if (!info || scriptSide(node) !== "client")
+            return;
+        registerDiagnostic(node, "warning", `log.${info.prop}() is ignored in client scripts attached to a form; use console.`);
+    },
+});

package/dist/rules/noConflictingClientScriptProps.js

@@ -0,0 +1,36 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { isFunction } from "../lib/script-side.js";
+// Oracle (Form.clientScriptModulePath and clientScriptFileId): PROPERTY_VALUE_CONFLICT,
+// "You attempted to set this value when the Form.clientScriptFileId property value
+// has already been specified." Setting both on the same form fails.
+export const noConflictingClientScriptProps = defineRule({
+    query: ast("JS_ASSIGNMENT_EXPRESSION"),
+    run(node) {
+        const target = node.children()[0];
+        if (target?.kind !== "JS_STATIC_MEMBER_ASSIGNMENT")
+            return;
+        const [object, member] = target.children();
+        if (member?.text !== "clientScriptModulePath" || !object)
+            return;
+        const scope = node.ancestors().find(isFunction);
+        if (!scope)
+            return;
+        const conflict = (function find(n) {
+            for (const child of n.children()) {
+                if (child.kind === "JS_ASSIGNMENT_EXPRESSION") {
+                    const t = child.children()[0];
+                    if (t?.kind === "JS_STATIC_MEMBER_ASSIGNMENT" &&
+                        t.children()[1]?.text === "clientScriptFileId" &&
+                        t.children()[0]?.text === object.text)
+                        return true;
+                }
+                if (find(child))
+                    return true;
+            }
+            return false;
+        })(scope);
+        if (conflict) {
+            registerDiagnostic(node, "error", `Set either clientScriptFileId or clientScriptModulePath on ${object.text}, not both.`);
+        }
+    },
+});

package/dist/rules/noDynamicRequire.js

@@ -0,0 +1,23 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { callArguments } from "../lib/options.js";
+// Oracle's OWASP skill: "Hardcode module paths; never build from input."
+// A module name passed to require() must be a string literal, alone or in an
+// array of them.
+export const noDynamicRequire = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (node.callee?.text !== "require")
+            return;
+        const first = callArguments(node)[0];
+        if (!first)
+            return;
+        const names = first.kind === "JS_ARRAY_EXPRESSION"
+            ? (first.children()[0]?.children() ?? [])
+            : [first];
+        for (const name of names) {
+            if (name.kind !== "JS_STRING_LITERAL_EXPRESSION") {
+                registerDiagnostic(name, "warning", "Pass require() a string literal module name, not an expression.");
+            }
+        }
+    },
+});

package/dist/rules/noDynamicSuiteQL.js

@@ -0,0 +1,29 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { optionsObject, propertyValue } from "../lib/options.js";
+import { isStaticString } from "../lib/suitescript.js";
+// Matches query.runSuiteQL, runSuiteQLPaged and their .promise forms.
+const SUITEQL = /(^|\.)runSuiteQL(Paged)?(\.promise)?$/;
+// Building SuiteQL from variables invites injection and defeats query plan
+// caching; pass values through `params` placeholders instead. A bare variable
+// is not flagged because its contents are unknown. A call that passes `params`
+// is skipped: the OWASP skill's own examples build `IN (${placeholders})` and an
+// allowlisted `ORDER BY ${column}` into the text and bind the values through
+// `params`.
+export const noDynamicSuiteQL = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!SUITEQL.test(node.callee?.text ?? ""))
+            return;
+        const options = optionsObject(node);
+        if (options && propertyValue(options, "params"))
+            return;
+        const sql = options
+            ? propertyValue(options, "query")
+            : node.arguments?.children()[0]?.children()[0];
+        if (sql &&
+            !isStaticString(sql) &&
+            sql.kind !== "JS_IDENTIFIER_EXPRESSION") {
+            registerDiagnostic(sql, "warning", "Build SuiteQL with ? placeholders and params, not string concatenation.");
+        }
+    },
+});

