biome-plugin-suitescript 0.2.0 → 0.3.0

package/dist/rules/noPositionalOptions.js

@@ -0,0 +1,26 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { moduleCall } from "../lib/module-calls.js";
+import { callArguments } from "../lib/options.js";
+const LITERALS = [
+    "JS_STRING_LITERAL_EXPRESSION",
+    "JS_NUMBER_LITERAL_EXPRESSION",
+    "JS_BOOLEAN_LITERAL_EXPRESSION",
+    "JS_NULL_LITERAL_EXPRESSION",
+    "JS_ARRAY_EXPRESSION",
+];
+// The type definitions (Tier 2) show that a module-level function takes one
+// options object. Passing a literal instead (`record.load('customer', 1)`) leaves
+// every required option missing at runtime. Only a literal first argument is
+// flagged; a variable may hold the options object.
+export const noPositionalOptions = defineRule({
+    query: semantic("JS_CALL_EXPRESSION"),
+    run(node, { model }) {
+        const call = moduleCall(node, model);
+        if (!call || call.alternatives === 0)
+            return;
+        const first = callArguments(node)[0];
+        if (first && LITERALS.includes(first.kind)) {
+            registerDiagnostic(first, "error", `${call.callee}() takes an options object, not positional arguments.`);
+        }
+    },
+});

package/dist/rules/noPostMessageWildcard.js

@@ -0,0 +1,15 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { callArguments, stringValue } from "../lib/options.js";
+// Oracle's OWASP skill: "`postMessage` uses specific origin (never `'*'`)".
+// Sending with a wildcard target origin lets any website receive the message.
+export const noPostMessageWildcard = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/\.postMessage$/.test(node.callee?.text ?? ""))
+            return;
+        const origin = callArguments(node)[1];
+        if (stringValue(origin) === "*") {
+            registerDiagnostic(origin ?? node, "warning", "Pass postMessage() a specific target origin, never '*'.");
+        }
+    },
+});

package/dist/rules/noPublicFileUpload.js

@@ -0,0 +1,20 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's OWASP skill: uploads are stored in restricted folders and
+// `isOnline: false // Not publicly accessible by default`; its bad example sets
+// `fileObj.isOnline = true; // Publicly accessible!`. LOW CONFIDENCE, so no preset
+// includes it: public assets legitimately set isOnline.
+export const noPublicFileUpload = defineRule({
+    query: ast("JS_PROPERTY_OBJECT_MEMBER", "JS_ASSIGNMENT_EXPRESSION"),
+    run(node) {
+        const [target, value] = node.children();
+        const name = node.kind === "JS_ASSIGNMENT_EXPRESSION"
+            ? target?.kind === "JS_STATIC_MEMBER_ASSIGNMENT"
+                ? target.children()[1]?.text
+                : undefined
+            : target?.text;
+        if (name === "isOnline" && value?.text === "true") {
+            registerDiagnostic(value, "warning", "isOnline: true makes the file publicly accessible.");
+        }
+    },
+});

package/dist/rules/noRecordInLoop.js

@@ -7,13 +7,16 @@ const LOOPS = [
     "JS_DO_WHILE_STATEMENT",
 ];
 const ITERATORS = /\.(forEach|each|map)$/;
-const RECORD_CALLS = ["record.load", "record.create"];
-// Loading or creating a record per iteration burns governance; search or
-// submitFields in bulk instead. Opt-in: Map/Reduce `map` handles one record per call.
+const LOOKUPS = /^(record\.load|query\.runSuiteQL(Paged)?|search\.(create|load))(\.promise)?$/;
+// Oracle's SAFE guide: "NEVER run queries inside loops" (the N+1 problem) and
+// "Loading records in loops: use searches or bulk operations." Loading a record or
+// running a query or search per iteration burns governance. Only record.load is
+// named for records, so record.create and submitFields are not flagged. Map/Reduce
+// `map` handles one record per call, so keep this rule out of those files.
 export const noRecordInLoop = defineRule({
     query: ast("JS_CALL_EXPRESSION"),
     run(node) {
-        if (!RECORD_CALLS.includes(node.callee?.text ?? ""))
+        if (!LOOKUPS.test(node.callee?.text ?? ""))
             return;
         const inLoop = node.ancestors().some((a) => {
             if (LOOPS.includes(a.kind))
@@ -25,7 +28,7 @@ export const noRecordInLoop = defineRule({
                 ITERATORS.test(call.children()[0]?.text ?? ""));
         });
         if (inLoop) {
-            registerDiagnostic(node, "warning", `${node.callee?.text}() inside a loop; use a search or submitFields instead.`);
+            registerDiagnostic(node, "warning", `${node.callee?.text}() inside a loop; fetch what you need with one search or query instead.`);
         }
     },
 });

