runline 0.7.6 → 0.8.0

package/dist/plugins/_shared/imageFile.js

@@ -0,0 +1,40 @@
+/**
+ * Shared helper for image-generation plugins: write generated bytes to a
+ * file and return its path, instead of returning raw base64.
+ *
+ * Base64 image payloads in an action result bloat the agent context and are
+ * stripped by many hosts before reaching the model, so the agent can never
+ * actually deliver the image. A file `path` hands straight to a host
+ * send_file/attachment tool. Plugins load in-process via jiti, so node:fs is
+ * available (same pattern as googleDrive/googleSlides).
+ */
+import { writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+const MIME_EXT = {
+    "image/png": "png",
+    "image/jpeg": "jpg",
+    "image/jpg": "jpg",
+    "image/webp": "webp",
+    "image/gif": "gif",
+    "image/svg+xml": "svg",
+};
+export function extForMime(mimeType) {
+    if (!mimeType)
+        return "png";
+    return MIME_EXT[mimeType] ?? mimeType.split("/")[1]?.split("+")[0] ?? "png";
+}
+/**
+ * Decode base64 image bytes and write them to `saveDir` (or the OS temp dir),
+ * named `<provider>-<stamp>-<index>.<ext>`. Returns the file path + size.
+ */
+export function writeImageFile(opts) {
+    const mimeType = opts.mimeType ?? "image/png";
+    const dir = (typeof opts.saveDir === "string" && opts.saveDir.trim()) || tmpdir();
+    const bytes = Buffer.from(opts.base64 ?? "", "base64");
+    const stamp = opts.stamp ?? Date.now();
+    const path = join(dir, `${opts.provider}-${stamp}-${opts.index}.${extForMime(mimeType)}`);
+    writeFileSync(path, bytes);
+    return { path, mimeType, byteLength: bytes.length };
+}
+export const SEND_FILE_NOTE = "Image(s) written to disk. Deliver each to the user with send_file using its `path`.";

package/dist/plugins/_shared/microsoftAuth.js

@@ -0,0 +1,100 @@
+const REFRESH_SKEW_MS = 60_000;
+function authority(cfg) {
+    return `https://login.microsoftonline.com/${cfg.tenantId || "common"}/oauth2/v2.0/token`;
+}
+export function isAppOnly(cfg) {
+    return !cfg.refreshToken && !!(cfg.tenantId && cfg.clientId && cfg.clientSecret);
+}
+/** Graph path prefix for the acting principal: /me (delegated) or /users/{upn} (app-only). */
+export function userBase(ctx) {
+    const cfg = ctx.connection.config;
+    if (cfg.refreshToken)
+        return "/me";
+    if (cfg.userUpn)
+        return `/users/${encodeURIComponent(cfg.userUpn)}`;
+    throw new Error("microsoft: app-only mode requires userUpn (target mailbox/drive). Set MS_GRAPH_USER_UPN, or connect via OAuth.");
+}
+export async function microsoftAccessToken(ctx, pluginName, scopes) {
+    const cfg = ctx.connection.config;
+    if (cfg.accessToken &&
+        typeof cfg.accessTokenExpiresAt === "number" &&
+        Date.now() < cfg.accessTokenExpiresAt - REFRESH_SKEW_MS) {
+        return cfg.accessToken;
+    }
+    let body;
+    if (cfg.refreshToken) {
+        if (!cfg.clientId || !cfg.clientSecret) {
+            throw new Error(`${pluginName}: missing clientId/clientSecret for OAuth refresh.`);
+        }
+        body = new URLSearchParams({
+            client_id: cfg.clientId,
+            client_secret: cfg.clientSecret,
+            refresh_token: cfg.refreshToken,
+            grant_type: "refresh_token",
+            scope: [...scopes, "offline_access"].join(" "),
+        });
+    }
+    else if (isAppOnly(cfg)) {
+        body = new URLSearchParams({
+            client_id: cfg.clientId,
+            client_secret: cfg.clientSecret,
+            grant_type: "client_credentials",
+            scope: "https://graph.microsoft.com/.default",
+        });
+    }
+    else {
+        throw new Error(`${pluginName}: no credentials. Connect via OAuth, or set tenantId/clientId/clientSecret (app-only).`);
+    }
+    const res = await fetch(authority(cfg), {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+    });
+    if (!res.ok) {
+        throw new Error(`${pluginName}: token request failed (${res.status}): ${await res.text()}`);
+    }
+    const data = (await res.json());
+    const patch = {
+        accessToken: data.access_token,
+        accessTokenExpiresAt: Date.now() + data.expires_in * 1000,
+    };
+    // Microsoft rotates refresh tokens — persist the new one when present.
