@okostream/mcp 0.1.2 → 0.2.0

package/README.md

@@ -4,7 +4,7 @@ MCP server for managing OKO Stream webinars as an organizer.
 
 ## Quick Setup
 
-1. Create an API key in OKO: `/app/settings` -> API keys for MCP.
+1. Create an API key in OKO: `/app/mcp` -> access keys.
 2. Add the server to your MCP client config.
 
 Claude Desktop / Claude Code:
@@ -54,7 +54,7 @@ Every tool returns JSON text plus MCP `structuredContent`. List-like tools use b
 
 - `limit` defaults to 20-50 depending on the tool.
 - Cursor tools return both `hasMore`/`nextCursor` and `has_more`/`next_cursor`.
-- `oko_list_my_events`, `oko_get_analytics`, `oko_list_recent_chat`, `oko_list_participants`, and `oko_list_leads` support pagination.
+- `oko_list_my_events`, `oko_get_analytics`, `oko_list_recent_chat`, `oko_list_participants`, `oko_list_leads`, `oko_list_workspace_access`, `oko_list_workspace_invites`, and `oko_list_telegram_posts` support pagination.
 - `oko_get_analytics` omits heavy `timeline`, baseline/final snapshots, and NMO participant rows by default. Request `includeTimeline`, `includeSnapshots`, or `includeNmoRows` only when needed.
 - Oversized responses are truncated with `truncated: true` and a `truncationMessage`.
 
@@ -89,40 +89,32 @@ Local config without npm publishing:
 
 All tools are prefixed with `oko_` for safe discovery next to other MCP servers.
 
-Read tools include:
-
-- `oko_whoami`
-- `oko_list_workspaces`
-- `oko_list_my_events`
-- `oko_get_event`
-- `oko_get_live_state`
-- `oko_get_analytics`
-- `oko_list_recent_chat`
-- `oko_list_participants`
-- `oko_list_leads`
-
-Write/control tools include:
-
-- `oko_create_webinar`
-- `oko_update_event`
-- `oko_configure_blocks`
-- `oko_configure_cards`
-- `oko_upload_image`
-- `oko_delete_image`
-- `oko_set_block_visibility`
-- `oko_refresh_viewers`
-- `oko_start_session`
-- `oko_end_session`
-- `oko_send_chat_message`
-- `oko_delete_chat_message`
-- `oko_mute_user`
-- `oko_ban_user`
-- `oko_set_chat_settings`
-- `oko_launch_checkpoint`
-- `oko_close_checkpoint`
-- `oko_publish_telegram_post`
-- `oko_create_workspace_invite`
-- `oko_delete_event`
+Core discovery/read tools:
+
+- `oko_whoami`, `oko_list_workspaces`, `oko_list_my_events`, `oko_get_event`
+- `oko_get_live_state`, `oko_get_analytics`, `oko_list_recent_chat`, `oko_list_participants`, `oko_list_leads`
+
+Event/setup/media tools:
+
+- `oko_create_webinar`, `oko_update_event`, `oko_delete_event`
+- `oko_duplicate_event`, `oko_move_event`
+- `oko_configure_blocks`, `oko_configure_cards`
+- `oko_upload_image`, `oko_delete_image`
+
+Live/session/chat/NMO tools:
+
+- `oko_set_block_visibility`, `oko_refresh_viewers`
+- `oko_start_session`, `oko_end_session`, `oko_fix_orphan_session`, `oko_delete_session`
+- `oko_send_chat_message`, `oko_delete_chat_message`, `oko_mute_user`, `oko_unmute_user`, `oko_ban_user`, `oko_unban_user`, `oko_set_chat_settings`
+- `oko_launch_checkpoint`, `oko_close_checkpoint`
+- `oko_add_nmo_participant`, `oko_import_nmo_participants`, `oko_remove_nmo_participant`
+
+Workspace and Telegram tools:
+
+- `oko_create_workspace`, `oko_update_workspace`, `oko_delete_workspace`
+- `oko_list_workspace_access`, `oko_update_workspace_member`, `oko_remove_workspace_member`
+- `oko_create_workspace_invite`, `oko_list_workspace_invites`, `oko_revoke_workspace_invite`, `oko_claim_workspace_invite`
+- `oko_list_telegram_channels`, `oko_claim_telegram_channel`, `oko_list_telegram_posts`, `oko_cancel_telegram_post`, `oko_publish_telegram_post`
 
 Dangerous or external side-effect tools require `confirm: true`.
 
@@ -133,8 +125,10 @@ Dangerous or external side-effect tools require `confirm: true`.
 3. `oko_create_webinar` should create a test webinar and RTDB owner/workspace mirror.
 4. `oko_configure_cards` should create/update `blocks.cards.items` and preserve card image fields by stable card id.
 5. `oko_upload_image` should accept a local path or HTTPS image URL, upload `master.webp`, and let OKO generate variants.
-6. `oko_delete_image` should clear image fields and best-effort delete master/variants.
-7. `oko_get_analytics` should read an existing event with analytics sessions.
+6. `oko_start_session` -> `oko_fix_orphan_session` -> `oko_delete_session` should leave no active session pointers on a disposable test event.
+7. `oko_duplicate_event`, workspace tools, and `oko_move_event` should preserve Firestore access rules and RTDB owner/workspace mirrors.
+8. `oko_import_nmo_participants` should call CF24 and return per-row results; clean up test participants after import.
+9. `oko_get_analytics` should read an existing event with analytics sessions.
 
 CLI help:
 

package/dist/server.js

@@ -22,7 +22,7 @@ if (process.argv.includes("--help")) {
 }
 const server = new McpServer({
     name: "oko-mcp-server",
-    version: "0.1.2",
+    version: "0.2.0",
 });
 registerTools(server);
 const transport = new StdioServerTransport();

