@oomol-lab/open-connector 1.6.1 → 1.6.2

package/src/providers/netlify/actions.js

@@ -16,6 +16,17 @@ const listSitesInputSchema = s.object({
     name: s.string({ minLength: 1, description: "Only return sites whose name matches this value." }),
     filter: s.stringEnum(["all", "owner", "guest"], { description: "Which Netlify sites to include in the result." }),
 }, { description: "Input parameters for listing Netlify sites." });
+const createSiteInputSchema = s.object("Input parameters for creating a Netlify site.", {
+    name: s.nonEmptyString("The desired Netlify site name. Netlify generates one when omitted."),
+    accountId: s.nonEmptyString("The Netlify account ID that should own the site."),
+    customDomain: s.nonEmptyString("The custom domain to configure for the site."),
+    domainAliases: s.array("Additional domain aliases to configure for the site.", s.nonEmptyString("A domain alias.")),
+    notificationEmail: s.email("The email address that should receive site notifications."),
+    forceSsl: s.boolean("Whether Netlify should redirect HTTP requests to HTTPS."),
+    configureDns: s.boolean("Whether Netlify should automatically configure DNS for the custom domain."),
+}, {
+    optional: ["name", "accountId", "customDomain", "domainAliases", "notificationEmail", "forceSsl", "configureDns"],
+});
 const siteInputSchema = s.object({
     siteId: siteIdField,
 }, { required: ["siteId"], description: "Input parameters for a Netlify site request." });
@@ -254,6 +265,7 @@ const submissionsOutputSchema = s.object({
 const actionSources = [
     {
         name: "get_current_user",
+        operationType: "read",
         description: "Retrieve the Netlify user associated with the connected credential.",
         requiredScopes: [],
         inputSchema: emptyInputSchema,
@@ -261,6 +273,7 @@ const actionSources = [
     },
     {
         name: "list_accounts",
+        operationType: "read",
         description: "List Netlify accounts accessible to the connected credential.",
         requiredScopes: [],
         inputSchema: emptyInputSchema,
@@ -268,6 +281,7 @@ const actionSources = [
     },
     {
         name: "get_account",
+        operationType: "read",
         description: "Retrieve one Netlify account membership, including billing and capability fields returned by Netlify.",
         requiredScopes: [],
         inputSchema: accountInputSchema,
@@ -275,13 +289,23 @@ const actionSources = [
     },
     {
         name: "list_sites",
+        operationType: "read",
         description: "List Netlify sites accessible to the connected credential.",
         requiredScopes: [],
         inputSchema: listSitesInputSchema,
         outputSchema: sitesOutputSchema,
     },
+    {
+        name: "create_site",
+        operationType: "write",
+        description: "Create a Netlify site, optionally assigning its account, name, domains, notification email, and HTTPS settings.",
+        requiredScopes: [],
+        inputSchema: createSiteInputSchema,
+        outputSchema: siteOutputSchema,
+    },
     {
         name: "get_site",
+        operationType: "read",
         description: "Retrieve one Netlify site by site ID or name.",
         requiredScopes: [],
         inputSchema: siteInputSchema,
@@ -289,6 +313,7 @@ const actionSources = [
     },
     {
         name: "list_site_deploys",
+        operationType: "read",
         description: "List deploys for one Netlify site.",
         requiredScopes: [],
         inputSchema: listSiteDeploysInputSchema,
@@ -296,6 +321,7 @@ const actionSources = [
     },
     {
         name: "get_deploy",
+        operationType: "read",
         description: "Retrieve one Netlify deploy by deploy ID.",
         requiredScopes: [],
         inputSchema: deployInputSchema,
@@ -303,6 +329,7 @@ const actionSources = [
     },
     {
         name: "cancel_deploy",
+        operationType: "destructive",
         description: "Cancel one Netlify deploy by deploy ID.",
         requiredScopes: [],
         inputSchema: deployInputSchema,
@@ -310,6 +337,7 @@ const actionSources = [
     },
     {
         name: "lock_deploy",
