@okostream/mcp 0.11.1 → 0.12.0

package/dist/tools/images.js

@@ -0,0 +1,214 @@
+// Загрузка и удаление изображений события.
+//
+// Клиент не пишет в Storage напрямую — только через CF26/CF27, которые
+// проверяют доступ, размер и формат. Варианты 320/800/1600 делает CF4 уже
+// после загрузки, поэтому есть отдельный инструмент ожидания: сразу после
+// загрузки картинка ещё не адаптивна.
+import { z } from "zod";
+import { requireConfirm, textResult } from "../utils.js";
+import { authed } from "./context.js";
+import { cardImagesBatchOutputSchema, deleteImageOutputSchema, destructiveTool, eventIdField, imageOutputSchema, imageVariantsOutputSchema, readOnlyTool, toolDescription, writeTool } from "./schemas.js";
+import { cardIdSchema, deleteStorageUrls, IMAGE_KINDS, imageSourceSchema, MAX_CARD_ITEMS, readImageRef, updateCardImageInTransaction, uploadEventImageForUser, waitForImageVariantTargets } from "./imagePipeline.js";
+import { deleteField, doc, updateDoc } from "firebase/firestore";
+import { firestore } from "../firebase.js";
+import { readEvent } from "./eventAccess.js";
+export function registerImageTools(server) {
+    server.registerTool("oko_upload_image", {
+        title: "Upload event image",
+        description: toolDescription({
+            summary: "Upload and compress an image for an OKO setup block, then write the master URL back to Firestore.",
+            args: [
+                "eventId: event to edit.",
+                "kind: promoBanner, videoPlaceholder, or card.",
+                "cardId: required when kind=card; must match an existing blocks.cards.items id.",
+                "source: exactly one of local path or HTTPS image URL.",
+                "confirm: must be true because the public event image may be replaced.",
+            ],
+            returns: "eventId, kind, imageId, Storage path, masterUrl, byte counts, and a note that CF-generated variants are pending.",
+            examples: [
+                'Use kind="promoBanner" with source.url to set a webinar banner from an image link.',
+                'Use kind="card" with cardId after the card item already exists.',
+            ],
+            notes: [
+                "Uploading an image does not enable its block: toggle the block independently via oko_configure_blocks, in either order.",
+                "The MCP server reads local paths on the organizer machine.",
+                "Remote URLs must be public HTTPS images, max 15MB; private/local hosts are blocked.",
+                "For card images, imageId is the cardId so OKO CF4 can update the correct item.",
+            ],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            kind: z.enum(IMAGE_KINDS).describe("Target image slot."),
+            cardId: z.string().min(1).optional().describe("Required when kind=card."),
+            source: imageSourceSchema.describe("Image source: exactly one of path or url."),
+            confirm: z.boolean().optional().describe("Required true for image upload/replacement."),
+        },
+        outputSchema: imageOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, kind, cardId, source, confirm }) => {
+        const { uid } = await authed(["setup:write"]);
+        requireConfirm(confirm, "oko_upload_image", { eventId, kind, cardId: cardId ?? null, sourceType: source.path ? "local" : "https" });
+        return textResult(await uploadEventImageForUser(uid, eventId, kind, cardId, source));
+    });
+    server.registerTool("oko_upload_card_images_batch", {
+        title: "Upload card images batch",
+        description: toolDescription({
+            summary: "Upload images for multiple existing cards, preserving card metadata with Firestore transactions and waiting for generated variants.",
+            args: [
+                "eventId: event to edit.",
+                "images: 1-6 card image uploads. Each cardId must already exist in blocks.cards.items.",
+                "timeoutSec: max wait for all CF-generated image variants, default 60 seconds.",
+                "confirm: must be true because existing card images may be replaced.",
+            ],
+            returns: "eventId, per-card upload details, per-card variant readiness, ready flag, and warnings.",
+            examples: [
+                "Use after oko_configure_cards has returned stable card ids.",
+                "Use for webinar cards where an agent generated several local images and needs to attach all of them.",
+            ],
+            notes: [
+                "This is a workflow tool for cards only. Use oko_upload_image for promoBanner or videoPlaceholder.",
+                "The tool does not create cards; it only attaches images to existing cards.",
+            ],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            images: z.array(z.object({
+                cardId: cardIdSchema.describe("Existing card id."),
+                source: imageSourceSchema.describe("Image source for this card."),
+            }).strict()).min(1).max(MAX_CARD_ITEMS).describe("Card images to upload."),
+            timeoutSec: z.number().int().min(1).max(120).default(60).describe("Maximum seconds to wait for all generated variants."),
+            confirm: z.boolean().optional().describe("Required true for batch image upload/replacement."),
