@okostream/mcp 0.1.1 → 0.2.0

package/dist/tools.js

@@ -6,7 +6,7 @@ import { isAbsolute, join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import sharp from "sharp";
 import { z } from "zod";
-import { addDoc, collection, deleteDoc, deleteField, documentId, doc, getDoc, getDocs, limit, orderBy, query, serverTimestamp, setDoc, startAfter, Timestamp, updateDoc, where, } from "firebase/firestore";
+import { addDoc, arrayRemove, collection, deleteDoc, deleteField, documentId, doc, getDoc, getDocs, limit, orderBy, query, serverTimestamp, setDoc, startAfter, Timestamp, updateDoc, where, } from "firebase/firestore";
 import { get, endBefore, limitToLast, orderByKey, push, query as dbQuery, ref, remove, runTransaction, serverTimestamp as rtdbServerTimestamp, set, update, } from "firebase/database";
 import { httpsCallable } from "firebase/functions";
 import { deleteObject, getDownloadURL, ref as storageRef, uploadBytes, } from "firebase/storage";
@@ -17,6 +17,13 @@ import { detectAndNormalize, extractIframeSrc } from "./videoUrl.js";
 const boolOrNull = z.boolean().nullable();
 const IMAGE_KINDS = ["promoBanner", "videoPlaceholder", "card"];
 const IMAGE_VARIANT_NAMES = ["thumb_320.webp", "card_800.webp", "hero_1600.webp"];
+const CARD_IMAGE_RATIOS = ["auto", "1:1", "4:3", "3:2", "16:9", "2:3", "3:4"];
+const CARD_ID_PATTERN = /^[A-Za-z0-9_-]{1,80}$/;
+const MAX_CARD_ITEMS = 6;
+const MAX_CARD_TITLE_LENGTH = 160;
+const MAX_CARD_TEXT_LENGTH = 500;
+const MAX_CARD_BUTTON_LABEL_LENGTH = 80;
+const MAX_CARD_BUTTON_URL_LENGTH = 1000;
 const MAX_SOURCE_IMAGE_BYTES = 15 * 1024 * 1024;
 const MAX_SOURCE_IMAGE_PIXELS = 50_000_000;
 const MAX_MASTER_IMAGE_BYTES = 10 * 1024 * 1024;
@@ -32,6 +39,10 @@ const MAX_LIST_LIMIT = 100;
 const MAX_EXPORT_LIMIT = 200;
 const ANALYTICS_DEFAULT_LIMIT = 10;
 const ANALYTICS_TIMELINE_DEFAULT_LIMIT = 120;
+const MAX_NMO_IMPORT_PARTICIPANTS = 200;
+const MAX_WORKSPACE_NAME_LENGTH = 120;
+const MAX_WORKSPACE_INVITE_CODE_LENGTH = 64;
+const TELEGRAM_POST_STATUSES = ["draft", "scheduled", "sent", "failed"];
 const readOnlyTool = {
     readOnlyHint: true,
     destructiveHint: false,
@@ -133,6 +144,25 @@ const deleteImageOutputSchema = z.object({
     storageDeletesAttempted: z.number().int().nonnegative(),
     storageDeleteWarnings: z.array(z.string()),
 }).passthrough();
+const workspaceAccessOutputSchema = z.object({
+    workspaceId: z.string(),
+    workspace: unknownRecordSchema,
+    members: z.array(unknownRecordSchema),
+    invites: z.array(unknownRecordSchema),
+}).passthrough();
+const telegramChannelsOutputSchema = z.object({
+    channels: z.array(unknownRecordSchema),
+    count: z.number().int().nonnegative(),
+}).passthrough();
+const telegramPostsOutputSchema = z.object({
+    posts: z.array(unknownRecordSchema),
+    ...cursorMetaSchema,
+}).passthrough();
+const nmoImportOutputSchema = z.object({
+    eventId: z.string(),
+    summary: unknownRecordSchema,
+    results: z.array(unknownRecordSchema),
+}).passthrough();
 const formFieldSchema = z.object({
     id: z.string().min(1).optional(),
     label: z.string().max(120),
@@ -156,6 +186,44 @@ const imageSourceSchema = z.object({
 }).strict().refine((source) => Boolean(source.path) !== Boolean(source.url), {
     message: "Provide exactly one image source: path or url.",
 });
+const cardIdSchema = z.string()
+    .regex(CARD_ID_PATTERN, "Use 1-80 characters: letters, numbers, underscore, or hyphen.")
+    .describe("Stable card id. Omit to generate one; keep it to preserve images and analytics continuity.");
+const cardItemInputSchema = z.object({
+    id: cardIdSchema.optional(),
+    title: z.string().max(MAX_CARD_TITLE_LENGTH).nullable().optional(),
+    text: z.string().max(MAX_CARD_TEXT_LENGTH).nullable().optional(),
+    buttonLabel: z.string().max(MAX_CARD_BUTTON_LABEL_LENGTH).nullable().optional(),
+    buttonUrl: z.string().max(MAX_CARD_BUTTON_URL_LENGTH).nullable().optional(),
+    formId: cardIdSchema.nullable().optional(),
+}).strict();
+const emailSchema = z.string().email().max(320);
+const nmoParticipantInputSchema = z.object({
+    email: emailSchema.describe("Participant email."),
+    fullName: z.string().min(2).max(200).describe("Participant full name."),
+    position: z.string().max(200).nullable().optional().describe("Optional medical position."),
+    org: z.string().max(200).nullable().optional().describe("Optional organization/clinic."),
+}).strict();
+const telegramChannelSchema = z.object({
+    chatId: z.number().int(),
+    title: z.string().max(200).optional(),
+    username: z.string().max(120).nullable().optional(),
+}).strict();
+const cardsConfigOutputSchema = z.object({
+    eventId: z.string(),
+    updated: z.array(z.string()),
+    cards: z.object({
+        enabled: z.boolean(),
+        visibility: z.enum(["always", "hidden"]),
+        cardImageRatio: z.enum(CARD_IMAGE_RATIOS),
+        items: z.array(unknownRecordSchema),
+    }).passthrough(),
+    generatedCardIds: z.array(z.string()),
+    removedCardIds: z.array(z.string()),
+    removedCardsWithImages: z.array(z.string()),
+    preservedImageCardIds: z.array(z.string()),
+    warnings: z.array(z.string()),
+}).passthrough();
 const workspacePermissionsSchema = z.object({
     createEvents: z.boolean().optional(),
     editSetup: z.boolean().optional(),
@@ -167,6 +235,17 @@ const workspacePermissionsSchema = z.object({
     downloadReports: z.boolean().optional(),
     sendNotifications: z.boolean().optional(),
 }).strict().default({});
+const WORKSPACE_PERMISSION_KEYS = [
+    "createEvents",
+    "editSetup",
+    "deleteEvents",
+    "controlLive",
+    "moderateChat",
+    "startSession",
+    "viewAnalytics",
+    "downloadReports",
+    "sendNotifications",
+];
 const eventIdField = z.string().min(1).describe("OKO event document id, for example KJsAku48821hB4PXTW0S.");
 const limitField = (max = MAX_LIST_LIMIT, defaultValue = DEFAULT_LIST_LIMIT) => z.number().int().min(1).max(max).default(defaultValue).describe(`Maximum items to return, 1-${max}.`);
 const cursorField = z.string().min(1).optional().describe("Cursor returned as nextCursor by the previous page.");
@@ -441,6 +520,112 @@ function cardItemsWithImage(eventData, cardId, patch) {
         throw new Error(`Card ${cardId} not found in blocks.cards.items.`);
     return next;
 }
+function readImageVariants(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const data = value;
+    if (typeof data.thumbUrl !== "string" || typeof data.cardUrl !== "string" || typeof data.heroUrl !== "string") {
+        return null;
+    }
+    return {
+        thumbUrl: data.thumbUrl,
+        cardUrl: data.cardUrl,
+        heroUrl: data.heroUrl,
+    };
+}
+function readCardsConfig(eventData) {
+    const blocks = (eventData.blocks && typeof eventData.blocks === "object" ? eventData.blocks : {});
+    const raw = (blocks.cards && typeof blocks.cards === "object" ? blocks.cards : {});
+    const rawItems = Array.isArray(raw.items) ? raw.items : [];
+    const items = rawItems
+        .filter((item) => Boolean(item) && typeof item === "object" && !Array.isArray(item))
+        .map((item) => {
+        const fallbackId = randomUUID();
+        return {
+            id: typeof item.id === "string" && CARD_ID_PATTERN.test(item.id) ? item.id : fallbackId,
+            title: safeString(item.title).trim() || null,
+            text: safeString(item.text).trim() || null,
+            buttonLabel: safeString(item.buttonLabel).trim() || null,
+            buttonUrl: safeString(item.buttonUrl).trim() || null,
+            imageUrl: safeString(item.imageUrl).trim() || null,
+            imageMasterUrl: safeString(item.imageMasterUrl).trim() || null,
+            imageVariants: readImageVariants(item.imageVariants),
+            formId: safeString(item.formId).trim() || null,
+        };
+    });
+    const ratio = safeString(raw.cardImageRatio);
+    return {
+        enabled: raw.enabled === true,
+        visibility: raw.visibility === "hidden" ? "hidden" : "always",
+        cardImageRatio: CARD_IMAGE_RATIOS.includes(ratio) ? ratio : "16:9",
+        items,
+    };
+}
+function normalizeNullableText(value) {
+    if (value == null)
+        return null;
+    return value.trim() || null;
+}
+function normalizeCardButtonUrl(value) {
+    const trimmed = normalizeNullableText(value);
+    if (!trimmed)
+        return null;
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        throw new Error(`Invalid card buttonUrl "${trimmed}". Use http(s), mailto, tel, or set formId instead.`);
+    }
+    if (!["http:", "https:", "mailto:", "tel:"].includes(url.protocol)) {
+        throw new Error(`Unsupported card buttonUrl protocol "${url.protocol}". Use http(s), mailto, tel, or set formId instead.`);
+    }
+    return trimmed;
+}