+    if (data.refresh_token)
+        patch.refreshToken = data.refresh_token;
+    await ctx.updateConnection(patch);
+    return data.access_token;
+}
+/** Authenticated Graph v1.0 request. Returns parsed JSON ({success:true} for 204). */
+export async function graphRequest(ctx, pluginName, scopes, method, path, body) {
+    const token = await microsoftAccessToken(ctx, pluginName, scopes);
+    const init = {
+        method,
+        headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+    };
+    if (body !== undefined) {
+        init.headers["Content-Type"] = "application/json";
+        init.body = JSON.stringify(body);
+    }
+    const res = await fetch(`https://graph.microsoft.com/v1.0${path}`, init);
+    if (res.status === 204)
+        return { success: true };
+    const text = await res.text();
+    if (!res.ok)
+        throw new Error(`${pluginName}: ${method} ${path} → ${res.status} ${text}`);
+    return text ? JSON.parse(text) : { success: true };
+}
+/** Setup help shown by the OAuth wizard for all Microsoft plugins. */
+export function microsoftSetupHelp(apiName) {
+    return [
+        `You need a Microsoft Entra (Azure AD) app registration. One-time, ~5 minutes.`,
+        "",
+        "1. Register an app: https://entra.microsoft.com → App registrations → New registration.",
+        "   Supported account types: your org (single tenant) is fine.",
+        "2. Add a Web redirect URI (Authentication → Add platform → Web):",
+        "     {{redirectUri}}",
+        "3. Certificates & secrets → New client secret → copy the VALUE (not the Secret ID).",
+        `4. API permissions → Add → Microsoft Graph → Delegated → add the ${apiName} scopes,`,
+        "   then 'Grant admin consent'.",
+        "5. Paste the Application (client) ID and the client secret VALUE below.",
+    ];
+}

package/dist/plugins/gmail/src/index.js

@@ -108,6 +108,18 @@ function header(name, value) {
 function foldedBase64ByteLength(length) {
     return length === 0 ? 0 : length + Math.floor((length - 1) / 76) * CRLF.length;
 }
+function normalizeMimeBase64(value, index) {
+    const compact = value.replace(/\s+/g, "");
+    if (!/^[A-Za-z0-9+/=_-]*$/.test(compact)) {
+        throw new Error(`gmail: attachment ${index} contentBase64 contains invalid base64 characters`);
+    }
+    const standard = compact.replace(/-/g, "+").replace(/_/g, "/");
+    const remainder = standard.length % 4;
+    if (remainder === 1) {
+        throw new Error(`gmail: attachment ${index} contentBase64 has invalid base64 length`);
+    }
+    return remainder === 0 ? standard : `${standard}${"=".repeat(4 - remainder)}`;
+}
 function foldBase64(encoded) {
     let folded = "";
     for (let i = 0; i < encoded.length; i += 76) {
@@ -147,7 +159,7 @@ function normalizeAttachment(input, index) {
     return {
         name: input.name ?? input.filename ?? `attachment-${index + 1}`,
         mimeType: input.mimeType ?? "application/octet-stream",
-        contentBase64,
+        contentBase64: normalizeMimeBase64(contentBase64, index),
     };
 }
 function attachmentPart(att) {

package/dist/plugins/googleAppsScript/src/index.js

@@ -0,0 +1,203 @@
+import { googleAccessToken } from "../../_shared/googleAuth.js";
+const SCRIPT_API = "https://script.googleapis.com/v1";
+const DRIVE_API = "https://www.googleapis.com/drive/v3";
+const SCOPES = [
+    "https://www.googleapis.com/auth/script.projects",
+    "https://www.googleapis.com/auth/script.deployments",
+    "https://www.googleapis.com/auth/script.processes",
+    "https://www.googleapis.com/auth/drive.metadata.readonly",
+];
+function accessToken(ctx) {
+    return googleAccessToken(ctx, "googleAppsScript", SCOPES);
+}
+async function call(ctx, method, url, payload) {
+    const headers = { Authorization: `Bearer ${await accessToken(ctx)}` };
+    if (payload !== undefined)
+        headers["Content-Type"] = "application/json";
+    const res = await fetch(url, {
+        method,
+        headers,
+        body: payload !== undefined ? JSON.stringify(payload) : undefined,
+    });
+    const text = await res.text();
+    let json;
+    try {
+        json = text ? JSON.parse(text) : {};
+    }
+    catch {
+        json = { raw: text };
+    }
+    if (!res.ok) {
+        const msg = json?.error?.message || json?.error_description || text.slice(0, 300) || res.status;
+        throw new Error(`googleAppsScript: ${method} ${res.status}: ${msg}`);
+    }
+    return json;
+}
+export default function googleAppsScript(rl) {
+    rl.setName("googleAppsScript");
+    rl.setVersion("1.0.0");
+    rl.setConnectionSchema({
