@okostream/mcp 0.15.0 → 0.15.1

package/dist/server.js

@@ -116310,7 +116310,7 @@ function sanitizeScopes(scopes) {
 }
 
 // build/version.js
-var OKO_MCP_VERSION = "0.15.0";
+var OKO_MCP_VERSION = "0.15.1";
 
 // build/auth.js
 var state = null;
@@ -116646,1563 +116646,1583 @@ function pinnedLookup(address, family) {
   };
 }
 
-// build/tools/eventAccess.js
-var EVENT_ACCESS_FIELD_BY_MODE = {
-  read: "accessibleBy",
-  edit: "editors",
-  delete: "deleters",
-  live: "liveControllers",
-  session: "sessionManagers",
-  analytics: "analyticsViewers",
-  report: "reportDownloaders",
-  moderate: "chatModerators",
-  notify: "notificationSenders"
-};
-var EVENT_ACCESS_COMPOSITION_FIELDS = [
-  ...Object.values(EVENT_ACCESS_FIELD_BY_MODE),
-  "moderators",
-  "participantUids"
-];
-function eventDocumentForOutput(data) {
-  const projected = {};
-  for (const [key, value] of Object.entries(data)) {
-    if (EVENT_ACCESS_COMPOSITION_FIELDS.includes(key))
-      continue;
-    projected[key] = value;
-  }
-  return projected;
-}
-function grantAllowsMode(data, mode) {
-  const field2 = EVENT_ACCESS_FIELD_BY_MODE[mode];
-  return asRecord(data.capabilities)[field2] === true;
-}
-function legacyEventAllowsMode(data, uid, mode) {
-  if (data.ownerId === uid)
-    return true;
-  const fields = mode === "read" ? ["accessibleBy", "editors"] : [EVENT_ACCESS_FIELD_BY_MODE[mode]];
-  return fields.some((field2) => Array.isArray(data[field2]) && data[field2].includes(uid));
-}
-async function readEventAccess(eventId, uid, mode) {
-  const [snap, grant] = await Promise.all([
-    getDoc(doc(firestore, "events", eventId)),
-    getDoc(doc(firestore, "eventAccess", uid, "grants", eventId)).catch((error3) => {
-      if (!isFirestorePermissionDenied(error3))
-        throw error3;
-      return null;
-    })
-  ]);
-  const data = snap.data() ?? {};
-  const holds = (wanted) => grant === null ? legacyEventAllowsMode(data, uid, wanted) : data.ownerId === uid || grant.exists() && grantAllowsMode(grant.data(), wanted);
-  return { data, exists: snap.exists(), visible: holds("read"), allowed: holds(mode) };
-}
-async function eventGrantsMode(eventId, uid, mode) {
-  return (await readEventAccess(eventId, uid, mode)).allowed;
-}
-var EVENT_NOT_FOUND_MESSAGE = "Event not found.";
-async function readEvent(eventId, uid, mode = "read") {
-  const { data, exists, visible, allowed } = await readEventAccess(eventId, uid, mode);
-  if (!visible || !exists) {
-    throw new Error(EVENT_NOT_FOUND_MESSAGE);
-  }
-  if (!allowed) {
-    throw new Error(`Event does not grant ${mode} access to this organizer.`);
-  }
-  if (data.trashedAt && mode !== "read" && mode !== "delete") {
-    throw new Error("Event is in trash. Restore it before making changes or live actions.");
-  }
-  return data;
-}
-
-// build/tools/imagePipeline.js
-var IMAGE_KINDS = ["promoBanner", "videoPlaceholder", "card"];
-var IMAGE_ADVICE = {
-  promoBanner: "Banner advice: a wide landscape image at least 1600 px wide (3:1 to 5:1 works best, for example 1600\xD7400); keep text inside the middle 80% so it survives mobile scaling; JPEG/PNG/WebP/AVIF up to 15 MB, stored as WebP with 320/800/1600 px variants.",
-  videoPlaceholder: "Placeholder advice: it covers the 16:9 video slot, so use a 16:9 image at least 1600\xD7900 px; avoid small text; JPEG/PNG/WebP/AVIF up to 15 MB, stored as WebP with 320/800/1600 px variants.",
-  card: "Card advice: match the cardImageRatio chosen in oko_configure_cards (1:1 is the safest), at least 800 px on the short side; JPEG/PNG/WebP/AVIF up to 15 MB, stored as WebP with 320/800/1600 px variants."
