@okostream/mcp 0.1.2 → 0.3.0

package/dist/tools.js

@@ -6,7 +6,7 @@ import { isAbsolute, join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import sharp from "sharp";
 import { z } from "zod";
-import { addDoc, collection, deleteDoc, deleteField, documentId, doc, getDoc, getDocs, limit, orderBy, query, serverTimestamp, setDoc, startAfter, Timestamp, updateDoc, where, } from "firebase/firestore";
+import { addDoc, arrayRemove, collection, deleteDoc, deleteField, documentId, doc, getDoc, getDocs, limit, orderBy, query, serverTimestamp, setDoc, startAfter, Timestamp, updateDoc, where, } from "firebase/firestore";
 import { get, endBefore, limitToLast, orderByKey, push, query as dbQuery, ref, remove, runTransaction, serverTimestamp as rtdbServerTimestamp, set, update, } from "firebase/database";
 import { httpsCallable } from "firebase/functions";
 import { deleteObject, getDownloadURL, ref as storageRef, uploadBytes, } from "firebase/storage";
@@ -39,6 +39,10 @@ const MAX_LIST_LIMIT = 100;
 const MAX_EXPORT_LIMIT = 200;
 const ANALYTICS_DEFAULT_LIMIT = 10;
 const ANALYTICS_TIMELINE_DEFAULT_LIMIT = 120;
+const MAX_NMO_IMPORT_PARTICIPANTS = 200;
+const MAX_WORKSPACE_NAME_LENGTH = 120;
+const MAX_WORKSPACE_INVITE_CODE_LENGTH = 64;
+const TELEGRAM_POST_STATUSES = ["draft", "scheduled", "sent", "failed"];
 const readOnlyTool = {
     readOnlyHint: true,
     destructiveHint: false,
@@ -140,6 +144,51 @@ const deleteImageOutputSchema = z.object({
     storageDeletesAttempted: z.number().int().nonnegative(),
     storageDeleteWarnings: z.array(z.string()),
 }).passthrough();
+const workspaceAccessOutputSchema = z.object({
+    workspaceId: z.string(),
+    workspace: unknownRecordSchema,
+    members: z.array(unknownRecordSchema),
+    invites: z.array(unknownRecordSchema),
+}).passthrough();
+const telegramChannelsOutputSchema = z.object({
+    channels: z.array(unknownRecordSchema),
+    count: z.number().int().nonnegative(),
+}).passthrough();
+const telegramPostsOutputSchema = z.object({
+    posts: z.array(unknownRecordSchema),
+    ...cursorMetaSchema,
+}).passthrough();
+const nmoImportOutputSchema = z.object({
+    eventId: z.string(),
+    summary: unknownRecordSchema,
+    results: z.array(unknownRecordSchema),
+}).passthrough();
+const sessionReportOutputSchema = z.object({
+    eventId: z.string(),
+    sessionId: z.string(),
+    reportUrl: z.string().url(),
+    markdown: z.string(),
+    session: unknownRecordSchema,
+}).passthrough();
+const profileOutputSchema = z.object({
+    uid: z.string(),
+    profile: unknownRecordSchema,
+    updated: z.array(z.string()),
+}).passthrough();
+const deleteLeadOutputSchema = z.object({
+    eventId: z.string(),
+    leadId: z.string(),
+    deleted: z.boolean(),
+}).passthrough();
+const notificationsOutputSchema = z.object({
+    notifications: z.array(unknownRecordSchema),
+    unreadCountOnPage: z.number().int().nonnegative(),
+    ...cursorMetaSchema,
+}).passthrough();
+const notificationsMarkOutputSchema = z.object({
+    markedRead: z.number().int().nonnegative(),
+    notificationIds: z.array(z.string()),
+}).passthrough();
 const formFieldSchema = z.object({
     id: z.string().min(1).optional(),
     label: z.string().max(120),
@@ -174,6 +223,23 @@ const cardItemInputSchema = z.object({
     buttonUrl: z.string().max(MAX_CARD_BUTTON_URL_LENGTH).nullable().optional(),
     formId: cardIdSchema.nullable().optional(),
 }).strict();
+const emailSchema = z.string().email().max(320);
+const nmoParticipantInputSchema = z.object({
+    email: emailSchema.describe("Participant email."),
+    fullName: z.string().min(2).max(200).describe("Participant full name."),
+    position: z.string().max(200).nullable().optional().describe("Optional medical position."),
+    org: z.string().max(200).nullable().optional().describe("Optional organization/clinic."),
+}).strict();
+const telegramChannelSchema = z.object({
+    chatId: z.number().int(),
+    title: z.string().max(200).optional(),
+    username: z.string().max(120).nullable().optional(),
+}).strict();
+const profileDisplayNameSchema = z.string().max(40).nullable();
+const timezoneSchema = z.string()
+    .min(1)
+    .max(100)
+    .regex(/^[A-Za-z0-9_+./-]+$/, "Use an IANA timezone such as Europe/Moscow or UTC.");
 const cardsConfigOutputSchema = z.object({
     eventId: z.string(),
     updated: z.array(z.string()),
@@ -200,6 +266,17 @@ const workspacePermissionsSchema = z.object({
     downloadReports: z.boolean().optional(),
     sendNotifications: z.boolean().optional(),
 }).strict().default({});
+const WORKSPACE_PERMISSION_KEYS = [
+    "createEvents",
+    "editSetup",
+    "deleteEvents",
+    "controlLive",
+    "moderateChat",
+    "startSession",
+    "viewAnalytics",
+    "downloadReports",
+    "sendNotifications",
+];
 const eventIdField = z.string().min(1).describe("OKO event document id, for example KJsAku48821hB4PXTW0S.");
 const limitField = (max = MAX_LIST_LIMIT, defaultValue = DEFAULT_LIST_LIMIT) => z.number().int().min(1).max(max).default(defaultValue).describe(`Maximum items to return, 1-${max}.`);
 const cursorField = z.string().min(1).optional().describe("Cursor returned as nextCursor by the previous page.");
@@ -633,6 +710,35 @@ function normalizeVideo(videoUrl) {
 function eventUrl(eventId) {
     return `https://okostream.app/event/${eventId}`;
 }
+function setupUrl(eventId) {
+    return `https://okostream.app/setup/${eventId}`;
+}
+function analyticsUrl(eventId) {
+    return `https://okostream.app/analytics/${eventId}`;
+}
+function sessionReportUrl(eventId, sessionId) {
+    return `${analyticsUrl(eventId)}/report/${sessionId}`;
+}
+function nmoRegisterUrl(eventId) {
+    return `${eventUrl(eventId)}/register`;
+}
+function nmoLoginUrl(eventId) {
+    return `${eventUrl(eventId)}/login`;
+}
+function eventLinks(eventId, eventData) {
+    const nmoMode = eventData?.nmoMode === true;
+    return {
+        url: eventUrl(eventId),
+        setupUrl: setupUrl(eventId),
+        analyticsUrl: analyticsUrl(eventId),
+        registrationUrl: nmoRegisterUrl(eventId),
+        loginUrl: nmoLoginUrl(eventId),
+        ...(nmoMode ? {
+            nmoRegistrationUrl: nmoRegisterUrl(eventId),
+            nmoLoginUrl: nmoLoginUrl(eventId),
+        } : {}),
+    };
+}
 function assertEventReadable(data, uid) {
     const access = Array.isArray(data.accessibleBy) ? data.accessibleBy : [];
     const editors = Array.isArray(data.editors) ? data.editors : [];
@@ -695,6 +801,193 @@ async function buildWorkspaceAccess(uid, workspaceId) {
     }
     return { accessibleBy: [...accessibleBy], editors: [...editors] };
 }
+async function buildMoveWorkspaceAccess(uid, targetWorkspaceId, originalOwnerId) {
+    const access = await buildWorkspaceAccess(uid, targetWorkspaceId);
+    const accessibleBy = new Set(access.accessibleBy);
+    const editors = new Set(access.editors);
+    if (originalOwnerId)
+        accessibleBy.add(originalOwnerId);
+    return { accessibleBy: [...accessibleBy], editors: [...editors] };
+}
+async function readWorkspaceForOwner(workspaceId, uid) {
+    const snap = await getDoc(doc(firestore, "workspaces", workspaceId));
+    if (!snap.exists())
+        throw new Error("Workspace not found.");
+    const data = snap.data();
+    if (data.ownerId !== uid)
+        throw new Error("Only the workspace owner can manage this workspace.");
+    return data;
+}
+function normalizeWorkspacePermissions(value) {
+    const out = {};
+    for (const key of WORKSPACE_PERMISSION_KEYS) {
+        if (value[key] === true)
+            out[key] = true;
+        else if (value[key] === false)
+            out[key] = false;
+    }
+    return out;
+}
+function randomInviteCode() {
+    return Math.random().toString(36).slice(2, 8).toUpperCase();
+}
+function normalizeEmail(value) {
+    return value.trim().toLowerCase();
+}
+function normalizeOptionalText(value, max) {
+    const text = value?.trim() ?? "";
+    return text ? text.slice(0, max) : null;
+}
+function parseCsvLine(line) {
+    const cells = [];
+    let current = "";
+    let quoted = false;
+    for (let i = 0; i < line.length; i++) {
+        const char = line[i];
+        const next = line[i + 1];
+        if (quoted && char === "\"" && next === "\"") {
+            current += "\"";
+            i++;
+            continue;
+        }
+        if (char === "\"") {
+            quoted = !quoted;
+            continue;
+        }
+        if (!quoted && char === ",") {
+            cells.push(current.trim());
+            current = "";
+            continue;
+        }
+        current += char;
+    }
+    cells.push(current.trim());
+    return cells;
+}
+function parseNmoParticipantsCsv(csv) {
+    const lines = csv
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+    if (lines.length < 2)
+        throw new Error("CSV must include a header row and at least one participant row.");
+    const headers = parseCsvLine(lines[0] ?? "").map((header) => header.trim().toLowerCase());
+    const alias = {
+        email: "email",
+        mail: "email",
+        "e-mail": "email",
+        fullname: "fullName",
+        full_name: "fullName",
+        name: "fullName",
+        fio: "fullName",
+        "фио": "fullName",
+        "имя": "fullName",
+        position: "position",
+        "должность": "position",
+        org: "org",