package/dist/rules/noRequireInsteadOfDefine.js

@@ -0,0 +1,25 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { callArguments } from "../lib/options.js";
+import { descendants } from "../lib/script-side.js";
+// Oracle (entry point script validation): "The following script is invalid
+// because it uses a require statement instead of a define statement. If you try
+// to upload a script that includes a require statement, the system returns the
+// error 'SuiteScript 2.0 entry point scripts must implement one script type
+// function.'" Only a top-level require([...], callback) in a file with no
+// define() is flagged; require inside a define() callback is legitimate.
+export const noRequireInsteadOfDefine = defineRule({
+    query: ast("JS_MODULE", "JS_SCRIPT"),
+    run(node) {
+        const calls = [...descendants(node)].filter((n) => n.kind === "JS_CALL_EXPRESSION");
+        if (calls.some((c) => c.callee?.text === "define"))
+            return;
+        for (const call of calls) {
+            if (call.callee?.text !== "require")
+                continue;
+            const [deps, callback] = callArguments(call);
+            if (deps?.kind === "JS_ARRAY_EXPRESSION" && callback) {
+                registerDiagnostic(call, "error", "Use define() instead of require(); NetSuite rejects an entry point script without a define call.");
+            }
+        }
+    },
+});

package/dist/rules/noSecretKeyGuidAndSecret.js

@@ -0,0 +1,16 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { definedOptions } from "../lib/required-options.js";
+// Oracle (https.createSecretKey): "You cannot use both the options.guid parameter
+// and secret parameter in combination." The type definitions (N/https.d.ts) carry
+// the same comment and make both options optional.
+export const noSecretKeyGuidAndSecret = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^https\.createSecretKey(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const defined = definedOptions(node);
+        if (defined?.has("guid") && defined.has("secret")) {
+            registerDiagnostic(node, "error", "Pass createSecretKey() either 'guid' or 'secret', not both.");
+        }
+    },
+});

package/dist/rules/noSensitiveBrowserStorage.js

@@ -0,0 +1,24 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { callArguments, stringValue } from "../lib/options.js";
+import { scriptSide } from "../lib/script-side.js";
+const SENSITIVE = /token|password|secret|api[_-]?key|ssn|credit|card|auth/i;
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's OWASP skill: "`localStorage` and `sessionStorage` are accessible to any
+// JavaScript running on the same origin. If an XSS vulnerability exists, stored
+// tokens, PII, or session data can be exfiltrated", and "Never store tokens or PII
+// in localStorage". LOW CONFIDENCE, so no preset includes it: it guesses from the
+// key name.
+export const noSensitiveBrowserStorage = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^(localStorage|sessionStorage)\.setItem$/.test(node.callee?.text ?? ""))
+            return;
+        if (scriptSide(node) === "server")
+            return;
+        const key = callArguments(node)[0];
+        const name = stringValue(key);
+        if (name && SENSITIVE.test(name)) {
+            registerDiagnostic(key ?? node, "warning", `Do not keep '${name}' in browser storage; any script on the page can read it.`);
+        }
+    },
+});

package/dist/rules/noStackInResponse.js

@@ -0,0 +1,21 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { descendants } from "../lib/script-side.js";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's OWASP skill: "Returning stack traces, internal IDs, script file paths,
+// or record structure details in error responses gives attackers a map of the
+// system." LOW CONFIDENCE, so no preset includes it: only a `.stack` read inside
+// the arguments of `response.write`/`writeLine` is detected, not one returned from
+// a RESTlet.
+export const noStackInResponse = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/response\.(write|writeLine)$/i.test(node.callee?.text ?? ""))
+            return;
+        for (const child of descendants(node)) {
+            if (child.kind === "JS_STATIC_MEMBER_EXPRESSION" &&
+                child.children()[1]?.text === "stack") {
+                registerDiagnostic(child, "warning", "Do not send a stack trace to the client.");
+            }
+        }
+    },
+});

