@oomol-lab/open-connector 1.6.0 → 1.6.2

package/src/providers/oracle_cloud/actions.js

@@ -48,6 +48,7 @@ const pagination = { limit, page };
 export const oracleCloudActions = [
     defineProviderAction(service, {
         name: "list_instances",
+        operationType: "read",
         description: "List OCI compute instances in a compartment.",
         inputSchema: input("Instance filters.", {
             compartmentId,
@@ -69,6 +70,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "get_instance",
+        operationType: "read",
         description: "Get a compute instance by OCID.",
         inputSchema: s.requiredObject("Instance lookup.", { instanceId }),
         outputSchema: entityOutput("instance"),
@@ -76,6 +78,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "launch_instance",
+        operationType: "write",
         description: "Launch a compute instance from an image in a subnet.",
         inputSchema: input("Instance launch details.", {
             compartmentId,
@@ -92,12 +95,14 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "terminate_instance",
+        operationType: "destructive",
         description: "Permanently terminate a compute instance. This destructive operation cannot be undone.",
         inputSchema: s.requiredObject("Instance termination.", { instanceId }),
         outputSchema: responseOutput("Instance termination response."),
     }),
     defineProviderAction(service, {
         name: "update_instance",
+        operationType: "write",
         description: "Update flexible shape resources for an instance; OCI may restart the instance.",
         inputSchema: input("Instance shape update.", {
             instanceId,
@@ -108,6 +113,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "list_images",
+        operationType: "read",
         description: "List compute images, optionally filtered by operating system.",
         inputSchema: input("Image filters.", {
             compartmentId,
@@ -119,12 +125,14 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "get_image",
+        operationType: "read",
         description: "Get a compute image by OCID.",
         inputSchema: s.requiredObject("Image lookup.", { imageId: ocid("Image OCID.") }),
         outputSchema: entityOutput("image"),
     }),
     defineProviderAction(service, {
         name: "instance_action",
+        operationType: "read",
         description: "Perform one of the instance actions exposed by Oracle's official Compute MCP server.",
         inputSchema: s.requiredObject("Instance action.", {
             instanceId,
@@ -135,6 +143,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "list_vnic_attachments",
+        operationType: "read",
         description: "List VNIC attachments in a compartment, optionally for one instance.",
         inputSchema: input("VNIC attachment filters.", { compartmentId, instanceId, ...pagination }, [
             "compartmentId",
@@ -147,6 +156,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "get_vnic_attachment",
+        operationType: "read",
         description: "Get a VNIC attachment by OCID.",
         inputSchema: s.requiredObject("VNIC attachment lookup.", {
             vnicAttachmentId: ocid("VNIC attachment OCID."),
@@ -155,6 +165,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "list_vcns",
+        operationType: "read",
         description: "List virtual cloud networks in a compartment.",
         inputSchema: input("VCN filters.", { compartmentId, ...pagination }, ["compartmentId", "limit", "page"]),
         outputSchema: listOutput("vcns"),
@@ -162,18 +173,21 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "get_vcn",
+        operationType: "read",
         description: "Get a virtual cloud network by OCID.",
         inputSchema: s.requiredObject("VCN lookup.", { vcnId: ocid("VCN OCID.") }),
         outputSchema: entityOutput("vcn"),
     }),
     defineProviderAction(service, {
         name: "delete_vcn",
+        operationType: "destructive",
         description: "Permanently delete an empty VCN. This is destructive.",
         inputSchema: s.requiredObject("VCN deletion.", { vcnId: ocid("VCN OCID.") }),
         outputSchema: responseOutput("VCN deletion response."),
     }),
     defineProviderAction(service, {
         name: "create_vcn",
+        operationType: "write",
         description: "Create a virtual cloud network.",
         inputSchema: input("VCN creation.", {
             compartmentId,
@@ -184,6 +198,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "list_subnets",
+        operationType: "read",
         description: "List subnets in a compartment, optionally filtered by VCN.",
         inputSchema: input("Subnet filters.", { compartmentId, vcnId: ocid("VCN OCID."), ...pagination }, [
