suitescript-verify 0.1.0 → 0.3.0

package/README.md

@@ -9,15 +9,15 @@ npm install --save-dev suitescript-verify @oracle/suitecloud-cli
 npx suitescript-verify help
 ```
 
-`init` scaffolds `verification/probes`, `verification/sdf`, `docs/verification/results` and a committed `verification/.env` of layout keys, then prints a to-do list. It creates no credentials. `doctor` checks the SuiteCloud CLI, account, sandbox, certificates, passkey and project files, and says which failing steps are the maintainer's own; it exits 1 while any fails.
+`init` scaffolds `verification/probes`, `verification/sdf`, your results folder and a committed `verification/.env` of layout keys, then prints a to-do list. It creates no credentials. The package imposes no layout for results: where results pages live is your choice, set as `SUITESCRIPT_VERIFY_RESULTS_DIR` in the committed `.env` (a path inside the project). `init` will not pick it for you: at a terminal it asks (suggesting `docs/verification/results`), and without one it needs `--results-dir <path>` (for example `init --results-dir docs/verification/results`). A project that already sets the key is not asked again, and a command that needs the folder without the key stops and names it. `doctor` checks the SuiteCloud CLI, account, sandbox, certificates, passkey and project files, and says which failing steps are the maintainer's own; it exits 1 while any fails.
 
 `certificate` generates the runner key pair (EC P-256) and the SDF key pair (RSA-4096) outside the project with `openssl` (`--keys-dir`, default `~/.suitescript-verify`), `passkey` and `env set NAME=value` save settings in the gitignored `verification/.env.local` (values are never printed; a different existing value is kept unless `--overwrite`), and `setup-ci` registers the SDF credentials with the SuiteCloud CLI.
 
 `setup-ci` prepares a pipeline: it registers the SDF credentials (auth id `suitescript-verify`) with your project's SuiteCloud CLI and passes the passkey to it through the environment, never an argument. On success it prints the `SUITESCRIPT_VERIFY_` names the pipeline must supply as its own secrets (account, client id, both certificate ids, both private key paths, passkey), never a value. It writes no file, no credential variable and no license variable, and it holds no credential itself: the pipeline provides them. Accepting Oracle's SuiteCloud license in the pipeline is yours.
 
-`deploy` generates the runner and an SDF project into `verification/sdf` (the generated `src/` and `package.json` there are yours to gitignore) from the RESTlet probes in `verification/probes`, then dry-runs it through your project's SuiteCloud CLI. A real deploy needs `--approved` and a person at a terminal who types `DEPLOY`. `cleanup` does the same with the runner's deployment switched off and needs `CLEANUP`. `--dir <path>` moves `verification/`.
+`deploy` generates the runner and an SDF project into `verification/sdf` (the generated `src/` there is yours to gitignore) from the RESTlet probes in `verification/probes`, then dry-runs it through your project's SuiteCloud CLI. A real deploy needs `--approved` and a person at a terminal who types `DEPLOY`. `cleanup` does the same with the runner's deployment switched off and needs `CLEANUP`. `--dir <path>` moves `verification/`.
 
-`run <probe> [--draft]` runs one probe by name through the deployed runner. The name must be one of the probes in the folder: the runner only runs the fixed list generated into it and never code from a request. Output is scrubbed of the account, client and certificate ids, and refused if it still looks like an identifier. A probe with an `<probe>.expect.json` is compared with it and a difference exits 2 as drift. `--draft` writes `docs/verification/results/<probe>.md` (never over an existing page) with the test, NetSuite version and results, and empty explanation and decision sections. Probes must declare `@scriptType Restlet` and no `@writes`.
+`run <probe> [--draft]` runs one probe by name through the deployed runner. The name must be one of the probes in the folder: the runner only runs the fixed list generated into it and never code from a request. Output is scrubbed of the account, client and certificate ids, and refused if it still looks like an identifier. A probe with an `<probe>.expect.json` is compared with it and a difference exits 2 as drift. `--draft` writes `<probe>.md` into your results folder (`SUITESCRIPT_VERIFY_RESULTS_DIR`; never over an existing page) with the test, NetSuite version and results, and empty explanation and decision sections. Probes must declare `@scriptType Restlet` and no `@writes`.