package/dist/rules/noEmptyEntryPoints.js

@@ -0,0 +1,19 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { ALL_ENTRY_POINTS, GENERIC_ENTRY_POINTS } from "../lib/inference.js";
+import { functionName, scriptSide } from "../lib/script-side.js";
+// Oracle: "Do not deploy scripts with blank entry functions. They still load and
+// may affect performance without doing any work." Only modules whose script type
+// is inferred are checked, so libraries with an empty `get` or `run` are ignored.
+export const noEmptyEntryPoints = defineRule({
+    query: ast("JS_FUNCTION_DECLARATION", "JS_FUNCTION_EXPRESSION", "JS_ARROW_FUNCTION_EXPRESSION", "JS_METHOD_OBJECT_MEMBER"),
+    run(node) {
+        const name = functionName(node);
+        if (!name || !ALL_ENTRY_POINTS.has(name) || GENERIC_ENTRY_POINTS.has(name))
+            return;
+        const body = node.children().find((c) => c.kind === "JS_FUNCTION_BODY");
+        const empty = body?.children().every((c) => c.children().length === 0);
+        if (!empty || !scriptSide(node))
+            return;
+        registerDiagnostic(node, "warning", `Entry point '${name}' is empty.`);
+    },
+});

package/dist/rules/noExtraDeps.js

@@ -0,0 +1,16 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { parseDefine } from "../lib/define.js";
+// More dependencies than callback parameters: the extra modules load but cannot
+// be used. NetSuite does not fail on it, so this is a warning. The matching
+// check for parameters without a dependency is noExtraParams.
+export const noExtraDeps = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const def = parseDefine(node);
+        if (!def)
+            return;
+        for (const extra of def.elements.slice(def.params.length)) {
+            registerDiagnostic(extra, "warning", `Excess module name ${extra.text}.`);
+        }
+    },
+});

package/dist/rules/noExtraParams.js

@@ -0,0 +1,17 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { parseDefine } from "../lib/define.js";
+// More callback parameters than dependencies: the extra parameters are always
+// undefined, which fails when the module uses them. The matching check for
+// dependencies without a parameter is noExtraDeps.
+export const noExtraParams = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const def = parseDefine(node);
+        if (!def)
+            return;
+        for (const extra of def.params.slice(def.elements.length)) {
+            if (extra)
+                registerDiagnostic(extra, "error", `Excess module identifier '${extra.text}'.`);
+        }
+    },
+});

package/dist/rules/noGlobalShadowing.js

@@ -0,0 +1,38 @@
+import { ast, defineRule, registerDiagnostic, } from "@biomejs/runtime/plugin";
+import { dependencies } from "../lib/biome-modules.js";
+import { parseDefine } from "../lib/define.js";
+// Oracle's upgrade skill: not renaming `log` or `util` "shadows SS2.1 globals and
+// can break logging or utility calls" (listed as `error` in its SKILL.md).
+// `log` and `util` are SuiteScript 2.1 globals. The one allowed binding is the
+// module they come from: N/log as `log`, N/util as `util`. `error` is not listed
+// because moduleVars names the N/error identifier `error`.
+const GLOBALS = { log: "N/log", util: "N/util" };
+function isModuleBinding(node, module) {
+    const ancestors = node.ancestors();
+    for (const ancestor of ancestors) {
+        if (ancestor.kind === "JS_CALL_EXPRESSION") {
+            const def = parseDefine(ancestor);
+            if (!def)
+                continue;
+            const index = def.params.findIndex((p) => p?.text === node.text);
+            const isParameter = ancestors.some((a) => a.kind === "JS_FORMAL_PARAMETER");
+            const name = def.elements[index]?.text.slice(1, -1);
+            return isParameter && index >= 0 && name === module;
+        }
+        if (ancestor.kind === "JS_IMPORT") {
+            return dependencies(ancestor).some((d) => d.name === module);
+        }
+    }
+    return false;
+}
+export const noGlobalShadowing = defineRule({
+    query: ast("JS_IDENTIFIER_BINDING"),
+    run(node) {
+        const module = Object.hasOwn(GLOBALS, node.text)
+            ? GLOBALS[node.text]
+            : undefined;
+        if (module && !isModuleBinding(node, module)) {
+            registerDiagnostic(node, "error", `'${node.text}' shadows the global ${node.text}.`);
+        }
+    },
+});

