runline 0.1.0

package/dist/plugins/slack/src/index.js

@@ -0,0 +1,236 @@
+async function api(token, method, endpoint, body, qs) {
+    const url = new URL(`https://slack.com/api${endpoint}`);
+    if (qs) {
+        for (const [k, v] of Object.entries(qs)) {
+            if (v !== undefined && v !== null)
+                url.searchParams.set(k, String(v));
+        }
+    }
+    const init = { method, headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json; charset=utf-8" } };
+    if (body && Object.keys(body).length > 0)
+        init.body = JSON.stringify(body);
+    const res = await fetch(url.toString(), init);
+    if (!res.ok)
+        throw new Error(`Slack HTTP error ${res.status}: ${await res.text()}`);
+    const data = (await res.json());
+    if (data.ok === false)
+        throw new Error(`Slack API error: ${data.error}`);
+    return data;
+}
+export default function slack(rl) {
+    rl.setName("slack");
+    rl.setVersion("0.1.0");
+    rl.setConnectionSchema({ accessToken: { type: "string", required: true, description: "Slack Bot/User token", env: "SLACK_ACCESS_TOKEN" } });
+    const t = (ctx) => ctx.connection.config.accessToken;
+    // ── Message ─────────────────────────────────────────
+    rl.registerAction("message.post", { description: "Post a message to a channel or user",
+        inputSchema: { channel: { type: "string", required: true }, text: { type: "string", required: false }, blocks: { type: "object", required: false }, threadTs: { type: "string", required: false }, replyBroadcast: { type: "boolean", required: false }, unfurlLinks: { type: "boolean", required: false } },
+        async execute(input, ctx) {
+            const p = input;
+            const body = { channel: p.channel };
+            if (p.text)
+                body.text = p.text;
+            if (p.blocks)
+                body.blocks = p.blocks;
+            if (p.threadTs)
+                body.thread_ts = p.threadTs;
+            if (p.replyBroadcast)
+                body.reply_broadcast = true;
+            if (p.unfurlLinks !== undefined)
+                body.unfurl_links = p.unfurlLinks;
+            return api(t(ctx), "POST", "/chat.postMessage", body);
+        } });
+    rl.registerAction("message.update", { description: "Update a message",
+        inputSchema: { channel: { type: "string", required: true }, ts: { type: "string", required: true }, text: { type: "string", required: false }, blocks: { type: "object", required: false } },
+        async execute(input, ctx) { return api(t(ctx), "POST", "/chat.update", input); } });
+    rl.registerAction("message.delete", { description: "Delete a message",
+        inputSchema: { channel: { type: "string", required: true }, ts: { type: "string", required: true } },
+        async execute(input, ctx) { return api(t(ctx), "POST", "/chat.delete", input); } });
+    rl.registerAction("message.getPermalink", { description: "Get a message permalink",
+        inputSchema: { channel: { type: "string", required: true }, messageTs: { type: "string", required: true } },
+        async execute(input, ctx) { const p = input; return api(t(ctx), "GET", "/chat.getPermalink", undefined, { channel: p.channel, message_ts: p.messageTs }); } });
+    rl.registerAction("message.search", { description: "Search messages",
+        inputSchema: { query: { type: "string", required: true }, sort: { type: "string", required: false, description: "score or timestamp" }, limit: { type: "number", required: false } },
+        async execute(input, ctx) {
+            const p = input;
+            const qs = { query: p.query };
+            if (p.sort)
+                qs.sort = p.sort === "relevance" ? "score" : "timestamp";
+            if (p.limit)
+                qs.count = p.limit;
+            const data = (await api(t(ctx), "POST", "/search.messages", undefined, qs));
+            return data.messages?.matches;
+        } });
+    // ── Channel ─────────────────────────────────────────
+    rl.registerAction("channel.create", { description: "Create a channel",
+        inputSchema: { name: { type: "string", required: true }, isPrivate: { type: "boolean", required: false } },
+        async execute(input, ctx) {
+            const p = input;
+            const data = (await api(t(ctx), "POST", "/conversations.create", { name: p.name, is_private: p.isPrivate ?? false }));
+            return data.channel;
+        } });
+    rl.registerAction("channel.get", { description: "Get channel info",
