Some checks are pending
Bidi Control Character Guard / bidi-control-guard (push) Waiting to run
Circular Dependency Check / Check for new circular dependencies (push) Waiting to run
Citus Migration Smoke / Combined migrations on single-node Citus (push) Waiting to run
E2E Fresh Install Tests / fresh-install-e2e (push) Waiting to run
ext-v2 guardrails / Run ext-v2 guard and ESLint (push) Waiting to run
Integration Tests / Check for relevant changes (push) Waiting to run
Integration Tests / ${{ (github.event_name == 'schedule' || github.event.inputs.suite == 'full') && 'Full integration suite' || 'Tier-1 integration subset' }} (push) Blocked by required conditions
Mobile checks / Mobile lint + typecheck (push) Waiting to run
Mobile checks / Mobile unit tests (push) Waiting to run
Mobile checks / Mobile dependency audit (report) (push) Waiting to run
Mobile checks / Mobile reproducibility checks (push) Waiting to run
Secrets guard (env backups) / Ensure no tracked env backup files (push) Waiting to run
Temporal Readiness / fast-readiness (push) Waiting to run
Temporal Readiness / docker-parity (push) Waiting to run
TypeScript Type Check / Nx affected typecheck (push) Waiting to run
Unit Tests / Skipped-test budget (push) Waiting to run
Unit Tests / Nx affected unit tests (push) Waiting to run
Unit Tests / Server unit coverage (informational) (push) Waiting to run
Validate Tenant Management Schema / Check for relevant changes (push) Waiting to run
Validate Tenant Management Schema / Validate Tenant Management Schema (push) Blocked by required conditions
EE Workflows Build Guard / ee-workflows-build-guard (push) Waiting to run
Excluded: .git, node_modules, secrets/, compose.env, assemblyscript tgz Source: /opt/alga-psa on psa.joliet.tech
5.0 KiB
5.0 KiB
Scratchpad — QBO client migration off node-quickbooks
- Plan slug:
qbo-client-migration-off-node-quickbooks - Created:
2026-02-06
What This Is
Keep a lightweight, continuously-updated log of discoveries and decisions made while implementing this plan.
Prefer short bullets. Append new entries as you learn things, and also update earlier notes when a decision changes or an open question is resolved.
Decisions
- (2026-02-06) Primary migration target is an internal REST-based QBO client inside
QboClientService, not another community wrapper. Rationale: we only use a narrow operation set and can remove the largest dependency risk surface fastest. - (2026-02-06) Execute in two commits/batches: Batch 1 parity implementation + compile/typecheck validation, Batch 2 dependency removal + lockfile/audit verification.
- (2026-02-06) Per user instruction, skip new test authoring/execution for now and validate via typechecks/compiles only.
- (2026-02-06) Batch 2 removes
node-quickbooksfrom bothpackages/integrationsandservermanifests/lockfiles because both declarations contributed risk even though runtime usage had already been removed.
Discoveries / Constraints
- (2026-02-06) Current
node-quickbooksusage is concentrated inpackages/integrations/src/lib/qbo/qboClientService.ts; app call sites are mostlyqboActions.tsandquickBooksCompanyAdapter.ts. - (2026-02-06) Existing behavior to preserve includes:
query,create,update,read,findCustomerByDisplayName,createOrUpdateCustomer, and token refresh with tenant secret updates. - (2026-02-06)
node-quickbookslatest npm version is2.0.47(modified2025-12-06) and includesrequest@2.88.0in dependencies. - (2026-02-06)
quickbooks-node-promiselatest npm version is3.3.14(modified2025-02-03). It is a possible fallback option but not selected as primary path. - (2026-02-06)
intuit-oauthlatest npm version is4.2.2(modified2025-11-10) and can remain relevant for OAuth flows, but this migration targets data API calls in client service. - (2026-02-06)
server/package.jsonalso declaresnode-quickbookseven though no active imports were found in server source; batch 2 should remove this as part of dependency cleanup. - (2026-02-06) After lockfile cleanup,
npm ls node-quickbooks --allreturns empty at both monorepo root and server package.
Commands / Runbooks
- (2026-02-06) Find QBO usage surface:
rg -n "quickbooks|node-quickbooks|intuit|qbo" packages/integrations/src/lib/qbo/qboClientService.ts packages/integrations/src/actions/qboActions.ts packages/billing/src/services/companySync/adapters/quickBooksCompanyAdapter.ts packages/integrations/package.json
- (2026-02-06) Inspect npm package metadata:
npm view node-quickbooks version time.modified repository.url dependencies --jsonnpm view quickbooks-node-promise version time.modified repository.url dependencies --jsonnpm view intuit-oauth version time.modified repository.url dependencies --json
- (2026-02-06) Inspect repo activity quick check:
curl -s https://api.github.com/repos/mcohen01/node-quickbooks | rg -n '"pushed_at"|"open_issues_count"'curl -s https://api.github.com/repos/pbrink231/quickbooks-node-promise | rg -n '"pushed_at"|"open_issues_count"'
- (2026-02-06) Validate compile/typecheck only (no tests):
npm -w packages/integrations run typechecknpm -w packages/billing run typechecknpm -w server run typecheck
- (2026-02-06) Remove vulnerable dependency entries and refresh lockfiles:
npm uninstall -w packages/integrations node-quickbooks --legacy-peer-depsnpm uninstall -w server node-quickbooks --legacy-peer-depsnpm --prefix server uninstall node-quickbooks --legacy-peer-depsnpm install --package-lock-only --legacy-peer-depsnpm prune --legacy-peer-deps
- (2026-02-06) Verify dependency removal:
npm ls node-quickbooks --all || truenpm --prefix server ls node-quickbooks --all || true
Links / References
- Plan files:
ee/docs/plans/2026-02-06-qbo-client-migration-off-node-quickbooks/PRD.mdee/docs/plans/2026-02-06-qbo-client-migration-off-node-quickbooks/features.jsonee/docs/plans/2026-02-06-qbo-client-migration-off-node-quickbooks/tests.json
- Key code:
packages/integrations/src/lib/qbo/qboClientService.tspackages/integrations/src/actions/qboActions.tspackages/billing/src/services/companySync/adapters/quickBooksCompanyAdapter.ts
- External packages:
https://www.npmjs.com/package/node-quickbookshttps://www.npmjs.com/package/quickbooks-node-promisehttps://www.npmjs.com/package/intuit-oauthhttps://github.com/mcohen01/node-quickbookshttps://github.com/pbrink231/quickbooks-node-promisehttps://github.com/intuit/oauth-jsclient
Open Questions
- Do we keep a temporary fallback path to legacy SDK for one release, or hard-cut to REST implementation immediately?
- Should update payloads enforce sparse update semantics globally?
- Is explicit
minorversionsupport required now, or can it be deferred?