-};
-var IMAGE_VARIANT_NAMES = ["thumb_320.webp", "card_800.webp", "hero_1600.webp"];
-var CARD_IMAGE_RATIOS = ["auto", "1:1", "4:3", "3:2", "16:9", "2:3", "3:4"];
-var CARD_ID_PATTERN = /^[A-Za-z0-9_-]{1,80}$/;
-var MAX_CARD_ITEMS = 6;
-var MAX_CARD_TITLE_LENGTH = 160;
-var MAX_CARD_TEXT_LENGTH = 500;
-var MAX_CARD_BUTTON_LABEL_LENGTH = 80;
-var MAX_CARD_BUTTON_URL_LENGTH = 1e3;
-var MAX_SOURCE_IMAGE_BYTES = 15 * 1024 * 1024;
-var REMOTE_IMAGE_TIMEOUT_MS = 15e3;
-var REMOTE_IMAGE_TOTAL_TIMEOUT_MS = 4e4;
-var REMOTE_IMAGE_MAX_REDIRECTS = 3;
-function remoteImageHopBudget(deadlineAt, now, perHopMs) {
-  const left = deadlineAt - now;
-  if (left <= 0)
-    return { kind: "exhausted" };
-  if (left < perHopMs)
-    return { kind: "budget", ms: left, capped: true };
-  return { kind: "budget", ms: perHopMs, capped: false };
-}
-var ALLOWED_REMOTE_IMAGE_TYPES = /* @__PURE__ */ new Set(["image/jpeg", "image/jpg", "image/png", "image/webp", "image/gif", "image/avif"]);
-function storagePathFromDownloadUrl(downloadUrl) {
-  if (!downloadUrl)
-    return null;
-  const match = downloadUrl.match(/\/o\/([^?]+)/);
-  if (!match)
-    return null;
-  const encodedPath = match[1];
-  if (!encodedPath)
+// build/videoUrl.js
+var TWITCH_PARENT = "okostream.app";
+function extractIframeSrc(input) {
+  const trimmed = input.trim();
+  if (!trimmed.startsWith("<iframe"))
     return null;
+  const match = trimmed.match(/\bsrc=["']([^"']+)["']/i);
+  return match?.[1] ?? null;
+}
+var YT_ID_RE = /^[\w-]{11}$/;
+function extractYouTubeId(url) {
+  let parsed;
   try {
-    return decodeURIComponent(encodedPath);
+    parsed = new URL(url);
   } catch {
     return null;
   }
-}
-function variantPathsFromMasterPath(masterPath) {
-  if (!masterPath.endsWith("/master.webp"))
-    return [];
-  return IMAGE_VARIANT_NAMES.map((name7) => masterPath.replace(/master\.webp$/, name7));
-}
-function resolveLocalImagePath(inputPath) {
-  const expanded = inputPath === "~" || inputPath.startsWith("~/") ? join2(homedir2(), inputPath.slice(2)) : inputPath;
-  return isAbsolute2(expanded) ? resolve2(expanded) : resolve2(process.cwd(), expanded);
-}
-function isBlockedHostname(hostname2) {
-  const host = hostname2.toLowerCase();
-  return host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local");
-}
-function nonPublicResolutionMessage(hostname2, addresses) {
-  const list = addresses.length ? addresses.join(", ") : "no address";
-  const fakeIp = addresses.some((address) => /^198\.1[89]\./.test(address));
-  const environmentHint = fakeIp ? "Addresses in 198.18.0.0/15 mean a VPN or proxy with DNS interception (fake-IP mode) is active on this machine: every public host resolves there, so no remote URL can be verified." : "If other public hosts resolve to private addresses too, a VPN or proxy with DNS interception is active on this machine.";
-  return `Image URL resolves to a non-public IP address (${hostname2} \u2192 ${list}), which is not allowed. ${environmentHint} Workarounds: upload the file from disk via source.path (allowed directories come from OKO_IMAGE_ROOTS; the organizer can download the image first), or disable the VPN/proxy for this upload.`;
-}
-async function resolveRemoteImageAddress(url) {
-  if (url.protocol !== "https:") {
-    throw new Error("Image URL must use https://.");
-  }
-  if (url.username || url.password) {
-    throw new Error("Image URL must not include embedded credentials.");
+  const host = parsed.hostname.replace(/^www\./, "");
+  if (host === "youtu.be") {
+    const id = parsed.pathname.slice(1).split("/")[0] ?? "";
+    return YT_ID_RE.test(id) ? id : null;
   }
-  if (isBlockedHostname(url.hostname)) {
-    throw new Error(`Image URL host "${url.hostname}" is not allowed (local names are blocked). Use a public HTTPS image URL, or upload the file from disk via source.path (requires OKO_IMAGE_ROOTS).`);
+  if (host !== "youtube.com" && host !== "m.youtube.com")
+    return null;
+  const path = parsed.pathname;
+  if (path.startsWith("/embed/")) {
+    const id = path.slice(7).split("/")[0] ?? "";
+    return YT_ID_RE.test(id) ? id : null;
   }
-  const literalAddress = normalizeIpLiteralHostname(url.hostname);
-  const literalFamily = ipLiteralFamily(literalAddress);