package/dist/tools.js

@@ -6,7 +6,7 @@ import { isAbsolute, join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import sharp from "sharp";
 import { z } from "zod";
-import { addDoc, collection, deleteDoc, deleteField, documentId, doc, getDoc, getDocs, limit, orderBy, query, serverTimestamp, setDoc, startAfter, Timestamp, updateDoc, where, } from "firebase/firestore";
+import { addDoc, arrayRemove, collection, deleteDoc, deleteField, documentId, doc, getDoc, getDocs, limit, orderBy, query, serverTimestamp, setDoc, startAfter, Timestamp, updateDoc, where, } from "firebase/firestore";
 import { get, endBefore, limitToLast, orderByKey, push, query as dbQuery, ref, remove, runTransaction, serverTimestamp as rtdbServerTimestamp, set, update, } from "firebase/database";
 import { httpsCallable } from "firebase/functions";
 import { deleteObject, getDownloadURL, ref as storageRef, uploadBytes, } from "firebase/storage";
@@ -39,6 +39,10 @@ const MAX_LIST_LIMIT = 100;
 const MAX_EXPORT_LIMIT = 200;
 const ANALYTICS_DEFAULT_LIMIT = 10;
 const ANALYTICS_TIMELINE_DEFAULT_LIMIT = 120;
+const MAX_NMO_IMPORT_PARTICIPANTS = 200;
+const MAX_WORKSPACE_NAME_LENGTH = 120;
+const MAX_WORKSPACE_INVITE_CODE_LENGTH = 64;
+const TELEGRAM_POST_STATUSES = ["draft", "scheduled", "sent", "failed"];
 const readOnlyTool = {
     readOnlyHint: true,
     destructiveHint: false,
@@ -140,6 +144,25 @@ const deleteImageOutputSchema = z.object({
     storageDeletesAttempted: z.number().int().nonnegative(),
     storageDeleteWarnings: z.array(z.string()),
 }).passthrough();
+const workspaceAccessOutputSchema = z.object({
+    workspaceId: z.string(),
+    workspace: unknownRecordSchema,
+    members: z.array(unknownRecordSchema),
+    invites: z.array(unknownRecordSchema),
+}).passthrough();
+const telegramChannelsOutputSchema = z.object({
+    channels: z.array(unknownRecordSchema),
+    count: z.number().int().nonnegative(),
+}).passthrough();
+const telegramPostsOutputSchema = z.object({
+    posts: z.array(unknownRecordSchema),
+    ...cursorMetaSchema,
+}).passthrough();
+const nmoImportOutputSchema = z.object({
+    eventId: z.string(),
+    summary: unknownRecordSchema,
+    results: z.array(unknownRecordSchema),
+}).passthrough();
 const formFieldSchema = z.object({
     id: z.string().min(1).optional(),
     label: z.string().max(120),
@@ -174,6 +197,18 @@ const cardItemInputSchema = z.object({
     buttonUrl: z.string().max(MAX_CARD_BUTTON_URL_LENGTH).nullable().optional(),
     formId: cardIdSchema.nullable().optional(),
 }).strict();
+const emailSchema = z.string().email().max(320);
+const nmoParticipantInputSchema = z.object({
+    email: emailSchema.describe("Participant email."),
+    fullName: z.string().min(2).max(200).describe("Participant full name."),
+    position: z.string().max(200).nullable().optional().describe("Optional medical position."),
+    org: z.string().max(200).nullable().optional().describe("Optional organization/clinic."),
+}).strict();
+const telegramChannelSchema = z.object({
+    chatId: z.number().int(),
+    title: z.string().max(200).optional(),
+    username: z.string().max(120).nullable().optional(),
+}).strict();
 const cardsConfigOutputSchema = z.object({
     eventId: z.string(),
     updated: z.array(z.string()),
@@ -200,6 +235,17 @@ const workspacePermissionsSchema = z.object({
     downloadReports: z.boolean().optional(),
     sendNotifications: z.boolean().optional(),
 }).strict().default({});
+const WORKSPACE_PERMISSION_KEYS = [
+    "createEvents",
+    "editSetup",
+    "deleteEvents",
+    "controlLive",
+    "moderateChat",
+    "startSession",
+    "viewAnalytics",
+    "downloadReports",
+    "sendNotifications",
+];
 const eventIdField = z.string().min(1).describe("OKO event document id, for example KJsAku48821hB4PXTW0S.");
 const limitField = (max = MAX_LIST_LIMIT, defaultValue = DEFAULT_LIST_LIMIT) => z.number().int().min(1).max(max).default(defaultValue).describe(`Maximum items to return, 1-${max}.`);
 const cursorField = z.string().min(1).optional().describe("Cursor returned as nextCursor by the previous page.");
@@ -633,6 +679,32 @@ function normalizeVideo(videoUrl) {
 function eventUrl(eventId) {
     return `https://okostream.app/event/${eventId}`;
 }
+function setupUrl(eventId) {
+    return `https://okostream.app/setup/${eventId}`;
+}
+function analyticsUrl(eventId) {
+    return `https://okostream.app/analytics/${eventId}`;
+}
+function nmoRegisterUrl(eventId) {
+    return `${eventUrl(eventId)}/register`;
+}
+function nmoLoginUrl(eventId) {
+    return `${eventUrl(eventId)}/login`;
+}
+function eventLinks(eventId, eventData) {
+    const nmoMode = eventData?.nmoMode === true;
+    return {
+        url: eventUrl(eventId),
+        setupUrl: setupUrl(eventId),
+        analyticsUrl: analyticsUrl(eventId),
+        registrationUrl: nmoRegisterUrl(eventId),
+        loginUrl: nmoLoginUrl(eventId),
+        ...(nmoMode ? {
+            nmoRegistrationUrl: nmoRegisterUrl(eventId),
+            nmoLoginUrl: nmoLoginUrl(eventId),
+        } : {}),
+    };
+}
 function assertEventReadable(data, uid) {
     const access = Array.isArray(data.accessibleBy) ? data.accessibleBy : [];
     const editors = Array.isArray(data.editors) ? data.editors : [];
@@ -695,6 +767,193 @@ async function buildWorkspaceAccess(uid, workspaceId) {
     }
     return { accessibleBy: [...accessibleBy], editors: [...editors] };
 }
+async function buildMoveWorkspaceAccess(uid, targetWorkspaceId, originalOwnerId) {
+    const access = await buildWorkspaceAccess(uid, targetWorkspaceId);
+    const accessibleBy = new Set(access.accessibleBy);
+    const editors = new Set(access.editors);
+    if (originalOwnerId)
+        accessibleBy.add(originalOwnerId);
+    return { accessibleBy: [...accessibleBy], editors: [...editors] };
+}
+async function readWorkspaceForOwner(workspaceId, uid) {
+    const snap = await getDoc(doc(firestore, "workspaces", workspaceId));
+    if (!snap.exists())
+        throw new Error("Workspace not found.");
+    const data = snap.data();
+    if (data.ownerId !== uid)
+        throw new Error("Only the workspace owner can manage this workspace.");
+    return data;
+}
+function normalizeWorkspacePermissions(value) {
+    const out = {};
+    for (const key of WORKSPACE_PERMISSION_KEYS) {
+        if (value[key] === true)
+            out[key] = true;
+        else if (value[key] === false)
+            out[key] = false;
+    }
+    return out;
+}
+function randomInviteCode() {
+    return Math.random().toString(36).slice(2, 8).toUpperCase();
+}
+function normalizeEmail(value) {
+    return value.trim().toLowerCase();
+}
+function normalizeOptionalText(value, max) {
+    const text = value?.trim() ?? "";
+    return text ? text.slice(0, max) : null;
+}
+function parseCsvLine(line) {
+    const cells = [];
+    let current = "";
+    let quoted = false;
+    for (let i = 0; i < line.length; i++) {
+        const char = line[i];
+        const next = line[i + 1];
+        if (quoted && char === "\"" && next === "\"") {
+            current += "\"";
+            i++;
+            continue;
+        }
+        if (char === "\"") {
+            quoted = !quoted;
+            continue;
+        }
+        if (!quoted && char === ",") {
+            cells.push(current.trim());
+            current = "";
+            continue;
+        }
+        current += char;
+    }
+    cells.push(current.trim());
+    return cells;
+}
+function parseNmoParticipantsCsv(csv) {
+    const lines = csv
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+    if (lines.length < 2)
+        throw new Error("CSV must include a header row and at least one participant row.");
+    const headers = parseCsvLine(lines[0] ?? "").map((header) => header.trim().toLowerCase());
+    const alias = {
+        email: "email",
+        mail: "email",
+        "e-mail": "email",
+        fullname: "fullName",
+        full_name: "fullName",
+        name: "fullName",
+        fio: "fullName",
+        "фио": "fullName",
+        "имя": "fullName",
+        position: "position",
+        "должность": "position",
+        org: "org",
+        organization: "org",
+        organisation: "org",
+        clinic: "org",
+        "организация": "org",
+    };
+    return lines.slice(1).map((line, index) => {
+        const cells = parseCsvLine(line);