             "compartmentId",
@@ -195,12 +210,14 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "get_subnet",
+        operationType: "read",
         description: "Get a subnet by OCID.",
         inputSchema: s.requiredObject("Subnet lookup.", { subnetId: ocid("Subnet OCID.") }),
         outputSchema: entityOutput("subnet"),
     }),
     defineProviderAction(service, {
         name: "create_subnet",
+        operationType: "write",
         description: "Create a subnet in a VCN.",
         inputSchema: input("Subnet creation.", {
             vcnId: ocid("VCN OCID."),
@@ -212,6 +229,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "list_security_lists",
+        operationType: "read",
         description: "List security lists in a compartment, optionally filtered by VCN.",
         inputSchema: input("Security list filters.", { compartmentId, vcnId: ocid("VCN OCID."), ...pagination }, [
             "compartmentId",
@@ -223,6 +241,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "get_security_list",
+        operationType: "read",
         description: "Get a security list by OCID.",
         inputSchema: s.requiredObject("Security list lookup.", {
             securityListId: ocid("Security list OCID."),
@@ -231,6 +250,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "list_network_security_groups",
+        operationType: "read",
         description: "List network security groups, optionally filtered by VCN or VLAN.",
         inputSchema: input("Network security group filters.", {
             compartmentId,
@@ -242,6 +262,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "get_network_security_group",
+        operationType: "read",
         description: "Get a network security group by OCID.",
         inputSchema: s.requiredObject("Network security group lookup.", {
             networkSecurityGroupId: ocid("Network security group OCID."),
@@ -250,18 +271,21 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "get_vnic",
+        operationType: "read",
         description: "Get a VNIC and its assigned IP addresses by OCID.",
         inputSchema: s.requiredObject("VNIC lookup.", { vnicId: ocid("VNIC OCID.") }),
         outputSchema: entityOutput("vnic"),
     }),
     defineProviderAction(service, {
         name: "list_alarms",
+        operationType: "read",
         description: "List Monitoring alarms in a compartment.",
         inputSchema: input("Alarm filters.", { compartmentId, ...pagination }, ["compartmentId", "limit", "page"]),
         outputSchema: listOutput("alarms"),
     }),
     defineProviderAction(service, {
         name: "list_metric_definitions",
+        operationType: "read",
         description: "List available OCI Monitoring metric definitions.",
         inputSchema: input("Metric definition filters.", {
             compartmentId,
@@ -285,6 +309,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "get_metrics_data",
+        operationType: "read",
         description: "Retrieve aggregated OCI Monitoring metric data using an MQL expression.",
         inputSchema: input("Metric query.", {
             compartmentId,
@@ -300,6 +325,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "list_compartments",
+        operationType: "read",
         description: "List child compartments, optionally traversing the tenancy subtree.",
         inputSchema: input("Compartment filters.", {
             compartmentId,
@@ -315,30 +341,35 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "get_tenancy",
+        operationType: "read",
         description: "Get a tenancy by OCID.",
         inputSchema: s.requiredObject("Tenancy lookup.", { tenancyId: ocid("Tenancy OCID.") }),
         outputSchema: entityOutput("tenancy"),
     }),
     defineProviderAction(service, {
         name: "list_availability_domains",
+        operationType: "read",
         description: "List availability domains accessible from a compartment or tenancy.",
         inputSchema: input("Availability domain lookup.", { compartmentId }, ["compartmentId"]),
         outputSchema: listOutput("availabilityDomains"),
     }),
     defineProviderAction(service, {
         name: "get_current_tenancy",
+        operationType: "read",
         description: "Get the tenancy configured on this connection.",
         inputSchema: s.object("No input.", {}),
         outputSchema: entityOutput("tenancy"),
     }),
     defineProviderAction(service, {
         name: "get_current_user",
+        operationType: "read",
         description: "Get the IAM user configured on this connection.",
         inputSchema: s.object("No input.", {}),
         outputSchema: entityOutput("user"),
     }),
     defineProviderAction(service, {
         name: "get_compartment_by_name",
