vpsnet-mcp 2.6.0 → 2.7.1

package/build/tool-annotations.js

@@ -0,0 +1,770 @@
+export const reviewedAnnotations = {
+    abort_service_file_upload: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Abort one open upload and remove its staging file (the target file is not touched). Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    add_domain_parent_ds: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'domain-registry',
+        why: 'Queue adding public DNSSEC DS records at the parent zone for an owned domain. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to the domain registry or registrar.' },
+    add_network_load_balancer_listener: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Add a listener and optional initial members using currently offered protocol capabilities. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    add_network_load_balancer_member: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Add an attached private server address to the selected listener; backend validates membership in this network. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    add_network_vpn_site_line: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Add line 2 to an IPsec site using the gateway generation and an external X25519 public reveal key. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    apply_dns_template: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Apply a backend-defined DNS template to a native forward zone. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    apply_service_public_firewall: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Send the saved firewall of an owned server to its node again, typically after state not_applied; the rules and the generation do not change. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    attach_network_vpn_gateway: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Attach or move an account VPN to an owned network only when standalone attachment is advertised. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    attach_private_network_port: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Attach an eligible existing owned service to a private network with port_intent_ready=true; omit ipv4 for automatic allocation or pass a fixed usable address. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    attach_public_address_to_network: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Attach an already-paid address to an owned network\'s NAT using the NETWORK generation. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    attach_public_address_to_server: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Attach an owned paid public address to an eligible zero-public-IP server\'s private port. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    attach_public_address_to_server_interface: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Attach an owned paid public address directly to the public interface of a server that has its own public IPv4 (service_id from list_public_address_server_targets with eligible true). Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    attach_service_dns_record: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Point a DNS name at a service in one call: creates an A/AAAA/CNAME record in an owned forward DNS zone using the service\'s own IP (A/AAAA default to the service IP when ip is omitted; the ip, when given, must belong to t Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    bind_network_public_ip: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Bind an already reserved floating public binding to an owned private port when supported. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    browse_restore_files: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Create a persisted asynchronous browse job to list one directory inside a backup point. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    calculate_plan_change: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Preview a plan change. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    cancel_application_action: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Request pre-dispatch cancellation of the exact latest action for one owned managed application. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    cancel_automatic_ssl_subscription: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'certificate-authority',
+        why: 'Cancel an owned Automatic SSL subscription after reading get_automatic_ssl_subscription and list_automatic_ssl_actions. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to a public certificate authority.' },
+    cancel_certificate: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'certificate-authority',
+        why: 'Cancel an eligible pending paid TLS certificate order. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to a public certificate authority.' },
+    cancel_free_certificate: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'certificate-authority',
+        why: 'Cancel an owned pending free TLS certificate request before issuance. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to a public certificate authority.' },
+    cancel_vm_operation: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Request cancellation of this operation through its guest process group or delegated SSH session. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    change_certificate_validation: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'certificate-authority',
+        why: 'Change the validation method for one authorized DNS name on an owned paid TLS certificate order. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to a public certificate authority.' },
+    change_hostname: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Queue a customer-managed hostname change for a Container VPS, VPS, or Cloud VPS. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    change_plan: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Change VPS plan. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    change_rdns: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Set a customer PTR override for an address returned by get_rdns. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    change_root_password: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Change VPS root password. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    change_title: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Change service display title Requires services:manage and a full-access API key. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    check_domain_availability: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'read', world: 'domain-registry',
+        why: 'Check read-only domain availability. Read-only: it returns data and changes nothing (repeating it has no further effect). Open world: it talks to the domain registry or registrar.' },
+    check_network_public_address_reach: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true, effect: 'additive', world: 'public-internet',
+        why: 'Ask again whether an owned public address attached to a server\'s public interface is reachable from the internet, and ask the server\'s own step again (for example after the server agent was started). Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    check_network_vpn_public_access: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Preview the complete VPN public-source lists without applying them. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    clear_rdns: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Clear a customer PTR override for an address returned by get_rdns. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    clone_network_security_group: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Clone an owned group into a new name; use the source group\'s current revision. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    configure_application_access: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Queue an access change for one owned managed application. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    configure_application_resource_thresholds: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Replace the complete optional resource-threshold set and email preference for one owned managed application. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    configure_application_server_routes: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Queue a change of the server routes of one owned Managed Applications server. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    confirm_application_compose_adoption: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Confirm the one-time takeover of an eligible unexpired Compose candidate. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    confirm_domain_register: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'paid', world: 'domain-registry',
+        why: 'Confirm a quoted domain registration and pay from the VPSNet account. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Open world: it talks to the domain registry or registrar.' },
+    confirm_domain_renew: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'paid', world: 'domain-registry',
+        why: 'Confirm a quoted domain renewal and pay from the VPSNet account. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Open world: it talks to the domain registry or registrar.' },
+    confirm_domain_restore: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'paid', world: 'domain-registry',
+        why: 'Confirm a quoted domain restore and pay from the VPSNet account. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Open world: it talks to the domain registry or registrar.' },
+    confirm_domain_transfer: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'paid', world: 'domain-registry',
+        why: 'Confirm a quoted domain transfer and pay from the VPSNet account. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Open world: it talks to the domain registry or registrar.' },
+    confirm_service_order: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Purchase the exact previously quoted server from VPSnet balance after explicit customer approval of its final EUR total and billing period. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    console_service: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Request a legacy or Cloud VPS console session and return its tracking event ID. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    create_application_recipe: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'additive', world: 'public-internet',
+        why: 'Resolve image tags from their registries, validate the resulting digest-pinned Compose definition, and freeze that exact definition as the first immutable customer-owned recipe revision. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    create_application_recipe_revision: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'additive', world: 'public-internet',
+        why: 'Resolve image tags from their registries, validate the resulting digest-pinned Compose definition, and freeze that exact definition as a later immutable customer-owned recipe revision. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    create_backup: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Create a new backup. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    create_ddns_token: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true, effect: 'additive', world: 'public-dns',