+        },
+        outputSchema: cardImagesBatchOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, images, timeoutSec, confirm }) => {
+        const { uid } = await authed(["setup:write"]);
+        requireConfirm(confirm, "oko_upload_card_images_batch", { eventId, cardIds: images.map((image) => image.cardId).join(",") });
+        const uploads = [];
+        for (const image of images) {
+            uploads.push(await uploadEventImageForUser(uid, eventId, "card", image.cardId, image.source));
+        }
+        const variants = await waitForImageVariantTargets(uid, eventId, images.map((image) => ({ kind: "card", cardId: image.cardId })), timeoutSec);
+        const warnings = variants
+            .filter((item) => !item.ready)
+            .map((item) => `Card ${item.cardId ?? "unknown"} variants are not ready yet: ${item.reason ?? "unknown"}.`);
+        return textResult({
+            eventId,
+            uploads,
+            variants,
+            ready: variants.every((item) => item.ready),
+            warnings,
+        });
+    });
+    server.registerTool("oko_wait_for_image_variants", {
+        title: "Wait for image variants",
+        description: toolDescription({
+            summary: "Poll an event image slot until Cloud Function generated thumb/card/hero variants are visible in Firestore.",
+            args: [
+                "eventId: event to inspect.",
+                "kind: promoBanner, videoPlaceholder, or card.",
+                "cardId: required when kind=card.",
+                "timeoutSec: max wait, default 60 seconds.",
+            ],
+            returns: "image URLs, imageVariants, ready flag, pending reason, and elapsed time.",
+            examples: ["Use after oko_upload_image to avoid checking the UI before image variants are ready."],
+            notes: ["Read-only. It does not trigger variant generation; it only waits for CF4's Firestore update."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            kind: z.enum(IMAGE_KINDS).describe("Target image slot."),
+            cardId: z.string().min(1).optional().describe("Required when kind=card."),
+            timeoutSec: z.number().int().min(1).max(120).default(60).describe("Maximum seconds to wait."),
+        },
+        outputSchema: imageVariantsOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ eventId, kind, cardId, timeoutSec }) => {
+        const { uid } = await authed(["events:read"]);
+        if (kind === "card" && !cardId)
+            throw new Error("cardId is required when kind is card.");
+        if (kind !== "card" && cardId)
+            throw new Error("cardId is only valid when kind is card.");
+        const statuses = await waitForImageVariantTargets(uid, eventId, [{ kind, cardId: cardId ?? null }], timeoutSec);
+        const status = statuses[0];
+        if (!status)
+            throw new Error("Image variant status was not produced.");
+        return textResult(status);
+    });
+    server.registerTool("oko_delete_image", {
+        title: "Delete event image",
+        description: toolDescription({
+            summary: "Delete an OKO setup block image from Storage and clear the corresponding Firestore image fields.",
+            args: [
+                "eventId: event to edit.",
+                "kind: promoBanner, videoPlaceholder, or card.",
+                "cardId: required when kind=card.",
+                "confirm: must be true.",
+            ],
+            returns: "eventId, kind, deleted=true, and best-effort Storage cleanup warnings if any.",
+            examples: ["Use only after confirming the exact event and image slot with the user."],
+            notes: ["Destructive. Storage cleanup mirrors the web Setup screen: failed object deletes do not block clearing Firestore fields."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            kind: z.enum(IMAGE_KINDS).describe("Target image slot."),
+            cardId: z.string().min(1).optional().describe("Required when kind=card."),
+            confirm: z.boolean().optional().describe("Required true for image deletion."),
+        },
+        outputSchema: deleteImageOutputSchema,
+        annotations: destructiveTool,
+    }, async ({ eventId, kind, cardId, confirm }) => {
+        const { uid } = await authed(["setup:write"]);
+        if (kind === "card" && !cardId)
+            throw new Error("cardId is required when kind is card.");
+        if (kind !== "card" && cardId)
+            throw new Error("cardId is only valid when kind is card.");
+        const event = await readEvent(eventId, uid, "edit");
+        const previous = readImageRef(event, kind, cardId);
+        requireConfirm(confirm, "oko_delete_image", { eventId, kind, cardId: cardId ?? null, imageId: previous.imageId });
+        // 🔴 Сначала снимаем ссылки, потом удаляем объекты. Прежде порядок был
+        // обратный: упавший `updateDoc` оставлял документ со ссылками на уже
+        // удалённые файлы — зритель видел 404, а повтор восстановить их не мог,
+        // потому что объектов больше нет. В обратном порядке отказ Storage
+        // оставляет осиротевшие файлы, и это поправимо: их подберёт CF31 при
+        // удалении события, а ссылок на них уже нет.