package/dist/rules/noSuiteQLSelectStar.js

@@ -0,0 +1,18 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { SUITEQL, staticSuiteql } from "../lib/suiteql.js";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's SAFE guide: "Avoid SELECT *" and "Always specify needed columns."
+// LOW CONFIDENCE, so no preset includes it: the guide itself recommends a
+// `SELECT * ... WHERE ROWNUM <= 1` probe to discover column names, and the rule
+// only sees a query built from literals.
+export const noSuiteQLSelectStar = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!SUITEQL.test(node.callee?.text ?? ""))
+            return;
+        const sql = staticSuiteql(node);
+        if (sql && /\bSELECT\s+(DISTINCT\s+)?\*/i.test(sql)) {
+            registerDiagnostic(node, "warning", "Name the columns instead of SELECT *.");
+        }
+    },
+});

package/dist/rules/noSuiteQLSystemNoteJoin.js

@@ -0,0 +1,19 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { SUITEQL, staticSuiteql } from "../lib/suiteql.js";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's SAFE guide: "`SystemNote` is an extremely high-volume table ... Joining
+// it in SuiteQL queries causes severe performance degradation and frequent query
+// timeouts", "never as a JOIN against a large result set". LOW CONFIDENCE, so no
+// preset includes it: a tightly filtered join is fine, and the rule only sees a
+// query built from literals.
+export const noSuiteQLSystemNoteJoin = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!SUITEQL.test(node.callee?.text ?? ""))
+            return;
+        const sql = staticSuiteql(node);
+        if (sql && /\b(JOIN\s+|,\s*)SystemNote\b/i.test(sql)) {
+            registerDiagnostic(node, "warning", "Do not join SystemNote in a SuiteQL query; query it separately with filters.");
+        }
+    },
+});

package/dist/rules/noSuiteQLTypeInSearch.js

@@ -0,0 +1,41 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { optionsObject, propertyValue, stringValue } from "../lib/options.js";
+// SuiteQL abbreviations that are not search types. `Estimate` and `CashSale` are
+// left out: their lowercase form is a valid search type.
+const ABBREVIATIONS = new Set([
+    "PurchOrd",
+    "SalesOrd",
+    "CustInvc",
+    "ItemRcpt",
+    "ItemShip",
+    "VendBill",
+    "VendPymt",
+    "CustPymt",
+    "Journal",
+    "CustCred",
+    "RtnAuth",
+    "TrnfrOrd",
+    "WorkOrd",
+    "ExpRept",
+    "InvAdjst",
+    "VendCred",
+]);
+// Oracle's SAFE guide: "Passing a SuiteQL abbreviation to `search.create()` throws
+// a runtime error: `The record type [PURCHORD] is invalid.` Always use
+// `search.Type.*` enum values (or their lowercase string equivalents) in N/search,
+// and SuiteQL abbreviations only inside SuiteQL query strings." The failure claim
+// comes only from this skill and has not been checked against Oracle's
+// documentation."
+export const noSuiteQLTypeInSearch = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^search\.create(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const options = optionsObject(node);
+        const type = options && propertyValue(options, "type");
+        const value = stringValue(type);
+        if (type && value && ABBREVIATIONS.has(value)) {
+            registerDiagnostic(type, "error", `'${value}' is a SuiteQL abbreviation, not a search type; use search.Type.`);
+        }
+    },
+});