+        why: 'Create a narrow DNS updater token for one hostname/pattern inside a verified customer-owned zone. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it publishes to or queries public DNS.' },
+    create_dns_zone: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Create a native or secondary forward DNS zone in the authenticated VPSnet account. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    create_domain_contact: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Create a domain contact for future domain registration/transfer. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    create_domain_glue_record: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'domain-registry',
+        why: 'Queue creating or updating a same-domain nameserver IP record at the registrar for an owned domain. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to the domain registry or registrar.' },
+    create_firecracker_snapshot: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Create a temporary snapshot of a Firecracker VPS. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    create_free_certificate: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'additive', world: 'certificate-authority',
+        why: 'Create one idempotent no-cost public DV certificate request after preflight. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it talks to a public certificate authority.' },
+    create_function: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'additive', world: 'arbitrary-code',
+        why: 'Create a Firecracker Function. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it runs customer code or commands that can reach any internet address.' },
+    create_network_security_group: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Create a named allow-rule set. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    create_network_vpn_peer: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'additive', world: 'public-internet',
+        why: 'Add a device or, with kind=site_to_site, a connected location using a customer-generated one-time X25519 PUBLIC reveal key. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    create_network_vpn_site_health_webhook: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true, effect: 'additive', world: 'public-internet',
+        why: 'Create a signed site health subscription. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    create_private_network: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Create an approved private network for existing services when no suitable owned network exists. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    create_service_directory: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Create a directory (0755, owned by the parent directory\'s owner unless that is root). Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    create_snapshot: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Create a disk snapshot of a Cloud VPS (KVM/VDS) service. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    create_ssh_key: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Add a new SSH key to the account. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    create_temp_vm: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Coming soon: customer ordering is disabled. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    create_vm_file: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Create a new text file with private permissions in an existing directory. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    delete_dns_record: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Delete a forward DNS record from desired state. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    delete_dns_zone: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Delete a forward DNS zone. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    delete_domain_contact: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Delete an unused domain contact. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    delete_domain_glue_record: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'domain-registry',
+        why: 'Queue deleting a same-domain nameserver IP record for an owned domain. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to the domain registry or registrar.' },
+    delete_domain_parent_ds: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'domain-registry',
+        why: 'Queue deleting DNSSEC DS records at the parent zone for an owned domain. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to the domain registry or registrar.' },
+    delete_firecracker_snapshot: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Delete a Firecracker VPS temporary snapshot (stops its keep billing). Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    delete_function: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Delete a Firecracker Function, including its public webhook endpoint when enabled. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    delete_network_load_balancer: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Request appliance teardown at its current generation; this is not a refund or paid-period cancellation. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    delete_network_public_binding: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Request deletion of an existing binding using its generation. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    delete_network_security_group: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Delete an unreferenced customer group at its expected revision; referenced groups are refused. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    delete_network_vpn_gateway: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Request teardown of an owned VPN gateway; all devices lose connectivity. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    delete_network_vpn_site_health_webhook: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Remove this owned site\'s subscription and cancel pending deliveries. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    delete_private_network: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Request deletion of an empty network. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    delete_service_files: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Permanently delete 1-100 files or directories (no recycle bin). Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    delete_snapshot: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Delete a Cloud VPS (KVM/VDS) disk snapshot. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    delete_ssh_key: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Delete an SSH key from the account Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    delete_temp_vm: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Permanently delete a tenant-owned on-demand server before expiry. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    deploy_ssh_key: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Deploy an SSH key to VPS. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    detach_network_public_address: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Detach an owned public address from its current target; it stays owned for the paid period. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    detach_network_vpn_gateway: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Detach an account VPN from its network when supported; it keeps its paid period and devices but recreates the gateway. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    detach_private_network_port: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Detach the owned server port. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    disable_network_product_auto_renew: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Disable automatic renewal. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    disable_public_address_auto_renew: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Disable address automatic renewal; ownership lasts until paid_until. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    disable_vpn_auto_renew: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Disable the VPN\'s automatic renewal; the current paid period remains. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    discover_service_containers: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Run a bounded read-only Docker discovery on one supported Firecracker service. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    download_certificate: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Download the issued public leaf, chain, and full chain for one owned order after download_available becomes true. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    download_free_certificate: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Retrieve only the public leaf, issuer chain, and full chain for one issued no-cost certificate. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    download_service_file: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Download one file from the server to a local path on the machine running this MCP server: mints a download URL, fetches it without the API key (the URL is its own token) and writes the file atomically, verifying the size Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    enter_service_rescue: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Restart one owned active Firecracker VPS or Cloud VPS into an operator-owned rescue system. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    estimate_network_load_balancer: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read a technical load balancer estimate for this exact configuration. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    exit_service_rescue: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Restore the exact pre-rescue boot configuration and original running or stopped state for one owned service. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    export_application_recipe: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Export one immutable customer-owned recipe revision. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    export_dns_zone: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Export a native forward DNS zone\'s desired-state records as a BIND-style zone file. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    extract_service_file_archive: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Firecracker only: extract a zip, tar, tar.gz/tgz or single .gz archive with the guest agent\'s own reader into a destination that must not exist (default: next to the archive, without the archive extension). Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    find_network_product_order: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Recover an uncertain checkout by the ORIGINAL quote_id; order=null means no order was found, not proof to use a new payment key. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    flush_iptables: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Flush iptables rules on VPS (useful when locked out) Requires services:manage and a full-access API key. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_account: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get account info: user ID, email, balance, VAT rate Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_api_key: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get metadata for one active API key: scope, granular scopes, paid_scopes, paid_operations_enabled, daily_spend_limit_eur, monthly_spend_limit_eur, allowed IPs, expiry and rate_limit. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_api_key_activity: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get the recorded request activity for this API key: recent matched route patterns and statuses, resolved and separately labelled caller-claimed source addresses, endpoint/source totals, and retained daily history. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_api_key_inference_usage: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get exact paid VPSnet AI usage for this inference API key: committed and currently reserved spend for the UTC day and month, request and token totals by public VPSnet model profile, configured spend limits, remaining spe Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_application_compose_adoption: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Poll one tenant-bound Compose adoption candidate. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_application_data_restore: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Poll one tenant-bound selective application data restore. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_application_events: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get the latest customer-safe audit events for one owned managed application. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_application_health: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Run an on-demand health inspection of one owned managed application and return the observed container/service health. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_application_inspection: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Poll the exact persisted health or logs inspection returned by get_application_health or get_application_logs when it remains pending. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_application_installation: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get customer-safe observed state, health, drift, endpoints, components, bounded application/container resource history, optional display thresholds, and latest action for one owned managed application. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_application_logs: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Run an on-demand logs inspection of one owned managed application and return recent, size-bounded container logs for troubleshooting. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_application_recipe_validation: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Poll the exact persisted customer recipe validation returned by validate_application_recipe or a pending recipe creation/revision. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_application_server_routes: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get the server routes of one owned Managed Applications server: customer-owned hostnames routed by the in-guest HTTPS front door to the customer\'s own local services (for example app.example.com to 127.0.0.1:3000) with a Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_automatic_ssl_subscription: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read one customer-owned Automatic SSL subscription. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_backup_history: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get backup history for a service Requires services:read when called with an API key. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_backup_status: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get backup status and configuration for a service Requires services:read when called with an API key. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_certificate: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read one customer-owned paid TLS certificate order. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_certificate_catalog_product: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read one published paid TLS product with final EUR offers and customer-visible capabilities. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_certificate_validation: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read current per-name domain-control validation state and the owner-visible challenge while it is pending. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_connected_account: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Identify the connected VPSnet account and its granted permissions, selected services and spending limits. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_dns_service_status: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get the VPSNet DNS cluster status: whether the anycast DNS service is operational, healthy node count, the public nameservers to delegate domains to, and the recursive resolver IPs to use on VPSNet servers. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_dns_zone: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get a DNS zone and desired records, including their record IDs for update_dns_record. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_dns_zone_diagnostics: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'read', world: 'public-dns',
+        why: 'Run customer-facing DNS health diagnostics for a zone: delegation, public SOA, DNSSEC signal, and common record hygiene checks. Read-only: it returns data and changes nothing (repeating it has no further effect). Open world: it publishes to or queries public DNS.' },
+    get_dns_zone_history: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get the recent change history for a DNS zone and its records (action, record, who, when). Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_dnssec: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get DNSSEC state and public DNSKEY/DS material for a native DNS zone. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_domain: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get one owned domain with current nameservers and any pending domain action. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_domain_ordering_status: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'read', world: 'domain-registry',
+        why: 'Show non-secret domain ordering readiness. Read-only: it returns data and changes nothing (repeating it has no further effect). Open world: it talks to the domain registry or registrar.' },
+    get_domain_parent_ds: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List parent-zone DNSSEC DS records for an owned domain. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_event: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read the state of an asynchronous action: created, proccessing (sic), completed or error, with its message and payload. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_faq: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get frequently asked questions Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_firecracker_backup_history: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get retained nightly Firecracker VPS backup history, including failed/running attempts and consistency provenance. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_firecracker_backup_status: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get nightly off-node backup status for a Firecracker VPS, including running count and the latest retained backup\'s consistency provenance. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_free_certificate: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read one owned no-cost certificate request, including public CA, renewal schedule, validation state, safe timeline, and whether its public certificate is ready. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_free_certificate_eligibility: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'read', world: 'certificate-authority',
+        why: 'Check whether this account may request no-cost public DV certificates, its current anti-abuse quota, supported key-custody modes, and only the public certificate authorities that are operational in the current environmen Read-only: it returns data and changes nothing (repeating it has no further effect). Open world: it talks to a public certificate authority.' },
+    get_free_certificate_instruction: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read the current DNS validation instruction for one owned no-cost certificate request. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_function: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Get one Firecracker Function with code, config, and webhook details. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_function_invocation: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get a Firecracker Function invocation\'s status and usage cost. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_guest_agent_status: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read guest-agent availability for Cloud VPS (KVM/VDS) or Firecracker. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_guest_nameservers: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get the server\'s saved guest DNS resolver configuration: nsData.type is own (VPSnet defaults) or custom, with ns1-ns4 resolver IP addresses. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_hostname: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Get the current service hostname, reserved automatic hostname, and automatic/customer management mode. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_invoice: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get a specific invoice by hash Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_login_history: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get account login history (IPs, dates) with pagination; follow response pagination to read older records. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_management_history: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get management/activity history with pagination and optional exact orderNo or subject_kind/subject_key filters. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_appliance_billing: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read current customer-visible recurring appliance lines and currency. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_appliance_capabilities: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read available load balancer providers/tiers, public qualification, VPN capabilities (including technologies and ipsec_vendors) and quota. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_appliance_operation: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Poll an accepted appliance operation on in_progress (true until terminal), waiting next_check_seconds between reads when supplied; that interval is a poll suggestion, not a completion estimate. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_load_balancer: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read one owned load balancer, listeners, members, generation and health. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_payment_methods: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read payment-method metadata without starting payment. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_port_forwards: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read the NAT port forwarding rules of an owned private network: applied rules (protocol, external_port on the network\'s NAT public address, the target server\'s private_port_id and its internal_port), the router generatio Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_product_order: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read an owned common-checkout order\'s payment and fulfilment state. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_public_address: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read one owned public address, attachment and paid-period state. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_public_binding: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read one existing owned public binding\'s generation, state and assigned address. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_routed_egress: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read this network\'s NAT/internet access, public address and qualification state. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_security_policy: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read default_policy, assigned group rules and desired/applied policy generations. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_vpn_egress_options: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read supported VPN Internet exits and qualification. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_vpn_gateway: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read one owned VPN gateway, current generation, peers, grant candidates and attachment capability. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_vpn_peer_history: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read one device\'s or site\'s traffic and connection history, oldest point first: range 24h = raw 30-second samples (kept 24 h), 7d = 10-minute points and 30d = hourly points (from per-minute rows kept 30 days), 13m = dail Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_vpn_peer_recipe: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read backend-sourced router setup instructions for one owned IPsec IKEv2 site. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_vpn_summary: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read the network\'s VPN summary, including truthful absence. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_network_vpn_tunnel_test: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read one owned tunnel test by its returned ID; while running, poll no faster than the backend\'s one-second guidance. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_networking_capabilities: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read account networking availability, quota, creation options and new-server order eligibility. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_networking_features: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read current networking feature gates, DNS options and supported contract extensions. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_networking_operation: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read an accepted network or port operation only. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_networking_overview: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read owned networks, quota and operation snapshot. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_networking_topology: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read the account topology with network-scoped identities. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_order_options: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get configurable options (OS, resources, periods) for a plan Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_order_plans: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get available plans for one explicitly selected service product. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_os_options: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get available OS templates for reinstall Requires services:read when called with an API key. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_period_options: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get billing period and auto-renewal options Requires services:read when called with an API key. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_plan_options: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get available plans for upgrade/downgrade. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_plan_resources: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get configurable resources for a specific plan Requires services:read when called with an API key. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_pricing: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get public pricing for a service type Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_private_network: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read one owned network including DHCP reservations, DNS change progress, generation and project_id. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_profile: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get user profile details (name, address, company info) Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_public_ip_rdns: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read the reverse DNS (PTR) of an owned public address that is not a server\'s own primary address: an additional address, a floating binding, a VPN\'s or a public load balancer\'s address (target). Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_purchase_result: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Inspect this connection’s existing financial purchase attempt by its original idempotency key. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_rdns: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get effective PTR records for every assigned IPv4 and enabled IPv6 address. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_registrar_lock: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'read', world: 'domain-registry',
+        why: 'Get the registrar transfer-lock status for an owned domain (locked / unlocked / unsupported). Read-only: it returns data and changes nothing (repeating it has no further effect). Open world: it talks to the domain registry or registrar.' },
+    get_restore_file_browse: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Poll one queued backup file listing. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_restore_status: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get the unified restore state for a service: retention days, restore price, and any restore request in progress. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_security_group_capabilities: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read security-group availability, whether the network default policy can be changed, the offered default_policy_values (accept, deny, ingress_rules) and whether create-group egress_policy is accepted. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_service: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get detailed info and follow_up readiness guidance for the original service order. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_service_container_discovery: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Poll the exact persisted service container discovery returned by discover_service_containers when it remains pending. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_service_file_capabilities: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Check whether the file manager can serve this server now: available, platform (firecracker or vds), the verbatim unavailable reason, features, limits (view/upload/write sizes, chunk size, page size) and transfer mode. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_service_file_download_url: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Mint a one-file download URL (bound to the file version and size and to the caller\'s address /24 or /64; valid 10 minutes until first use, 6 hours after it, read-only). Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_service_file_operation: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Poll a file operation that answered 202 (a slow guest, a recursive delete or an extraction): pending, running, succeeded (result = the answer the call would have given), failed (errorCode) or needsAttention (outcome unkn Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_service_graphs: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get one performance graph series for a service: pick a metric and a period. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_service_history: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get action history for a service Requires services:read when called with an API key. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_service_public_firewall: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read the firewall of an owned server\'s public interface (VPS or Cloud VPS; incoming allow rules for IPv4 and IPv6). Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_service_rescue: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get operator rescue capability and the current durable rescue session for one owned Firecracker VPS or Cloud VPS. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_ssh_key: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get a specific SSH key by ID Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_system_status: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get VPSnet.com system status Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_temp_vm: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get one tenant-owned on-demand server session. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_temp_vm_options: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get the coming-soon on-demand server preview options and authoritative orderable/availability launch state. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_title: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get the current customer-visible service display title Requires services:read when called with an API key. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_update_info: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read public VPSnet releases and reviewed client update guidance without changing software, credentials or permissions. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_usage_statements: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Get itemized usage-billing statements for the account (per-period totals by family, e.g. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    get_vm_operation: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read the durable state and result of a VM operation after disconnect or process restart. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    import_dns_zone: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Import BIND-style forward DNS records into a native zone. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    inspect_vm: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Start a persisted VM diagnostic operation for Linux OS, resources, running services, processes, listening ports and Docker/Podman inventory. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    install_application: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Queue installation of a catalog application using its version-pinned container blueprint. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    install_application_recipe: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Queue installation of one exact validated customer-owned recipe revision. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    invoke_function: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'paid', world: 'arbitrary-code',
