SuiteCloud Developer cheat sheet

Account customization model: objects, fields, and scripts live in one NetSuite account; SDF (SuiteCloud Development Framework) represents them as an Account Customization Project (ACP) or SuiteApp project in a file-based XML structure under src/Objects and src/FileCabinet.

Deployment targets: SDF projects deploy to a target account; a SuiteApp project is built into a distributable bundle for install in other accounts, while an ACP project deploys only to the account it was created for.

Account Customization Project vs SuiteApp: ACP cannot include locked-bundle objects or bundleable-only features; SuiteApp projects can declare dependencies and are versioned for distribution through SuiteApp.com or private repositories.

SuiteScript 2.x entry points: script type is chosen at deployment (Client, User Event, Scheduled, Map/Reduce, RESTlet, Suitelet, Portlet, Workflow Action, Mass Update, Bundle Installation, Custom Plug-in, SDF Installation). Each type has a fixed entry point name and function signature.

Script deployment record fields that control execution: Status (Testing/Released/Scheduled), Log Level, Execute As Role, Audience (roles, departments, subsidiaries, employees), and for client scripts, Applies To (view/create/edit) plus Page/Record type.

Governance model: server-side scripts receive usage units (governance) per execution; client-side scripts are not governed by usage units but are limited by browser and API call restrictions. SuiteScript 2.1 adds features while keeping 2.0 compatibility.

N/cache, N/runtime, N/log, N/error, and N/record are core modules; require() must be called with a module name, and module dependencies are listed in the JSDoc @NApiVersion tag (e.g., @NApiVersion 2.1).

Search vs record load: N/search returns search.Result objects with limited fields and is preferred for bulk reads; record.load returns full record objects and is limited by record-type load governance.

SuiteCloud IDE/CLI: SuiteCloud CLI for Node.js (suitecloud) creates projects, imports objects, validates, and deploys; suitecloud.config.json and manifest.json define project settings; deploy.xml lists objects and files included in a deployment.

Entry point signatures: user event beforeLoad(context), beforeSubmit(context), afterSubmit(context); client script pageInit(context), fieldChanged(context), saveRecord(context), validateField(context), postSourcing(context), lineInit(context), sublistChanged(context), and validateLine(context).

User event context properties: context.type is create/edit/delete/approve/reject/cancel/pack/xedit; context.newRecord and context.oldRecord are record objects; returning false from beforeSubmit cancels the submit; afterSubmit runs in the same transaction and cannot roll back the write.

Scheduled script: execute(context) where context.scriptId and context.deploymentId identify the deployment; use N/runtime for getCurrentScript().getParameter() values; scheduled scripts can be invoked by a saved search or by the scheduler.

Map/Reduce: getInputData(context) returns a search or array; map(context) receives context.key, context.value; reduce(context) receives context.values grouped by key; summarize(context) receives context.keys and context.values; each stage has its own governance budget.

RESTlet: entry points get, post, put, delete; request parameters via context.request.parameters; return JSON-serializable objects; errors surface as HTTP 400/500; authentication via token-based auth (TBA) or OAuth 2.0.

Suitelet: onRequest(context) with context.request and context.response; response.write() and response.setHeader(); can render forms via N/ui/serverWidget and can be deployed with an external URL.

Client scripts cannot use server-only modules (N/record, N/search, N/file); use N/https or a Suitelet/RESTlet for server work; N/currentRecord provides the current record in client context.

N/record operations: record.create({type, isDynamic}), record.load({type, id}), record.copy, record.transform({fromType, fromId, toType}), record.delete; record.submitFields updates without loading; record.save is implicit on create/load operations after setValue.

Governance: runtime.getCurrentScript().getRemainingUsage() returns remaining units; script.getParameter and script.getDeploymentId; N/runtime.getCurrentUser() returns user, role, and subsidiary info; N/error.create({name, message}) throws a governed error.

Asynchronous work: N/task.create({taskType: task.TaskType.MAP_REDUCE, scriptId, deploymentId, params}) and task.submit(); N/async module for promises; N/transaction for voiding and N/sftp for file transfer.

Custom record types: define ID, name, parent, and permissions; custom record fields can be sourced from lists; custom record types support custom segments and are addressable in SuiteScript via record type ID (customrecord_xxx).

Custom fields: field type determines storage (Free-Form Text, List/Record, Date, Currency, Percent, Check Box, Long Text, Image, Document, Inline HTML); Applies To controls which record types show the field; Display Type (Normal, Hidden, Disabled) controls UI behavior.

Custom lists: values are ordered and can be sorted; list values have an ID and a value; Sourcing (Static vs Dynamic) determines whether a field pulls from a list or another record; custom list IDs are used in script values.

Custom forms: entry forms, transaction forms, and custom sublists; form fields can be added, removed, and reordered; preferred form is set per role; SuiteScript can select a form by ID in record.load or via the UI.

Workflow: states, transitions, actions (Set Field Value, Send Email, Create Record, Return, Lock Record, Add Button); workflow initiation (On Create, On View/Update, Scheduled, User Triggered); conditions use the same field IDs as scripts.

Custom segments and classifications: custom segments extend the chart of accounts; classification fields (Class, Department, Location) are standard; custom segments appear as segments in transactions and reports.

Permissions and roles: custom roles inherit from a base role; permission levels are None, View, Create, Edit, Full; script deployments have an Audience and a Log Level; the 'Execute As Role' setting determines effective permissions.

Sublists: standard sublists (item, expense, inventory) vs custom sublists on custom records; custom sublists require a custom record type and are accessed in SuiteScript via record.getSublistValue/setSublistValue with the sublist ID.

Custom objects in SDF: each object has an XML file under src/Objects with a scriptid; object dependencies (e.g., a field on a custom record) must be deployed in dependency order; SDF validation catches missing dependencies.

Token-Based Authentication (TBA): create an integration record, generate token ID and token secret, and use OAuth 1.0 HMAC-SHA256 with the consumer key/secret and token credentials; realm is the account ID.

OAuth 2.0: NetSuite supports Authorization Code and Client Credentials flows; the integration record must enable the REST Web Services feature; access tokens expire and refresh tokens are used for renewal.

REST Web Services: base URL https://.suitetalk.api.netsuite.com/services/rest/; resources include record/v1, query/v1/suiteql, and metadata; SuiteQL supports SELECT with limited JOINs and pagination via limit/offset.

SOAP Web Services: SuiteTalk endpoint /services/NetSuitePort_2021_2 or later; operations include add, update, upsert, delete, search, get; use async operations for bulk; SOAP is legacy-preferred for some record types but REST is the strategic direction.

SDF deployment: suitecloud project:validate, project:deploy, and project:import; deploy.xml lists objects and files; the deployment is asynchronous and can be monitored via the deployment status; a failed deployment rolls back the unit.

SuiteApp distribution: bundle is built with the SuiteCloud SDK; the manifest.json declares dependencies and the bundle ID; private distribution uses a repository URL; public distribution requires SuiteApp.com review.

Integration record: defines the application, authentication method, and allowed scopes; the record's internal ID is used in TBA; OAuth 2.0 requires the redirect URI and scope list.

Error handling: REST returns HTTP status codes and a JSON error body with 'o:errorDetails'; SOAP returns a fault with statusDetail; retry with exponential backoff for 429/5xx; idempotency via externalId on upsert.

Rate limits: REST Web Services have concurrency limits per account; SuiteQL queries have row limits and timeouts; bulk operations should use Map/Reduce or async SOAP to stay within limits.