 
 A probe takes data by declaring parameters in its leading JSDoc block, one tag per parameter: `@param <name> <pattern>`. The name is lowercase-initial letters and digits (`recordType`); the pattern is a JavaScript regular expression (Unicode mode) that the whole value must match, so `[a-z_]+` cannot match `a;b`. Pass each value with `run <probe> --param name=value`. Every declared parameter is required and its value is always a string. The runner validates the parameters against the declarations before any request, rejecting an invalid, undeclared, missing or repeated one, and a probe that declares none takes none; the generated runner checks them again and hands the probe only declared strings in `run(params)`. A value goes in the JSON request body and is never evaluated or turned into code. A bad `@param` tag (no pattern, an invalid pattern, a duplicate name) stops `run` and `deploy`.
 
@@ -33,13 +33,13 @@ define(["N/record"], (record) => ({
 }));
 ```
 
-Every command that reaches the sandbox refuses an account that is not a sandbox (`digits_SBn`). The runner uses the script id `customscript_suitescript_verify_runner` and is limited to a role with the ID `customrole_suitescript_verify`, which you create in the sandbox.
+Every command that reaches the sandbox refuses an account that is not a sandbox (`digits_SBn`). The runner uses the script id `customscript_suitescript_verify_runner` and is limited to a role with the ID `customrole_suitescript_verify`, which you create in the sandbox. A project that names its own role sets `SUITESCRIPT_VERIFY_ROLE_ID` (for example `SUITESCRIPT_VERIFY_ROLE_ID=customrole_my_runner`); the generated SDF project uses it in the manifest and the runner. Like every `SUITESCRIPT_VERIFY_` setting it layers from the committed `verification/.env`, the gitignored `.env.local` and the process environment. The value must match `^customrole_[a-z0-9_]+$`; a bad value stops every command that reaches the sandbox, and the error names the key, never the value. `doctor` reports the id in use.
 
-See [docs/verification/README.md](docs/verification/README.md) and [docs/verification/lessons.md](docs/verification/lessons.md).
+The verification method and the lessons learned running probes are in the repository, not the package: see [the verification guide](https://github.com/nemchik/suitescript-verify/blob/main/docs/verification/README.md) and [the lessons](https://github.com/nemchik/suitescript-verify/blob/main/docs/verification/lessons.md).
 
 ## Development
 
-You need the Node.js and npm versions in `package.json` `devEngines`.
+You need the Node.js and npm versions in `package.json` `devEngines` (mirrored in `.nvmrc`). `npm pack` and `npm test` refuse any other Node version.
 
 ```sh
 npm install

package/dist/cli.js

@@ -1,6 +1,7 @@
 import { randomBytes } from "node:crypto";
+import { createInterface } from "node:readline/promises";
 import { certificate } from "./certificate.js";
-import { loadConfig } from "./config.js";
+import { loadConfig, resultsDirGuidance, resultsDirKey, suggestedResultsDir, } from "./config.js";
 import { formatChecks, names, runChecks } from "./doctor.js";
 import { envNames } from "./envfile.js";
 import { init } from "./init.js";
@@ -10,7 +11,7 @@ import { confirmWrite, flagValue, positionals, requireSandbox, saveEnv, suiteclo
 export const USAGE = `Usage: suitescript-verify <command> [options]
 
 Commands:
-  init                                 Scaffold the folders and .env, and print a to-do list
+  init [--results-dir <path>]          Scaffold the folders and .env, and print a to-do list; the results folder is yours to choose (suggested: docs/verification/results)
   doctor                               Check the setup; each failing step says who does it
   certificate [--only runner|sdf] [--keys-dir <path>] [--overwrite | --keep]
                                        Generate the key pairs outside the project
@@ -53,8 +54,23 @@ function doctor(args) {
     console.log(formatChecks(checks));
     return config.problems.length === 0 && checks.every((c) => c.ok) ? 0 : 1;
 }
-function initCommand(args) {
-    console.log(init(process.cwd(), reporting(args)));
+/** The results folder `init` was told to use: the flag, or a prompt at a terminal when the key is not set. Never a silent default. */
+async function chooseResultsDir(config, args) {
+    const flagged = flagValue(args, "--results-dir");
+    // Already configured: the flag is passed on only so `init` can say it was ignored.
