Xero invoices, quotes, repeating invoices, credit notes, prepayments, overpayments, branding, and payment services. Generated from Xero's official OpenAPI repository at immutable commit e952d0bda3628facbf7afc5990ad6a0e7e77bd1e; the exact xero_accounting.yaml bytes are SHA-256 pinned. Every tenant-scoped call exposes the required Xero-tenant-id as an explicit approval-bound header argument; OAuth credentials, Authorization, and API authority are never caller inputs. Reads are uncached; all mutations are grant-off and require approval every run. JSON responses preserve unsafe integer literals as exact strings. Binary attachment downloads are isolated as file_ref values; binary attachment uploads are explicitly excluded because body_raw is text-only. No work-entity Source is declared because the official response contracts do not guarantee both a mandatory stable identity and a mandatory version field for an honest task, note, or project projection.