+        organization: "org",
+        organisation: "org",
+        clinic: "org",
+        "организация": "org",
+    };
+    return lines.slice(1).map((line, index) => {
+        const cells = parseCsvLine(line);
+        const row = {};
+        headers.forEach((header, cellIndex) => {
+            const key = alias[header];
+            if (key)
+                row[key] = cells[cellIndex] ?? "";
+        });
+        const parsed = nmoParticipantInputSchema.safeParse(row);
+        if (!parsed.success) {
+            throw new Error(`Invalid NMO CSV row ${index + 2}: ${parsed.error.issues.map((issue) => issue.message).join("; ")}`);
+        }
+        return parsed.data;
+    });
+}
+async function readTelegramChannels(uid, includeWorkspaceChannels) {
+    const channelsById = new Map();
+    const profileSnap = await getDoc(doc(firestore, "userProfiles", uid));
+    const profileChannels = Array.isArray(profileSnap.data()?.telegramChannels) ? profileSnap.data()?.telegramChannels : [];
+    for (const raw of profileChannels) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            continue;
+        const ch = raw;
+        if (typeof ch.chatId !== "number")
+            continue;
+        channelsById.set(ch.chatId, { ...serialize(ch), source: "profile" });
+    }
+    if (includeWorkspaceChannels) {
+        const workspaces = await listVisibleWorkspaces(uid, true);
+        for (const workspace of workspaces) {
+            const workspaceId = safeString(workspace.id);
+            const workspaceName = safeString(workspace.name);
+            const channels = Array.isArray(workspace.telegramChannels) ? workspace.telegramChannels : [];
+            for (const raw of channels) {
+                if (!raw || typeof raw !== "object" || Array.isArray(raw))
+                    continue;
+                const ch = raw;
+                if (typeof ch.chatId !== "number")
+                    continue;
+                const prev = channelsById.get(ch.chatId) ?? {};
+                const visibleInWorkspaces = Array.isArray(prev.visibleInWorkspaces) ? prev.visibleInWorkspaces : [];
+                channelsById.set(ch.chatId, {
+                    ...prev,
+                    ...serialize(ch),
+                    source: prev.source ? "profile+workspace" : "workspace",
+                    visibleInWorkspaces: [...visibleInWorkspaces, { id: workspaceId, name: workspaceName }],
+                });
+            }
+        }
+    }
+    return [...channelsById.values()].sort((a, b) => safeString(a.title).localeCompare(safeString(b.title)));
+}
+async function listVisibleWorkspaces(uid, includeShared) {
+    const out = [];
+    const ownedSnap = await getDocs(query(collection(firestore, "workspaces"), where("ownerId", "==", uid)));
+    ownedSnap.forEach((item) => out.push({ id: item.id, ...serialize(item.data()), isOwner: true }));
+    if (includeShared) {
+        const profileSnap = await getDoc(doc(firestore, "userProfiles", uid));
+        const sharedIds = (profileSnap.data()?.sharedWorkspaceIds ?? []);
+        for (const workspaceId of sharedIds) {
+            if (out.some((row) => row.id === workspaceId))
+                continue;
+            const wsSnap = await getDoc(doc(firestore, "workspaces", workspaceId));
+            const shareSnap = await getDoc(doc(firestore, "workspaces", workspaceId, "shares", uid));
+            if (wsSnap.exists())
+                out.push({ id: workspaceId, ...serialize(wsSnap.data()), isOwner: false, permissions: serialize(shareSnap.data()?.permissions ?? {}) });
+        }
+    }
+    return out;
+}
+async function syncTelegramChannelToWorkspaces(uid, channel, workspaceIds) {
+    const updated = [];
+    if (workspaceIds.length === 0)
+        return updated;
+    const profileRef = doc(firestore, "userProfiles", uid);
+    const profileSnap = await getDoc(profileRef);
+    const channels = Array.isArray(profileSnap.data()?.telegramChannels) ? [...profileSnap.data().telegramChannels] : [];
+    const nextProfileChannels = channels.map((item) => {
+        if (item.chatId !== channel.chatId)
+            return item;
+        const current = Array.isArray(item.workspaceIds) ? item.workspaceIds.filter((id) => typeof id === "string") : [];
+        return { ...item, workspaceIds: [...new Set([...current, ...workspaceIds])] };
+    });
+    await setDoc(profileRef, { telegramChannels: nextProfileChannels }, { merge: true });
+    for (const workspaceId of workspaceIds) {
+        await readWorkspaceForOwner(workspaceId, uid);
+        const wsRef = doc(firestore, "workspaces", workspaceId);
+        const wsSnap = await getDoc(wsRef);
+        const wsChannels = Array.isArray(wsSnap.data()?.telegramChannels) ? wsSnap.data().telegramChannels : [];
+        if (!wsChannels.some((item) => item.chatId === channel.chatId)) {
+            await updateDoc(wsRef, {
+                telegramChannels: [...wsChannels, { chatId: channel.chatId, title: channel.title ?? "", username: channel.username ?? null }],
+            });
+            updated.push(workspaceId);
+        }
+    }
+    return updated;
+}
 async function readAgg(eventId) {
     const snap = await get(ref(rtdb, `events/${eventId}/agg`));
     const agg = (snap.val() ?? {});
@@ -941,6 +1234,70 @@ function compactAnalyticsSession(raw, options) {
     }
     return session;
 }
+function numberMetric(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function formatSeconds(value) {
+    const seconds = numberMetric(value);
+    if (seconds == null)
+        return "n/a";
+    const total = Math.max(0, Math.round(seconds));
+    const h = Math.floor(total / 3600);
+    const m = Math.floor((total % 3600) / 60);
+    const s = total % 60;
+    if (h > 0)
+        return `${h}h ${String(m).padStart(2, "0")}m ${String(s).padStart(2, "0")}s`;
+    return `${m}m ${String(s).padStart(2, "0")}s`;
+}
+function formatDateTime(value) {
+    const millis = toMillis(value);
+    if (millis == null)
+        return "n/a";
+    return new Date(millis).toISOString();
+}
+function markdownMetric(label, value, suffix = "") {
+    const metric = value === null || value === undefined || value === "" ? "n/a" : String(value);
+    return `- ${label}: ${metric}${suffix}`;
+}
+function sessionReportMarkdown({ eventId, event, sessionId, session, }) {
+    const lines = [
+        `# OKO session report`,
+        "",
+        `Event: ${safeString(event.title, eventId)}`,
+        `Event URL: ${eventUrl(eventId)}`,
+        `Report URL: ${sessionReportUrl(eventId, sessionId)}`,
+        `Session: ${sessionId}`,
+        "",
+        "## Timing",
+        markdownMetric("Started", formatDateTime(session.startedAt)),
+        markdownMetric("Ended", formatDateTime(session.endedAt)),
+        markdownMetric("Duration", formatSeconds(session.durationSec)),
+        "",
+        "## Audience",
+        markdownMetric("Peak viewers", session.peakViewers),
+        markdownMetric("Unique visitors", session.uniqueVisitors),
+        markdownMetric("Views", session.viewCount),
+        markdownMetric("Average watch time", formatSeconds(session.avgTimeSec)),
+        markdownMetric("Median watch time", formatSeconds(session.medianTimeSec)),
+        "",
+        "## Engagement",
+        markdownMetric("Chat messages", session.chatMessages),
+        markdownMetric("Banner impressions", session.bannerImpressions),
+        markdownMetric("Banner clicks", session.bannerClicks),
+        markdownMetric("Banner CTR", session.bannerCtr, session.bannerCtr == null ? "" : "%"),
+        markdownMetric("CTA clicks", session.ctaClicks),
+        markdownMetric("Cards clicks", session.cardsClicks),
+    ];
+    const nmo = session.nmoEvaluation;
+    if (nmo && typeof nmo === "object" && !Array.isArray(nmo)) {
+        const summary = nmo.summary;
+        if (summary && typeof summary === "object" && !Array.isArray(summary)) {
+            const s = summary;
+            lines.push("", "## NMO", markdownMetric("Passed", s.passed), markdownMetric("Failed", s.failed), markdownMetric("No-show", s.noShow), markdownMetric("Total", s.total));
+        }
+    }
+    return lines.join("\n");
+}
 export function registerTools(server) {
     server.registerTool("oko_whoami", {
         title: "Who am I",
@@ -958,6 +1315,39 @@ export function registerTools(server) {
         const auth = await authed([]);
         return textResult({ uid: auth.uid, scopes: currentScopes() });
     });
+    server.registerTool("oko_update_profile", {
+        title: "Update profile",
+        description: toolDescription({
+            summary: "Update the authenticated organizer profile fields used by OKO UI.",
+            args: [
+                "displayName: optional display name, max 40 chars; null clears it.",
+                "timezone: optional IANA timezone such as Europe/Moscow or UTC.",
+            ],
+            returns: "uid, updated field names, and the resulting profile snapshot.",
+            examples: ["Use when the organizer asks to change their visible OKO name or timezone."],
+            notes: ["This edits only the current organizer's own userProfiles document and does not require extra workspace/event scopes."],
+        }),
+        inputSchema: {
+            displayName: profileDisplayNameSchema.optional().describe("Display name, max 40 chars. Null clears it."),
