suitescript-verify 1.0.0 → 1.1.0

package/README.md

@@ -113,16 +113,33 @@ Every step that creates a credential or accepts a license is the person's. `init
    Oracle allows one certificate per integration, role and entity, so the two pairs cannot be shared, and an EC key fails the SDF login (see [Troubleshooting](#setup-ci-fails-with-an-error-with-the-private-key)).
 5. **In the sandbox, create the integration record, the role and the certificate mappings.**
    - The integration needs more than the machine-to-machine grant: also enable the token-based authentication flags and the RESTlets and REST Web Services scopes (see [Troubleshooting](#every-call-fails-with-401-invalid_login_attempt)).
-   - The runner is limited to a role with the id `customrole_suitescript_verify`, which you create. Use your own id by setting `SUITESCRIPT_VERIFY_ROLE_ID`; do not rely on a fixed id, since a custom role's id may be read-only after saving.
+   - The runner is limited to a role with the id `customrole_suitescript_verify`, which you create. Use your own id by setting `SUITESCRIPT_VERIFY_ROLE_ID`; do not rely on a fixed id, since a custom role's id may be read-only after saving. The platform rejects a role id over 40 characters, `customrole_` included, so the id after the prefix is at most 29 characters; the package refuses a longer one before it reaches the sandbox.
    - Keep the role minimal (see [Probes](#probes)).
 6. **Save the settings.** `suitescript-verify passkey` generates the SuiteCloud passkey into `verification/.env.local`. `suitescript-verify env set NAME=value` saves any other key there (values are never printed; a different existing value is kept unless `--overwrite`). See [Settings](#settings) for the names.
-7. **Run `suitescript-verify doctor`** until every step passes. It checks the SuiteCloud CLI, account, sandbox, certificates, passkey and project files, says which failing steps are the maintainer's own, and exits 1 while any fails.
+7. **Run `suitescript-verify doctor`** until every step passes. It checks the SuiteCloud CLI, Java 17 or 21, the SuiteCloud SDK jar and login, account, sandbox, certificates, passkey and project files, says which failing steps are the maintainer's own, and exits 1 while any fails.
 8. **`suitescript-verify setup-ci`** (for a pipeline) registers the SDF credentials (auth id `suitescript-verify`) with your project's SuiteCloud CLI, passing the passkey through the environment, never an argument. On success it prints the `SUITESCRIPT_VERIFY_` names the pipeline must supply as its own secrets, never a value. It writes no file, no credential variable and no license variable. Accepting Oracle's license in the pipeline is yours.
 
+**Note:** projects on one machine that register the same SDF auth id (this package always uses `suitescript-verify`) share one stored credential entry. That is harmless while their certificate and passkey values match; when they differ, the later `setup-ci` replaces the earlier entry.
+
 **Note:** never put `SUITECLOUD_CI_PASSKEY` in your user-wide environment. It stops browser login in your other SuiteCloud projects. Keep the passkey in `.env.local`, where the package hands it to the CLI for its own child process only.
 
 Every command that reaches the sandbox refuses an account that is not a sandbox (`digits_SBn`).
 
+### Keeping the tooling in a subfolder
+
+A project that publishes its own package from the repository root may keep the tooling in a subfolder that is an npm project of its own, with its own `package.json` and `node_modules` holding `suitescript-verify` and `@oracle/suitecloud-cli`. The package treats the folder it runs in as the project, so run it from the subfolder and pass `--dir .`, which makes the subfolder itself the verification folder (its `.env`, `.env.local`, `probes` and `sdf`):
+
+```json
+{
+    "scripts": {
+        "verify:doctor": "suitescript-verify doctor --dir .",
+        "verify:run": "suitescript-verify run --dir ."
+    }
+}
+```
+
+A script at the repository root then calls it with `npm --prefix <subfolder> run verify:doctor --`. Give `init`, `deploy`, `cleanup` and the other commands the same `--dir .`. The subfolder's `.env.local` is checked against the repository's `.gitignore`.
+
 ## Deploy
 
 ```sh
@@ -131,8 +148,9 @@ suitescript-verify deploy --approved   # the real deploy: a person at a terminal
 suitescript-verify cleanup --approved  # turns the runner's deployment off: the person types CLEANUP
 ```
 