package/dist/rules/noHardcodedAuthPasswords.js

@@ -0,0 +1,27 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { optionsObject, propertyValue, stringValue } from "../lib/options.js";
+const PASSWORD_OPTIONS = {
+    changeEmail: ["password"],
+    changePassword: ["currentPassword", "newPassword"],
+};
+// Oracle (SuiteScript security considerations): "Don't hard-code any passwords in
+// scripts." and, for N/auth, "Be extremely careful when using the N/auth module to
+// change an email or user password. Both the auth.changeEmail(options) and
+// auth.changePassword(options) methods allow you to include a plaintext string for
+// the password."
+export const noHardcodedAuthPasswords = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const match = /^auth\.(changePassword|changeEmail)(\.promise)?$/.exec(node.callee?.text ?? "");
+        const keys = match?.[1] && PASSWORD_OPTIONS[match[1]];
+        const options = optionsObject(node);
+        if (!keys || !options)
+            return;
+        for (const key of keys) {
+            const value = propertyValue(options, key);
+            if (value && stringValue(value)) {
+                registerDiagnostic(value, "warning", `Do not hard-code the ${key} in a script.`);
+            }
+        }
+    },
+});

package/dist/rules/noHardcodedSecrets.js

@@ -0,0 +1,43 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+const SECRET_NAMES = /^(password|passwd|pwd|secret|api_?key|client_?secret|token_?secret|consumer_?secret)$/i;
+const unquote = (text) => text.replace(/^['"]|['"]$/g, "");
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle: "Don't hard-code any passwords in scripts." The OWASP skill agrees, but
+// its `SKILL.md` shows script parameters as the safe place while its
+// references/02 says script parameters are not a secret store and points to API
+// Secrets. `SKILL.md` outranks the reference; the message follows the reference
+// because it is the more precise advice. A heuristic on names, so
+// no preset includes it; enable it explicitly. Only exact secret-like names with
+// a non-empty string literal are flagged (not `passwordId` or `tokenName`).
+export const noHardcodedSecrets = defineRule({
+    query: ast("JS_VARIABLE_DECLARATOR", "JS_PROPERTY_OBJECT_MEMBER", "JS_ASSIGNMENT_EXPRESSION"),
+    run(node) {
+        const children = node.children();
+        let name;
+        let value;
+        if (node.kind === "JS_VARIABLE_DECLARATOR") {
+            name = children.find((c) => c.kind === "JS_IDENTIFIER_BINDING")?.text;
+            value = children
+                .find((c) => c.kind === "JS_INITIALIZER_CLAUSE")
+                ?.children()[0];
+        }
+        else if (node.kind === "JS_PROPERTY_OBJECT_MEMBER") {
+            name = children[0] && unquote(children[0].text);
+            value = children[1];
+        }
+        else {
+            const target = children[0];
+            name =
+                target?.kind === "JS_STATIC_MEMBER_ASSIGNMENT"
+                    ? target.children()[1]?.text
+                    : target?.text;
+            value = children[1];
+        }
+        if (name &&
+            SECRET_NAMES.test(name) &&
+            value?.kind === "JS_STRING_LITERAL_EXPRESSION" &&
+            value.text.length > 2) {
+            registerDiagnostic(value, "error", `Do not hard-code '${name}'; use an API Secret (https.createSecureString) instead of source code.`);
+        }
+    },
+});

