NetSuite SuiteCloud

View saved version →

---
name: netsuite-owasp-secure-coding
description: Platform-agnostic OWASP secure coding practices with JavaScript/Node.js patterns and NetSuite SuiteScript examples. Covers Open Worldwide Application Security Project (OWASP) Top 10 (2021), output encoding, injection prevention, CSP headers, file security, API hardening, AI agent security, DRY security patterns, and 48+ security pitfalls with GOOD/BAD code templates.
license: The Universal Permissive License (UPL), Version 1.0
metadata:
  author: Oracle NetSuite
  version: "1.0"
---

# OWASP Secure Coding Practices

## 1. Description

This skill provides **implementation-depth OWASP secure coding coverage** for JavaScript
and SuiteScript 2.1 development. It is the primary security reference for writing,
reviewing, and auditing code.

**What This Skill Covers:**

- Complete OWASP Top 10 (2021) mapping with code-level mitigation patterns
- 48 cataloged security pitfalls (OSCP-001 through OSCP-048) with BAD/GOOD code examples
- Platform-agnostic JavaScript security patterns applicable beyond NetSuite
- SuiteScript-specific security patterns for RESTlets, Suitelets, Client Scripts, and more
- Output encoding for five HTML contexts (body, attribute, JavaScript, URL, CSS)
- CSP header construction and deployment
- File upload/download validation pipelines
- API and RESTlet hardening patterns
- AI agent security considerations for tool-assisted development
- DRY security architecture: shared validation modules, centralized encoding, single-source configs
- A mandatory security review checklist for every code review

**Relationship to Existing Security Content:**

If available, the `netsuite-sdf-leading-practices` skill contains two security-related principles from
the SAFE Guide:

- **Principle 5 (`05-security-privacy.md`)** -- Owns NetSuite-specific security topics:
  roles and permissions, token-based authentication (TBA), N/crypto module usage, PCI-DSS awareness,
  credential storage via script parameters, and SuiteCloud platform security features.
- **Principle 11 (`11-security-best-practices.md`)** -- Owns OWASP awareness-level
  guidance: the core security principles list, a high-level OWASP Top 10 overview,
  basic input sanitization patterns, and parameterized query awareness.

**This skill** (`netsuite-owasp-secure-coding`) provides everything below the awareness
level: full implementation depth, exhaustive code patterns, all 48 pitfalls, context-specific
encoding, CSP templates, file security, API hardening, client-side defenses, logging safety,
and AI agent threat mitigation. It references Principles 5 and 11 where appropriate rather
than duplicating their NetSuite-specific content.

---

## 2. How to Use

### Invocation

Use this skill whenever you need a security review, threat analysis, or implementation
guidance for SuiteScript or JavaScript security concerns.

If your client supports explicit skill activation by name, activate
`netsuite-owasp-secure-coding` and request the topic you need.

### Auto-Activation Triggers

This skill auto-activates when the agent detects security-relevant context in the
conversation. See Section 3 for the complete trigger list.

### Reference Files

All deep-dive content is in the local `references/` directory. The skill loads the
appropriate reference files based on the detected security topic. You can also request a
specific reference directly:

```
Review this RESTlet for security issues.
Load the injection prevention reference.
Load the CSP header templates appendix.
```

---

## 3. When to Use

### Keyword Triggers

The skill activates when any of the following keywords or phrases appear in the
conversation or code context:

**Injection and Input:**
`injection`, `sanitize`, `sanitise`, `validate input`, `SQL concatenation`,
`string concatenation query`, `parameterized`, `prepared statement`, `user input`

**XSS and Output:**
`XSS`, `cross-site scripting`, `encode`, `output encoding`, `innerHTML`,
`textContent`, `dangerouslySetInnerH

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 15 — file references are metadata, not package contents.