+        if (kind === "promoBanner") {
+            await updateDoc(doc(firestore, "events", eventId), {
+                "blocks.promoBanner.imageMasterUrl": deleteField(),
+                "blocks.promoBanner.imageUrl": deleteField(),
+                "blocks.promoBanner.imageVariants": deleteField(),
+                "blocks.promoBanner.imageWidth": deleteField(),
+                "blocks.promoBanner.imageHeight": deleteField(),
+            });
+        }
+        else if (kind === "videoPlaceholder") {
+            await updateDoc(doc(firestore, "events", eventId), {
+                "blocks.video.placeholder.imageMasterUrl": deleteField(),
+                "blocks.video.placeholder.imageUrl": deleteField(),
+                "blocks.video.placeholder.imageVariants": deleteField(),
+                "blocks.video.placeholder.imageWidth": deleteField(),
+                "blocks.video.placeholder.imageHeight": deleteField(),
+            });
+        }
+        else {
+            await updateCardImageInTransaction(eventId, cardId, {
+                imageUrl: null,
+                imageMasterUrl: null,
+                imageVariants: null,
+                imageWidth: null,
+                imageHeight: null,
+            });
+        }
+        // Удаление объектов — best-effort и уже после того, как на них никто не
+        // ссылается: его отказ попадёт в предупреждения ответа, а не в битые
+        // ссылки у зрителя.
+        const cleanup = await deleteStorageUrls(eventId, previous.imageMasterUrl, previous.imageUrl);
+        return textResult({
+            eventId,
+            kind,
+            imageId: previous.imageId ?? (kind === "card" ? cardId : null),
+            deleted: true,
+            storageDeletesAttempted: cleanup.attempted,
+            storageDeleteWarnings: cleanup.warnings,
+        });
+    });
+}

package/dist/tools/instrumentation.js

@@ -0,0 +1,40 @@
+// Обёртка над регистрацией инструментов: аудит записей и человеческий ответ
+// на отказ авторизации.
+//
+// Подменяет server.registerTool один раз, поэтому все домены, зарегистрированные
+// ПОСЛЕ вызова, получают обёртку автоматически — включая те, что появятся
+// позже. Читающие инструменты (readOnlyHint) в журнал не пишут: журнал нужен
+// про изменения, а не про просмотры.
+//
+// OkoAuthError превращается в обычный результат, а не в исключение протокола:
+// «ключ не настроен» — это состояние, о котором модели надо рассказать, а не
+// сбой транспорта.
+import { authErrorResult, OkoAuthError } from "../auth.js";
+import { recordToolAudit } from "./audit.js";
+export function installToolInstrumentation(server) {
+    const rawRegisterTool = server.registerTool.bind(server);
+    server.registerTool = (name, config, handler) => {
+        if (typeof name !== "string" || typeof handler !== "function") {
+            return rawRegisterTool(name, config, handler);
+        }
+        const readOnly = Boolean(config && typeof config === "object"
+            && config.annotations?.readOnlyHint === true);
+        const wrapped = async (...handlerArgs) => {
+            const startedAt = Date.now();
+            try {
+                const result = await handler(...handlerArgs);
+                if (!readOnly)
+                    await recordToolAudit(name, "success", handlerArgs[0], startedAt);
+                return result;
+            }
+            catch (error) {
+                if (error instanceof OkoAuthError)
+                    return authErrorResult(error);
+                if (!readOnly)
+                    await recordToolAudit(name, "error", handlerArgs[0], startedAt, error);
+                throw error;
+            }
+        };
+        return rawRegisterTool(name, config, wrapped);
+    };
+}

package/dist/tools/leads.js

@@ -0,0 +1,85 @@
+// Заявки, оставленные зрителями через формы события.
+//
+// Создаёт их только CF45 после проверки согласия и лимитов; отсюда доступны
+// чтение с выгрузкой в CSV и удаление. Это персональные данные людей —
+// выгрузка отдаёт ровно то, что организатор и так видит в аналитике.