+        inputSchema: { channel: { type: "string", required: true } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "POST", "/conversations.info", undefined, { channel: input.channel })); return data.channel; } });
+    rl.registerAction("channel.list", { description: "List channels",
+        inputSchema: { limit: { type: "number", required: false }, types: { type: "string", required: false, description: "Comma-separated: public_channel,private_channel" }, excludeArchived: { type: "boolean", required: false } },
+        async execute(input, ctx) {
+            const p = (input ?? {});
+            const qs = { types: p.types ?? "public_channel,private_channel" };
+            if (p.limit)
+                qs.limit = p.limit;
+            if (p.excludeArchived)
+                qs.exclude_archived = true;
+            const data = (await api(t(ctx), "GET", "/conversations.list", undefined, qs));
+            return data.channels;
+        } });
+    rl.registerAction("channel.history", { description: "Get channel message history",
+        inputSchema: { channel: { type: "string", required: true }, limit: { type: "number", required: false }, oldest: { type: "string", required: false, description: "ISO datetime" }, latest: { type: "string", required: false } },
+        async execute(input, ctx) {
+            const p = input;
+            const qs = { channel: p.channel };
+            if (p.limit)
+                qs.limit = p.limit;
+            if (p.oldest)
+                qs.oldest = new Date(p.oldest).getTime() / 1000;
+            if (p.latest)
+                qs.latest = new Date(p.latest).getTime() / 1000;
+            const data = (await api(t(ctx), "GET", "/conversations.history", undefined, qs));
+            return data.messages;
+        } });
+    rl.registerAction("channel.replies", { description: "Get thread replies",
+        inputSchema: { channel: { type: "string", required: true }, ts: { type: "string", required: true }, limit: { type: "number", required: false } },
+        async execute(input, ctx) {
+            const p = input;
+            const qs = { channel: p.channel, ts: p.ts };
+            if (p.limit)
+                qs.limit = p.limit;
+            const data = (await api(t(ctx), "GET", "/conversations.replies", undefined, qs));
+            return data.messages;
+        } });
+    rl.registerAction("channel.invite", { description: "Invite users to a channel",
+        inputSchema: { channel: { type: "string", required: true }, users: { type: "string", required: true, description: "Comma-separated user IDs" } },
+        async execute(input, ctx) { const p = input; const data = (await api(t(ctx), "POST", "/conversations.invite", { channel: p.channel, users: p.users })); return data.channel; } });
+    rl.registerAction("channel.kick", { description: "Remove a user from a channel",
+        inputSchema: { channel: { type: "string", required: true }, user: { type: "string", required: true } },
+        async execute(input, ctx) { return api(t(ctx), "POST", "/conversations.kick", input); } });
+    rl.registerAction("channel.join", { description: "Join a channel",
+        inputSchema: { channel: { type: "string", required: true } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "POST", "/conversations.join", { channel: input.channel })); return data.channel; } });
+    rl.registerAction("channel.leave", { description: "Leave a channel",
+        inputSchema: { channel: { type: "string", required: true } },
+        async execute(input, ctx) { return api(t(ctx), "POST", "/conversations.leave", { channel: input.channel }); } });
+    rl.registerAction("channel.archive", { description: "Archive a channel",
+        inputSchema: { channel: { type: "string", required: true } },
+        async execute(input, ctx) { return api(t(ctx), "POST", "/conversations.archive", { channel: input.channel }); } });
+    rl.registerAction("channel.unarchive", { description: "Unarchive a channel",
+        inputSchema: { channel: { type: "string", required: true } },
+        async execute(input, ctx) { return api(t(ctx), "POST", "/conversations.unarchive", { channel: input.channel }); } });
+    rl.registerAction("channel.rename", { description: "Rename a channel",
+        inputSchema: { channel: { type: "string", required: true }, name: { type: "string", required: true } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "POST", "/conversations.rename", input)); return data.channel; } });
+    rl.registerAction("channel.setTopic", { description: "Set channel topic",
