@desktopaccountingapi/quickbooks-desktop-mcp 0.5.1 → 0.5.3

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## 0.5.3 (2026-10-09)
+
+- Releases publish to npm through trusted publishing (GitHub OIDC) with provenance; no npm token is used. The publish script checks that npm is new enough.
+
+## 0.5.2 (2026-10-09)
+
+- Released in lockstep with the other Desktop Accounting API packages; no entries for this package.
+
 ## 0.5.1 (2026-10-09)
 
 - Released in lockstep with the other Desktop Accounting API packages; no entries for this package.
@@ -10,9 +18,35 @@
 
 - `list_api_endpoints` finds the searches its description suggests: "profit and loss" and "open invoices" now return the report operation and name the matching `reportType` (for example `profit_and_loss_standard`, `open_invoices`). Words match as tokens against the operation name, resource, summary, description, path, parameter names and report types; case, plurals and stop words do not matter, common synonyms count (P&L, A/R, supplier for vendor), and results come best match first. An exact operation or tool name (`qbd.salesOrders.list`, `qbd_sales_orders_list`, `generalSummary`) is found and listed first.
 
-## 0.1.0
+## 0.4.0 (2026-10-08)
+
+- The endpoint catalog follows the API contract: employee responses carry the warning `QBD_PERSONAL_DATA_WITHHELD` for each Social Security number QuickBooks withheld, integration connections report `personalDataAccess`, and a failed passthrough's error `details.requests` lists the status of every qbXML message.
+
+## 0.3.0 (2026-10-08)
+
+- Error results give the error catalog's cause and fixes before the `<untrusted-data>` envelope, so the model follows them; the message and details, which can quote QuickBooks data, stay inside it.
+- A write whose outcome is pending and one whose outcome is unknown get different guidance, and both name the request that keeps running (`details.requestId`) instead of the HTTP call's ID. A read timeout gets a next step, a non-JSON error on a write says to resend only with the same idempotency key, and `Retry-After` is passed on.
+- The endpoint catalog follows the API contract: `qbd.reports.budgetSummary` requires `fiscalYear`, the inventory valuation summary no longer takes `basis` (QuickBooks rejects it), and the `connection.company_file_remarked` webhook event is listed.
+
+## 0.2.1 (2026-10-07)
+
+- The endpoint catalog follows API contract sha256 `b5774d24bc81` (documentation only): `revisionNumber` and `updatedAt` change at most once per second, the status 3261 personal-data fixes, and what item sites return without Advanced Inventory.
+
+## 0.2.0 (2026-10-07)
+
+- QuickBooks data in tool results, and error details that may quote it, is wrapped in an `<untrusted-data>` envelope with a fixed note telling the model not to follow instructions inside it. `<` is escaped, so the data cannot close the envelope.
+- `destructiveHint` marks every write tool except additive ones (creates, and testing or resending a webhook), so clients ask before an update, delete, void, cancel, passthrough, secret rotation or company file reset.
+- Without `--read-only`, the server recognizes a read-only secret key, with a check that changes nothing, and hides the write tools.
+- `--code-allow-http-gets`, Conductor's read-only flag, is accepted as an alias of `--read-only`, and `handleMcpRequest` treats Conductor's `x-stainless-mcp-client-permissions` header as read-only.
+- The endpoint catalog follows the API contract: with `ids` or `refNumbers`, `limit` is ignored (every match comes in one page) instead of rejected.
+
+## 0.1.1 (2026-10-06)
+
+- The README is rewritten: setup for each MCP client, read-only keys, the tools and library use. Its code samples are type-checked against the package before release.
+
+## 0.1.0 (2026-10-06)
 
-First release of `@desktopaccountingapi/quickbooks-desktop-mcp`, generated from API contract sha256 `3d102b7bcecb` (API version 1.0.0, 275 operations).
+First release of `@desktopaccountingapi/quickbooks-desktop-mcp`, generated from API contract sha256 `1cc3058cecb5` (API version 1.0.0, 275 operations).
 