+        operationType: "write",
         description: "Lock one Netlify deploy by deploy ID.",
         requiredScopes: [],
         inputSchema: deployInputSchema,
@@ -317,6 +345,7 @@ const actionSources = [
     },
     {
         name: "unlock_deploy",
+        operationType: "write",
         description: "Unlock one Netlify deploy by deploy ID.",
         requiredScopes: [],
         inputSchema: deployInputSchema,
@@ -324,6 +353,7 @@ const actionSources = [
     },
     {
         name: "create_site_build",
+        operationType: "write",
         description: "Start a Netlify build for one site without uploading binary files.",
         requiredScopes: [],
         inputSchema: createSiteBuildInputSchema,
@@ -331,6 +361,7 @@ const actionSources = [
     },
     {
         name: "create_site_deploy_from_zip_url",
+        operationType: "write",
         description: "Create a Netlify site deploy by downloading a public zip file URL and uploading it to Netlify.",
         requiredScopes: [],
         inputSchema: createSiteDeployFromZipUrlInputSchema,
@@ -338,6 +369,7 @@ const actionSources = [
     },
     {
         name: "upload_deploy_file_from_url",
+        operationType: "write",
         description: "Upload one file into an existing Netlify deploy by downloading a public file URL first.",
         requiredScopes: [],
         inputSchema: uploadDeployFileFromUrlInputSchema,
@@ -345,6 +377,7 @@ const actionSources = [
     },
     {
         name: "upload_deploy_function_from_zip_url",
+        operationType: "write",
         description: "Upload one Netlify function bundle into an existing deploy by downloading a public zip file URL first.",
         requiredScopes: [],
         inputSchema: uploadDeployFunctionFromZipUrlInputSchema,
@@ -352,6 +385,7 @@ const actionSources = [
     },
     {
         name: "get_build",
+        operationType: "read",
         description: "Retrieve one Netlify build by build ID.",
         requiredScopes: [],
         inputSchema: buildInputSchema,
@@ -359,6 +393,7 @@ const actionSources = [
     },
     {
         name: "notify_build_start",
+        operationType: "write",
         description: "Notify Netlify that one build has started.",
         requiredScopes: [],
         inputSchema: buildInputSchema,
@@ -366,6 +401,7 @@ const actionSources = [
     },
     {
         name: "list_site_forms",
+        operationType: "read",
         description: "List forms detected for one Netlify site.",
         requiredScopes: [],
         inputSchema: listSiteFormsInputSchema,
@@ -373,6 +409,7 @@ const actionSources = [
     },
     {
         name: "list_submissions",
+        operationType: "read",
         description: "List Netlify form submissions by site or by form.",
         requiredScopes: [],
         inputSchema: listSubmissionsInputSchema,
@@ -380,6 +417,7 @@ const actionSources = [
     },
     {
         name: "delete_submission",
+        operationType: "destructive",
         description: "Delete one Netlify form submission by submission ID.",
         requiredScopes: [],
         inputSchema: s.object({

package/src/providers/netlify/runtime.js

@@ -51,6 +51,29 @@ export const netlifyActionHandlers = {
         }));
         return { sites, count: sites.length };
     },
+    async create_site(input, context) {
+        return {
+            site: objectPayload(await netlifyRequestJson({
+                accessToken: context.accessToken,
+                method: "POST",
+                path: "/sites",
+                query: compactObject({
+                    configure_dns: readOptionalBooleanString(input.configureDns),
+                }),
+                body: JSON.stringify(compactObject({
+                    name: readOptionalNonEmptyString(input.name),
+                    account_id: readOptionalNonEmptyString(input.accountId),
+                    custom_domain: readOptionalNonEmptyString(input.customDomain),
+                    domain_aliases: input.domainAliases,
+                    notification_email: readOptionalNonEmptyString(input.notificationEmail),
+                    force_ssl: optionalBoolean(input.forceSsl),