+function eventFormIds(eventData) {
+    const rawForms = Array.isArray(eventData.forms) ? eventData.forms : [];
+    return new Set(rawForms
+        .map((form) => form && typeof form === "object" && !Array.isArray(form) ? safeString(form.id).trim() : "")
+        .filter(Boolean));
+}
+function cardHasImage(item) {
+    return Boolean(item.imageMasterUrl || item.imageUrl || item.imageVariants);
+}
+function buildCardsItems({ inputs, existing, formIds, }) {
+    const existingById = new Map(existing.map((item) => [item.id, item]));
+    const seen = new Set();
+    const generatedCardIds = [];
+    const preservedImageCardIds = [];
+    const items = inputs.map((input) => {
+        const id = input.id ?? randomUUID();
+        if (seen.has(id))
+            throw new Error(`Duplicate card id "${id}". Each card id must be unique.`);
+        seen.add(id);
+        if (!CARD_ID_PATTERN.test(id))
+            throw new Error(`Invalid card id "${id}". Use 1-80 characters: letters, numbers, underscore, or hyphen.`);
+        if (!input.id)
+            generatedCardIds.push(id);
+        const formId = normalizeNullableText(input.formId);
+        if (formId && !formIds.has(formId)) {
+            throw new Error(`Form ${formId} not found in event.forms. Create it with oko_configure_blocks forms first, or set formId:null.`);
+        }
+        const previous = existingById.get(id);
+        if (previous && cardHasImage(previous))
+            preservedImageCardIds.push(id);
+        return {
+            id,
+            title: normalizeNullableText(input.title),
+            text: normalizeNullableText(input.text),
+            buttonLabel: normalizeNullableText(input.buttonLabel),
+            buttonUrl: normalizeCardButtonUrl(input.buttonUrl),
+            imageUrl: previous?.imageUrl ?? null,
+            imageMasterUrl: previous?.imageMasterUrl ?? null,
+            imageVariants: previous?.imageVariants ?? null,
+            formId,
+        };
+    });
+    return { items, generatedCardIds, preservedImageCardIds };
+}
 async function deleteStoragePaths(paths) {
     const warnings = [];
     for (const path of [...new Set(paths.filter(Boolean))]) {
@@ -494,6 +679,32 @@ function normalizeVideo(videoUrl) {
 function eventUrl(eventId) {
     return `https://okostream.app/event/${eventId}`;
 }
+function setupUrl(eventId) {
+    return `https://okostream.app/setup/${eventId}`;
+}
+function analyticsUrl(eventId) {
+    return `https://okostream.app/analytics/${eventId}`;
+}
+function nmoRegisterUrl(eventId) {
+    return `${eventUrl(eventId)}/register`;
+}
+function nmoLoginUrl(eventId) {
+    return `${eventUrl(eventId)}/login`;
+}
+function eventLinks(eventId, eventData) {
+    const nmoMode = eventData?.nmoMode === true;
+    return {
+        url: eventUrl(eventId),
+        setupUrl: setupUrl(eventId),
+        analyticsUrl: analyticsUrl(eventId),
+        registrationUrl: nmoRegisterUrl(eventId),
+        loginUrl: nmoLoginUrl(eventId),
+        ...(nmoMode ? {
+            nmoRegistrationUrl: nmoRegisterUrl(eventId),
+            nmoLoginUrl: nmoLoginUrl(eventId),
+        } : {}),
+    };
+}
 function assertEventReadable(data, uid) {
     const access = Array.isArray(data.accessibleBy) ? data.accessibleBy : [];
     const editors = Array.isArray(data.editors) ? data.editors : [];
@@ -556,6 +767,193 @@ async function buildWorkspaceAccess(uid, workspaceId) {
     }
     return { accessibleBy: [...accessibleBy], editors: [...editors] };
 }
+async function buildMoveWorkspaceAccess(uid, targetWorkspaceId, originalOwnerId) {
+    const access = await buildWorkspaceAccess(uid, targetWorkspaceId);
+    const accessibleBy = new Set(access.accessibleBy);
+    const editors = new Set(access.editors);
+    if (originalOwnerId)
+        accessibleBy.add(originalOwnerId);
+    return { accessibleBy: [...accessibleBy], editors: [...editors] };
+}
+async function readWorkspaceForOwner(workspaceId, uid) {
+    const snap = await getDoc(doc(firestore, "workspaces", workspaceId));
+    if (!snap.exists())
+        throw new Error("Workspace not found.");
+    const data = snap.data();
+    if (data.ownerId !== uid)
+        throw new Error("Only the workspace owner can manage this workspace.");
+    return data;
+}
+function normalizeWorkspacePermissions(value) {
+    const out = {};
+    for (const key of WORKSPACE_PERMISSION_KEYS) {
+        if (value[key] === true)
+            out[key] = true;
+        else if (value[key] === false)
+            out[key] = false;
+    }
+    return out;
+}
+function randomInviteCode() {
+    return Math.random().toString(36).slice(2, 8).toUpperCase();
+}
+function normalizeEmail(value) {
+    return value.trim().toLowerCase();
+}
+function normalizeOptionalText(value, max) {
+    const text = value?.trim() ?? "";
+    return text ? text.slice(0, max) : null;
+}
+function parseCsvLine(line) {
+    const cells = [];
+    let current = "";
+    let quoted = false;
+    for (let i = 0; i < line.length; i++) {
+        const char = line[i];
+        const next = line[i + 1];
+        if (quoted && char === "\"" && next === "\"") {
+            current += "\"";
+            i++;
+            continue;
+        }
+        if (char === "\"") {
+            quoted = !quoted;
+            continue;
+        }
+        if (!quoted && char === ",") {
+            cells.push(current.trim());
+            current = "";
+            continue;
+        }
+        current += char;
+    }
+    cells.push(current.trim());
+    return cells;
+}
+function parseNmoParticipantsCsv(csv) {
+    const lines = csv
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+    if (lines.length < 2)
+        throw new Error("CSV must include a header row and at least one participant row.");
+    const headers = parseCsvLine(lines[0] ?? "").map((header) => header.trim().toLowerCase());
+    const alias = {
+        email: "email",
+        mail: "email",
+        "e-mail": "email",
+        fullname: "fullName",
+        full_name: "fullName",
+        name: "fullName",
+        fio: "fullName",
+        "фио": "fullName",
+        "имя": "fullName",
+        position: "position",
+        "должность": "position",
+        org: "org",
+        organization: "org",
+        organisation: "org",
+        clinic: "org",
+        "организация": "org",
+    };
+    return lines.slice(1).map((line, index) => {
+        const cells = parseCsvLine(line);
+        const row = {};
+        headers.forEach((header, cellIndex) => {
+            const key = alias[header];
+            if (key)
+                row[key] = cells[cellIndex] ?? "";
+        });
+        const parsed = nmoParticipantInputSchema.safeParse(row);
+        if (!parsed.success) {
+            throw new Error(`Invalid NMO CSV row ${index + 2}: ${parsed.error.issues.map((issue) => issue.message).join("; ")}`);
+        }
+        return parsed.data;
+    });
+}
+async function readTelegramChannels(uid, includeWorkspaceChannels) {
+    const channelsById = new Map();
+    const profileSnap = await getDoc(doc(firestore, "userProfiles", uid));
+    const profileChannels = Array.isArray(profileSnap.data()?.telegramChannels) ? profileSnap.data()?.telegramChannels : [];
+    for (const raw of profileChannels) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            continue;
+        const ch = raw;
+        if (typeof ch.chatId !== "number")
+            continue;
+        channelsById.set(ch.chatId, { ...serialize(ch), source: "profile" });
+    }
+    if (includeWorkspaceChannels) {
+        const workspaces = await listVisibleWorkspaces(uid, true);
+        for (const workspace of workspaces) {
+            const workspaceId = safeString(workspace.id);
+            const workspaceName = safeString(workspace.name);
+            const channels = Array.isArray(workspace.telegramChannels) ? workspace.telegramChannels : [];
+            for (const raw of channels) {
+                if (!raw || typeof raw !== "object" || Array.isArray(raw))
+                    continue;
+                const ch = raw;
+                if (typeof ch.chatId !== "number")
+                    continue;
+                const prev = channelsById.get(ch.chatId) ?? {};
+                const visibleInWorkspaces = Array.isArray(prev.visibleInWorkspaces) ? prev.visibleInWorkspaces : [];
+                channelsById.set(ch.chatId, {
+                    ...prev,
+                    ...serialize(ch),
+                    source: prev.source ? "profile+workspace" : "workspace",
+                    visibleInWorkspaces: [...visibleInWorkspaces, { id: workspaceId, name: workspaceName }],
+                });
+            }
+        }
+    }
+    return [...channelsById.values()].sort((a, b) => safeString(a.title).localeCompare(safeString(b.title)));