+        operationType: "read",
         description: "Find a direct child compartment by exact name.",
         inputSchema: s.requiredObject("Compartment name lookup.", {
             name: s.nonEmptyString("Exact compartment name."),
@@ -351,12 +382,14 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "list_subscribed_regions",
+        operationType: "read",
         description: "List regions to which a tenancy is subscribed.",
         inputSchema: input("Region subscription lookup.", { tenancyId: ocid("Tenancy OCID.") }, ["tenancyId"]),
         outputSchema: listOutput("regions"),
     }),
     defineProviderAction(service, {
         name: "run_instance_agent_command",
+        operationType: "write",
         description: "Run a shell or batch script through Oracle Cloud Agent. The script executes on the target host with the agent service account's privileges.",
         inputSchema: input("Agent command.", {
             compartmentId,
@@ -370,6 +403,7 @@ export const oracleCloudActions = [
     }),
     defineProviderAction(service, {
         name: "list_instance_agent_command_executions",
+        operationType: "read",
         description: "List Oracle Cloud Agent command executions for a compute instance.",
         inputSchema: input("Agent command execution filters.", { compartmentId, instanceId, ...pagination }, [
             "compartmentId",

package/src/providers/orimon/executors.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+export declare const executors: ProviderExecutors;
+export declare const proxy: ProviderProxyExecutor;
+export declare const credentialValidators: CredentialValidators;

package/src/providers/orimon/executors.js

@@ -0,0 +1,80 @@
+import { randomUUID } from "node:crypto";
+import { optionalRecord, optionalString } from "../../core/cast.js";
+import { defineApiKeyProviderExecutors, defineProviderProxy, requiredInputString, requiredResponseRecord, runProviderRequest, providerUserAgent, ProviderRequestError, } from "../provider-runtime.js";
+const orimonApiBaseUrl = "https://channel-connector.orimon.ai/orimon/v1";
+const orimonMessagePath = "/conversation/api/message";
+export const executors = defineApiKeyProviderExecutors("orimon", {
+    async send_message(input, context) {
+        const tenantId = requiredInputString(input.tenantId, "tenantId");
+        return requestOrimonJson({
+            apiKey: context.apiKey,
+            fetcher: context.fetcher,
+            signal: context.signal,
+            body: {
+                type: "message",
+                info: {
+                    psid: optionalString(input.psid)?.trim() || `${randomUUID()}_${tenantId}`,
+                    sender: "user",
+                    tenantId,
+                    platformName: "web",
+                },
+                message: {
+                    id: optionalString(input.messageId)?.trim() || randomUUID(),
+                    type: "text",
+                    payload: { text: requiredInputString(input.message, "message") },
+                },
+            },
+        });
+    },
+}, { skipDnsValidation: true });
+export const proxy = defineProviderProxy({
+    service: "orimon",
+    baseUrl: orimonApiBaseUrl,
+    auth: { type: "api_key_authorization", prefix: "apiKey " },
+    skipDnsValidation: true,
+});
+export const credentialValidators = {
+    async apiKey() {
+        return {
+            profile: { accountId: "orimon", displayName: "Orimon API Key" },
+            metadata: { apiBaseUrl: orimonApiBaseUrl, validationMode: "local_non_empty_key" },
+        };
+    },
+};
+async function requestOrimonJson(options) {
+    return runProviderRequest({ label: "Orimon", signal: options.signal }, async (signal) => {
+        const response = await options.fetcher(new URL(`${orimonApiBaseUrl}${orimonMessagePath}`), {
+            method: "POST",
+            headers: {
+                accept: "application/json",
+                authorization: `apiKey ${options.apiKey}`,
+                "content-type": "application/json",
+                "user-agent": providerUserAgent,
+            },
+            body: JSON.stringify(options.body),
+            signal,
+        });
+        const text = await response.text();
+        const payload = parseJsonObject(text);
+        if (!response.ok) {
+            throw createOrimonError(response.status, payload, text);
+        }
+        return requiredResponseRecord(payload, "Orimon response");
+    });
+}
+function parseJsonObject(text) {
+    if (!text.trim()) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function createOrimonError(status, payload, fallback) {
+    const record = optionalRecord(payload);
+    const message = optionalString(record?.message) ?? optionalString(record?.error) ?? fallback.trim();