View saved version →

---
name: netsuite-sdf-project-documentation
description: Generate enterprise-grade documentation for NetSuite SDF projects. Analyze scripts, object XML files, `manifest.xml`, and SuiteQL queries to produce README.md, architecture diagrams (Mermaid/ASCII), deployment guides, and troubleshooting tables. Can integrate with post-deployment documentation workflows when automation (for example, hooks) is available.
license: The Universal Permissive License (UPL), Version 1.0
metadata:
  author: Oracle NetSuite
  version: "1.0"
---

# NetSuite SDF Documentation Generator Skill

**Created by:** Oracle NetSuite

## Description
Generate comprehensive, enterprise-grade documentation for NetSuite SuiteCloud Development Framework (SDF) projects. This skill provides:

- **Full Project Analysis**: Scans all scripts, object XML files, and manifest.xml.
- **Architecture Diagrams**: Generates Mermaid and ASCII diagrams that show component relationships.
- **Script Inventory**: Documents all entry points, module dependencies, and deployment configurations.
- **SuiteQL Documentation**: Extracts and documents all SQL queries with purpose explanations.
- **Deployment Tables**: Summarizes script deployments, URLs, and triggers.
- **Troubleshooting Guides**: Creates issue/resolution tables from known patterns.
- **Multiple Output Formats**: Produces `README.md`, `ARCHITECTURE.md`, `API.md`, and `CHANGELOG.md` files.

## Skill Activation

This skill activates when:
- User asks to document a NetSuite project.
- User asks for README generation.
- User asks to regenerate documentation after project changes.
- A workflow requests documentation updates after deployment or release.

## Documentation Standards

### Quality Requirements

1. **Accuracy**: Every statement must be derived from actual code analysis.
2. **Completeness**: Cover all scripts, objects, and integrations.
3. **Clarity**: Write for both technical and business audiences.
4. **Maintainability**: Use consistent formatting that's easy to update.

### Writing Style

- Use active voice.
- Be specific.
- Include code examples where helpful.
- Use tables for structured data.
- Use Mermaid or ASCII diagrams for architecture.

## Security & Safety Requirements

- Global safety guardrails are defined in `## SafeWords`.
- Perform static documentation analysis only; do not execute repository-derived commands or scripts

### Sensitive Data Handling

- Keep documentation detailed by default, including URLs, script IDs, deployment IDs, role/deployment metadata, and full SQL.
- For SQL, preserve full query structure (tables, joins, filters, and aliases) and redact only sensitive literals

### Public Sharing Note

- If documentation is intended for external/public sharing, apply stricter redaction before publishing
- Review internal endpoints, tenant/account-specific identifiers, and environment-specific values for additional masking as needed

---

## Analysis Checklist

Before generating documentation, gather all required information and redact only true sensitive data:

### Project Metadata
- [ ] SuiteApp ID (from `manifest.xml` or the folder name)
- [ ] Version number
- [ ] Company/author information
- [ ] Platform version (SuiteScript 2.0 or 2.1)

### Script Inventory
For each `.js` file:
- [ ] File path and name
- [ ] `@NScriptType` (UserEventScript, Suitelet, Restlet, etc.)
- [ ] `@NApiVersion`
- [ ] `@NModuleScope`
- [ ] `@description` or header comments
- [ ] Entry point functions
- [ ] Module dependencies (from the define block)

### Object Inventory
For each `.xml` file:
- [ ] Object type (script, record, field, etc.)
- [ ] Script ID
- [ ] Name/label
- [ ] Deployment configuration
- [ ] Role permissions

### Data Integration
- [ ] Saved search IDs referenced
- [ ] SuiteQL queries (keep full SQL by default; redact only sensitive literals)
- [ ] External API integrations
- [ ] `N/llm` usage
- [ ] Custom records/fields used

### Architecture
- [ ] Component relationships
- [ ] Data flow direction

Preview of the first 4,000 characters. Read full instructions →

View saved version →

---
name: netsuite-sdf-roles-and-permissions
description: Use when generating or reviewing NetSuite SDF permission configurations such as customrole XML, script deployment permissions, permkey values, permlevel choices, run-as role design, and least-privilege access. Confirms exact ADMI_ / LIST_ / REGT_ / REPO_ / TRAN_ permission IDs, distinguishes standard permissions from customrecord_* script IDs, and validates permissions against bundled NetSuite reference data.
license: The Universal Permissive License (UPL), Version 1.0
metadata:
  author: Oracle NetSuite
  version: "1.0"
---

# NetSuite Permissions Reference

Use this skill to resolve NetSuite permission questions with exact `permkey` and `permlevel` values.