+}
+async function listVisibleWorkspaces(uid, includeShared) {
+    const out = [];
+    const ownedSnap = await getDocs(query(collection(firestore, "workspaces"), where("ownerId", "==", uid)));
+    ownedSnap.forEach((item) => out.push({ id: item.id, ...serialize(item.data()), isOwner: true }));
+    if (includeShared) {
+        const profileSnap = await getDoc(doc(firestore, "userProfiles", uid));
+        const sharedIds = (profileSnap.data()?.sharedWorkspaceIds ?? []);
+        for (const workspaceId of sharedIds) {
+            if (out.some((row) => row.id === workspaceId))
+                continue;
+            const wsSnap = await getDoc(doc(firestore, "workspaces", workspaceId));
+            const shareSnap = await getDoc(doc(firestore, "workspaces", workspaceId, "shares", uid));
+            if (wsSnap.exists())
+                out.push({ id: workspaceId, ...serialize(wsSnap.data()), isOwner: false, permissions: serialize(shareSnap.data()?.permissions ?? {}) });
+        }
+    }
+    return out;
+}
+async function syncTelegramChannelToWorkspaces(uid, channel, workspaceIds) {
+    const updated = [];
+    if (workspaceIds.length === 0)
+        return updated;
+    const profileRef = doc(firestore, "userProfiles", uid);
+    const profileSnap = await getDoc(profileRef);
+    const channels = Array.isArray(profileSnap.data()?.telegramChannels) ? [...profileSnap.data().telegramChannels] : [];
+    const nextProfileChannels = channels.map((item) => {
+        if (item.chatId !== channel.chatId)
+            return item;
+        const current = Array.isArray(item.workspaceIds) ? item.workspaceIds.filter((id) => typeof id === "string") : [];
+        return { ...item, workspaceIds: [...new Set([...current, ...workspaceIds])] };
+    });
+    await setDoc(profileRef, { telegramChannels: nextProfileChannels }, { merge: true });
+    for (const workspaceId of workspaceIds) {
+        await readWorkspaceForOwner(workspaceId, uid);
+        const wsRef = doc(firestore, "workspaces", workspaceId);
+        const wsSnap = await getDoc(wsRef);
+        const wsChannels = Array.isArray(wsSnap.data()?.telegramChannels) ? wsSnap.data().telegramChannels : [];
+        if (!wsChannels.some((item) => item.chatId === channel.chatId)) {
+            await updateDoc(wsRef, {
+                telegramChannels: [...wsChannels, { chatId: channel.chatId, title: channel.title ?? "", username: channel.username ?? null }],
+            });
+            updated.push(workspaceId);
+        }
+    }
+    return updated;
+}
 async function readAgg(eventId) {
     const snap = await get(ref(rtdb, `events/${eventId}/agg`));
     const agg = (snap.val() ?? {});
@@ -832,23 +1230,211 @@ export function registerTools(server) {
         annotations: readOnlyTool,
     }, async ({ includeShared }) => {
         const { uid } = await authed(["workspace:read"]);
-        const out = [];
-        const ownedSnap = await getDocs(query(collection(firestore, "workspaces"), where("ownerId", "==", uid)));
-        ownedSnap.forEach((item) => out.push({ id: item.id, ...serialize(item.data()), isOwner: true }));
-        if (includeShared) {
-            const profileSnap = await getDoc(doc(firestore, "userProfiles", uid));
-            const sharedIds = (profileSnap.data()?.sharedWorkspaceIds ?? []);
-            for (const workspaceId of sharedIds) {
-                if (out.some((row) => typeof row === "object" && row !== null && row.id === workspaceId))
-                    continue;
-                const wsSnap = await getDoc(doc(firestore, "workspaces", workspaceId));
-                const shareSnap = await getDoc(doc(firestore, "workspaces", workspaceId, "shares", uid));
-                if (wsSnap.exists())
-                    out.push({ id: workspaceId, ...serialize(wsSnap.data()), isOwner: false, permissions: serialize(shareSnap.data()?.permissions ?? {}) });
-            }
-        }
+        const out = await listVisibleWorkspaces(uid, includeShared);
         return textResult({ workspaces: out, count: out.length });
     });
+    server.registerTool("oko_create_workspace", {
+        title: "Create workspace",
+        description: toolDescription({
+            summary: "Create a shared OKO workspace owned by the authenticated organizer.",
+            args: ["name: workspace display name."],
+            returns: "workspaceId, name, and created=true.",
+            examples: ["Use when the organizer wants to create a new team/workspace for events."],
+        }),
+        inputSchema: { name: z.string().min(1).max(MAX_WORKSPACE_NAME_LENGTH).describe("Workspace name.") },
+        outputSchema: z.object({ workspaceId: z.string(), created: z.boolean() }).passthrough(),
+        annotations: writeTool,
+    }, async ({ name }) => {
+        const { uid } = await authed(["workspace:write"]);
+        const workspaceRef = await addDoc(collection(firestore, "workspaces"), {
+            name: name.trim(),
+            ownerId: uid,
+            personal: false,
+            createdAt: serverTimestamp(),
+        });
+        return textResult({ workspaceId: workspaceRef.id, name: name.trim(), created: true });
+    });
+    server.registerTool("oko_update_workspace", {
+        title: "Update workspace",
+        description: toolDescription({
+            summary: "Rename a workspace owned by the authenticated organizer.",
+            args: ["workspaceId: workspace to update.", "name: new workspace display name."],
+            returns: "workspaceId and updated fields.",
+            examples: ["Use for workspace rename requests."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1), name: z.string().min(1).max(MAX_WORKSPACE_NAME_LENGTH).describe("New workspace name.") },
+        outputSchema: updateOutputSchema,
+        annotations: idempotentWriteTool,
+    }, async ({ workspaceId, name }) => {
+        const { uid } = await authed(["workspace:write"]);
+        await readWorkspaceForOwner(workspaceId, uid);
+        await updateDoc(doc(firestore, "workspaces", workspaceId), { name: name.trim() });
+        return textResult({ workspaceId, updated: ["name"] });
+    });
+    server.registerTool("oko_delete_workspace", {
+        title: "Delete workspace",
+        description: toolDescription({
+            summary: "Delete an empty non-personal workspace owned by the authenticated organizer.",
+            args: ["workspaceId: workspace to delete.", "confirm: must be true."],
+            returns: "workspaceId and deleted=true.",
+            examples: ["Use after listing workspace access and confirming the workspace is empty."],
+            notes: ["Personal workspaces cannot be deleted. This tool refuses to delete workspaces that still contain events; move/delete events first."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1), confirm: z.boolean().optional().describe("Required true for workspace deletion.") },
+        outputSchema: z.object({ workspaceId: z.string(), deleted: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ workspaceId, confirm }) => {
+        const { uid } = await authed(["workspace:write"]);
+        const workspace = await readWorkspaceForOwner(workspaceId, uid);
+        requireConfirm(confirm, "oko_delete_workspace", { workspaceId, name: workspace.name, personal: workspace.personal });
+        if (workspace.personal === true)
+            throw new Error("Personal workspace cannot be deleted.");
+        const eventsSnap = await getDocs(query(collection(firestore, "events"), where("workspaceId", "==", workspaceId), limit(1)));
+        if (!eventsSnap.empty)
+            throw new Error("Workspace still has events. Move or delete its events before deleting the workspace.");
+        await deleteDoc(doc(firestore, "workspaces", workspaceId));
+        return textResult({ workspaceId, deleted: true });
+    });
+    server.registerTool("oko_list_workspace_access", {
+        title: "List workspace access",
+        description: toolDescription({
+            summary: "List workspace members/shares and pending invites.",
+            args: ["workspaceId: workspace owned by the authenticated organizer."],
+            returns: "workspace document, members array, invites array.",
+            examples: ["Use before changing permissions, removing a member, or revoking an invite."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1) },
+        outputSchema: workspaceAccessOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ workspaceId }) => {
+        const { uid } = await authed(["workspace:read"]);
+        const workspace = await readWorkspaceForOwner(workspaceId, uid);
+        const [sharesSnap, invitesSnap] = await Promise.all([
+            getDocs(collection(firestore, "workspaces", workspaceId, "shares")),