package/dist/rules/noSuiteScript1Api.js

@@ -1,10 +1,84 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
 // SuiteScript 2.1 only: nlapiXxx functions and nlobjXxx objects are 1.0 leftovers.
+// Oracle's upgrade skill lists "Any `nlapi[A-Z]` function call" and "Any
+// `nlobj[A-Z]` constructor or instanceof" as Critical, and also "Old getter/setter
+// methods" (`.getFieldValue()`, `.setFieldValue()`) and "Old error handling"
+// (`e.getCode()`). Only method names that exist in no 2.1 module are flagged, so a
+// 2.1 method of the same name on another object is never hit.
+const GLOBAL_OBJECTS = ["window", "globalThis", "self", "top", "this"];
+const V1_METHODS = new Set([
+    "getLineItemCount",
+    "getLineItemValue",
+    "getLineItemValues",
+    "getLineItemText",
+    "getLineItemField",
+    "setLineItemValue",
+    "setLineItemValues",
+    "insertLineItem",
+    "removeLineItem",
+    "selectLineItem",
+    "selectNewLineItem",
+    "commitLineItem",
+    "findLineItemValue",
+    "getCurrentLineItemValue",
+    "getCurrentLineItemValues",
+    "setCurrentLineItemValue",
+    "getFieldValue",
+    "getFieldValues",
+    "setFieldValue",
+    "setFieldValues",
+    "getFieldText",
+    "getFieldTexts",
+    "setFieldText",
+    "setFieldTexts",
+    "addSubList",
+    "getSubList",
+    "insertSubList",
+    "addSubTab",
+    "getSubTab",
+    "insertSubTab",
+]);
+const V1_ERROR_METHODS = new Set(["getCode", "getDetails", "getStackTrace"]);
+const V1_NAME = /^(nlapi|nlobj)[A-Z]/;
 export const noSuiteScript1Api = defineRule({
-    query: ast("JS_REFERENCE_IDENTIFIER"),
+    query: ast("JS_REFERENCE_IDENTIFIER", "JS_STATIC_MEMBER_EXPRESSION", "JS_CALL_EXPRESSION"),
     run(node) {
-        if (/^(nlapi|nlobj)[A-Z]/.test(node.text)) {
-            registerDiagnostic(node, "error", `'${node.text}' is SuiteScript 1.0; use the SuiteScript 2.1 N/ modules.`);
+        if (node.kind === "JS_REFERENCE_IDENTIFIER") {
+            if (V1_NAME.test(node.text)) {
+                registerDiagnostic(node, "error", `'${node.text}' is SuiteScript 1.0; use the SuiteScript 2.1 N/ modules.`);
+            }
+            return;
+        }
+        if (node.kind === "JS_STATIC_MEMBER_EXPRESSION") {
+            const [object, member] = node.children();
+            if (object &&
+                member &&
+                GLOBAL_OBJECTS.includes(object.text) &&
+                V1_NAME.test(member.text)) {
+                registerDiagnostic(node, "error", `'${member.text}' is SuiteScript 1.0; use the SuiteScript 2.1 N/ modules.`);
+            }
+            return;
+        }
+        const callee = node.callee;
+        if (callee?.kind !== "JS_STATIC_MEMBER_EXPRESSION")
+            return;
+        const [object, member] = callee.children();
+        if (!object || !member)
+            return;
+        if (V1_METHODS.has(member.text)) {
+            registerDiagnostic(node, "error", `'${member.text}()' is a SuiteScript 1.0 method; use the SuiteScript 2.1 equivalent.`);
+        }
+        else if (V1_ERROR_METHODS.has(member.text) &&
+            isCatchParameter(node, object.text)) {
+            registerDiagnostic(node, "error", `'${member.text}()' is SuiteScript 1.0; in 2.1 the error exposes a property.`);
         }
     },
 });
+function isCatchParameter(node, name) {
+    for (const ancestor of node.ancestors()) {
+        if (ancestor.kind === "JS_CATCH_CLAUSE") {
+            return new RegExp(`^catch\\s*\\(\\s*${name}\\b`).test(ancestor.text);
+        }
+    }
+    return false;
+}