+        clientId: { type: "string", required: false, description: "OAuth client ID", env: "GOOGLE_APPS_SCRIPT_CLIENT_ID" },
+        clientSecret: { type: "string", required: false, description: "OAuth client secret", env: "GOOGLE_APPS_SCRIPT_CLIENT_SECRET" },
+        refreshToken: { type: "string", required: false, description: "OAuth refresh token", env: "GOOGLE_APPS_SCRIPT_REFRESH_TOKEN" },
+        serviceAccountJson: { type: "string", required: false, description: "Service-account key JSON", env: "GOOGLE_APPS_SCRIPT_SERVICE_ACCOUNT_JSON" },
+        serviceAccountEmail: { type: "string", required: false, description: "Service-account email", env: "GOOGLE_APPS_SCRIPT_SERVICE_ACCOUNT_EMAIL" },
+        serviceAccountPrivateKey: { type: "string", required: false, description: "Service-account private key", env: "GOOGLE_APPS_SCRIPT_SERVICE_ACCOUNT_PRIVATE_KEY" },
+        serviceAccountSubject: { type: "string", required: false, description: "User to impersonate (domain-wide delegation)", env: "GOOGLE_APPS_SCRIPT_SERVICE_ACCOUNT_SUBJECT" },
+    });
+    rl.registerAction("script.list", {
+        description: "List Apps Script projects in Drive (standalone scripts; bound scripts live inside their container and don't appear here).",
+        inputSchema: {
+            query: { type: "string", required: false, description: "Case-insensitive name substring filter." },
+            pageSize: { type: "number", required: false, description: "Max results (default 50)." },
+        },
+        async execute(input, ctx) {
+            const params = new URLSearchParams({
+                q: "mimeType='application/vnd.google-apps.script' and trashed=false",
+                fields: "files(id,name,modifiedTime)",
+                pageSize: String(input.pageSize ?? 50),
+                orderBy: "modifiedTime desc",
+            });
+            const res = await call(ctx, "GET", `${DRIVE_API}/files?${params}`);
+            let files = res.files ?? [];
+            if (input.query) {
+                const q = String(input.query).toLowerCase();
+                files = files.filter((f) => (f.name || "").toLowerCase().includes(q));
+            }
+            return { count: files.length, scripts: files };
+        },
+    });
+    rl.registerAction("project.getContent", {
+        description: "Get all files of an Apps Script project (name, type, source).",
+        inputSchema: { scriptId: { type: "string", required: true } },
+        async execute(input, ctx) {
+            const res = await call(ctx, "GET", `${SCRIPT_API}/projects/${input.scriptId}/content`);
+            return { scriptId: input.scriptId, files: res.files ?? [] };
+        },
+    });
+    rl.registerAction("project.readFile", {
+        description: "Read one file's source from a project.",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            name: { type: "string", required: true, description: "File name without extension (e.g. 'Code', 'appsscript')." },
+        },
+        async execute(input, ctx) {
+            const res = await call(ctx, "GET", `${SCRIPT_API}/projects/${input.scriptId}/content`);
+            const file = (res.files ?? []).find((f) => f.name === input.name);
+            if (!file)
+                throw new Error(`No file "${input.name}". Available: ${(res.files ?? []).map((f) => f.name).join(", ")}`);
+            return { name: file.name, type: file.type, source: file.source };
+        },
+    });
+    rl.registerAction("file.edit", {
+        description: "Replace (or add) a single file's source, leaving other files untouched. Read-modify-write — the safe way to change code.",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            name: { type: "string", required: true },
+            source: { type: "string", required: true },
+            type: { type: "string", required: false, description: "SERVER_JS (default), HTML, or JSON (for appsscript)." },
+        },
+        async execute(input, ctx) {
+            const cur = await call(ctx, "GET", `${SCRIPT_API}/projects/${input.scriptId}/content`);
+            const files = cur.files ?? [];
+            const idx = files.findIndex((f) => f.name === input.name);
+            const type = input.type || (input.name === "appsscript" ? "JSON" : files[idx]?.type || "SERVER_JS");
+            const entry = { name: input.name, type, source: input.source };
+            if (idx >= 0)
+                files[idx] = entry;
+            else
+                files.push(entry);
+            await call(ctx, "PUT", `${SCRIPT_API}/projects/${input.scriptId}/content`, { files });
+            return { scriptId: input.scriptId, updated: input.name, fileCount: files.length };