 - Local MCP server over stdio: `npx -y @desktopaccountingapi/quickbooks-desktop-mcp`. Node.js 20 or later on Windows, macOS and Linux; no other runtime and no runtime dependencies.
 - Tools: `list_end_users`, `list_api_endpoints`, `get_api_endpoint_schema`, `invoke_api_endpoint`, `search_docs`; optional one tool per operation with `--resources`.

package/README.md

@@ -6,7 +6,7 @@
 - Writes carry an idempotency key and are never retried blindly. Read-only keys are enforced by the API itself.
 - Runs over stdio with Node.js 20 or later on Windows, macOS and Linux, with no runtime dependencies.
 
-The current version is **0.5.1**. [MCP guide](https://www.desktopaccountingapi.com/docs/guides/mcp/) · [Documentation](https://www.desktopaccountingapi.com/docs/) · [Changelog](CHANGELOG.md) · [Status](https://status.desktopaccountingapi.com)
+The current version is **0.5.3**. [MCP guide](https://www.desktopaccountingapi.com/docs/guides/mcp/) · [Documentation](https://www.desktopaccountingapi.com/docs/) · [Changelog](CHANGELOG.md) · [Status](https://status.desktopaccountingapi.com)
 
 ## Hosted server or local package
 
@@ -37,14 +37,14 @@ Open **Settings > Developer > Edit Config** (`claude_desktop_config.json`) and a
   "mcpServers": {
     "quickbooks-desktop": {
       "command": "npx",
-      "args": ["-y", "@desktopaccountingapi/quickbooks-desktop-mcp@0.5.1"],
+      "args": ["-y", "@desktopaccountingapi/quickbooks-desktop-mcp@0.5.3"],
       "env": { "DAAPI_SECRET_KEY": "sk_live_..." }
     }
   }
 }
 ```
 
-If the file already has an `mcpServers` section, add the `quickbooks-desktop` entry inside it, then restart Claude Desktop. Drop `@0.5.1` from the package name to always run the latest version.
+If the file already has an `mcpServers` section, add the `quickbooks-desktop` entry inside it, then restart Claude Desktop. Drop `@0.5.3` from the package name to always run the latest version.
 
 ### Claude Code
 
@@ -172,8 +172,8 @@ Clients send their own secret key as `Authorization: Bearer sk_...`; the server
 
 ## Versioning and changelog
 
-- The package follows [semantic versioning](https://semver.org/) and is released together with the [Node.js](https://github.com/DesktopAccountingAPI/quickbooks-desktop-node), [Python](https://github.com/DesktopAccountingAPI/quickbooks-desktop-python), [.NET](https://github.com/DesktopAccountingAPI/quickbooks-desktop-dotnet) and [Java](https://github.com/DesktopAccountingAPI/quickbooks-desktop-java) SDKs, with the same version number.
-- It is generated from the Desktop Accounting API contract (sha256 `3d102b7bcecb...` for this release) by the same pipeline as the SDKs.
+- The package follows [semantic versioning](https://semver.org/) and is released together with the [Node.js](https://github.com/DesktopAccountingAPI/quickbooks-desktop-node), [Python](https://github.com/DesktopAccountingAPI/quickbooks-desktop-python), [.NET](https://github.com/DesktopAccountingAPI/quickbooks-desktop-dotnet) and [Java](https://github.com/DesktopAccountingAPI/quickbooks-desktop-java) SDKs, with the same version number. Before 1.0, a minor version may contain breaking changes; they are marked Breaking in the [CHANGELOG](https://github.com/DesktopAccountingAPI/quickbooks-desktop-mcp/blob/main/CHANGELOG.md).
+- It is generated from the Desktop Accounting API contract (sha256 `09aa9517f466...` for this release) by the same pipeline as the SDKs.
 - Every release is listed in [CHANGELOG.md](CHANGELOG.md) and tagged `v<version>` on GitHub.
 
 ## Support

package/dist/catalog.js

@@ -1,5 +1,5 @@
 // Code generated by packages/sdk-generator from packages/mcp/src. DO NOT EDIT.
-// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:3d102b7bcecbf18e72b655745e5c55d641457fab2fd8184b3da643aeb51bb76f
+// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:09aa9517f466027d023798abdf939204d057d808cb4eb15566deed6b960adcec
 // MCP endpoint catalog: a compact, input-only view of the public OpenAPI contract that the MCP
 // tools search, describe and invoke. Built from packages/api-contract/generated/openapi.json by
 // scripts/api-contract.mjs (committed as packages/mcp/generated/catalog.json, drift-checked) and

package/dist/catalog.json

@@ -4,10 +4,6 @@
   {
    "url": "https://api.desktopaccountingapi.com",
    "description": "Production"
-  },
-  {
-   "url": "https://api-staging.desktopaccountingapi.com",
-   "description": "Staging"
   }
  ],
  "endpoints": [
@@ -159,7 +155,7 @@
    "tag": "End users",
    "group": "Platform",
    "summary": "Reset the company file",
-   "description": "Re-binds the connection after the company file was moved or renamed (`mode: path`) or the company itself was renamed (`mode: identity`), which otherwise leaves the connection in `company_file_mismatch` or `QBD_COMPANY_FILE_NOT_FOUND`. Ask the end user to open the correct company file in QuickBooks first. The connection checks the file at the next Web Connector check-in. Queued requests stay queued.",
+   "description": "Re-binds the connection after the company file was moved or renamed (`mode: path`) or the company itself was renamed (`mode: identity`), which otherwise leaves the connection in `company_file_mismatch` or `QBD_COMPANY_FILE_NOT_FOUND`. Ask the end user to open the correct company file in QuickBooks first. The connection checks the file at the next Web Connector check-in. With `mode: identity`, the reset is refused with `409 COMPANY_FILE_RESET_BUSY` while a request is in flight (sent to QuickBooks, not finished): wait for it to finish, then retry. When it goes through, every request queued but not yet sent to QuickBooks is canceled with `REQUEST_CANCELED` (`details.reason: company_file_reset`), so a request accepted for one company file never runs against another; send them again after the reset. Requests already sent keep their usual outcome. With `mode: path`, queued requests stay queued.",
    "write": true,
    "endUser": false,
    "idempotent": true,

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Code generated by packages/sdk-generator from packages/mcp/src. DO NOT EDIT.
-// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:3d102b7bcecbf18e72b655745e5c55d641457fab2fd8184b3da643aeb51bb76f
+// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:09aa9517f466027d023798abdf939204d057d808cb4eb15566deed6b960adcec
 // Local (stdio) MCP server for the Desktop Accounting API.
 //
 //   npx -y @desktopaccountingapi/quickbooks-desktop-mcp [--read-only] [--resources invoices,customers] [--end-user-id eu_...]

package/dist/http.js

@@ -1,5 +1,5 @@
 // Code generated by packages/sdk-generator from packages/mcp/src. DO NOT EDIT.
-// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:3d102b7bcecbf18e72b655745e5c55d641457fab2fd8184b3da643aeb51bb76f
+// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:09aa9517f466027d023798abdf939204d057d808cb4eb15566deed6b960adcec
 // Streamable HTTP transport (MCP 2025-03-26 and later), stateless: each POST carries one JSON-RPC
 // message (or a batch, for 2025-03-26 clients) and is answered with application/json. No server
 // sessions and no server-initiated stream, so GET and DELETE return 405. Web-standard Request and

package/dist/index.js

@@ -1,5 +1,5 @@
 // Code generated by packages/sdk-generator from packages/mcp/src. DO NOT EDIT.
-// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:3d102b7bcecbf18e72b655745e5c55d641457fab2fd8184b3da643aeb51bb76f
+// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:09aa9517f466027d023798abdf939204d057d808cb4eb15566deed6b960adcec