+        inputSchema: { channel: { type: "string", required: true }, topic: { type: "string", required: true } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "POST", "/conversations.setTopic", input)); return data.channel; } });
+    rl.registerAction("channel.setPurpose", { description: "Set channel purpose",
+        inputSchema: { channel: { type: "string", required: true }, purpose: { type: "string", required: true } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "POST", "/conversations.setPurpose", input)); return data.channel; } });
+    rl.registerAction("channel.members", { description: "List channel members",
+        inputSchema: { channel: { type: "string", required: true }, limit: { type: "number", required: false } },
+        async execute(input, ctx) {
+            const p = input;
+            const qs = { channel: p.channel };
+            if (p.limit)
+                qs.limit = p.limit;
+            const data = (await api(t(ctx), "GET", "/conversations.members", undefined, qs));
+            return data.members.map(m => ({ member: m }));
+        } });
+    // ── Reaction ────────────────────────────────────────
+    rl.registerAction("reaction.add", { description: "Add a reaction to a message",
+        inputSchema: { channel: { type: "string", required: true }, timestamp: { type: "string", required: true }, name: { type: "string", required: true, description: "Emoji name without colons" } },
+        async execute(input, ctx) { return api(t(ctx), "POST", "/reactions.add", input); } });
+    rl.registerAction("reaction.remove", { description: "Remove a reaction",
+        inputSchema: { channel: { type: "string", required: true }, timestamp: { type: "string", required: true }, name: { type: "string", required: true } },
+        async execute(input, ctx) { return api(t(ctx), "POST", "/reactions.remove", input); } });
+    rl.registerAction("reaction.get", { description: "Get reactions for a message",
+        inputSchema: { channel: { type: "string", required: true }, timestamp: { type: "string", required: true } },
+        async execute(input, ctx) { return api(t(ctx), "GET", "/reactions.get", undefined, input); } });
+    // ── User ────────────────────────────────────────────
+    rl.registerAction("user.info", { description: "Get user info",
+        inputSchema: { user: { type: "string", required: true } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "GET", "/users.info", undefined, { user: input.user })); return data.user; } });
+    rl.registerAction("user.list", { description: "List all users",
+        inputSchema: { limit: { type: "number", required: false } },
+        async execute(input, ctx) {
+            const qs = {};
+            if (input?.limit)
+                qs.limit = input.limit;
+            const data = (await api(t(ctx), "GET", "/users.list", undefined, qs));
+            return data.members;
+        } });
+    rl.registerAction("user.getPresence", { description: "Get a user's presence",
+        inputSchema: { user: { type: "string", required: true } },
+        async execute(input, ctx) { return api(t(ctx), "GET", "/users.getPresence", undefined, { user: input.user }); } });
+    rl.registerAction("user.getProfile", { description: "Get a user's profile",
+        inputSchema: { user: { type: "string", required: true } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "GET", "/users.profile.get", undefined, { user: input.user })); return data.profile; } });
+    rl.registerAction("user.updateProfile", { description: "Update the authenticated user's profile",
+        inputSchema: { profile: { type: "object", required: true, description: "Profile fields to set" } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "POST", "/users.profile.set", { profile: input.profile })); return data.profile; } });
+    // ── User Group ──────────────────────────────────────
+    rl.registerAction("userGroup.create", { description: "Create a user group",
+        inputSchema: { name: { type: "string", required: true }, handle: { type: "string", required: false }, description: { type: "string", required: false } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "POST", "/usergroups.create", input)); return data.usergroup; } });
+    rl.registerAction("userGroup.list", { description: "List user groups",
+        inputSchema: { includeUsers: { type: "boolean", required: false } },
+        async execute(input, ctx) {
+            const qs = {};
+            if (input?.includeUsers)
+                qs.include_users = true;
