@sonde/packs 0.1.0 → 0.1.2

package/src/integrations/splunk.ts

@@ -0,0 +1,352 @@
+import type {
+  FetchFn,
+  IntegrationConfig,
+  IntegrationCredentials,
+  IntegrationPack,
+  IntegrationProbeHandler,
+} from '@sonde/shared';
+
+// --- Auth helpers ---
+
+/** Build auth headers: Bearer token or Basic username:password */
+export function buildAuthHeaders(credentials: IntegrationCredentials): Record<string, string> {
+  if (credentials.authMethod === 'bearer_token') {
+    const token = credentials.credentials.splunkToken ?? '';
+    return { Authorization: `Bearer ${token}` };
+  }
+
+  // basic auth
+  const { username, password } = credentials.credentials;
+  if (username && password) {
+    return { Authorization: `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}` };
+  }
+  return {};
+}
+
+// --- Splunk REST helper ---
+
+/** Build a full Splunk REST URL with output_mode=json */
+function splunkUrl(endpoint: string, path: string, params?: Record<string, string>): string {
+  const base = `${endpoint.replace(/\/$/, '')}${path}`;
+  const url = new URL(base);
+  url.searchParams.set('output_mode', 'json');
+  if (params) {
+    for (const [key, value] of Object.entries(params)) {
+      url.searchParams.set(key, value);
+    }
+  }
+  return url.toString();
+}
+
+/** GET a Splunk REST endpoint, returns parsed JSON */
+export async function splunkGet(
+  path: string,
+  config: IntegrationConfig,
+  credentials: IntegrationCredentials,
+  fetchFn: FetchFn,
+  params?: Record<string, string>,
+): Promise<unknown> {
+  const url = splunkUrl(config.endpoint, path, params);
+  const headers: Record<string, string> = {
+    Accept: 'application/json',
+    ...buildAuthHeaders(credentials),
+    ...config.headers,
+  };
+
+  const res = await fetchFn(url, { headers });
+  if (!res.ok) throw new Error(`Splunk API returned ${res.status}: ${res.statusText}`);
+  return res.json();
+}
+
+/** POST URL-encoded form data to a Splunk REST endpoint, returns parsed JSON */
+export async function splunkPost(
+  path: string,
+  formData: Record<string, string>,
+  config: IntegrationConfig,
+  credentials: IntegrationCredentials,
+  fetchFn: FetchFn,
+): Promise<unknown> {
+  const url = splunkUrl(config.endpoint, path);
+  const body = new URLSearchParams(formData);
+
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/x-www-form-urlencoded',
+    Accept: 'application/json',
+    ...buildAuthHeaders(credentials),
+    ...config.headers,
+  };
+
+  const res = await fetchFn(url, { method: 'POST', headers, body: body.toString() });
+  if (!res.ok) throw new Error(`Splunk API returned ${res.status}: ${res.statusText}`);
+  return res.json();
+}
+
+// --- Probe handlers ---
+
+const POLL_INTERVAL_MS = 1000;
+const MAX_POLL_ATTEMPTS = 60;
+
+const splunkSearch: IntegrationProbeHandler = async (params, config, credentials, fetchFn) => {
+  const query = (params?.query as string) ?? '';
+  if (!query) throw new Error('query parameter is required (SPL search string)');
+
+  const earliest = (params?.earliest as string) || '-24h';
+  const latest = (params?.latest as string) || 'now';
+  const maxResults = (params?.max_results as number) || 100;
+
+  const startTime = Date.now();
+
+  // Create async search job via v2 API
+  const jobResponse = (await splunkPost(
+    '/services/search/v2/jobs',
+    {
+      search: query,
+      earliest_time: earliest,
+      latest_time: latest,
+    },
+    config,
+    credentials,
+    fetchFn,
+  )) as { sid?: string };
+
+  const sid = jobResponse.sid;
+  if (!sid) throw new Error('Splunk did not return a search job ID (sid)');
+
+  // Poll until done
+  let dispatchState = '';
+  let attempts = 0;
+
+  while (dispatchState !== 'DONE' && attempts < MAX_POLL_ATTEMPTS) {
+    const status = (await splunkGet(
+      `/services/search/v2/jobs/${sid}`,
+      config,
+      credentials,
+      fetchFn,
+    )) as { entry?: Array<{ content?: { dispatchState?: string } }> };
+
+    dispatchState = status.entry?.[0]?.content?.dispatchState ?? '';
+
+    if (dispatchState === 'FAILED') {
+      throw new Error('Splunk search job failed');
+    }
+
+    if (dispatchState !== 'DONE') {
+      await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+      attempts++;
+    }
+  }
+
+  if (dispatchState !== 'DONE') {
+    throw new Error('Splunk search job timed out waiting for completion');
+  }
+
+  // Fetch results
+  const results = (await splunkGet(
+    `/services/search/v2/jobs/${sid}/results`,
+    config,
+    credentials,
+    fetchFn,
+    { count: String(maxResults) },
+  )) as { results?: unknown[]; init_offset?: number; post_process_count?: number };
+
+  const executionTimeMs = Date.now() - startTime;
+
+  return {
+    results: results.results ?? [],
+    resultCount: (results.results ?? []).length,
+    sid,
+    executionTimeMs,
+  };
+};
+
+const splunkIndexes: IntegrationProbeHandler = async (_params, config, credentials, fetchFn) => {
+  const data = (await splunkGet('/services/data/indexes', config, credentials, fetchFn, {
+    count: '0',
+  })) as {
+    entry?: Array<{
+      name?: string;
+      content?: {