-  if (literalFamily !== 0) {
-    if (!isPublicUnicastAddress(literalAddress)) {
-      throw new Error(`Image URL points to a private/local IP address (${literalAddress}), which is not allowed. Use a public HTTPS image URL, or upload the file from disk via source.path (requires OKO_IMAGE_ROOTS).`);
-    }
-    return { addresses: [{ address: literalAddress, family: literalFamily }], transparentProxy: false };
+  if (path.startsWith("/shorts/")) {
+    const id = path.slice(8).split("/")[0] ?? "";
+    return YT_ID_RE.test(id) ? id : null;
   }
-  const addresses = await lookup(url.hostname, { all: true });
-  const transparentProxy = addresses.length > 0 && addresses.every((item) => isTransparentProxyAddress(item.address));
-  if (!transparentProxy && (addresses.length === 0 || addresses.some((item) => !isPublicUnicastAddress(item.address)))) {
-    throw new Error(nonPublicResolutionMessage(url.hostname, addresses.map((item) => item.address)));
+  if (path.startsWith("/live/")) {
+    const id = path.slice(6).split("/")[0] ?? "";
+    return YT_ID_RE.test(id) ? id : null;
   }
-  const candidates = orderAddressCandidates(addresses);
-  if (candidates.length === 0) {
-    throw new Error("Image URL host could not be resolved safely.");
+  if (path === "/watch") {
+    const id = parsed.searchParams.get("v") ?? "";
+    return YT_ID_RE.test(id) ? id : null;
   }
-  return { addresses: candidates, transparentProxy };
+  return null;
 }
-async function responseBufferWithLimit(response, maxBytes) {
-  const body = response.body;
-  if (!body) {
-    const bytes = Buffer.from(await response.arrayBuffer());
-    if (bytes.byteLength > maxBytes)
-      throw new Error(`Image exceeds ${Math.floor(maxBytes / 1024 / 1024)}MB limit.`);
-    return bytes;
-  }
-  const reader = body.getReader();
-  const chunks = [];
-  let total = 0;
+function hostOf(url) {
   try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done)
-        break;
-      const chunk = Buffer.from(value);
-      total += chunk.byteLength;
-      if (total > maxBytes) {
-        throw new Error(`Image exceeds ${Math.floor(maxBytes / 1024 / 1024)}MB limit.`);
-      }
-      chunks.push(chunk);
-    }
-  } finally {
-    reader.releaseLock();
+    return new URL(url).hostname.replace(/^www\./, "").replace(/^m\./, "");
+  } catch {
+    return null;
   }
-  return Buffer.concat(chunks, total);
 }
-function shareLinkHint(url) {
-  let host = "";
+function extractVkVideoIds(url) {
+  let parsed;
   try {
-    host = new URL(url).hostname.toLowerCase();
+    parsed = new URL(url);
   } catch {
-    return "";
-  }
-  if (host === "drive.google.com" || host === "docs.google.com") {
-    return " This is a Google Drive page, not the file: share it as 'anyone with the link' and use https://drive.google.com/uc?export=download&id=<fileId>, or download the file and pass source.path.";
+    return null;
   }
-  if (host.endsWith("disk.yandex.ru") || host.endsWith("disk.yandex.com") || host === "yadi.sk" || host.endsWith("disk.360.yandex.ru")) {
-    return " This is a Yandex Disk page, not the file: use the direct download link from the page (\u0421\u043A\u0430\u0447\u0430\u0442\u044C \u2192 copy link), or download the file and pass source.path.";
+  if (parsed.pathname.includes("video_ext.php")) {
+    const oid = parsed.searchParams.get("oid");
+    const id = parsed.searchParams.get("id");
+    return oid && id ? { oid, id } : null;
   }
-  if (host === "dropbox.com" || host.endsWith(".dropbox.com")) {
-    return " This is a Dropbox page: replace ?dl=0 with ?dl=1 in the link, or download the file and pass source.path.";
+  const match = parsed.pathname.match(/\/video(-?\d+)_(\d+)/);
+  return match ? { oid: match[1] ?? "", id: match[2] ?? "" } : null;
+}
+function extractPathId(url, host, patterns) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
   }
-  if (host.endsWith("onedrive.live.com") || host === "1drv.ms" || host.endsWith("sharepoint.com")) {
-    return " This is a OneDrive page: use its direct download link, or download the file and pass source.path.";
+  if (parsed.hostname.replace(/^www\./, "") !== host && !parsed.hostname.endsWith(`.${host}`))
+    return null;
+  for (const pattern of patterns) {
+    const match = parsed.pathname.match(pattern);