+            const data = (await api(t(ctx), "GET", "/usergroups.list", undefined, qs));
+            return data.usergroups;
+        } });
+    rl.registerAction("userGroup.update", { description: "Update a user group",
+        inputSchema: { usergroup: { type: "string", required: true }, name: { type: "string", required: false }, handle: { type: "string", required: false }, description: { type: "string", required: false } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "POST", "/usergroups.update", input)); return data.usergroup; } });
+    rl.registerAction("userGroup.enable", { description: "Enable a user group",
+        inputSchema: { usergroup: { type: "string", required: true } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "POST", "/usergroups.enable", { usergroup: input.usergroup })); return data.usergroup; } });
+    rl.registerAction("userGroup.disable", { description: "Disable a user group",
+        inputSchema: { usergroup: { type: "string", required: true } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "POST", "/usergroups.disable", { usergroup: input.usergroup })); return data.usergroup; } });
+    // ── File ────────────────────────────────────────────
+    rl.registerAction("file.get", { description: "Get file info",
+        inputSchema: { file: { type: "string", required: true } },
+        async execute(input, ctx) { const data = (await api(t(ctx), "GET", "/files.info", undefined, { file: input.file })); return data.file; } });
+    rl.registerAction("file.list", { description: "List files",
+        inputSchema: { channel: { type: "string", required: false }, limit: { type: "number", required: false }, types: { type: "string", required: false } },
+        async execute(input, ctx) {
+            const p = (input ?? {});
+            const qs = {};
+            if (p.channel)
+                qs.channel = p.channel;
+            if (p.limit)
+                qs.count = p.limit;
+            if (p.types)
+                qs.types = p.types;
+            const data = (await api(t(ctx), "GET", "/files.list", undefined, qs));
+            return data.files;
+        } });
+    // ── Star ────────────────────────────────────────────
+    rl.registerAction("star.add", { description: "Star an item",
+        inputSchema: { channel: { type: "string", required: false }, timestamp: { type: "string", required: false }, file: { type: "string", required: false } },
+        async execute(input, ctx) { return api(t(ctx), "POST", "/stars.add", input); } });
+    rl.registerAction("star.remove", { description: "Unstar an item",
+        inputSchema: { channel: { type: "string", required: false }, timestamp: { type: "string", required: false }, file: { type: "string", required: false } },
+        async execute(input, ctx) { return api(t(ctx), "POST", "/stars.remove", input); } });
+    rl.registerAction("star.list", { description: "List starred items",
+        inputSchema: { limit: { type: "number", required: false } },
+        async execute(input, ctx) {
+            const qs = {};
+            if (input?.limit)
+                qs.limit = input.limit;
+            const data = (await api(t(ctx), "GET", "/stars.list", undefined, qs));
+            return data.items;
+        } });
+}

package/dist/plugins/sms77/src/index.js

@@ -0,0 +1,63 @@
+const BASE = "https://gateway.seven.io/api";
+async function apiRequest(apiKey, endpoint, body) {
+    const form = new URLSearchParams();
+    for (const [k, v] of Object.entries(body)) {
+        if (v !== undefined && v !== null)
+            form.set(k, String(v));
+    }
+    const res = await fetch(`${BASE}${endpoint}`, {
+        method: "POST",
+        headers: { "X-Api-Key": apiKey, SentWith: "runline" },
+        body: form,
+    });
+    if (!res.ok)
+        throw new Error(`seven API error ${res.status}: ${await res.text()}`);
+    return res.json();
+}
+export default function sms77(rl) {
+    rl.setName("sms77");
+    rl.setVersion("0.1.0");
+    rl.setConnectionSchema({
+        apiKey: { type: "string", required: true, description: "seven (sms77) API key", env: "SMS77_API_KEY" },
+    });
+    const key = (ctx) => ctx.connection.config.apiKey;
+    rl.registerAction("sms.send", {
+        description: "Send an SMS via seven",
+        inputSchema: {
+            to: { type: "string", required: true, description: "Recipient number(s), comma-separated" },
+            message: { type: "string", required: true, description: "Message text (max 1520 chars)" },
+            from: { type: "string", required: false, description: "Sender ID" },
