biome-plugin-suitescript 0.1.1 → 0.3.0

package/dist/rules/noLocationHeader.js

@@ -0,0 +1,20 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { headerCall } from "../lib/headers.js";
+import { isStaticString } from "../lib/suitescript.js";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's OWASP skill: "SAFE: use the documented redirect module instead of
+// writing raw headers", because an unvalidated value in a response header can
+// split the response. LOW CONFIDENCE, so no preset includes it: the value may
+// have been validated, and the skill's references still set Location after
+// sanitising it.
+export const noLocationHeader = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const header = headerCall(node);
+        if (header?.name === "location" &&
+            header.value &&
+            !isStaticString(header.value)) {
+            registerDiagnostic(header.value, "warning", "Use N/redirect instead of writing a Location header from a variable.");
+        }
+    },
+});

package/dist/rules/noLogModule.js

@@ -1,7 +1,13 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
 import { dependencies } from "../lib/biome-modules.js";
-// Use the global `log` instead of loading N/log. The global is not available in
-// client scripts, so scope this rule away from them with the plugin `includes`.
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md, docs/adr/0006-log-is-a-global-with-two-opposite-styles.md.
+// Opt-in style: use the global `log` instead of loading N/log. Oracle's help
+// center says "NetSuite loads the log Object by default for all script types. You
+// do not need to load it manually", which is what this rule follows. It is the
+// opposite of requireLogModule, so enable only one of them. (The upgrade skill
+// says the global exists but loading is recommended, which requireLogModule
+// follows; the learning skill says it is not global and loses.) Logging in a client script attached to a form is
+// ignored either way; see noClientLog.
 export const noLogModule = defineRule({
     query: ast("JS_CALL_EXPRESSION", "JS_IMPORT"),
     run(node) {

package/dist/rules/noMapReduceSearchResults.js

@@ -0,0 +1,33 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { descendants, enclosingFunctionNames, isFunction, } from "../lib/script-side.js";
+const RESULTS = /\.getRange\(/;
+// Oracle: running a search in getInputData and returning its results risks a
+// timeout; return the search.create()/search.load() object instead. Detects
+// `.getRange()` results returned directly or through a local variable.
+export const noMapReduceSearchResults = defineRule({
+    query: ast("JS_RETURN_STATEMENT"),
+    run(node) {
+        if (!enclosingFunctionNames(node).includes("getInputData"))
+            return;
+        const argument = node.children()[0];
+        if (!argument)
+            return;
+        let flagged = RESULTS.test(argument.text);
+        if (!flagged && argument.kind === "JS_IDENTIFIER_EXPRESSION") {
+            const fn = node.ancestors().find(isFunction);
+            for (const d of fn ? descendants(fn) : []) {
+                if (d.kind !== "JS_VARIABLE_DECLARATOR")
+                    continue;
+                const id = d.children().find((c) => c.kind === "JS_IDENTIFIER_BINDING");
+                const init = d
+                    .children()
+                    .find((c) => c.kind === "JS_INITIALIZER_CLAUSE");
+                if (id?.text === argument.text && init && RESULTS.test(init.text))
+                    flagged = true;
+            }
+        }
+        if (flagged) {
+            registerDiagnostic(argument, "warning", "Return the search object from getInputData instead of its results.");
+        }
+    },
+});

