feat(quickbooks): add master data and simple CRUD

[BillLeoutsakosvl346]

Summary

Adds the first stacked QuickBooks expansion on top of feat/quickbooks-integration:

• Replaces List Vendors with one compact Master Data: Read operation for Account, Customer, Vendor, Item, and Employee records
• Adds explicit create/update operations for Customers and Vendors
• Adds explicit create/update operations for Service and Non-inventory Items
• Preserves the existing Company Info, Purchase Order, and Bill operations
• Keeps fixed entity mappings, bounded pagination, one request per action, no retries, and explicit SyncToken sparse updates
• Updates the QuickBooks block, registries, metadata, generated integration catalog, and docs

The block now exposes exactly ten operations. This PR does not add arbitrary queries, filtering infrastructure, remote selectors, inventory/category writes, or new OAuth scopes.

Validation

• Focused QuickBooks/block/OAuth/registry suites: 277 tests passed
• Full Sim suite: 1,257 files and 16,960 tests passed
• TypeScript type-check
• Formatter and lint checks
• Strict API-contract validation
• Bare-icon validation
• git diff --check
• Integration validation and memory-load audits
• Live Intuit sandbox reads for Account, Customer, Vendor, Item, and Employee
• Live Customer and Vendor create/update/deactivate/reactivate lifecycles
• Live Service and Non-inventory Item create/update lifecycles
• Duplicate-name and stale-SyncToken faults verified
• One HTTP request per tool execution verified

Sandbox note

The local environment had one connected QuickBooks company, so the existing multi-company isolation behavior was not re-exercised in this child PR. No credentials or unsanitized accounting records are committed.

Stack

• Base: feat/quickbooks-integration at the frozen parent SHA 970d3b1e4
• Head: feat/quickbooks-01-master-data

This PR must not be merged automatically.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 1, 2026 8:12pm

[cursor]

PR Summary

Medium Risk
Adds write paths to a connected QuickBooks company (customers, vendors, items) and changes global sensitive-key handling for *token fields; mistakes could mutate accounting master data or briefly mis-classify secrets in logs if allowlist patterns are wrong.

Overview
Expands the QuickBooks integration from read-only procurement lists to ten bounded operations: unified Master Data: Read (accounts, customers, vendors, items, employees—list or by ID) replaces standalone vendor listing, plus create/update for customers, vendors, and Service/Non-inventory items with explicit SyncToken sparse updates. Company info, purchase orders, and bills listing stay as before.

The QuickBooks block, integration catalog, OAuth copy, and docs are aligned with grouped operation labels and the new inputs (record type, read mode, mutation fields, conditional pagination).

Security redaction is adjusted so workflow-state tokens such as SyncToken and pagination cursors are not treated as credentials in logs/API key redaction, while auth tokens remain redacted; string redaction now respects key names for =/: quoted fields.

Templates and block skills shift toward onboarding, catalogue maintenance, and master-data audit rather than vendor-only read workflows.

^{Reviewed by Cursor Bugbot for commit 30c9e12. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

Adds consolidated QuickBooks master-data reads and explicit customer, vendor, and item mutations.

• Replaces the vendor-list operation with list/by-ID reads for accounts, customers, vendors, items, and employees.
• Adds sparse create and update tools for customers, vendors, Service items, and Non-inventory items.
• Updates block configuration, tool registries, output metadata, tests, generated integration metadata, and documentation.

Confidence Score: 4/5

This PR should not merge until legacy vendor-list workflows remain executable and Employee responses are filtered before entering workflow or agent output.

Removing the persisted operation ID creates wrong-tool or missing-tool execution paths, and raw Employee API objects can propagate sensitive fields that the public output schema intentionally omits.

Files Needing Attention: apps/sim/blocks/blocks/quickbooks.ts, apps/sim/tools/quickbooks/read_master_data.ts, apps/sim/tools/quickbooks/utils.ts, apps/sim/tools/quickbooks/types.ts

Security Review

Employee master-data reads pass raw QuickBooks records through the tool boundary, allowing sensitive fields such as SSN to reach workflow state, logs, clients, and LLM tool results. How this was verified: The Employee response type includes SSN, and the changed transform returns the unfiltered provider object directly through the executor.

Important Files Changed

Filename	Overview
apps/sim/blocks/blocks/quickbooks.ts	Expands the block to ten operations and maps their inputs, but removing the legacy vendor-list operation breaks persisted workflows.
apps/sim/tools/quickbooks/read_master_data.ts	Adds list and by-ID reads for five entity types, including Employee records whose raw sensitive properties are not sanitized.
apps/sim/tools/quickbooks/utils.ts	Adds shared entity, mutation, parsing, and validation helpers; the entity transform passes complete provider objects through unchanged.
apps/sim/tools/quickbooks/create_customer.ts	Adds a bounded, non-retrying customer creation request with normalized optional fields.
apps/sim/tools/quickbooks/update_customer.ts	Adds explicit SyncToken-based sparse customer updates and active-status changes.
apps/sim/tools/quickbooks/create_vendor.ts	Adds vendor creation with normalized contact, address, account, and 1099 fields.
apps/sim/tools/quickbooks/update_vendor.ts	Adds explicit SyncToken-based sparse vendor updates and active-status changes.
apps/sim/tools/quickbooks/create_item.ts	Adds Service and Non-inventory item creation with account-reference and purchase-field validation.
apps/sim/tools/quickbooks/update_item.ts	Adds sparse item updates with SyncToken concurrency control and numeric validation.
apps/sim/tools/quickbooks/types.ts	Expands QuickBooks entity and output types, including sensitive Employee properties that can remain present at runtime.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Workflow[QuickBooks block] --> Selector{Operation}
  Selector --> Read[Master-data read]
  Selector --> Mutate[Customer, vendor, or item mutation]
  Read --> QB[QuickBooks Online API]
  Mutate --> QB
  QB --> Transform[Response transform]
  Transform --> Output[Workflow output]

Loading

_{Reviews (1): Last reviewed commit: "docs(quickbooks): document master data a..." | Re-trigger Greptile}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4fd99eb. Configure here.}