+    if (match?.[1])
+      return match[1];
   }
-  return " Use a direct link to the image file (right-click the image \u2192 copy image address), or download the file and pass source.path.";
+  return null;
 }
-async function readRemoteImage(rawUrl, redirects = 0, notes = [], deadlineAt = Date.now() + REMOTE_IMAGE_TOTAL_TIMEOUT_MS) {
-  if (redirects > REMOTE_IMAGE_MAX_REDIRECTS) {
-    throw new Error("Image URL has too many redirects.");
+function extractTwitchEmbed(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
   }
-  const url = new URL(rawUrl);
-  const pinned = await resolveRemoteImageAddress(url);
-  if (pinned.transparentProxy && redirects === 0) {
-    notes.push(`Image fetched through a VPN/proxy with DNS interception: ${url.hostname} resolved to ${pinned.addresses[0]?.address}, so OKO could not verify the destination address itself; the connection went through the proxy. This is expected on such machines and fine for public image links.`);
+  const host = parsed.hostname.replace(/^www\./, "");
+  if (host === "player.twitch.tv") {
+    const channel = parsed.searchParams.get("channel");
+    const video = parsed.searchParams.get("video");
+    if (channel)
+      return `https://player.twitch.tv/?channel=${channel}&parent=${TWITCH_PARENT}`;
+    if (video)
+      return `https://player.twitch.tv/?video=${video}&parent=${TWITCH_PARENT}`;
   }
-  let lastConnectError = null;
-  for (const candidate of pinned.addresses) {
-    const attempt = await readRemoteImageFrom(url, rawUrl, candidate, redirects, deadlineAt);
-    if ("buffer" in attempt)
-      return attempt.buffer;
-    if ("redirectTo" in attempt)
-      return readRemoteImage(attempt.redirectTo, redirects + 1, notes, deadlineAt);
-    lastConnectError = attempt.connectError;
+  if (host === "twitch.tv") {
+    const vodMatch = parsed.pathname.match(/\/videos\/(\d+)/);
+    if (vodMatch?.[1])
+      return `https://player.twitch.tv/?video=v${vodMatch[1]}&parent=${TWITCH_PARENT}`;
+    const channelMatch = parsed.pathname.match(/^\/([a-zA-Z0-9_]+)$/);
+    if (channelMatch?.[1])
+      return `https://player.twitch.tv/?channel=${channelMatch[1]}&parent=${TWITCH_PARENT}`;
   }
-  throw new Error(`Image URL host ${url.hostname} could not be reached at any of its addresses (${pinned.addresses.map((item) => item.address).join(", ")}): ${lastConnectError?.message ?? "connection failed"}.`);
-}
-function totalBudgetMessage() {
-  return `Image URL did not finish loading within ${REMOTE_IMAGE_TOTAL_TIMEOUT_MS / 1e3} seconds, including redirects.`;
+  return null;
 }
-async function readRemoteImageFrom(url, rawUrl, candidate, redirects, deadlineAt) {
-  const budget = remoteImageHopBudget(deadlineAt, Date.now(), REMOTE_IMAGE_TIMEOUT_MS);
-  if (budget.kind === "exhausted") {
-    throw new Error(totalBudgetMessage());
+function detectAndNormalize(url) {
+  const trimmed = url.trim();
+  if (!trimmed)
+    return { provider: "unknown", normalizedUrl: null };
+  const host = hostOf(trimmed);
+  if (host === "youtube.com" || host === "youtu.be") {
+    const id = extractYouTubeId(trimmed);
+    return { provider: "youtube", normalizedUrl: id ? `https://www.youtube.com/embed/${id}` : null };
   }
-  const dispatcher = new import_undici.Agent({
-    connect: { lookup: pinnedLookup(candidate.address, candidate.family) }
-  });
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), budget.ms);
-  try {
-    let response;
-    try {
-      response = await (0, import_undici.fetch)(url, {
-        redirect: "manual",
-        signal: controller.signal,
-        headers: { accept: "image/avif,image/webp,image/png,image/jpeg,image/gif" },
-        dispatcher
-      });
-    } catch (err) {
-      if (err instanceof Error && err.name === "AbortError") {
-        throw new Error(budget.capped ? totalBudgetMessage() : `Image URL did not respond within ${REMOTE_IMAGE_TIMEOUT_MS / 1e3} seconds.`);
-      }
-      return { connectError: err instanceof Error ? err : new Error(String(err)) };
-    }
-    if (response.status >= 300 && response.status < 400) {
-      const location2 = response.headers.get("location");
-      if (!location2)
-        throw new Error(`Image URL redirected with HTTP ${response.status} but no Location header.`);