package/dist/rules/noMissingModules.js

@@ -0,0 +1,29 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { MODULES } from "../lib/modules.js";
+import { inSuiteScriptModule } from "../lib/suitescript.js";
+// Tier 0: docs/adr/0006-log-is-a-global-with-two-opposite-styles.md.
+// `log` and `util` are globals in SuiteScript 2.1 ("NetSuite loads the log Object
+// by default for all script types. You do not need to load it manually."), so
+// neither needs loading. requireLogModule is the style that wants N/log loaded.
+const GLOBALS = ["log", "util"];
+const ALIASES = new Map(Object.entries(MODULES)
+    .filter(([, identifier]) => !GLOBALS.includes(identifier))
+    .map(([name, identifier]) => [identifier, name]));
+// Reports `record.load()` when `record` resolves to no binding, meaning the
+// module was never added to `define()` or imported. Locals that shadow the
+// name resolve to a binding and are left alone.
+export const noMissingModules = defineRule({
+    query: semantic("JS_REFERENCE_IDENTIFIER"),
+    run(node, { model }) {
+        const module = ALIASES.get(node.text);
+        if (!module || model.binding(node))
+            return;
+        const member = node.parent?.parent;
+        if (member?.kind !== "JS_STATIC_MEMBER_EXPRESSION" ||
+            member.children()[0]?.text !== node.text)
+            return;
+        if (!inSuiteScriptModule(node))
+            return;
+        registerDiagnostic(node, "error", `'${node.text}' is used but ${module} is not loaded.`);
+    },
+});

package/dist/rules/noModuleScopeApiCalls.js

@@ -0,0 +1,49 @@
+import { ast, defineRule, registerDiagnostic, } from "@biomejs/runtime/plugin";
+import { pairs, parseDefine } from "../lib/define.js";
+const FUNCTIONS = [
+    "JS_FUNCTION_EXPRESSION",
+    "JS_ARROW_FUNCTION_EXPRESSION",
+    "JS_FUNCTION_DECLARATION",
+    "JS_METHOD_OBJECT_MEMBER",
+    "JS_METHOD_CLASS_MEMBER",
+];
+const FACTORIES = /\.(createColumn|createFilter|createSort|createSetting)$/;
+// Oracle's SAFE guide: "All N/ API modules are unavailable during the `define()`
+// callback execution. Calling `runtime.getCurrentScript()`, `record.load()`, or
+// any N/ API at module scope causes deployment failure." Initialize lazily from an
+// entry point instead. N/log is exempt because log is a global. The failure claim
+// comes only from this skill and has not been checked against Oracle's
+// documentation, and its examples are calls that do work (getCurrentScript, record.load).
+// Calls that only build an object (`search.createColumn`, `createFilter`,
+// `createSort`, `createSetting`) are skipped, because nothing says they fail; remove
+// them from FACTORIES if that turns out to be wrong.
+export const noModuleScopeApiCalls = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const def = parseDefine(node);
+        if (!def?.body)
+            return;
+        const aliases = new Set(pairs(def)
+            .filter((d) => d.name?.startsWith("N/") && d.name !== "N/log")
+            .map((d) => d.param?.text));
+        const visit = (n) => {
+            if (FUNCTIONS.includes(n.kind))
+                return;
+            if (n.kind === "JS_CALL_EXPRESSION") {
+                const callee = n.children()[0];
+                const object = callee?.kind === "JS_STATIC_MEMBER_EXPRESSION"
+                    ? callee.children()[0]?.text
+                    : undefined;
+                if (object &&
+                    aliases.has(object) &&
+                    !FACTORIES.test(callee?.text ?? "")) {
+                    registerDiagnostic(n, "error", `${callee?.text}() runs at module scope; call it from an entry point.`);
+                }
+            }
+            for (const child of n.children())
+                visit(child);
+        };
+        for (const child of def.body.children())
+            visit(child);
+    },
+});

package/dist/rules/noMultipleDefine.js

@@ -0,0 +1,14 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { descendants } from "../lib/script-side.js";
+// Oracle (entry point script validation): "The script must include one, and only
+// one, properly structured define statement. The script can't include multiple
+// define statements." NetSuite rejects the upload with MULTIPLE_DEFINE_CALLS.
+export const noMultipleDefine = defineRule({
+    query: ast("JS_MODULE", "JS_SCRIPT"),
+    run(node) {
+        const defines = [...descendants(node)].filter((n) => n.kind === "JS_CALL_EXPRESSION" && n.callee?.text === "define");
+        for (const extra of defines.slice(1)) {
+            registerDiagnostic(extra, "error", "A script can call define() only once.");
+        }
+    },
+});