+            getDocs(query(collection(firestore, "workspaceInvites"), where("workspaceId", "==", workspaceId))),
+        ]);
+        const members = [];
+        for (const share of sharesSnap.docs) {
+            const profileSnap = await getDoc(doc(firestore, "userProfiles", share.id));
+            members.push({
+                uid: share.id,
+                ...serialize(share.data()),
+                profile: profileSnap.exists() ? serialize(profileSnap.data()) : null,
+            });
+        }
+        const invites = invitesSnap.docs.map((invite) => ({ code: invite.id, ...serialize(invite.data()) }));
+        return textResult({ workspaceId, workspace: { id: workspaceId, ...serialize(workspace) }, members, invites });
+    });
+    server.registerTool("oko_update_workspace_member", {
+        title: "Update workspace member",
+        description: toolDescription({
+            summary: "Create or update a workspace share/member permissions document.",
+            args: ["workspaceId: workspace owned by the organizer.", "uid: member uid.", "permissions: 9 workspace permission booleans.", "confirm: must be true."],
+            returns: "workspaceId, uid, and updated=true.",
+            examples: ["Use to change an existing member's permissions, or direct-add a known uid."],
+            notes: ["Changing a share triggers OKO CF18 fan-out to event access, RTDB workspaceMembers, and chat roles."],
+        }),
+        inputSchema: {
+            workspaceId: z.string().min(1),
+            uid: z.string().min(1).describe("Member Firebase uid."),
+            email: z.string().email().optional().describe("Optional member email cache."),
+            comment: z.string().max(500).default(""),
+            permissions: workspacePermissionsSchema,
+            confirm: z.boolean().optional().describe("Required true for share updates."),
+        },
+        outputSchema: updateOutputSchema,
+        annotations: writeTool,
+    }, async (args) => {
+        const { uid } = await authed(["workspace:write"]);
+        const workspace = await readWorkspaceForOwner(args.workspaceId, uid);
+        requireConfirm(args.confirm, "oko_update_workspace_member", { workspaceId: args.workspaceId, workspaceName: workspace.name, targetUid: args.uid, permissions: args.permissions });
+        await setDoc(doc(firestore, "workspaces", args.workspaceId, "shares", args.uid), {
+            email: args.email ?? "",
+            comment: args.comment.trim(),
+            permissions: normalizeWorkspacePermissions(args.permissions),
+            sharedAt: serverTimestamp(),
+            sharedBy: uid,
+        }, { merge: true });
+        return textResult({ workspaceId: args.workspaceId, uid: args.uid, updated: true });
+    });
+    server.registerTool("oko_remove_workspace_member", {
+        title: "Remove workspace member",
+        description: toolDescription({
+            summary: "Remove a member/share from a workspace.",
+            args: ["workspaceId: workspace owned by the organizer.", "uid: member uid.", "confirm: must be true."],
+            returns: "workspaceId, uid, removed=true.",
+            examples: ["Use after listing workspace access and confirming the exact uid."],
+            notes: ["Removing a share triggers OKO CF18 reverse fan-out."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1), uid: z.string().min(1), confirm: z.boolean().optional().describe("Required true for member removal.") },
+        outputSchema: z.object({ workspaceId: z.string(), uid: z.string(), removed: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ workspaceId, uid: targetUid, confirm }) => {
+        const { uid } = await authed(["workspace:write"]);
+        const workspace = await readWorkspaceForOwner(workspaceId, uid);
+        requireConfirm(confirm, "oko_remove_workspace_member", { workspaceId, workspaceName: workspace.name, targetUid });
+        await deleteDoc(doc(firestore, "workspaces", workspaceId, "shares", targetUid));
+        return textResult({ workspaceId, uid: targetUid, removed: true });
+    });
+    server.registerTool("oko_list_workspace_invites", {
+        title: "List workspace invites",
+        description: toolDescription({
+            summary: "List workspace invite links for a workspace owned by the organizer.",
+            args: ["workspaceId: workspace owned by the organizer."],
+            returns: "invites array with code, claim status, permissions, and inviteUrl.",
+            examples: ["Use before revoking or sharing an invite code."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1) },
+        outputSchema: z.object({ workspaceId: z.string(), invites: z.array(unknownRecordSchema), count: z.number().int().nonnegative() }).passthrough(),
+        annotations: readOnlyTool,
+    }, async ({ workspaceId }) => {
+        const { uid } = await authed(["workspace:read"]);
+        await readWorkspaceForOwner(workspaceId, uid);
+        const snap = await getDocs(query(collection(firestore, "workspaceInvites"), where("workspaceId", "==", workspaceId)));
+        const invites = snap.docs.map((invite) => ({ code: invite.id, ...serialize(invite.data()), inviteUrl: `https://okostream.app/invite/${invite.id}` }));
+        return textResult({ workspaceId, invites, count: invites.length });
+    });
+    server.registerTool("oko_revoke_workspace_invite", {
+        title: "Revoke workspace invite",
+        description: toolDescription({
+            summary: "Delete a pending workspace invite code.",
+            args: ["code: invite code.", "confirm: must be true."],
+            returns: "code and revoked=true.",
+            examples: ["Use after confirming the exact invite code."],
+        }),
+        inputSchema: { code: z.string().min(4).max(MAX_WORKSPACE_INVITE_CODE_LENGTH), confirm: z.boolean().optional().describe("Required true for invite revocation.") },
+        outputSchema: z.object({ code: z.string(), revoked: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ code, confirm }) => {
+        const { uid } = await authed(["workspace:write"]);
+        const normalizedCode = code.trim().toUpperCase();
+        const inviteSnap = await getDoc(doc(firestore, "workspaceInvites", normalizedCode));
+        if (!inviteSnap.exists())
+            throw new Error("Workspace invite not found.");
+        const invite = inviteSnap.data();
+        if (invite.createdBy !== uid)
+            throw new Error("Only the invite creator/workspace owner can revoke this invite.");
+        requireConfirm(confirm, "oko_revoke_workspace_invite", { code: normalizedCode, workspaceId: invite.workspaceId, claimed: invite.claimed });
+        await deleteDoc(doc(firestore, "workspaceInvites", normalizedCode));
+        return textResult({ code: normalizedCode, revoked: true });
+    });
+    server.registerTool("oko_claim_workspace_invite", {
+        title: "Claim workspace invite",
+        description: toolDescription({
+            summary: "Accept a workspace invite code for the authenticated organizer.",
+            args: ["code: invite code from /invite/{code}."],
+            returns: "success plus workspace id/name returned by OKO CF19.",
+            examples: ["Use when the organizer wants to join a workspace from an invite code."],
+        }),
+        inputSchema: { code: z.string().min(4).max(MAX_WORKSPACE_INVITE_CODE_LENGTH) },
+        outputSchema: unknownRecordSchema,
+        annotations: writeTool,
+    }, async ({ code }) => {
+        await authed(["workspace:write"]);
+        const claimInvite = httpsCallable(functions, "claimWorkspaceInvite");
+        const result = await claimInvite({ code: code.trim().toUpperCase() });
+        return textResult({ ...serialize(result.data) });
+    });
     server.registerTool("oko_list_my_events", {
         title: "List my events",
         description: toolDescription({
@@ -899,7 +1485,7 @@ export function registerTools(server) {
     }, async ({ eventId }) => {
         const { uid } = await authed(["events:read"]);
         const data = await readEvent(eventId, uid, "read");
-        return textResult({ id: eventId, ...serialize(data), url: eventUrl(eventId) });
+        return textResult({ id: eventId, ...serialize(data), ...eventLinks(eventId, data) });
     });
     server.registerTool("oko_create_webinar", {
         title: "Create webinar",
@@ -955,7 +1541,7 @@ export function registerTools(server) {
             ownerId: uid,
             workspaceId,
         });
-        return textResult({ id: docRef.id, url: eventUrl(docRef.id), workspaceId });
+        return textResult({ id: docRef.id, ...eventLinks(docRef.id), workspaceId });
     });
     server.registerTool("oko_update_event", {
         title: "Update event metadata",
@@ -1110,6 +1696,92 @@ export function registerTools(server) {
