biome-plugin-suitescript 0.2.0 → 0.4.0

package/dist/lib/typings.js

@@ -0,0 +1,2 @@
+// The shape of the data generated from @hitc/netsuite-types (see typings-data.ts).
+export {};

package/dist/rules/logRequireDetails.js

@@ -1,5 +1,9 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
 import { hasProperty, logCall } from "../lib/log.js";
+// Tier 0: docs/adr/0002-options-are-separate-rules.md.
+// Oracle's help center marks log `details` optional on all four log method pages;
+// requiring it does not contradict that, it is a house practice from the ESLint
+// log-args rules. As the lowest-precedence kind of source it is in `all` only.
 export const logRequireDetails = defineRule({
     query: ast("JS_CALL_EXPRESSION"),
     run(node) {

package/dist/rules/logRequireTitle.js

@@ -1,5 +1,6 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
 import { hasProperty, logCall } from "../lib/log.js";
+// Tier 0: docs/adr/0002-options-are-separate-rules.md.
 export const logRequireTitle = defineRule({
     query: ast("JS_CALL_EXPRESSION"),
     run(node) {

package/dist/rules/noAuthorizationHeaderInInternalRequest.js

@@ -0,0 +1,24 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { objectMembers, optionsObject, propertyValue } from "../lib/options.js";
+const INTERNAL = /^https\.(requestRestlet|requestSuitelet|requestSuiteTalkRest)(\.promise)?$/;
+// Oracle (https.requestRestlet, requestSuitelet, requestSuiteTalkRest): "Sends an
+// HTTPS request to a RESTlet and returns the response. Authentication headers are
+// automatically added." (the type definitions in N/https.d.ts say the same) and the error SSS_AUTHORIZATION_HEADER_NOT_ALLOWED: "The
+// authorization header is set."
+export const noAuthorizationHeaderInInternalRequest = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!INTERNAL.test(node.callee?.text ?? ""))
+            return;
+        const options = optionsObject(node);
+        const headers = options && propertyValue(options, "headers");
+        if (headers?.kind !== "JS_OBJECT_EXPRESSION")
+            return;
+        for (const member of objectMembers(headers)) {
+            const name = member.children()[0]?.text.replace(/^['"]|['"]$/g, "");
+            if (name?.toLowerCase() === "authorization") {
+                registerDiagnostic(member, "error", "Do not set an Authorization header; NetSuite adds authentication to internal requests.");
+            }
+        }
+    },
+});

package/dist/rules/noBlockedHttpsHeader.js

@@ -0,0 +1,32 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { objectMembers, optionsObject, propertyValue } from "../lib/options.js";
+const BLOCKED = new Set([
+    "connection",
+    "content-length",
+    "host",
+    "jsessionid",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "via",
+]);
+// Oracle (N/https, General Blocked HTTPS Headers): "certain headers cannot be set
+// manually when using N/https module methods. If a script attempts to set values
+// for any of the following headers, the values are discarded."
+export const noBlockedHttpsHeader = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/^https\.\w+(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const options = optionsObject(node);
+        const headers = options && propertyValue(options, "headers");
+        if (headers?.kind !== "JS_OBJECT_EXPRESSION")
+            return;
+        for (const member of objectMembers(headers)) {
+            const name = member.children()[0]?.text.replace(/^['"]|['"]$/g, "");
+            if (name && BLOCKED.has(name.toLowerCase())) {
+                registerDiagnostic(member, "warning", `NetSuite discards the ${name} header set in an N/https request.`);
+            }
+        }
+    },
+});