package/dist/rules/noHeaderUnderscores.js

@@ -0,0 +1,23 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// Oracle: "When you define custom headers, don't include underscores in the name."
+export const noHeaderUnderscores = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^https\.[a-zA-Z]+(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const options = node.arguments?.children()[0]?.children()[0];
+        if (options?.kind !== "JS_OBJECT_EXPRESSION")
+            return;
+        for (const member of options.children()[0]?.children() ?? []) {
+            const [name, headers] = member.children();
+            if (name?.text !== "headers" || headers?.kind !== "JS_OBJECT_EXPRESSION")
+                continue;
+            for (const header of headers.children()[0]?.children() ?? []) {
+                const key = header.children()[0];
+                if (key?.text.replace(/^['"]|['"]$/g, "").includes("_")) {
+                    registerDiagnostic(key, "warning", "Header names must not contain underscores.");
+                }
+            }
+        }
+    },
+});

package/dist/rules/noInnerHtml.js

@@ -0,0 +1,41 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { callArguments } from "../lib/options.js";
+import { scriptSide } from "../lib/script-side.js";
+import { isStaticString } from "../lib/suitescript.js";
+const SINKS = ["innerHTML", "outerHTML"];
+const CALL_SINKS = /\.(insertAdjacentHTML|write|writeln)$/;
+const SANITIZED = /sanitize|escape|encode|purify/i;
+// Oracle's OWASP skill: "No `innerHTML` with unsanitized content (use
+// `textContent` for untrusted data)", and the same for `document.write`,
+// `outerHTML` and `insertAdjacentHTML`. Its own safe example assigns a static
+// string, so only a value that is not a literal is flagged, and a value wrapped
+// in a call named like a sanitizer is skipped. Server scripts are left to
+// noBrowserGlobals.
+export const noInnerHtml = defineRule({
+    query: ast("JS_ASSIGNMENT_EXPRESSION", "JS_CALL_EXPRESSION"),
+    run(node) {
+        let value;
+        if (node.kind === "JS_ASSIGNMENT_EXPRESSION") {
+            const [target, assigned] = node.children();
+            if (target?.kind === "JS_STATIC_MEMBER_ASSIGNMENT" &&
+                SINKS.includes(target.children()[1]?.text ?? ""))
+                value = assigned;
+        }
+        else {
+            const callee = node.callee?.text ?? "";
+            if (!CALL_SINKS.test(callee))
+                return;
+            if (/\.(write|writeln)$/.test(callee) && !callee.startsWith("document."))
+                return;
+            const args = callArguments(node);
+            value = callee.endsWith(".insertAdjacentHTML") ? args[1] : args[0];
+        }
+        if (!value || isStaticString(value))
+            return;
+        if (value.kind === "JS_CALL_EXPRESSION" && SANITIZED.test(value.text))
+            return;
+        if (scriptSide(node) === "server")
+            return;
+        registerDiagnostic(value, "warning", "Do not write unsanitized HTML; use textContent for untrusted data.");
+    },
+});

package/dist/rules/noInsecureCookie.js

@@ -0,0 +1,27 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { headerCall } from "../lib/headers.js";
+import { isStaticString } from "../lib/suitescript.js";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's OWASP skill: "Cookies set without HttpOnly, Secure, and SameSite
+// attributes are vulnerable to theft via XSS, interception over HTTP, and
+// cross-site request forgery", and Suitelet cookies "must include security
+// attributes". LOW CONFIDENCE, so no preset includes it: only a Set-Cookie value
+// built from literals can be checked, and the skill assumes a Suitelet may set
+// the header at all, which we have not confirmed.
+export const noInsecureCookie = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const header = headerCall(node);
+        if (header?.name !== "set-cookie" || !header.value)
+            return;
+        if (!isStaticString(header.value) &&
+            header.value.kind !== "JS_CALL_EXPRESSION")
+            return;
+        const text = header.value.text;
+        if (!/httponly/i.test(text) ||
+            !/secure/i.test(text) ||
+            !/samesite/i.test(text)) {
+            registerDiagnostic(header.value, "warning", "Set-Cookie needs the HttpOnly, Secure and SameSite attributes.");
+        }
+    },
+});

