feat(quickbooks): add purchasing and payables

[BillLeoutsakosvl346]

Summary

Adds QuickBooks purchasing and accounts-payable support as the third stacked PR.

• replaces the standalone Bill and Purchase Order list actions with one bounded purchasing reader
• adds safe create and header-only update operations for Purchase Orders, Bills, Bill Payments, Vendor Credits, and Purchases/Expenses
• keeps PO-to-Bill linking and unsafe collection/payment changes out of scope
• preserves one-request execution, bounded inputs/responses, and existing OAuth/company binding

This PR is stacked on feat/quickbooks-02-sales and should not be merged before its parent.

Safety choices

• list pages, purchasing lines, and Bill allocations are capped at 100
• updates require current SyncToken values
• Bill, BillPayment, and VendorCredit updates resend required Vendor references
• BillPayment and Purchase updates cannot silently alter allocations, lines, payment type, or payment account
• no automatic pagination, retries, fan-out, payments, deletes, or PO conversion

Validation

• live Intuit sandbox acceptance for all eleven operations and relevant fault cases
• independent gpt-5.6-sol review against staging: approved with no findings
• 12 focused regression suites: 492 tests passed in the final independent review
• Sim type-check
• formatter and lint checks
• API-contract, bare-icon, icon-path, and client-boundary checks
• documentation generation and memory-load audit
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 3, 2026 11:52pm

[greptile-apps]

Greptile has paused reviews on this repository — it used its 2000 free open-source review credits for this billing period. Reviews resume automatically on August 9. To continue before then, an organization admin can keep reviews running past the free credits — those bill as normal usage.

[cursor]

PR Summary

Medium Risk
New routes handle OAuth tokens, user file access, and external fetches to Intuit—including pinned-IP downloads—which are security-sensitive but bounded by size limits and tests; doc-only changes elsewhere are low risk.

Overview
Expands the QuickBooks integration docs to match a broader block surface: unified Read Purchasing Transactions (replacing separate purchase-order and bill list actions), full purchasing/payables create/update actions, accounting reads/mutations, financial reports, transaction email/PDF, and attachment read/add/download—with intro text that now covers reports and documents instead of saying they are unsupported.

Master data and sales list reads gain class/department types, optional activeStatus, and date/customer filters on sales lists; several update actions document activeStatus as optional rather than required.

Adds three internal tool API routes for document workflows: attach file/note to an entity (multipart upload with workspace file authorization and size/MIME checks), download transaction PDFs (PDF validation and Sim file storage), and download file attachments via Intuit’s short-lived URL with DNS pinning and bounded reads. A 673-line test suite covers auth, cancellation, oversize payloads, and sanitized fault handling for those routes.

^{Reviewed by Cursor Bugbot for commit e8ad9a1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[BillLeoutsakosvl346]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1832dc2. Configure here.}

[BillLeoutsakosvl346]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1832dc2. Configure here.}