-      return { redirectTo: new URL(location2, url).toString() };
-    }
-    if (!response.ok) {
-      throw new Error(`Image URL fetch failed with HTTP ${response.status}.`);
-    }
-    const contentType = (response.headers.get("content-type") ?? "").split(";")[0]?.trim().toLowerCase();
-    if (!contentType || !contentType.startsWith("image/")) {
-      throw new Error(`Image URL must return Content-Type image/* (got ${contentType || "none"}).${shareLinkHint(rawUrl)}`);
-    }
-    if (!ALLOWED_REMOTE_IMAGE_TYPES.has(contentType)) {
-      throw new Error(`Image URL Content-Type ${contentType} is not supported. Use JPEG, PNG, WEBP, GIF, or AVIF.`);
-    }
-    const contentLength = Number(response.headers.get("content-length") ?? 0);
-    if (Number.isFinite(contentLength) && contentLength > MAX_SOURCE_IMAGE_BYTES) {
-      throw new Error("Image URL is larger than 15MB.");
-    }
-    return { buffer: await responseBufferWithLimit(response, MAX_SOURCE_IMAGE_BYTES) };
-  } catch (err) {
-    if (err instanceof Error && err.name === "AbortError") {
-      throw new Error("Image URL fetch timed out.");
-    }
-    throw err;
-  } finally {
-    clearTimeout(timeout);
-    await dispatcher.destroy();
+  if (host === "vk.com" || host === "vkvideo.ru") {
+    const ids = extractVkVideoIds(trimmed);
+    return { provider: "vk", normalizedUrl: ids ? `https://vk.com/video_ext.php?oid=${ids.oid}&id=${ids.id}&hd=2` : null };
   }
+  const rutubeId = extractPathId(trimmed, "rutube.ru", [/\/play\/embed\/([a-f0-9]+)/i, /\/video\/([a-f0-9]+)/i]);
+  if (rutubeId)
+    return { provider: "rutube", normalizedUrl: `https://rutube.ru/play/embed/${rutubeId}` };
+  if (trimmed.includes("rutube.ru"))
+    return { provider: "rutube", normalizedUrl: null };
+  const vimeoId = extractPathId(trimmed, "vimeo.com", [/\/video\/(\d+)/, /^\/(\d+)/]);
+  if (vimeoId)
+    return { provider: "vimeo", normalizedUrl: `https://player.vimeo.com/video/${vimeoId}` };
+  if (trimmed.includes("vimeo.com"))
+    return { provider: "vimeo", normalizedUrl: null };
+  const kinescopeId = extractPathId(trimmed, "kinescope.io", [/\/embed\/([a-zA-Z0-9]+)/, /^\/([a-zA-Z0-9]+)$/]);
+  if (kinescopeId)
+    return { provider: "kinescope", normalizedUrl: `https://kinescope.io/embed/${kinescopeId}` };
+  if (trimmed.includes("kinescope.io"))
+    return { provider: "kinescope", normalizedUrl: null };
+  const dzenId = extractPathId(trimmed, "dzen.ru", [/\/embed\/([a-zA-Z0-9_-]+)/, /\/video\/watch\/([a-zA-Z0-9_-]+)/]);
+  if (dzenId)
+    return { provider: "dzen", normalizedUrl: `https://dzen.ru/embed/${dzenId}` };
+  if (trimmed.includes("dzen.ru"))
+    return { provider: "dzen", normalizedUrl: null };
+  const twitchEmbed = extractTwitchEmbed(trimmed);
+  if (twitchEmbed)
+    return { provider: "twitch", normalizedUrl: twitchEmbed };
+  if (trimmed.includes("twitch.tv"))
+    return { provider: "twitch", normalizedUrl: null };
+  const dailymotionId = extractPathId(trimmed, "dailymotion.com", [/\/embed\/video\/([a-zA-Z0-9]+)/, /\/video\/([a-zA-Z0-9]+)/]) ?? extractPathId(trimmed, "dai.ly", [/^\/([a-zA-Z0-9]+)/]);
+  if (dailymotionId)
+    return { provider: "dailymotion", normalizedUrl: `https://www.dailymotion.com/embed/video/${dailymotionId}` };
+  if (trimmed.includes("dailymotion.com") || trimmed.includes("dai.ly"))
+    return { provider: "dailymotion", normalizedUrl: null };
+  const wistiaId = extractPathId(trimmed, "wistia.com", [/\/medias\/([a-zA-Z0-9]+)/]) ?? extractPathId(trimmed, "fast.wistia.net", [/\/embed\/iframe\/([a-zA-Z0-9]+)/]);
+  if (wistiaId)
+    return { provider: "wistia", normalizedUrl: `https://fast.wistia.net/embed/iframe/${wistiaId}` };
+  if (trimmed.includes("wistia.com") || trimmed.includes("wistia.net"))
+    return { provider: "wistia", normalizedUrl: null };
+  return { provider: "unknown", normalizedUrl: null };
 }
-async function readLocalImage(inputPath) {
-  if (env.imageRoots.length === 0) {
-    throw new Error("Local image reads are disabled. Set OKO_IMAGE_ROOTS to an explicit trusted directory and restart the MCP client.");
+
+// build/tools/formatting.js
+var RETIRED_SESSION_FIELDS = ["nmoEvaluation"];
+function cursorMeta(count, max, hasMore, nextCursor) {