+                })),
+                contentType: "application/json",
+                fetcher: context.fetcher,
+                phase: "execute",
+            })),
+        };
+    },
     async get_site(input, context) {
         return {
             site: objectPayload(await netlifyRequestJson({

package/src/providers/neutrino/actions.js

@@ -146,30 +146,35 @@ const checkIpBlocklistOutputSchema = outputObject("IP blocklist payload returned
 export const neutrinoActions = [
     defineProviderAction(service, {
         name: "validate_email",
+        operationType: "read",
         description: "Parse, validate, and clean an email address with Neutrino.",
         inputSchema: validateEmailInputSchema,
         outputSchema: validateEmailOutputSchema,
     }),
     defineProviderAction(service, {
         name: "validate_phone",
+        operationType: "read",
         description: "Parse, validate, format, and locate a phone number with Neutrino.",
         inputSchema: validatePhoneInputSchema,
         outputSchema: validatePhoneOutputSchema,
     }),
     defineProviderAction(service, {
         name: "get_ip_info",
+        operationType: "read",
         description: "Get Neutrino geolocation and reverse-DNS details for an IP address.",
         inputSchema: getIpInfoInputSchema,
         outputSchema: getIpInfoOutputSchema,
     }),
     defineProviderAction(service, {
         name: "lookup_domain",
+        operationType: "read",
         description: "Get Neutrino domain registration, DNS, mail, website, and blocklist details.",
         inputSchema: lookupDomainInputSchema,
         outputSchema: lookupDomainOutputSchema,
     }),
     defineProviderAction(service, {
         name: "check_ip_blocklist",
+        operationType: "read",
         description: "Check whether an IP address is listed on Neutrino security blocklists.",
         inputSchema: checkIpBlocklistInputSchema,
         outputSchema: checkIpBlocklistOutputSchema,

package/src/providers/new_relic/actions.js

@@ -7,10 +7,10 @@ const stringOrNumber = s.union([s.string({ description: "A string value." }), s.
 const graphqlErrors = s.nullable(s.array(looseObject, { description: "New Relic GraphQL mutation errors." }));
 const dashboardPages = s.array(looseObject, { minItems: 1, description: "Dashboard page definitions." });
 export const newRelicActions = [
-    action("get_current_user", "Validate the connected New Relic user key and return the current user profile from NerdGraph.", {}, [], {
+    action("get_current_user", "read", "Validate the connected New Relic user key and return the current user profile from NerdGraph.", {}, [], {
         user: looseObject,
     }),
-    action("search_entities", "Search New Relic entities with either the raw entity search language or a structured query builder.", {
+    action("search_entities", "read", "Search New Relic entities with either the raw entity search language or a structured query builder.", {
         query: s.string({ description: "The raw entity search query." }),
         cursor: s.string({ description: "The entity search cursor for the next page." }),
         queryBuilder: looseObject,
@@ -19,7 +19,7 @@ export const newRelicActions = [
         nextCursor: s.nullable(s.string({ description: "The cursor for the next search page, when available." })),
         entities: looseList,
     }),
-    action("execute_nrql_query", "Execute an NRQL query against a specific New Relic account and return the query results and metadata.", {
+    action("execute_nrql_query", "read", "Execute an NRQL query against a specific New Relic account and return the query results and metadata.", {
         accountId: s.positiveInteger("The account ID to query."),
         query: s.nonEmptyString("The NRQL query string."),
         timeout: s.integer({ minimum: 1, maximum: 600, description: "The query timeout in seconds." }),
@@ -31,57 +31,57 @@ export const newRelicActions = [
         totalResult: looseObject,
         queryProgress: looseObject,
     }),
-    action("get_alert_policies", "List New Relic alert policies with optional name, incident preference, and pagination filters using the REST alerts API.", {