+        },
+    });
+    rl.registerAction("project.updateContent", {
+        description: "Replace the entire project file set. files = [{name, type, source}], must include the appsscript JSON manifest. Prefer file.edit for single changes.",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            files: { type: "array", required: true, description: "[{name, type: SERVER_JS|HTML|JSON, source}]" },
+        },
+        async execute(input, ctx) {
+            const res = await call(ctx, "PUT", `${SCRIPT_API}/projects/${input.scriptId}/content`, { files: input.files });
+            return { scriptId: input.scriptId, fileCount: (res.files ?? []).length };
+        },
+    });
+    rl.registerAction("project.create", {
+        description: "Create a new Apps Script project. Pass parentId (a Drive file id, e.g. a Sheet) to bind it to that container.",
+        inputSchema: {
+            title: { type: "string", required: true },
+            parentId: { type: "string", required: false, description: "Container Drive file id for a bound script." },
+        },
+        async execute(input, ctx) {
+            const payload = { title: input.title };
+            if (input.parentId)
+                payload.parentId = input.parentId;
+            const res = await call(ctx, "POST", `${SCRIPT_API}/projects`, payload);
+            return { scriptId: res.scriptId, title: res.title, parentId: res.parentId };
+        },
+    });
+    rl.registerAction("version.create", {
+        description: "Create an immutable version of the project (needed before deploying).",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            description: { type: "string", required: false },
+        },
+        async execute(input, ctx) {
+            const res = await call(ctx, "POST", `${SCRIPT_API}/projects/${input.scriptId}/versions`, { description: input.description || "" });
+            return { scriptId: input.scriptId, versionNumber: res.versionNumber, description: res.description };
+        },
+    });
+    rl.registerAction("deployment.create", {
+        description: "Deploy a version. For function.run, deploy with an API-executable manifest (executionApi access).",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            versionNumber: { type: "number", required: true },
+            description: { type: "string", required: false },
+            manifestFileName: { type: "string", required: false, description: "Defaults to 'appsscript'." },
+        },
+        async execute(input, ctx) {
+            const res = await call(ctx, "POST", `${SCRIPT_API}/projects/${input.scriptId}/deployments`, {
+                versionNumber: input.versionNumber,
+                manifestFileName: input.manifestFileName || "appsscript",
+                description: input.description || "",
+            });
+            return { deploymentId: res.deploymentId, entryPoints: res.entryPoints };
+        },
+    });
+    rl.registerAction("function.run", {
+        description: "Run a function via scripts.run. Requires the project linked to a standard GCP project, the Apps Script API enabled, and an API-executable deployment (or devMode for the owner).",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            functionName: { type: "string", required: true },
+            parameters: { type: "array", required: false, description: "Positional args for the function." },
+            devMode: { type: "boolean", required: false, description: "Run latest saved code (owner only). Default true." },
+        },
+        async execute(input, ctx) {
+            const res = await call(ctx, "POST", `${SCRIPT_API}/scripts/${input.scriptId}:run`, {
+                function: input.functionName,
+                parameters: input.parameters ?? [],
+                devMode: input.devMode === undefined ? true : input.devMode,
+            });
+            if (res.error) {
+                const d = res.error.details?.[0];
+                throw new Error(`Function error: ${d?.errorMessage || res.error.message}`);
+            }
+            return { done: res.done, result: res.response?.result ?? null };
+        },
+    });
+    rl.registerAction("process.list", {
+        description: "Recent executions for a project (status, function, times) — a log view.",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            pageSize: { type: "number", required: false, description: "Default 20." },
+        },
+        async execute(input, ctx) {
+            const params = new URLSearchParams({
+                "userProcessFilter.scriptId": input.scriptId,