+            timezone: timezoneSchema.optional().describe("IANA timezone, for example Europe/Moscow or UTC."),
+        },
+        outputSchema: profileOutputSchema,
+        annotations: idempotentWriteTool,
+    }, async ({ displayName, timezone }) => {
+        const { uid } = await authed([]);
+        const patch = { updatedAt: serverTimestamp() };
+        if (displayName !== undefined)
+            patch.displayName = displayName?.trim() || null;
+        if (timezone !== undefined)
+            patch.timezone = timezone.trim();
+        const updated = Object.keys(patch).filter((key) => key !== "updatedAt");
+        if (updated.length === 0)
+            throw new Error("Provide displayName and/or timezone.");
+        const profileRef = doc(firestore, "userProfiles", uid);
+        await setDoc(profileRef, patch, { merge: true });
+        const profileSnap = await getDoc(profileRef);
+        return textResult({ uid, updated, profile: profileSnap.exists() ? serialize(profileSnap.data()) : {} });
+    });
     server.registerTool("oko_list_workspaces", {
         title: "List workspaces",
         description: toolDescription({
@@ -971,23 +1361,211 @@ export function registerTools(server) {
         annotations: readOnlyTool,
     }, async ({ includeShared }) => {
         const { uid } = await authed(["workspace:read"]);
-        const out = [];
-        const ownedSnap = await getDocs(query(collection(firestore, "workspaces"), where("ownerId", "==", uid)));
-        ownedSnap.forEach((item) => out.push({ id: item.id, ...serialize(item.data()), isOwner: true }));
-        if (includeShared) {
-            const profileSnap = await getDoc(doc(firestore, "userProfiles", uid));
-            const sharedIds = (profileSnap.data()?.sharedWorkspaceIds ?? []);
-            for (const workspaceId of sharedIds) {
-                if (out.some((row) => typeof row === "object" && row !== null && row.id === workspaceId))
-                    continue;
-                const wsSnap = await getDoc(doc(firestore, "workspaces", workspaceId));
-                const shareSnap = await getDoc(doc(firestore, "workspaces", workspaceId, "shares", uid));
-                if (wsSnap.exists())
-                    out.push({ id: workspaceId, ...serialize(wsSnap.data()), isOwner: false, permissions: serialize(shareSnap.data()?.permissions ?? {}) });
-            }
-        }
+        const out = await listVisibleWorkspaces(uid, includeShared);
         return textResult({ workspaces: out, count: out.length });
     });
+    server.registerTool("oko_create_workspace", {
+        title: "Create workspace",
+        description: toolDescription({
+            summary: "Create a shared OKO workspace owned by the authenticated organizer.",
+            args: ["name: workspace display name."],
+            returns: "workspaceId, name, and created=true.",
+            examples: ["Use when the organizer wants to create a new team/workspace for events."],
+        }),
+        inputSchema: { name: z.string().min(1).max(MAX_WORKSPACE_NAME_LENGTH).describe("Workspace name.") },
+        outputSchema: z.object({ workspaceId: z.string(), created: z.boolean() }).passthrough(),
+        annotations: writeTool,
+    }, async ({ name }) => {
+        const { uid } = await authed(["workspace:write"]);
+        const workspaceRef = await addDoc(collection(firestore, "workspaces"), {
+            name: name.trim(),
+            ownerId: uid,
+            personal: false,
+            createdAt: serverTimestamp(),
+        });
+        return textResult({ workspaceId: workspaceRef.id, name: name.trim(), created: true });
+    });
+    server.registerTool("oko_update_workspace", {
+        title: "Update workspace",
+        description: toolDescription({
+            summary: "Rename a workspace owned by the authenticated organizer.",
+            args: ["workspaceId: workspace to update.", "name: new workspace display name."],
+            returns: "workspaceId and updated fields.",
+            examples: ["Use for workspace rename requests."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1), name: z.string().min(1).max(MAX_WORKSPACE_NAME_LENGTH).describe("New workspace name.") },
+        outputSchema: updateOutputSchema,
+        annotations: idempotentWriteTool,
+    }, async ({ workspaceId, name }) => {
+        const { uid } = await authed(["workspace:write"]);
+        await readWorkspaceForOwner(workspaceId, uid);
+        await updateDoc(doc(firestore, "workspaces", workspaceId), { name: name.trim() });
+        return textResult({ workspaceId, updated: ["name"] });
+    });
+    server.registerTool("oko_delete_workspace", {
+        title: "Delete workspace",
+        description: toolDescription({
+            summary: "Delete an empty non-personal workspace owned by the authenticated organizer.",
+            args: ["workspaceId: workspace to delete.", "confirm: must be true."],
+            returns: "workspaceId and deleted=true.",
+            examples: ["Use after listing workspace access and confirming the workspace is empty."],
+            notes: ["Personal workspaces cannot be deleted. This tool refuses to delete workspaces that still contain events; move/delete events first."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1), confirm: z.boolean().optional().describe("Required true for workspace deletion.") },
+        outputSchema: z.object({ workspaceId: z.string(), deleted: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ workspaceId, confirm }) => {
+        const { uid } = await authed(["workspace:write"]);
+        const workspace = await readWorkspaceForOwner(workspaceId, uid);
+        requireConfirm(confirm, "oko_delete_workspace", { workspaceId, name: workspace.name, personal: workspace.personal });
+        if (workspace.personal === true)
+            throw new Error("Personal workspace cannot be deleted.");
+        const eventsSnap = await getDocs(query(collection(firestore, "events"), where("workspaceId", "==", workspaceId), limit(1)));
+        if (!eventsSnap.empty)
+            throw new Error("Workspace still has events. Move or delete its events before deleting the workspace.");
+        await deleteDoc(doc(firestore, "workspaces", workspaceId));
+        return textResult({ workspaceId, deleted: true });
+    });
+    server.registerTool("oko_list_workspace_access", {
+        title: "List workspace access",
+        description: toolDescription({
+            summary: "List workspace members/shares and pending invites.",
+            args: ["workspaceId: workspace owned by the authenticated organizer."],
+            returns: "workspace document, members array, invites array.",
+            examples: ["Use before changing permissions, removing a member, or revoking an invite."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1) },
+        outputSchema: workspaceAccessOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ workspaceId }) => {
+        const { uid } = await authed(["workspace:read"]);
+        const workspace = await readWorkspaceForOwner(workspaceId, uid);
+        const [sharesSnap, invitesSnap] = await Promise.all([
+            getDocs(collection(firestore, "workspaces", workspaceId, "shares")),
+            getDocs(query(collection(firestore, "workspaceInvites"), where("workspaceId", "==", workspaceId))),
+        ]);
+        const members = [];
+        for (const share of sharesSnap.docs) {
+            const profileSnap = await getDoc(doc(firestore, "userProfiles", share.id));
+            members.push({
+                uid: share.id,
+                ...serialize(share.data()),
+                profile: profileSnap.exists() ? serialize(profileSnap.data()) : null,
+            });
+        }
+        const invites = invitesSnap.docs.map((invite) => ({ code: invite.id, ...serialize(invite.data()) }));
+        return textResult({ workspaceId, workspace: { id: workspaceId, ...serialize(workspace) }, members, invites });
+    });
+    server.registerTool("oko_update_workspace_member", {
+        title: "Update workspace member",
+        description: toolDescription({
+            summary: "Create or update a workspace share/member permissions document.",
+            args: ["workspaceId: workspace owned by the organizer.", "uid: member uid.", "permissions: 9 workspace permission booleans.", "confirm: must be true."],
+            returns: "workspaceId, uid, and updated=true.",
+            examples: ["Use to change an existing member's permissions, or direct-add a known uid."],
+            notes: ["Changing a share triggers OKO CF18 fan-out to event access, RTDB workspaceMembers, and chat roles."],
+        }),
+        inputSchema: {
+            workspaceId: z.string().min(1),
+            uid: z.string().min(1).describe("Member Firebase uid."),
+            email: z.string().email().optional().describe("Optional member email cache."),
+            comment: z.string().max(500).default(""),
+            permissions: workspacePermissionsSchema,
+            confirm: z.boolean().optional().describe("Required true for share updates."),
+        },
+        outputSchema: updateOutputSchema,
+        annotations: writeTool,
+    }, async (args) => {
+        const { uid } = await authed(["workspace:write"]);
+        const workspace = await readWorkspaceForOwner(args.workspaceId, uid);