-`deploy` generates the runner and an SDF project into `verification/sdf` (the generated `src/` there is yours to gitignore) from the RESTlet probes in `verification/probes`, then dry-runs it through your project's SuiteCloud CLI. `cleanup` does the same with the deployment switched off, and without `--approved` it is a dry run. The runner's script id is `customscript_suitescript_verify_runner`.
+`deploy` generates the runner and an SDF project into `verification/sdf` (the generated `src/` there is yours to gitignore) from the RESTlet probes in `verification/probes`, then dry-runs it through your project's SuiteCloud CLI. `cleanup` does the same with the deployment switched off, and without `--approved` it is a dry run. The runner's script id is `customscript_suitescript_verify_runner` and its deployment id `customdeploy_suitescript_verify_runner`; both come from the runner id (`SUITESCRIPT_VERIFY_RUNNER_ID`, default `suitescript_verify`).
 
+- **Projects that share a sandbox need their own runner id.** A deploy replaces the runner's probe list, so two projects with the same runner id overwrite each other: whichever deployed last decides which probes exist, and the other's answer `unknown probe` until it deploys again. Set a different `SUITESCRIPT_VERIFY_RUNNER_ID` in each project's committed `.env` (for example `my_project`). The runner, its deployment and its File Cabinet folder are named from it (`customscript_my_project_runner`, `my-project`), while the projects can still share one role and token mapping. The id is at most 20 characters because the platform rejects a script or deployment id over 40 characters, prefix included (`The script ID must not exceed 40 characters.`): `customscript_` and `customdeploy_` take 13 and `_runner` takes 7. Changing a project's id leaves its old runner deployed in the sandbox, because the SuiteCloud CLI cannot delete a script. The next `deploy` or `cleanup` removes the old runner from the generated SDF folder (so it is not deployed again) and warns with the old id; to turn the old runner off, run `cleanup --approved` once with `SUITESCRIPT_VERIFY_RUNNER_ID` set to the old id, then switch back. The warning only sees runners generated in this folder.
 - **Every probe change needs a deploy.** The runner's probe list is generated into its dependency list, so a new, renamed or edited probe only exists in the sandbox after a deploy. Write and review **all** the probes of a batch first, dry-run once, and ask for one deploy. A deploy is the person's, in their own terminal, so a wasted one costs a person's time.
 - **After every deploy, run the chain-proving probe first** (a trivial probe, for example `probe-zero`, that only proves the runner loads). If it fails, the runner is broken and no other result means anything (see [Troubleshooting](#every-probe-returns-http-400-and-names-no-probe)).
 - **A sandbox refresh clears the token mappings and, presumably, the deployed runner.** After one, redo the role, mapping and deploy steps.
@@ -190,21 +208,22 @@ The package validates the tags in a probe's leading JSDoc block: `@scriptType`,
 
 Every setting is a `SUITESCRIPT_VERIFY_` key. They layer from the committed `verification/.env`, the gitignored `verification/.env.local` and the process environment, in that order. The committed file may hold only the keys marked "committed", and its values must not look like a secret. A bad value stops every command that reaches the sandbox, and the error names the key, never the value.
 