+import { z } from "zod";
+import { requireConfirm, serialize, textResult } from "../utils.js";
+import { authed } from "./context.js";
+import { cursorField, deleteLeadOutputSchema, destructiveTool, eventIdField, leadsOutputSchema, limitField, MAX_EXPORT_LIMIT, readOnlyTool, toolDescription } from "./schemas.js";
+import { collection, deleteDoc, doc, documentId, getDoc, getDocs, limit, orderBy, query, startAfter, where } from "firebase/firestore";
+import { csvRows, cursorMeta } from "./formatting.js";
+import { firestore } from "../firebase.js";
+import { readEvent } from "./eventAccess.js";
+export function registerLeadTools(server) {
+    server.registerTool("oko_list_leads", {
+        title: "List form leads",
+        description: toolDescription({
+            summary: "Read paginated lead form submissions for an event.",
+            args: [
+                "eventId: target event.",
+                "formId: optional lead form id filter.",
+                "csv: return CSV string instead of leads array.",
+                "limit: max rows, default 50, max 200.",
+                "cursor: lead document id returned as nextCursor by the previous page.",
+            ],
+            returns: "leads or csv plus count, limit, hasMore/has_more, nextCursor/next_cursor.",
+            examples: ["Use formId to export one form; if Firestore requests an index, create it from the error link and rerun."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            formId: z.string().optional().describe("Optional lead form id to filter submissions."),
+            csv: z.boolean().default(false).describe("Return CSV string instead of JSON rows."),
+            limit: limitField(MAX_EXPORT_LIMIT, 50),
+            cursor: cursorField,
+        },
+        outputSchema: leadsOutputSchema,
+        annotations: readOnlyTool,
+    }, async ({ eventId, formId, csv, limit: max, cursor }) => {
+        const { uid } = await authed(["leads:read"]);
+        await readEvent(eventId, uid, "analytics");
+        const base = collection(firestore, "events", eventId, "leads");
+        const constraints = formId
+            ? [where("formId", "==", formId), orderBy(documentId()), ...(cursor ? [startAfter(cursor)] : []), limit(max + 1)]
+            : [orderBy(documentId()), ...(cursor ? [startAfter(cursor)] : []), limit(max + 1)];
+        const snap = await getDocs(query(base, ...constraints));
+        const page = snap.docs.slice(0, max);
+        const leads = page.map((item) => ({ id: item.id, ...serialize(item.data()) }));
+        const hasMore = snap.docs.length > max;
+        const nextCursor = hasMore ? page.at(-1)?.id ?? null : null;
+        const meta = cursorMeta(leads.length, max, hasMore, nextCursor);
+        if (csv) {
+            const text = csvRows(["id", "formId", "source", "submittedAt", "valuesJson"], leads.map((lead) => [lead.id, lead.formId, lead.source, lead.submittedAt, JSON.stringify(lead.values ?? {})]));
+            return textResult({ csv: text, ...meta });
+        }
+        return textResult({ leads, ...meta });
+    });
+    server.registerTool("oko_delete_lead", {
+        title: "Delete form lead",
+        description: toolDescription({
+            summary: "Delete one lead/form submission from an event.",
+            args: ["eventId: event id.", "leadId: events/{eventId}/leads document id.", "confirm: must be true."],
+            returns: "eventId, leadId, deleted=true, and a small preview of the deleted lead.",
+            examples: ["Use after listing leads and confirming the exact submission to remove."],
+            notes: ["Destructive. Requires setup:write in addition to leads:read so read-only keys cannot delete leads."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            leadId: z.string().min(1).max(160).describe("Lead document id under events/{eventId}/leads."),
+            confirm: z.boolean().optional().describe("Required true for lead deletion."),
+        },
+        outputSchema: deleteLeadOutputSchema,
+        annotations: destructiveTool,
+    }, async ({ eventId, leadId, confirm }) => {
+        const { uid } = await authed(["leads:read", "setup:write"]);
+        await readEvent(eventId, uid, "edit");
+        const leadRef = doc(firestore, "events", eventId, "leads", leadId);
+        const leadSnap = await getDoc(leadRef);
+        if (!leadSnap.exists())
+            throw new Error("Lead not found.");
+        const lead = serialize(leadSnap.data());
+        requireConfirm(confirm, "oko_delete_lead", { eventId, leadId, formId: lead.formId, source: lead.source, submittedAt: lead.submittedAt });
+        await deleteDoc(leadRef);
+        return textResult({ eventId, leadId, deleted: true, leadPreview: lead });
+    });
+}

package/dist/tools/lifecycle.js

@@ -0,0 +1,161 @@
+// Жизненный цикл события: корзина, восстановление, дублирование, перенос.