## Use This Skill When

- Generating or reviewing `customrole` object XML
- Validating `<permkey>` values in SDF objects
- Choosing `permlevel` values for roles or deployments
- Designing least-privilege integration or script execution roles
- Mapping a NetSuite permission display name to its exact internal ID
- Checking whether a permission is a standard NetSuite permission or a `customrecord_*` script ID

## Primary References

- `references/permissions.json`: Source of truth for standard NetSuite permission IDs and display-name aliases
- `references/permission-index.md`: Human-readable index by category, use case, and module

Read `references/permissions.json` whenever you need to confirm an exact ID. Use `references/permission-index.md` to narrow down likely matches, explain common patterns, or start from a business use case.

## Workflow

1. Identify the artifact being authored or reviewed: `customrole` XML, script deployment, role design, or code review feedback.
2. Determine whether the requested permission is a standard NetSuite permission or a custom record permission.
3. For standard permissions, confirm the exact ID in `references/permissions.json`.
4. Recommend the minimum `permlevel` that satisfies the use case.
5. Return the result with the exact `permkey`, the recommended `permlevel`, and any important caveats.

## Decision Rules

### 1. Standard Permissions

Use `references/permissions.json` as the source of truth for standard permissions with these prefixes:

- `ADMI_`
- `LIST_`
- `REGT_`
- `REPO_`
- `TRAN_`

Always return the exact `id`. Do not invent or abbreviate IDs.

### 2. Custom Record Permissions

If the permission is for a custom record type, the `permkey` is the custom record script ID, such as `customrecord_invoice_batch`. Do not look for custom record permissions in `references/permissions.json`; validate them against the project's custom record XML instead.

### 3. Display-Name Aliases

Some NetSuite UI labels map to the same underlying permission ID. When aliases exist, prefer the exact ID from `references/permissions.json` and mention the display name only as a human-readable explanation.

### 4. Permission Levels

Use the smallest level that satisfies the behavior:

- `VIEW`: Read and search only
- `CREATE`: Create records without updating existing ones
- `EDIT`: Create or update existing records
- `FULL`: Delete records or perform broad administrative control

Default to least privilege. Treat `FULL` as exceptional and justify it explicitly.

### 5. Run-as Role Guidance

If the request involves a script execution role, you MUST NOT recommend the built-in Administrator role for production use. Prefer a dedicated role with only the permissions the script needs. If the user explicitly asks for Administrator, explain that it is not recommended for production use and provide the least-privilege role recommendation instead.

## Review Checklist

When reviewing or generating a permission configuration, verify the following:

- Every standard `permkey` exists exactly in `references/permissions.json`.
- Every `customrecord_*` `permkey` matches an actual project script ID.
- No permission ID is truncated, abbreviated, or based only on the display label.
- `permlevel` is one of `VIEW`, `CREAT

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 2 — file references are metadata, not package contents.