-| Key                                       | Where     | What it is                                                                                                                                                                 |
-| ----------------------------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `SUITESCRIPT_VERIFY_PROBES_DIR`           | committed | Folder of probes (a path in the project)                                                                                                                                   |
-| `SUITESCRIPT_VERIFY_RESULTS_DIR`          | committed | Folder of results pages (a path in the project). No default: you choose                                                                                                    |
-| `SUITESCRIPT_VERIFY_SDF_DIR`              | committed | Folder for the generated SDF project (a path in the project)                                                                                                               |
-| `SUITESCRIPT_VERIFY_ROLE_ID`              | committed | The runner's role id, matching `^customrole_[a-z0-9_]+$`; default `customrole_suitescript_verify`. Used in the generated manifest and the runner, and reported by `doctor` |
-| `SUITESCRIPT_VERIFY_EXTRA_TAGS`           | committed | Extra probe tag names, comma-separated, without the `@`                                                                                                                    |
-| `SUITESCRIPT_VERIFY_ACCOUNT`              | local     | The sandbox account (`digits_SBn`)                                                                                                                                         |
-| `SUITESCRIPT_VERIFY_CLIENT_ID`            | local     | The integration's client id                                                                                                                                                |
-| `SUITESCRIPT_VERIFY_CERTIFICATE_ID`       | local     | Certificate id of the runner pair                                                                                                                                          |
-| `SUITESCRIPT_VERIFY_PRIVATE_KEY_PATH`     | local     | Path to the runner pair's private key (outside the project)                                                                                                                |
-| `SUITESCRIPT_VERIFY_SDF_CERTIFICATE_ID`   | local     | Certificate id of the SDF pair                                                                                                                                             |
-| `SUITESCRIPT_VERIFY_SDF_PRIVATE_KEY_PATH` | local     | Path to the SDF pair's private key (outside the project)                                                                                                                   |
-| `SUITESCRIPT_VERIFY_PASSKEY`              | local     | The SuiteCloud passkey, saved by `passkey`                                                                                                                                 |
-| `SUITESCRIPT_VERIFY_DOMAIN`               | local     | Optional NetSuite domain passed to the SuiteCloud CLI                                                                                                                      |
+| Key                                       | Where     | What it is                                                                                                                                                                                                                                                                          |
+| ----------------------------------------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `SUITESCRIPT_VERIFY_PROBES_DIR`           | committed | Folder of probes (a path in the project)                                                                                                                                                                                                                                            |
+| `SUITESCRIPT_VERIFY_RESULTS_DIR`          | committed | Folder of results pages (a path in the project). No default: you choose                                                                                                                                                                                                             |
+| `SUITESCRIPT_VERIFY_SDF_DIR`              | committed | Folder for the generated SDF project (a path in the project)                                                                                                                                                                                                                        |
+| `SUITESCRIPT_VERIFY_ROLE_ID`              | committed | The runner's role id, matching `^customrole_[a-z0-9_]{1,29}$` (40 characters at most in all); default `customrole_suitescript_verify`. Used in the generated manifest and the runner, and reported by `doctor`                                                                      |
+| `SUITESCRIPT_VERIFY_RUNNER_ID`            | committed | The runner's name: 1 to 20 lowercase letters, digits and underscores, starting with a letter; default `suitescript_verify`. Names the script (`customscript_<id>_runner`), the deployment and the File Cabinet folder, so projects sharing a sandbox can each have their own runner |
+| `SUITESCRIPT_VERIFY_EXTRA_TAGS`           | committed | Extra probe tag names, comma-separated, without the `@`                                                                                                                                                                                                                             |
+| `SUITESCRIPT_VERIFY_ACCOUNT`              | local     | The sandbox account (`digits_SBn`)                                                                                                                                                                                                                                                  |
+| `SUITESCRIPT_VERIFY_CLIENT_ID`            | local     | The integration's client id                                                                                                                                                                                                                                                         |
+| `SUITESCRIPT_VERIFY_CERTIFICATE_ID`       | local     | Certificate id of the runner pair                                                                                                                                                                                                                                                   |
+| `SUITESCRIPT_VERIFY_PRIVATE_KEY_PATH`     | local     | Path to the runner pair's private key (outside the project)                                                                                                                                                                                                                         |
+| `SUITESCRIPT_VERIFY_SDF_CERTIFICATE_ID`   | local     | Certificate id of the SDF pair                                                                                                                                                                                                                                                      |
+| `SUITESCRIPT_VERIFY_SDF_PRIVATE_KEY_PATH` | local     | Path to the SDF pair's private key (outside the project)                                                                                                                                                                                                                            |
+| `SUITESCRIPT_VERIFY_PASSKEY`              | local     | The SuiteCloud passkey, saved by `passkey`                                                                                                                                                                                                                                          |
+| `SUITESCRIPT_VERIFY_DOMAIN`               | local     | Optional NetSuite domain passed to the SuiteCloud CLI                                                                                                                                                                                                                               |
 
 "Local" keys go in `.env.local` or the process environment (a pipeline's secrets), never in the committed file.
 