+        currentDBSizeMB?: number;
+        totalEventCount?: string;
+        minTime?: string;
+        maxTime?: string;
+        disabled?: boolean;
+      };
+    }>;
+  };
+
+  const indexes = (data.entry ?? []).map((entry) => ({
+    name: entry.name ?? '',
+    currentSizeMB: entry.content?.currentDBSizeMB ?? 0,
+    totalEventCount: entry.content?.totalEventCount ?? '0',
+    earliestEventTime: entry.content?.minTime ?? null,
+    latestEventTime: entry.content?.maxTime ?? null,
+    disabled: entry.content?.disabled ?? false,
+  }));
+
+  return { indexes, count: indexes.length };
+};
+
+const splunkSavedSearches: IntegrationProbeHandler = async (
+  params,
+  config,
+  credentials,
+  fetchFn,
+) => {
+  const filterName = params?.name as string | undefined;
+
+  const data = (await splunkGet('/services/saved/searches', config, credentials, fetchFn, {
+    count: '0',
+  })) as {
+    entry?: Array<{
+      name?: string;
+      content?: {
+        search?: string;
+        cron_schedule?: string;
+        'dispatch.latest_time'?: string;
+        disabled?: boolean;
+        triggered_alert_count?: number;
+      };
+      updated?: string;
+    }>;
+  };
+
+  let searches = (data.entry ?? []).map((entry) => ({
+    name: entry.name ?? '',
+    search: entry.content?.search ?? '',
+    cronSchedule: entry.content?.cron_schedule ?? null,
+    disabled: entry.content?.disabled ?? false,
+    triggeredAlertCount: entry.content?.triggered_alert_count ?? 0,
+    lastUpdated: entry.updated ?? null,
+  }));
+
+  if (filterName) {
+    const lower = filterName.toLowerCase();
+    searches = searches.filter((s) => s.name.toLowerCase().includes(lower));
+  }
+
+  return { savedSearches: searches, count: searches.length };
+};
+
+const splunkHealth: IntegrationProbeHandler = async (_params, config, credentials, fetchFn) => {
+  const data = (await splunkGet(
+    '/services/server/health/splunkd',
+    config,
+    credentials,
+    fetchFn,
+  )) as {
+    entry?: Array<{
+      content?: {
+        health?: string;
+        features?: Record<string, { health?: string; [key: string]: unknown }>;
+      };
+    }>;
+  };
+
+  const content = data.entry?.[0]?.content;
+  const features = content?.features ?? {};
+
+  const featureHealth = Object.entries(features).map(([name, info]) => ({
+    name,
+    health: info.health ?? 'unknown',
+  }));
+
+  return {
+    overallHealth: content?.health ?? 'unknown',
+    features: featureHealth,
+  };
+};
+
+// --- Pack definition ---
+
+export const splunkPack: IntegrationPack = {
+  manifest: {
+    name: 'splunk',
+    type: 'integration',
+    version: '0.1.0',
+    description: 'Splunk Enterprise — search, indexes, saved searches, and health monitoring',
+    requires: { groups: [], files: [], commands: [] },
+    probes: [
+      {
+        name: 'search',
+        description:
+          'Run an SPL search query and return results. Requires a role with "search" capability.',
+        capability: 'observe',
+        params: {
+          query: {
+            type: 'string',
+            description: 'SPL search query (e.g. "search index=main error | head 10")',
+            required: true,
+          },
+          earliest: {
+            type: 'string',
+            description: 'Earliest time (default: "-24h")',
+            required: false,
+          },
+          latest: {
+            type: 'string',
+            description: 'Latest time (default: "now")',
+            required: false,
+          },
+          max_results: {
+            type: 'number',
+            description: 'Maximum results to return (default: 100)',
+            required: false,
+          },
+        },
+        timeout: 60000,
+      },
+      {
+        name: 'indexes',
+        description: 'List all indexes with size, event count, and time range',
+        capability: 'observe',
+        params: {},
+        timeout: 15000,
+      },
+      {
+        name: 'saved_searches',
+        description: 'List saved searches with schedule and status',
+        capability: 'observe',
+        params: {
+          name: {
+            type: 'string',
+            description: 'Optional name filter (case-insensitive substring match)',
+            required: false,
+          },
+        },
+        timeout: 15000,
+      },
+      {
+        name: 'health',
+        description: 'Splunkd health status with per-feature breakdown',
+        capability: 'observe',
+        params: {},
+        timeout: 15000,
+      },
+    ],
+    runbook: {
+      category: 'observability',
+      probes: ['health', 'indexes'],
+      parallel: true,
+    },
+  },
+
+  handlers: {
+    search: splunkSearch,
+    indexes: splunkIndexes,
+    saved_searches: splunkSavedSearches,
+    health: splunkHealth,
+  },
+
+  testConnection: async (config, credentials, fetchFn) => {
+    const url = splunkUrl(config.endpoint, '/services/server/info');
+    const headers: Record<string, string> = {
+      Accept: 'application/json',
+      ...buildAuthHeaders(credentials),
+      ...config.headers,
+    };
+
+    const res = await fetchFn(url, { headers });
+    return res.ok;
+  },
+};