+    action("get_alert_policies", "read", "List New Relic alert policies with optional name, incident preference, and pagination filters using the REST alerts API.", {
         name: s.string({ description: "The optional partial policy name filter." }),
         page: s.positiveInteger("The 1-based result page to fetch."),
         incidentPreference: s.stringEnum(["PER_POLICY", "PER_CONDITION", "PER_CONDITION_AND_TARGET"], {
             description: "The incident preference filter.",
         }),
     }, [], { policies: looseList }),
-    action("create_alert_policy", "Create a New Relic alert policy using the REST alerts API.", {
+    action("create_alert_policy", "write", "Create a New Relic alert policy using the REST alerts API.", {
         name: s.nonEmptyString("The alert policy name."),
         incidentPreference: s.stringEnum(["PER_POLICY", "PER_CONDITION", "PER_CONDITION_AND_TARGET"], {
             description: "The incident preference for the new policy.",
         }),
     }, ["name"], { policy: looseObject }),
-    action("update_alert_policy", "Update a New Relic alert policy name or incident preference using the REST alerts API.", {
+    action("update_alert_policy", "write", "Update a New Relic alert policy name or incident preference using the REST alerts API.", {
         policyId: stringOrNumber,
         policy: looseObject,
     }, ["policyId", "policy"], { policy: looseObject }),
-    action("delete_alert_policy", "Delete a New Relic alert policy using the REST alerts API.", {
+    action("delete_alert_policy", "destructive", "Delete a New Relic alert policy using the REST alerts API.", {
         policyId: stringOrNumber,
     }, ["policyId"], {
         deletedPolicyId: stringOrNumber,
         deleted: s.boolean({ description: "Whether the policy delete request succeeded." }),
     }),
-    action("list_nrql_conditions", "List NRQL alert conditions for a specific alert policy using the REST alerts API.", {
+    action("list_nrql_conditions", "read", "List NRQL alert conditions for a specific alert policy using the REST alerts API.", {
         policyId: s.positiveInteger("The alert policy ID."),
         page: s.positiveInteger("The 1-based result page to fetch."),
     }, ["policyId"], {
         nrqlConditions: looseList,
     }),
-    action("create_nrql_condition", "Create a static or baseline NRQL alert condition for a policy using the REST alerts API.", {
+    action("create_nrql_condition", "write", "Create a static or baseline NRQL alert condition for a policy using the REST alerts API.", {
         policyId: s.positiveInteger("The alert policy ID."),
         nrqlCondition: looseObject,
     }, ["policyId", "nrqlCondition"], {
         nrqlCondition: looseObject,
     }),
-    action("update_nrql_condition", "Update a static or baseline NRQL alert condition using the REST alerts API.", {
+    action("update_nrql_condition", "write", "Update a static or baseline NRQL alert condition using the REST alerts API.", {
         conditionId: stringOrNumber,
         nrqlCondition: looseObject,
     }, ["conditionId", "nrqlCondition"], {
         nrqlCondition: looseObject,
     }),
-    action("delete_nrql_condition", "Delete a New Relic NRQL alert condition using the REST alerts API.", {
+    action("delete_nrql_condition", "destructive", "Delete a New Relic NRQL alert condition using the REST alerts API.", {
         conditionId: stringOrNumber,
     }, ["conditionId"], {
         deletedConditionId: stringOrNumber,
         deleted: s.boolean({ description: "Whether the NRQL condition delete request succeeded." }),
     }),
-    action("get_dashboard_entity", "Read a New Relic dashboard entity, including its pages and widgets, by GUID.", {
+    action("get_dashboard_entity", "read", "Read a New Relic dashboard entity, including its pages and widgets, by GUID.", {
         guid: s.nonEmptyString("The dashboard entity GUID."),
     }, ["guid"], { dashboard: looseObject }),
-    action("create_dashboard", "Create a New Relic dashboard with pages and widgets using NerdGraph.", {