+        why: 'Invoke a Firecracker Function. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Open world: it runs customer code or commands that can reach any internet address.' },
+    list_api_keys: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Show the API key this request authenticated with: scope (read/full/ai), granular scopes, paid_scopes, paid_operations_enabled, daily_spend_limit_eur, monthly_spend_limit_eur, allowed IPs, expiry and rate_limit (a stored Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_application_catalog: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List catalog applications compatible with one owned VPSnet service. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_application_recipe_revisions: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List immutable revision metadata for one customer-owned application recipe. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_application_recipes: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List immutable customer-owned application recipe projects for one supported service. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_application_registry_credentials: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List non-secret private registry credential metadata for one owned service, including Docker Hub, GHCR, and exact custom HTTPS registry hostnames. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_application_restore_points: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Freely list opaque, unexpired nightly whole-VM backup points eligible to restore the exact current revision of one managed application, plus the current non-binding price and account-balance estimate. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_automatic_ssl_actions: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List the latest customer-visible cancellation, domain addition, removal, and replacement actions for one owned Automatic SSL subscription. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_automatic_ssl_subscriptions: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List customer-owned Automatic SSL subscriptions, subscribed DNS names, paid term, final EUR amount, public state, and whether portal-only setup credentials are ready. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_certificate_actions: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List durable customer-visible management actions for one paid certificate. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_certificate_catalog: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List published paid TLS certificate products and final customer offers in EUR. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_certificates: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List customer-owned paid TLS certificate orders, final EUR amount, validation and issuance state, renewal dates, and whether the public certificate bundle is ready. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_ddns_tokens: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List DNS updater tokens for a DNS zone (DDNS A/AAAA and ACME DNS-01 TXT). Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_dns_templates: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List backend-defined DNS record templates for a native forward zone, such as web service, Google Workspace, Microsoft 365, mail security, Null MX and CAA lockdown. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_dns_zones: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List forward DNS zones on the account. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_domain_contacts: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List all domain registrant/admin/tech/billing contacts owned by the account in one response. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_domain_glue_records: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List same-domain nameserver IP records for an owned domain, e.g. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_domain_tlds: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List TLDs currently enabled for the VPSNet domain catalog. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_domains: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List domains owned by the account, including status, expiry, nameservers, DNS zone link, and renewal settings. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_firecracker_snapshots: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List temporary snapshots for a Firecracker VPS service, including billing state (free window, then a per-GB keep rate) and expiry. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_free_certificates: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List customer-owned no-cost public-certificate requests and their safe lifecycle state. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_function_history: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read paginated account-wide Firecracker Function invocation history. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_function_invocations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List the latest 50 invocations of a Firecracker Function with status, duration, and cost. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_functions: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'List Firecracker Functions (serverless-style code execution in microVMs) with runtimes, webhook URLs, and usage. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_invoices: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List invoices with pagination Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_network_appliances: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read owned load balancers and VPN gateways with one stream cursor. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_network_attachment_candidates: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'For a network with port_intent_ready=true, check each existing service\'s attachment eligibility and attachment_mode; service_id selects one owned service. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_network_load_balancers: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List private and public load balancers and customer-safe health/qualification state. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_network_product_periods: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read owned product periods, renewal availability and lifecycle facts. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_network_products: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read current paid products, prices, order periods, distinct renew_periods and purchase capability. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_network_public_addresses: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read owned paid public addresses, account limits, target support and purchase availability. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_network_security_groups: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List groups in the owned project. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_network_vpn_gateways: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List owned VPN gateways, their device peers and safe status. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_network_vpn_site_health_webhooks: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List this owned site\'s signed health subscriptions and last delivery outcomes. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_networking_operations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read recent network operations and operations_has_more. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_payments: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List payment history with pagination Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_private_network_ports: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read owned network ports, their fixed DHCP addresses, generations and attachment states. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_private_networks: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List owned private networks, including deletion awaiting verified cleanup. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_public_address_server_targets: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Search and page the account\'s servers as targets for attach_public_address_to_server_interface. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_restore_file_points: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List the nightly backup points whose contents can be browsed file by file for one owned service, and report whether folder search is available on that service\'s node. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_restore_points: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List available backup restore points for a service (automatic off-node backups). Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_service_applications: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List managed application installations and any pending checkout selection for one owned service. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_service_dns_options: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List the DNS attach options for a service: its public IPv4/IPv6 addresses, the account\'s editable forward DNS zones, and DNS records already pointing at the service. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_service_file_uploads: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List the service\'s open uploads (received bytes, state, expiry). Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_service_files: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List one directory page inside a running server (lstat: a symlink is described itself), directories first. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_service_private_ports: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Read private ports and order attachment recovery state for one owned service order number. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_service_ssh_keys: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List which account SSH keys are in root\'s authorized_keys on one owned Cloud VPS or Firecracker VPS, as the server last reported: per key deployed (true, false, or null when the server was never read) and a removal runni Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_services: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List all active VPS services with state, plan, IPs, and expiry Requires services:read when called with an API key. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_snapshots: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'List disk snapshots for a Cloud VPS (KVM/VDS) service, with the snapshot billing policy (free window, then billed per GB while kept) and a usage summary. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_ssh_keys: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List account SSH public keys. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    list_temp_vms: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'List the account\'s on-demand server sessions and current options. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    manage_application: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Queue one supported lifecycle action for an owned managed application. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    manage_automatic_ssl_subscription: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'certificate-authority',