+  return {
+    count,
+    limit: max,
+    hasMore,
+    nextCursor,
+    has_more: hasMore,
+    next_cursor: nextCursor
+  };
+}
+function pickPage(items, max) {
+  return {
+    page: items.slice(0, max),
+    hasMore: items.length > max
+  };
+}
+function assertEmbeddableUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`Invalid videoUrl "${value}". Provide an https:// link or a full <iframe> embed code.`);
   }
-  const filePath = await realpath(resolveLocalImagePath(inputPath));
-  const roots = await Promise.all(env.imageRoots.map(async (root) => {
-    try {
-      return await realpath(root);
-    } catch {
-      return resolve2(root);
-    }
-  }));
-  const allowed = roots.some((root) => {
-    const child2 = relative(root, filePath);
-    return child2 === "" || !child2.startsWith(`..${sep}`) && child2 !== ".." && !isAbsolute2(child2);
-  });
-  if (!allowed) {
-    throw new Error("Image path is outside OKO_IMAGE_ROOTS. Add a trusted root to the MCP client environment.");
+  if (url.protocol !== "https:") {
+    throw new Error(`Unsupported videoUrl protocol "${url.protocol}". The player must be served over https:// \u2014 http:// links are refused by the platform.`);
   }
-  const info = await stat(filePath);
-  if (!info.isFile())
-    throw new Error("Image path must point to a regular file.");
-  if (info.size > MAX_SOURCE_IMAGE_BYTES)
-    throw new Error("Image file is larger than 15MB.");
-  return readFile(filePath);
+  return value;
 }
-function serverFetchRefusal(error3) {
-  if (!error3 || typeof error3 !== "object")
-    return null;
-  const details = error3.details;
-  if (details && typeof details === "object" && details.code === "REMOTE_FETCH_FAILED") {
-    const record3 = details;
-    const fallbackMessage = String(error3.message ?? "the server could not fetch the URL");
-    return {
-      reason: typeof record3.reason === "string" ? record3.reason : "unknown",
-      message: typeof record3.message === "string" ? record3.message : fallbackMessage
-    };
-  }
-  const code = error3.code;
-  const message = String(error3.message ?? "");
-  if (code === "functions/invalid-argument" && message.includes("Image payload is empty or too large")) {
-    return { reason: "server_without_url_support", message: "The OKO server release in use does not fetch URLs yet." };
+function assertNotNullLiteral(value, field2) {
+  if (typeof value === "string" && value.trim().toLowerCase() === "null") {
+    throw new Error(`${field2}: received the literal text "null". To clear the field pass an empty string "" (or JSON null); to keep it unchanged, omit the parameter.`);
   }
-  if (code === "functions/deadline-exceeded") {
-    return { reason: "server_timeout", message: "The OKO server did not finish fetching the URL within its time limit." };
+}
+function normalizeVideo(videoUrl) {
+  const raw = videoUrl?.trim();
+  if (!raw)
+    return { originalUrl: null, embedUrl: null };
+  const effective = extractIframeSrc(raw) ?? raw;
+  const detected = detectAndNormalize(effective);
+  if (detected.provider !== "unknown" && !detected.normalizedUrl) {
+    throw new Error(`Could not extract a valid ${detected.provider} video id from videoUrl.`);
   }
-  if (code === "functions/internal") {
-    return { reason: "server_error", message: message && message !== "internal" ? message : "The OKO server failed while fetching the URL." };
+  return { originalUrl: raw, embedUrl: assertEmbeddableUrl(detected.normalizedUrl ?? effective) };
+}
+function csvRows(headers, rows) {
+  return [headers, ...rows].map((row) => row.map(csvCell).join(",")).join("\n");
+}
+function toMillis(value) {
+  if (typeof value === "number" && Number.isFinite(value))
+    return value;
+  if (value && typeof value === "object" && typeof value.toMillis === "function") {
+    return value.toMillis();
   }
   return null;
 }
-var SERVER_FETCH_NOTE = "Image fetched by the OKO server directly from the URL; this machine's network was not involved.";
-function localFallbackNote(serverFailure) {
-  return `The OKO server could not fetch the URL (${serverFailure.reason}: ${serverFailure.message}), so the image was fetched from this machine instead.`;
+function parseTimestampCursor(cursor) {