+//
+// Корзина обратима 30 дней, окончательное удаление — нет, поэтому оба
+// разрушающих инструмента требуют явного confirm и показывают цель заранее.
+// Тяжёлая работа (очистка обеих RTDB, Storage, уведомлений) живёт в CF31:
+// клиент такую последовательность довести до конца не может.
+import { z } from "zod";
+import { requireConfirm, safeString, textResult } from "../utils.js";
+import { authed, eventLinks } from "./context.js";
+import { createWebinarOutputSchema, destructiveTool, eventIdField, idempotentWriteTool, toolDescription, unknownRecordSchema, updateOutputSchema, writeTool } from "./schemas.js";
+import { functions } from "../firebase.js";
+import { httpsCallable } from "firebase/functions";
+import { readEvent } from "./eventAccess.js";
+import { serverTimestamp } from "firebase/firestore";
+import { addEventWithRtdbMirror, assertCanCreateInWorkspace } from "./eventCreate.js";
+export function registerLifecycleTools(server) {
+    server.registerTool("oko_delete_event", {
+        title: "Move event to trash",
+        description: toolDescription({
+            summary: "Move an OKO event to the 30-day trash. This compatibility alias has the same behavior as oko_trash_event.",
+            args: ["eventId: event to move to trash.", "confirm: must be true."],
+            returns: "trashed event id and purge deadline in epoch milliseconds.",
+            examples: ["Use after showing the exact event title and asking the organizer to confirm moving it to trash."],
+            notes: ["Recoverable for 30 days with oko_restore_event. This does not create an event lifecycle status."],
+        }),
+        inputSchema: { eventId: eventIdField, confirm: z.boolean().optional().describe("Required true to move the event to trash.") },
+        outputSchema: z.object({ trashed: z.string(), purgeAfter: z.number().nullable() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ eventId, confirm }) => {
+        const { uid } = await authed(["events:delete"]);
+        const data = await readEvent(eventId, uid, "delete");
+        requireConfirm(confirm, "oko_delete_event", { eventId, title: data.title });
+        const trash = httpsCallable(functions, "trashEvent");
+        const result = await trash({ eventId });
+        return textResult(result.data);
+    });
+    server.registerTool("oko_trash_event", {
+        title: "Move event to trash",
+        description: toolDescription({
+            summary: "Move an OKO event to the recoverable 30-day trash.",
+            args: ["eventId: event to move to trash.", "confirm: must be true."],
+            returns: "trashed event id and purge deadline in epoch milliseconds.",
+            examples: ["Use after showing the exact event title and asking the organizer to confirm moving it to trash."],
+            notes: ["End any active analytics session first. Restore with oko_restore_event before the purge deadline."],
+        }),
+        inputSchema: { eventId: eventIdField, confirm: z.boolean().optional().describe("Required true to move the event to trash.") },
+        outputSchema: z.object({ trashed: z.string(), purgeAfter: z.number().nullable() }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ eventId, confirm }) => {
+        const { uid } = await authed(["events:delete"]);
+        const event = await readEvent(eventId, uid, "delete");
+        requireConfirm(confirm, "oko_trash_event", { eventId, title: event.title });
+        const trash = httpsCallable(functions, "trashEvent");
+        return textResult((await trash({ eventId })).data);
+    });
+    server.registerTool("oko_restore_event", {
+        title: "Restore event",
+        description: toolDescription({
+            summary: "Restore an OKO event from the 30-day trash before its purge deadline.",
+            args: ["eventId: trashed event to restore."],
+            returns: "restored event id.",
+            examples: ["Use when the organizer asks to undo a trash action."],
+            notes: ["Idempotent. Fails after the trash retention deadline has expired."],
+        }),
+        inputSchema: { eventId: eventIdField },
+        outputSchema: z.object({ restored: z.string() }).passthrough(),
+        annotations: idempotentWriteTool,
+    }, async ({ eventId }) => {
+        const { uid } = await authed(["events:delete"]);
+        await readEvent(eventId, uid, "delete");
+        const restore = httpsCallable(functions, "restoreEvent");
+        return textResult((await restore({ eventId })).data);
+    });
+    server.registerTool("oko_delete_event_permanently", {
+        title: "Delete event permanently",
+        description: toolDescription({
+            summary: "Permanently delete a trashed OKO event and all associated Firestore, RTDB, chat, Storage, participant, session, and Telegram data.",
+            args: [
+                "eventId: trashed event to delete permanently.",
+                "confirmTitle: exact current event title, including case and spacing.",