+    action("create_dashboard", "write", "Create a New Relic dashboard with pages and widgets using NerdGraph.", {
         accountId: s.positiveInteger("The account ID that will own the dashboard."),
         name: s.nonEmptyString("The dashboard name."),
         description: s.string({ description: "The optional dashboard description." }),
@@ -93,7 +93,7 @@ export const newRelicActions = [
         dashboard: looseObject,
         errors: graphqlErrors,
     }),
-    action("update_dashboard", "Update a New Relic dashboard by GUID, replacing the dashboard configuration with the supplied pages and widgets.", {
+    action("update_dashboard", "write", "Update a New Relic dashboard by GUID, replacing the dashboard configuration with the supplied pages and widgets.", {
         guid: s.nonEmptyString("The dashboard entity GUID."),
         name: s.nonEmptyString("The updated dashboard name."),
         description: s.string({ description: "The updated dashboard description." }),
@@ -105,18 +105,18 @@ export const newRelicActions = [
         dashboard: looseObject,
         errors: graphqlErrors,
     }),
-    action("delete_dashboard", "Delete a New Relic dashboard by its entity GUID.", {
+    action("delete_dashboard", "destructive", "Delete a New Relic dashboard by its entity GUID.", {
         guid: s.nonEmptyString("The dashboard entity GUID."),
     }, ["guid"], {
         status: s.string({ description: "The dashboard deletion status." }),
         errors: graphqlErrors,
     }),
-    action("create_dashboard_snapshot_url", "Generate a snapshot URL for a New Relic dashboard page GUID.", {
+    action("create_dashboard_snapshot_url", "write", "Generate a snapshot URL for a New Relic dashboard page GUID.", {
         guid: s.nonEmptyString("The dashboard page GUID."),
     }, ["guid"], {
         url: s.url("The generated dashboard snapshot URL."),
     }),
-    action("list_monitors", "List synthetic monitors by using NerdGraph entity search over the SYNTH MONITOR entity type.", {
+    action("list_monitors", "read", "List synthetic monitors by using NerdGraph entity search over the SYNTH MONITOR entity type.", {
         cursor: s.string({ description: "The entity search cursor for the next page." }),
         query: s.string({ description: "An optional raw entity search query to further narrow the monitor set." }),
     }, [], {
@@ -124,13 +124,13 @@ export const newRelicActions = [
         nextCursor: s.nullable(s.string({ description: "The cursor for the next monitor page, when available." })),
         monitors: looseList,
     }),
-    action("get_synth_monitor", "Get a synthetic monitor by its legacy monitor ID or entity GUID using NerdGraph entity search.", {
+    action("get_synth_monitor", "read", "Get a synthetic monitor by its legacy monitor ID or entity GUID using NerdGraph entity search.", {
         monitorId: s.string({ description: "The legacy synthetic monitor ID." }),
         guid: s.string({ description: "The synthetic monitor entity GUID." }),
     }, [], {
         monitor: s.nullable(looseObject),
     }),
-    action("create_synthetics_simple_monitor", "Create a New Relic ping monitor by using the syntheticsCreateSimpleMonitor mutation.", {
+    action("create_synthetics_simple_monitor", "write", "Create a New Relic ping monitor by using the syntheticsCreateSimpleMonitor mutation.", {
         accountId: s.positiveInteger("The account ID that will own the monitor."),
         name: s.nonEmptyString("The monitor display name."),
         uri: s.url("The URL or endpoint to monitor."),
@@ -143,18 +143,18 @@ export const newRelicActions = [
         errors: graphqlErrors,
         monitor: s.nullable(looseObject),
     }),
-    action("update_synthetics_simple_monitor", "Update a New Relic ping monitor by GUID using the syntheticsUpdateSimpleMonitor mutation.", {
+    action("update_synthetics_simple_monitor", "write", "Update a New Relic ping monitor by GUID using the syntheticsUpdateSimpleMonitor mutation.", {
         guid: s.nonEmptyString("The synthetic monitor GUID."),
         monitor: looseObject,
     }, ["guid", "monitor"], {