+    if (config.resultsDir !== undefined || flagged !== undefined)
+        return flagged;
+    if (!process.stdin.isTTY) {
+        throw new UsageError(`${resultsDirKey} is not set. ${resultsDirGuidance} Nothing was created.`);
+    }
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await rl.question(`Where should results pages live in this project? [${suggestedResultsDir}] `);
+    rl.close();
+    return answer.trim() || suggestedResultsDir;
+}
+async function initCommand(args) {
+    const config = reporting(args);
+    console.log(init(process.cwd(), config, await chooseResultsDir(config, args)));
     return 0;
 }
 async function deploy(args) {
@@ -64,6 +80,7 @@ async function deploy(args) {
     const { files, slugs } = buildSdfProject(config.sdfDir, config.probesDir, {
         deployed: true,
         extraTags: config.extraTags,
+        roleId: config.roleId,
     });
     console.log(`Probes in the runner: ${slugs.join(", ") || "(none)"}`);
     console.log(`Files to upload: ${files.join(", ")}`);
@@ -92,6 +109,7 @@ async function cleanup(args) {
     buildSdfProject(config.sdfDir, config.probesDir, {
         deployed: false,
         extraTags: config.extraTags,
+        roleId: config.roleId,
     });
     return suitecloud(project, config, [
         "project:deploy",
@@ -183,7 +201,7 @@ export async function main(args) {
         if (command === "doctor")
             return doctor(rest);
         if (command === "init")
-            return initCommand(rest);
+            return await initCommand(rest);
         throw new UsageError(`Unknown command "${command}".\n\n${USAGE}`);
     }
     catch (error) {

package/dist/config.js

@@ -8,8 +8,17 @@ export const layoutKeys = [
     "SUITESCRIPT_VERIFY_RESULTS_DIR",
     "SUITESCRIPT_VERIFY_SDF_DIR",
 ];
+export const resultsDirKey = "SUITESCRIPT_VERIFY_RESULTS_DIR";
+/** What `init` suggests for the results folder; it is never applied without the project's say-so. */
+export const suggestedResultsDir = "docs/verification/results";
+/** What every command says when the results folder is not chosen: one sentence, so the commands cannot drift apart. */
+export const resultsDirGuidance = `Choose where results pages live in your project, then run suitescript-verify init --results-dir <path> (${suggestedResultsDir} is the suggested value) or set ${resultsDirKey} in the committed .env.`;
 /** The committed `.env` may also register extra probe tags: a comma-separated list of tag names, not a path. */
 export const extraTagsKey = "SUITESCRIPT_VERIFY_EXTRA_TAGS";
+/** The committed `.env` may also name the runner role: a NetSuite custom role id. */
+export const roleIdKey = "SUITESCRIPT_VERIFY_ROLE_ID";
+export const defaultRoleId = "customrole_suitescript_verify";
+const roleIdPattern = /^customrole_[a-z0-9_]+$/;
 const tagName = /^[A-Za-z][A-Za-z0-9_-]*$/;
 /** The tag names in a registration value, without the `@`; blank entries are dropped. */
 export const parseTagList = (value) => value
@@ -41,7 +50,7 @@ function readEnvFile(path) {
         ? parseEnv(readFileSync(path, "utf8"))
         : new Map();
 }
-const insideProject = (project, path) => {
+export const insideProject = (project, path) => {
     const rel = relative(project, resolve(project, path));
     return !isAbsolute(rel) && rel.split(/[\\/]/)[0] !== "..";
 };
@@ -49,11 +58,19 @@ const insideProject = (project, path) => {
 const looksSecret = (value) => /-----BEGIN /.test(value) ||
     /^eyJ[\w-]+\.[\w-]+\.[\w-]+$/.test(value) ||
     /^[A-Za-z0-9+_=-]{32,}$/.test(value);
+const roleIdProblem = (file) => ({
+    message: `${roleIdKey} in ${file} is not a NetSuite custom role id like customrole_suitescript_verify (lowercase letters, digits and underscores after customrole_).`,
+});
 /** Checks the committed `.env` against the allowlist. Messages name the key, never the value. */
 function checkCommitted(project, committed, file) {
     const problems = [];
     for (const [key, value] of committed) {
-        if (key === extraTagsKey) {
+        if (key === roleIdKey) {
+            // The pattern is the whole check: a valid id may be long enough to look like a token.