package/dist/cli.js

@@ -1,7 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { createInterface } from "node:readline/promises";
 import { certificate } from "./certificate.js";
-import { loadConfig, resultsDirGuidance, resultsDirKey, suggestedResultsDir, } from "./config.js";
+import { loadConfig, resultsDirGuidance, resultsDirKey, runnerIdKey, suggestedResultsDir, } from "./config.js";
 import { formatChecks, names, runChecks } from "./doctor.js";
 import { envNames } from "./envfile.js";
 import { init } from "./init.js";
@@ -73,15 +73,23 @@ async function initCommand(args) {
     console.log(init(process.cwd(), config, await chooseResultsDir(config, args)));
     return 0;
 }
+/**
+ * Generates the runner and its SDF project. A runner generated here under
+ * another id may still be deployed (the SuiteCloud CLI cannot delete a script),
+ * so say how to turn it off.
+ */
+function buildRunner(config, deployed) {
+    const built = buildSdfProject(config, { deployed });
+    for (const id of built.replacedRunners) {
+        console.warn(`This folder held a runner for the id "${id}", which may still be deployed in the sandbox. To turn it off, run cleanup with ${runnerIdKey}=${id}, then switch back.`);
+    }
+    return built;
+}
 async function deploy(args) {
     const project = process.cwd();
     const config = configure(args, true);
     requireSandbox(config);
-    const { files, slugs } = buildSdfProject(config.sdfDir, config.probesDir, {
-        deployed: true,
-        extraTags: config.extraTags,
-        roleId: config.roleId,
-    });
+    const { files, slugs } = buildRunner(config, true);
     console.log(`Probes in the runner: ${slugs.join(", ") || "(none)"}`);
     console.log(`Files to upload: ${files.join(", ")}`);
     const approved = args.includes("--approved");
@@ -106,11 +114,7 @@ async function cleanup(args) {
     else {
         console.log("Dry run only. This turns the runner's deployment off in the sandbox, so ask the user for approval, then rerun with --approved.\nTo remove access entirely, the user revokes the certificate mapping (Setup > Integration > Manage Authentication > OAuth 2.0 Client Credentials (M2M) Setup).");
     }
-    buildSdfProject(config.sdfDir, config.probesDir, {
-        deployed: false,
-        extraTags: config.extraTags,
-        roleId: config.roleId,
-    });
+    buildRunner(config, false);
     return suitecloud(project, config, [
         "project:deploy",
         ...(approved ? [] : ["--dryrun"]),