+        const row = {};
+        headers.forEach((header, cellIndex) => {
+            const key = alias[header];
+            if (key)
+                row[key] = cells[cellIndex] ?? "";
+        });
+        const parsed = nmoParticipantInputSchema.safeParse(row);
+        if (!parsed.success) {
+            throw new Error(`Invalid NMO CSV row ${index + 2}: ${parsed.error.issues.map((issue) => issue.message).join("; ")}`);
+        }
+        return parsed.data;
+    });
+}
+async function readTelegramChannels(uid, includeWorkspaceChannels) {
+    const channelsById = new Map();
+    const profileSnap = await getDoc(doc(firestore, "userProfiles", uid));
+    const profileChannels = Array.isArray(profileSnap.data()?.telegramChannels) ? profileSnap.data()?.telegramChannels : [];
+    for (const raw of profileChannels) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            continue;
+        const ch = raw;
+        if (typeof ch.chatId !== "number")
+            continue;
+        channelsById.set(ch.chatId, { ...serialize(ch), source: "profile" });
+    }
+    if (includeWorkspaceChannels) {
+        const workspaces = await listVisibleWorkspaces(uid, true);
+        for (const workspace of workspaces) {
+            const workspaceId = safeString(workspace.id);
+            const workspaceName = safeString(workspace.name);
+            const channels = Array.isArray(workspace.telegramChannels) ? workspace.telegramChannels : [];
+            for (const raw of channels) {
+                if (!raw || typeof raw !== "object" || Array.isArray(raw))
+                    continue;
+                const ch = raw;
+                if (typeof ch.chatId !== "number")
+                    continue;
+                const prev = channelsById.get(ch.chatId) ?? {};
+                const visibleInWorkspaces = Array.isArray(prev.visibleInWorkspaces) ? prev.visibleInWorkspaces : [];
+                channelsById.set(ch.chatId, {
+                    ...prev,
+                    ...serialize(ch),
+                    source: prev.source ? "profile+workspace" : "workspace",
+                    visibleInWorkspaces: [...visibleInWorkspaces, { id: workspaceId, name: workspaceName }],
+                });
+            }
+        }
+    }
+    return [...channelsById.values()].sort((a, b) => safeString(a.title).localeCompare(safeString(b.title)));
+}
+async function listVisibleWorkspaces(uid, includeShared) {
+    const out = [];
+    const ownedSnap = await getDocs(query(collection(firestore, "workspaces"), where("ownerId", "==", uid)));
+    ownedSnap.forEach((item) => out.push({ id: item.id, ...serialize(item.data()), isOwner: true }));
+    if (includeShared) {
+        const profileSnap = await getDoc(doc(firestore, "userProfiles", uid));
+        const sharedIds = (profileSnap.data()?.sharedWorkspaceIds ?? []);
+        for (const workspaceId of sharedIds) {
+            if (out.some((row) => row.id === workspaceId))
+                continue;
+            const wsSnap = await getDoc(doc(firestore, "workspaces", workspaceId));
+            const shareSnap = await getDoc(doc(firestore, "workspaces", workspaceId, "shares", uid));
+            if (wsSnap.exists())
+                out.push({ id: workspaceId, ...serialize(wsSnap.data()), isOwner: false, permissions: serialize(shareSnap.data()?.permissions ?? {}) });
+        }
+    }
+    return out;
+}
+async function syncTelegramChannelToWorkspaces(uid, channel, workspaceIds) {
+    const updated = [];
+    if (workspaceIds.length === 0)
+        return updated;
+    const profileRef = doc(firestore, "userProfiles", uid);
+    const profileSnap = await getDoc(profileRef);
+    const channels = Array.isArray(profileSnap.data()?.telegramChannels) ? [...profileSnap.data().telegramChannels] : [];
+    const nextProfileChannels = channels.map((item) => {
+        if (item.chatId !== channel.chatId)
+            return item;
+        const current = Array.isArray(item.workspaceIds) ? item.workspaceIds.filter((id) => typeof id === "string") : [];
+        return { ...item, workspaceIds: [...new Set([...current, ...workspaceIds])] };
+    });
+    await setDoc(profileRef, { telegramChannels: nextProfileChannels }, { merge: true });
+    for (const workspaceId of workspaceIds) {
+        await readWorkspaceForOwner(workspaceId, uid);
+        const wsRef = doc(firestore, "workspaces", workspaceId);
+        const wsSnap = await getDoc(wsRef);
+        const wsChannels = Array.isArray(wsSnap.data()?.telegramChannels) ? wsSnap.data().telegramChannels : [];
+        if (!wsChannels.some((item) => item.chatId === channel.chatId)) {
+            await updateDoc(wsRef, {
+                telegramChannels: [...wsChannels, { chatId: channel.chatId, title: channel.title ?? "", username: channel.username ?? null }],
+            });
+            updated.push(workspaceId);
+        }
+    }
+    return updated;
+}
 async function readAgg(eventId) {
     const snap = await get(ref(rtdb, `events/${eventId}/agg`));
     const agg = (snap.val() ?? {});
@@ -971,23 +1230,211 @@ export function registerTools(server) {
         annotations: readOnlyTool,
     }, async ({ includeShared }) => {
         const { uid } = await authed(["workspace:read"]);
-        const out = [];
-        const ownedSnap = await getDocs(query(collection(firestore, "workspaces"), where("ownerId", "==", uid)));
-        ownedSnap.forEach((item) => out.push({ id: item.id, ...serialize(item.data()), isOwner: true }));
-        if (includeShared) {
-            const profileSnap = await getDoc(doc(firestore, "userProfiles", uid));
-            const sharedIds = (profileSnap.data()?.sharedWorkspaceIds ?? []);
-            for (const workspaceId of sharedIds) {
-                if (out.some((row) => typeof row === "object" && row !== null && row.id === workspaceId))
-                    continue;
-                const wsSnap = await getDoc(doc(firestore, "workspaces", workspaceId));
-                const shareSnap = await getDoc(doc(firestore, "workspaces", workspaceId, "shares", uid));
-                if (wsSnap.exists())
-                    out.push({ id: workspaceId, ...serialize(wsSnap.data()), isOwner: false, permissions: serialize(shareSnap.data()?.permissions ?? {}) });
-            }
-        }
+        const out = await listVisibleWorkspaces(uid, includeShared);
         return textResult({ workspaces: out, count: out.length });
     });
+    server.registerTool("oko_create_workspace", {
+        title: "Create workspace",
+        description: toolDescription({
+            summary: "Create a shared OKO workspace owned by the authenticated organizer.",
+            args: ["name: workspace display name."],
+            returns: "workspaceId, name, and created=true.",
+            examples: ["Use when the organizer wants to create a new team/workspace for events."],
+        }),
+        inputSchema: { name: z.string().min(1).max(MAX_WORKSPACE_NAME_LENGTH).describe("Workspace name.") },
+        outputSchema: z.object({ workspaceId: z.string(), created: z.boolean() }).passthrough(),
+        annotations: writeTool,
+    }, async ({ name }) => {
+        const { uid } = await authed(["workspace:write"]);
+        const workspaceRef = await addDoc(collection(firestore, "workspaces"), {
+            name: name.trim(),
+            ownerId: uid,
+            personal: false,
+            createdAt: serverTimestamp(),
+        });
+        return textResult({ workspaceId: workspaceRef.id, name: name.trim(), created: true });
+    });
+    server.registerTool("oko_update_workspace", {
+        title: "Update workspace",
+        description: toolDescription({
+            summary: "Rename a workspace owned by the authenticated organizer.",
+            args: ["workspaceId: workspace to update.", "name: new workspace display name."],
+            returns: "workspaceId and updated fields.",
+            examples: ["Use for workspace rename requests."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1), name: z.string().min(1).max(MAX_WORKSPACE_NAME_LENGTH).describe("New workspace name.") },
+        outputSchema: updateOutputSchema,
+        annotations: idempotentWriteTool,
+    }, async ({ workspaceId, name }) => {
+        const { uid } = await authed(["workspace:write"]);
+        await readWorkspaceForOwner(workspaceId, uid);
