feat: add attachment upload, list, and download commands

[illumitry-mf]

Summary

Adds attachments sub-commands to the seven resource types that support file attachments via the Xero Accounting API: invoices, credit-notes, bank-transactions, quotes, contacts, accounts, and manual-journals.

Commands added

Each resource gains three new sub-commands following the existing topic/verb pattern:

# Upload a file to a resource
xero invoices attachments upload --invoice-id <ID> --file <path>
xero invoices attachments upload --invoice-id <ID> --file <path> --include-online

# List attachments on a resource
xero invoices attachments list --invoice-id <ID>

# Download an attachment to disk
xero invoices attachments download --invoice-id <ID> --attachment-id <ID>
xero invoices attachments download --invoice-id <ID> --attachment-id <ID> --output ./downloads/

The same three commands are available for credit-notes, bank-transactions, quotes, contacts, accounts, and manual-journals with their respective ID flags.

--include-online is available on invoices and credit-notes upload — makes the attachment visible to the end customer in their online invoice/credit note view.

Note: The Xero Accounting API does not support deleting attachments, so no delete command is included.

Architecture

All API logic lives in a new shared lib src/lib/attachments.ts:

• Dispatch map routes each AttachmentResource type to the correct xero-node SDK method (createInvoiceAttachmentByFileName, getInvoiceAttachments, getInvoiceAttachmentById, etc.)
• Pre-flight validation before any API call: file-exists check, 25MB size limit, supported MIME type check
• Built-in MIME detection for .pdf, .png, .jpg/.jpeg, .gif, .webp, .xml, .csv, .txt — no new npm dependencies
• Download resolves the original filename via a listAttachments call internally, enabling smart --output handling (accepts a file path or directory; defaults to current working directory)

Command files are thin wrappers: parse flags → this.xeroCall → delegate to lib → format output.

Test plan

• 21 new unit tests in test/lib/attachments.test.ts covering MIME detection, file validation (not-found, oversized), uploadAttachment dispatch per resource, listAttachments, and downloadAttachment (including attachment-not-found error)
• All 87 tests pass (npm test)
• TypeScript build is clean (npm run build)
• Smoke tested against live Xero API: invoices attachments list, upload, and download all work end-to-end

🤖 Generated with Claude Code