package/dist/config.js

@@ -15,10 +15,27 @@ export const suggestedResultsDir = "docs/verification/results";
 export const resultsDirGuidance = `Choose where results pages live in your project, then run suitescript-verify init --results-dir <path> (${suggestedResultsDir} is the suggested value) or set ${resultsDirKey} in the committed .env.`;
 /** The committed `.env` may also register extra probe tags: a comma-separated list of tag names, not a path. */
 export const extraTagsKey = "SUITESCRIPT_VERIFY_EXTRA_TAGS";
-/** The committed `.env` may also name the runner role: a NetSuite custom role id. */
+/** The committed `.env` may name the runner role: a NetSuite custom role id. */
 export const roleIdKey = "SUITESCRIPT_VERIFY_ROLE_ID";
 export const defaultRoleId = "customrole_suitescript_verify";
-const roleIdPattern = /^customrole_[a-z0-9_]+$/;
+const roleSetting = {
+    // `customrole_` is 11 characters, so 29 more make 40.
+    expects: "a NetSuite custom role id like customrole_suitescript_verify (lowercase letters, digits and underscores after customrole_, 40 characters at most in all)",
+    fallback: defaultRoleId,
+    key: roleIdKey,
+    pattern: /^customrole_[a-z0-9_]{1,29}$/,
+};
+/** The committed `.env` may name the runner: a short stem for its script id, deployment id and File Cabinet folder. */
+export const runnerIdKey = "SUITESCRIPT_VERIFY_RUNNER_ID";
+export const defaultRunnerId = "suitescript_verify";
+const runnerSetting = {
+    // `customscript_` and `customdeploy_` are 13 characters and `_runner` is 7, so 20 more make 40.
+    expects: "a runner id like my_project (a lowercase letter, then lowercase letters, digits and underscores, 20 characters at most)",
+    fallback: defaultRunnerId,
+    key: runnerIdKey,
+    pattern: /^[a-z][a-z0-9_]{0,19}$/,
+};
+const idSettings = [roleSetting, runnerSetting];
 const tagName = /^[A-Za-z][A-Za-z0-9_-]*$/;
 /** The tag names in a registration value, without the `@`; blank entries are dropped. */
 export const parseTagList = (value) => value
@@ -58,17 +75,19 @@ export const insideProject = (project, path) => {
 const looksSecret = (value) => /-----BEGIN /.test(value) ||
     /^eyJ[\w-]+\.[\w-]+\.[\w-]+$/.test(value) ||
     /^[A-Za-z0-9+_=-]{32,}$/.test(value);
-const roleIdProblem = (file) => ({
-    message: `${roleIdKey} in ${file} is not a NetSuite custom role id like customrole_suitescript_verify (lowercase letters, digits and underscores after customrole_).`,
+const idProblem = (setting, file) => ({
+    message: `${setting.key} in ${file} is not ${setting.expects}.`,
 });
 /** Checks the committed `.env` against the allowlist. Messages name the key, never the value. */
 function checkCommitted(project, committed, file) {
     const problems = [];
     for (const [key, value] of committed) {
-        if (key === roleIdKey) {
+        const idSetting = idSettings.find((setting) => setting.key === key);
+        if (idSetting) {
             // The pattern is the whole check: a valid id may be long enough to look like a token.
-            if (!roleIdPattern.test(value))
-                problems.push(roleIdProblem(file));
+            if (!idSetting.pattern.test(value)) {
+                problems.push(idProblem(idSetting, file));
+            }
         }
         else if (key === extraTagsKey) {
             if (!parseTagList(value).every((name) => tagName.test(name))) {
@@ -84,7 +103,7 @@ function checkCommitted(project, committed, file) {
         }
         else if (!layoutKeys.includes(key)) {
             problems.push({
-                message: `${key} in ${file} is not a layout key. The committed file holds layout only (${[...layoutKeys, extraTagsKey, roleIdKey].join(", ")}); put anything else in .env.local or the process environment.`,
+                message: `${key} in ${file} is not a layout key. The committed file holds layout only (${[...layoutKeys, extraTagsKey, ...idSettings.map((setting) => setting.key)].join(", ")}); put anything else in .env.local or the process environment.`,
             });
         }
         else if (!insideProject(project, value)) {
@@ -142,13 +161,15 @@ export function loadConfig(project, dir, processEnv = process.env) {
         }
     }
     const path = (key, fallback) => resolve(project, values[key] || fallback);
-    const roleId = values[roleIdKey] || defaultRoleId;
+    const idValue = (setting) => values[setting.key] || setting.fallback;
     // The committed file reports its own bad value; this covers .env.local and the environment.
-    const committedRole = committed.get(roleIdKey);
-    const roleProblems = roleIdPattern.test(roleId) ||
-        (committedRole !== undefined && !roleIdPattern.test(committedRole))
-        ? []
-        : [roleIdProblem(".env.local or the environment")];
+    const idProblems = idSettings.flatMap((setting) => {
+        const committedValue = committed.get(setting.key);
+        return setting.pattern.test(idValue(setting)) ||
+            (committedValue !== undefined && !setting.pattern.test(committedValue))
+            ? []
+            : [idProblem(setting, ".env.local or the environment")];
+    });
     const shown = relative(project, envFile).replaceAll("\\", "/");
     return {
         extraTags: parseTagList(values[extraTagsKey] ?? ""),
@@ -156,13 +177,14 @@ export function loadConfig(project, dir, processEnv = process.env) {
         problems: [
             ...checkCommitted(project, committed, shown),
             ...checkLocalIgnored(project, localFile),
-            ...roleProblems,
+            ...idProblems,
         ],
         resultsDir: values[resultsDirKey]
             ? resolve(project, values[resultsDirKey])
             : undefined,
-        roleId,
+        roleId: idValue(roleSetting),
         root,
+        runnerId: idValue(runnerSetting),
         sdfDir: path("SUITESCRIPT_VERIFY_SDF_DIR", join(root, "sdf")),
         values,
     };