+    return new ProviderRequestError(status, message || `Orimon request failed with status ${status}`, undefined, "provider_error");
+}

package/src/providers/outlook/microsoft-graph.js

@@ -41,12 +41,14 @@ export async function microsoftGraphJson(pathOrUrl, options) {
     }));
 }
 function buildMicrosoftGraphUrl(pathOrUrl, query, allowNextLink) {
-    const absolute = /^https?:\/\//iu.test(pathOrUrl);
+    const normalizedPathOrUrl = pathOrUrl.toLowerCase();
+    const absolute = normalizedPathOrUrl.startsWith("https://") || normalizedPathOrUrl.startsWith("http://");
+    const requiresNextLinkValidation = absolute || pathOrUrl.startsWith("/");
     const url = absolute ? new URL(pathOrUrl) : new URL(pathOrUrl, graphBaseUrl);
     if (url.origin !== graphOrigin || url.protocol !== "https:") {
         throw new ProviderRequestError(400, "Microsoft Graph URL must target https://graph.microsoft.com");
     }
-    if (absolute && (!url.pathname.startsWith("/v1.0/") || !allowNextLink?.(url.pathname))) {
+    if (requiresNextLinkValidation && (!url.pathname.startsWith("/v1.0/") || !allowNextLink?.(url.pathname))) {
         throw new ProviderRequestError(400, "nextLink does not target an allowed Microsoft Graph endpoint");
     }
     setSearchParams(url, query ?? {});

package/src/providers/paperless_ngx/actions-documents.js

@@ -297,6 +297,7 @@ const getTaskFollowUp = "paperless_ngx.get_task";
 export const paperlessNgxDocumentActions = [
     defineProviderAction(service, {
         name: "list_documents",
+        operationType: "read",
         description: "List or search documents visible to the connected user, 25 per page by default. Filters mirror the Paperless-ngx query parameters: id, title, archive serial number, dates, correspondent, document type, storage path, tags, owner, custom fields, MIME type and content lookups can be combined; anything not modelled goes into additional_filters. query, text, title_search and more_like_id run a search-index query instead, returning results with __search_hit__ ordered by relevance, and only one of them may be used per call. Only root documents are listed; file versions appear inside each document's versions array. Requires the view_document permission.",
         requiredScopes: [],
         inputSchema: listDocumentsInputSchema,
@@ -304,6 +305,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "get_document",
+        operationType: "read",
         description: "Get one document with its metadata, tags, custom fields, notes, file versions and duplicate_documents (other documents sharing the same checksum). content holds the extracted text of the latest version unless version selects another one. Requires the view_document permission and view access to the document.",
         requiredScopes: [],
         inputSchema: getDocumentInputSchema,
@@ -311,6 +313,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "update_document",
+        operationType: "write",
         description: "Partially update a document: title, content, correspondent, document type, storage path, tags, creation date, archive serial number, custom fields, inbox tag removal, owner and object permissions. Only the provided fields are sent (PATCH); tags and custom_fields replace the whole list. Changing owner or set_permissions requires being the owner or a superuser. The response carries the full permissions object. Requires the change_document permission and change access to the document.",
         requiredScopes: [],
         inputSchema: updateDocumentInputSchema,
@@ -318,6 +321,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "delete_document",
+        operationType: "destructive",
         description: "Move a document and all of its file versions to the trash. Trashed documents stay restorable until the configured trash delay (30 days by default) expires and are removed from the search index immediately. Requires the delete_document permission and delete access to the document.",
         requiredScopes: [],
         inputSchema: s.object("The document to delete.", { id: documentIdField }),
@@ -325,6 +329,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "get_document_root",
+        operationType: "read",
         description: "Resolve the root document of any document id, including ids of file versions and trashed documents. For a root document the answer is its own id. Requires view access to the root document.",
         requiredScopes: [],
         inputSchema: s.object("The document or version to resolve.", {
@@ -336,6 +341,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "get_document_metadata",
+        operationType: "read",