package/src/mysql/index.ts

@@ -0,0 +1,14 @@
+import type { Pack } from '../types.js';
+import { mysqlManifest } from './manifest.js';
+import { databasesList } from './probes/databases-list.js';
+import { processlist } from './probes/processlist.js';
+import { status } from './probes/status.js';
+
+export const mysqlPack: Pack = {
+  manifest: mysqlManifest,
+  handlers: {
+    'mysql.databases.list': databasesList,
+    'mysql.processlist': processlist,
+    'mysql.status': status,
+  },
+};

package/src/mysql/manifest.ts

@@ -0,0 +1,70 @@
+import type { PackManifest } from '@sonde/shared';
+
+export const mysqlManifest: PackManifest = {
+  name: 'mysql',
+  version: '0.1.0',
+  description: 'MySQL probes: database listing, process list, server status',
+  requires: {
+    groups: [],
+    files: [],
+    commands: ['mysql'],
+  },
+  probes: [
+    {
+      name: 'databases.list',
+      description: 'List all MySQL databases with table counts and sizes',
+      capability: 'observe',
+      params: {
+        host: {
+          type: 'string',
+          description: 'Database host',
+          required: false,
+          default: 'localhost',
+        },
+        port: { type: 'number', description: 'Database port', required: false, default: 3306 },
+        user: { type: 'string', description: 'Database user', required: false, default: 'root' },
+      },
+      timeout: 15_000,
+    },
+    {
+      name: 'processlist',
+      description: 'Show active MySQL processes',
+      capability: 'observe',
+      params: {
+        host: {
+          type: 'string',
+          description: 'Database host',
+          required: false,
+          default: 'localhost',
+        },
+        port: { type: 'number', description: 'Database port', required: false, default: 3306 },
+        user: { type: 'string', description: 'Database user', required: false, default: 'root' },
+      },
+      timeout: 15_000,
+    },
+    {
+      name: 'status',
+      description: 'Get MySQL server status variables',
+      capability: 'observe',
+      params: {
+        host: {
+          type: 'string',
+          description: 'Database host',
+          required: false,
+          default: 'localhost',
+        },
+        port: { type: 'number', description: 'Database port', required: false, default: 3306 },
+        user: { type: 'string', description: 'Database user', required: false, default: 'root' },
+      },
+      timeout: 15_000,
+    },
+  ],
+  runbook: {
+    category: 'mysql',
+    probes: ['databases.list', 'processlist', 'status'],
+    parallel: true,
+  },
+  detect: {
+    commands: ['mysql'],
+  },
+};

