feat(quickbooks): add master data and simple CRUD

[BillLeoutsakosvl346]

Summary

Adds the first stacked QuickBooks expansion on top of feat/quickbooks-integration:

• Replaces List Vendors with one compact Master Data: Read operation for Account, Customer, Vendor, Item, and Employee records
• Adds explicit create/update operations for Customers and Vendors
• Adds explicit create/update operations for Service and Non-inventory Items
• Preserves the existing Company Info, Purchase Order, and Bill operations
• Keeps fixed entity mappings, bounded pagination, one request per action, no retries, and explicit SyncToken sparse updates
• Updates the QuickBooks block, registries, metadata, generated integration catalog, and docs

The block now exposes exactly ten operations. This PR does not add arbitrary queries, filtering infrastructure, remote selectors, inventory/category writes, or new OAuth scopes.

Validation

• Focused QuickBooks/block/OAuth/registry suites: 277 tests passed
• Full Sim suite: 1,257 files and 16,960 tests passed
• TypeScript type-check
• Formatter and lint checks
• Strict API-contract validation
• Bare-icon validation
• git diff --check
• Integration validation and memory-load audits
• Live Intuit sandbox reads for Account, Customer, Vendor, Item, and Employee
• Live Customer and Vendor create/update/deactivate/reactivate lifecycles
• Live Service and Non-inventory Item create/update lifecycles
• Duplicate-name and stale-SyncToken faults verified
• One HTTP request per tool execution verified

Sandbox note

The local environment had one connected QuickBooks company, so the existing multi-company isolation behavior was not re-exercised in this child PR. No credentials or unsanitized accounting records are committed.

Stack

• Base: feat/quickbooks-integration at the frozen parent SHA 970d3b1e4
• Head: feat/quickbooks-01-master-data

This PR must not be merged automatically.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 3, 2026 11:54pm

[cursor]

PR Summary

Medium Risk
Document routes handle OAuth tokens, user file access, and external Intuit download URLs; mitigations (pinned IP, size limits, auth) are in place but mistakes could affect live company data or file security.

Overview
Docs: The QuickBooks integration page is rewritten from a narrow read-only procurement scope to a full action catalog. It adds a manual intro (OAuth company binding, list/by-ID pagination, sparse SyncToken updates, void semantics, sandbox vs production, reports, and document limits) and documents many new actions—consolidated Read Master Data, customer/employee/vendor/item CRUD, sales and purchasing transaction reads and mutations, accounting, financial reports, email, PDF download, and attachment read/add/download—replacing older list-only sections like quickbooks_list_bills / quickbooks_list_vendors.

API: New internal tool routes implement download transaction PDF, add attachment (note JSON or multipart file with workspace file authorization and size caps), and download attachment (short-lived Intuit URL via DNS-validated pinned fetch, then store as execution or copilot files). Responses expose file metadata without raw bytes; faults are sanitized. Vitest coverage exercises auth order, PDF validation, multipart upload, SSRF-safe downloads, abort signals, and 413 limits.

^{Reviewed by Cursor Bugbot for commit 6e42e48. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

Adds consolidated QuickBooks master-data reads and explicit customer, vendor, and item mutations.

• Replaces the vendor-list operation with list/by-ID reads for accounts, customers, vendors, items, and employees.
• Adds sparse create and update tools for customers, vendors, Service items, and Non-inventory items.
• Updates block configuration, tool registries, output metadata, tests, generated integration metadata, and documentation.

Confidence Score: 4/5

This PR should not merge until legacy vendor-list workflows remain executable and Employee responses are filtered before entering workflow or agent output.

Removing the persisted operation ID creates wrong-tool or missing-tool execution paths, and raw Employee API objects can propagate sensitive fields that the public output schema intentionally omits.

Files Needing Attention: apps/sim/blocks/blocks/quickbooks.ts, apps/sim/tools/quickbooks/read_master_data.ts, apps/sim/tools/quickbooks/utils.ts, apps/sim/tools/quickbooks/types.ts

Security Review

Employee master-data reads pass raw QuickBooks records through the tool boundary, allowing sensitive fields such as SSN to reach workflow state, logs, clients, and LLM tool results. How this was verified: The Employee response type includes SSN, and the changed transform returns the unfiltered provider object directly through the executor.

Important Files Changed

Filename	Overview
apps/sim/blocks/blocks/quickbooks.ts	Expands the block to ten operations and maps their inputs, but removing the legacy vendor-list operation breaks persisted workflows.
apps/sim/tools/quickbooks/read_master_data.ts	Adds list and by-ID reads for five entity types, including Employee records whose raw sensitive properties are not sanitized.
apps/sim/tools/quickbooks/utils.ts	Adds shared entity, mutation, parsing, and validation helpers; the entity transform passes complete provider objects through unchanged.
apps/sim/tools/quickbooks/create_customer.ts	Adds a bounded, non-retrying customer creation request with normalized optional fields.
apps/sim/tools/quickbooks/update_customer.ts	Adds explicit SyncToken-based sparse customer updates and active-status changes.
apps/sim/tools/quickbooks/create_vendor.ts	Adds vendor creation with normalized contact, address, account, and 1099 fields.
apps/sim/tools/quickbooks/update_vendor.ts	Adds explicit SyncToken-based sparse vendor updates and active-status changes.
apps/sim/tools/quickbooks/create_item.ts	Adds Service and Non-inventory item creation with account-reference and purchase-field validation.
apps/sim/tools/quickbooks/update_item.ts	Adds sparse item updates with SyncToken concurrency control and numeric validation.
apps/sim/tools/quickbooks/types.ts	Expands QuickBooks entity and output types, including sensitive Employee properties that can remain present at runtime.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
Workflow[QuickBooks block] --> Selector{Operation}
Selector --> Read[Master-data read]
Selector --> Mutate[Customer, vendor, or item mutation]
Read --> QB[QuickBooks Online API]
Mutate --> QB
QB --> Transform[Response transform]
Transform --> Output[Workflow output]

Loading

_{Reviews (1): Last reviewed commit: "docs(quickbooks): document master data a..." | Re-trigger Greptile}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 74ad283. Configure here.}