         await updateDoc(doc(firestore, "events", args.eventId), patch);
         return textResult({ id: args.eventId, updated: Object.keys(patch) });
     });
+    server.registerTool("oko_configure_cards", {
+        title: "Configure event cards",
+        description: toolDescription({
+            summary: "Configure the Cards setup block and replace its card list. Images are managed separately through oko_upload_image and are preserved by matching card id.",
+            args: [
+                "eventId: event to edit.",
+                "enabled: optional Cards block enabled flag.",
+                "visibility: optional default visibility, always or hidden.",
+                "cardImageRatio: optional image ratio, one of auto, 1:1, 4:3, 3:2, 16:9, 2:3, 3:4.",
+                "items: optional full replacement array, max 6 cards. Each item may include id, title, text, buttonLabel, buttonUrl, formId.",
+            ],
+            returns: "event id, updated Firestore fields, normalized cards config, generated card ids, preserved image ids, removed card ids, and warnings.",
+            examples: [
+                "Use after oko_create_webinar to create cards before uploading per-card images.",
+                "Call oko_get_event first and pass the full desired items array when editing existing cards.",
+                "Use formId instead of buttonUrl when a card button should open a lead form.",
+            ],
+            notes: [
+                "This tool replaces blocks.cards.items when items is provided; omitted text fields become null.",
+                "Existing card images are preserved only when the same card id remains in the replacement list.",
+                "buttonUrl allows http(s), mailto, or tel URLs; javascript/data URLs are rejected.",
+                "If a removed card had an image, Storage cleanup is not automatic; this matches the web Setup behavior.",
+            ],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            enabled: z.boolean().optional().describe("Whether the Cards block is enabled in setup."),
+            visibility: z.enum(["always", "hidden"]).optional().describe("Default visibility when no live override exists."),
+            cardImageRatio: z.enum(CARD_IMAGE_RATIOS).optional().describe("Image aspect ratio for all cards."),
+            items: z.array(cardItemInputSchema).max(MAX_CARD_ITEMS).optional().describe("Full replacement list, max 6 cards. Omit to update only block settings."),
+        },
+        outputSchema: cardsConfigOutputSchema,
+        annotations: writeTool,
+    }, async (args) => {
+        const { uid } = await authed(["setup:write"]);
+        const event = await readEvent(args.eventId, uid, "edit");
+        const currentCards = readCardsConfig(event);
+        const patch = {};
+        const finalCards = {
+            enabled: args.enabled ?? currentCards.enabled,
+            visibility: args.visibility ?? currentCards.visibility,
+            cardImageRatio: args.cardImageRatio ?? currentCards.cardImageRatio,
+            items: currentCards.items,
+        };
+        const generatedCardIds = [];
+        const preservedImageCardIds = [];
+        let removedCardIds = [];
+        let removedCardsWithImages = [];
+        if (args.enabled !== undefined)
+            patch["blocks.cards.enabled"] = args.enabled;
+        if (args.visibility !== undefined)
+            patch["blocks.cards.visibility"] = args.visibility;
+        if (args.cardImageRatio !== undefined)
+            patch["blocks.cards.cardImageRatio"] = args.cardImageRatio;
+        if (args.items !== undefined) {
+            const built = buildCardsItems({
+                inputs: args.items,
+                existing: currentCards.items,
+                formIds: eventFormIds(event),
+            });
+            finalCards.items = built.items;
+            generatedCardIds.push(...built.generatedCardIds);
+            preservedImageCardIds.push(...built.preservedImageCardIds);
+            const nextIds = new Set(built.items.map((item) => item.id));
+            const removed = currentCards.items.filter((item) => !nextIds.has(item.id));
+            removedCardIds = removed.map((item) => item.id);
+            removedCardsWithImages = removed.filter(cardHasImage).map((item) => item.id);
+            patch["blocks.cards.items"] = built.items;
+        }
+        if (Object.keys(patch).length > 0) {
+            await updateDoc(doc(firestore, "events", args.eventId), patch);
+        }
+        const warnings = removedCardsWithImages.length > 0
+            ? [`Removed cards had images and their Storage files were not deleted: ${removedCardsWithImages.join(", ")}.`]
+            : [];
+        return textResult({
+            eventId: args.eventId,
+            updated: Object.keys(patch),
+            cards: finalCards,
+            generatedCardIds,
+            removedCardIds,
+            removedCardsWithImages,
+            preservedImageCardIds,
+            warnings,
+        });
+    });
     server.registerTool("oko_upload_image", {
         title: "Upload event image",
         description: toolDescription({
@@ -1286,6 +1958,71 @@ export function registerTools(server) {
         await deleteDoc(doc(firestore, "events", eventId));
         return textResult({ deleted: eventId });
     });
+    server.registerTool("oko_duplicate_event", {
+        title: "Duplicate event",
+        description: toolDescription({
+            summary: "Duplicate an event setup into the same or another workspace without analytics/session history.",
+            args: ["eventId: source event.", "targetWorkspaceId: optional target workspace; omitted means source workspace or personal workspace."],
+            returns: "new event id, public/setup/analytics URLs, source event id, and workspaceId.",
+            examples: ["Use to create a reusable copy of a configured webinar before editing the new copy."],
+            notes: ["Copies title, video, meta, blocks, forms, telegram config, NMO settings; does not copy analytics sessions/leads/participants."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            targetWorkspaceId: z.string().min(1).optional().describe("Target workspace id; omit to use the source workspace or personal workspace."),
+        },
+        outputSchema: createWebinarOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, targetWorkspaceId }) => {
+        const { uid } = await authed(["events:write"]);
+        const source = await readEvent(eventId, uid, "read");
+        const workspaceId = targetWorkspaceId ?? safeString(source.workspaceId, uid);
+        const access = await buildWorkspaceAccess(uid, workspaceId);
+        const newRef = await addDoc(collection(firestore, "events"), {
+            ownerId: uid,
+            workspaceId,
+            accessibleBy: access.accessibleBy,
+            editors: access.editors,
+            createdAt: serverTimestamp(),
+            title: safeString(source.title, "Untitled event"),
+            pinned: false,
+            video: source.video ?? { originalUrl: null, embedUrl: null },
+            meta: source.meta ?? { eventDate: null, speakerName: null, description: null },
+            blocks: source.blocks ?? {},
+            ...(Array.isArray(source.forms) ? { forms: source.forms } : {}),
+            ...(source.telegram && typeof source.telegram === "object" ? { telegram: source.telegram } : {}),
+            ...(source.nmoMode === true ? { nmoMode: true } : {}),
+            ...(source.nmoCriteria && typeof source.nmoCriteria === "object" ? { nmoCriteria: source.nmoCriteria } : {}),
+            ...(source.nmoExtraFields && typeof source.nmoExtraFields === "object" ? { nmoExtraFields: source.nmoExtraFields } : {}),
+        });
+        await update(ref(rtdb, `events/${newRef.id}`), { ownerId: uid, workspaceId });
+        return textResult({ id: newRef.id, sourceEventId: eventId, workspaceId, ...eventLinks(newRef.id) });
+    });
+    server.registerTool("oko_move_event", {
+        title: "Move event",
+        description: toolDescription({
+            summary: "Move an event to another workspace and recompute accessibleBy/editors.",
+            args: ["eventId: event to move.", "targetWorkspaceId: target workspace id."],
+            returns: "eventId, targetWorkspaceId, updated Firestore fields, and RTDB mirror status.",
+            examples: ["Use when an event belongs in another workspace. Call oko_list_workspaces first to choose the target."],
+            notes: ["Reads target workspace shares from Firestore with permissions; does not use RTDB workspaceMembers."],
+        }),
+        inputSchema: { eventId: eventIdField, targetWorkspaceId: z.string().min(1).describe("Target workspace id.") },