View saved version →

---
name: netsuite-sdf-safe-guide
description: Comprehensive NetSuite SDF best practices based on the SAFE Guide (12 principles + appendices). Generates Object XML for all 14 script types, enforces governance limits, security patterns, and defensive coding. Includes N/cache, N/query, concurrency limits, OAuth 2.0 guidance, legacy TBA guardrails, CustomTool runtime patterns, REST Web Services (2026.1 features), and 140+ documented pitfalls. Essential for SuiteApp and Account Customization development.
license: The Universal Permissive License (UPL), Version 1.0
metadata:
  author: Oracle NetSuite
  version: "1.0"
---

# NetSuite SDF Safe Guide

## Description
Comprehensive guide for NetSuite SuiteCloud Development Framework (SDF) projects, incorporating the **SAFE Guide** (SuiteApp Architecture Framework for Excellence) principles. This skill provides:

- **SAFE Guide Integration**: 12 principles covering features, governance, performance, multi-SuiteApp environments, security, testing, distribution, maintenance, licensing, open-source compliance, secure coding, and UIF SPA best practices
- **Object XML Generation**: Automatically creates deployment XML files for all 14 SuiteScript types
- **Best Practices Enforcement**: Ensures correct deployment configurations, permissions, and status values
- **Common Pitfalls Documentation**: 140+ documented pitfalls with solutions learned from real deployments
- **Performance Guidance**: N/cache patterns, N/query with SuiteQL, avoiding N+1 queries, batch operations, Map/Reduce optimization
- **Architecture Patterns**: Suitelet-as-API pattern, popup communication with postMessage, module-level initialization
- **Defensive Coding**: Patterns for scripts to coexist with other scripts, workflows, and SuiteApps
- **Governance & Limits**: Usage unit limits by script type, concurrency limits, API costs, time limits
- **Security**: OWASP principles, input validation, secure coding practices
- **Appendices**: Concurrency limits, N/query joins, N/cache samples, and other static reference material

## How to Use This Skill

### Manual Invocation (Slash Command)
Invoke this skill at any time by typing:
```
/netsuite-sdf-safe-guide
```

Or use natural language triggers:
- "Generate objects" – Scan SuiteScripts folder and create missing Object XML files.
- "Create object for this script" – Generate Object XML for the current/specified file.
- "Check my deployment XML" – Review and validate existing Object XML files.
- "Review my SuiteScript" – Review code for best practices, pitfalls, and governance issues.

### Optional Coding Assistant Activation Example
For NetSuite SuiteCloud Development Framework (SDF) projects, supported coding assistants may preload this skill from project settings.

Here is an example for Claude, which is one of the supported coding assistants:
**Step 1:** Create or edit `.claude/settings.local.json` in your SDF project root:

```json
{
  "permissions": {
    "allow": [
      "Skill(netsuite-sdf-safe-guide)"
    ]
  }
}
```

**Step 2 (Optional):** Add additional related skills and permissions:

```json
{
  "permissions": {
    "allow": [
      "Skill(netsuite-sdf-safe-guide)",
      "Skill(netsuite-suitescript-learning)",
      "Bash(suitecloud project:deploy:*)"
    ]
  }
}
```

With skill preloading configured, an assistant will automatically apply SDF best practices when you:
- Work on any NetSuite SDF project (SuiteApps or Account Customization projects).
- Create or modify SuiteScript files (all 14 script types including Suitelets, RESTlets, User Event Scripts, etc.).
- Work with Object XML files, custom records, custom fields, or other SDF objects.
- Configure deployment settings, manifest.xml, or deploy.xml.
- Ask questions about NetSuite SDF development.
- Encounter deployment errors or script issues.

---

## Intended Audience

This skill is designed for **Technical Architects, Developers, and System Administrators** working with NetSuite SuiteScript and the SuiteCloud 

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 28 — file references are metadata, not package contents.