+            flash: { type: "boolean", required: false },
+            delay: { type: "string", required: false, description: "Scheduled send time" },
+            ttl: { type: "number", required: false, description: "Time to live in minutes" },
+        },
+        async execute(input, ctx) {
+            const p = input;
+            const body = { to: p.to, text: p.message };
+            if (p.from)
+                body.from = p.from;
+            if (p.flash)
+                body.flash = 1;
+            if (p.delay)
+                body.delay = p.delay;
+            if (p.ttl)
+                body.ttl = p.ttl;
+            return apiRequest(key(ctx), "/sms", body);
+        },
+    });
+    rl.registerAction("voice.send", {
+        description: "Convert text to voice and call a number",
+        inputSchema: {
+            to: { type: "string", required: true },
+            message: { type: "string", required: true, description: "Text to speak" },
+            from: { type: "string", required: false, description: "Caller ID" },
+        },
+        async execute(input, ctx) {
+            const p = input;
+            const body = { to: p.to, text: p.message };
+            if (p.from)
+                body.from = p.from;
+            return apiRequest(key(ctx), "/voice", body);
+        },
+    });
+}

package/dist/plugins/splunk/src/index.js

@@ -0,0 +1,207 @@
+function getConn(ctx) {
+    const baseUrl = ctx.connection.config.baseUrl.replace(/\/$/, "");
+    const authToken = ctx.connection.config.authToken;
+    return { baseUrl, authToken };
+}
+// Splunk REST API uses form-urlencoded for POST, returns JSON when output_mode=json
+async function api(baseUrl, token, method, endpoint, body, qs) {
+    const url = new URL(`${baseUrl}${endpoint}`);
+    // Always request JSON output
+    url.searchParams.set("output_mode", "json");
+    if (qs) {
+        for (const [k, v] of Object.entries(qs)) {
+            if (v !== undefined && v !== null)
+                url.searchParams.set(k, String(v));
+        }
+    }
+    const headers = { Authorization: `Bearer ${token}` };
+    const init = { method, headers };
+    if (body && Object.keys(body).length > 0) {
+        headers["Content-Type"] = "application/x-www-form-urlencoded";
+        const params = new URLSearchParams();
+        for (const [k, v] of Object.entries(body)) {
+            if (v === undefined || v === null)
+                continue;
+            if (Array.isArray(v)) {
+                for (const item of v)
+                    params.append(k, String(item));
+            }
+            else
+                params.set(k, String(v));
+        }
+        init.body = params.toString();
+    }
+    const res = await fetch(url.toString(), init);
+    if (!res.ok)
+        throw new Error(`Splunk error ${res.status}: ${await res.text()}`);
+    const text = await res.text();
+    if (!text)
+        return { success: true };
+    const json = JSON.parse(text);
+    // Format entry array if present
+    if (json.entry && Array.isArray(json.entry)) {
+        return json.entry.map((e) => {
+            const { content, link, ...rest } = e;
+            const flat = { ...rest, ...(content ?? {}) };
+            if (flat.id && typeof flat.id === "string") {
+                flat.entryUrl = flat.id;
+                flat.id = flat.id.split("/").pop();
+            }
+            return flat;
+        });
+    }
+    return json;
+}
+export default function splunk(rl) {
+    rl.setName("splunk");
+    rl.setVersion("0.1.0");
+    rl.setConnectionSchema({
+        baseUrl: { type: "string", required: true, description: "Splunk instance URL, e.g. https://localhost:8089", env: "SPLUNK_BASE_URL" },
+        authToken: { type: "string", required: true, description: "Splunk auth token", env: "SPLUNK_AUTH_TOKEN" },
+    });
+    // ── Search Jobs ─────────────────────────────────────
+    rl.registerAction("search.create", { description: "Create a search job",
+        inputSchema: { search: { type: "string", required: true, description: "SPL query" }, execMode: { type: "string", required: false, description: "blocking, normal, or oneshot" }, earliestTime: { type: "string", required: false }, latestTime: { type: "string", required: false }, maxTime: { type: "number", required: false }, namespace: { type: "string", required: false } },
+        async execute(input, ctx) {
+            const { baseUrl, authToken } = getConn(ctx);
+            const p = input;
+            const body = { search: p.search };