package/dist/doctor.js

@@ -1,5 +1,7 @@
+import { spawnSync } from "node:child_process";
 import { createPrivateKey } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { join } from "node:path";
 import { insideProject, resultsDirGuidance, resultsDirKey, } from "./config.js";
 export const names = {
@@ -11,6 +13,33 @@ export const names = {
     sdfCertificateId: "SUITESCRIPT_VERIFY_SDF_CERTIFICATE_ID",
     sdfPrivateKeyPath: "SUITESCRIPT_VERIFY_SDF_PRIVATE_KEY_PATH",
 };
+/**
+ * The Java versions Oracle's SDK runs on: the SuiteCloud CLI's own
+ * `SDK_COMPATIBLE_JAVA_VERSIONS`, which refuses to run on any other.
+ */
+const javaVersions = ["17", "21"];
+/** Where Oracle's SDK keeps its jar (`cli/`) and its saved logins, under the home folder. */
+const sdkFolder = ".suitecloud-sdk";
+const loginFiles = ["credentials_browser_based.p12", "credentials_ci.p12"];
+/** The installed Java's version, read the way the SuiteCloud CLI reads it (`java -version`, no shell); empty when there is none. */
+function installedJavaVersion() {
+    const result = spawnSync("java", ["-version"], {
+        encoding: "utf8",
+        shell: false,
+    });
+    const match = /(?:\bjava version\b|\bopenjdk version\b) "([\d.]+)"/.exec(result.stderr ?? "");
+    return match?.[1] ?? "";
+}
+/** The SDK jar the installed SuiteCloud CLI downloads, from its package.json; empty when unknown. */
+function sdkFilename(project) {
+    try {
+        const manifest = JSON.parse(readFileSync(join(project, "node_modules", "@oracle", "suitecloud-cli", "package.json"), "utf8"));
+        return manifest.sdkFilename ?? "";
+    }
+    catch {
+        return "";
+    }
+}
 /** `ec:<curve>`, `rsa:<bits>` or `other`, from a private key file. Never the key itself. */
 function keyType(path) {
     try {
@@ -34,6 +63,14 @@ export function runChecks(project, config, env = process.env) {
     const add = (name, ok, owner, next) => checks.push({ name, next, ok, owner });
     const v = config.values;
     add("SuiteCloud CLI (@oracle/suitecloud-cli) is installed in the project", existsSync(join(project, "node_modules", "@oracle", "suitecloud-cli", "src", "suitecloud.js")), "maintainer", "Run npm install --save-dev @oracle/suitecloud-cli, read Oracle's license and accept it yourself. This package never accepts it.");
+    const javaVersion = installedJavaVersion();
+    add(`Java ${javaVersions.join(" or ")} is on the PATH`, 
+    // The major version: "17.0.4" is Java 17, but "170.0.1" is not.
+    javaVersions.includes(javaVersion.split(".")[0] ?? ""), "maintainer", `Install Java ${javaVersions.join(" or ")} and make sure \`java -version\` works: the SuiteCloud SDK runs on no other version.`);
+    const sdkRoot = join(homedir(), sdkFolder);
+    const jarName = sdkFilename(project);
+    add("The SuiteCloud SDK jar is downloaded", jarName !== "" && existsSync(join(sdkRoot, "cli", jarName)), "maintainer", "Run the SuiteCloud CLI's postinstall script in your project (node node_modules/@oracle/suitecloud-cli/postinstall.js) and read and accept Oracle's license yourself when it asks. This package never accepts it. A headless machine needs a desktop install, or the maintainer to accept the license first.");
+    add("SuiteCloud login is set up (browser-based once, or CI)", loginFiles.some((file) => existsSync(join(sdkRoot, file))), "maintainer", "With SUITECLOUD_CI_PASSKEY unset, run the project's SuiteCloud CLI account:setup from the SDF folder, log in to the sandbox and choose a role. This one-time browser login installs Oracle's SuiteCloud Development Integration in the account.");
     const missing = [
         names.account,
         names.clientId,
@@ -84,6 +121,7 @@ export function runChecks(project, config, env = process.env) {
         ? "Run suitescript-verify init to create the missing folders."
         : "Run account:setup:ci from the SDF folder once the steps above pass, so project.json gets a default auth id.");
     add(`Runner role id: ${config.roleId}`, true, "agent", "");
+    add(`Runner id: ${config.runnerId}`, true, "agent", "");
     return checks;
 }
 export function formatChecks(checks) {