+  const separator = cursor.indexOf("|");
+  const head = separator === -1 ? cursor : cursor.slice(0, separator);
+  const docId = separator === -1 ? "" : cursor.slice(separator + 1);
+  const millis2 = Number(head);
+  const at = Number.isFinite(millis2) && millis2 > 0 ? millis2 : Date.parse(head);
+  if (!Number.isFinite(at)) {
+    throw new Error("Invalid cursor. Use the nextCursor value returned by the previous page.");
+  }
+  const boundary = Timestamp.fromMillis(at);
+  return docId ? [boundary, docId] : [boundary];
 }
-function remoteImageUnavailableMessage(url, serverFailure, localError) {
-  const localMessage = localError instanceof Error ? localError.message : String(localError);
-  return `Image URL could not be fetched by the OKO server or from this machine. Server (${serverFailure.reason}): ${serverFailure.message} This machine: ${localMessage} Ask the organizer to download the image and pass its path via source.path (allowed directories come from OKO_IMAGE_ROOTS), or to share a public HTTPS link that returns the image file directly. URL: ${url}`;
+function timestampCursorFrom(value, docId) {
+  const millis2 = toMillis(value);
+  if (millis2 == null)
+    return null;
+  return docId ? `${millis2}|${docId}` : String(millis2);
 }
-async function uploadImageFromSource(eventId, kind, cardId, source) {
-  if (source.path) {
-    const buffer2 = await readLocalImage(source.path);
-    const uploaded2 = await uploadMasterImage(eventId, kind, cardId, { imageBase64: buffer2.toString("base64") });
-    return { uploaded: uploaded2, sourceBytes: buffer2.byteLength, sourceVia: "client", notes: [] };
-  }
-  if (!source.url)
-    throw new Error("Provide image source path or url.");
-  let serverFailure;
-  try {
-    const uploaded2 = await uploadMasterImage(eventId, kind, cardId, { sourceUrl: source.url });
-    return { uploaded: uploaded2, sourceBytes: uploaded2.sourceBytes ?? 0, sourceVia: "server", notes: [SERVER_FETCH_NOTE] };
-  } catch (error3) {
-    const refusal3 = serverFetchRefusal(error3);
-    if (!refusal3)
-      throw error3;
-    serverFailure = refusal3;
-  }
-  let buffer;
-  const fetchNotes = [];
-  try {
-    buffer = await readRemoteImage(source.url, 0, fetchNotes);
-  } catch (localError) {
-    throw new Error(remoteImageUnavailableMessage(source.url, serverFailure, localError));
-  }
-  const uploaded = await uploadMasterImage(eventId, kind, cardId, { imageBase64: buffer.toString("base64") });
-  return {
-    uploaded,
-    sourceBytes: buffer.byteLength,
-    sourceVia: "client",
-    notes: [localFallbackNote(serverFailure), ...fetchNotes]
-  };
-}
-function readImageRef(eventData, kind, cardId) {
-  const blocks = eventData.blocks && typeof eventData.blocks === "object" ? eventData.blocks : {};
-  if (kind === "promoBanner") {
-    const banner = blocks.promoBanner && typeof blocks.promoBanner === "object" ? blocks.promoBanner : {};
-    return {
-      imageId: storagePathFromDownloadUrl(safeString(banner.imageMasterUrl))?.split("/").at(-2) ?? null,
-      imageUrl: safeString(banner.imageUrl) || null,
-      imageMasterUrl: safeString(banner.imageMasterUrl) || null,
-      imageVariants: readImageVariants(banner.imageVariants)
-    };
-  }
-  if (kind === "videoPlaceholder") {
-    const video = blocks.video && typeof blocks.video === "object" ? blocks.video : {};
-    const placeholder = video.placeholder && typeof video.placeholder === "object" ? video.placeholder : {};
-    return {
-      imageId: storagePathFromDownloadUrl(safeString(placeholder.imageMasterUrl))?.split("/").at(-2) ?? null,
-      imageUrl: safeString(placeholder.imageUrl) || null,
-      imageMasterUrl: safeString(placeholder.imageMasterUrl) || null,
-      imageVariants: readImageVariants(placeholder.imageVariants)
-    };
-  }
-  if (!cardId)
-    throw new Error("cardId is required when kind is card.");
-  const cards = blocks.cards && typeof blocks.cards === "object" ? blocks.cards : {};
-  const items = Array.isArray(cards.items) ? cards.items : [];
-  const item = items.find((raw) => Boolean(raw) && typeof raw === "object" && raw.id === cardId);
-  if (!item)
-    throw new Error(`Card ${cardId} not found in blocks.cards.items. Create/configure the card before uploading its image.`);
-  return {