         errors: graphqlErrors,
     }),
-    action("delete_synthetics_monitor", "Delete a synthetic monitor by GUID using the syntheticsDeleteMonitor mutation.", {
+    action("delete_synthetics_monitor", "destructive", "Delete a synthetic monitor by GUID using the syntheticsDeleteMonitor mutation.", {
         guid: s.nonEmptyString("The synthetic monitor GUID."),
     }, ["guid"], {
         deletedGuid: s.string({ description: "The GUID of the deleted synthetic monitor." }),
     }),
-    action("list_secure_credentials", "List synthetic secure credentials by using NerdGraph entity search over the SYNTH SECURE_CRED entity type.", {
+    action("list_secure_credentials", "read", "List synthetic secure credentials by using NerdGraph entity search over the SYNTH SECURE_CRED entity type.", {
         cursor: s.string({ description: "The entity search cursor for the next page." }),
         query: s.string({ description: "An optional raw entity search query to further narrow the credential set." }),
     }, [], {
@@ -162,12 +162,12 @@ export const newRelicActions = [
         nextCursor: s.nullable(s.string({ description: "The cursor for the next credentials page, when available." })),
         credentials: looseList,
     }),
-    action("get_secure_credential", "Get a synthetic secure credential by key using NerdGraph entity search metadata only.", {
+    action("get_secure_credential", "read", "Get a synthetic secure credential by key using NerdGraph entity search metadata only.", {
         key: s.nonEmptyString("The secure credential key."),
     }, ["key"], {
         credential: s.nullable(looseObject),
     }),
-    action("create_secure_credential", "Create a New Relic synthetic secure credential using NerdGraph.", {
+    action("create_secure_credential", "write", "Create a New Relic synthetic secure credential using NerdGraph.", {
         accountId: s.positiveInteger("The account ID that will own the secure credential."),
         key: s.string({ minLength: 1, maxLength: 64, description: "The secure credential key." }),
         value: s.string({ minLength: 1, maxLength: 10000, description: "The secure credential value." }),
@@ -176,7 +176,7 @@ export const newRelicActions = [
         key: s.string({ description: "The secure credential key." }),
         errors: graphqlErrors,
     }),
-    action("update_secure_credential", "Update a New Relic synthetic secure credential value or description using NerdGraph.", {
+    action("update_secure_credential", "write", "Update a New Relic synthetic secure credential value or description using NerdGraph.", {
         accountId: s.positiveInteger("The account ID that owns the secure credential."),
         key: s.string({ minLength: 1, maxLength: 64, description: "The secure credential key." }),
         value: s.string({ minLength: 1, maxLength: 10000, description: "The updated secure credential value." }),
@@ -187,7 +187,7 @@ export const newRelicActions = [
         lastUpdated: s.string({ description: "The secure credential update timestamp." }),
         errors: graphqlErrors,
     }),
-    action("delete_secure_credential", "Delete a New Relic synthetic secure credential using NerdGraph.", {
+    action("delete_secure_credential", "destructive", "Delete a New Relic synthetic secure credential using NerdGraph.", {
         accountId: s.positiveInteger("The account ID that owns the secure credential."),
         key: s.string({ minLength: 1, maxLength: 64, description: "The secure credential key." }),
     }, ["accountId", "key"], {
@@ -195,7 +195,7 @@ export const newRelicActions = [
         deleted: s.boolean({ description: "Whether the secure credential delete request succeeded." }),
         errors: graphqlErrors,
     }),
-    action("create_deployment_marker", "Create a New Relic change-tracking deployment marker for an entity GUID using NerdGraph.", {
+    action("create_deployment_marker", "write", "Create a New Relic change-tracking deployment marker for an entity GUID using NerdGraph.", {
         entityGuid: s.nonEmptyString("The target entity GUID."),
         version: s.nonEmptyString("The deployment version identifier."),