+            if (!roleIdPattern.test(value))
+                problems.push(roleIdProblem(file));
+        }
+        else if (key === extraTagsKey) {
             if (!parseTagList(value).every((name) => tagName.test(name))) {
                 problems.push({
                     message: `${key} in ${file} is not a comma-separated list of tag names like flavor,other.`,
@@ -67,7 +84,7 @@ function checkCommitted(project, committed, file) {
         }
         else if (!layoutKeys.includes(key)) {
             problems.push({
-                message: `${key} in ${file} is not a layout key. The committed file holds layout only (${[...layoutKeys, extraTagsKey].join(", ")}); put anything else in .env.local or the process environment.`,
+                message: `${key} in ${file} is not a layout key. The committed file holds layout only (${[...layoutKeys, extraTagsKey, roleIdKey].join(", ")}); put anything else in .env.local or the process environment.`,
             });
         }
         else if (!insideProject(project, value)) {
@@ -125,6 +142,13 @@ export function loadConfig(project, dir, processEnv = process.env) {
         }
     }
     const path = (key, fallback) => resolve(project, values[key] || fallback);
+    const roleId = values[roleIdKey] || defaultRoleId;
+    // The committed file reports its own bad value; this covers .env.local and the environment.
+    const committedRole = committed.get(roleIdKey);
+    const roleProblems = roleIdPattern.test(roleId) ||
+        (committedRole !== undefined && !roleIdPattern.test(committedRole))
+        ? []
+        : [roleIdProblem(".env.local or the environment")];
     const shown = relative(project, envFile).replaceAll("\\", "/");
     return {
         extraTags: parseTagList(values[extraTagsKey] ?? ""),
@@ -132,8 +156,12 @@ export function loadConfig(project, dir, processEnv = process.env) {
         problems: [
             ...checkCommitted(project, committed, shown),
             ...checkLocalIgnored(project, localFile),
+            ...roleProblems,
         ],
-        resultsDir: path("SUITESCRIPT_VERIFY_RESULTS_DIR", "docs/verification/results"),
+        resultsDir: values[resultsDirKey]
+            ? resolve(project, values[resultsDirKey])
+            : undefined,
+        roleId,
         root,
         sdfDir: path("SUITESCRIPT_VERIFY_SDF_DIR", join(root, "sdf")),
         values,

package/dist/doctor.js

@@ -1,6 +1,7 @@
 import { createPrivateKey } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { insideProject, resultsDirGuidance, resultsDirKey, } from "./config.js";
 export const names = {
     account: "SUITESCRIPT_VERIFY_ACCOUNT",
     certificateId: "SUITESCRIPT_VERIFY_CERTIFICATE_ID",
@@ -76,10 +77,13 @@ export function runChecks(project, config, env = process.env) {
             // A malformed project.json fails the step.
         }
     }
-    const absent = [config.probesDir, config.resultsDir, config.sdfDir].filter((dir) => !existsSync(dir));
+    add(`The results folder is set, inside the project (${resultsDirKey})`, config.resultsDir !== undefined &&
+        insideProject(project, config.resultsDir), "maintainer", resultsDirGuidance);
+    const absent = [config.probesDir, config.resultsDir, config.sdfDir].filter((dir) => dir !== undefined && !existsSync(dir));
     add("Project files: the probe, results and SDF folders exist and the SDF project has a default auth id", absent.length === 0 && authId !== "", absent.length > 0 ? "agent" : "maintainer", absent.length > 0
         ? "Run suitescript-verify init to create the missing folders."
         : "Run account:setup:ci from the SDF folder once the steps above pass, so project.json gets a default auth id.");
+    add(`Runner role id: ${config.roleId}`, true, "agent", "");
     return checks;
 }
 export function formatChecks(checks) {

package/dist/init.js

@@ -1,35 +1,81 @@
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { dirname, join, relative } from "node:path";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { insideProject, resultsDirKey } from "./config.js";
+import { UsageError } from "./shared.js";
+/** A path relative to the project, with forward slashes, for messages and the committed `.env`. */
+const shown = (project, path) => relative(project, path).replaceAll("\\", "/");
 /**
- * Scaffolds the folders and a committed `.env` of layout keys, then returns
- * the to-do list for the person. Creates no credential and installs nothing.