 // Runtime-agnostic MCP server core (no Node-only imports); the tool design is in tools.ts.
 export { buildCatalog, defsFor } from './catalog.js';
 export { handleMcpRequest } from './http.js';

package/dist/key.js

@@ -1,5 +1,5 @@
 // Code generated by packages/sdk-generator from packages/mcp/src. DO NOT EDIT.
-// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:3d102b7bcecbf18e72b655745e5c55d641457fab2fd8184b3da643aeb51bb76f
+// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:09aa9517f466027d023798abdf939204d057d808cb4eb15566deed6b960adcec
 // Local secret-key check (same rule as the API and SDKs, docs/api-conventions.md section 2):
 // `sk_live_`/`sk_test_` + 40 base62 chars, the last 6 being the base62 CRC32 of the first 34.
 // Rejecting a mistyped key locally keeps it from counting against the API's per-IP

package/dist/search.js

@@ -1,5 +1,5 @@
 // Code generated by packages/sdk-generator from packages/mcp/src. DO NOT EDIT.
-// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:3d102b7bcecbf18e72b655745e5c55d641457fab2fd8184b3da643aeb51bb76f
+// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:09aa9517f466027d023798abdf939204d057d808cb4eb15566deed6b960adcec
 // Operation search for list_api_endpoints. Words are matched as tokens (case, plurals and
 // camelCase/snake_case ignored, a word of 5+ letters also matches the start of a longer one)
 // against an operation's name, tag, summary, description, path, query parameter names and the

package/dist/server.js

@@ -1,5 +1,5 @@
 // Code generated by packages/sdk-generator from packages/mcp/src. DO NOT EDIT.
-// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:3d102b7bcecbf18e72b655745e5c55d641457fab2fd8184b3da643aeb51bb76f
+// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:09aa9517f466027d023798abdf939204d057d808cb4eb15566deed6b960adcec
 // Model Context Protocol server core: JSON-RPC 2.0 message handling for the `tools` capability.
 // Transport-independent; stdio.ts and http.ts carry the messages. Implements the lifecycle
 // (initialize with version negotiation, notifications/initialized, ping) plus tools/list and

package/dist/stdio.js

@@ -1,5 +1,5 @@
 // Code generated by packages/sdk-generator from packages/mcp/src. DO NOT EDIT.
-// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:3d102b7bcecbf18e72b655745e5c55d641457fab2fd8184b3da643aeb51bb76f
+// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:09aa9517f466027d023798abdf939204d057d808cb4eb15566deed6b960adcec
 // stdio transport: newline-delimited JSON-RPC on stdin/stdout (MCP specification, "stdio").
 // Only protocol messages go to stdout; diagnostics go to stderr. Pure Node.js (no Deno, no
 // POSIX-only features), so it runs the same on Windows, macOS and Linux.

package/dist/tools.js

@@ -1,5 +1,5 @@
 // Code generated by packages/sdk-generator from packages/mcp/src. DO NOT EDIT.
-// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:3d102b7bcecbf18e72b655745e5c55d641457fab2fd8184b3da643aeb51bb76f
+// Contract: packages/api-contract/generated/openapi.json (OpenAPI 3.1.0) sha256:09aa9517f466027d023798abdf939204d057d808cb4eb15566deed6b960adcec
 // MCP tools over the Desktop Accounting API. Runtime-agnostic (fetch and Web Crypto only), so the
 // same code runs in the hosted Cloudflare Worker (apps/mcp) and the stdio npm package.
 //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desktopaccountingapi/quickbooks-desktop-mcp",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Model Context Protocol (MCP) server for Desktop Accounting API: QuickBooks Desktop for Claude, Cursor, VS Code, Codex and other AI tools.",
   "license": "MIT",
   "author": "Desktop Accounting API",