package/dist/rules/noNativeIterators.js

@@ -0,0 +1,19 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// Oracle's SAFE guide: "`function*` generators and `Symbol.iterator` usage passes
+// Jest/Node.js but fails in GraalJS; use standard array methods instead." Its own
+// samples use `for...of`, so that is not flagged. Generator methods (`*foo() {}`)
+// are generators too. The failure claim comes only from this skill and has not been
+// checked against Oracle's documentation.
+export const noNativeIterators = defineRule({
+    query: ast("JS_FUNCTION_DECLARATION", "JS_FUNCTION_EXPRESSION", "JS_METHOD_OBJECT_MEMBER", "JS_METHOD_CLASS_MEMBER", "JS_STATIC_MEMBER_EXPRESSION"),
+    run(node) {
+        if (node.kind === "JS_STATIC_MEMBER_EXPRESSION") {
+            if (node.text === "Symbol.iterator") {
+                registerDiagnostic(node, "error", "Avoid Symbol.iterator.");
+            }
+        }
+        else if (node.starToken) {
+            registerDiagnostic(node, "error", "Avoid generator functions.");
+        }
+    },
+});

package/dist/rules/noPositionalOptions.js

@@ -0,0 +1,26 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { moduleCall } from "../lib/module-calls.js";
+import { callArguments } from "../lib/options.js";
+const LITERALS = [
+    "JS_STRING_LITERAL_EXPRESSION",
+    "JS_NUMBER_LITERAL_EXPRESSION",
+    "JS_BOOLEAN_LITERAL_EXPRESSION",
+    "JS_NULL_LITERAL_EXPRESSION",
+    "JS_ARRAY_EXPRESSION",
+];
+// The type definitions (Tier 2) show that a module-level function takes one
+// options object. Passing a literal instead (`record.load('customer', 1)`) leaves
+// every required option missing at runtime. Only a literal first argument is
+// flagged; a variable may hold the options object.
+export const noPositionalOptions = defineRule({
+    query: semantic("JS_CALL_EXPRESSION"),
+    run(node, { model }) {
+        const call = moduleCall(node, model);
+        if (!call || call.alternatives === 0)
+            return;
+        const first = callArguments(node)[0];
+        if (first && LITERALS.includes(first.kind)) {
+            registerDiagnostic(first, "error", `${call.callee}() takes an options object, not positional arguments.`);
+        }
+    },
+});

package/dist/rules/noPostMessageWildcard.js

@@ -0,0 +1,15 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { callArguments, stringValue } from "../lib/options.js";
+// Oracle's OWASP skill: "`postMessage` uses specific origin (never `'*'`)".
+// Sending with a wildcard target origin lets any website receive the message.
+export const noPostMessageWildcard = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/\.postMessage$/.test(node.callee?.text ?? ""))
+            return;
+        const origin = callArguments(node)[1];
+        if (stringValue(origin) === "*") {
+            registerDiagnostic(origin ?? node, "warning", "Pass postMessage() a specific target origin, never '*'.");
+        }
+    },
+});

package/dist/rules/noPublicFileUpload.js

@@ -0,0 +1,20 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's OWASP skill: uploads are stored in restricted folders and
+// `isOnline: false // Not publicly accessible by default`; its bad example sets
+// `fileObj.isOnline = true; // Publicly accessible!`. LOW CONFIDENCE, so no preset
+// includes it: public assets legitimately set isOnline.
+export const noPublicFileUpload = defineRule({
+    query: ast("JS_PROPERTY_OBJECT_MEMBER", "JS_ASSIGNMENT_EXPRESSION"),
+    run(node) {
+        const [target, value] = node.children();
+        const name = node.kind === "JS_ASSIGNMENT_EXPRESSION"
+            ? target?.kind === "JS_STATIC_MEMBER_ASSIGNMENT"
+                ? target.children()[1]?.text
+                : undefined
+            : target?.text;
+        if (name === "isOnline" && value?.text === "true") {
+            registerDiagnostic(value, "warning", "isOnline: true makes the file publicly accessible.");
+        }
+    },
+});