package/dist/rules/noBlockedResponseHeader.js

@@ -0,0 +1,35 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { headerCall } from "../lib/headers.js";
+const BLOCKED = new Set([
+    "allow",
+    "content-location",
+    "content-md5",
+    "content-range",
+    "date",
+    "location",
+    "proxy-authenticate",
+    "public-key-pins",
+    "public-key-pins-report-only",
+    "retry-after",
+    "server",
+    "strict-transport-security",
+    "upgrade-insecure-requests",
+    "warning",
+    "www-authenticate",
+]);
+// Oracle (N/https, HTTPS Header Information): "certain headers cannot be set
+// manually when interacting with the https.ServerResponse Objects sent by
+// Suitelets. If a script attempts to set values for any of these headers, the
+// system throws an SSS_INVALID_HEADER error." Only calls on a receiver named like
+// a response are checked.
+export const noBlockedResponseHeader = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/response\.(setHeader|addHeader)$/i.test(node.callee?.text ?? ""))
+            return;
+        const header = headerCall(node);
+        if (header && BLOCKED.has(header.name)) {
+            registerDiagnostic(header.nameNode, "error", `A Suitelet cannot set the ${header.name} header; NetSuite throws SSS_INVALID_HEADER.`);
+        }
+    },
+});

package/dist/rules/noBrowserGlobals.js

@@ -8,6 +8,8 @@ const BROWSER_GLOBALS = new Set([
     "XMLHttpRequest",
     "alert",
     "navigator",
+    "URLSearchParams",
+    "fetch",
 ]);
 // Server scripts run outside a browser, but TypeScript's DOM library lets
 // these names compile. Locals that reuse a name resolve to a binding and are left alone.

package/dist/rules/noConflictingClientScriptProps.js

@@ -0,0 +1,36 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { isFunction } from "../lib/script-side.js";
+// Oracle (Form.clientScriptModulePath and clientScriptFileId): PROPERTY_VALUE_CONFLICT,
+// "You attempted to set this value when the Form.clientScriptFileId property value
+// has already been specified." Setting both on the same form fails.
+export const noConflictingClientScriptProps = defineRule({
+    query: ast("JS_ASSIGNMENT_EXPRESSION"),
+    run(node) {
+        const target = node.children()[0];
+        if (target?.kind !== "JS_STATIC_MEMBER_ASSIGNMENT")
+            return;
+        const [object, member] = target.children();
+        if (member?.text !== "clientScriptModulePath" || !object)
+            return;
+        const scope = node.ancestors().find(isFunction);
+        if (!scope)
+            return;
+        const conflict = (function find(n) {
+            for (const child of n.children()) {
+                if (child.kind === "JS_ASSIGNMENT_EXPRESSION") {
+                    const t = child.children()[0];
+                    if (t?.kind === "JS_STATIC_MEMBER_ASSIGNMENT" &&
+                        t.children()[1]?.text === "clientScriptFileId" &&
+                        t.children()[0]?.text === object.text)
+                        return true;
+                }
+                if (find(child))
+                    return true;
+            }
+            return false;
+        })(scope);
+        if (conflict) {
+            registerDiagnostic(node, "error", `Set either clientScriptFileId or clientScriptModulePath on ${object.text}, not both.`);
+        }
+    },
+});

package/dist/rules/noDynamicRequire.js

@@ -0,0 +1,23 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { callArguments } from "../lib/options.js";
+// Oracle's OWASP skill: "Hardcode module paths; never build from input."
+// A module name passed to require() must be a string literal, alone or in an
+// array of them.
+export const noDynamicRequire = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (node.callee?.text !== "require")
+            return;
+        const first = callArguments(node)[0];
+        if (!first)
+            return;
+        const names = first.kind === "JS_ARRAY_EXPRESSION"
+            ? (first.children()[0]?.children() ?? [])
+            : [first];
+        for (const name of names) {
+            if (name.kind !== "JS_STRING_LITERAL_EXPRESSION") {
+                registerDiagnostic(name, "warning", "Pass require() a string literal module name, not an expression.");
+            }
+        }
+    },
+});