+        why: 'Queue one exact idempotent Automatic SSL action: cancel the subscription, remove an eligible purchased DNS name, or replace an eligible purchased DNS name during its correction window. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to a public certificate authority.' },
+    manage_certificate: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'certificate-authority',
+        why: 'Queue one exact idempotent paid-certificate management action: cancel an eligible pending order, recheck or resend validation, change one validation method, or request a free same-name reissue with a new public CSR. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to a public certificate authority.' },
+    manage_free_certificate: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'certificate-authority',
+        why: 'Request one free-certificate lifecycle action after reading its current state: early renew, revoke, recheck validation, or cancel before issuance. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to a public certificate authority.' },
+    move_network_public_ip: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Move a prepared floating public binding to another owned private port; confirm interruption to the old target. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    move_service_file: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Rename or move one entry (a symlink itself, not its target); never across file systems (filesCrossFilesystem) and never onto an existing name unless overwrite=true (a directory is never replaced). Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    open_vm_session: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Open an authorized Linux session on a selected KVM or Firecracker service. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    order_automatic_ssl_domain: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'paid', world: 'certificate-authority',
+        why: 'Confirm and pay for the exact additional Automatic SSL DNS-name quote. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Open world: it talks to a public certificate authority.' },
+    order_automatic_ssl_renewal: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'paid', world: 'certificate-authority',
+        why: 'Prepay one exact next Automatic SSL term from account balance. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Open world: it talks to a public certificate authority.' },
+    order_automatic_ssl_subscription: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'paid', world: 'certificate-authority',
+        why: 'Confirm and pay for the exact Automatic SSL quote. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Open world: it talks to a public certificate authority.' },
+    order_certificate: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'paid', world: 'certificate-authority',
+        why: 'Confirm and pay for the exact quote returned by quote_certificate. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Open world: it talks to a public certificate authority.' },
+    order_network_product: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Confirm a common-checkout purchase from an approved exact quote. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    order_service: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Order a new VPS. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    preflight_free_certificate: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'read', world: 'certificate-authority',
+        why: 'Plan a no-cost public DV certificate without issuing it or changing DNS. Read-only: it returns data and changes nothing (repeating it has no further effect). Open world: it talks to a public certificate authority.' },
+    prepare_application_compose_adoption: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Prepare and poll a short-lived, read-only takeover candidate for one exact unmanaged Compose project from a fresh discovery. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_account_vpn: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Quote the one canonical VPN product based on the current Firecracker plan for common checkout when vpn_account_order is advertised. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_application_data_restore: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Create a short-lived quote for one exact application restore selection. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_automatic_ssl_domain: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Quote one additional DNS name for an active Automatic SSL subscription without charging. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_automatic_ssl_renewal: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Quote the next term of an owned renewable Automatic SSL subscription during its final 30 days without charging. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_automatic_ssl_subscription: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Create a short-lived exact quote for Automatic SSL without charging. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_certificate: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Create a short-lived quote for one exact paid TLS certificate or eligible renewal. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_domain_register: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true, effect: 'quote', world: 'domain-registry',
+        why: 'Create a VPSNet-priced domain registration quote. Not read-only and not destructive: it stores a price quote and charges nothing. Open world: it talks to the domain registry or registrar.' },
+    quote_domain_renew: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true, effect: 'quote', world: 'domain-registry',
+        why: 'Create a VPSNet-priced renewal quote for an owned domain. Not read-only and not destructive: it stores a price quote and charges nothing. Open world: it talks to the domain registry or registrar.' },
+    quote_domain_restore: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true, effect: 'quote', world: 'domain-registry',
+        why: 'Create a restore quote for an owned domain in redemption. Not read-only and not destructive: it stores a price quote and charges nothing. Open world: it talks to the domain registry or registrar.' },
+    quote_domain_transfer: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true, effect: 'quote', world: 'domain-registry',
+        why: 'Create a VPSNet-priced domain transfer quote. Not read-only and not destructive: it stores a price quote and charges nothing. Open world: it talks to the domain registry or registrar.' },
+    quote_network_product: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Create the network product\'s exact paid quote for COMMON CHECKOUT. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_network_product_renewal: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Quote the selected paid term (one month when omitted) for a network product; no charge. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_network_public_address: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Quote a new paid public address for common checkout; no charge. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_network_vpn_traffic_pack: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Quote separately purchased additional traffic for this owned VPN using an offered pack code from get_network_vpn_gateway traffic; this does not buy or change a VPN plan. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_public_address_renewal: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Quote the address\'s selected term (one month when omitted) without charging; use the returned quote and this key for confirmation. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_service_order: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Quote one permanent Firecracker VPS, Cloud VPS (KVM) or Container VPS using the selected current plan, OS, resources and period. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_temp_vm: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Coming soon: customer ordering is disabled. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    quote_vpn_period_renewal: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'quote', world: 'account',
+        why: 'Quote the VPN\'s selected term (one month when omitted) on its actual paid scope; no charge. Not read-only and not destructive: it stores a price quote and charges nothing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    read_service_file: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'View a file: UTF-8 text up to 1 MiB is returned as text, an image up to 4 MiB as an image, binary content as data null; a larger file answers 413 filesTooLargeToView and is download-only (download_service_file). Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    read_vm_file: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Start a persisted file-read operation for a VM text file, a byte range or the tail of a log; it does not modify guest files or settings. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    reapply_dns_zone: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Retry publication of a published DNS zone whose apply_state is failed. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    rebuild_network_load_balancer: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Rebuild every proxy server of an owned public load balancer, one at a time, from the image it runs now; the others keep serving, so the balancer keeps its address, listeners and members. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    rebuild_network_vpn_gateway: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Rebuild the owned VPN VM with its existing address and devices. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    recheck_certificate_validation: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'additive', world: 'certificate-authority',
+        why: 'Recheck validation for the specified DNS names in an owned paid TLS certificate order. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it talks to a public certificate authority.' },
+    recheck_free_certificate: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true, effect: 'additive', world: 'certificate-authority',
