[helpcodeai]

Summary

Paying Cloud workspaces keep a hand-built connector next to our catalog adapter for the parts the adapter lacks. This adds those tools to the catalog, modelled on the customers' own tool definitions that have successful calls in production, checked against the vendor docs, and live-checked read-only with the customers' existing credentials where a read tool was involved.

Why, from tool_invocations (successful calls of the hand-built connectors):

• OTTO Ads: 2,437 ok in 3 days (keywords list 1,208, change requests 362, targets 519, keyword updates 192).
• Klardaten: 1,601 ok in 14 days (order update 1,178, responsibilities 52, time entries 49, law and IAM reads).
• Lexware Office: 619 ok (delivery note reads 590, delivery note create 10, article updates 8, quotation drafts 6).
• weclapp: 1,528 ok (invoice responsible user 739, order 220, party 132, supply sources 26).
• Sellsy: 591 ok (contact update 524, company archive 50, contact companies 17).
• Fatture in Cloud: 136 ok (e-invoice XML 86).
• eBay Browse 34, Zammad 13, Magento CMS 12, Mollie payment links 3.

Changes

New adapters (519 listed, up from 517)

• otto-ads (de, 20 tools): Sponsored Product Ads campaigns, targets, keywords and bids, change-request polling, SPA reporting (campaign and product KPIs, CSV reports). Separate from otto-market because Ads uses its own OAuth scope advertising-services; adding it to otto-market's scope list would make the token request fail for partner apps without the Ads interface. otto_ads_delete_keywords installs switched off; report requests are POSTs marked read-only (they change nothing, but count against OTTO's 200 reports/24 h).
• ebay-browse (intl, 4 tools, read-only): item search, item, item by legacy id, item group, with an application token (client credentials). ebay-sell needs a seller's user token and covers selling only.

Extended adapters

• klardaten (+16): DATEV Anwalt reads (files, parties, budget, jurisdiction levels, custom fields, reference sheet, expenses, one catalog tool for the 12 reference lists), DATEV users and groups (SCIM, read-only), klardaten_get_order, and three writes installed switched off: klardaten_update_order, klardaten_create_expense_posting, klardaten_set_client_responsibilities. New optional KLARDATEN_PROFILE_ID, sent as x-profile-id on every DATEVconnect call (also the existing passthrough) and left out when empty; the customer sends a profile on every call and Eigenorganisation writes need an EO employee profile.
• lexware-office (+8): get delivery note, delivery note PDF, invoice PDF, create delivery note (draft), create quotation draft, get/create/update article.
• sellsy (+4): get contact, list a contact's companies, edit contact, edit company (partial PUT of the given fields; archive via is_archived).
• weclapp (+6, and 3 lists in weclapp_list_reference_data): weclapp_set_{sales_invoice,sales_order,party}_responsible (single-field shortcuts the customer's AI calls reliably; same request as weclapp_edit_*), add supply source, manufacturer, item group; reference data now lists manufacturer, articleSupplySource, articleItemGroup.
• zammad (+2): edit ticket (state, owner, group, priority, pending time), merge ticket.
• fatture-in-cloud (+2): FatturaPA XML of an issued document, received document detail.
• mollie (+4): list/get payment links, payments of a link, create payment link.
• magento (+8): search/get CMS pages and blocks; create/update page and block installed switched off, no delete. CMS tools always use the all store code ({{MAGENTO_BASE_URL}}/rest/all/V1/..., as the customer's working connector does) so a page written through default is not reassigned to one store view.

New tool names were checked against every tool name in installed connectors of these adapters on Cloud (catalog re-sync matches by name): no collisions.