package/dist/rules/noQueryColumnFieldAndFormula.js

@@ -0,0 +1,19 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { hasProperty } from "../lib/log.js";
+// Oracle (N/query): a column's `formula` and `fieldId` "cannot be set at the same time."
+export const noQueryColumnFieldAndFormula = defineRule({
+    query: ast("JS_OBJECT_EXPRESSION"),
+    run(node) {
+        if (!hasProperty(node, "fieldId") || !hasProperty(node, "formula"))
+            return;
+        const inColumn = node.ancestors().some((a) => {
+            if (a.kind === "JS_CALL_EXPRESSION")
+                return /createColumn$/.test(a.children()[0]?.text ?? "");
+            return (a.kind === "JS_PROPERTY_OBJECT_MEMBER" &&
+                a.children()[0]?.text === "columns");
+        });
+        if (inColumn) {
+            registerDiagnostic(node, "error", "A query column cannot set both fieldId and formula.");
+        }
+    },
+});

package/dist/rules/noRecordInLoop.js

@@ -0,0 +1,34 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+const LOOPS = [
+    "JS_FOR_STATEMENT",
+    "JS_FOR_OF_STATEMENT",
+    "JS_FOR_IN_STATEMENT",
+    "JS_WHILE_STATEMENT",
+    "JS_DO_WHILE_STATEMENT",
+];
+const ITERATORS = /\.(forEach|each|map)$/;
+const LOOKUPS = /^(record\.load|query\.runSuiteQL(Paged)?|search\.(create|load))(\.promise)?$/;
+// Oracle's SAFE guide: "NEVER run queries inside loops" (the N+1 problem) and
+// "Loading records in loops: use searches or bulk operations." Loading a record or
+// running a query or search per iteration burns governance. Only record.load is
+// named for records, so record.create and submitFields are not flagged. Map/Reduce
+// `map` handles one record per call, so keep this rule out of those files.
+export const noRecordInLoop = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!LOOKUPS.test(node.callee?.text ?? ""))
+            return;
+        const inLoop = node.ancestors().some((a) => {
+            if (LOOPS.includes(a.kind))
+                return true;
+            if (a.kind !== "JS_CALL_ARGUMENT_LIST")
+                return false;
+            const call = a.parent?.parent;
+            return (call?.kind === "JS_CALL_EXPRESSION" &&
+                ITERATORS.test(call.children()[0]?.text ?? ""));
+        });
+        if (inLoop) {
+            registerDiagnostic(node, "warning", `${node.callee?.text}() inside a loop; fetch what you need with one search or query instead.`);
+        }
+    },
+});

package/dist/rules/noRequireInsteadOfDefine.js

@@ -0,0 +1,25 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { callArguments } from "../lib/options.js";
+import { descendants } from "../lib/script-side.js";
+// Oracle (entry point script validation): "The following script is invalid
+// because it uses a require statement instead of a define statement. If you try
+// to upload a script that includes a require statement, the system returns the
+// error 'SuiteScript 2.0 entry point scripts must implement one script type
+// function.'" Only a top-level require([...], callback) in a file with no
+// define() is flagged; require inside a define() callback is legitimate.
+export const noRequireInsteadOfDefine = defineRule({
+    query: ast("JS_MODULE", "JS_SCRIPT"),
+    run(node) {
+        const calls = [...descendants(node)].filter((n) => n.kind === "JS_CALL_EXPRESSION");
+        if (calls.some((c) => c.callee?.text === "define"))
+            return;
+        for (const call of calls) {
+            if (call.callee?.text !== "require")
+                continue;
+            const [deps, callback] = callArguments(call);
+            if (deps?.kind === "JS_ARRAY_EXPRESSION" && callback) {
+                registerDiagnostic(call, "error", "Use define() instead of require(); NetSuite rejects an entry point script without a define call.");
+            }
+        }
+    },
+});