+        requireConfirm(args.confirm, "oko_update_workspace_member", { workspaceId: args.workspaceId, workspaceName: workspace.name, targetUid: args.uid, permissions: args.permissions });
+        await setDoc(doc(firestore, "workspaces", args.workspaceId, "shares", args.uid), {
+            email: args.email ?? "",
+            comment: args.comment.trim(),
+            permissions: normalizeWorkspacePermissions(args.permissions),
+            sharedAt: serverTimestamp(),
+            sharedBy: uid,
+        }, { merge: true });
+        return textResult({ workspaceId: args.workspaceId, uid: args.uid, updated: true });
+    });
+    server.registerTool("oko_remove_workspace_member", {
+        title: "Remove workspace member",
+        description: toolDescription({
+            summary: "Remove a member/share from a workspace.",
+            args: ["workspaceId: workspace owned by the organizer.", "uid: member uid.", "confirm: must be true."],
+            returns: "workspaceId, uid, removed=true.",
+            examples: ["Use after listing workspace access and confirming the exact uid."],
+            notes: ["Removing a share triggers OKO CF18 reverse fan-out."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1), uid: z.string().min(1), confirm: z.boolean().optional().describe("Required true for member removal.") },
+        outputSchema: z.object({ workspaceId: z.string(), uid: z.string(), removed: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ workspaceId, uid: targetUid, confirm }) => {
+        const { uid } = await authed(["workspace:write"]);
+        const workspace = await readWorkspaceForOwner(workspaceId, uid);
+        requireConfirm(confirm, "oko_remove_workspace_member", { workspaceId, workspaceName: workspace.name, targetUid });
+        await deleteDoc(doc(firestore, "workspaces", workspaceId, "shares", targetUid));
+        return textResult({ workspaceId, uid: targetUid, removed: true });
+    });
+    server.registerTool("oko_list_workspace_invites", {
+        title: "List workspace invites",
+        description: toolDescription({
+            summary: "List workspace invite links for a workspace owned by the organizer.",
+            args: ["workspaceId: workspace owned by the organizer."],
+            returns: "invites array with code, claim status, permissions, and inviteUrl.",
+            examples: ["Use before revoking or sharing an invite code."],
+        }),
+        inputSchema: { workspaceId: z.string().min(1) },
+        outputSchema: z.object({ workspaceId: z.string(), invites: z.array(unknownRecordSchema), count: z.number().int().nonnegative() }).passthrough(),
+        annotations: readOnlyTool,
+    }, async ({ workspaceId }) => {
+        const { uid } = await authed(["workspace:read"]);
+        await readWorkspaceForOwner(workspaceId, uid);
+        const snap = await getDocs(query(collection(firestore, "workspaceInvites"), where("workspaceId", "==", workspaceId)));
+        const invites = snap.docs.map((invite) => ({ code: invite.id, ...serialize(invite.data()), inviteUrl: `https://okostream.app/invite/${invite.id}` }));
+        return textResult({ workspaceId, invites, count: invites.length });
+    });
+    server.registerTool("oko_revoke_workspace_invite", {
+        title: "Revoke workspace invite",
+        description: toolDescription({
+            summary: "Delete a pending workspace invite code.",
+            args: ["code: invite code.", "confirm: must be true."],
+            returns: "code and revoked=true.",
+            examples: ["Use after confirming the exact invite code."],
+        }),
+        inputSchema: { code: z.string().min(4).max(MAX_WORKSPACE_INVITE_CODE_LENGTH), confirm: z.boolean().optional().describe("Required true for invite revocation.") },
+        outputSchema: z.object({ code: z.string(), revoked: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ code, confirm }) => {
+        const { uid } = await authed(["workspace:write"]);
+        const normalizedCode = code.trim().toUpperCase();
+        const inviteSnap = await getDoc(doc(firestore, "workspaceInvites", normalizedCode));
+        if (!inviteSnap.exists())
+            throw new Error("Workspace invite not found.");
+        const invite = inviteSnap.data();
+        if (invite.createdBy !== uid)
+            throw new Error("Only the invite creator/workspace owner can revoke this invite.");
+        requireConfirm(confirm, "oko_revoke_workspace_invite", { code: normalizedCode, workspaceId: invite.workspaceId, claimed: invite.claimed });
+        await deleteDoc(doc(firestore, "workspaceInvites", normalizedCode));
+        return textResult({ code: normalizedCode, revoked: true });
+    });
+    server.registerTool("oko_claim_workspace_invite", {
+        title: "Claim workspace invite",
+        description: toolDescription({
+            summary: "Accept a workspace invite code for the authenticated organizer.",
+            args: ["code: invite code from /invite/{code}."],
+            returns: "success plus workspace id/name returned by OKO CF19.",
+            examples: ["Use when the organizer wants to join a workspace from an invite code."],
+        }),
+        inputSchema: { code: z.string().min(4).max(MAX_WORKSPACE_INVITE_CODE_LENGTH) },
+        outputSchema: unknownRecordSchema,
+        annotations: writeTool,
+    }, async ({ code }) => {
+        await authed(["workspace:write"]);
+        const claimInvite = httpsCallable(functions, "claimWorkspaceInvite");
+        const result = await claimInvite({ code: code.trim().toUpperCase() });
+        return textResult({ ...serialize(result.data) });
+    });
     server.registerTool("oko_list_my_events", {
         title: "List my events",
         description: toolDescription({
@@ -1038,7 +1616,7 @@ export function registerTools(server) {
     }, async ({ eventId }) => {
         const { uid } = await authed(["events:read"]);
         const data = await readEvent(eventId, uid, "read");
-        return textResult({ id: eventId, ...serialize(data), url: eventUrl(eventId) });
+        return textResult({ id: eventId, ...serialize(data), ...eventLinks(eventId, data) });
     });
     server.registerTool("oko_create_webinar", {
         title: "Create webinar",
@@ -1094,7 +1672,7 @@ export function registerTools(server) {
             ownerId: uid,
             workspaceId,
         });
-        return textResult({ id: docRef.id, url: eventUrl(docRef.id), workspaceId });
+        return textResult({ id: docRef.id, ...eventLinks(docRef.id), workspaceId });
     });
     server.registerTool("oko_update_event", {
         title: "Update event metadata",
@@ -1511,6 +2089,71 @@ export function registerTools(server) {
         await deleteDoc(doc(firestore, "events", eventId));
         return textResult({ deleted: eventId });
     });
+    server.registerTool("oko_duplicate_event", {
+        title: "Duplicate event",
+        description: toolDescription({
+            summary: "Duplicate an event setup into the same or another workspace without analytics/session history.",
+            args: ["eventId: source event.", "targetWorkspaceId: optional target workspace; omitted means source workspace or personal workspace."],
+            returns: "new event id, public/setup/analytics URLs, source event id, and workspaceId.",
+            examples: ["Use to create a reusable copy of a configured webinar before editing the new copy."],
+            notes: ["Copies title, video, meta, blocks, forms, telegram config, NMO settings; does not copy analytics sessions/leads/participants."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            targetWorkspaceId: z.string().min(1).optional().describe("Target workspace id; omit to use the source workspace or personal workspace."),
+        },
+        outputSchema: createWebinarOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, targetWorkspaceId }) => {
+        const { uid } = await authed(["events:write"]);
+        const source = await readEvent(eventId, uid, "read");
+        const workspaceId = targetWorkspaceId ?? safeString(source.workspaceId, uid);
+        const access = await buildWorkspaceAccess(uid, workspaceId);
+        const newRef = await addDoc(collection(firestore, "events"), {
+            ownerId: uid,
+            workspaceId,
+            accessibleBy: access.accessibleBy,
+            editors: access.editors,
+            createdAt: serverTimestamp(),
+            title: safeString(source.title, "Untitled event"),
+            pinned: false,
+            video: source.video ?? { originalUrl: null, embedUrl: null },
+            meta: source.meta ?? { eventDate: null, speakerName: null, description: null },
+            blocks: source.blocks ?? {},
+            ...(Array.isArray(source.forms) ? { forms: source.forms } : {}),
+            ...(source.telegram && typeof source.telegram === "object" ? { telegram: source.telegram } : {}),
+            ...(source.nmoMode === true ? { nmoMode: true } : {}),
+            ...(source.nmoCriteria && typeof source.nmoCriteria === "object" ? { nmoCriteria: source.nmoCriteria } : {}),
+            ...(source.nmoExtraFields && typeof source.nmoExtraFields === "object" ? { nmoExtraFields: source.nmoExtraFields } : {}),
+        });
+        await update(ref(rtdb, `events/${newRef.id}`), { ownerId: uid, workspaceId });