package/dist/rules/noUnknownModuleMember.js

@@ -0,0 +1,23 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { moduleOfReceiver, typingsOf } from "../lib/module-calls.js";
+const IGNORED = ["default", "prototype", "constructor", "__esModule"];
+// Reading something the type definitions (Tier 2) do not export from an N/ module
+// (`record.loadRecord`) gives undefined or throws at runtime. The module is
+// resolved from the define() or import binding of the receiver. Modules that
+// re-export everything are skipped because their exports cannot be listed, and the
+// definitions can lag a release, so a member Oracle added recently may be reported.
+export const noUnknownModuleMember = defineRule({
+    query: semantic("JS_STATIC_MEMBER_EXPRESSION"),
+    run(node, { model }) {
+        const [object, member] = node.children();
+        if (!object || !member)
+            return;
+        const module = moduleOfReceiver(object, model);
+        const exports = typingsOf(module)?.exports;
+        if (exports &&
+            !exports.includes(member.text) &&
+            !IGNORED.includes(member.text)) {
+            registerDiagnostic(member, "error", `${module} has no export '${member.text}'.`);
+        }
+    },
+});

package/dist/rules/noUnknownOptions.js

@@ -0,0 +1,31 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { moduleCall } from "../lib/module-calls.js";
+import { objectMembers, optionsObject } from "../lib/options.js";
+// An option the type definitions (Tier 2) do not list for a module-level function
+// is ignored at runtime, so a typo in an optional option goes unnoticed. A typo in
+// a required option is also caught by requireOptions. Functions whose options
+// type accepts any key are skipped.
+export const noUnknownOptions = defineRule({
+    query: semantic("JS_CALL_EXPRESSION"),
+    run(node, { model }) {
+        const call = moduleCall(node, model);
+        if (!call || call.alternatives === 0)
+            return;
+        if (call.alternatives.some((alt) => alt[2]))
+            return;
+        const options = optionsObject(node);
+        if (!options)
+            return;
+        const known = new Set(call.alternatives.flatMap(([, names]) => names));
+        for (const member of objectMembers(options)) {
+            if (member.kind === "JS_SPREAD")
+                return;
+            if (member.kind !== "JS_PROPERTY_OBJECT_MEMBER")
+                continue;
+            const name = member.children()[0]?.text.replace(/^['"]|['"]$/g, "");
+            if (name && !known.has(name)) {
+                registerDiagnostic(member, "warning", `${call.callee}() does not take an '${name}' option.`);
+            }
+        }
+    },
+});

package/dist/rules/noUnsupportedServerWidgetFieldType.js

@@ -0,0 +1,40 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { optionsObject, propertyValue } from "../lib/options.js";
+const COLUMN_UNSUPPORTED = new Set([
+    "CHECKBOX",
+    "DATETIME",
+    "DATETIMETZ",
+    "FILE",
+    "HELP",
+    "INLINEHTML",
+    "LABEL",
+    "MULTISELECT",
+    "SELECT",
+    "RADIO",
+]);
+// Oracle (serverWidget.FieldType): "The DATETIME field type is not supported with
+// addField methods, you must specify DATETIMETZ." The type definitions
+// (N/ui/serverWidget.d.ts) have no DATETIME member in FieldType at all. Oracle also
+// says "The CHECKBOX, DATETIME,
+// DATETIMETZ, FILE, HELP, INLINEHTML, LABEL, MULTISELECT, SELECT, and RADIO field
+// types are not supported with List.addColumn(options)." Sublist.addField has its
+// own list but needs the receiver's type, so it is not checked.
+export const noUnsupportedServerWidgetFieldType = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const method = /\.(addField|addColumn)$/.exec(node.callee?.text ?? "")?.[1];
+        if (!method)
+            return;
+        const options = optionsObject(node);
+        const type = options && propertyValue(options, "type");
+        const member = /(^|\.)FieldType\.(\w+)$/.exec(type?.text ?? "")?.[2];
+        if (!type || !member)
+            return;
+        if ((method === "addField" && member === "DATETIME") ||
+            (method === "addColumn" && COLUMN_UNSUPPORTED.has(member))) {
+            registerDiagnostic(type, "error", method === "addField"
+                ? "DATETIME is not supported by addField; use DATETIMETZ."
+                : `${member} is not supported by List.addColumn.`);
+        }
+    },
+});