         user: s.string({ description: "The deployment user or service principal." }),
@@ -209,7 +209,7 @@ export const newRelicActions = [
     }, ["entityGuid", "version"], {
         deployment: looseObject,
     }),
-    action("list_deployments", "List deployment markers for a legacy APM application by using the REST v2 deployments API.", {
+    action("list_deployments", "read", "List deployment markers for a legacy APM application by using the REST v2 deployments API.", {
         applicationId: s.positiveInteger("The APM application ID."),
         page: s.positiveInteger("The 1-based result page to fetch."),
     }, ["applicationId"], {
@@ -217,9 +217,10 @@ export const newRelicActions = [
         links: looseObject,
     }),
 ];
-function action(name, description, inputProperties, required, outputProperties) {
+function action(name, operationType, description, inputProperties, required, outputProperties) {
     return defineProviderAction(service, {
         name,
+        operationType,
         description,
         requiredScopes: [],
         inputSchema: s.actionInput(inputProperties, required, "The input payload for this action."),

package/src/providers/one_drive/executors.d.ts

@@ -11,10 +11,12 @@ type OneDriveRequestInput = {
     headers?: Record<string, string>;
     body?: unknown;
     rawBody?: BodyInit;
-    absoluteUrlPolicy?: "children" | "search";
+    absoluteUrlPolicy?: OneDriveNextLinkPolicy;
     allowStatuses?: number[];
     signal?: AbortSignal;
 };
+/** Which paginated endpoint a caller-supplied `@odata.nextLink` is allowed to target. */
+type OneDriveNextLinkPolicy = "children" | "search" | "permissions";
 export declare const oneDriveActionHandlers: ProviderActionHandlers<"one_drive", OneDriveActionHandler>;
 export declare const executors: ProviderExecutors;
 export declare const proxy: ProviderProxyExecutor;

package/src/providers/one_drive/executors.js

@@ -27,6 +27,9 @@ export const oneDriveActionHandlers = {
     list_folder_children(input, deps) {
         return listFolderChildren(input, deps);
     },
+    list_item_permissions(input, deps) {
+        return listItemPermissions(input, deps);
+    },
     search_items(input, deps) {
         return searchItems(input, deps);
     },
@@ -146,6 +149,9 @@ function assertAllowedOneDriveNextLink(target, absoluteUrlPolicy) {
     if (absoluteUrlPolicy === "search" && !isAllowedSearchNextLinkPath(target.pathname)) {
         throw new ProviderRequestError(400, "nextLink must target OneDrive search pagination endpoints");
     }
+    if (absoluteUrlPolicy === "permissions" && !isAllowedPermissionsNextLinkPath(target.pathname)) {
+        throw new ProviderRequestError(400, "nextLink must target OneDrive permission pagination endpoints");
+    }
 }
 function isAllowedChildrenNextLinkPath(pathname) {
     const suffix = readDrivePathSuffix(pathname);
@@ -165,6 +171,20 @@ function isAllowedSearchNextLinkPath(pathname) {
     const suffix = readDrivePathSuffix(pathname);
     return Boolean(suffix && suffix.startsWith("/root/search("));
 }
+function isAllowedPermissionsNextLinkPath(pathname) {
+    const suffix = readDrivePathSuffix(pathname);
+    if (!suffix) {
+        return false;
+    }
+    if (suffix === "/root/permissions") {
+        return true;
+    }
+    if (suffix.startsWith("/items/")) {
+        const segments = suffix.split("/").filter(Boolean);
+        return segments.length === 3 && segments[0] === "items" && segments[2] === "permissions";
+    }
+    return suffix.startsWith("/root:/") && suffix.endsWith(":/permissions");
+}
 function readDrivePathSuffix(pathname) {
     const normalizedPath = trimTrailingSlash(pathname);
     if (!normalizedPath.startsWith("/v1.0/")) {
@@ -306,6 +326,20 @@ async function listFolderChildren(input, deps) {
         nextLink: readNextLink(payload),
     };
 }
+async function listItemPermissions(input, deps) {
+    const nextLink = readOptionalString(input.nextLink);
+    const path = nextLink ? nextLink : `${buildDriveItemPathFromInput(input)}/permissions`;
+    const payload = asObject(await oneDriveJsonRequest(path, {