View saved version →

---
name: netsuite-suitescript-learning
description: Interactive learning system for NetSuite SDF development. Features six modes (learn, review, explain, annotate, quiz, and final) with SAFE Guide integration. Produces compliance-reviewed learning documentation. Learn topics like governance, N/cache, and security directly from SAFE Guide principles. Generate quizzes from code or SAFE Guide content.
license: The Universal Permissive License (UPL), Version 1.0
metadata:
  author: Oracle NetSuite
  version: "1.0"
---

# NetSuite SuiteScript Learning Skill

**Created by:** Oracle NetSuite

## Description
Interactive learning system for NetSuite SuiteScript and SDF projects with **SAFE Guide integration**. This skill provides:

- **Learn Mode**: Topic-based learning from SAFE Guide principles (14 topics including governance, performance, security, N/cache, concurrency)
- **Review Mode**: Analyze code files and identify key learning concepts
- **Explain Mode**: Deep-dive explanations with automatic SAFE Guide references
- **Annotate Mode**: Embed educational comments directly into code
- **Quiz Mode**: Generate quizzes from user code (`--source=code`), SAFE Guide principles (`--source=safe`), or both
- **Final Mode**: Comprehensive learning documentation with SAFE Guide compliance checklist

Covers all 14 script types, deployment configurations, performance patterns, defensive coding practices, and governance limits.

## How to Use This Skill

### Manual Invocation (Slash Command)
Invoke this skill at any time by typing:
```
/netsuite-suitescript-learning
```

Note: `/netsuite-suitescript-learning` is the full skill command, while `/suitescript-learning` may be available as a coding assistant alias where supported.

Or use specific mode commands:
```
/netsuite-suitescript-learning learn [topic] # Learn a SAFE Guide topic
/netsuite-suitescript-learning review [filename] # Review a file and identify learning concepts
/netsuite-suitescript-learning explain [concept] # Deep dive into a specific concept
/netsuite-suitescript-learning annotate [filename] # Add inline learning comments to code
/netsuite-suitescript-learning quiz [section] # Generate quiz questions
/netsuite-suitescript-learning final # Generate a comprehensive learning document
```

### Optional Coding Assistant Activation Example
For Claude Code, add this to your project's `.claude/settings.local.json`:

```json
{
  "permissions": {
    "allow": [
      "Skill(netsuite-sdf-safe-guide)",
      "Skill(netsuite-suitescript-learning)"
    ]
  }
}
```

With both skills enabled, an assistant will:
- Follow SDF best practices for all SDF components (scripts, custom records, workflows, etc.)
- Automatically embed educational annotations in code as it's written
- Generate quizzes and learning materials on request
- Provide guidance on Suitelets, RESTlets, User Event Scripts, and all 14 script types

---

## When to Use This Skill

### Proactive Invocation (Recommended)
- Invoke this skill **during development** as code is being written, not just at the end.
- Call after each major component is created (script file, object XML, etc.).
- Use for real-time learning reinforcement.
- **IMPORTANT**: When creating NetSuite SuiteScript code, automatically embed learning annotations (CONCEPT comments, LEARNING NOTES) directly into the code as it's written.

### Automatic Annotation During Code Creation

When this skill is active and code is being created (not just reviewed), the following annotations should be automatically included:

1. **JSDoc Headers**: Include LEARNING NOTES explaining the script type and purpose.
2. **Entry Points**: Add LEARNING NOTES blocks explaining when/how the function runs.
3. **API Calls**: Add CONCEPT comments before each N/* module usage.
4. **Complex Logic**: Add step-by-step comments for multi-step operations.
5. **Return Statements**: Explain what's being exposed and why.

This ensures educational content is embedded as code is written, not added as an a

Preview of the first 4,000 characters. Read full instructions →

View saved version →

---
name: netsuite-suitescript-records-reference
description: SuiteScript records and fields reference. Look up field IDs, types, required status, and search capabilities for all 272 NetSuite record types. Use this when building SuiteScript to ensure correct field usage.
license: The Universal Permissive License (UPL), Version 1.0
metadata:
  author: Oracle NetSuite
  version: "1.0"
---

# NetSuite SuiteScript Records Reference

## Description
Authoritative reference for NetSuite SuiteScript record types and their fields. Use this skill to:
- Look up field internal IDs for any record type.
- Verify field types (text, select, currency, date, etc.).
- Check whether fields are required or support `nlapiSubmitField`.
- Find available search filters and columns.
- Determine if a record supports custom fields.