package/src/mysql/probes/databases-list.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, it } from 'vitest';
+import type { ExecFn } from '../../types.js';
+import type { MysqlDatabasesListResult } from './databases-list.js';
+import { databasesList, parseDatabasesList } from './databases-list.js';
+
+const SAMPLE_OUTPUT = `information_schema\t79\t0.00
+myapp\t15\t256.50
+mysql\t38\t2.44`;
+
+describe('parseDatabasesList', () => {
+  it('parses mysql output into structured data', () => {
+    const result = parseDatabasesList(SAMPLE_OUTPUT);
+    expect(result.count).toBe(3);
+    expect(result.databases[0]).toEqual({
+      name: 'information_schema',
+      tables: 79,
+      sizeMb: 0,
+    });
+    expect(result.databases[1]).toEqual({
+      name: 'myapp',
+      tables: 15,
+      sizeMb: 256.5,
+    });
+  });
+
+  it('handles empty output', () => {
+    const result = parseDatabasesList('');
+    expect(result.count).toBe(0);
+    expect(result.databases).toEqual([]);
+  });
+});
+
+describe('databasesList handler', () => {
+  it('calls mysql with default params', async () => {
+    const mockExec: ExecFn = async (cmd, args) => {
+      expect(cmd).toBe('mysql');
+      expect(args).toContain('-h');
+      expect(args).toContain('localhost');
+      expect(args).toContain('-P');
+      expect(args).toContain('3306');
+      expect(args).toContain('-u');
+      expect(args).toContain('root');
+      expect(args).toContain('--batch');
+      expect(args).toContain('--skip-column-names');
+      return SAMPLE_OUTPUT;
+    };
+
+    const result = (await databasesList(undefined, mockExec)) as MysqlDatabasesListResult;
+    expect(result.count).toBe(3);
+  });
+
+  it('passes custom host/port/user', async () => {
+    const mockExec: ExecFn = async (cmd, args) => {
+      expect(args).toContain('db.example.com');
+      expect(args).toContain('3307');
+      expect(args).toContain('admin');
+      return SAMPLE_OUTPUT;
+    };
+
+    await databasesList({ host: 'db.example.com', port: 3307, user: 'admin' }, mockExec);
+  });
+});

package/src/mysql/probes/databases-list.ts

@@ -0,0 +1,45 @@
+import type { ProbeHandler } from '../../types.js';
+
+export interface MysqlDatabaseInfo {
+  name: string;
+  tables: number;
+  sizeMb: number;
+}
+
+export interface MysqlDatabasesListResult {
+  databases: MysqlDatabaseInfo[];
+  count: number;
+}
+
+export const databasesList: ProbeHandler = async (params, exec) => {
+  const host = (params?.host as string) ?? 'localhost';
+  const port = String((params?.port as number) ?? 3306);
+  const user = (params?.user as string) ?? 'root';
+
+  const stdout = await exec('mysql', [
+    '-h',
+    host,
+    '-P',
+    port,
+    '-u',
+    user,
+    '--batch',
+    '--skip-column-names',
+    '-e',
+    'SELECT s.SCHEMA_NAME, COUNT(t.TABLE_NAME), ROUND(SUM(t.DATA_LENGTH + t.INDEX_LENGTH) / 1024 / 1024, 2) FROM information_schema.SCHEMATA s LEFT JOIN information_schema.TABLES t ON s.SCHEMA_NAME = t.TABLE_SCHEMA GROUP BY s.SCHEMA_NAME ORDER BY s.SCHEMA_NAME',
+  ]);
+  return parseDatabasesList(stdout);
+};
+
+export function parseDatabasesList(stdout: string): MysqlDatabasesListResult {
+  const lines = stdout.trim().split('\n').filter(Boolean);
+  const databases: MysqlDatabaseInfo[] = lines.map((line) => {
+    const parts = line.split('\t');
+    return {
+      name: parts[0] ?? '',
+      tables: Number(parts[1]) || 0,
+      sizeMb: Number(parts[2]) || 0,
+    };
+  });
+  return { databases, count: databases.length };
+}

package/src/mysql/probes/processlist.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it } from 'vitest';
+import type { ExecFn } from '../../types.js';
+import type { MysqlProcesslistResult } from './processlist.js';
+import { parseProcesslist, processlist } from './processlist.js';
+
+const SAMPLE_OUTPUT = `42\troot\tlocalhost\tmyapp\tQuery\t120\texecuting\tSELECT * FROM large_table
+99\tappuser\t192.168.1.10\tmyapp\tSleep\t5\t\t`;
+
+describe('parseProcesslist', () => {
+  it('parses process list output', () => {
+    const result = parseProcesslist(SAMPLE_OUTPUT);
+    expect(result.count).toBe(2);
+    expect(result.processes[0]).toEqual({
+      id: 42,
+      user: 'root',
+      host: 'localhost',
+      db: 'myapp',
+      command: 'Query',
+      time: 120,
+      state: 'executing',
+      info: 'SELECT * FROM large_table',
+    });
+    expect(result.processes[1]?.command).toBe('Sleep');
+  });
+
+  it('handles empty output', () => {
+    const result = parseProcesslist('');
+    expect(result.count).toBe(0);
+    expect(result.processes).toEqual([]);
+  });
+});
+
+describe('processlist handler', () => {
+  it('calls mysql with correct args', async () => {
+    const mockExec: ExecFn = async (cmd, args) => {
+      expect(cmd).toBe('mysql');
+      expect(args).toContain('--batch');
+      expect(args).toContain('--skip-column-names');
+      const query = args[args.length - 1];
+      expect(query).toContain('PROCESSLIST');
+      return SAMPLE_OUTPUT;
+    };
+
+    const result = (await processlist(undefined, mockExec)) as MysqlProcesslistResult;
+    expect(result.count).toBe(2);
+  });
+});