package/dist/rules/noDynamicSuiteQL.js

@@ -1,20 +1,25 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { optionsObject, propertyValue } from "../lib/options.js";
 import { isStaticString } from "../lib/suitescript.js";
 // Matches query.runSuiteQL, runSuiteQLPaged and their .promise forms.
 const SUITEQL = /(^|\.)runSuiteQL(Paged)?(\.promise)?$/;
 // Building SuiteQL from variables invites injection and defeats query plan
 // caching; pass values through `params` placeholders instead. A bare variable
-// is not flagged because its contents are unknown.
+// is not flagged because its contents are unknown. A call that passes `params`
+// is skipped: the OWASP skill's own examples build `IN (${placeholders})` and an
+// allowlisted `ORDER BY ${column}` into the text and bind the values through
+// `params`.
 export const noDynamicSuiteQL = defineRule({
     query: ast("JS_CALL_EXPRESSION"),
     run(node) {
         if (!SUITEQL.test(node.callee?.text ?? ""))
             return;
-        let sql = node.arguments?.children()[0]?.children()[0];
-        if (sql?.kind === "JS_OBJECT_EXPRESSION") {
-            const member = (sql.children()[0]?.children() ?? []).find((m) => m.children()[0]?.text.replace(/^['"]|['"]$/g, "") === "query");
-            sql = member?.children()[1];
-        }
+        const options = optionsObject(node);
+        if (options && propertyValue(options, "params"))
+            return;
+        const sql = options
+            ? propertyValue(options, "query")
+            : node.arguments?.children()[0]?.children()[0];
         if (sql &&
             !isStaticString(sql) &&
             sql.kind !== "JS_IDENTIFIER_EXPRESSION") {

package/dist/rules/noExtraDeps.js

@@ -0,0 +1,16 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { parseDefine } from "../lib/define.js";
+// More dependencies than callback parameters: the extra modules load but cannot
+// be used. NetSuite does not fail on it, so this is a warning. The matching
+// check for parameters without a dependency is noExtraParams.
+export const noExtraDeps = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const def = parseDefine(node);
+        if (!def)
+            return;
+        for (const extra of def.elements.slice(def.params.length)) {
+            registerDiagnostic(extra, "warning", `Excess module name ${extra.text}.`);
+        }
+    },
+});

package/dist/rules/noExtraParams.js

@@ -0,0 +1,17 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { parseDefine } from "../lib/define.js";
+// More callback parameters than dependencies: the extra parameters are always
+// undefined, which fails when the module uses them. The matching check for
+// dependencies without a parameter is noExtraDeps.
+export const noExtraParams = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const def = parseDefine(node);
+        if (!def)
+            return;
+        for (const extra of def.params.slice(def.elements.length)) {
+            if (extra)
+                registerDiagnostic(extra, "error", `Excess module identifier '${extra.text}'.`);
+        }
+    },
+});

package/dist/rules/noGlobalShadowing.js

@@ -1,6 +1,8 @@
 import { ast, defineRule, registerDiagnostic, } from "@biomejs/runtime/plugin";
 import { dependencies } from "../lib/biome-modules.js";
 import { parseDefine } from "../lib/define.js";
+// Oracle's upgrade skill: not renaming `log` or `util` "shadows SS2.1 globals and
+// can break logging or utility calls" (listed as `error` in its SKILL.md).
 // `log` and `util` are SuiteScript 2.1 globals. The one allowed binding is the
 // module they come from: N/log as `log`, N/util as `util`. `error` is not listed
 // because moduleVars names the N/error identifier `error`.
@@ -26,9 +28,11 @@ function isModuleBinding(node, module) {
 export const noGlobalShadowing = defineRule({
     query: ast("JS_IDENTIFIER_BINDING"),
     run(node) {
-        const module = GLOBALS[node.text];
+        const module = Object.hasOwn(GLOBALS, node.text)
+            ? GLOBALS[node.text]
+            : undefined;
         if (module && !isModuleBinding(node, module)) {
-            registerDiagnostic(node, "warning", `'${node.text}' shadows the global ${node.text}.`);
+            registerDiagnostic(node, "error", `'${node.text}' shadows the global ${node.text}.`);
         }
     },
 });