+            if (p.execMode)
+                body.exec_mode = p.execMode;
+            if (p.earliestTime)
+                body.earliest_time = p.earliestTime;
+            if (p.latestTime)
+                body.latest_time = p.latestTime;
+            if (p.maxTime)
+                body.max_time = p.maxTime;
+            if (p.namespace)
+                body.namespace = p.namespace;
+            // Create returns XML with sid, then we fetch JSON
+            const createRes = await api(baseUrl, authToken, "POST", "/services/search/jobs", body);
+            const sid = createRes.sid;
+            if (sid)
+                return api(baseUrl, authToken, "GET", `/services/search/jobs/${sid}`);
+            return createRes;
+        } });
+    rl.registerAction("search.get", { description: "Get a search job by ID",
+        inputSchema: { searchJobId: { type: "string", required: true } },
+        async execute(input, ctx) { const { baseUrl, authToken } = getConn(ctx); return api(baseUrl, authToken, "GET", `/services/search/jobs/${input.searchJobId}`); } });
+    rl.registerAction("search.list", { description: "List search jobs",
+        inputSchema: { limit: { type: "number", required: false }, sortKey: { type: "string", required: false }, sortDir: { type: "string", required: false, description: "asc or desc" } },
+        async execute(input, ctx) {
+            const { baseUrl, authToken } = getConn(ctx);
+            const p = (input ?? {});
+            const qs = {};
+            if (p.limit)
+                qs.count = p.limit;
+            else
+                qs.count = 0;
+            if (p.sortKey)
+                qs.sort_key = p.sortKey;
+            if (p.sortDir)
+                qs.sort_dir = p.sortDir;
+            return api(baseUrl, authToken, "GET", "/services/search/jobs", undefined, qs);
+        } });
+    rl.registerAction("search.delete", { description: "Delete a search job",
+        inputSchema: { searchJobId: { type: "string", required: true } },
+        async execute(input, ctx) { const { baseUrl, authToken } = getConn(ctx); await api(baseUrl, authToken, "DELETE", `/services/search/jobs/${input.searchJobId}`); return { success: true }; } });
+    rl.registerAction("search.getResults", { description: "Get results of a search job",
+        inputSchema: { searchJobId: { type: "string", required: true }, limit: { type: "number", required: false }, filterKey: { type: "string", required: false, description: "Filter field name" }, filterValue: { type: "string", required: false, description: "Filter field value" } },
+        async execute(input, ctx) {
+            const { baseUrl, authToken } = getConn(ctx);
+            const p = input;
+            const qs = {};
+            if (p.limit)
+                qs.count = p.limit;
+            else
+                qs.count = 0;
+            if (p.filterKey && p.filterValue)
+                qs.search = `search ${p.filterKey}=${p.filterValue}`;
+            return api(baseUrl, authToken, "GET", `/services/search/jobs/${p.searchJobId}/results`, undefined, qs);
+        } });
+    // ── Alerts ──────────────────────────────────────────
+    rl.registerAction("alert.getMetrics", { description: "Get metric alerts", inputSchema: {},
+        async execute(_input, ctx) { const { baseUrl, authToken } = getConn(ctx); return api(baseUrl, authToken, "GET", "/services/alerts/metric_alerts"); } });
+    rl.registerAction("alert.getFired", { description: "Get fired alerts report", inputSchema: {},
+        async execute(_input, ctx) { const { baseUrl, authToken } = getConn(ctx); return api(baseUrl, authToken, "GET", "/services/alerts/fired_alerts"); } });
+    // ── Reports (Saved Searches) ────────────────────────
+    rl.registerAction("report.create", { description: "Create a saved search / report from a search job",
+        inputSchema: { name: { type: "string", required: true }, search: { type: "string", required: true, description: "SPL query for the report" }, cronSchedule: { type: "string", required: false }, earliestTime: { type: "string", required: false }, latestTime: { type: "string", required: false } },
+        async execute(input, ctx) {
+            const { baseUrl, authToken } = getConn(ctx);
+            const p = input;
+            const body = { name: p.name, search: p.search, alert_type: "always" };
+            if (p.cronSchedule)
+                body.cron_schedule = p.cronSchedule;
+            if (p.earliestTime)
+                body["dispatch.earliest_time"] = p.earliestTime;
+            if (p.latestTime)