+        why: 'Recheck validation for an owned pending free TLS certificate after reading its current state. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it talks to a public certificate authority.' },
+    recheck_public_address_outgoing_source: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Ask a server again to put its outgoing source back on its own IP, for an entry of outgoing_source_warnings (an address already left the server, which still tries to send from it). Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    reconcile_application: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Reconcile an owned managed application with its declared configuration. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    refresh_automatic_ssl_subscription: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'additive', world: 'certificate-authority',
+        why: 'Durably schedule an authoritative read-only certificate-authority refresh for one owned Automatic SSL subscription. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it talks to a public certificate authority.' },
+    refresh_certificate: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'additive', world: 'certificate-authority',
+        why: 'Durably schedule a read-only certificate-authority status reconciliation for one owned order. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it talks to a public certificate authority.' },
+    reinstall_os: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Reinstall OS on a VPS or qualified dedicated server. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    reissue_certificate: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'certificate-authority',
+        why: 'Request a free same-name reissue of an owned paid TLS certificate using a new public CSR. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to a public certificate authority.' },
+    reissue_dns_zone_verification: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Rotate the ownership TXT value for a DNS zone in pending_verification or verification_expired. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    remove_automatic_ssl_domain: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'certificate-authority',
+        why: 'Remove one eligible purchased DNS name from an owned Automatic SSL subscription. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to a public certificate authority.' },
+    remove_network_load_balancer_listener: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Remove a listener and its members; deleting the last listener is refused. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    remove_network_load_balancer_member: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Remove a member from rotation using the load balancer generation. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    remove_network_vpn_site_second_line: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Remove line 2 using the gateway generation. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    remove_service_ssh_key: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Remove one account SSH key (ssh_key from list_ssh_keys) from root\'s authorized_keys on one owned running Cloud VPS or Firecracker VPS; every line with that key goes, nothing else changes, and the key stays in the account Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    rename_network_vpn_gateway: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Rename an owned VPN\'s customer label. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    renew_free_certificate: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'certificate-authority',
+        why: 'Request early renewal of an owned free TLS certificate after reading its current state. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to a public certificate authority.' },
+    renew_network_product: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Pay the exact previously disclosed renewal from account balance. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    renew_network_public_address: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Pay the approved address renewal from balance with its exact quote ID/token and original key. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    renew_service: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Manually renew a service for a specific period. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    renew_vpn_period: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Pay the VPN\'s approved quoted renewal term from account balance using the exact quote and original key. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    repair_application: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Repair an owned managed application\'s runtime. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    replace_automatic_ssl_domain: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'certificate-authority',
+        why: 'Replace one eligible purchased DNS name during its Automatic SSL correction window. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to a public certificate authority.' },
+    request_restore: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'PAID: restore a service from a backup point. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    resend_certificate_validation: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'additive', world: 'certificate-authority',
+        why: 'Resend validation instructions for an owned paid TLS certificate order. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it talks to a public certificate authority.' },
+    reset_hostname: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Restore the immutable VPSnet-managed automatic hostname for a Container VPS, VPS, or Cloud VPS. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    reset_public_ip_rdns: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Remove the custom reverse DNS of an owned public address (target) at the revision read with get_public_ip_rdns; a paid address gets no automatic name back. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    restart_application: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Restart an owned managed application. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    restart_network_vpn_gateway: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Restart the owned VPN VM in place. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    restart_service: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Restart a VPS. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    restore_application_data: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Pay for and queue replacement of only the selected managed application\'s declared data from one eligible nightly server backup. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    resume_service: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Resume a suspended Cloud VPS (KVM/VDS) service. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    retire_network_security_policy: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Retire the policy only after its server ports are gone. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    retry_network_security_policy: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Retry the failed network security policy using its current desired state. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    retry_private_network: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Retry the failed current network operation only; preserve its current generation. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    retry_private_network_port: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Retry the failed current port operation with the PORT generation and any required restart approval. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    revoke_ddns_token: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Revoke a DNS updater token (DDNS or ACME). Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    revoke_free_certificate: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'certificate-authority',
+        why: 'Revoke an owned free TLS certificate after checking its state and obtaining explicit user approval. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to a public certificate authority.' },
+    revoke_network_vpn_peer: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Revoke one device using the VPN GATEWAY generation. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    rollback_application: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Queue the exact reverse transition advertised as type=rollback by get_application_installation. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    rollback_firecracker_snapshot: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Roll a Firecracker VPS back to a temporary snapshot. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    rollback_snapshot: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Roll a Cloud VPS (KVM/VDS) service back to a disk snapshot. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    rotate_network_vpn_ipsec_key: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Rotate an IPsec site\'s pre-shared key. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    run_vm_command: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'arbitrary-code',
+        why: 'Start one durable command on a delegated Linux VM as root. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it runs customer code or commands that can reach any internet address.' },
+    save_network_vpn_router_setup: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Save nonsecret backend-catalogue router version and local interface/zone fields for an IPsec site, optionally line 2. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    search_service_files: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Find entries by name below a directory: a case-insensitive substring or a glob with * ? Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_auto_renew: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Enable or disable auto-renewal for a service. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_dnssec: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Enable or disable public DNSSEC signing for a native DNS zone. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    set_domain_auto_renew: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'paid', world: 'account',
+        why: 'Enable or disable automatic renewal for an owned domain. Destructive: it spends the customer\'s VPSnet balance or adds a billed resource. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_domain_nameservers: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'domain-registry',
+        why: 'Queue an asynchronous registrar nameserver change for an owned domain. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it talks to the domain registry or registrar.' },