Verification

Adapter	Tool(s)	How verified
otto-ads	list/get campaigns, list/get targets, list keywords, campaign KPIs, product KPIs	Live, read-only, customer's credentials
otto-ads	report status, download report, get change request	Live route check (structured 404 for an unknown id) + customer's working definition
otto-ads	request campaign/keyword/product report	Customer's working definition (keyword report 3 ok) + docs; not called (quota)
otto-ads	create/update campaign, add targets, update target bids, add/update/delete keywords	Customer's working definition (up to 192 ok) + OTTO docs
ebay-browse	search, get item, by legacy id, item group	Live, read-only, customer's app keys
klardaten	law, IAM and order reads	Customer's working definitions (successful up to today) + DATEVconnect paths. Live: the gateway answers today with DATEV's own DCO10009 (no DATEVconnect licence) for every module, with and without profile, while the diagnostics endpoint answers 200; the customer's last DATEVconnect success was 01:37 UTC today. Not live-verified.
klardaten	update order, expense posting, set responsibilities	Customer's working definitions (1,178 / 49 / 52 ok)
lexware-office	get delivery note, delivery note PDF, invoice PDF, get article	Live, read-only, customer's token
lexware-office	create delivery note, quotation draft, create/update article	Customer's working definitions (10 / 6 / 1 / 8 ok) + docs
sellsy	get contact, list contact companies	Live, read-only
sellsy	edit contact, edit company	Customer's working definitions (524 / 50 ok)
weclapp	user, manufacturer, articleSupplySource, articleItemGroup lists	Live, read-only
weclapp	responsible setters, add supply source/manufacturer/item group	Customer's working definitions (739 / 220 / 132 / 26 / 2 / 1 ok)
zammad	edit ticket, merge ticket	Customer's working definitions (12 / 1 ok) + docs
fatture-in-cloud	e-invoice XML, received document	Live, read-only, customer's token
mollie	list/get payment links, link payments	Live, read-only (both accounts)
mollie	create payment link	Customer's working definition (3 ok) + docs
magento	search/get CMS pages and blocks	Live, read-only, under /rest/all and /rest/default
magento	create/update CMS page and block	Docs only (the customer's writes have no successful call); switched off

Live checks ran inside the Cloud backend container: credentials were decrypted in memory and never printed or stored, only GET requests were sent, only status and response shape were printed, no OAuth refresh token was used (stored access tokens, or a client-credentials token for OTTO, Sellsy and eBay app keys). No write, send or cost-generating call was made with customer credentials.

Commands (all from the repository root unless noted):

• node scripts/validate-adapters.mjs --warn: exit 0; no warnings on new tools (remaining ones on these adapters predate this PR: short descriptions on older Magento/Mollie tools, FIC_COMPANY_ID reference).
• node scripts/regenerate-catalog.mjs: 533 adapters across 15 regions.
• node scripts/adapter-count.mjs --check: OK, 519 adapters (23 keyless, 7951 tools) after updating README×4, glama.json, CITATION.cff, server.json, package.json.
• packages/backend: npm run lint exit 0 (11 pre-existing warnings; two unrelated --fix rewrites reverted), npx tsc --noEmit -p tsconfig.json exit 0, npm test: 737 suites passed, 4 skipped; 22,048 tests passed, 1,540 skipped. No baseline failures.
• Specs: new de/otto-ads.live.spec.ts, intl/ebay-browse.live.spec.ts (RestEngine request tests + live blocks behind RUN_OTTO_ADS_LIVE=1 / RUN_EBAY_BROWSE_LIVE=1); added cases to the klardaten (incl. profile header omitted when empty), lexware-office, sellsy, weclapp, zammad, fatture-in-cloud, mollie and magento specs.

Cloud and self-hosted

Same behaviour in both: these are catalog adapters with no deployment-specific code. New adapters appear in the catalog; existing connectors get the new tools only when the workspace applies the connector update, as with any catalog change. Writes on Klardaten and Magento CMS install switched off. On self-hosted instances the vendors' public hosts must be reachable as before (Zammad and Magento stay on the customer's own host).

Not in this PR

• Fatture in Cloud manual token: the engine already returns a stored accessToken when there is no refresh token, so accessToken: "{{FIC_ACCESS_TOKEN}}" plus optional client vars would work at call time. But the guided setup page always starts the provider sign-in for an oauth_browser adapter, so a token-only install would end on an authorization error. That needs a small setup-flow change (e.g. an env-var flag that skips the sign-in when filled), which is an authentication change to discuss first.
• Klardaten suborder update, Lexware contact update and dunning: the customers defined them but never called them successfully, so nothing proven to build on.

Follow-ups (Matteo decides)

• Website guides: update the tool lists for the extended adapters; otto-ads and ebay-browse need guides in 7 languages.
• Nudge the workspaces with hand-built connectors to the catalog adapters once deployed (OTTO Ads, Klardaten, Lexware ×2, Sellsy, weclapp, Zammad, Fatture in Cloud, Mollie, eBay, Magento). No customer was contacted.
• Klardaten: the customer's DATEV server answers DCO10009 since early today; worth a look before nudging.
• No deploy: not merged, no auto-merge.

Type

• New feature

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable)
• All existing tests pass (npm test)
• This PR has a descriptive title