+                body["dispatch.latest_time"] = p.latestTime;
+            return api(baseUrl, authToken, "POST", "/services/saved/searches", body);
+        } });
+    rl.registerAction("report.get", { description: "Get a saved search / report",
+        inputSchema: { reportId: { type: "string", required: true } },
+        async execute(input, ctx) { const { baseUrl, authToken } = getConn(ctx); return api(baseUrl, authToken, "GET", `/services/saved/searches/${input.reportId}`); } });
+    rl.registerAction("report.list", { description: "List saved searches / reports",
+        inputSchema: { limit: { type: "number", required: false } },
+        async execute(input, ctx) {
+            const { baseUrl, authToken } = getConn(ctx);
+            const p = (input ?? {});
+            const qs = {};
+            if (p.limit)
+                qs.count = p.limit;
+            else
+                qs.count = 0;
+            return api(baseUrl, authToken, "GET", "/services/saved/searches", undefined, qs);
+        } });
+    rl.registerAction("report.delete", { description: "Delete a saved search / report",
+        inputSchema: { reportId: { type: "string", required: true } },
+        async execute(input, ctx) { const { baseUrl, authToken } = getConn(ctx); await api(baseUrl, authToken, "DELETE", `/services/saved/searches/${input.reportId}`); return { success: true }; } });
+    // ── Users ───────────────────────────────────────────
+    rl.registerAction("user.create", { description: "Create a Splunk user",
+        inputSchema: { name: { type: "string", required: true, description: "Login name" }, password: { type: "string", required: true }, roles: { type: "object", required: true, description: "Array of role names" }, email: { type: "string", required: false }, realname: { type: "string", required: false, description: "Full name" } },
+        async execute(input, ctx) {
+            const { baseUrl, authToken } = getConn(ctx);
+            const p = input;
+            const body = { name: p.name, password: p.password, roles: p.roles };
+            if (p.email)
+                body.email = p.email;
+            if (p.realname)
+                body.realname = p.realname;
+            return api(baseUrl, authToken, "POST", "/services/authentication/users", body);
+        } });
+    rl.registerAction("user.get", { description: "Get a user",
+        inputSchema: { userId: { type: "string", required: true, description: "Username" } },
+        async execute(input, ctx) { const { baseUrl, authToken } = getConn(ctx); return api(baseUrl, authToken, "GET", `/services/authentication/users/${input.userId}`); } });
+    rl.registerAction("user.list", { description: "List users",
+        inputSchema: { limit: { type: "number", required: false } },
+        async execute(input, ctx) {
+            const { baseUrl, authToken } = getConn(ctx);
+            const p = (input ?? {});
+            const qs = {};
+            if (p.limit)
+                qs.count = p.limit;
+            else
+                qs.count = 0;
+            return api(baseUrl, authToken, "GET", "/services/authentication/users", undefined, qs);
+        } });
+    rl.registerAction("user.update", { description: "Update a user",
+        inputSchema: { userId: { type: "string", required: true, description: "Username" }, email: { type: "string", required: false }, realname: { type: "string", required: false }, password: { type: "string", required: false }, roles: { type: "object", required: false, description: "Array of role names" } },
+        async execute(input, ctx) {
+            const { baseUrl, authToken } = getConn(ctx);
+            const { userId, ...fields } = input;
+            const body = {};
+            if (fields.email)
+                body.email = fields.email;
+            if (fields.realname)
+                body.realname = fields.realname;
+            if (fields.password)
+                body.password = fields.password;
+            if (fields.roles)
+                body.roles = fields.roles;
+            return api(baseUrl, authToken, "POST", `/services/authentication/users/${userId}`, body);
+        } });
+    rl.registerAction("user.delete", { description: "Delete a user",
+        inputSchema: { userId: { type: "string", required: true, description: "Username" } },
+        async execute(input, ctx) { const { baseUrl, authToken } = getConn(ctx); await api(baseUrl, authToken, "DELETE", `/services/authentication/users/${input.userId}`); return { success: true }; } });
+}