+    set_guest_nameservers: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Change DNS resolvers inside a supported Linux server. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    set_network_default_security_policy: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Change the policy for servers without custom groups using an advertised default_policy_values value: accept, deny, or ingress_rules (allow unrestricted IPv4 egress while ingress follows rules/platform exceptions). Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_port_forwards: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Replace the COMPLETE NAT port forwarding rule set of an owned network (rules: [] withdraws all of them) at the router generation read from get_network_port_forwards. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_routed_egress: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Request the currently supported NAT transition for an owned network; the backend may refuse mode changes. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_site_route_mode: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Choose how the servers of a network reach its VPN\'s connected locations: dhcp (default) = DHCP classless static routes, picked up at the next lease renewal (about 30 minutes) or a DHCP renew/restart, never by servers wit Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_vpn_internet_exit: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Choose none, the VPN\'s own IPv4, or its attached network NAT as Internet exit. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_vpn_ipsec_tuning: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Replace an IPsec site\'s advanced tunnel choices using the gateway generation. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_vpn_peer_egress: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Set a device\'s private-only, inherited NAT, or advertised chosen exit policy. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_vpn_peer_grants: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Replace the peer\'s complete server-access choice using the gateway generation. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_vpn_public_access: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Replace the complete WireGuard/IPsec public-source lists at the VPN gateway generation. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_vpn_site_alert: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Switch the office-down e-mail of one connected location: enabled=true sends one e-mail to the account when the location\'s router has not reached the VPN for 5 minutes and one more when it is back. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_vpn_site_bgp: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Enable or change BGP over an eligible IPsec site using the gateway generation. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_vpn_site_main_line: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Choose line 1 or 2 as the main IPsec line using the gateway generation; optional DPD applies to both. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_vpn_site_options: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Set one or more VPN options: hub_and_spoke joins offices, site_reach sets the default load-balancer/floating-IP reach for sites, and device_mesh lets devices reach each other. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_network_vpn_site_reach: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Set this site\'s load-balancer/floating-IP reach choice, or null to follow its VPN default. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_private_network_dns: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Replace the network\'s DHCP DNS mode and resolver addresses; changing or disabling them can interrupt name resolution for attached guests. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_private_network_names: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Replace the complete internal DNS zone label and alias list. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_private_port_security_groups: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Replace the port\'s complete customer-group list. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_public_address_outgoing_source: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Make an owned additional address the source of a server\'s new outgoing IPv4 connections (enabled=true), or go back to the server\'s own IP (enabled=false). Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_public_ip_rdns: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Set the reverse DNS (PTR) hostname of an owned public address (target) at the revision read with get_public_ip_rdns. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    set_service_public_firewall: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Replace the COMPLETE firewall of an owned server\'s public interface (VPS or Cloud VPS) at the generation read with get_service_public_firewall: enabled switches it on or off, rules is every incoming allow rule (at most l Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    set_vpn_server_access: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Choose accept or groups_only for the VPN\'s access to attached servers when this capability is available. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    start_application: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Start a stopped owned managed application. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    start_network_vpn_tunnel_test: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'additive', world: 'public-internet',
+        why: 'Start a backend tunnel test for a site or supported WireGuard peer; optional line selects 1 or 2. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    start_service: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, effect: 'additive', world: 'account',
+        why: 'Start a stopped VPS. Not destructive: it adds or starts something new and removes or replaces nothing existing. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    stat_service_file: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Describe one entry: type, size, mode, owner, mtime, version and kind (text, image, binary, directory, other). Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    stop_application: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Stop an owned managed application. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    stop_service: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Stop a running VPS. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    suspend_service: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Suspend a running Cloud VPS (KVM/VDS) service. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    take_network_vpn_peer_config: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Consume a device\'s or site\'s sealed configuration ONCE. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    take_network_vpn_site_line_config: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Consume the second IPsec line\'s sealed key exactly once with line=2. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    toggle_extra_settings: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Toggle extra VPS settings: ppp, fuse, tuntap, or nfs Requires services:manage and a full-access API key. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    toggle_ipv6: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Enable or disable IPv6 on VPS Requires services:manage and a full-access API key. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    uninstall_application: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Permanently delete an owned managed application\'s containers, configuration, saved credentials, and application data; server backups remain. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    update_application: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true, effect: 'change', world: 'public-internet',
+        why: 'Queue the backend-selected newer immutable release for an owned managed application. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    update_dns_record: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Update an existing forward DNS record by its ID (PUT), replacing its desired value, TTL or comment. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    update_domain_contact: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Update an existing domain contact. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    update_function: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'arbitrary-code',
+        why: 'Update a Firecracker Function\'s code or configuration. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it runs customer code or commands that can reach any internet address.' },
+    update_network_security_group: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Replace the complete group name and rule list at its expected revision. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    update_network_vpn_gateway_image: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Apply the backend-qualified reviewed VPN image in place. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    upload_service_file: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Upload a file to the server in one call: from localPath (a file on the machine running this MCP server) or contentBase64. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    upsert_dns_record: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Add a forward DNS desired-state record to a native zone, identified by name, type and content together. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    validate_application_recipe: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true, effect: 'additive', world: 'public-internet',
+        why: 'Resolve image tags from their registries to immutable digests, then validate the resulting customer-owned Docker Compose document with the authoritative policy on the target Firecracker worker. Not destructive: it adds or starts something new and removes or replaces nothing existing. Open world: it reaches public registries, public hostnames, e-mail or addresses on the internet.' },
+    verify_dns_zone: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, effect: 'change', world: 'public-dns',
+        why: 'Check the zone\'s ownership TXT value (_vpsnet-dns.<zone>) and publish the zone when it matches: publicly, or served authoritatively by the nameservers the parent zone delegated the name to when the zone was created (the Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Open world: it publishes to or queries public DNS.' },
+    wait_for_event: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, effect: 'read', world: 'account',
+        why: 'Poll an asynchronous action until it is completed or error, or until timeout_seconds pass (default 120, max 600), every 3 seconds. Read-only: it returns data and changes nothing (repeating it has no further effect). Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    write_service_file: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Write a small file (at most 1 MiB) with compare-and-swap. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+    write_vm_file: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false, effect: 'change', world: 'account',
+        why: 'Replace an existing regular text file within the maxFileBytes limit returned by open_vm_session, checking the sha256 returned by read_vm_file before atomic replacement. Destructive: it replaces, removes, interrupts or restarts existing state, or changes who can reach a server. Closed world: it acts only on the customer\'s own VPSnet account and services.' },
+};