package/dist/rules/noHardcodedAuthPasswords.js

@@ -0,0 +1,27 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { optionsObject, propertyValue, stringValue } from "../lib/options.js";
+const PASSWORD_OPTIONS = {
+    changeEmail: ["password"],
+    changePassword: ["currentPassword", "newPassword"],
+};
+// Oracle (SuiteScript security considerations): "Don't hard-code any passwords in
+// scripts." and, for N/auth, "Be extremely careful when using the N/auth module to
+// change an email or user password. Both the auth.changeEmail(options) and
+// auth.changePassword(options) methods allow you to include a plaintext string for
+// the password."
+export const noHardcodedAuthPasswords = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const match = /^auth\.(changePassword|changeEmail)(\.promise)?$/.exec(node.callee?.text ?? "");
+        const keys = match?.[1] && PASSWORD_OPTIONS[match[1]];
+        const options = optionsObject(node);
+        if (!keys || !options)
+            return;
+        for (const key of keys) {
+            const value = propertyValue(options, key);
+            if (value && stringValue(value)) {
+                registerDiagnostic(value, "warning", `Do not hard-code the ${key} in a script.`);
+            }
+        }
+    },
+});

package/dist/rules/noHardcodedSecrets.js

@@ -1,7 +1,12 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
 const SECRET_NAMES = /^(password|passwd|pwd|secret|api_?key|client_?secret|token_?secret|consumer_?secret)$/i;
 const unquote = (text) => text.replace(/^['"]|['"]$/g, "");
-// Oracle: "Do not hard-code any passwords in scripts." A heuristic on names, so
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle: "Don't hard-code any passwords in scripts." The OWASP skill agrees, but
+// its `SKILL.md` shows script parameters as the safe place while its
+// references/02 says script parameters are not a secret store and points to API
+// Secrets. `SKILL.md` outranks the reference; the message follows the reference
+// because it is the more precise advice. A heuristic on names, so
 // no preset includes it; enable it explicitly. Only exact secret-like names with
 // a non-empty string literal are flagged (not `passwordId` or `tokenName`).
 export const noHardcodedSecrets = defineRule({
@@ -32,7 +37,7 @@ export const noHardcodedSecrets = defineRule({
             SECRET_NAMES.test(name) &&
             value?.kind === "JS_STRING_LITERAL_EXPRESSION" &&
             value.text.length > 2) {
-            registerDiagnostic(value, "error", `Do not hard-code '${name}'; read it from a script parameter or credentials.`);
+            registerDiagnostic(value, "error", `Do not hard-code '${name}'; use an API Secret (https.createSecureString) instead of source code.`);
         }
     },
 });

package/dist/rules/noInnerHtml.js

@@ -0,0 +1,41 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { callArguments } from "../lib/options.js";
+import { scriptSide } from "../lib/script-side.js";
+import { isStaticString } from "../lib/suitescript.js";
+const SINKS = ["innerHTML", "outerHTML"];
+const CALL_SINKS = /\.(insertAdjacentHTML|write|writeln)$/;
+const SANITIZED = /sanitize|escape|encode|purify/i;
+// Oracle's OWASP skill: "No `innerHTML` with unsanitized content (use
+// `textContent` for untrusted data)", and the same for `document.write`,
+// `outerHTML` and `insertAdjacentHTML`. Its own safe example assigns a static
+// string, so only a value that is not a literal is flagged, and a value wrapped
+// in a call named like a sanitizer is skipped. Server scripts are left to
+// noBrowserGlobals.
+export const noInnerHtml = defineRule({
+    query: ast("JS_ASSIGNMENT_EXPRESSION", "JS_CALL_EXPRESSION"),
+    run(node) {
+        let value;
+        if (node.kind === "JS_ASSIGNMENT_EXPRESSION") {
+            const [target, assigned] = node.children();
+            if (target?.kind === "JS_STATIC_MEMBER_ASSIGNMENT" &&
+                SINKS.includes(target.children()[1]?.text ?? ""))
+                value = assigned;
+        }
+        else {
+            const callee = node.callee?.text ?? "";
+            if (!CALL_SINKS.test(callee))
+                return;
+            if (/\.(write|writeln)$/.test(callee) && !callee.startsWith("document."))
+                return;
+            const args = callArguments(node);
+            value = callee.endsWith(".insertAdjacentHTML") ? args[1] : args[0];
+        }
+        if (!value || isStaticString(value))
+            return;
+        if (value.kind === "JS_CALL_EXPRESSION" && SANITIZED.test(value.text))
+            return;
+        if (scriptSide(node) === "server")
+            return;
+        registerDiagnostic(value, "warning", "Do not write unsanitized HTML; use textContent for untrusted data.");
+    },
+});