+ * Which folder holds results: the one the configuration already sets, else the
+ * one the project just chose. `ignoredNote` is non-empty when a choice was
+ * given but the key was already set. Refuses a choice outside the project
+ * before anything is created.
  */
-export function init(project, config) {
-    const rel = (path) => relative(project, path).replaceAll("\\", "/");
-    const dirs = [config.probesDir, config.resultsDir, config.sdfDir];
-    for (const dir of dirs)
-        mkdirSync(dir, { recursive: true });
+function pickResultsDir(project, config, chosenResultsDir) {
+    const chosen = chosenResultsDir === undefined
+        ? undefined
+        : resolve(project, chosenResultsDir);
+    if (chosen !== undefined && !insideProject(project, chosen)) {
+        throw new UsageError(`${resultsDirKey} must be a path inside the project, because the committed .env holds layout only. Nothing was created.`);
+    }
+    if (config.resultsDir !== undefined) {
+        const ignoredNote = chosen !== undefined && chosen !== config.resultsDir
+            ? `${resultsDirKey} is already set to ${shown(project, config.resultsDir)}, so --results-dir ${shown(project, chosen)} was ignored. Change the key itself to move the results folder.\n\n`
+            : "";
+        return { alreadySet: true, dir: config.resultsDir, ignoredNote };
+    }
+    if (chosen === undefined) {
+        throw new Error("init needs a results folder; the caller must choose one.");
+    }
+    return { alreadySet: false, dir: chosen, ignoredNote: "" };
+}
+/**
+ * Writes the layout keys to the committed `.env`: a new file with all of them,
+ * or, for an existing one, only the results key when it is missing. Returns
+ * whether the file was created.
+ */
+function writeLayoutEnv(project, config, resultsDir) {
     const envFile = join(config.root, ".env");
-    const created = !existsSync(envFile);
-    if (created) {
+    const results = `${resultsDirKey}=${shown(project, resultsDir.dir)}`;
+    if (!existsSync(envFile)) {
         mkdirSync(dirname(envFile), { recursive: true });
         writeFileSync(envFile, [
             "# Layout only: this file is committed. Credentials go in .env.local, which is gitignored.",
-            `SUITESCRIPT_VERIFY_PROBES_DIR=${rel(config.probesDir)}`,
-            `SUITESCRIPT_VERIFY_RESULTS_DIR=${rel(config.resultsDir)}`,
-            `SUITESCRIPT_VERIFY_SDF_DIR=${rel(config.sdfDir)}`,
+            `SUITESCRIPT_VERIFY_PROBES_DIR=${shown(project, config.probesDir)}`,
+            results,
+            `SUITESCRIPT_VERIFY_SDF_DIR=${shown(project, config.sdfDir)}`,
             "",
         ].join("\n"));
+        return true;
+    }
+    if (!resultsDir.alreadySet) {
+        const text = readFileSync(envFile, "utf8");
+        const lead = text === "" || text.endsWith("\n") ? "" : "\n";
+        appendFileSync(envFile, `${lead}${results}\n`);
     }
-    const local = rel(join(config.root, ".env.local"));
+    return false;
+}
+/**
+ * Scaffolds the folders and a committed `.env` of layout keys, then returns
+ * the to-do list for the person. Creates no credential and installs nothing.
+ * `chosenResultsDir` is the project's own choice for the results folder; it is
+ * used only when the configuration does not already set one.