         description: "Get file-level metadata of a document: checksums, sizes, MIME type, media file names, whether an archived PDF exists, parser metadata (such as PDF info and XMP fields) of the original and archived files, and the detected content language. Reads the latest version unless version is given. Requires view access to the document.",
         requiredScopes: [],
         inputSchema: s.object("The document whose metadata to read.", { id: documentIdField, version: versionQueryInputField }, { optional: ["version"] }),
@@ -343,6 +349,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "get_document_suggestions",
+        operationType: "read",
         description: "Get correspondent, tag, document type, storage path and date suggestions for a document from the matching rules and the trained classifier. Results are cached until the document or classifier changes. Requires change access to the document (403 otherwise).",
         requiredScopes: [],
         inputSchema: s.object("The document to get suggestions for.", { id: documentIdField }),
@@ -350,6 +357,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "get_document_ai_suggestions",
+        operationType: "read",
         description: "Ask the configured language model for a title, tags, correspondent, document type, storage path and dates for a document. Existing objects the model picked are returned as ids, new names it proposed are returned separately. Requires AI to be enabled on the instance: otherwise Paperless-ngx answers 400 AI is required for this feature, an invalid AI configuration yields 400 and a model timeout yields 503. The call blocks while the model answers, and requires change access to the document.",
         requiredScopes: [],
         inputSchema: s.object("The document to get AI suggestions for.", { id: documentIdField }),
@@ -357,6 +365,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "download_document",
+        operationType: "read",
         description: "Download the file of a document and hand it back as a local transit file. By default the archived PDF is served when it exists, otherwise the original upload; original=true always serves the original. The preview endpoint of Paperless-ngx serves exactly the same bytes with an inline disposition, so it is not exposed as a separate action. Works for trashed documents and file versions. Requires view access to the document; files above 200 MiB are rejected.",
         requiredScopes: [],
         inputSchema: downloadDocumentInputSchema,
@@ -364,6 +373,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "get_document_thumbnail",
+        operationType: "read",
         description: "Download the WebP thumbnail of a document (or of one of its file versions) and hand it back as a local transit file. Requires view access to the document.",
         requiredScopes: [],
         inputSchema: s.object("The document whose thumbnail to download.", { id: documentIdField, version: versionQueryInputField }, { optional: ["version"] }),
@@ -371,6 +381,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "list_document_notes",
+        operationType: "read",
         description: "List the notes attached to a document, newest first, each with its author. Requires the view_note permission and view access to the document.",
         requiredScopes: [],
         inputSchema: s.object("The document whose notes to list.", { id: documentIdField }),
@@ -378,6 +389,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "add_document_note",
+        operationType: "write",
         description: "Add a note to a document on behalf of the connected user and return the complete note list. Also bumps the document's modified timestamp and re-indexes it. Requires the add_note permission and change access to the document.",
         requiredScopes: [],
         inputSchema: s.object("The note to add.", {
@@ -388,6 +400,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "delete_document_note",
+        operationType: "destructive",
         description: "Delete one note from a document and return the remaining notes. Requires the delete_note permission and change access to the document; a note id that does not belong to the document yields 404.",
         requiredScopes: [],
         inputSchema: s.object("The note to delete.", {
@@ -398,6 +411,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "list_document_share_links",
+        operationType: "read",
         description: "List the share links of a document that have not expired yet, newest first. Requires change access to the document (Paperless-ngx treats reading share links as a sharing operation).",
         requiredScopes: [],
         inputSchema: s.object("The document whose share links to list.", { id: documentIdField }),
@@ -407,6 +421,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "get_document_history",
+        operationType: "read",