+                "confirm: must be true.",
+            ],
+            returns: "deleted event id and cross-store cleanup counts.",
+            examples: ["Read the event first, show its exact title, and proceed only after the organizer explicitly types or confirms that exact title."],
+            notes: ["Irreversible. The event must already be in trash; use oko_trash_event first."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            confirmTitle: z.string().max(500).describe("Exact current event title."),
+            confirm: z.boolean().optional().describe("Required true for permanent deletion."),
+        },
+        outputSchema: z.object({ deleted: z.string(), cleanup: unknownRecordSchema }).passthrough(),
+        annotations: destructiveTool,
+    }, async ({ eventId, confirmTitle, confirm }) => {
+        const { uid } = await authed(["events:delete"]);
+        const event = await readEvent(eventId, uid, "delete");
+        const title = safeString(event.title);
+        if (confirmTitle !== title)
+            throw new Error("confirmTitle must exactly match the current event title.");
+        requireConfirm(confirm, "oko_delete_event_permanently", { eventId, title });
+        const remove = httpsCallable(functions, "deleteEventCompletely");
+        return textResult((await remove({ eventId, confirmTitle })).data);
+    });
+    server.registerTool("oko_duplicate_event", {
+        title: "Duplicate event",
+        description: toolDescription({
+            summary: "Duplicate an event setup into the same or another workspace without analytics/session history.",
+            args: ["eventId: source event.", "targetWorkspaceId: optional target workspace; omitted means source workspace or personal workspace."],
+            returns: "new event id, public/setup/analytics URLs, source event id, and workspaceId.",
+            examples: ["Use to create a reusable copy of a configured webinar before editing the new copy."],
+            notes: ["Copies title, video, meta, blocks, forms, and Telegram config; does not copy analytics sessions or leads."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            targetWorkspaceId: z.string().min(1).optional().describe("Target workspace id; omit to use the source workspace or personal workspace."),
+        },
+        outputSchema: createWebinarOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, targetWorkspaceId }) => {
+        const { uid } = await authed(["events:write"]);
+        const source = await readEvent(eventId, uid, "read");
+        const workspaceId = targetWorkspaceId ?? safeString(source.workspaceId, uid);
+        await assertCanCreateInWorkspace(uid, workspaceId);
+        const newRef = await addEventWithRtdbMirror({
+            ownerId: uid,
+            workspaceId,
+            createdAt: serverTimestamp(),
+            title: safeString(source.title, "Untitled event"),
+            pinned: false,
+            video: source.video ?? { originalUrl: null, embedUrl: null },
+            meta: source.meta ?? { eventDate: null, speakerName: null, description: null },
+            blocks: source.blocks ?? {},
+            ...(Array.isArray(source.forms) ? { forms: source.forms } : {}),
+            ...(source.telegram && typeof source.telegram === "object" ? { telegram: source.telegram } : {}),
+        });
+        return textResult({ id: newRef.id, sourceEventId: eventId, workspaceId, ...eventLinks(newRef.id) });
+    });
+    server.registerTool("oko_move_event", {
+        title: "Move event",
+        description: toolDescription({
+            summary: "Move an event to another workspace and recompute accessibleBy/editors.",
+            args: ["eventId: event to move.", "targetWorkspaceId: target workspace id.", "confirm: must be true because access changes."],
+            returns: "eventId, targetWorkspaceId, updated Firestore fields, and RTDB mirror status.",
+            examples: ["Use when an event belongs in another workspace. Call oko_list_workspaces first to choose the target."],
+            notes: ["Reads target workspace shares from Firestore with permissions; does not use RTDB workspaceMembers."],
+        }),
+        inputSchema: {
+            eventId: eventIdField,
+            targetWorkspaceId: z.string().min(1).describe("Target workspace id."),
+            confirm: z.boolean().optional().describe("Required true for event move."),
+        },
+        outputSchema: updateOutputSchema,
+        annotations: writeTool,
+    }, async ({ eventId, targetWorkspaceId, confirm }) => {
+        await authed(["events:write", "workspace:write"]);
+        requireConfirm(confirm, "oko_move_event", { eventId, targetWorkspaceId });
+        const moveEvent = httpsCallable(functions, "moveEventToWorkspace");
+        const result = await moveEvent({ eventId, targetWorkspaceId });
+        return textResult(result.data);
+    });
+}