+ */
+export function init(project, config, chosenResultsDir) {
+    const results = pickResultsDir(project, config, chosenResultsDir);
+    const dirs = [config.probesDir, results.dir, config.sdfDir];
+    for (const dir of dirs)
+        mkdirSync(dir, { recursive: true });
+    const created = writeLayoutEnv(project, config, results);
+    const envFile = shown(project, join(config.root, ".env"));
+    const local = shown(project, join(config.root, ".env.local"));
     return [
-        `${created ? "Created" : "Kept"} ${rel(envFile)} and the folders ${dirs.map(rel).join(", ")}. No credentials were created.`,
+        `${results.ignoredNote}${created ? "Created" : "Kept"} ${envFile} and the folders ${dirs.map((dir) => shown(project, dir)).join(", ")}. No credentials were created.`,
         "",
         "To do (each step is yours, the maintainer's):",
         "1. Install the SuiteCloud CLI: npm install --save-dev @oracle/suitecloud-cli. Read Oracle's license and accept it yourself; this package never does.",
         `2. Add ${local} to .gitignore before saving any value: it holds credentials.`,
         "3. In a sandbox, create the integration record, the role and the certificate mappings, and generate the private keys outside the repository.",
-        `4. Save the account, client id, certificate ids, key paths and a passkey in ${local} (see docs/verification/README.md).`,
+        `4. Save the account, client id, certificate ids, key paths and a passkey in ${local}. Setup is described in the package README: https://github.com/nemchik/suitescript-verify#readme`,
         "5. Run suitescript-verify doctor until every step passes.",
     ].join("\n");
 }

package/dist/run.js

@@ -3,7 +3,7 @@ import { join, relative } from "node:path";
 import { clientAssertion, restletUrl, scrub, tokenUrl } from "./netsuite.js";
 import { anchored, isRestlet, isSlug, listProbes, matchesExpect, read, readExpect, tagProblems, } from "./probes.js";
 import { resultsDraft } from "./results.js";
-import { positionals, requireSandbox, UsageError } from "./shared.js";
+import { positionals, requireResultsDir, requireSandbox, UsageError, } from "./shared.js";
 /** Every `--param name=value` in the arguments, in order. The value may start with anything. */
 function suppliedParams(args) {
     const out = [];
@@ -63,6 +63,10 @@ function validateParams(probe, args) {
  * code: the runner only knows the probes generated into it by `deploy`.
  */
 export async function runProbe(project, config, args) {
+    // A missing results key is the project's own layout choice: report it before the credentials.
+    const resultsDir = args.includes("--draft")
+        ? requireResultsDir(config)
+        : undefined;
     const creds = requireSandbox(config);
     const name = positionals(args)[0] ?? "";
     const probes = listProbes(config.probesDir, config.extraTags);
@@ -73,7 +77,7 @@ export async function runProbe(project, config, args) {
         throw new UsageError(`Unknown probe "${name}". Known: ${probes.map((p) => p.slug).join(", ") || "(none)"}`);
     }
     if (!isRestlet(probe)) {
-        throw new UsageError(`${probe.slug} needs a ${probe.scriptType || "(undeclared)"} script. The runner only runs RESTlet probes (declare @scriptType Restlet); ask the user to run it by hand (docs/verification/README.md).`);
+        throw new UsageError(`${probe.slug} needs a ${probe.scriptType || "(undeclared)"} script. The runner only runs RESTlet probes (declare @scriptType Restlet); ask the user to run it by hand in a sandbox console.`);
     }
     if (probe.writes) {
         throw new UsageError(`${probe.slug} declares @writes, which needs the user's separate approval. That path is not automated.`);
@@ -156,9 +160,9 @@ export async function runProbe(project, config, args) {
             console.log(`\nDRIFT: the output differs from ${probe.slug}.expect.json. The platform changed, or the expectation is wrong.`);
         }
     }
-    if (args.includes("--draft")) {
+    if (resultsDir !== undefined) {
         const probeFile = join(config.probesDir, `${probe.slug}.js`);
-        const page = join(config.resultsDir, `${probe.slug}.md`);
+        const page = join(resultsDir, `${probe.slug}.md`);
         const shown = relative(project, page).replaceAll("\\", "/");
         if (existsSync(page)) {
             console.log(`\n${shown} already exists; not overwriting.`);
@@ -169,7 +173,7 @@ export async function runProbe(project, config, args) {
                 output: body.result,
                 probe,
                 probeFile,
-                resultsDir: config.resultsDir,
+                resultsDir,
                 scriptSource: read(probeFile),
                 version: body.version ?? "unknown",
             }), known);

package/dist/sdf.js

@@ -1,5 +1,6 @@
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { defaultRoleId } from "./config.js";
 import { fileCabinetFolder } from "./netsuite.js";
 import { isRestlet, listProbes, read, tagProblems, } from "./probes.js";
 import { UsageError } from "./shared.js";
@@ -24,7 +25,7 @@ export function generateRunner(probes, source) {
  * the SDF folder. Only RESTlet probes go in: the runner is a RESTlet. With
  * `deployed: false` the runner's deployment is switched off (cleanup).