+        outputSchema: updateOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, targetWorkspaceId }) => {
+        const { uid } = await authed(["events:write", "workspace:write"]);
+        const event = await readEvent(eventId, uid, "edit");
+        const originalOwnerId = safeString(event.ownerId) || null;
+        const access = await buildMoveWorkspaceAccess(uid, targetWorkspaceId, originalOwnerId);
+        await updateDoc(doc(firestore, "events", eventId), {
+            workspaceId: targetWorkspaceId,
+            accessibleBy: access.accessibleBy,
+            editors: access.editors,
+        });
+        await set(ref(rtdb, `events/${eventId}/workspaceId`), targetWorkspaceId);
+        return textResult({ eventId, targetWorkspaceId, updated: ["workspaceId", "accessibleBy", "editors"], rtdbMirrorUpdated: true });
+    });
     server.registerTool("oko_get_live_state", {
         title: "Get live state",
         description: toolDescription({
@@ -1629,6 +2366,103 @@ export function registerTools(server) {
         ]);
         return textResult({ eventId, sessionId, ended: true });
     });
+    server.registerTool("oko_fix_orphan_session", {
+        title: "Fix orphan analytics session",
+        description: toolDescription({
+            summary: "Clear stuck active-session pointers when an analytics session cannot be ended normally.",
+            args: [
+                "eventId: event with stuck session pointers.",
+                "deleteRtdbSessionData: optional, also delete events/{eventId}/sessions/{sessionId}; default false.",
+                "confirm: must be true.",
+            ],
+            returns: "eventId, cleared sessionId if found, and cleaned paths.",
+            examples: ["Use when oko_end_session says the baseline is missing or dashboard shows a stuck/orphan session."],
+            notes: ["This does not stop the video stream; OKO Start/End controls analytics sessions only."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            deleteRtdbSessionData: z.boolean().default(false).describe("Also delete RTDB session data for the stuck session."),
+            confirm: z.boolean().optional().describe("Required true for clearing session pointers."),
+        },
+        outputSchema: basicEventOutputSchema,
+        annotations: destructiveTool,
+    }, async ({ eventId, deleteRtdbSessionData, confirm }) => {
+        const { uid } = await authed(["analytics:write", "live:control"]);
+        const event = await readEvent(eventId, uid, "edit");
+        const ctrlSnap = await get(ref(rtdb, `events/${eventId}/ctrl/activeSessionId`));
+        const sessionId = safeString(event.activeAnalyticsSessionId) || safeString(ctrlSnap.val());
+        requireConfirm(confirm, "oko_fix_orphan_session", { eventId, sessionId: sessionId || null, deleteRtdbSessionData });
+        const cleanup = [
+            updateDoc(doc(firestore, "events", eventId), { activeAnalyticsSessionId: deleteField() }),
+            remove(ref(rtdb, `events/${eventId}/ctrl/activeSessionId`)),
+        ];
+        if (sessionId)
+            cleanup.push(remove(ref(rtdb, `activeSessions/${sessionId}`)));
+        if (sessionId && deleteRtdbSessionData)
+            cleanup.push(remove(ref(rtdb, `events/${eventId}/sessions/${sessionId}`)));
+        const results = await Promise.allSettled(cleanup);
+        const warnings = results
+            .filter((result) => result.status === "rejected")
+            .map((result) => result.reason instanceof Error ? result.reason.message : String(result.reason));
+        return textResult({
+            eventId,
+            sessionId: sessionId || null,
+            fixed: warnings.length === 0,
+            cleared: ["events.activeAnalyticsSessionId", "ctrl/activeSessionId", ...(sessionId ? [`activeSessions/${sessionId}`] : []), ...(sessionId && deleteRtdbSessionData ? [`events/${eventId}/sessions/${sessionId}`] : [])],
+            warnings,
+        });
+    });
+    server.registerTool("oko_delete_session", {
+        title: "Delete analytics session",
+        description: toolDescription({
+            summary: "Delete an analytics session document and optionally its RTDB session data.",
+            args: [
+                "eventId: event id.",
+                "sessionId: analytics session id.",
+                "deleteRtdbData: best-effort delete of events/{eventId}/sessions/{sessionId}; default false.",
+                "confirm: must be true.",
+            ],
+            returns: "eventId, sessionId, deleted=true, and cleaned paths.",
+            examples: ["Use only after confirming the exact session id with the organizer."],
+            notes: ["Destructive. If the session is active, active pointers are cleared first. RTDB session data cleanup is best-effort because rules may deny deleting historical session snapshots."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            sessionId: z.string().min(1).describe("analyticsSessions document id."),
+            deleteRtdbData: z.boolean().default(false).describe("Best-effort delete RTDB session data for this session."),
+            confirm: z.boolean().optional().describe("Required true for session deletion."),
+        },
+        outputSchema: basicEventOutputSchema,
+        annotations: destructiveTool,
+    }, async ({ eventId, sessionId, deleteRtdbData, confirm }) => {
+        const { uid } = await authed(["analytics:write", "live:control"]);
+        const event = await readEvent(eventId, uid, "edit");
+        requireConfirm(confirm, "oko_delete_session", { eventId, sessionId, deleteRtdbData });
+        const isActive = safeString(event.activeAnalyticsSessionId) === sessionId;
+        const cleanup = [];
+        if (isActive) {
+            cleanup.push(updateDoc(doc(firestore, "events", eventId), { activeAnalyticsSessionId: deleteField() }));
+            cleanup.push(remove(ref(rtdb, `events/${eventId}/ctrl/activeSessionId`)));
+            cleanup.push(remove(ref(rtdb, `activeSessions/${sessionId}`)));
+        }
+        cleanup.push(deleteDoc(doc(firestore, "events", eventId, "analyticsSessions", sessionId)));
+        const results = await Promise.allSettled(cleanup);
+        const warnings = results
+            .filter((result) => result.status === "rejected")
+            .map((result) => result.reason instanceof Error ? result.reason.message : String(result.reason));
+        if (warnings.length > 0)
+            throw new Error(`Session delete partially failed: ${warnings.join("; ")}`);
+        const rtdbCleanupWarnings = [];
+        if (deleteRtdbData) {
+            try {
+                await remove(ref(rtdb, `events/${eventId}/sessions/${sessionId}`));
+            }
+            catch (err) {
+                rtdbCleanupWarnings.push(err instanceof Error ? err.message : String(err));
+            }
+        }
+        return textResult({ eventId, sessionId, deleted: true, wasActive: isActive, deleteRtdbData, rtdbCleanupWarnings });
+    });
     server.registerTool("oko_get_analytics", {
         title: "Get analytics sessions",
         description: toolDescription({
@@ -1783,6 +2617,42 @@ export function registerTools(server) {
             await update(ref(chatRtdb), deletes);
         return textResult({ eventId, targetUid, banned: true, deletedMessages: Object.keys(deletes).length });
     });
+    server.registerTool("oko_unmute_user", {
+        title: "Unmute chat user",
+        description: toolDescription({
+            summary: "Remove a chat mute for a user.",
+            args: ["eventId: target event.", "uid: Firebase uid to unmute.", "confirm: must be true."],
+            returns: "eventId, targetUid, and unmuted=true.",
+            examples: ["Use when a user was muted by mistake or the organizer wants to restore chat access."],
+        }),
+        inputSchema: { eventId: eventIdField, uid: z.string().min(1).describe("Firebase uid to unmute."), confirm: z.boolean().optional().describe("Required true for unmute.") },
+        outputSchema: basicEventOutputSchema,
+        annotations: idempotentWriteTool,
+    }, async ({ eventId, uid: targetUid, confirm }) => {
+        const actor = await authed(["chat:moderate"]);
+        await readEvent(eventId, actor.uid, "edit");
+        requireConfirm(confirm, "oko_unmute_user", { eventId, targetUid });
+        await remove(ref(chatRtdb, `mutes/${eventId}/${targetUid}`));
+        return textResult({ eventId, targetUid, unmuted: true });
+    });
+    server.registerTool("oko_unban_user", {
+        title: "Unban chat user",
+        description: toolDescription({
+            summary: "Remove a chat ban for a user.",
+            args: ["eventId: target event.", "uid: Firebase uid to unban.", "confirm: must be true."],
+            returns: "eventId, targetUid, and unbanned=true.",
