fix(quickbooks): gate every internal tool operation and contract-bind the provider ops

The QuickBooks internal handler returned for all twelve provider create/update
tool ids above both the operation input cap and the trusted-identity check, so
those gates only ever ran for the three file tool ids. Hoist both above the
switch, matching the Asana handler.

The same twelve operations had no boundary schema — executeToolOperationImplementation
only checks the input is a non-array object before casting to the operation's
param type. Author a contract per operation and route them through
executeInternalJsonToolOperation, the canonical in-process path. The two file
operations now parse through their contracts as well, which were previously
declared but unreferenced.

Also pass the transfer signal, not the caller's, when reading a failed
transaction-PDF response body, so a stalled Intuit error body stays bounded by
the 60s transfer deadline.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RB5M2gk7zZgGomnQqr7WRB

Author: waleedlatif1

apps/sim/lib/api/contracts/tools/quickbooks.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod'
 import { userFileSchema } from '@/lib/api/contracts/primitives'
+import type { ContractBody, ContractJsonResponse } from '@/lib/api/contracts/types'
 import { defineRouteContract } from '@/lib/api/contracts/types'
 import { RawFileInputSchema } from '@/lib/uploads/utils/file-schemas'
 
@@ -198,3 +199,352 @@ export const quickBooksAddAttachmentContract = defineRouteContract({
     ]),
   },
 })
+
+const QUICKBOOKS_MAX_LINES = 100
+const QUICKBOOKS_MAX_ALLOCATIONS = 100
+
+function requiredQuickBooksId(label: string) {
+  return z.string().min(1, `${label} is required`).max(256, `${label} is too long`)
+}
+
+function optionalQuickBooksId(label: string) {
+  return z.string().max(256, `${label} is too long`).optional()
+}
+
+function optionalQuickBooksText(label: string, max: number) {
+  return z.string().max(max, `${label} is too long`).optional()
+}
+
+/**
+ * QuickBooks dates are `YYYY-MM-DD`, but the format check stays in
+ * `validateQuickBooksDate` so an empty value keeps meaning "not supplied".
+ */
+function optionalQuickBooksDate(label: string) {
+  return z.string().max(32, `${label} is too long`).optional()
+}
+
+const quickBooksActiveStatusSchema = z
+  .enum(['unchanged', 'active', 'inactive'], {
+    error: 'activeStatus must be unchanged, active, or inactive',
+  })
+  .optional()
+
+/**
+ * Address input reaches this boundary already parsed into an object on every
+ * caller path. Key names and their QuickBooks mapping stay in
+ * `parseQuickBooksAddress`.
+ */
+const quickBooksAddressInputSchema = z.record(z.string(), z.string())
+
+const quickBooksSalesLineInputSchema = z.strictObject({
+  lineType: z.enum(['item', 'description'], {
+    error: 'lines[].lineType must be item or description',
+  }),
+  amount: z.number().optional(),
+  itemId: optionalQuickBooksId('lines[].itemId'),
+  description: optionalQuickBooksText('lines[].description', 4000),
+  quantity: z.number().optional(),
+  unitPrice: z.number().optional(),
+  serviceDate: optionalQuickBooksDate('lines[].serviceDate'),
+})
+
+const quickBooksSalesLinesSchema = z
+  .array(quickBooksSalesLineInputSchema)
+  .min(1, 'lines must contain at least one line')
+  .max(QUICKBOOKS_MAX_LINES, `lines cannot contain more than ${QUICKBOOKS_MAX_LINES} lines`)
+
+const quickBooksInvoiceAllocationsSchema = z
+  .array(
+    z.strictObject({
+      invoiceId: requiredQuickBooksId('invoiceAllocations[].invoiceId'),
+      amount: z.number(),
+    })
+  )
+  .min(1, 'invoiceAllocations must contain at least one allocation')
+  .max(
+    QUICKBOOKS_MAX_ALLOCATIONS,
+    `invoiceAllocations cannot contain more than ${QUICKBOOKS_MAX_ALLOCATIONS} allocations`
+  )
+
+const quickBooksBillAllocationsSchema = z
+  .array(
+    z.strictObject({