package/dist/rules/noInsecureCookie.js

@@ -0,0 +1,27 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { headerCall } from "../lib/headers.js";
+import { isStaticString } from "../lib/suitescript.js";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's OWASP skill: "Cookies set without HttpOnly, Secure, and SameSite
+// attributes are vulnerable to theft via XSS, interception over HTTP, and
+// cross-site request forgery", and Suitelet cookies "must include security
+// attributes". LOW CONFIDENCE, so no preset includes it: only a Set-Cookie value
+// built from literals can be checked, and the skill assumes a Suitelet may set
+// the header at all, which we have not confirmed.
+export const noInsecureCookie = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const header = headerCall(node);
+        if (header?.name !== "set-cookie" || !header.value)
+            return;
+        if (!isStaticString(header.value) &&
+            header.value.kind !== "JS_CALL_EXPRESSION")
+            return;
+        const text = header.value.text;
+        if (!/httponly/i.test(text) ||
+            !/secure/i.test(text) ||
+            !/samesite/i.test(text)) {
+            registerDiagnostic(header.value, "warning", "Set-Cookie needs the HttpOnly, Secure and SameSite attributes.");
+        }
+    },
+});

package/dist/rules/noInvalidDefine.js

@@ -0,0 +1,47 @@
+import { ast, defineRule, registerDiagnostic, } from "@biomejs/runtime/plugin";
+import { callArguments } from "../lib/options.js";
+// A define() call has one of four shapes, and its last argument is the factory:
+// define(factory), define(deps, factory), define(name, factory) or
+// define(name, deps, factory). Arguments that cannot be judged statically
+// (identifiers, calls) are accepted; only a literal of the wrong kind is flagged.
+const NAME = "JS_STRING_LITERAL_EXPRESSION";
+const DEPS = "JS_ARRAY_EXPRESSION";
+const LITERALS = [
+    NAME,
+    DEPS,
+    "JS_NUMBER_LITERAL_EXPRESSION",
+    "JS_BOOLEAN_LITERAL_EXPRESSION",
+    "JS_NULL_LITERAL_EXPRESSION",
+];
+const wrongLiteral = (node, ...allowed) => !!node && LITERALS.includes(node.kind) && !allowed.includes(node.kind);
+export const noInvalidDefine = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (node.callee?.text !== "define")
+            return;
+        const args = callArguments(node);
+        const factory = args[args.length - 1];
+        let problem;
+        if (args.length === 0) {
+            problem = "define() needs a factory.";
+        }
+        else if (args.length > 3) {
+            problem =
+                "define() takes at most a name, a dependency array and a factory.";
+        }
+        else if (wrongLiteral(factory)) {
+            problem = "The define() factory must be a function or an object.";
+        }
+        else if (args.length === 2 && wrongLiteral(args[0], NAME, DEPS)) {
+            problem =
+                "The first define() argument must be a dependency array or a name.";
+        }
+        else if (args.length === 3 &&
+            (wrongLiteral(args[0], NAME) || wrongLiteral(args[1], DEPS))) {
+            problem =
+                "define(name, dependencies, factory) needs a string name and a dependency array.";
+        }
+        if (problem)
+            registerDiagnostic(node, "error", problem);
+    },
+});