+        await updateDoc(doc(firestore, "workspaces", workspaceId), { name: name.trim() });
+        return textResult({ workspaceId, updated: ["name"] });
+    });
+    server.registerTool("oko_delete_workspace", {
+        title: "Delete workspace",
+        description: toolDescription({
+            summary: "Delete an empty non-personal workspace owned by the authenticated organizer.",
+            args: ["workspaceId: workspace to delete.", "confirm: must be true."],
+            returns: "workspaceId and deleted=true.",
+            examples: ["Use after listing workspace access and confirming the workspace is empty."],
+            notes: ["Personal workspaces cannot be deleted. This tool refuses to delete workspaces that still contain events; move/delete events first."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1), confirm: z.boolean().optional().describe("Required true for workspace deletion.") },
+        outputSchema: z.object({ workspaceId: z.string(), deleted: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ workspaceId, confirm }) => {
+        const { uid } = await authed(["workspace:write"]);
+        const workspace = await readWorkspaceForOwner(workspaceId, uid);
+        requireConfirm(confirm, "oko_delete_workspace", { workspaceId, name: workspace.name, personal: workspace.personal });
+        if (workspace.personal === true)
+            throw new Error("Personal workspace cannot be deleted.");
+        const eventsSnap = await getDocs(query(collection(firestore, "events"), where("workspaceId", "==", workspaceId), limit(1)));
+        if (!eventsSnap.empty)
+            throw new Error("Workspace still has events. Move or delete its events before deleting the workspace.");
+        await deleteDoc(doc(firestore, "workspaces", workspaceId));
+        return textResult({ workspaceId, deleted: true });
+    });
+    server.registerTool("oko_list_workspace_access", {
+        title: "List workspace access",
+        description: toolDescription({
+            summary: "List workspace members/shares and pending invites.",
+            args: ["workspaceId: workspace owned by the authenticated organizer."],
+            returns: "workspace document, members array, invites array.",
+            examples: ["Use before changing permissions, removing a member, or revoking an invite."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1) },
+        outputSchema: workspaceAccessOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ workspaceId }) => {
+        const { uid } = await authed(["workspace:read"]);
+        const workspace = await readWorkspaceForOwner(workspaceId, uid);
+        const [sharesSnap, invitesSnap] = await Promise.all([
+            getDocs(collection(firestore, "workspaces", workspaceId, "shares")),
+            getDocs(query(collection(firestore, "workspaceInvites"), where("workspaceId", "==", workspaceId))),
+        ]);
+        const members = [];
+        for (const share of sharesSnap.docs) {
+            const profileSnap = await getDoc(doc(firestore, "userProfiles", share.id));
+            members.push({
+                uid: share.id,
+                ...serialize(share.data()),
+                profile: profileSnap.exists() ? serialize(profileSnap.data()) : null,
+            });
+        }
+        const invites = invitesSnap.docs.map((invite) => ({ code: invite.id, ...serialize(invite.data()) }));
+        return textResult({ workspaceId, workspace: { id: workspaceId, ...serialize(workspace) }, members, invites });
+    });
+    server.registerTool("oko_update_workspace_member", {
+        title: "Update workspace member",
+        description: toolDescription({
+            summary: "Create or update a workspace share/member permissions document.",
+            args: ["workspaceId: workspace owned by the organizer.", "uid: member uid.", "permissions: 9 workspace permission booleans.", "confirm: must be true."],
+            returns: "workspaceId, uid, and updated=true.",
+            examples: ["Use to change an existing member's permissions, or direct-add a known uid."],
+            notes: ["Changing a share triggers OKO CF18 fan-out to event access, RTDB workspaceMembers, and chat roles."],
+        }),
+        inputSchema: {
+            workspaceId: z.string().min(1),
+            uid: z.string().min(1).describe("Member Firebase uid."),
+            email: z.string().email().optional().describe("Optional member email cache."),
+            comment: z.string().max(500).default(""),
+            permissions: workspacePermissionsSchema,
+            confirm: z.boolean().optional().describe("Required true for share updates."),
+        },
+        outputSchema: updateOutputSchema,
+        annotations: writeTool,
+    }, async (args) => {
+        const { uid } = await authed(["workspace:write"]);
+        const workspace = await readWorkspaceForOwner(args.workspaceId, uid);
+        requireConfirm(args.confirm, "oko_update_workspace_member", { workspaceId: args.workspaceId, workspaceName: workspace.name, targetUid: args.uid, permissions: args.permissions });
+        await setDoc(doc(firestore, "workspaces", args.workspaceId, "shares", args.uid), {
+            email: args.email ?? "",
+            comment: args.comment.trim(),
+            permissions: normalizeWorkspacePermissions(args.permissions),
+            sharedAt: serverTimestamp(),
+            sharedBy: uid,
+        }, { merge: true });
+        return textResult({ workspaceId: args.workspaceId, uid: args.uid, updated: true });
+    });
+    server.registerTool("oko_remove_workspace_member", {
+        title: "Remove workspace member",
+        description: toolDescription({
+            summary: "Remove a member/share from a workspace.",
+            args: ["workspaceId: workspace owned by the organizer.", "uid: member uid.", "confirm: must be true."],
+            returns: "workspaceId, uid, removed=true.",
+            examples: ["Use after listing workspace access and confirming the exact uid."],
+            notes: ["Removing a share triggers OKO CF18 reverse fan-out."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1), uid: z.string().min(1), confirm: z.boolean().optional().describe("Required true for member removal.") },
+        outputSchema: z.object({ workspaceId: z.string(), uid: z.string(), removed: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ workspaceId, uid: targetUid, confirm }) => {
+        const { uid } = await authed(["workspace:write"]);
+        const workspace = await readWorkspaceForOwner(workspaceId, uid);
+        requireConfirm(confirm, "oko_remove_workspace_member", { workspaceId, workspaceName: workspace.name, targetUid });
+        await deleteDoc(doc(firestore, "workspaces", workspaceId, "shares", targetUid));
+        return textResult({ workspaceId, uid: targetUid, removed: true });
+    });
+    server.registerTool("oko_list_workspace_invites", {
+        title: "List workspace invites",
+        description: toolDescription({
+            summary: "List workspace invite links for a workspace owned by the organizer.",
+            args: ["workspaceId: workspace owned by the organizer."],
+            returns: "invites array with code, claim status, permissions, and inviteUrl.",
+            examples: ["Use before revoking or sharing an invite code."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1) },
+        outputSchema: z.object({ workspaceId: z.string(), invites: z.array(unknownRecordSchema), count: z.number().int().nonnegative() }).passthrough(),
+        annotations: readOnlyTool,
+    }, async ({ workspaceId }) => {
+        const { uid } = await authed(["workspace:read"]);
+        await readWorkspaceForOwner(workspaceId, uid);
+        const snap = await getDocs(query(collection(firestore, "workspaceInvites"), where("workspaceId", "==", workspaceId)));
+        const invites = snap.docs.map((invite) => ({ code: invite.id, ...serialize(invite.data()), inviteUrl: `https://okostream.app/invite/${invite.id}` }));
+        return textResult({ workspaceId, invites, count: invites.length });
+    });
+    server.registerTool("oko_revoke_workspace_invite", {
+        title: "Revoke workspace invite",
+        description: toolDescription({
+            summary: "Delete a pending workspace invite code.",
+            args: ["code: invite code.", "confirm: must be true."],