package/dist/netsuite.js

@@ -1,10 +1,23 @@
 import { createPrivateKey, sign } from "node:crypto";
-export const runnerScriptId = "customscript_suitescript_verify_runner";
-export const runnerDeployId = "customdeploy_suitescript_verify_runner";
-export const fileCabinetFolder = "suitescript-verify";
+import { defaultRunnerId } from "./config.js";
+/** The names a runner takes from its id: the script, the deployment, the File Cabinet folder and the title shown in the account. */
+export const runnerNames = (runnerId) => ({
+    deployId: `customdeploy_${runnerId}_runner`,
+    folder: runnerId.replaceAll("_", "-"),
+    scriptId: `customscript_${runnerId}_runner`,
+    // A runner of another id says so, so two runners in one account can be told apart.
+    title: runnerId === defaultRunnerId
+        ? "suitescript-verify runner"
+        : `suitescript-verify runner (${runnerId})`,
+});
+/** The id of the runner that wrote an object file, from its name; undefined for any other file. */
+export const runnerIdOfObjectFile = (file) => /^customscript_([a-z0-9_]+)_runner.xml$/.exec(file)?.[1];
 const host = (account) => account.trim().toLowerCase().replace(/_/g, "-");
 export const tokenUrl = (account) => `https://${host(account)}.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token`;
-export const restletUrl = (account) => `https://${host(account)}.restlets.api.netsuite.com/app/site/hosting/restlet.nl?script=${runnerScriptId}&deploy=${runnerDeployId}`;
+export const restletUrl = (account, runnerId) => {
+    const { deployId, scriptId } = runnerNames(runnerId);
+    return `https://${host(account)}.restlets.api.netsuite.com/app/site/hosting/restlet.nl?script=${scriptId}&deploy=${deployId}`;
+};
 const base64url = (data) => Buffer.from(data).toString("base64url");
 /** The signed JWT NetSuite's OAuth 2.0 client credentials flow expects: ES256 with an EC P-256 key. */
 export function clientAssertion(options) {

package/dist/run.js

@@ -115,7 +115,7 @@ export async function runProbe(project, config, args) {
         if (!tokenResponse.ok || !tokenBody.access_token) {
             throw new UsageError(safe(`Token request failed: HTTP ${tokenResponse.status} ${tokenBody.error ?? ""} ${tokenBody.error_description ?? ""}`.trim()));
         }
-        const response = await fetch(restletUrl(creds.account), {
+        const response = await fetch(restletUrl(creds.account, config.runnerId), {
             body: JSON.stringify(probe.params.length > 0
                 ? { params, probe: probe.slug }
                 : { probe: probe.slug }),