package/dist/rules/noInvalidEnumMember.js

@@ -0,0 +1,24 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { moduleOfReceiver, typingsOf } from "../lib/module-calls.js";
+// A member the type definitions (Tier 2) do not list for a module enum
+// (`record.Type.CUSTOMR`) evaluates to undefined, which then fails a required
+// option at runtime. The enum's module is resolved from the define() or import
+// binding of the receiver.
+export const noInvalidEnumMember = defineRule({
+    query: semantic("JS_STATIC_MEMBER_EXPRESSION"),
+    run(node, { model }) {
+        const [object, member] = node.children();
+        if (object?.kind !== "JS_STATIC_MEMBER_EXPRESSION" || !member)
+            return;
+        const [receiver, enumName] = object.children();
+        if (!receiver || !enumName)
+            return;
+        const enums = typingsOf(moduleOfReceiver(receiver, model))?.enums;
+        const members = enums && Object.hasOwn(enums, enumName.text)
+            ? enums[enumName.text]
+            : undefined;
+        if (members && !members.includes(member.text)) {
+            registerDiagnostic(member, "warning", `${member.text} is not a member of ${receiver.text}.${enumName.text}.`);
+        }
+    },
+});

package/dist/rules/noLocationHeader.js

@@ -0,0 +1,20 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { headerCall } from "../lib/headers.js";
+import { isStaticString } from "../lib/suitescript.js";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's OWASP skill: "SAFE: use the documented redirect module instead of
+// writing raw headers", because an unvalidated value in a response header can
+// split the response. LOW CONFIDENCE, so no preset includes it: the value may
+// have been validated, and the skill's references still set Location after
+// sanitising it.
+export const noLocationHeader = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const header = headerCall(node);
+        if (header?.name === "location" &&
+            header.value &&
+            !isStaticString(header.value)) {
+            registerDiagnostic(header.value, "warning", "Use N/redirect instead of writing a Location header from a variable.");
+        }
+    },
+});

package/dist/rules/noLogModule.js

@@ -1,10 +1,13 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
 import { dependencies } from "../lib/biome-modules.js";
-// Opt-in style: use the global `log` instead of loading N/log. It is the opposite
-// of noMissingModules, which requires loading N/log, so enable only one of them.
-// Oracle's skills disagree on this (upgrade: the global exists but importing is
-// recommended; learning: it is not global). The global is not available in
-// client scripts, so scope this rule away from them with the plugin `includes`.
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md, docs/adr/0006-log-is-a-global-with-two-opposite-styles.md.
+// Opt-in style: use the global `log` instead of loading N/log. Oracle's help
+// center says "NetSuite loads the log Object by default for all script types. You
+// do not need to load it manually", which is what this rule follows. It is the
+// opposite of requireLogModule, so enable only one of them. (The upgrade skill
+// says the global exists but loading is recommended, which requireLogModule
+// follows; the learning skill says it is not global and loses.) Logging in a client script attached to a form is
+// ignored either way; see noClientLog.
 export const noLogModule = defineRule({
     query: ast("JS_CALL_EXPRESSION", "JS_IMPORT"),
     run(node) {

package/dist/rules/noMissingModules.js

@@ -1,10 +1,13 @@
 import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
 import { MODULES } from "../lib/modules.js";
 import { inSuiteScriptModule } from "../lib/suitescript.js";
-// `util` is a global in SuiteScript 2.1, so it never needs loading. `log` is
-// treated like every other module: load N/log when you call it.
+// Tier 0: docs/adr/0006-log-is-a-global-with-two-opposite-styles.md.
+// `log` and `util` are globals in SuiteScript 2.1 ("NetSuite loads the log Object
+// by default for all script types. You do not need to load it manually."), so
+// neither needs loading. requireLogModule is the style that wants N/log loaded.
+const GLOBALS = ["log", "util"];
 const ALIASES = new Map(Object.entries(MODULES)
-    .filter(([, identifier]) => identifier !== "util")
+    .filter(([, identifier]) => !GLOBALS.includes(identifier))
     .map(([name, identifier]) => [identifier, name]));
 // Reports `record.load()` when `record` resolves to no binding, meaning the
 // module was never added to `define()` or imported. Locals that shadow the