         description: "Get the audit trail of a document: every logged create, update, delete and access entry for the document and its custom field values, newest first, with the changed fields and the acting user. Requires the audit log to be enabled on the instance (PAPERLESS_AUDIT_LOG_ENABLED, otherwise 400 Audit log is disabled), the auditlog.view_logentry permission, and the connected user must own the document, be a superuser, or the document must be unowned.",
         requiredScopes: [],
         inputSchema: s.object("The document whose history to read.", { id: documentIdField }),
@@ -416,6 +431,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "email_document",
+        operationType: "write",
         description: "Send one document as an email attachment through the mail server configured on the Paperless-ngx instance. The archived PDF is attached when it exists unless use_archive_version is false. Paperless-ngx routes this through its collection email endpoint with a single document id. Requires the view_document permission, view access to the document and a configured outgoing mail server (otherwise a 500 Error emailing documents).",
         requiredScopes: [],
         inputSchema: s.object("The document to email and the message to send.", { id: documentIdField, ...emailInputFields }, { optional: ["use_archive_version"] }),
@@ -423,6 +439,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "email_documents",
+        operationType: "write",
         description: "Send several documents as attachments of one email through the mail server configured on the Paperless-ngx instance. Archived PDFs are attached when they exist unless use_archive_version is false. Requires the view_document permission, view access to every document (403 otherwise) and a configured outgoing mail server (otherwise a 500 Error emailing documents).",
         requiredScopes: [],
         inputSchema: s.object("The documents to email and the message to send.", {
@@ -433,6 +450,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "update_document_version",
+        operationType: "write",
         description: "Upload a new file version for a document. The connector reads the supplied local transit file and posts it as multipart form field document; Paperless-ngx consumes it in the background as a new version of the root document, keeping title, tags and other metadata shared. Returns the Celery task id to poll with get_task. Requires the change_document permission and change access to the root document; unsupported file types are rejected with 400.",
         requiredScopes: [],
         asyncLifecycle: {
@@ -450,6 +468,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "delete_document_version",
+        operationType: "destructive",
         description: "Permanently delete one non-root file version of a document. The root (original) version cannot be deleted this way; delete the document instead (400 otherwise). Requires delete access to the root document.",
         requiredScopes: [],
         inputSchema: s.object("The version to delete.", {
@@ -462,6 +481,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "update_document_version_label",
+        operationType: "write",
         description: "Set or clear the label of one file version of a document, including the root version. Requires change access to the root document.",
         requiredScopes: [],
         inputSchema: s.object("The version and its new label.", {
@@ -473,6 +493,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "get_next_asn",
+        operationType: "read",
         description: "Get the next free archive serial number: the highest ASN currently in use plus one, or 1 when none is assigned. Trashed documents keep their ASN reserved.",
         requiredScopes: [],
         inputSchema: emptyInputSchema,
@@ -482,6 +503,7 @@ export const paperlessNgxDocumentActions = [
     }),
     defineProviderAction(service, {
         name: "upload_document",
+        operationType: "write",
         description: "Upload a file for consumption as a new document. The connector reads the supplied local transit file (at most 100 MiB) and posts it as multipart form field document together with the optional title, creation date, correspondent, document type, storage path, tags, archive serial number and custom field values. Paperless-ngx sniffs the file type from the bytes and rejects unsupported types with 400; consumption (OCR, matching, workflows) runs in the background, so the action returns the Celery task id to poll with get_task, whose result_data.document_id identifies the new document once it succeeded. The connected user becomes the owner. Requires the add_document permission.",
         requiredScopes: [],
         asyncLifecycle: {