## When to Use
- Building `N/record` operations (`create`, `load`, `setValue`, `getValue`)
- Creating `N/search` filters and columns
- Validating field IDs in existing code
- Generating Object XML with correct field references

## Reference Data
- **Total records:** 272 NetSuite record types
- **Data source:** NetSuite SuiteScript Records Browser plus [SuiteScript Supported Records](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_N3170023.html)
- **Location:** `references/records.json`

## Lookup Instructions

### Find a Record
1. Search `records.json` for the record internal ID (for example, "salesorder", "customer").
2. The record object contains all field definitions.

### Record Properties
Each record includes:
| Property | Description |
|----------|-------------|
| `recordCategory` | Record type: List, Transaction, Entity, Activity, Subrecord, Script, Custom, etc. |
| `scriptingLevel` | API access level: Full, Read and Search Only, Search Only, Copy Not Supported, etc. |
| `clientScriptable` | Whether the record can be scripted in client SuiteScript (true/false) |
| `serverScriptable` | Whether the record can be scripted in server SuiteScript (true/false) |
| `scriptingNotes` | Special notes (for example, "Server scripts must access through the parent record") |
| `supportsCustomFields` | Whether the record supports custom fields |

### Field Properties
Each field includes:
| Property | Description |
|----------|-------------|
| `internalId` | Field ID to use in scripts (for example, "entity", "trandate") |
| `type` | Field type: text, select, currency, date, checkbox, etc. |
| `label` | Human-readable field name |
| `required` | "true" or "false" |
| `nlapiSubmitField` | Whether the field can be updated through `submitFields()` |
| `help` | Tooltip/description text |

### Common Lookups

**Check if a record supports create/update:**
```
Look for "scriptingLevel": "Full" — supports all CRUD operations.
"Read and Search Only" — cannot create or update via script.
"Search Only" — can only be used in N/search, no N/record access.
```

**Check client vs. server scriptability:**
```
"clientScriptable": true — can attach a Client Script and use currentRecord.
"serverScriptable": true — can be used in User Event, Scheduled, Map/Reduce, etc.
```

**Get all fields for a record:**
```
Search records.json for: "internalId": "salesorder".
```

**Find required fields:**
```
Look for fields where "required": "true".
```

**Check if field is submittable:**
```
Look for "nlapiSubmitField": "true".
```

## Scripting Level Reference

| Level | N/record.create | N/record.load | N/record.copy | N/record.delete | N/search |
|-------|:-:|:-:|:-:|:-:|:-:|
| Full | Yes | Yes | Yes | Yes | Yes |
| Copy Not Supported | Yes | Yes | No | Yes | Yes |
| Create, Read, Update, and Delete | Yes | Yes | No | Yes | Yes |
| Read, Create, Update, Copy, Delete, and Search | Yes | Yes | Yes | Yes | Yes |
| Read and Search Only | No | Yes | No | No | Yes |
| Search Only | No | No | No | No | Yes |

## Record Category Reference

This table lists common categories; source data may include additional categories.

| Category | Description |
|

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 2 — file references are metadata, not package contents.

View saved version →

---
name: netsuite-suitescript-upgrade
description: SuiteScript 1.0, 2.0, and 2.x to 2.1 migration assistant. Analyzes, converts, explains, and validates script upgrades. Covers 125+ API mappings, 34 object conversions, 13 unmapped API workarounds, all script type entry point changes, SuiteScript 2.0/2.x to 2.1 upgrade guidance, and 16 categories of breaking behavioral changes. Essential for modernizing legacy SuiteScript codebases.
license: The Universal Permissive License (UPL), Version 1.0 
metadata:
  author: Oracle NetSuite
  version: "1.0"
---

# NetSuite SuiteScript Upgrade Skill

**Created by:** Oracle NetSuite

## Description

Complete SuiteScript 1.0, 2.0, and 2.x to 2.1 migration assistant with **4 operating modes**: analyze, convert, explain, and validate. SuiteScript 2.1 is always the target version. This skill provides:

- **Analyze Mode**: Scan SS1.0, SS2.0, and SS2.x scripts and produce migration complexity reports
- **Convert Mode**: Transform SS1.0, SS2.0, and SS2.x scripts to SS2.1 with full API mapping and JavaScript modernization
- **Explain Mode**: Deep dive into specific API mappings, objects, or migration concepts for a full SS2.1 conversion
- **Validate Mode**: Check converted scripts for leftover 1.0 patterns, non-2.1 version tags, and common conversion bugs

Backed by comprehensive reference data:
- **125+ API function mappings** (nlapi\* → N/\* modules) across 26 modules
- **34 object conversions** (nlobj\* → SS2.1 classes) with 331 method mappings
- **13 unmapped APIs** with native JavaScript or alternative workarounds
- **All script type entry point changes** (User Event, Client, Suitelet, RESTlet, Scheduled, Map/Reduce, etc.)
- **16 categories of breaking behavioral changes** with before/after examples

## How to Use This Skill

### Manual Invocation (Slash Command)

Invoke this skill at any time by typing:
```
/netsuite-suitescript-upgrade
```

Or use specific mode commands:
```
/netsuite-suitescript-upgrade analyze [file-path]     # Assess migration complexity for SS1.0/2.0/2.x
/netsuite-suitescript-upgrade convert [file-path]     # Convert SS1.0/2.0/2.x → SS2.1
/netsuite-suitescript-upgrade explain [api-or-concept] # Deep dive into a mapping
/netsuite-suitescript-upgrade validate [file-path]    # Check converted script
```

### Automatic Activation (Recommended for Migration Projects)

For projects undergoing SuiteScript migration, add this skill to your project's `.claude/settings.local.json`:

```json
{
  "permissions": {
    "allow": [
      "Skill(netsuite-suitescript-upgrade)",
      "Skill(netsuite-sdf-leading-practices)",
      "Skill(netsuite-suitescript-reference)"
    ]
  }
}
```

With all three skills enabled, Claude will:
- Detect SS1.0, SS2.0, and SS2.x scripts automatically and offer migration assistance
- Convert APIs using the complete mapping reference
- Generate proper deployment XML via the leading-practices skill
- Look up correct field IDs via the suitescript-reference skill

---

## When to Use This Skill

### Proactive Invocation (Recommended)

This skill should be invoked automatically when:
- User opens or references a SuiteScript 1.0 file (detected by `nlapi*` calls, no `define()`)
- User opens or references a SuiteScript 2.0 or ambiguous 2.x file that needs normalization to SuiteScript 2.1
- User asks about migrating, upgrading, or converting SuiteScript
- User encounters `nlapi*` or `nlobj*` functions and asks what the SS2.1 equivalent is
- User is working on a project with mixed SS1.0, SS2.0, SS2.x, and SS2.1 scripts

### Manual Invocation

- Commands: "analyze this script", "convert to 2.1", "what's the 2.1 version of nlapiSearchRecord?"
- Questions: "How do I migrate this User Event?", "What module replaces nlapi functions?"
- Validation: "Check my converted script", "Did I miss any 1.0 patterns?"

---

## SS1.0 Detection Logic

### How to Identify a SuiteScript 1.0 Script

A file is a SuiteScript 1.0 script if it matches **any** of these patterns:

| Indicator |

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 6 — file references are metadata, not package contents.

View saved version →

---
name: netsuite-uif-spa-reference
description: "Use when building, modifying, or debugging NetSuite UIF SPA components. Provides API/type lookup for `@uif-js/core` and `@uif-js/component` (constructors, methods, props, enums, hooks, and component options)."
license: The Universal Permissive License (UPL), Version 1.0
metadata:
  author: Oracle NetSuite
  version: "1.0"
---

# NetSuite UIF Reference

Complete type definitions for `@uif-js/core` and `@uif-js/component`, the two packages that power NetSuite SPA (single-page application) user interfaces.