+            returns: "code and revoked=true.",
+            examples: ["Use after confirming the exact invite code."],
+        }),
+        inputSchema: { code: z.string().min(4).max(MAX_WORKSPACE_INVITE_CODE_LENGTH), confirm: z.boolean().optional().describe("Required true for invite revocation.") },
+        outputSchema: z.object({ code: z.string(), revoked: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ code, confirm }) => {
+        const { uid } = await authed(["workspace:write"]);
+        const normalizedCode = code.trim().toUpperCase();
+        const inviteSnap = await getDoc(doc(firestore, "workspaceInvites", normalizedCode));
+        if (!inviteSnap.exists())
+            throw new Error("Workspace invite not found.");
+        const invite = inviteSnap.data();
+        if (invite.createdBy !== uid)
+            throw new Error("Only the invite creator/workspace owner can revoke this invite.");
+        requireConfirm(confirm, "oko_revoke_workspace_invite", { code: normalizedCode, workspaceId: invite.workspaceId, claimed: invite.claimed });
+        await deleteDoc(doc(firestore, "workspaceInvites", normalizedCode));
+        return textResult({ code: normalizedCode, revoked: true });
+    });
+    server.registerTool("oko_claim_workspace_invite", {
+        title: "Claim workspace invite",
+        description: toolDescription({
+            summary: "Accept a workspace invite code for the authenticated organizer.",
+            args: ["code: invite code from /invite/{code}."],
+            returns: "success plus workspace id/name returned by OKO CF19.",
+            examples: ["Use when the organizer wants to join a workspace from an invite code."],
+        }),
+        inputSchema: { code: z.string().min(4).max(MAX_WORKSPACE_INVITE_CODE_LENGTH) },
+        outputSchema: unknownRecordSchema,
+        annotations: writeTool,
+    }, async ({ code }) => {
+        await authed(["workspace:write"]);
+        const claimInvite = httpsCallable(functions, "claimWorkspaceInvite");
+        const result = await claimInvite({ code: code.trim().toUpperCase() });
+        return textResult({ ...serialize(result.data) });
+    });
     server.registerTool("oko_list_my_events", {
         title: "List my events",
         description: toolDescription({
@@ -1038,7 +1485,7 @@ export function registerTools(server) {
     }, async ({ eventId }) => {
         const { uid } = await authed(["events:read"]);
         const data = await readEvent(eventId, uid, "read");
-        return textResult({ id: eventId, ...serialize(data), url: eventUrl(eventId) });
+        return textResult({ id: eventId, ...serialize(data), ...eventLinks(eventId, data) });
     });
     server.registerTool("oko_create_webinar", {
         title: "Create webinar",
@@ -1094,7 +1541,7 @@ export function registerTools(server) {
             ownerId: uid,
             workspaceId,
         });
-        return textResult({ id: docRef.id, url: eventUrl(docRef.id), workspaceId });
+        return textResult({ id: docRef.id, ...eventLinks(docRef.id), workspaceId });
     });
     server.registerTool("oko_update_event", {
         title: "Update event metadata",
@@ -1511,6 +1958,71 @@ export function registerTools(server) {
         await deleteDoc(doc(firestore, "events", eventId));
         return textResult({ deleted: eventId });
     });
+    server.registerTool("oko_duplicate_event", {
+        title: "Duplicate event",
+        description: toolDescription({
+            summary: "Duplicate an event setup into the same or another workspace without analytics/session history.",
+            args: ["eventId: source event.", "targetWorkspaceId: optional target workspace; omitted means source workspace or personal workspace."],
+            returns: "new event id, public/setup/analytics URLs, source event id, and workspaceId.",
+            examples: ["Use to create a reusable copy of a configured webinar before editing the new copy."],
+            notes: ["Copies title, video, meta, blocks, forms, telegram config, NMO settings; does not copy analytics sessions/leads/participants."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            targetWorkspaceId: z.string().min(1).optional().describe("Target workspace id; omit to use the source workspace or personal workspace."),
+        },
+        outputSchema: createWebinarOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, targetWorkspaceId }) => {
+        const { uid } = await authed(["events:write"]);
+        const source = await readEvent(eventId, uid, "read");
+        const workspaceId = targetWorkspaceId ?? safeString(source.workspaceId, uid);
+        const access = await buildWorkspaceAccess(uid, workspaceId);
+        const newRef = await addDoc(collection(firestore, "events"), {
+            ownerId: uid,
+            workspaceId,
+            accessibleBy: access.accessibleBy,
+            editors: access.editors,
+            createdAt: serverTimestamp(),
+            title: safeString(source.title, "Untitled event"),
+            pinned: false,
+            video: source.video ?? { originalUrl: null, embedUrl: null },
+            meta: source.meta ?? { eventDate: null, speakerName: null, description: null },
+            blocks: source.blocks ?? {},
+            ...(Array.isArray(source.forms) ? { forms: source.forms } : {}),
+            ...(source.telegram && typeof source.telegram === "object" ? { telegram: source.telegram } : {}),
+            ...(source.nmoMode === true ? { nmoMode: true } : {}),
+            ...(source.nmoCriteria && typeof source.nmoCriteria === "object" ? { nmoCriteria: source.nmoCriteria } : {}),
+            ...(source.nmoExtraFields && typeof source.nmoExtraFields === "object" ? { nmoExtraFields: source.nmoExtraFields } : {}),
+        });
+        await update(ref(rtdb, `events/${newRef.id}`), { ownerId: uid, workspaceId });
+        return textResult({ id: newRef.id, sourceEventId: eventId, workspaceId, ...eventLinks(newRef.id) });
+    });
+    server.registerTool("oko_move_event", {
+        title: "Move event",
+        description: toolDescription({
+            summary: "Move an event to another workspace and recompute accessibleBy/editors.",
+            args: ["eventId: event to move.", "targetWorkspaceId: target workspace id."],
+            returns: "eventId, targetWorkspaceId, updated Firestore fields, and RTDB mirror status.",
+            examples: ["Use when an event belongs in another workspace. Call oko_list_workspaces first to choose the target."],
+            notes: ["Reads target workspace shares from Firestore with permissions; does not use RTDB workspaceMembers."],
+        }),
+        inputSchema: { eventId: eventIdField, targetWorkspaceId: z.string().min(1).describe("Target workspace id.") },
+        outputSchema: updateOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, targetWorkspaceId }) => {
+        const { uid } = await authed(["events:write", "workspace:write"]);
+        const event = await readEvent(eventId, uid, "edit");
+        const originalOwnerId = safeString(event.ownerId) || null;
+        const access = await buildMoveWorkspaceAccess(uid, targetWorkspaceId, originalOwnerId);
+        await updateDoc(doc(firestore, "events", eventId), {
+            workspaceId: targetWorkspaceId,
+            accessibleBy: access.accessibleBy,
+            editors: access.editors,
+        });
+        await set(ref(rtdb, `events/${eventId}/workspaceId`), targetWorkspaceId);
+        return textResult({ eventId, targetWorkspaceId, updated: ["workspaceId", "accessibleBy", "editors"], rtdbMirrorUpdated: true });
+    });
     server.registerTool("oko_get_live_state", {
         title: "Get live state",
         description: toolDescription({
@@ -1854,6 +2366,103 @@ export function registerTools(server) {
         ]);
         return textResult({ eventId, sessionId, ended: true });
     });
+    server.registerTool("oko_fix_orphan_session", {
+        title: "Fix orphan analytics session",
+        description: toolDescription({
+            summary: "Clear stuck active-session pointers when an analytics session cannot be ended normally.",
+            args: [
+                "eventId: event with stuck session pointers.",
+                "deleteRtdbSessionData: optional, also delete events/{eventId}/sessions/{sessionId}; default false.",