+        return textResult({ id: newRef.id, sourceEventId: eventId, workspaceId, ...eventLinks(newRef.id) });
+    });
+    server.registerTool("oko_move_event", {
+        title: "Move event",
+        description: toolDescription({
+            summary: "Move an event to another workspace and recompute accessibleBy/editors.",
+            args: ["eventId: event to move.", "targetWorkspaceId: target workspace id."],
+            returns: "eventId, targetWorkspaceId, updated Firestore fields, and RTDB mirror status.",
+            examples: ["Use when an event belongs in another workspace. Call oko_list_workspaces first to choose the target."],
+            notes: ["Reads target workspace shares from Firestore with permissions; does not use RTDB workspaceMembers."],
+        }),
+        inputSchema: { eventId: eventIdField, targetWorkspaceId: z.string().min(1).describe("Target workspace id.") },
+        outputSchema: updateOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, targetWorkspaceId }) => {
+        const { uid } = await authed(["events:write", "workspace:write"]);
+        const event = await readEvent(eventId, uid, "edit");
+        const originalOwnerId = safeString(event.ownerId) || null;
+        const access = await buildMoveWorkspaceAccess(uid, targetWorkspaceId, originalOwnerId);
+        await updateDoc(doc(firestore, "events", eventId), {
+            workspaceId: targetWorkspaceId,
+            accessibleBy: access.accessibleBy,
+            editors: access.editors,
+        });
+        await set(ref(rtdb, `events/${eventId}/workspaceId`), targetWorkspaceId);
+        return textResult({ eventId, targetWorkspaceId, updated: ["workspaceId", "accessibleBy", "editors"], rtdbMirrorUpdated: true });
+    });
     server.registerTool("oko_get_live_state", {
         title: "Get live state",
         description: toolDescription({
@@ -1854,6 +2497,103 @@ export function registerTools(server) {
         ]);
         return textResult({ eventId, sessionId, ended: true });
     });
+    server.registerTool("oko_fix_orphan_session", {
+        title: "Fix orphan analytics session",
+        description: toolDescription({
+            summary: "Clear stuck active-session pointers when an analytics session cannot be ended normally.",
+            args: [
+                "eventId: event with stuck session pointers.",
+                "deleteRtdbSessionData: optional, also delete events/{eventId}/sessions/{sessionId}; default false.",
+                "confirm: must be true.",
+            ],
+            returns: "eventId, cleared sessionId if found, and cleaned paths.",
+            examples: ["Use when oko_end_session says the baseline is missing or dashboard shows a stuck/orphan session."],
+            notes: ["This does not stop the video stream; OKO Start/End controls analytics sessions only."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            deleteRtdbSessionData: z.boolean().default(false).describe("Also delete RTDB session data for the stuck session."),
+            confirm: z.boolean().optional().describe("Required true for clearing session pointers."),
+        },
+        outputSchema: basicEventOutputSchema,
+        annotations: destructiveTool,
+    }, async ({ eventId, deleteRtdbSessionData, confirm }) => {
+        const { uid } = await authed(["analytics:write", "live:control"]);
+        const event = await readEvent(eventId, uid, "edit");
+        const ctrlSnap = await get(ref(rtdb, `events/${eventId}/ctrl/activeSessionId`));
+        const sessionId = safeString(event.activeAnalyticsSessionId) || safeString(ctrlSnap.val());
+        requireConfirm(confirm, "oko_fix_orphan_session", { eventId, sessionId: sessionId || null, deleteRtdbSessionData });
+        const cleanup = [
+            updateDoc(doc(firestore, "events", eventId), { activeAnalyticsSessionId: deleteField() }),
+            remove(ref(rtdb, `events/${eventId}/ctrl/activeSessionId`)),
+        ];
+        if (sessionId)
+            cleanup.push(remove(ref(rtdb, `activeSessions/${sessionId}`)));
+        if (sessionId && deleteRtdbSessionData)
+            cleanup.push(remove(ref(rtdb, `events/${eventId}/sessions/${sessionId}`)));
+        const results = await Promise.allSettled(cleanup);
+        const warnings = results
+            .filter((result) => result.status === "rejected")
+            .map((result) => result.reason instanceof Error ? result.reason.message : String(result.reason));
+        return textResult({
+            eventId,
+            sessionId: sessionId || null,
+            fixed: warnings.length === 0,
+            cleared: ["events.activeAnalyticsSessionId", "ctrl/activeSessionId", ...(sessionId ? [`activeSessions/${sessionId}`] : []), ...(sessionId && deleteRtdbSessionData ? [`events/${eventId}/sessions/${sessionId}`] : [])],
+            warnings,
+        });
+    });
+    server.registerTool("oko_delete_session", {
+        title: "Delete analytics session",
+        description: toolDescription({
+            summary: "Delete an analytics session document and optionally its RTDB session data.",
+            args: [
+                "eventId: event id.",
+                "sessionId: analytics session id.",
+                "deleteRtdbData: best-effort delete of events/{eventId}/sessions/{sessionId}; default false.",
+                "confirm: must be true.",
+            ],
+            returns: "eventId, sessionId, deleted=true, and cleaned paths.",
+            examples: ["Use only after confirming the exact session id with the organizer."],
+            notes: ["Destructive. If the session is active, active pointers are cleared first. RTDB session data cleanup is best-effort because rules may deny deleting historical session snapshots."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            sessionId: z.string().min(1).describe("analyticsSessions document id."),
+            deleteRtdbData: z.boolean().default(false).describe("Best-effort delete RTDB session data for this session."),
+            confirm: z.boolean().optional().describe("Required true for session deletion."),
+        },
+        outputSchema: basicEventOutputSchema,
+        annotations: destructiveTool,
+    }, async ({ eventId, sessionId, deleteRtdbData, confirm }) => {
+        const { uid } = await authed(["analytics:write", "live:control"]);
+        const event = await readEvent(eventId, uid, "edit");
+        requireConfirm(confirm, "oko_delete_session", { eventId, sessionId, deleteRtdbData });
+        const isActive = safeString(event.activeAnalyticsSessionId) === sessionId;
+        const cleanup = [];
+        if (isActive) {
+            cleanup.push(updateDoc(doc(firestore, "events", eventId), { activeAnalyticsSessionId: deleteField() }));
+            cleanup.push(remove(ref(rtdb, `events/${eventId}/ctrl/activeSessionId`)));
+            cleanup.push(remove(ref(rtdb, `activeSessions/${sessionId}`)));
+        }
+        cleanup.push(deleteDoc(doc(firestore, "events", eventId, "analyticsSessions", sessionId)));
+        const results = await Promise.allSettled(cleanup);
+        const warnings = results
+            .filter((result) => result.status === "rejected")
+            .map((result) => result.reason instanceof Error ? result.reason.message : String(result.reason));
+        if (warnings.length > 0)
+            throw new Error(`Session delete partially failed: ${warnings.join("; ")}`);
+        const rtdbCleanupWarnings = [];
+        if (deleteRtdbData) {
+            try {
+                await remove(ref(rtdb, `events/${eventId}/sessions/${sessionId}`));
+            }
+            catch (err) {
+                rtdbCleanupWarnings.push(err instanceof Error ? err.message : String(err));
+            }
+        }
+        return textResult({ eventId, sessionId, deleted: true, wasActive: isActive, deleteRtdbData, rtdbCleanupWarnings });
+    });
     server.registerTool("oko_get_analytics", {
         title: "Get analytics sessions",
         description: toolDescription({
@@ -1896,6 +2636,65 @@ export function registerTools(server) {
         const nextCursor = hasMore ? timestampCursorFrom(page.at(-1)?.data().startedAt) : null;
         return textResult({ sessions, ...cursorMeta(sessions.length, max, hasMore, nextCursor) }, { truncationHint: "Use limit/cursor or keep includeTimeline/includeSnapshots/includeNmoRows disabled." });
     });
+    server.registerTool("oko_get_session_report", {
+        title: "Get session report",
+        description: toolDescription({
+            summary: "Build a ready-to-share report for one analytics session, with compact structured data and markdown.",
+            args: [
+                "eventId: event to inspect.",
+                "sessionId: optional analytics session id; omitted means latest session.",
+                "includeTimeline: include recent timeline buckets; default false.",
+                "timelineLimit: max timeline buckets when includeTimeline=true.",
+                "includeSnapshots: include baseline/final snapshots; default false.",
+                "includeNmoRows: include full NMO participant rows; default false.",
+            ],
+            returns: "event/session ids, report URL, markdown summary, event summary, and compact session object.",