package/dist/rules/noSecretKeyGuidAndSecret.js

@@ -0,0 +1,16 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { definedOptions } from "../lib/required-options.js";
+// Oracle (https.createSecretKey): "You cannot use both the options.guid parameter
+// and secret parameter in combination." The type definitions (N/https.d.ts) carry
+// the same comment and make both options optional.
+export const noSecretKeyGuidAndSecret = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^https\.createSecretKey(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const defined = definedOptions(node);
+        if (defined?.has("guid") && defined.has("secret")) {
+            registerDiagnostic(node, "error", "Pass createSecretKey() either 'guid' or 'secret', not both.");
+        }
+    },
+});

package/dist/rules/noSensitiveBrowserStorage.js

@@ -0,0 +1,24 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { callArguments, stringValue } from "../lib/options.js";
+import { scriptSide } from "../lib/script-side.js";
+const SENSITIVE = /token|password|secret|api[_-]?key|ssn|credit|card|auth/i;
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's OWASP skill: "`localStorage` and `sessionStorage` are accessible to any
+// JavaScript running on the same origin. If an XSS vulnerability exists, stored
+// tokens, PII, or session data can be exfiltrated", and "Never store tokens or PII
+// in localStorage". LOW CONFIDENCE, so no preset includes it: it guesses from the
+// key name.
+export const noSensitiveBrowserStorage = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^(localStorage|sessionStorage)\.setItem$/.test(node.callee?.text ?? ""))
+            return;
+        if (scriptSide(node) === "server")
+            return;
+        const key = callArguments(node)[0];
+        const name = stringValue(key);
+        if (name && SENSITIVE.test(name)) {
+            registerDiagnostic(key ?? node, "warning", `Do not keep '${name}' in browser storage; any script on the page can read it.`);
+        }
+    },
+});

package/dist/rules/noStackInResponse.js

@@ -0,0 +1,21 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { descendants } from "../lib/script-side.js";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's OWASP skill: "Returning stack traces, internal IDs, script file paths,
+// or record structure details in error responses gives attackers a map of the
+// system." LOW CONFIDENCE, so no preset includes it: only a `.stack` read inside
+// the arguments of `response.write`/`writeLine` is detected, not one returned from
+// a RESTlet.
+export const noStackInResponse = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/response\.(write|writeLine)$/i.test(node.callee?.text ?? ""))
+            return;
+        for (const child of descendants(node)) {
+            if (child.kind === "JS_STATIC_MEMBER_EXPRESSION" &&
+                child.children()[1]?.text === "stack") {
+                registerDiagnostic(child, "warning", "Do not send a stack trace to the client.");
+            }
+        }
+    },
+});

package/dist/rules/noSuiteQLSelectStar.js

@@ -0,0 +1,18 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { SUITEQL, staticSuiteql } from "../lib/suiteql.js";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's SAFE guide: "Avoid SELECT *" and "Always specify needed columns."
+// LOW CONFIDENCE, so no preset includes it: the guide itself recommends a
+// `SELECT * ... WHERE ROWNUM <= 1` probe to discover column names, and the rule
+// only sees a query built from literals.
+export const noSuiteQLSelectStar = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!SUITEQL.test(node.callee?.text ?? ""))
+            return;
+        const sql = staticSuiteql(node);
+        if (sql && /\bSELECT\s+(DISTINCT\s+)?\*/i.test(sql)) {
+            registerDiagnostic(node, "warning", "Name the columns instead of SELECT *.");
+        }
+    },
+});

package/dist/rules/noSuiteQLSystemNoteJoin.js

@@ -0,0 +1,19 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { SUITEQL, staticSuiteql } from "../lib/suiteql.js";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's SAFE guide: "`SystemNote` is an extremely high-volume table ... Joining
+// it in SuiteQL queries causes severe performance degradation and frequent query
+// timeouts", "never as a JOIN against a large result set". LOW CONFIDENCE, so no
+// preset includes it: a tightly filtered join is fine, and the rule only sees a
+// query built from literals.
+export const noSuiteQLSystemNoteJoin = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!SUITEQL.test(node.callee?.text ?? ""))
+            return;
+        const sql = staticSuiteql(node);
+        if (sql && /\b(JOIN\s+|,\s*)SystemNote\b/i.test(sql)) {
+            registerDiagnostic(node, "warning", "Do not join SystemNote in a SuiteQL query; query it separately with filters.");
+        }
+    },
+});