+                "confirm: must be true.",
+            ],
+            returns: "eventId, cleared sessionId if found, and cleaned paths.",
+            examples: ["Use when oko_end_session says the baseline is missing or dashboard shows a stuck/orphan session."],
+            notes: ["This does not stop the video stream; OKO Start/End controls analytics sessions only."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            deleteRtdbSessionData: z.boolean().default(false).describe("Also delete RTDB session data for the stuck session."),
+            confirm: z.boolean().optional().describe("Required true for clearing session pointers."),
+        },
+        outputSchema: basicEventOutputSchema,
+        annotations: destructiveTool,
+    }, async ({ eventId, deleteRtdbSessionData, confirm }) => {
+        const { uid } = await authed(["analytics:write", "live:control"]);
+        const event = await readEvent(eventId, uid, "edit");
+        const ctrlSnap = await get(ref(rtdb, `events/${eventId}/ctrl/activeSessionId`));
+        const sessionId = safeString(event.activeAnalyticsSessionId) || safeString(ctrlSnap.val());
+        requireConfirm(confirm, "oko_fix_orphan_session", { eventId, sessionId: sessionId || null, deleteRtdbSessionData });
+        const cleanup = [
+            updateDoc(doc(firestore, "events", eventId), { activeAnalyticsSessionId: deleteField() }),
+            remove(ref(rtdb, `events/${eventId}/ctrl/activeSessionId`)),
+        ];
+        if (sessionId)
+            cleanup.push(remove(ref(rtdb, `activeSessions/${sessionId}`)));
+        if (sessionId && deleteRtdbSessionData)
+            cleanup.push(remove(ref(rtdb, `events/${eventId}/sessions/${sessionId}`)));
+        const results = await Promise.allSettled(cleanup);
+        const warnings = results
+            .filter((result) => result.status === "rejected")
+            .map((result) => result.reason instanceof Error ? result.reason.message : String(result.reason));
+        return textResult({
+            eventId,
+            sessionId: sessionId || null,
+            fixed: warnings.length === 0,
+            cleared: ["events.activeAnalyticsSessionId", "ctrl/activeSessionId", ...(sessionId ? [`activeSessions/${sessionId}`] : []), ...(sessionId && deleteRtdbSessionData ? [`events/${eventId}/sessions/${sessionId}`] : [])],
+            warnings,
+        });
+    });
+    server.registerTool("oko_delete_session", {
+        title: "Delete analytics session",
+        description: toolDescription({
+            summary: "Delete an analytics session document and optionally its RTDB session data.",
+            args: [
+                "eventId: event id.",
+                "sessionId: analytics session id.",
+                "deleteRtdbData: best-effort delete of events/{eventId}/sessions/{sessionId}; default false.",
+                "confirm: must be true.",
+            ],
+            returns: "eventId, sessionId, deleted=true, and cleaned paths.",
+            examples: ["Use only after confirming the exact session id with the organizer."],
+            notes: ["Destructive. If the session is active, active pointers are cleared first. RTDB session data cleanup is best-effort because rules may deny deleting historical session snapshots."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            sessionId: z.string().min(1).describe("analyticsSessions document id."),
+            deleteRtdbData: z.boolean().default(false).describe("Best-effort delete RTDB session data for this session."),
+            confirm: z.boolean().optional().describe("Required true for session deletion."),
+        },
+        outputSchema: basicEventOutputSchema,
+        annotations: destructiveTool,
+    }, async ({ eventId, sessionId, deleteRtdbData, confirm }) => {
+        const { uid } = await authed(["analytics:write", "live:control"]);
+        const event = await readEvent(eventId, uid, "edit");
+        requireConfirm(confirm, "oko_delete_session", { eventId, sessionId, deleteRtdbData });
+        const isActive = safeString(event.activeAnalyticsSessionId) === sessionId;
+        const cleanup = [];
+        if (isActive) {
+            cleanup.push(updateDoc(doc(firestore, "events", eventId), { activeAnalyticsSessionId: deleteField() }));
+            cleanup.push(remove(ref(rtdb, `events/${eventId}/ctrl/activeSessionId`)));
+            cleanup.push(remove(ref(rtdb, `activeSessions/${sessionId}`)));
+        }
+        cleanup.push(deleteDoc(doc(firestore, "events", eventId, "analyticsSessions", sessionId)));
+        const results = await Promise.allSettled(cleanup);
+        const warnings = results
+            .filter((result) => result.status === "rejected")
+            .map((result) => result.reason instanceof Error ? result.reason.message : String(result.reason));
+        if (warnings.length > 0)
+            throw new Error(`Session delete partially failed: ${warnings.join("; ")}`);
+        const rtdbCleanupWarnings = [];
+        if (deleteRtdbData) {
+            try {
+                await remove(ref(rtdb, `events/${eventId}/sessions/${sessionId}`));
+            }
+            catch (err) {
+                rtdbCleanupWarnings.push(err instanceof Error ? err.message : String(err));
+            }
+        }
+        return textResult({ eventId, sessionId, deleted: true, wasActive: isActive, deleteRtdbData, rtdbCleanupWarnings });
+    });
     server.registerTool("oko_get_analytics", {
         title: "Get analytics sessions",
         description: toolDescription({
@@ -2008,6 +2617,42 @@ export function registerTools(server) {
             await update(ref(chatRtdb), deletes);
         return textResult({ eventId, targetUid, banned: true, deletedMessages: Object.keys(deletes).length });
     });
+    server.registerTool("oko_unmute_user", {
+        title: "Unmute chat user",
+        description: toolDescription({
+            summary: "Remove a chat mute for a user.",
+            args: ["eventId: target event.", "uid: Firebase uid to unmute.", "confirm: must be true."],
+            returns: "eventId, targetUid, and unmuted=true.",
+            examples: ["Use when a user was muted by mistake or the organizer wants to restore chat access."],
+        }),
+        inputSchema: { eventId: eventIdField, uid: z.string().min(1).describe("Firebase uid to unmute."), confirm: z.boolean().optional().describe("Required true for unmute.") },
+        outputSchema: basicEventOutputSchema,
+        annotations: idempotentWriteTool,
+    }, async ({ eventId, uid: targetUid, confirm }) => {
+        const actor = await authed(["chat:moderate"]);
+        await readEvent(eventId, actor.uid, "edit");
+        requireConfirm(confirm, "oko_unmute_user", { eventId, targetUid });
+        await remove(ref(chatRtdb, `mutes/${eventId}/${targetUid}`));
+        return textResult({ eventId, targetUid, unmuted: true });
+    });
+    server.registerTool("oko_unban_user", {
+        title: "Unban chat user",
+        description: toolDescription({
+            summary: "Remove a chat ban for a user.",
+            args: ["eventId: target event.", "uid: Firebase uid to unban.", "confirm: must be true."],
+            returns: "eventId, targetUid, and unbanned=true.",
+            examples: ["Use when a user was banned by mistake or the organizer wants to restore event chat access."],
+        }),
+        inputSchema: { eventId: eventIdField, uid: z.string().min(1).describe("Firebase uid to unban."), confirm: z.boolean().optional().describe("Required true for unban.") },
+        outputSchema: basicEventOutputSchema,
+        annotations: idempotentWriteTool,
+    }, async ({ eventId, uid: targetUid, confirm }) => {
+        const actor = await authed(["chat:moderate"]);
+        await readEvent(eventId, actor.uid, "edit");
+        requireConfirm(confirm, "oko_unban_user", { eventId, targetUid });
+        await remove(ref(chatRtdb, `bans/${eventId}/${targetUid}`));
+        return textResult({ eventId, targetUid, unbanned: true });
+    });
     server.registerTool("oko_set_chat_settings", {
         title: "Set chat settings",
         description: toolDescription({
@@ -2113,6 +2758,116 @@ export function registerTools(server) {
         }
         return textResult({ participants: rows, ...meta });
     });