  */
-export function buildSdfProject(sdfDir, probesDir, { deployed, extraTags = [], }) {
+export function buildSdfProject(sdfDir, probesDir, { deployed, extraTags = [], roleId = defaultRoleId, }) {
     const probes = listProbes(probesDir, extraTags).filter(isRestlet);
     const bad = probes.filter((probe) => tagProblems(probe).length > 0);
     if (bad.length > 0) {
@@ -39,9 +40,11 @@ export function buildSdfProject(sdfDir, probesDir, { deployed, extraTags = [], }
     mkdirSync(join(src, "Objects"), { recursive: true });
     writeFileSync(join(sdfDir, "package.json"), template("sdf/package.json"));
     writeFileSync(join(sdfDir, "suitecloud.config.js"), template("sdf/suitecloud.config.js"));
-    writeFileSync(join(src, "manifest.xml"), template("sdf/manifest.xml"));
+    writeFileSync(join(src, "manifest.xml"), template("sdf/manifest.xml").replaceAll("%%ROLE_ID%%", roleId));
     writeFileSync(join(src, "deploy.xml"), template("sdf/deploy.xml"));
-    writeFileSync(join(src, "Objects", "customscript_suitescript_verify_runner.xml"), template("sdf/runner.xml").replace("%%DEPLOYED%%", deployed ? "T" : "F"));
+    writeFileSync(join(src, "Objects", "customscript_suitescript_verify_runner.xml"), template("sdf/runner.xml")
+        .replace("%%DEPLOYED%%", deployed ? "T" : "F")
+        .replaceAll("%%ROLE_ID%%", roleId));
     const slugs = probes.map((probe) => probe.slug);
     const files = ["runner.js"];
     writeFileSync(join(folder, "runner.js"), generateRunner(probes, template("runner.template.js")));

package/dist/shared.js

@@ -2,12 +2,19 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
+import { resultsDirGuidance, resultsDirKey } from "./config.js";
 import { isSandboxAccount, names } from "./doctor.js";
 import { applyEnvUpdate, planEnvUpdate } from "./envfile.js";
 /** A refusal or mistake to report to the person; the message holds no secret. */
 export class UsageError extends Error {
 }
-const valueFlags = ["--dir", "--keys-dir", "--only", "--param"];
+const valueFlags = [
+    "--dir",
+    "--keys-dir",
+    "--only",
+    "--param",
+    "--results-dir",
+];
 /** The value after a flag, when given. */
 export function flagValue(args, flag) {
     const at = args.indexOf(flag);
@@ -110,6 +117,13 @@ export async function saveEnv(config, args, entries) {
         console.log(`Kept the existing ${name}. To replace it, ask the user, then rerun with --overwrite.`);
     }
 }
+/** The results folder, or a refusal naming the key: the package imposes no layout for results. */
+export function requireResultsDir(config) {
+    if (config.resultsDir === undefined) {
+        throw new UsageError(`${resultsDirKey} is not set. ${resultsDirGuidance}`);
+    }
+    return config.resultsDir;
+}
 /** The runner credentials, or a refusal: every command that reaches the sandbox needs a sandbox account. */
 export function requireSandbox(config) {
     const v = config.values;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "suitescript-verify",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Run probes in a NetSuite sandbox to verify what SuiteScript modules do, with guardrails for agents.",
   "keywords": [
     "suitescript",
@@ -50,7 +50,7 @@
     "@types/node": "24.19.2",
     "git-pull-run": "2.1.0",
     "lefthook": "2.2.2",
-    "skills": "1.7.6",
+    "skills": "1.8.0",
     "typescript": "7.0.2"
   },
   "peerDependencies": {

package/templates/sdf/manifest.xml

@@ -6,7 +6,7 @@
       <feature required="true">SERVERSIDESCRIPTING</feature>
     </features>
     <objects>
-      <object>customrole_suitescript_verify</object>
+      <object>%%ROLE_ID%%</object>
     </objects>
   </dependencies>
 </manifest>

package/templates/sdf/runner.xml

@@ -7,7 +7,7 @@
   <scriptdeployments>
     <scriptdeployment scriptid="customdeploy_suitescript_verify_runner">
       <allroles>F</allroles>
-      <audslctrole>[customrole_suitescript_verify]</audslctrole>
+      <audslctrole>[%%ROLE_ID%%]</audslctrole>
       <isdeployed>%%DEPLOYED%%</isdeployed>
       <loglevel>DEBUG</loglevel>
       <status>RELEASED</status>