package/dist/rules/noSuiteQLTypeInSearch.js

@@ -0,0 +1,41 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { optionsObject, propertyValue, stringValue } from "../lib/options.js";
+// SuiteQL abbreviations that are not search types. `Estimate` and `CashSale` are
+// left out: their lowercase form is a valid search type.
+const ABBREVIATIONS = new Set([
+    "PurchOrd",
+    "SalesOrd",
+    "CustInvc",
+    "ItemRcpt",
+    "ItemShip",
+    "VendBill",
+    "VendPymt",
+    "CustPymt",
+    "Journal",
+    "CustCred",
+    "RtnAuth",
+    "TrnfrOrd",
+    "WorkOrd",
+    "ExpRept",
+    "InvAdjst",
+    "VendCred",
+]);
+// Oracle's SAFE guide: "Passing a SuiteQL abbreviation to `search.create()` throws
+// a runtime error: `The record type [PURCHORD] is invalid.` Always use
+// `search.Type.*` enum values (or their lowercase string equivalents) in N/search,
+// and SuiteQL abbreviations only inside SuiteQL query strings." The failure claim
+// comes only from this skill and has not been checked against Oracle's
+// documentation."
+export const noSuiteQLTypeInSearch = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^search\.create(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const options = optionsObject(node);
+        const type = options && propertyValue(options, "type");
+        const value = stringValue(type);
+        if (type && value && ABBREVIATIONS.has(value)) {
+            registerDiagnostic(type, "error", `'${value}' is a SuiteQL abbreviation, not a search type; use search.Type.`);
+        }
+    },
+});

package/dist/rules/noSuiteScript1Api.js

@@ -0,0 +1,84 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// SuiteScript 2.1 only: nlapiXxx functions and nlobjXxx objects are 1.0 leftovers.
+// Oracle's upgrade skill lists "Any `nlapi[A-Z]` function call" and "Any
+// `nlobj[A-Z]` constructor or instanceof" as Critical, and also "Old getter/setter
+// methods" (`.getFieldValue()`, `.setFieldValue()`) and "Old error handling"
+// (`e.getCode()`). Only method names that exist in no 2.1 module are flagged, so a
+// 2.1 method of the same name on another object is never hit.
+const GLOBAL_OBJECTS = ["window", "globalThis", "self", "top", "this"];
+const V1_METHODS = new Set([
+    "getLineItemCount",
+    "getLineItemValue",
+    "getLineItemValues",
+    "getLineItemText",
+    "getLineItemField",
+    "setLineItemValue",
+    "setLineItemValues",
+    "insertLineItem",
+    "removeLineItem",
+    "selectLineItem",
+    "selectNewLineItem",
+    "commitLineItem",
+    "findLineItemValue",
+    "getCurrentLineItemValue",
+    "getCurrentLineItemValues",
+    "setCurrentLineItemValue",
+    "getFieldValue",
+    "getFieldValues",
+    "setFieldValue",
+    "setFieldValues",
+    "getFieldText",
+    "getFieldTexts",
+    "setFieldText",
+    "setFieldTexts",
+    "addSubList",
+    "getSubList",
+    "insertSubList",
+    "addSubTab",
+    "getSubTab",
+    "insertSubTab",
+]);
+const V1_ERROR_METHODS = new Set(["getCode", "getDetails", "getStackTrace"]);
+const V1_NAME = /^(nlapi|nlobj)[A-Z]/;
+export const noSuiteScript1Api = defineRule({
+    query: ast("JS_REFERENCE_IDENTIFIER", "JS_STATIC_MEMBER_EXPRESSION", "JS_CALL_EXPRESSION"),
+    run(node) {
+        if (node.kind === "JS_REFERENCE_IDENTIFIER") {
+            if (V1_NAME.test(node.text)) {
+                registerDiagnostic(node, "error", `'${node.text}' is SuiteScript 1.0; use the SuiteScript 2.1 N/ modules.`);
+            }
+            return;
+        }
+        if (node.kind === "JS_STATIC_MEMBER_EXPRESSION") {
+            const [object, member] = node.children();
+            if (object &&
+                member &&
+                GLOBAL_OBJECTS.includes(object.text) &&
+                V1_NAME.test(member.text)) {
+                registerDiagnostic(node, "error", `'${member.text}' is SuiteScript 1.0; use the SuiteScript 2.1 N/ modules.`);
+            }
+            return;
+        }
+        const callee = node.callee;
+        if (callee?.kind !== "JS_STATIC_MEMBER_EXPRESSION")
+            return;
+        const [object, member] = callee.children();
+        if (!object || !member)
+            return;
+        if (V1_METHODS.has(member.text)) {
+            registerDiagnostic(node, "error", `'${member.text}()' is a SuiteScript 1.0 method; use the SuiteScript 2.1 equivalent.`);
+        }
+        else if (V1_ERROR_METHODS.has(member.text) &&
+            isCatchParameter(node, object.text)) {
+            registerDiagnostic(node, "error", `'${member.text}()' is SuiteScript 1.0; in 2.1 the error exposes a property.`);
+        }
+    },
+});
+function isCatchParameter(node, name) {
+    for (const ancestor of node.ancestors()) {
+        if (ancestor.kind === "JS_CATCH_CLAUSE") {
+            return new RegExp(`^catch\\s*\\(\\s*${name}\\b`).test(ancestor.text);
+        }
+    }
+    return false;
+}