+    server.registerTool("oko_add_nmo_participant", {
+        title: "Add NMO participant",
+        description: toolDescription({
+            summary: "Add or update one NMO participant for an event through OKO organizer import.",
+            args: ["eventId: NMO event.", "email/fullName/position/org: participant fields."],
+            returns: "eventId, summary, and per-row import result.",
+            examples: ["Use when the organizer dictates one doctor/participant to add before the webinar."],
+            notes: ["This does not return a participant login token; use registration/login URLs from oko_get_event for attendee access."],
+        }),
+        inputSchema: { eventId: eventIdField, participant: nmoParticipantInputSchema },
+        outputSchema: nmoImportOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, participant }) => {
+        const { uid } = await authed(["nmo:write"]);
+        await readEvent(eventId, uid, "edit");
+        const importFn = httpsCallable(functions, "importNmoParticipants");
+        const result = await importFn({
+            eventId,
+            participants: [{
+                    email: normalizeEmail(participant.email),
+                    fullName: participant.fullName.trim(),
+                    position: normalizeOptionalText(participant.position, 200),
+                    org: normalizeOptionalText(participant.org, 200),
+                }],
+        });
+        const data = serialize(result.data);
+        const results = Array.isArray(data.results) ? data.results : [];
+        const first = results[0];
+        if (!first || first.ok !== true) {
+            throw new Error(`NMO participant import failed: ${safeString(first?.error, "unknown error")}`);
+        }
+        return textResult({ eventId, ...data });
+    });
+    server.registerTool("oko_import_nmo_participants", {
+        title: "Import NMO participants",
+        description: toolDescription({
+            summary: "Bulk import NMO participants from structured rows or CSV text.",
+            args: [
+                "eventId: NMO event.",
+                "participants: optional array of rows { email, fullName, position?, org? }.",
+                "csv: optional CSV text with headers email, fullName, position, org.",
+            ],
+            returns: "eventId, summary, and per-row results with ok/error.",
+            examples: ["Use csv when the organizer pastes a participant list from a spreadsheet."],
+            notes: ["Provide exactly one of participants or csv. Max 200 rows. The callable returns partial success for bulk imports."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            participants: z.array(nmoParticipantInputSchema).max(MAX_NMO_IMPORT_PARTICIPANTS).optional(),
+            csv: z.string().max(80_000).optional().describe("CSV with headers email, fullName, position, org."),
+        },
+        outputSchema: nmoImportOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, participants, csv }) => {
+        const { uid } = await authed(["nmo:write"]);
+        await readEvent(eventId, uid, "edit");
+        if (Boolean(participants) === Boolean(csv))
+            throw new Error("Provide exactly one of participants or csv.");
+        const rows = participants ?? parseNmoParticipantsCsv(csv ?? "");
+        if (rows.length === 0 || rows.length > MAX_NMO_IMPORT_PARTICIPANTS)
+            throw new Error(`Import supports 1-${MAX_NMO_IMPORT_PARTICIPANTS} participants.`);
+        const importFn = httpsCallable(functions, "importNmoParticipants");
+        const result = await importFn({
+            eventId,
+            participants: rows.map((row) => ({
+                email: normalizeEmail(row.email),
+                fullName: row.fullName.trim(),
+                position: normalizeOptionalText(row.position, 200),
+                org: normalizeOptionalText(row.org, 200),
+            })),
+        });
+        return textResult({ eventId, ...serialize(result.data) });
+    });
+    server.registerTool("oko_remove_nmo_participant", {
+        title: "Remove NMO participant",
+        description: toolDescription({
+            summary: "Remove an NMO participant and immediately revoke event access.",
+            args: ["eventId: NMO event.", "uid or email: participant to remove.", "confirm: must be true."],
+            returns: "eventId, participant uid/email, and removed=true.",
+            examples: ["Use after listing participants and confirming the exact participant."],
+            notes: ["Order is intentional: arrayRemove from events.participantUids first, then delete participant doc."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            uid: z.string().min(1).optional().describe("Participant Firebase uid."),
+            email: emailSchema.optional().describe("Participant email; used to resolve uid if uid is omitted."),
+            confirm: z.boolean().optional().describe("Required true for participant removal."),
+        },
+        outputSchema: z.object({ eventId: z.string(), uid: z.string(), removed: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ eventId, uid: participantUid, email, confirm }) => {
+        const { uid } = await authed(["nmo:write"]);
+        await readEvent(eventId, uid, "edit");
+        let targetUid = participantUid;
+        const normalizedEmail = email ? normalizeEmail(email) : null;
+        if (!targetUid && normalizedEmail) {
+            const snap = await getDocs(query(collection(firestore, "eventParticipants", eventId, "items"), where("email", "==", normalizedEmail), limit(2)));
+            if (snap.empty)
+                throw new Error(`NMO participant with email ${normalizedEmail} not found.`);
+            if (snap.docs.length > 1)
+                throw new Error(`Multiple NMO participants found for email ${normalizedEmail}; use uid.`);
+            targetUid = snap.docs[0].id;
+        }
+        if (!targetUid)
+            throw new Error("Provide uid or email.");
+        requireConfirm(confirm, "oko_remove_nmo_participant", { eventId, uid: targetUid, email: normalizedEmail });
+        await updateDoc(doc(firestore, "events", eventId), { participantUids: arrayRemove(targetUid) });
+        await deleteDoc(doc(firestore, "eventParticipants", eventId, "items", targetUid));
+        return textResult({ eventId, uid: targetUid, email: normalizedEmail, removed: true });
+    });
     server.registerTool("oko_list_leads", {
         title: "List form leads",
         description: toolDescription({
@@ -2155,6 +2910,116 @@ export function registerTools(server) {
         }
         return textResult({ leads, ...meta });
     });
+    server.registerTool("oko_list_telegram_channels", {
+        title: "List Telegram channels",
+        description: toolDescription({
+            summary: "List Telegram channels available to the authenticated organizer.",
+            args: ["includeWorkspaceChannels: include channels exposed through visible workspaces, default true."],
+            returns: "channels with chatId, title, username, source, and visible workspace metadata.",
+            examples: ["Use before oko_publish_telegram_post so the user can choose a channel by title instead of numeric id."],
+        }),
+        inputSchema: { includeWorkspaceChannels: z.boolean().default(true).describe("Include workspace-level channels visible to this organizer.") },
+        outputSchema: telegramChannelsOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ includeWorkspaceChannels }) => {
+        const { uid } = await authed(["telegram:write"]);
+        const channels = await readTelegramChannels(uid, includeWorkspaceChannels);
+        return textResult({ channels, count: channels.length });
+    });
+    server.registerTool("oko_claim_telegram_channel", {
+        title: "Claim Telegram channel",
+        description: toolDescription({
+            summary: "Claim a pending Telegram channel using the code sent by OKO bot.",
+            args: [
+                "claimCode: code posted by the bot after it was added to a channel.",
+                "workspaceIds: optional workspaces to expose this channel to after claim.",
+            ],
+            returns: "claimed channel and workspace ids updated.",
+            examples: ["Add @OKOStreamBot to a Telegram channel, copy the claim code, then call this tool."],