package/dist/rules/noModuleScopeApiCalls.js

@@ -7,8 +7,16 @@ const FUNCTIONS = [
     "JS_METHOD_OBJECT_MEMBER",
     "JS_METHOD_CLASS_MEMBER",
 ];
-// N/ APIs called while the define() callback runs (module scope) can fail on
-// deploy; initialize lazily from an entry point instead. N/log is exempt.
+const FACTORIES = /\.(createColumn|createFilter|createSort|createSetting)$/;
+// Oracle's SAFE guide: "All N/ API modules are unavailable during the `define()`
+// callback execution. Calling `runtime.getCurrentScript()`, `record.load()`, or
+// any N/ API at module scope causes deployment failure." Initialize lazily from an
+// entry point instead. N/log is exempt because log is a global. The failure claim
+// comes only from this skill and has not been checked against Oracle's
+// documentation, and its examples are calls that do work (getCurrentScript, record.load).
+// Calls that only build an object (`search.createColumn`, `createFilter`,
+// `createSort`, `createSetting`) are skipped, because nothing says they fail; remove
+// them from FACTORIES if that turns out to be wrong.
 export const noModuleScopeApiCalls = defineRule({
     query: ast("JS_CALL_EXPRESSION"),
     run(node) {
@@ -26,8 +34,10 @@ export const noModuleScopeApiCalls = defineRule({
                 const object = callee?.kind === "JS_STATIC_MEMBER_EXPRESSION"
                     ? callee.children()[0]?.text
                     : undefined;
-                if (object && aliases.has(object)) {
-                    registerDiagnostic(n, "warning", `${callee?.text}() runs at module scope; call it from an entry point.`);
+                if (object &&
+                    aliases.has(object) &&
+                    !FACTORIES.test(callee?.text ?? "")) {
+                    registerDiagnostic(n, "error", `${callee?.text}() runs at module scope; call it from an entry point.`);
                 }
             }
             for (const child of n.children())

package/dist/rules/noMultipleDefine.js

@@ -0,0 +1,14 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { descendants } from "../lib/script-side.js";
+// Oracle (entry point script validation): "The script must include one, and only
+// one, properly structured define statement. The script can't include multiple
+// define statements." NetSuite rejects the upload with MULTIPLE_DEFINE_CALLS.
+export const noMultipleDefine = defineRule({
+    query: ast("JS_MODULE", "JS_SCRIPT"),
+    run(node) {
+        const defines = [...descendants(node)].filter((n) => n.kind === "JS_CALL_EXPRESSION" && n.callee?.text === "define");
+        for (const extra of defines.slice(1)) {
+            registerDiagnostic(extra, "error", "A script can call define() only once.");
+        }
+    },
+});

package/dist/rules/noNativeIterators.js

@@ -1,16 +1,19 @@
 import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
-// NetSuite runs GraalJS; Oracle's guidance is to use array methods, not
-// generators or Symbol.iterator.
+// Oracle's SAFE guide: "`function*` generators and `Symbol.iterator` usage passes
+// Jest/Node.js but fails in GraalJS; use standard array methods instead." Its own
+// samples use `for...of`, so that is not flagged. Generator methods (`*foo() {}`)
+// are generators too. The failure claim comes only from this skill and has not been
+// checked against Oracle's documentation.
 export const noNativeIterators = defineRule({
-    query: ast("JS_FUNCTION_DECLARATION", "JS_FUNCTION_EXPRESSION", "JS_STATIC_MEMBER_EXPRESSION"),
+    query: ast("JS_FUNCTION_DECLARATION", "JS_FUNCTION_EXPRESSION", "JS_METHOD_OBJECT_MEMBER", "JS_METHOD_CLASS_MEMBER", "JS_STATIC_MEMBER_EXPRESSION"),
     run(node) {
         if (node.kind === "JS_STATIC_MEMBER_EXPRESSION") {
             if (node.text === "Symbol.iterator") {
-                registerDiagnostic(node, "warning", "Avoid Symbol.iterator.");
+                registerDiagnostic(node, "error", "Avoid Symbol.iterator.");
             }
         }
         else if (node.starToken) {
-            registerDiagnostic(node, "warning", "Avoid generator functions.");
+            registerDiagnostic(node, "error", "Avoid generator functions.");
         }
     },
 });