+        accessToken: deps.accessToken,
+        fetcher: deps.fetcher,
+        absoluteUrlPolicy: nextLink ? "permissions" : undefined,
+        query: nextLink ? undefined : compactObject({ $select: formatOptionalStringArray(input.select) }),
+    }));
+    return {
+        items: readCollectionItems(payload.value),
+        nextLink: readNextLink(payload),
+    };
+}
 async function searchItems(input, deps) {
     const nextLink = readOptionalString(input.nextLink);
     const path = nextLink
@@ -852,13 +886,13 @@ function buildDriveBasePath(driveId) {
     if (!driveId || driveId === "me") {
         return "me/drive";
     }
-    return `drives/${encodeURIComponent(driveId)}`;
+    return `drives/${encodeDriveSegment(driveId, "driveId")}`;
 }
 function buildDriveRootPath(driveId) {
     return `${buildDriveBasePath(driveId)}/root`;
 }
 function buildDriveItemPath(itemId, driveId) {
-    return `${buildDriveBasePath(driveId)}/items/${encodeURIComponent(itemId)}`;
+    return `${buildDriveBasePath(driveId)}/items/${encodeDriveSegment(itemId, "itemId")}`;
 }
 function buildDrivePathFromPath(path, driveId, fieldName) {
     const normalizedSegments = normalizeDrivePath(path, fieldName);
@@ -874,6 +908,17 @@ function buildDrivePathFromSegments(segments, driveId) {
     }
     return `${buildDriveBasePath(driveId)}/root:/${segments.map((segment) => encodeURIComponent(segment)).join("/")}:`;
 }
+// encodeURIComponent leaves "." and ".." intact, and new URL() then collapses them as dot segments,
+// which would let an input escape its Graph path prefix while still carrying the user's token.
+function assertSafeDriveSegment(segment, fieldName) {
+    if (segment === "." || segment === ".." || segment.includes("\\")) {
+        throw new ProviderRequestError(400, `${fieldName} must not contain ".", "..", or backslash path segments`);
+    }
+}
+function encodeDriveSegment(segment, fieldName) {
+    assertSafeDriveSegment(segment, fieldName);
+    return encodeURIComponent(segment);
+}
 function normalizeDrivePath(path, fieldName) {
     const trimmed = path.trim();
     if (!trimmed) {
@@ -889,6 +934,9 @@ function normalizeDrivePath(path, fieldName) {
     if (segments.some((segment) => segment.length === 0)) {
         throw new ProviderRequestError(400, `${fieldName} must not contain empty path segments`);
     }
+    for (const segment of segments) {
+        assertSafeDriveSegment(segment, fieldName);
+    }
     return segments;
 }
 function normalizeFlexibleDrivePath(path, fieldName) {
@@ -904,6 +952,9 @@ function normalizeFlexibleDrivePath(path, fieldName) {
     if (segments.some((segment) => segment.length === 0)) {
         throw new ProviderRequestError(400, `${fieldName} must not contain empty path segments`);
     }
+    for (const segment of segments) {
+        assertSafeDriveSegment(segment, fieldName);
+    }
     return segments;
 }
 function resolveSearchQuery(input) {

package/src/providers/one_password_events/actions.js

@@ -26,6 +26,7 @@ const eventStreamOutputSchema = s.object("A normalized 1Password Events API stre
 export const onePasswordEventsActions = [
     defineProviderAction(service, {
         name: "list_audit_events",
+        operationType: "read",
         description: "List 1Password audit events using the official cursor-based Events API.",
         requiredScopes: ["auditevents"],
         inputSchema: cursorEventInputSchema,
@@ -33,6 +34,7 @@ export const onePasswordEventsActions = [
     }),
     defineProviderAction(service, {
         name: "list_item_usages",
+        operationType: "read",
         description: "List 1Password item usage events using the official cursor-based Events API.",
         requiredScopes: ["itemusages"],
         inputSchema: cursorEventInputSchema,
@@ -40,6 +42,7 @@ export const onePasswordEventsActions = [
     }),
     defineProviderAction(service, {
         name: "list_sign_in_attempts",
+        operationType: "read",
         description: "List 1Password sign-in attempts using the official cursor-based Events API.",
         requiredScopes: ["signinattempts"],
         inputSchema: cursorEventInputSchema,