feat(quickbooks): add sales and accounts receivable

[BillLeoutsakosvl346]

Summary

Adds the second stacked QuickBooks PR with 15 bounded sales and accounts-receivable operations, bringing the block to 25 operations total.

• Read estimates, invoices, sales receipts, customer payments, credit memos, and refund receipts by list or ID
• Create and sparse-update the six supported sales transaction types
• Void invoices and customer payments with explicit confirmation
• Parse bounded sales lines and invoice allocations without raw QuickBooks payloads
• Preserve native QuickBooks records, IDs, and SyncToken values
• Add generated docs and accountant-focused metadata

Safety and contracts

• Targets feat/quickbooks-01-master-data as a stacked PR
• Uses fixed entity/resource mappings and one QuickBooks request per action
• No arbitrary queries, retries, automatic pagination, deletes, email, tax administration, or raw payloads
• Response bodies remain capped at 8 MiB; pages, lines, and allocations are capped at 100
• Contracts were verified against Intuit documentation, official examples, and a connected sandbox using sanitized disposable records

Validation

• 421 focused QuickBooks, OAuth, registry, and output tests passed
• Direct Sim TypeScript check passed
• Full format check passed
• Full lint check passed with only two pre-existing fit.fit() false-positive warnings
• Strict API-contract validation passed
• Bare-icon validation passed
• Documentation generation passed
• git diff --check passed
• Independent gpt-5.6-sol high-reasoning review against staging completed with no remaining actionable findings

Stack

• Base PR: feat(quickbooks): add master data and simple CRUD #6119
• This PR must not be merged before its base and must not be merged automatically.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 3, 2026 11:54pm

[greptile-apps]

Greptile Summary

Adds 15 bounded QuickBooks sales and accounts-receivable operations.

• Supports list and by-ID reads for estimates, invoices, sales receipts, customer payments, credit memos, and refund receipts.
• Adds create and sparse-update operations for all six transaction types, plus confirmed void operations for invoices and customer payments.
• Adds bounded sales-line and invoice-allocation parsing, block metadata, registry entries, workflow output types, focused tests, and generated documentation.

Confidence Score: 5/5

The PR appears safe to merge after its stacked base, with no actionable correctness or security defects identified.

The new operation identifiers, editor contracts, runtime parameter mappings, bounded parsers, request construction, response transformations, and registry entries remain aligned, and malformed or incomplete financial inputs are rejected before dispatch.

Important Files Changed

Filename	Overview
apps/sim/tools/quickbooks/sales_utils.ts	Adds strict bounded parsing and request-body construction for sales lines, payment allocations, creates, and sparse updates.
apps/sim/blocks/blocks/quickbooks.ts	Exposes the new operations with coordinated parameter routing, conditional fields, and operation-specific outputs.
apps/sim/tools/quickbooks/read_sales_transactions.ts	Implements fixed-mapping list and by-ID reads with bounded pagination and native transaction outputs.
apps/sim/tools/quickbooks/void_invoice.ts	Adds explicitly confirmed invoice voiding while preserving the returned record ID and SyncToken.
apps/sim/tools/quickbooks/void_customer_payment.ts	Adds explicitly confirmed customer-payment voiding through the payment update-and-void request contract.
apps/sim/tools/quickbooks/sales.test.ts	Covers validation, payload construction, operation routing, response transformation, and void confirmation behavior.
apps/sim/tools/registry.ts	Registers all newly added QuickBooks tools consistently with the block's allowed tool identifiers.

Sequence Diagram

sequenceDiagram
  participant Workflow
  participant Block as QuickBooks Block
  participant Tool as QuickBooks Tool
  participant QBO as QuickBooks Online
  Workflow->>Block: Select sales/receivables operation
  Block->>Block: Parse bounded lines, allocations, and parameters
  Block->>Tool: Dispatch registered operation
  Tool->>QBO: One authenticated read or mutation request
  QBO-->>Tool: Native transaction response
  Tool-->>Workflow: Bounded record, IDs, SyncToken, and pagination metadata

Loading

_{Reviews (1): Last reviewed commit: "fix(quickbooks): address independent sal..." | Re-trigger Greptile}

[BillLeoutsakosvl346]

bugbot run

[BillLeoutsakosvl346]

bugbot run verbose=true

[BillLeoutsakosvl346]

cursor review

[BillLeoutsakosvl346]

@cursor review

[cursor]

PR Summary

Medium Risk
Document routes perform authenticated external fetches and user file I/O with size and SSRF mitigations; incorrect handling could leak files or accept malicious uploads, though the diff adds explicit guards and tests.

Overview
This PR massively expands the English QuickBooks integration docs and adds three internal API routes for transaction PDFs and attachments, with a large Vitest suite for those routes.

The docs now describe the full bounded QuickBooks block: OAuth company binding, list/by-ID reads with manual pagination, sparse updates, void semantics, sandbox vs production, financial reports, and document limits. They replace narrow list actions with unified read actions for sales, purchasing, and accounting transactions, document employee create/update, optional requestId on creates and optional activeStatus on updates, and catalog dozens of actions (estimates through journal entries, reports, email, PDF, attachments).

The new routes authenticate via internal auth, validate contracts, call Intuit (direct PDF or multipart upload for file attachments), enforce file size limits, tool file authorization on uploads, sanitize filenames, validate PDF bytes, and for attachment downloads resolve a temporary URL then fetch via DNS-validated pinned IP before storing files as execution or copilot uploads. Requests honor abort signals so cancelled workflows do not persist partial downloads.

^{Reviewed by Cursor Bugbot for commit 1990197. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ad88f00. Configure here.}