+            examples: ["Use after a webinar when the user asks for the finished session report without manually opening the report page."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            sessionId: z.string().min(1).optional().describe("analyticsSessions document id. Omit to use the latest session."),
+            includeTimeline: z.boolean().default(false).describe("Include recent timeline buckets."),
+            timelineLimit: z.number().int().min(1).max(500).default(ANALYTICS_TIMELINE_DEFAULT_LIMIT).describe("Max timeline buckets when includeTimeline=true."),
+            includeSnapshots: z.boolean().default(false).describe("Include baselineSnapshot and finalSnapshot."),
+            includeNmoRows: z.boolean().default(false).describe("Include full NMO participant rows when present."),
+        },
+        outputSchema: sessionReportOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ eventId, sessionId, includeTimeline, timelineLimit, includeSnapshots, includeNmoRows }) => {
+        const { uid } = await authed(["analytics:read"]);
+        const event = await readEvent(eventId, uid, "read");
+        let resolvedSessionId = sessionId;
+        let sessionData = null;
+        if (resolvedSessionId) {
+            const sessionSnap = await getDoc(doc(firestore, "events", eventId, "analyticsSessions", resolvedSessionId));
+            if (!sessionSnap.exists())
+                throw new Error("Analytics session not found.");
+            sessionData = sessionSnap.data();
+        }
+        else {
+            const snap = await getDocs(query(collection(firestore, "events", eventId, "analyticsSessions"), orderBy("startedAt", "desc"), limit(1)));
+            const first = snap.docs[0];
+            if (!first)
+                throw new Error("No analytics sessions found for this event.");
+            resolvedSessionId = first.id;
+            sessionData = first.data();
+        }
+        const session = compactAnalyticsSession({ id: resolvedSessionId, ...sessionData }, { includeTimeline, timelineLimit, includeSnapshots, includeNmoRows });
+        const markdown = sessionReportMarkdown({ eventId, event, sessionId: resolvedSessionId, session });
+        return textResult({
+            eventId,
+            sessionId: resolvedSessionId,
+            event: {
+                id: eventId,
+                title: safeString(event.title, eventId),
+                ...eventLinks(eventId, event),
+            },
+            reportUrl: sessionReportUrl(eventId, resolvedSessionId),
+            markdown,
+            session,
+        }, { truncationHint: "Keep includeTimeline/includeSnapshots/includeNmoRows disabled or lower timelineLimit." });
+    });
     server.registerTool("oko_list_recent_chat", {
         title: "List recent chat",
         description: toolDescription({
@@ -2008,6 +2807,42 @@ export function registerTools(server) {
             await update(ref(chatRtdb), deletes);
         return textResult({ eventId, targetUid, banned: true, deletedMessages: Object.keys(deletes).length });
     });
+    server.registerTool("oko_unmute_user", {
+        title: "Unmute chat user",
+        description: toolDescription({
+            summary: "Remove a chat mute for a user.",
+            args: ["eventId: target event.", "uid: Firebase uid to unmute.", "confirm: must be true."],
+            returns: "eventId, targetUid, and unmuted=true.",
+            examples: ["Use when a user was muted by mistake or the organizer wants to restore chat access."],
+        }),
+        inputSchema: { eventId: eventIdField, uid: z.string().min(1).describe("Firebase uid to unmute."), confirm: z.boolean().optional().describe("Required true for unmute.") },
+        outputSchema: basicEventOutputSchema,
+        annotations: idempotentWriteTool,
+    }, async ({ eventId, uid: targetUid, confirm }) => {
+        const actor = await authed(["chat:moderate"]);
+        await readEvent(eventId, actor.uid, "edit");
+        requireConfirm(confirm, "oko_unmute_user", { eventId, targetUid });
+        await remove(ref(chatRtdb, `mutes/${eventId}/${targetUid}`));
+        return textResult({ eventId, targetUid, unmuted: true });
+    });
+    server.registerTool("oko_unban_user", {
+        title: "Unban chat user",
+        description: toolDescription({
+            summary: "Remove a chat ban for a user.",
+            args: ["eventId: target event.", "uid: Firebase uid to unban.", "confirm: must be true."],
+            returns: "eventId, targetUid, and unbanned=true.",
+            examples: ["Use when a user was banned by mistake or the organizer wants to restore event chat access."],
+        }),
+        inputSchema: { eventId: eventIdField, uid: z.string().min(1).describe("Firebase uid to unban."), confirm: z.boolean().optional().describe("Required true for unban.") },
+        outputSchema: basicEventOutputSchema,
+        annotations: idempotentWriteTool,
+    }, async ({ eventId, uid: targetUid, confirm }) => {
+        const actor = await authed(["chat:moderate"]);
+        await readEvent(eventId, actor.uid, "edit");
+        requireConfirm(confirm, "oko_unban_user", { eventId, targetUid });
+        await remove(ref(chatRtdb, `bans/${eventId}/${targetUid}`));
+        return textResult({ eventId, targetUid, unbanned: true });
+    });
     server.registerTool("oko_set_chat_settings", {
         title: "Set chat settings",
         description: toolDescription({
@@ -2113,6 +2948,116 @@ export function registerTools(server) {
         }
         return textResult({ participants: rows, ...meta });
     });
+    server.registerTool("oko_add_nmo_participant", {
+        title: "Add NMO participant",
+        description: toolDescription({
+            summary: "Add or update one NMO participant for an event through OKO organizer import.",
+            args: ["eventId: NMO event.", "email/fullName/position/org: participant fields."],
+            returns: "eventId, summary, and per-row import result.",
+            examples: ["Use when the organizer dictates one doctor/participant to add before the webinar."],
+            notes: ["This does not return a participant login token; use registration/login URLs from oko_get_event for attendee access."],
+        }),
+        inputSchema: { eventId: eventIdField, participant: nmoParticipantInputSchema },
+        outputSchema: nmoImportOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, participant }) => {
+        const { uid } = await authed(["nmo:write"]);
+        await readEvent(eventId, uid, "edit");
+        const importFn = httpsCallable(functions, "importNmoParticipants");
+        const result = await importFn({
+            eventId,
+            participants: [{
+                    email: normalizeEmail(participant.email),
+                    fullName: participant.fullName.trim(),
+                    position: normalizeOptionalText(participant.position, 200),
+                    org: normalizeOptionalText(participant.org, 200),
+                }],
+        });
+        const data = serialize(result.data);
+        const results = Array.isArray(data.results) ? data.results : [];
+        const first = results[0];
+        if (!first || first.ok !== true) {
+            throw new Error(`NMO participant import failed: ${safeString(first?.error, "unknown error")}`);
+        }
+        return textResult({ eventId, ...data });
+    });
+    server.registerTool("oko_import_nmo_participants", {
+        title: "Import NMO participants",
+        description: toolDescription({
+            summary: "Bulk import NMO participants from structured rows or CSV text.",
+            args: [
+                "eventId: NMO event.",
+                "participants: optional array of rows { email, fullName, position?, org? }.",
+                "csv: optional CSV text with headers email, fullName, position, org.",
+            ],
+            returns: "eventId, summary, and per-row results with ok/error.",
+            examples: ["Use csv when the organizer pastes a participant list from a spreadsheet."],
+            notes: ["Provide exactly one of participants or csv. Max 200 rows. The callable returns partial success for bulk imports."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            participants: z.array(nmoParticipantInputSchema).max(MAX_NMO_IMPORT_PARTICIPANTS).optional(),
+            csv: z.string().max(80_000).optional().describe("CSV with headers email, fullName, position, org."),
+        },
+        outputSchema: nmoImportOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, participants, csv }) => {
+        const { uid } = await authed(["nmo:write"]);
+        await readEvent(eventId, uid, "edit");
+        if (Boolean(participants) === Boolean(csv))
+            throw new Error("Provide exactly one of participants or csv.");
+        const rows = participants ?? parseNmoParticipantsCsv(csv ?? "");
+        if (rows.length === 0 || rows.length > MAX_NMO_IMPORT_PARTICIPANTS)
+            throw new Error(`Import supports 1-${MAX_NMO_IMPORT_PARTICIPANTS} participants.`);
+        const importFn = httpsCallable(functions, "importNmoParticipants");
+        const result = await importFn({
+            eventId,
+            participants: rows.map((row) => ({
+                email: normalizeEmail(row.email),
+                fullName: row.fullName.trim(),
+                position: normalizeOptionalText(row.position, 200),