+      billId: requiredQuickBooksId('billAllocations[].billId'),
+      amount: z.number(),
+    })
+  )
+  .min(1, 'billAllocations must contain at least one allocation')
+  .max(
+    QUICKBOOKS_MAX_ALLOCATIONS,
+    `billAllocations cannot contain more than ${QUICKBOOKS_MAX_ALLOCATIONS} allocations`
+  )
+
+/** Every QuickBooks create/update operation answers with the same mutation envelope. */
+const quickBooksMutationResponseSchema = z.object({
+  success: z.literal(true),
+  output: z.object({
+    record: z
+      .object({
+        Id: z.string().min(1),
+        SyncToken: z.string().optional(),
+      })
+      .passthrough(),
+    recordId: boundedId,
+    syncToken: z.string().min(1),
+    recordVersion: z.string().min(1),
+    time: z.string().nullable(),
+  }),
+})
+
+const quickBooksMutationResponse = {
+  mode: 'json',
+  schema: quickBooksMutationResponseSchema,
+} as const
+
+export const quickBooksCreateBillPaymentBodySchema = quickBooksAuthSchema.extend({
+  vendorId: requiredQuickBooksId('vendorId'),
+  totalAmount: z.number(),
+  paymentType: z.enum(['check', 'credit_card'], {
+    error: 'paymentType must be check or credit_card',
+  }),
+  paymentAccountId: requiredQuickBooksId('paymentAccountId'),
+  billAllocations: quickBooksBillAllocationsSchema.optional(),
+  transactionDate: optionalQuickBooksDate('transactionDate'),
+  privateNote: optionalQuickBooksText('privateNote', 4000),
+  requestId: optionalQuickBooksText('requestId', 256),
+})
+
+export const quickBooksUpdateBillBodySchema = quickBooksAuthSchema.extend({
+  billId: requiredQuickBooksId('billId'),
+  syncToken: requiredQuickBooksId('syncToken'),
+  vendorId: optionalQuickBooksId('vendorId'),
+  apAccountId: optionalQuickBooksId('apAccountId'),
+  transactionDate: optionalQuickBooksDate('transactionDate'),
+  dueDate: optionalQuickBooksDate('dueDate'),
+  documentNumber: optionalQuickBooksText('documentNumber', 256),
+  privateNote: optionalQuickBooksText('privateNote', 4000),
+})
+
+export const quickBooksUpdateBillPaymentBodySchema = quickBooksAuthSchema.extend({
+  billPaymentId: requiredQuickBooksId('billPaymentId'),
+  syncToken: requiredQuickBooksId('syncToken'),
+  vendorId: optionalQuickBooksId('vendorId'),
+  transactionDate: optionalQuickBooksDate('transactionDate'),
+  privateNote: optionalQuickBooksText('privateNote', 4000),
+})
+
+/** Credit memos and refund receipts share Intuit's sales-document update shape. */
+export const quickBooksUpdateSalesDocumentBodySchema = quickBooksAuthSchema.extend({
+  transactionId: requiredQuickBooksId('transactionId'),
+  syncToken: requiredQuickBooksId('syncToken'),
+  customerId: optionalQuickBooksId('customerId'),
+  lines: quickBooksSalesLinesSchema.optional(),
+  transactionDate: optionalQuickBooksDate('transactionDate'),
+  documentNumber: optionalQuickBooksText('documentNumber', 256),
+  privateNote: optionalQuickBooksText('privateNote', 4000),
+  customerMemo: optionalQuickBooksText('customerMemo', 4000),
+  dueDate: optionalQuickBooksDate('dueDate'),
+  expirationDate: optionalQuickBooksDate('expirationDate'),
+  paymentMethodId: optionalQuickBooksId('paymentMethodId'),
+  paymentReferenceNumber: optionalQuickBooksText('paymentReferenceNumber', 256),
+  depositAccountId: optionalQuickBooksId('depositAccountId'),
+})
+
+export const quickBooksUpdateCustomerPaymentBodySchema = quickBooksAuthSchema.extend({
+  paymentId: requiredQuickBooksId('paymentId'),
+  syncToken: requiredQuickBooksId('syncToken'),
+  customerId: optionalQuickBooksId('customerId'),
+  totalAmount: z.number().optional(),
+  transactionDate: optionalQuickBooksDate('transactionDate'),
+  privateNote: optionalQuickBooksText('privateNote', 4000),
+  paymentReferenceNumber: optionalQuickBooksText('paymentReferenceNumber', 256),
+  paymentMethodId: optionalQuickBooksId('paymentMethodId'),
+  depositAccountId: optionalQuickBooksId('depositAccountId'),