package/src/mysql/probes/processlist.ts

@@ -0,0 +1,55 @@
+import type { ProbeHandler } from '../../types.js';
+
+export interface MysqlProcessInfo {
+  id: number;
+  user: string;
+  host: string;
+  db: string;
+  command: string;
+  time: number;
+  state: string;
+  info: string;
+}
+
+export interface MysqlProcesslistResult {
+  processes: MysqlProcessInfo[];
+  count: number;
+}
+
+export const processlist: ProbeHandler = async (params, exec) => {
+  const host = (params?.host as string) ?? 'localhost';
+  const port = String((params?.port as number) ?? 3306);
+  const user = (params?.user as string) ?? 'root';
+
+  const stdout = await exec('mysql', [
+    '-h',
+    host,
+    '-P',
+    port,
+    '-u',
+    user,
+    '--batch',
+    '--skip-column-names',
+    '-e',
+    'SELECT ID, USER, HOST, IFNULL(DB, ""), COMMAND, TIME, IFNULL(STATE, ""), LEFT(IFNULL(INFO, ""), 200) FROM information_schema.PROCESSLIST ORDER BY TIME DESC',
+  ]);
+  return parseProcesslist(stdout);
+};
+
+export function parseProcesslist(stdout: string): MysqlProcesslistResult {
+  const lines = stdout.trim().split('\n').filter(Boolean);
+  const processes: MysqlProcessInfo[] = lines.map((line) => {
+    const parts = line.split('\t');
+    return {
+      id: Number(parts[0]) || 0,
+      user: parts[1] ?? '',
+      host: parts[2] ?? '',
+      db: parts[3] ?? '',
+      command: parts[4] ?? '',
+      time: Number(parts[5]) || 0,
+      state: parts[6] ?? '',
+      info: parts[7] ?? '',
+    };
+  });
+  return { processes, count: processes.length };
+}

package/src/mysql/probes/status.test.ts

@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest';
+import type { ExecFn } from '../../types.js';
+import type { MysqlStatusResult } from './status.js';
+import { parseMysqlStatus, status } from './status.js';
+
+const SAMPLE_OUTPUT = `Uptime\t86400
+Threads_connected\t15
+Questions\t1728000
+Slow_queries\t42
+Opened_tables\t500
+Open_tables\t200`;
+
+describe('parseMysqlStatus', () => {
+  it('parses status variables', () => {
+    const result = parseMysqlStatus(SAMPLE_OUTPUT);
+    expect(result.uptime).toBe(86400);
+    expect(result.threads).toBe(15);
+    expect(result.questions).toBe(1728000);
+    expect(result.slowQueries).toBe(42);
+    expect(result.opens).toBe(500);
+    expect(result.openTables).toBe(200);
+    expect(result.queriesPerSecondAvg).toBe(20);
+  });
+
+  it('stores all variables in map', () => {
+    const result = parseMysqlStatus(SAMPLE_OUTPUT);
+    expect(result.variables['Uptime']).toBe('86400');
+    expect(result.variables['Slow_queries']).toBe('42');
+  });
+
+  it('handles empty output', () => {
+    const result = parseMysqlStatus('');
+    expect(result.uptime).toBe(0);
+    expect(result.queriesPerSecondAvg).toBe(0);
+  });
+});
+
+describe('status handler', () => {
+  it('calls mysql SHOW GLOBAL STATUS', async () => {
+    const mockExec: ExecFn = async (cmd, args) => {
+      expect(cmd).toBe('mysql');
+      const query = args[args.length - 1];
+      expect(query).toContain('SHOW GLOBAL STATUS');
+      return SAMPLE_OUTPUT;
+    };
+
+    const result = (await status(undefined, mockExec)) as MysqlStatusResult;
+    expect(result.uptime).toBe(86400);
+  });
+});