package/dist/rules/noInsecureHttpsUrl.js

@@ -0,0 +1,20 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// Oracle: the N/https module "does not allow the HTTP protocol".
+export const noInsecureHttpsUrl = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^https\.[a-zA-Z]+(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const options = node.arguments?.children()[0]?.children()[0];
+        if (options?.kind !== "JS_OBJECT_EXPRESSION")
+            return;
+        for (const member of options.children()[0]?.children() ?? []) {
+            const [name, value] = member.children();
+            if (name?.text === "url" &&
+                value?.kind === "JS_STRING_LITERAL_EXPRESSION" &&
+                /^['"]http:\/\//i.test(value.text)) {
+                registerDiagnostic(value, "error", "N/https does not allow http:// URLs.");
+            }
+        }
+    },
+});

package/dist/rules/noInvalidDefine.js

@@ -0,0 +1,47 @@
+import { ast, defineRule, registerDiagnostic, } from "@biomejs/runtime/plugin";
+import { callArguments } from "../lib/options.js";
+// A define() call has one of four shapes, and its last argument is the factory:
+// define(factory), define(deps, factory), define(name, factory) or
+// define(name, deps, factory). Arguments that cannot be judged statically
+// (identifiers, calls) are accepted; only a literal of the wrong kind is flagged.
+const NAME = "JS_STRING_LITERAL_EXPRESSION";
+const DEPS = "JS_ARRAY_EXPRESSION";
+const LITERALS = [
+    NAME,
+    DEPS,
+    "JS_NUMBER_LITERAL_EXPRESSION",
+    "JS_BOOLEAN_LITERAL_EXPRESSION",
+    "JS_NULL_LITERAL_EXPRESSION",
+];
+const wrongLiteral = (node, ...allowed) => !!node && LITERALS.includes(node.kind) && !allowed.includes(node.kind);
+export const noInvalidDefine = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (node.callee?.text !== "define")
+            return;
+        const args = callArguments(node);
+        const factory = args[args.length - 1];
+        let problem;
+        if (args.length === 0) {
+            problem = "define() needs a factory.";
+        }
+        else if (args.length > 3) {
+            problem =
+                "define() takes at most a name, a dependency array and a factory.";
+        }
+        else if (wrongLiteral(factory)) {
+            problem = "The define() factory must be a function or an object.";
+        }
+        else if (args.length === 2 && wrongLiteral(args[0], NAME, DEPS)) {
+            problem =
+                "The first define() argument must be a dependency array or a name.";
+        }
+        else if (args.length === 3 &&
+            (wrongLiteral(args[0], NAME) || wrongLiteral(args[1], DEPS))) {
+            problem =
+                "define(name, dependencies, factory) needs a string name and a dependency array.";
+        }
+        if (problem)
+            registerDiagnostic(node, "error", problem);
+    },
+});

package/dist/rules/noInvalidEnumMember.js

@@ -0,0 +1,24 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { moduleOfReceiver, typingsOf } from "../lib/module-calls.js";
+// A member the type definitions (Tier 2) do not list for a module enum
+// (`record.Type.CUSTOMR`) evaluates to undefined, which then fails a required
+// option at runtime. The enum's module is resolved from the define() or import
+// binding of the receiver.
+export const noInvalidEnumMember = defineRule({
+    query: semantic("JS_STATIC_MEMBER_EXPRESSION"),
+    run(node, { model }) {
+        const [object, member] = node.children();
+        if (object?.kind !== "JS_STATIC_MEMBER_EXPRESSION" || !member)
+            return;
+        const [receiver, enumName] = object.children();
+        if (!receiver || !enumName)
+            return;
+        const enums = typingsOf(moduleOfReceiver(receiver, model))?.enums;
+        const members = enums && Object.hasOwn(enums, enumName.text)
+            ? enums[enumName.text]
+            : undefined;
+        if (members && !members.includes(member.text)) {
+            registerDiagnostic(member, "warning", `${member.text} is not a member of ${receiver.text}.${enumName.text}.`);
+        }
+    },
+});