+  invoiceAllocations: quickBooksInvoiceAllocationsSchema.optional(),
+  unapplyOmittedInvoices: z.boolean().optional(),
+})
+
+export const quickBooksUpdateEmployeeBodySchema = quickBooksAuthSchema.extend({
+  employeeId: requiredQuickBooksId('employeeId'),
+  syncToken: requiredQuickBooksId('syncToken'),
+  displayName: optionalQuickBooksText('displayName', 1000),
+  givenName: optionalQuickBooksText('givenName', 1000),
+  familyName: optionalQuickBooksText('familyName', 1000),
+  primaryEmail: optionalQuickBooksText('primaryEmail', 320),
+  primaryPhone: optionalQuickBooksText('primaryPhone', 100),
+  primaryAddress: quickBooksAddressInputSchema.optional(),
+  printOnCheckName: optionalQuickBooksText('printOnCheckName', 1000),
+  billableTime: z.boolean().optional(),
+  activeStatus: quickBooksActiveStatusSchema,
+})
+
+export const quickBooksUpdateItemBodySchema = quickBooksAuthSchema.extend({
+  itemId: requiredQuickBooksId('itemId'),
+  syncToken: requiredQuickBooksId('syncToken'),
+  name: optionalQuickBooksText('name', 1000),
+  incomeAccountId: optionalQuickBooksId('incomeAccountId'),
+  description: optionalQuickBooksText('description', 4000),
+  unitPrice: z.number().optional(),
+  purchaseDescription: optionalQuickBooksText('purchaseDescription', 4000),
+  purchaseCost: z.number().optional(),
+  expenseAccountId: optionalQuickBooksId('expenseAccountId'),
+  taxable: z.boolean().optional(),
+  activeStatus: quickBooksActiveStatusSchema,
+})
+
+export const quickBooksUpdatePurchaseBodySchema = quickBooksAuthSchema.extend({
+  purchaseId: requiredQuickBooksId('purchaseId'),
+  syncToken: requiredQuickBooksId('syncToken'),
+  vendorId: optionalQuickBooksId('vendorId'),
+  transactionDate: optionalQuickBooksDate('transactionDate'),
+  paymentReference: optionalQuickBooksText('paymentReference', 256),
+  privateNote: optionalQuickBooksText('privateNote', 4000),
+})
+
+export const quickBooksUpdatePurchaseOrderBodySchema = quickBooksAuthSchema.extend({
+  purchaseOrderId: requiredQuickBooksId('purchaseOrderId'),
+  syncToken: requiredQuickBooksId('syncToken'),
+  vendorId: optionalQuickBooksId('vendorId'),
+  apAccountId: optionalQuickBooksId('apAccountId'),
+  transactionDate: optionalQuickBooksDate('transactionDate'),
+  documentNumber: optionalQuickBooksText('documentNumber', 256),
+  privateNote: optionalQuickBooksText('privateNote', 4000),
+})
+
+export const quickBooksUpdateVendorBodySchema = quickBooksAuthSchema.extend({
+  vendorId: requiredQuickBooksId('vendorId'),
+  syncToken: requiredQuickBooksId('syncToken'),
+  displayName: optionalQuickBooksText('displayName', 1000),
+  companyName: optionalQuickBooksText('companyName', 1000),
+  givenName: optionalQuickBooksText('givenName', 1000),
+  familyName: optionalQuickBooksText('familyName', 1000),
+  primaryEmail: optionalQuickBooksText('primaryEmail', 320),
+  primaryPhone: optionalQuickBooksText('primaryPhone', 100),
+  billingAddress: quickBooksAddressInputSchema.optional(),
+  printOnCheckName: optionalQuickBooksText('printOnCheckName', 1000),
+  accountNumber: optionalQuickBooksText('accountNumber', 256),
+  vendor1099: z.boolean().optional(),
+  activeStatus: quickBooksActiveStatusSchema,
+})
+
+export const quickBooksUpdateVendorCreditBodySchema = quickBooksAuthSchema.extend({
+  vendorCreditId: requiredQuickBooksId('vendorCreditId'),
+  syncToken: requiredQuickBooksId('syncToken'),
+  vendorId: optionalQuickBooksId('vendorId'),
+  apAccountId: optionalQuickBooksId('apAccountId'),
+  transactionDate: optionalQuickBooksDate('transactionDate'),
+  documentNumber: optionalQuickBooksText('documentNumber', 256),
+  privateNote: optionalQuickBooksText('privateNote', 4000),
+})
+
+export const quickBooksCreateBillPaymentContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/tools/quickbooks/create-bill-payment',
+  body: quickBooksCreateBillPaymentBodySchema,