+            notes: ["Workspace sync requires the authenticated organizer to own each workspace."],
+        }),
+        inputSchema: {
+            claimCode: z.string().min(4).max(32).describe("Telegram channel claim code."),
+            workspaceIds: z.array(z.string().min(1)).max(20).default([]).describe("Optional workspace ids to attach the channel to."),
+        },
+        outputSchema: z.object({ channel: unknownRecordSchema, workspaceIdsUpdated: z.array(z.string()) }).passthrough(),
+        annotations: writeTool,
+    }, async ({ claimCode, workspaceIds }) => {
+        const { uid } = await authed(["telegram:write"]);
+        const claimChannel = httpsCallable(functions, "claimTelegramChannel");
+        const result = await claimChannel({ code: claimCode.trim().toUpperCase() });
+        const data = serialize(result.data);
+        const channelRaw = data.channel && typeof data.channel === "object" ? data.channel : {};
+        const parsed = telegramChannelSchema.safeParse(channelRaw);
+        if (!parsed.success)
+            throw new Error("OKO claimTelegramChannel returned an invalid channel payload.");
+        const workspaceIdsUpdated = await syncTelegramChannelToWorkspaces(uid, parsed.data, workspaceIds);
+        return textResult({ ...data, channel: parsed.data, workspaceIdsUpdated });
+    });
+    server.registerTool("oko_list_telegram_posts", {
+        title: "List Telegram posts",
+        description: toolDescription({
+            summary: "List Telegram notification posts for an event.",
+            args: [
+                "eventId: event whose Telegram posts to list.",
+                "status: optional client-side status filter.",
+                "limit: max posts, default 30, max 100.",
+                "cursor: createdAt cursor returned by previous page.",
+            ],
+            returns: "posts plus cursor pagination metadata.",
+            examples: ["Use to review scheduled/sent/failed Telegram posts before canceling or cloning."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            status: z.enum(TELEGRAM_POST_STATUSES).optional().describe("Optional post status filter."),
+            limit: limitField(),
+            cursor: cursorField,
+        },
+        outputSchema: telegramPostsOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ eventId, status, limit: max, cursor }) => {
+        const { uid } = await authed(["telegram:write"]);
+        await readEvent(eventId, uid, "read");
+        const constraints = [
+            where("eventId", "==", eventId),
+            orderBy("createdAt", "desc"),
+            limit(max + 1),
+        ];
+        if (cursor)
+            constraints.splice(2, 0, startAfter(parseTimestampCursor(cursor)));
+        const snap = await getDocs(query(collection(firestore, "telegramPosts"), ...constraints));
+        const { page, hasMore } = pickPage(snap.docs, max);
+        let posts = page.map((item) => ({ id: item.id, ...serialize(item.data()) }));
+        if (status)
+            posts = posts.filter((post) => post.status === status);
+        const nextCursor = hasMore ? timestampCursorFrom(page.at(-1)?.data().createdAt) : null;
+        return textResult({ posts, ...cursorMeta(posts.length, max, hasMore, nextCursor) });
+    });
+    server.registerTool("oko_cancel_telegram_post", {
+        title: "Cancel Telegram post",
+        description: toolDescription({
+            summary: "Delete a draft/scheduled/failed Telegram post record before it is sent.",
+            args: ["postId: telegramPosts document id.", "confirm: must be true."],
+            returns: "postId, eventId, status, and canceled=true.",
+            examples: ["Use for scheduled posts that should not be sent."],
+            notes: ["Already sent Telegram messages cannot be unsent through OKO; this tool refuses status=sent."],
+        }),
+        inputSchema: { postId: z.string().min(1), confirm: z.boolean().optional().describe("Required true for cancellation.") },
+        outputSchema: z.object({ postId: z.string(), canceled: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ postId, confirm }) => {
+        await authed(["telegram:write"]);
+        const postRef = doc(firestore, "telegramPosts", postId);
+        const postSnap = await getDoc(postRef);
+        if (!postSnap.exists())
+            throw new Error("Telegram post not found.");
+        const post = postSnap.data();
+        if (post.status === "sent")
+            throw new Error("Telegram post was already sent and cannot be canceled through OKO.");
+        requireConfirm(confirm, "oko_cancel_telegram_post", { postId, eventId: post.eventId, status: post.status, caption: post.caption });
+        await deleteDoc(postRef);
+        return textResult({ postId, eventId: post.eventId, status: post.status, canceled: true });
+    });
     server.registerTool("oko_publish_telegram_post", {
         title: "Publish Telegram post",
         description: toolDescription({
@@ -2217,45 +3082,41 @@ export function registerTools(server) {
             summary: "Create a workspace invite for a known OKO workspace.",
             args: [
                 "workspaceId: workspace owned by the authenticated organizer.",
-                "code: invite code, 4-64 chars; stored uppercase.",
+                "code: optional invite code, 4-64 chars; omitted means generated.",
                 "email: optional intended recipient email.",
                 "permissions: optional whitelist of workspace permission booleans.",
                 "confirm: must be true.",
             ],
-            returns: "workspaceId, invite code, and created=true.",
+            returns: "workspaceId, invite code, inviteUrl, and created=true.",
             examples: ["Use only after confirming the recipient and permission set with the workspace owner."],
         }),
         inputSchema: {
             workspaceId: z.string().min(1),
-            code: z.string().min(4).max(64),
+            code: z.string().min(4).max(MAX_WORKSPACE_INVITE_CODE_LENGTH).optional(),
             email: z.string().email().optional(),
             comment: z.string().max(500).default(""),
             permissions: workspacePermissionsSchema,
             confirm: z.boolean().optional(),
         },
-        outputSchema: z.object({ workspaceId: z.string(), code: z.string(), created: z.boolean() }).passthrough(),
+        outputSchema: z.object({ workspaceId: z.string(), code: z.string(), inviteUrl: z.string().url(), created: z.boolean() }).passthrough(),
         annotations: writeTool,
     }, async (args) => {
         const { uid } = await authed(["workspace:write"]);
-        const workspaceSnap = await getDoc(doc(firestore, "workspaces", args.workspaceId));
-        if (!workspaceSnap.exists())
-            throw new Error("Workspace not found.");
-        const workspace = workspaceSnap.data();
-        if (workspace.ownerId !== uid)
-            throw new Error("Only the workspace owner can create invites.");
+        const workspace = await readWorkspaceForOwner(args.workspaceId, uid);
         requireConfirm(args.confirm, "oko_create_workspace_invite", { workspaceId: args.workspaceId, code: args.code, email: args.email });
-        const code = args.code.trim().toUpperCase();
+        const code = (args.code?.trim() || randomInviteCode()).toUpperCase();
+        const inviteUrl = `https://okostream.app/invite/${code}`;
         await setDoc(doc(firestore, "workspaceInvites", code), {
             workspaceId: args.workspaceId,
             workspaceName: safeString(workspace.name, "Workspace"),
             email: args.email ?? "",
             comment: args.comment,
-            permissions: args.permissions,
+            permissions: normalizeWorkspacePermissions(args.permissions),
             createdBy: uid,
             createdAt: serverTimestamp(),
             claimed: false,
             claimedBy: null,
         });
-        return textResult({ workspaceId: args.workspaceId, code, created: true });
+        return textResult({ workspaceId: args.workspaceId, code, inviteUrl, created: true });
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@okostream/mcp",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "MCP server for managing OKO Stream webinars as an organizer.",
   "license": "UNLICENSED",
   "type": "module",