+                pageSize: String(input.pageSize ?? 20),
+            });
+            const res = await call(ctx, "GET", `${SCRIPT_API}/processes?${params}`);
+            return { count: (res.processes ?? []).length, processes: res.processes ?? [] };
+        },
+    });
+}

package/dist/plugins/googleCalendar/src/index.js

@@ -780,4 +780,171 @@ export default function googleCalendar(rl) {
             return calRequest(ctx, "POST", `/calendars/${encodeCalendarId(p.calendarId)}/events/${p.eventId}/move`, undefined, qs);
         },
     });
+    // ─── FreeBusy ────────────────────────────────────────────────────
+    rl.registerAction("freeBusy.query", {
+        description: "Query free/busy windows across one or more calendars in a time range. Returns an array of busy intervals per calendar id, plus any errors.",
+        inputSchema: {
+            calendarIds: { type: "array", required: true, description: "Calendar ids to query (use 'primary' for the user's own)." },
+            timeMin: { type: "string", required: true, description: "RFC 3339 lower bound." },
+            timeMax: { type: "string", required: true, description: "RFC 3339 upper bound." },
+            timeZone: { type: "string", required: false },
+            groupExpansionMax: { type: "number", required: false },
+            calendarExpansionMax: { type: "number", required: false },
+        },
+        async execute(input, ctx) {
+            const p = (input ?? {});
+            const body = {
+                timeMin: p.timeMin,
+                timeMax: p.timeMax,
+                timeZone: p.timeZone,
+                groupExpansionMax: p.groupExpansionMax,
+                calendarExpansionMax: p.calendarExpansionMax,
+                items: p.calendarIds.map((id) => ({ id })),
+            };
+            return calRequest(ctx, "POST", `/freeBusy`, body);
+        },
+    });
+    // ─── Calendar list management ───────────────────────────────────
+    rl.registerAction("calendarList.list", {
+        description: "List calendars on the user's calendar list (the user's left sidebar).",
+        inputSchema: {
+            minAccessRole: { type: "string", required: false, description: "freeBusyReader | reader | writer | owner" },
+            showDeleted: { type: "boolean", required: false },
+            showHidden: { type: "boolean", required: false },
+            returnAll: { type: "boolean", required: false, default: true },
+        },
+        async execute(input, ctx) {
+            const p = (input ?? {});
+            const qs = {
+                minAccessRole: p.minAccessRole,
+                showDeleted: p.showDeleted,
+                showHidden: p.showHidden,
+                maxResults: 250,
+            };
+            if (p.returnAll ?? true)
+                return paginateAll(ctx, "/users/me/calendarList", "items", qs);
+            const res = (await calRequest(ctx, "GET", "/users/me/calendarList", undefined, qs));
+            return res.items ?? [];
+        },
+    });
+    rl.registerAction("calendarList.insert", {
+        description: "Add a calendar (by id) to the user's calendar list.",
+        inputSchema: {
+            calendarId: { type: "string", required: true },
+            colorRgbFormat: { type: "boolean", required: false },
+            defaultReminders: { type: "array", required: false },
+            summaryOverride: { type: "string", required: false },
+        },
+        async execute(input, ctx) {
+            const p = (input ?? {});
+            const body = { id: p.calendarId };
+            if (p.summaryOverride)
+                body.summaryOverride = p.summaryOverride;
+            if (Array.isArray(p.defaultReminders))
+                body.defaultReminders = p.defaultReminders;
+            return calRequest(ctx, "POST", "/users/me/calendarList", body, { colorRgbFormat: p.colorRgbFormat });
+        },
+    });
+    rl.registerAction("calendarList.patch", {
+        description: "Patch a calendar entry on the user's calendar list (colors, summary override, reminders, selected).",
+        inputSchema: {
+            calendarId: { type: "string", required: true },
+            colorId: { type: "string", required: false },
+            backgroundColor: { type: "string", required: false },
+            foregroundColor: { type: "string", required: false },
+            summaryOverride: { type: "string", required: false },
+            selected: { type: "boolean", required: false },
+            hidden: { type: "boolean", required: false },
+            defaultReminders: { type: "array", required: false },