package/dist/rules/noWeakHash.js

@@ -0,0 +1,17 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's OWASP skill: "MD5 and SHA-1 are cryptographically broken" and "Use
+// SHA-256 as the minimum hashing algorithm. MD5 and SHA-1 are broken and must
+// never be used for security-sensitive operations." LOW CONFIDENCE, so no preset
+// includes it: it cannot tell a security use from a vendor integration that
+// requires MD5 or SHA-1. The type definitions (N/crypto.d.ts) list only SHA256 and
+// SHA512 in crypto.HashAlg, so the MD5 and SHA1 member names come from the skill
+// alone; the skill outranks the type definitions, so the rule stays.
+export const noWeakHash = defineRule({
+    query: ast("JS_STATIC_MEMBER_EXPRESSION"),
+    run(node) {
+        if (/(^|\.)HashAlg\.(MD5|SHA1)$/.test(node.text)) {
+            registerDiagnostic(node, "warning", "MD5 and SHA-1 are broken; use SHA-256 or stronger for security-sensitive hashing.");
+        }
+    },
+});

package/dist/rules/noWildcardCors.js

@@ -0,0 +1,16 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { headerCall } from "../lib/headers.js";
+import { stringValue } from "../lib/options.js";
+// Oracle's OWASP skill: "Setting `Access-Control-Allow-Origin: *` allows any
+// website to make cross-origin requests to the RESTlet, enabling data theft from
+// authenticated sessions", and "Use explicit CORS origin allowlist (never `*`)".
+export const noWildcardCors = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const header = headerCall(node);
+        if (header?.name === "access-control-allow-origin" &&
+            stringValue(header.value) === "*") {
+            registerDiagnostic(header.value ?? node, "warning", "Do not allow every origin with Access-Control-Allow-Origin: *; list the allowed origins.");
+        }
+    },
+});

package/dist/rules/noWrongScriptTypeModules.js

@@ -5,7 +5,9 @@ import { inferredTypes } from "../lib/script-side.js";
 // Loading a client-only module in a server script (or the reverse), or a module
 // a script type does not support, fails at runtime. The type comes from the
 // entry points the module returns, so libraries and uninferable modules are
-// never flagged.
+// never flagged. The lists follow Oracle's "Supported Script Types" table, except
+// N/ui/message, which the table marks client-only but which server scripts load to
+// build the message that Form.addPageInitMessage shows (see module-script-types.ts).
 export const noWrongScriptTypeModules = defineRule({
     query: ast("JS_CALL_EXPRESSION", "JS_IMPORT"),
     run(node) {

package/dist/rules/requireCustpagePrefix.js

@@ -1,22 +1,23 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
-const ADDERS = /\.(addField|addFieldGroup|addSublist|addTab|addSubtab|addButton)$/;
-// Oracle: the internal ID of a UI object added to a page "must be prefixed with
-// custpage". Only a string literal `id` is checked.
+import { optionsObject, propertyValue } from "../lib/options.js";
+// Receiver `context.form` (or `scriptContext.form`) is the form of the page being
+// loaded, an existing NetSuite page. Forms made with serverWidget.createForm are
+// standalone pages, and Oracle's own samples use unprefixed ids on them.
+const ADDERS = /\.form\.(addField|addButton|addSublist|addTab|addSubtab|addCredentialField|addSecretKeyField)$/;
+// Oracle (N/ui/serverWidget): "When you add a UI object to an existing NetSuite
+// page, to minimize the occurrence of field/object name conflicts, the internal ID
+// that references the object must be prefixed with custpage." Only a string
+// literal `id` is checked.
 export const requireCustpagePrefix = defineRule({
     query: ast("JS_CALL_EXPRESSION"),
     run(node) {
         if (!ADDERS.test(node.callee?.text ?? ""))
             return;
-        const options = node.arguments?.children()[0]?.children()[0];
-        if (options?.kind !== "JS_OBJECT_EXPRESSION")
-            return;
-        for (const member of options.children()[0]?.children() ?? []) {
-            const [name, value] = member.children();
-            if (name?.text === "id" &&
-                value?.kind === "JS_STRING_LITERAL_EXPRESSION" &&
-                !/^['"]custpage/.test(value.text)) {
-                registerDiagnostic(value, "warning", "The id of a UI object must start with 'custpage'.");
-            }
+        const options = optionsObject(node);
+        const id = options && propertyValue(options, "id");
+        if (id?.kind === "JS_STRING_LITERAL_EXPRESSION" &&
+            !/^['"]custpage/.test(id.text)) {
+            registerDiagnostic(id, "warning", "The id of a UI object added to an existing page must start with 'custpage'.");
         }
     },
 });