package/dist/rules/noUnknownModuleMember.js

@@ -0,0 +1,23 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { moduleOfReceiver, typingsOf } from "../lib/module-calls.js";
+const IGNORED = ["default", "prototype", "constructor", "__esModule"];
+// Reading something the type definitions (Tier 2) do not export from an N/ module
+// (`record.loadRecord`) gives undefined or throws at runtime. The module is
+// resolved from the define() or import binding of the receiver. Modules that
+// re-export everything are skipped because their exports cannot be listed, and the
+// definitions can lag a release, so a member Oracle added recently may be reported.
+export const noUnknownModuleMember = defineRule({
+    query: semantic("JS_STATIC_MEMBER_EXPRESSION"),
+    run(node, { model }) {
+        const [object, member] = node.children();
+        if (!object || !member)
+            return;
+        const module = moduleOfReceiver(object, model);
+        const exports = typingsOf(module)?.exports;
+        if (exports &&
+            !exports.includes(member.text) &&
+            !IGNORED.includes(member.text)) {
+            registerDiagnostic(member, "error", `${module} has no export '${member.text}'.`);
+        }
+    },
+});

package/dist/rules/noUnknownOptions.js

@@ -0,0 +1,31 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { moduleCall } from "../lib/module-calls.js";
+import { objectMembers, optionsObject } from "../lib/options.js";
+// An option the type definitions (Tier 2) do not list for a module-level function
+// is ignored at runtime, so a typo in an optional option goes unnoticed. A typo in
+// a required option is also caught by requireOptions. Functions whose options
+// type accepts any key are skipped.
+export const noUnknownOptions = defineRule({
+    query: semantic("JS_CALL_EXPRESSION"),
+    run(node, { model }) {
+        const call = moduleCall(node, model);
+        if (!call || call.alternatives === 0)
+            return;
+        if (call.alternatives.some((alt) => alt[2]))
+            return;
+        const options = optionsObject(node);
+        if (!options)
+            return;
+        const known = new Set(call.alternatives.flatMap(([, names]) => names));
+        for (const member of objectMembers(options)) {
+            if (member.kind === "JS_SPREAD")
+                return;
+            if (member.kind !== "JS_PROPERTY_OBJECT_MEMBER")
+                continue;
+            const name = member.children()[0]?.text.replace(/^['"]|['"]$/g, "");
+            if (name && !known.has(name)) {
+                registerDiagnostic(member, "warning", `${call.callee}() does not take an '${name}' option.`);
+            }
+        }
+    },
+});