+  response: quickBooksMutationResponse,
+})
+
+export const quickBooksUpdateBillContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/tools/quickbooks/update-bill',
+  body: quickBooksUpdateBillBodySchema,
+  response: quickBooksMutationResponse,
+})
+
+export const quickBooksUpdateBillPaymentContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/tools/quickbooks/update-bill-payment',
+  body: quickBooksUpdateBillPaymentBodySchema,
+  response: quickBooksMutationResponse,
+})
+
+export const quickBooksUpdateCreditMemoContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/tools/quickbooks/update-credit-memo',
+  body: quickBooksUpdateSalesDocumentBodySchema,
+  response: quickBooksMutationResponse,
+})
+
+export const quickBooksUpdateCustomerPaymentContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/tools/quickbooks/update-customer-payment',
+  body: quickBooksUpdateCustomerPaymentBodySchema,
+  response: quickBooksMutationResponse,
+})
+
+export const quickBooksUpdateEmployeeContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/tools/quickbooks/update-employee',
+  body: quickBooksUpdateEmployeeBodySchema,
+  response: quickBooksMutationResponse,
+})
+
+export const quickBooksUpdateItemContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/tools/quickbooks/update-item',
+  body: quickBooksUpdateItemBodySchema,
+  response: quickBooksMutationResponse,
+})
+
+export const quickBooksUpdatePurchaseContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/tools/quickbooks/update-purchase',
+  body: quickBooksUpdatePurchaseBodySchema,
+  response: quickBooksMutationResponse,
+})
+
+export const quickBooksUpdatePurchaseOrderContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/tools/quickbooks/update-purchase-order',
+  body: quickBooksUpdatePurchaseOrderBodySchema,
+  response: quickBooksMutationResponse,
+})
+
+export const quickBooksUpdateRefundReceiptContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/tools/quickbooks/update-refund-receipt',
+  body: quickBooksUpdateSalesDocumentBodySchema,
+  response: quickBooksMutationResponse,
+})
+
+export const quickBooksUpdateVendorContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/tools/quickbooks/update-vendor',
+  body: quickBooksUpdateVendorBodySchema,
+  response: quickBooksMutationResponse,
+})
+
+export const quickBooksUpdateVendorCreditContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/tools/quickbooks/update-vendor-credit',
+  body: quickBooksUpdateVendorCreditBodySchema,
+  response: quickBooksMutationResponse,
+})
+
+export type QuickBooksCreateBillPaymentBody = ContractBody<
+  typeof quickBooksCreateBillPaymentContract
+>
+export type QuickBooksUpdateBillBody = ContractBody<typeof quickBooksUpdateBillContract>
+export type QuickBooksUpdateBillPaymentBody = ContractBody<
+  typeof quickBooksUpdateBillPaymentContract
+>
+export type QuickBooksUpdateCreditMemoBody = ContractBody<typeof quickBooksUpdateCreditMemoContract>
+export type QuickBooksUpdateCustomerPaymentBody = ContractBody<
+  typeof quickBooksUpdateCustomerPaymentContract
+>
+export type QuickBooksUpdateEmployeeBody = ContractBody<typeof quickBooksUpdateEmployeeContract>
+export type QuickBooksUpdateItemBody = ContractBody<typeof quickBooksUpdateItemContract>
+export type QuickBooksUpdatePurchaseBody = ContractBody<typeof quickBooksUpdatePurchaseContract>
+export type QuickBooksUpdatePurchaseOrderBody = ContractBody<
+  typeof quickBooksUpdatePurchaseOrderContract
+>
+export type QuickBooksUpdateRefundReceiptBody = ContractBody<
+  typeof quickBooksUpdateRefundReceiptContract
+>
+export type QuickBooksUpdateVendorBody = ContractBody<typeof quickBooksUpdateVendorContract>
+export type QuickBooksUpdateVendorCreditBody = ContractBody<
+  typeof quickBooksUpdateVendorCreditContract
+>
+export type QuickBooksMutationOperationResponse = ContractJsonResponse<
+  typeof quickBooksUpdateVendorContract
+>