+            examples: ["Use when a user was banned by mistake or the organizer wants to restore event chat access."],
+        }),
+        inputSchema: { eventId: eventIdField, uid: z.string().min(1).describe("Firebase uid to unban."), confirm: z.boolean().optional().describe("Required true for unban.") },
+        outputSchema: basicEventOutputSchema,
+        annotations: idempotentWriteTool,
+    }, async ({ eventId, uid: targetUid, confirm }) => {
+        const actor = await authed(["chat:moderate"]);
+        await readEvent(eventId, actor.uid, "edit");
+        requireConfirm(confirm, "oko_unban_user", { eventId, targetUid });
+        await remove(ref(chatRtdb, `bans/${eventId}/${targetUid}`));
+        return textResult({ eventId, targetUid, unbanned: true });
+    });
     server.registerTool("oko_set_chat_settings", {
         title: "Set chat settings",
         description: toolDescription({
@@ -1888,6 +2758,116 @@ export function registerTools(server) {
         }
         return textResult({ participants: rows, ...meta });
     });
+    server.registerTool("oko_add_nmo_participant", {
+        title: "Add NMO participant",
+        description: toolDescription({
+            summary: "Add or update one NMO participant for an event through OKO organizer import.",
+            args: ["eventId: NMO event.", "email/fullName/position/org: participant fields."],
+            returns: "eventId, summary, and per-row import result.",
+            examples: ["Use when the organizer dictates one doctor/participant to add before the webinar."],
+            notes: ["This does not return a participant login token; use registration/login URLs from oko_get_event for attendee access."],
+        }),
+        inputSchema: { eventId: eventIdField, participant: nmoParticipantInputSchema },
+        outputSchema: nmoImportOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, participant }) => {
+        const { uid } = await authed(["nmo:write"]);
+        await readEvent(eventId, uid, "edit");
+        const importFn = httpsCallable(functions, "importNmoParticipants");
+        const result = await importFn({
+            eventId,
+            participants: [{
+                    email: normalizeEmail(participant.email),
+                    fullName: participant.fullName.trim(),
+                    position: normalizeOptionalText(participant.position, 200),
+                    org: normalizeOptionalText(participant.org, 200),
+                }],
+        });
+        const data = serialize(result.data);
+        const results = Array.isArray(data.results) ? data.results : [];
+        const first = results[0];
+        if (!first || first.ok !== true) {
+            throw new Error(`NMO participant import failed: ${safeString(first?.error, "unknown error")}`);
+        }
+        return textResult({ eventId, ...data });
+    });
+    server.registerTool("oko_import_nmo_participants", {
+        title: "Import NMO participants",
+        description: toolDescription({
+            summary: "Bulk import NMO participants from structured rows or CSV text.",
+            args: [
+                "eventId: NMO event.",
+                "participants: optional array of rows { email, fullName, position?, org? }.",
+                "csv: optional CSV text with headers email, fullName, position, org.",
+            ],
+            returns: "eventId, summary, and per-row results with ok/error.",
+            examples: ["Use csv when the organizer pastes a participant list from a spreadsheet."],
+            notes: ["Provide exactly one of participants or csv. Max 200 rows. The callable returns partial success for bulk imports."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            participants: z.array(nmoParticipantInputSchema).max(MAX_NMO_IMPORT_PARTICIPANTS).optional(),
+            csv: z.string().max(80_000).optional().describe("CSV with headers email, fullName, position, org."),
+        },
+        outputSchema: nmoImportOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, participants, csv }) => {
+        const { uid } = await authed(["nmo:write"]);
+        await readEvent(eventId, uid, "edit");
+        if (Boolean(participants) === Boolean(csv))
+            throw new Error("Provide exactly one of participants or csv.");
+        const rows = participants ?? parseNmoParticipantsCsv(csv ?? "");
+        if (rows.length === 0 || rows.length > MAX_NMO_IMPORT_PARTICIPANTS)
+            throw new Error(`Import supports 1-${MAX_NMO_IMPORT_PARTICIPANTS} participants.`);
+        const importFn = httpsCallable(functions, "importNmoParticipants");
+        const result = await importFn({
+            eventId,
+            participants: rows.map((row) => ({
+                email: normalizeEmail(row.email),
+                fullName: row.fullName.trim(),
+                position: normalizeOptionalText(row.position, 200),
+                org: normalizeOptionalText(row.org, 200),
+            })),
+        });
+        return textResult({ eventId, ...serialize(result.data) });
+    });
+    server.registerTool("oko_remove_nmo_participant", {
+        title: "Remove NMO participant",
+        description: toolDescription({
+            summary: "Remove an NMO participant and immediately revoke event access.",
+            args: ["eventId: NMO event.", "uid or email: participant to remove.", "confirm: must be true."],
+            returns: "eventId, participant uid/email, and removed=true.",
+            examples: ["Use after listing participants and confirming the exact participant."],
+            notes: ["Order is intentional: arrayRemove from events.participantUids first, then delete participant doc."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            uid: z.string().min(1).optional().describe("Participant Firebase uid."),
+            email: emailSchema.optional().describe("Participant email; used to resolve uid if uid is omitted."),
+            confirm: z.boolean().optional().describe("Required true for participant removal."),
+        },
+        outputSchema: z.object({ eventId: z.string(), uid: z.string(), removed: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ eventId, uid: participantUid, email, confirm }) => {
+        const { uid } = await authed(["nmo:write"]);
+        await readEvent(eventId, uid, "edit");
+        let targetUid = participantUid;
+        const normalizedEmail = email ? normalizeEmail(email) : null;
+        if (!targetUid && normalizedEmail) {
+            const snap = await getDocs(query(collection(firestore, "eventParticipants", eventId, "items"), where("email", "==", normalizedEmail), limit(2)));
+            if (snap.empty)
+                throw new Error(`NMO participant with email ${normalizedEmail} not found.`);
+            if (snap.docs.length > 1)
+                throw new Error(`Multiple NMO participants found for email ${normalizedEmail}; use uid.`);
+            targetUid = snap.docs[0].id;
+        }
+        if (!targetUid)
+            throw new Error("Provide uid or email.");
+        requireConfirm(confirm, "oko_remove_nmo_participant", { eventId, uid: targetUid, email: normalizedEmail });
+        await updateDoc(doc(firestore, "events", eventId), { participantUids: arrayRemove(targetUid) });
+        await deleteDoc(doc(firestore, "eventParticipants", eventId, "items", targetUid));
+        return textResult({ eventId, uid: targetUid, email: normalizedEmail, removed: true });
+    });
     server.registerTool("oko_list_leads", {
         title: "List form leads",
         description: toolDescription({
@@ -1930,6 +2910,116 @@ export function registerTools(server) {
         }
         return textResult({ leads, ...meta });
     });
+    server.registerTool("oko_list_telegram_channels", {
+        title: "List Telegram channels",
+        description: toolDescription({
+            summary: "List Telegram channels available to the authenticated organizer.",
+            args: ["includeWorkspaceChannels: include channels exposed through visible workspaces, default true."],
+            returns: "channels with chatId, title, username, source, and visible workspace metadata.",
+            examples: ["Use before oko_publish_telegram_post so the user can choose a channel by title instead of numeric id."],
+        }),
+        inputSchema: { includeWorkspaceChannels: z.boolean().default(true).describe("Include workspace-level channels visible to this organizer.") },
+        outputSchema: telegramChannelsOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ includeWorkspaceChannels }) => {
+        const { uid } = await authed(["telegram:write"]);
+        const channels = await readTelegramChannels(uid, includeWorkspaceChannels);
+        return textResult({ channels, count: channels.length });