+                org: normalizeOptionalText(row.org, 200),
+            })),
+        });
+        return textResult({ eventId, ...serialize(result.data) });
+    });
+    server.registerTool("oko_remove_nmo_participant", {
+        title: "Remove NMO participant",
+        description: toolDescription({
+            summary: "Remove an NMO participant and immediately revoke event access.",
+            args: ["eventId: NMO event.", "uid or email: participant to remove.", "confirm: must be true."],
+            returns: "eventId, participant uid/email, and removed=true.",
+            examples: ["Use after listing participants and confirming the exact participant."],
+            notes: ["Order is intentional: arrayRemove from events.participantUids first, then delete participant doc."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            uid: z.string().min(1).optional().describe("Participant Firebase uid."),
+            email: emailSchema.optional().describe("Participant email; used to resolve uid if uid is omitted."),
+            confirm: z.boolean().optional().describe("Required true for participant removal."),
+        },
+        outputSchema: z.object({ eventId: z.string(), uid: z.string(), removed: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ eventId, uid: participantUid, email, confirm }) => {
+        const { uid } = await authed(["nmo:write"]);
+        await readEvent(eventId, uid, "edit");
+        let targetUid = participantUid;
+        const normalizedEmail = email ? normalizeEmail(email) : null;
+        if (!targetUid && normalizedEmail) {
+            const snap = await getDocs(query(collection(firestore, "eventParticipants", eventId, "items"), where("email", "==", normalizedEmail), limit(2)));
+            if (snap.empty)
+                throw new Error(`NMO participant with email ${normalizedEmail} not found.`);
+            if (snap.docs.length > 1)
+                throw new Error(`Multiple NMO participants found for email ${normalizedEmail}; use uid.`);
+            targetUid = snap.docs[0].id;
+        }
+        if (!targetUid)
+            throw new Error("Provide uid or email.");
+        requireConfirm(confirm, "oko_remove_nmo_participant", { eventId, uid: targetUid, email: normalizedEmail });
+        await updateDoc(doc(firestore, "events", eventId), { participantUids: arrayRemove(targetUid) });
+        await deleteDoc(doc(firestore, "eventParticipants", eventId, "items", targetUid));
+        return textResult({ eventId, uid: targetUid, email: normalizedEmail, removed: true });
+    });
     server.registerTool("oko_list_leads", {
         title: "List form leads",
         description: toolDescription({
@@ -2155,6 +3100,218 @@ export function registerTools(server) {
         }
         return textResult({ leads, ...meta });
     });
+    server.registerTool("oko_delete_lead", {
+        title: "Delete form lead",
+        description: toolDescription({
+            summary: "Delete one lead/form submission from an event.",
+            args: ["eventId: event id.", "leadId: events/{eventId}/leads document id.", "confirm: must be true."],
+            returns: "eventId, leadId, deleted=true, and a small preview of the deleted lead.",
+            examples: ["Use after listing leads and confirming the exact submission to remove."],
+            notes: ["Destructive. Requires setup:write in addition to leads:read so read-only keys cannot delete leads."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            leadId: z.string().min(1).max(160).describe("Lead document id under events/{eventId}/leads."),
+            confirm: z.boolean().optional().describe("Required true for lead deletion."),
+        },
+        outputSchema: deleteLeadOutputSchema,
+        annotations: destructiveTool,
+    }, async ({ eventId, leadId, confirm }) => {
+        const { uid } = await authed(["leads:read", "setup:write"]);
+        await readEvent(eventId, uid, "edit");
+        const leadRef = doc(firestore, "events", eventId, "leads", leadId);
+        const leadSnap = await getDoc(leadRef);
+        if (!leadSnap.exists())
+            throw new Error("Lead not found.");
+        const lead = serialize(leadSnap.data());
+        requireConfirm(confirm, "oko_delete_lead", { eventId, leadId, formId: lead.formId, source: lead.source, submittedAt: lead.submittedAt });
+        await deleteDoc(leadRef);
+        return textResult({ eventId, leadId, deleted: true, leadPreview: lead });
+    });
+    server.registerTool("oko_list_notifications", {
+        title: "List notifications",
+        description: toolDescription({
+            summary: "List in-app notifications for the authenticated organizer.",
+            args: [
+                "unreadOnly: only unread notifications, default false.",
+                "limit: max notifications, default 20, max 100.",
+                "cursor: createdAt cursor returned as nextCursor by the previous page.",
+            ],
+            returns: "notifications plus unreadCountOnPage and cursor pagination metadata.",
+            examples: ["Use when the organizer asks what changed in OKO or what notifications are waiting."],
+        }),
+        inputSchema: {
+            unreadOnly: z.boolean().default(false).describe("Return only unread notifications."),
+            limit: limitField(100, 20),
+            cursor: cursorField,
+        },
+        outputSchema: notificationsOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ unreadOnly, limit: max, cursor }) => {
+        const { uid } = await authed(["workspace:read"]);
+        const fetchLimit = unreadOnly ? Math.min(max * 5 + 1, 501) : max + 1;
+        const constraints = [
+            orderBy("createdAt", "desc"),
+            limit(fetchLimit),
+        ];
+        if (cursor)
+            constraints.splice(1, 0, startAfter(parseTimestampCursor(cursor)));
+        const snap = await getDocs(query(collection(firestore, "userNotifications", uid, "items"), ...constraints));
+        const matchingDocs = unreadOnly ? snap.docs.filter((item) => item.data().read !== true) : snap.docs;
+        const { page, hasMore: hasMoreInMatches } = pickPage(matchingDocs, max);
+        const hasMore = hasMoreInMatches || snap.docs.length >= fetchLimit;
+        const cursorSource = hasMoreInMatches ? page.at(-1) : snap.docs.at(-1);
+        const notifications = page.map((item) => ({ id: item.id, ...serialize(item.data()) }));
+        const nextCursor = hasMore ? timestampCursorFrom(cursorSource?.data().createdAt) : null;
+        return textResult({
+            notifications,
+            unreadCountOnPage: notifications.filter((item) => item.read !== true).length,
+            ...cursorMeta(notifications.length, max, hasMore, nextCursor),
+        });
+    });
+    server.registerTool("oko_mark_notifications_read", {
+        title: "Mark notifications read",
+        description: toolDescription({
+            summary: "Mark own OKO in-app notifications as read.",
+            args: [
+                "notificationIds: optional explicit notification ids, max 100.",
+                "allUnread: true to mark unread notifications on the first page, max controlled by limit.",
+                "limit: when allUnread=true, max unread notifications to mark, default 100, max 200.",
+            ],
+            returns: "markedRead count and notification ids updated.",
+            examples: ["Use after oko_list_notifications when the user asks to clear the bell/unread state."],
+            notes: ["Provide either notificationIds or allUnread=true. This can update only the current organizer's own notifications."],
+        }),
+        inputSchema: {
+            notificationIds: z.array(z.string().min(1).max(160)).max(100).optional().describe("Specific notification document ids."),
+            allUnread: z.boolean().default(false).describe("Mark unread notifications as read."),
+            limit: limitField(200, 100),
+        },
+        outputSchema: notificationsMarkOutputSchema,
+        annotations: idempotentWriteTool,
+    }, async ({ notificationIds, allUnread, limit: max }) => {
+        const { uid } = await authed(["workspace:read"]);
+        if (Boolean(notificationIds?.length) === allUnread) {
+            throw new Error("Provide either notificationIds or allUnread=true.");
+        }
+        let ids = [...new Set(notificationIds ?? [])];
+        if (allUnread) {
+            const snap = await getDocs(query(collection(firestore, "userNotifications", uid, "items"), where("read", "==", false), limit(max)));
+            ids = snap.docs.map((item) => item.id);
+        }
+        await Promise.all(ids.map((id) => updateDoc(doc(firestore, "userNotifications", uid, "items", id), { read: true })));
+        return textResult({ markedRead: ids.length, notificationIds: ids });
+    });
+    server.registerTool("oko_list_telegram_channels", {
+        title: "List Telegram channels",
+        description: toolDescription({
+            summary: "List Telegram channels available to the authenticated organizer.",
+            args: ["includeWorkspaceChannels: include channels exposed through visible workspaces, default true."],
+            returns: "channels with chatId, title, username, source, and visible workspace metadata.",