+        },
+        async execute(input, ctx) {
+            const p = (input ?? {});
+            const body = {};
+            for (const k of ["colorId", "backgroundColor", "foregroundColor", "summaryOverride", "selected", "hidden", "defaultReminders"]) {
+                if (p[k] !== undefined)
+                    body[k] = p[k];
+            }
+            return calRequest(ctx, "PATCH", `/users/me/calendarList/${encodeCalendarId(p.calendarId)}`, body, { colorRgbFormat: p.backgroundColor || p.foregroundColor ? true : undefined });
+        },
+    });
+    rl.registerAction("calendarList.delete", {
+        description: "Remove a calendar from the user's calendar list (does not delete the underlying calendar).",
+        inputSchema: { calendarId: { type: "string", required: true } },
+        async execute(input, ctx) {
+            const p = (input ?? {});
+            await calRequest(ctx, "DELETE", `/users/me/calendarList/${encodeCalendarId(p.calendarId)}`);
+            return { success: true };
+        },
+    });
+    // ─── ACL (calendar sharing) ──────────────────────────────────────
+    rl.registerAction("acl.list", {
+        description: "List ACL rules on a calendar.",
+        inputSchema: {
+            calendarId: { type: "string", required: true },
+            returnAll: { type: "boolean", required: false, default: true },
+        },
+        async execute(input, ctx) {
+            const p = (input ?? {});
+            const path = `/calendars/${encodeCalendarId(p.calendarId)}/acl`;
+            if (p.returnAll ?? true)
+                return paginateAll(ctx, path, "items", { maxResults: 250 });
+            const res = (await calRequest(ctx, "GET", path));
+            return res.items ?? [];
+        },
+    });
+    rl.registerAction("acl.insert", {
+        description: "Add an ACL rule to a calendar. Roles: 'none' | 'freeBusyReader' | 'reader' | 'writer' | 'owner'.",
+        inputSchema: {
+            calendarId: { type: "string", required: true },
+            role: { type: "string", required: true },
+            scopeType: { type: "string", required: true, description: "'default' | 'user' | 'group' | 'domain'" },
+            scopeValue: { type: "string", required: false, description: "Email / domain depending on scopeType." },
+            sendNotifications: { type: "boolean", required: false },
+        },
+        async execute(input, ctx) {
+            const p = (input ?? {});
+            const body = { role: p.role, scope: { type: p.scopeType, value: p.scopeValue } };
+            return calRequest(ctx, "POST", `/calendars/${encodeCalendarId(p.calendarId)}/acl`, body, { sendNotifications: p.sendNotifications });
+        },
+    });
+    rl.registerAction("acl.update", {
+        description: "Patch an ACL rule's role.",
+        inputSchema: {
+            calendarId: { type: "string", required: true },
+            ruleId: { type: "string", required: true },
+            role: { type: "string", required: true },
+        },
+        async execute(input, ctx) {
+            const p = (input ?? {});
+            return calRequest(ctx, "PATCH", `/calendars/${encodeCalendarId(p.calendarId)}/acl/${encodeURIComponent(p.ruleId)}`, { role: p.role });
+        },
+    });
+    rl.registerAction("acl.delete", {
+        description: "Remove an ACL rule.",
+        inputSchema: {
+            calendarId: { type: "string", required: true },
+            ruleId: { type: "string", required: true },
+        },
+        async execute(input, ctx) {
+            const p = (input ?? {});
+            await calRequest(ctx, "DELETE", `/calendars/${encodeCalendarId(p.calendarId)}/acl/${encodeURIComponent(p.ruleId)}`);
+            return { success: true };
+        },
+    });
+    // ─── Settings ────────────────────────────────────────────────────
+    rl.registerAction("settings.list", {
+        description: "List the user's calendar settings (timezone, week start, working location, etc.).",
+        inputSchema: { returnAll: { type: "boolean", required: false, default: true } },
+        async execute(_input, ctx) {
+            return paginateAll(ctx, "/users/me/settings", "items", { maxResults: 100 });
+        },
+    });
+    rl.registerAction("settings.get", {
+        description: "Get a single setting by key (e.g. 'timezone', 'weekStart', 'locale').",
+        inputSchema: { setting: { type: "string", required: true } },
+        async execute(input, ctx) {
+            const p = (input ?? {});
+            return calRequest(ctx, "GET", `/users/me/settings/${encodeURIComponent(p.setting)}`);
+        },
+    });
 }