package/dist/rules/requireEachReturn.js

@@ -0,0 +1,38 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { callArguments } from "../lib/options.js";
+import { isFunction } from "../lib/script-side.js";
+const EACH = /\.(run|iterator)\(\)\.each$/;
+/** Whether a function body returns a value, ignoring nested functions. */
+function returnsValue(node) {
+    for (const child of node.children()) {
+        if (isFunction(child))
+            continue;
+        if (child.kind === "JS_RETURN_STATEMENT" && child.children()[0])
+            return true;
+        if (returnsValue(child))
+            return true;
+    }
+    return false;
+}
+// Oracle's upgrade skill: "`.each()` callback must return `true` to continue
+// (stops on `false`)". A callback that never returns a value stops after the first
+// row without an error. Only `.run().each` and `.iterator().each` are checked. A
+// block body must return some value; an expression body that is a call (such as
+// `ids.push(id)`) returns whatever the call does, which is not `true`.
+export const requireEachReturn = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!EACH.test(node.callee?.text ?? ""))
+            return;
+        const callback = callArguments(node)[0];
+        if (!callback || !isFunction(callback))
+            return;
+        const body = callback.children().find((c) => c.kind === "JS_FUNCTION_BODY");
+        const flagged = body
+            ? !returnsValue(body)
+            : callback.children().at(-1)?.kind === "JS_CALL_EXPRESSION";
+        if (flagged) {
+            registerDiagnostic(callback, "warning", "The each() callback must return true to continue to the next row.");
+        }
+    },
+});

package/dist/rules/requireLogModule.js

@@ -0,0 +1,25 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { inSuiteScriptModule } from "../lib/suitescript.js";
+// Tier 0: docs/adr/0006-log-is-a-global-with-two-opposite-styles.md.
+// Load N/log when you call log.*. Oracle's upgrade skill says `log` is global but
+// "explicitly including it in `define()` makes dependencies clearer and is
+// recommended", and that practice is what this rule enforces. The help center's
+// "NetSuite loads the log Object by default for all script types. You do not need
+// to load it manually" is why noMissingModules leaves `log` alone. The learning
+// skill's "not globally available" loses: the documentation and the higher-ranked
+// upgrade skill both say it is global. This is the opposite style to noLogModule,
+// so enable only one of them.
+export const requireLogModule = defineRule({
+    query: semantic("JS_REFERENCE_IDENTIFIER"),
+    run(node, { model }) {
+        if (node.text !== "log" || model.binding(node))
+            return;
+        const member = node.parent?.parent;
+        if (member?.kind !== "JS_STATIC_MEMBER_EXPRESSION" ||
+            member.children()[0]?.text !== "log")
+            return;
+        if (!inSuiteScriptModule(node))
+            return;
+        registerDiagnostic(node, "warning", "'log' is used but N/log is not loaded.");
+    },
+});

package/dist/rules/requireOptions.js

@@ -0,0 +1,26 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { moduleCall } from "../lib/module-calls.js";
+import { definedOptions } from "../lib/required-options.js";
+// The type definitions (Tier 2) say which options each module-level function
+// requires, and a missing one makes the call fail at runtime (Oracle's method
+// pages list it as SSS_MISSING_REQD_ARGUMENT). The receiver is resolved from the
+// define() or import binding, so `record.load` is checked only when `record` is
+// N/record. Only an options object literal without a spread is checked, and a
+// function with several call shapes passes when any shape is satisfied.
+export const requireOptions = defineRule({
+    query: semantic("JS_CALL_EXPRESSION"),
+    run(node, { model }) {
+        const call = moduleCall(node, model);
+        if (!call || call.alternatives === 0)
+            return;
+        const defined = definedOptions(node);
+        if (!defined)
+            return;
+        const missing = call.alternatives
+            .map(([required]) => required.filter((name) => !defined.has(name)))
+            .sort((a, b) => a.length - b.length)[0];
+        for (const name of missing ?? []) {
+            registerDiagnostic(node, "error", `${call.callee}() needs the '${name}' option.`);
+        }
+    },
+});