+    });
+    server.registerTool("oko_claim_telegram_channel", {
+        title: "Claim Telegram channel",
+        description: toolDescription({
+            summary: "Claim a pending Telegram channel using the code sent by OKO bot.",
+            args: [
+                "claimCode: code posted by the bot after it was added to a channel.",
+                "workspaceIds: optional workspaces to expose this channel to after claim.",
+            ],
+            returns: "claimed channel and workspace ids updated.",
+            examples: ["Add @OKOStreamBot to a Telegram channel, copy the claim code, then call this tool."],
+            notes: ["Workspace sync requires the authenticated organizer to own each workspace."],
+        }),
+        inputSchema: {
+            claimCode: z.string().min(4).max(32).describe("Telegram channel claim code."),
+            workspaceIds: z.array(z.string().min(1)).max(20).default([]).describe("Optional workspace ids to attach the channel to."),
+        },
+        outputSchema: z.object({ channel: unknownRecordSchema, workspaceIdsUpdated: z.array(z.string()) }).passthrough(),
+        annotations: writeTool,
+    }, async ({ claimCode, workspaceIds }) => {
+        const { uid } = await authed(["telegram:write"]);
+        const claimChannel = httpsCallable(functions, "claimTelegramChannel");
+        const result = await claimChannel({ code: claimCode.trim().toUpperCase() });
+        const data = serialize(result.data);
+        const channelRaw = data.channel && typeof data.channel === "object" ? data.channel : {};
+        const parsed = telegramChannelSchema.safeParse(channelRaw);
+        if (!parsed.success)
+            throw new Error("OKO claimTelegramChannel returned an invalid channel payload.");
+        const workspaceIdsUpdated = await syncTelegramChannelToWorkspaces(uid, parsed.data, workspaceIds);
+        return textResult({ ...data, channel: parsed.data, workspaceIdsUpdated });
+    });
+    server.registerTool("oko_list_telegram_posts", {
+        title: "List Telegram posts",
+        description: toolDescription({
+            summary: "List Telegram notification posts for an event.",
+            args: [
+                "eventId: event whose Telegram posts to list.",
+                "status: optional client-side status filter.",
+                "limit: max posts, default 30, max 100.",
+                "cursor: createdAt cursor returned by previous page.",
+            ],
+            returns: "posts plus cursor pagination metadata.",
+            examples: ["Use to review scheduled/sent/failed Telegram posts before canceling or cloning."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            status: z.enum(TELEGRAM_POST_STATUSES).optional().describe("Optional post status filter."),
+            limit: limitField(),
+            cursor: cursorField,
+        },
+        outputSchema: telegramPostsOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ eventId, status, limit: max, cursor }) => {
+        const { uid } = await authed(["telegram:write"]);
+        await readEvent(eventId, uid, "read");
+        const constraints = [
+            where("eventId", "==", eventId),
+            orderBy("createdAt", "desc"),
+            limit(max + 1),
+        ];
+        if (cursor)
+            constraints.splice(2, 0, startAfter(parseTimestampCursor(cursor)));
+        const snap = await getDocs(query(collection(firestore, "telegramPosts"), ...constraints));
+        const { page, hasMore } = pickPage(snap.docs, max);
+        let posts = page.map((item) => ({ id: item.id, ...serialize(item.data()) }));
+        if (status)
+            posts = posts.filter((post) => post.status === status);
+        const nextCursor = hasMore ? timestampCursorFrom(page.at(-1)?.data().createdAt) : null;
+        return textResult({ posts, ...cursorMeta(posts.length, max, hasMore, nextCursor) });
+    });
+    server.registerTool("oko_cancel_telegram_post", {
+        title: "Cancel Telegram post",
+        description: toolDescription({
+            summary: "Delete a draft/scheduled/failed Telegram post record before it is sent.",
+            args: ["postId: telegramPosts document id.", "confirm: must be true."],
+            returns: "postId, eventId, status, and canceled=true.",
+            examples: ["Use for scheduled posts that should not be sent."],
+            notes: ["Already sent Telegram messages cannot be unsent through OKO; this tool refuses status=sent."],
+        }),
+        inputSchema: { postId: z.string().min(1), confirm: z.boolean().optional().describe("Required true for cancellation.") },
+        outputSchema: z.object({ postId: z.string(), canceled: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ postId, confirm }) => {
+        await authed(["telegram:write"]);
+        const postRef = doc(firestore, "telegramPosts", postId);
+        const postSnap = await getDoc(postRef);
+        if (!postSnap.exists())
+            throw new Error("Telegram post not found.");
+        const post = postSnap.data();
+        if (post.status === "sent")
+            throw new Error("Telegram post was already sent and cannot be canceled through OKO.");
+        requireConfirm(confirm, "oko_cancel_telegram_post", { postId, eventId: post.eventId, status: post.status, caption: post.caption });
+        await deleteDoc(postRef);
+        return textResult({ postId, eventId: post.eventId, status: post.status, canceled: true });
+    });
     server.registerTool("oko_publish_telegram_post", {
         title: "Publish Telegram post",
         description: toolDescription({
@@ -1992,45 +3082,41 @@ export function registerTools(server) {
             summary: "Create a workspace invite for a known OKO workspace.",
             args: [
                 "workspaceId: workspace owned by the authenticated organizer.",
-                "code: invite code, 4-64 chars; stored uppercase.",
+                "code: optional invite code, 4-64 chars; omitted means generated.",
                 "email: optional intended recipient email.",
                 "permissions: optional whitelist of workspace permission booleans.",
                 "confirm: must be true.",
             ],
-            returns: "workspaceId, invite code, and created=true.",
+            returns: "workspaceId, invite code, inviteUrl, and created=true.",
             examples: ["Use only after confirming the recipient and permission set with the workspace owner."],
         }),
         inputSchema: {
             workspaceId: z.string().min(1),
-            code: z.string().min(4).max(64),
+            code: z.string().min(4).max(MAX_WORKSPACE_INVITE_CODE_LENGTH).optional(),
             email: z.string().email().optional(),
             comment: z.string().max(500).default(""),
             permissions: workspacePermissionsSchema,
             confirm: z.boolean().optional(),
         },
-        outputSchema: z.object({ workspaceId: z.string(), code: z.string(), created: z.boolean() }).passthrough(),
+        outputSchema: z.object({ workspaceId: z.string(), code: z.string(), inviteUrl: z.string().url(), created: z.boolean() }).passthrough(),
         annotations: writeTool,
     }, async (args) => {
         const { uid } = await authed(["workspace:write"]);
-        const workspaceSnap = await getDoc(doc(firestore, "workspaces", args.workspaceId));
-        if (!workspaceSnap.exists())
-            throw new Error("Workspace not found.");
-        const workspace = workspaceSnap.data();
-        if (workspace.ownerId !== uid)
-            throw new Error("Only the workspace owner can create invites.");
+        const workspace = await readWorkspaceForOwner(args.workspaceId, uid);
         requireConfirm(args.confirm, "oko_create_workspace_invite", { workspaceId: args.workspaceId, code: args.code, email: args.email });
-        const code = args.code.trim().toUpperCase();
+        const code = (args.code?.trim() || randomInviteCode()).toUpperCase();
+        const inviteUrl = `https://okostream.app/invite/${code}`;
         await setDoc(doc(firestore, "workspaceInvites", code), {
             workspaceId: args.workspaceId,
             workspaceName: safeString(workspace.name, "Workspace"),
             email: args.email ?? "",
             comment: args.comment,
-            permissions: args.permissions,
+            permissions: normalizeWorkspacePermissions(args.permissions),
             createdBy: uid,
             createdAt: serverTimestamp(),
             claimed: false,
             claimedBy: null,
         });
-        return textResult({ workspaceId: args.workspaceId, code, created: true });
+        return textResult({ workspaceId: args.workspaceId, code, inviteUrl, created: true });
     });
 }