## When to Use

- Building or modifying a UIF SPA component (JSX files)
- Looking up the exact API for a UIF class (Date, ArrayDataSource, Router, etc.)
- Checking available props/methods on UIF components (DataGrid, StackPanel, Button, etc.)
- Debugging runtime errors from UIF framework code
- Verifying enum values (for example, `Button.Hierarchy`, `GapSize`, `DataGrid.ColumnType`)
- Understanding UIF Date vs. Native Date behavior

## Reference Data

The type definitions are located in the `references/` subdirectory.

| File | Package | Contents |
|------|---------|----------|
| `references/core.d.ts` | `@uif-js/core` | Core framework: Date, ArrayDataSource, Ajax, Router, useState, useEffect, Context, etc. |
| `references/component.d.ts` | `@uif-js/component` | UI components: DataGrid, StackPanel, Button, Text, Badge, Heading, Card, ContentPanel, Modal, etc. |

## Lookup Instructions

To find information about a specific class or component:

1. **Search by class name**:
   ```
   Search for `class Date` in the local `references/` directory.
   ```

2. **Search by method name**:
   ```
   Search for `lastOfMonth`, `firstOfMonth`, or `addDay` in `references/core.d.ts`.
   ```

3. **Search by enum**:
   ```
   Search for `enum GapSize`, `enum Hierarchy`, or `enum Type` in `references/component.d.ts`.
   ```

4. **Read a section**: Once you find the line number, open that part of the file to view the full definition.

## Key Classes Quick Reference

### @uif-js/core

| Class | Purpose | Key Members |
|-------|---------|-------------|
| `Date` | UIF date wrapper | `.year`, `.month` (0-indexed), `.day`, `.firstOfMonth()`, `.lastOfMonth()`, `.addDay()`, `.addMonth()`, `.stripTime()`, `.toDate()` (→ native), `Date.now()`, `Date.today()` |
| `ArrayDataSource` | Data provider for grids | `ArrayDataSource<T>` – constructor takes `T[]` |
| `Ajax` | HTTP client | `Ajax.post()`, `Ajax.get()`, `Ajax.DataType`, `Ajax.ResponseType` |
| `Router` | SPA routing | `Router.Routes`, `Router.Route`, `Router.Hash`, `Router.Path` |
| `useState` | State hook | `useState(initialValue)` → `[value, setter]` |
| `useEffect` | Effect hook | `useEffect(callback, deps)` |
| `useContext` | Context hook | `useContext(contextName: string)` – takes a string, for example, `ContextType.ROUTER_LOCATION` |
| `Context` | Context provider | `Context.Provider`, `Context.Consumer` |
| `ContextType` | Context type string constants | `ContextType.ROUTER_LOCATION`, `ContextType.ROUTER_NAVIGATION`, `ContextType.ROUTER_ROUTE`, `ContextType.I18N`, `ContextType.PREFERENCES`, `ContextType.FOCUS_MANAGER`, `ContextType.STORE` – full list: 31 values; search for `ContextType` in `core.d.ts` |
| `useCallback` | Memoized callback | `useCallback(fn, deps)` – prevents unnecessary re-renders |
| `useMemo` | Memoized value | `useMemo(() => compute(), deps)` |
| `useRef` | Mutable ref container | `useRef(initialValue)` – `.current` persists across renders |
| `Translation` | i18n support | `Translation.get('key')` for localized strings |
| `Store` | Redux-like state container | `Store.create({ reducer, initial })`; factory; `Store.Provider` – wrap the tree in JSX; `useSelector(fn)` – select slice; `useDispatch()` – dispatch actions |
| `Reducer` | Creates typed reducers | `Reducer.create(handlers)`; action handler map; `Reducer.combine([{path, reduce}])` – combine reducers (takes array, not plain object) |
| `useDispatch` | Dispatch hook |

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 2 — file references are metadata, not package contents.