+            examples: ["Use before oko_publish_telegram_post so the user can choose a channel by title instead of numeric id."],
+        }),
+        inputSchema: { includeWorkspaceChannels: z.boolean().default(true).describe("Include workspace-level channels visible to this organizer.") },
+        outputSchema: telegramChannelsOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ includeWorkspaceChannels }) => {
+        const { uid } = await authed(["telegram:write"]);
+        const channels = await readTelegramChannels(uid, includeWorkspaceChannels);
+        return textResult({ channels, count: channels.length });
+    });
+    server.registerTool("oko_claim_telegram_channel", {
+        title: "Claim Telegram channel",
+        description: toolDescription({
+            summary: "Claim a pending Telegram channel using the code sent by OKO bot.",
+            args: [
+                "claimCode: code posted by the bot after it was added to a channel.",
+                "workspaceIds: optional workspaces to expose this channel to after claim.",
+            ],
+            returns: "claimed channel and workspace ids updated.",
+            examples: ["Add @OKOStreamBot to a Telegram channel, copy the claim code, then call this tool."],
+            notes: ["Workspace sync requires the authenticated organizer to own each workspace."],
+        }),
+        inputSchema: {
+            claimCode: z.string().min(4).max(32).describe("Telegram channel claim code."),
+            workspaceIds: z.array(z.string().min(1)).max(20).default([]).describe("Optional workspace ids to attach the channel to."),
+        },
+        outputSchema: z.object({ channel: unknownRecordSchema, workspaceIdsUpdated: z.array(z.string()) }).passthrough(),
+        annotations: writeTool,
+    }, async ({ claimCode, workspaceIds }) => {
+        const { uid } = await authed(["telegram:write"]);
+        const claimChannel = httpsCallable(functions, "claimTelegramChannel");
+        const result = await claimChannel({ code: claimCode.trim().toUpperCase() });
+        const data = serialize(result.data);
+        const channelRaw = data.channel && typeof data.channel === "object" ? data.channel : {};
+        const parsed = telegramChannelSchema.safeParse(channelRaw);
+        if (!parsed.success)
+            throw new Error("OKO claimTelegramChannel returned an invalid channel payload.");
+        const workspaceIdsUpdated = await syncTelegramChannelToWorkspaces(uid, parsed.data, workspaceIds);
+        return textResult({ ...data, channel: parsed.data, workspaceIdsUpdated });
+    });
+    server.registerTool("oko_list_telegram_posts", {
+        title: "List Telegram posts",
+        description: toolDescription({
+            summary: "List Telegram notification posts for an event.",
+            args: [
+                "eventId: event whose Telegram posts to list.",
+                "status: optional client-side status filter.",
+                "limit: max posts, default 30, max 100.",
+                "cursor: createdAt cursor returned by previous page.",
+            ],
+            returns: "posts plus cursor pagination metadata.",
+            examples: ["Use to review scheduled/sent/failed Telegram posts before canceling or cloning."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            status: z.enum(TELEGRAM_POST_STATUSES).optional().describe("Optional post status filter."),
+            limit: limitField(),
+            cursor: cursorField,
+        },
+        outputSchema: telegramPostsOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ eventId, status, limit: max, cursor }) => {
+        const { uid } = await authed(["telegram:write"]);
+        await readEvent(eventId, uid, "read");
+        const constraints = [
+            where("eventId", "==", eventId),
+            orderBy("createdAt", "desc"),
+            limit(max + 1),
+        ];
+        if (cursor)
+            constraints.splice(2, 0, startAfter(parseTimestampCursor(cursor)));
+        const snap = await getDocs(query(collection(firestore, "telegramPosts"), ...constraints));
+        const { page, hasMore } = pickPage(snap.docs, max);
+        let posts = page.map((item) => ({ id: item.id, ...serialize(item.data()) }));
+        if (status)
+            posts = posts.filter((post) => post.status === status);
+        const nextCursor = hasMore ? timestampCursorFrom(page.at(-1)?.data().createdAt) : null;
+        return textResult({ posts, ...cursorMeta(posts.length, max, hasMore, nextCursor) });
+    });
+    server.registerTool("oko_cancel_telegram_post", {
+        title: "Cancel Telegram post",
+        description: toolDescription({
+            summary: "Delete a draft/scheduled/failed Telegram post record before it is sent.",
+            args: ["postId: telegramPosts document id.", "confirm: must be true."],
+            returns: "postId, eventId, status, and canceled=true.",
+            examples: ["Use for scheduled posts that should not be sent."],
+            notes: ["Already sent Telegram messages cannot be unsent through OKO; this tool refuses status=sent."],
+        }),
+        inputSchema: { postId: z.string().min(1), confirm: z.boolean().optional().describe("Required true for cancellation.") },
+        outputSchema: z.object({ postId: z.string(), canceled: z.boolean() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ postId, confirm }) => {
+        await authed(["telegram:write"]);
+        const postRef = doc(firestore, "telegramPosts", postId);
+        const postSnap = await getDoc(postRef);
+        if (!postSnap.exists())
+            throw new Error("Telegram post not found.");
+        const post = postSnap.data();
+        if (post.status === "sent")
+            throw new Error("Telegram post was already sent and cannot be canceled through OKO.");
+        requireConfirm(confirm, "oko_cancel_telegram_post", { postId, eventId: post.eventId, status: post.status, caption: post.caption });
+        await deleteDoc(postRef);
+        return textResult({ postId, eventId: post.eventId, status: post.status, canceled: true });
+    });
     server.registerTool("oko_publish_telegram_post", {
         title: "Publish Telegram post",
         description: toolDescription({
@@ -2217,45 +3374,41 @@ export function registerTools(server) {
             summary: "Create a workspace invite for a known OKO workspace.",
             args: [
                 "workspaceId: workspace owned by the authenticated organizer.",
-                "code: invite code, 4-64 chars; stored uppercase.",
+                "code: optional invite code, 4-64 chars; omitted means generated.",
                 "email: optional intended recipient email.",
                 "permissions: optional whitelist of workspace permission booleans.",
                 "confirm: must be true.",
             ],
-            returns: "workspaceId, invite code, and created=true.",
+            returns: "workspaceId, invite code, inviteUrl, and created=true.",
             examples: ["Use only after confirming the recipient and permission set with the workspace owner."],
         }),
         inputSchema: {
             workspaceId: z.string().min(1),
-            code: z.string().min(4).max(64),
+            code: z.string().min(4).max(MAX_WORKSPACE_INVITE_CODE_LENGTH).optional(),
             email: z.string().email().optional(),
             comment: z.string().max(500).default(""),
             permissions: workspacePermissionsSchema,
             confirm: z.boolean().optional(),
         },
-        outputSchema: z.object({ workspaceId: z.string(), code: z.string(), created: z.boolean() }).passthrough(),
+        outputSchema: z.object({ workspaceId: z.string(), code: z.string(), inviteUrl: z.string().url(), created: z.boolean() }).passthrough(),
         annotations: writeTool,
     }, async (args) => {
         const { uid } = await authed(["workspace:write"]);
-        const workspaceSnap = await getDoc(doc(firestore, "workspaces", args.workspaceId));
-        if (!workspaceSnap.exists())
-            throw new Error("Workspace not found.");
-        const workspace = workspaceSnap.data();
-        if (workspace.ownerId !== uid)
-            throw new Error("Only the workspace owner can create invites.");
+        const workspace = await readWorkspaceForOwner(args.workspaceId, uid);
         requireConfirm(args.confirm, "oko_create_workspace_invite", { workspaceId: args.workspaceId, code: args.code, email: args.email });
-        const code = args.code.trim().toUpperCase();
+        const code = (args.code?.trim() || randomInviteCode()).toUpperCase();
+        const inviteUrl = `https://okostream.app/invite/${code}`;
         await setDoc(doc(firestore, "workspaceInvites", code), {
             workspaceId: args.workspaceId,
             workspaceName: safeString(workspace.name, "Workspace"),
             email: args.email ?? "",
             comment: args.comment,
-            permissions: args.permissions,
+            permissions: normalizeWorkspacePermissions(args.permissions),
             createdBy: uid,
             createdAt: serverTimestamp(),
             claimed: false,
             claimedBy: null,
         });
-        return textResult({ workspaceId: args.workspaceId, code, created: true });
+        return textResult({ workspaceId: args.workspaceId, code, inviteUrl, created: true });
     });
 }