package/dist/sdf.js

@@ -1,7 +1,6 @@
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
-import { defaultRoleId } from "./config.js";
-import { fileCabinetFolder } from "./netsuite.js";
+import { runnerIdOfObjectFile, runnerNames } from "./netsuite.js";
 import { isRestlet, listProbes, read, tagProblems, } from "./probes.js";
 import { UsageError } from "./shared.js";
 const templates = new URL("../templates/", import.meta.url);
@@ -23,9 +22,11 @@ export function generateRunner(probes, source) {
 /**
  * Writes the generated runner, the probe copies and the SDF project files into
  * the SDF folder. Only RESTlet probes go in: the runner is a RESTlet. With
- * `deployed: false` the runner's deployment is switched off (cleanup).
+ * `deployed: false` the runner's deployment is switched off (cleanup). A runner
+ * generated here under another id is removed so it is not deployed again;
+ * `replacedRunners` names those ids, since each may still be deployed in the sandbox.
  */
-export function buildSdfProject(sdfDir, probesDir, { deployed, extraTags = [], roleId = defaultRoleId, }) {
+export function buildSdfProject({ extraTags, probesDir, roleId, runnerId, sdfDir, }, { deployed }) {
     const probes = listProbes(probesDir, extraTags).filter(isRestlet);
     const bad = probes.filter((probe) => tagProblems(probe).length > 0);
     if (bad.length > 0) {
@@ -34,15 +35,28 @@ export function buildSdfProject(sdfDir, probesDir, { deployed, extraTags = [], r
             .join("\n")}`);
     }
     const src = join(sdfDir, "src");
-    const folder = join(src, "FileCabinet", "SuiteScripts", fileCabinetFolder);
+    const names = runnerNames(runnerId);
+    const folder = join(src, "FileCabinet", "SuiteScripts", names.folder);
     rmSync(join(src, "FileCabinet"), { force: true, recursive: true });
     mkdirSync(join(folder, "probes"), { recursive: true });
     mkdirSync(join(src, "Objects"), { recursive: true });
+    const replacedRunners = [];
+    for (const file of readdirSync(join(src, "Objects"))) {
+        const id = runnerIdOfObjectFile(file);
+        if (id !== undefined && id !== runnerId) {
+            rmSync(join(src, "Objects", file));
+            replacedRunners.push(id);
+        }
+    }
     writeFileSync(join(sdfDir, "package.json"), template("sdf/package.json"));
     writeFileSync(join(sdfDir, "suitecloud.config.js"), template("sdf/suitecloud.config.js"));
     writeFileSync(join(src, "manifest.xml"), template("sdf/manifest.xml").replaceAll("%%ROLE_ID%%", roleId));
-    writeFileSync(join(src, "deploy.xml"), template("sdf/deploy.xml"));
-    writeFileSync(join(src, "Objects", "customscript_suitescript_verify_runner.xml"), template("sdf/runner.xml")
+    writeFileSync(join(src, "deploy.xml"), template("sdf/deploy.xml").replaceAll("%%FOLDER%%", names.folder));
+    writeFileSync(join(src, "Objects", `${names.scriptId}.xml`), template("sdf/runner.xml")
+        .replaceAll("%%SCRIPT_ID%%", names.scriptId)
+        .replaceAll("%%DEPLOY_ID%%", names.deployId)
+        .replaceAll("%%FOLDER%%", names.folder)
+        .replaceAll("%%TITLE%%", names.title)
         .replace("%%DEPLOYED%%", deployed ? "T" : "F")
         .replaceAll("%%ROLE_ID%%", roleId));
     const slugs = probes.map((probe) => probe.slug);
@@ -52,5 +66,5 @@ export function buildSdfProject(sdfDir, probesDir, { deployed, extraTags = [], r
         writeFileSync(join(folder, "probes", `${slug}.js`), read(join(probesDir, `${slug}.js`)));
         files.push(`probes/${slug}.js`);
     }
-    return { files, slugs };
+    return { files, replacedRunners, slugs };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "suitescript-verify",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Run probes in a NetSuite sandbox to verify what SuiteScript modules do, with guardrails for agents.",
   "keywords": [
     "suitescript",

package/templates/sdf/deploy.xml

@@ -1,6 +1,6 @@
 <deploy>
   <files>
-    <path>~/FileCabinet/SuiteScripts/suitescript-verify/*</path>
+    <path>~/FileCabinet/SuiteScripts/%%FOLDER%%/*</path>
   </files>
   <objects>
     <path>~/Objects/*</path>

package/templates/sdf/runner.xml

@@ -1,17 +1,17 @@
-<restlet scriptid="customscript_suitescript_verify_runner">
+<restlet scriptid="%%SCRIPT_ID%%">
   <description>Runs one version-controlled probe by name in a sandbox. Source: the project's verification folder, through suitescript-verify.</description>
   <isinactive>F</isinactive>
-  <name>suitescript-verify runner</name>
+  <name>%%TITLE%%</name>
   <notifyowner>F</notifyowner>
-  <scriptfile>[/SuiteScripts/suitescript-verify/runner.js]</scriptfile>
+  <scriptfile>[/SuiteScripts/%%FOLDER%%/runner.js]</scriptfile>
   <scriptdeployments>
-    <scriptdeployment scriptid="customdeploy_suitescript_verify_runner">
+    <scriptdeployment scriptid="%%DEPLOY_ID%%">
       <allroles>F</allroles>
       <audslctrole>[%%ROLE_ID%%]</audslctrole>
       <isdeployed>%%DEPLOYED%%</isdeployed>
       <loglevel>DEBUG</loglevel>
       <status>RELEASED</status>
-      <title>suitescript-verify runner</title>
+      <title>%%TITLE%%</title>
     </scriptdeployment>
   </scriptdeployments>
 </restlet>