-    imageId: cardId,
-    imageUrl: safeString(item.imageUrl) || null,
-    imageMasterUrl: safeString(item.imageMasterUrl) || null,
-    imageVariants: readImageVariants(item.imageVariants)
-  };
-}
-function cardItemsWithImage(eventData, cardId, patch) {
-  const blocks = eventData.blocks && typeof eventData.blocks === "object" ? eventData.blocks : {};
-  const cards = blocks.cards && typeof blocks.cards === "object" ? blocks.cards : {};
-  const items = Array.isArray(cards.items) ? cards.items : [];
-  let found = false;
-  const next = items.map((raw) => {
-    const item = raw && typeof raw === "object" ? raw : {};
-    if (item.id !== cardId)
-      return item;
-    found = true;
-    return { ...item, ...patch };
-  });
-  if (!found)
-    throw new Error(`Card ${cardId} not found in blocks.cards.items.`);
-  return next;
-}
-function readImageVariants(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return null;
-  const data = value;
-  if (typeof data.thumbUrl !== "string" || typeof data.cardUrl !== "string" || typeof data.heroUrl !== "string") {
+var ISO_WITH_OFFSET = /(?:Z|[+-]\d{2}:?\d{2})$/;
+function parseIsoBound(value, label) {
+  if (value === void 0)
     return null;
+  const parsed = Date.parse(value);
+  if (!Number.isFinite(parsed) || !ISO_WITH_OFFSET.test(value.trim())) {
+    throw new Error(`Invalid ${label}: expected an ISO timestamp with an explicit offset, such as 2026-08-28T00:00:00+03:00 or 2026-08-27T21:00:00Z.`);
   }
-  return {
-    thumbUrl: data.thumbUrl,
-    cardUrl: data.cardUrl,
-    heroUrl: data.heroUrl
-  };
-}
-function readCardsConfig(eventData) {
-  const blocks = eventData.blocks && typeof eventData.blocks === "object" ? eventData.blocks : {};
-  const raw = blocks.cards && typeof blocks.cards === "object" ? blocks.cards : {};
-  const rawItems = Array.isArray(raw.items) ? raw.items : [];
-  const repairedIdPositions = [];
-  const items = rawItems.map((item, position) => ({ item, position })).filter((entry) => Boolean(entry.item) && typeof entry.item === "object" && !Array.isArray(entry.item)).map(({ item, position }) => {
-    const hasUsableId = typeof item.id === "string" && CARD_ID_PATTERN.test(item.id);
-    if (!hasUsableId)
-      repairedIdPositions.push(position);
-    return {
-      // 🔴 The UUID is generated only when it is needed: previously the
-      // crypto RNG was invoked for every card on every read, and the value
-      // was discarded (review 02.09, R3c-14)
-      id: hasUsableId ? item.id : randomUUID2(),
-      title: safeString(item.title).trim() || null,
-      text: safeString(item.text).trim() || null,
-      buttonLabel: safeString(item.buttonLabel).trim() || null,
-      buttonUrl: safeString(item.buttonUrl).trim() || null,
-      imageUrl: safeString(item.imageUrl).trim() || null,
-      imageMasterUrl: safeString(item.imageMasterUrl).trim() || null,
-      imageVariants: readImageVariants(item.imageVariants),
-      imageWidth: typeof item.imageWidth === "number" ? item.imageWidth : null,
-      imageHeight: typeof item.imageHeight === "number" ? item.imageHeight : null,
-      formId: safeString(item.formId).trim() || null
-    };
-  });
-  const ratio = safeString(raw.cardImageRatio);
-  return {
-    enabled: raw.enabled === true,
-    visibility: raw.visibility === "hidden" ? "hidden" : "always",
-    cardImageRatio: CARD_IMAGE_RATIOS.includes(ratio) ? ratio : "16:9",
-    items,
-    repairedIdPositions
-  };
-}
-function normalizeNullableText(value) {
-  if (value == null)
-    return null;
-  return value.trim() || null;
+  return Timestamp.fromMillis(parsed);
 }
-var CARD_LINK_SCHEME = /^(https?:\/\/|mailto:|tel:|\/(?!\/))/i;
-var CARD_BARE_DOMAIN = /^[\p{L}\d-]+(\.[\p{L}\d-]+)+(:\d+)?(\/\S*)?$/u;
-function normalizeCardButtonUrl(value) {
-  const trimmed = normalizeNullableText(value);
+function absoluteHttpUrl(value, label) {
+  const trimmed = (value ?? "").trim();
   if (!trimmed)
     return null;
-  if (CARD_LINK_SCHEME.test(trimmed))
-    return trimmed;
-  if (CARD_BARE_DOMAIN.test(trimmed))
-    return `https://${trimmed}`;
   let url;
   try {
     url = new URL(trimmed);
   } catch {
-    throw new Error(`Invalid card buttonUrl "${trimmed}". Use http(s), mailto, tel, a site-relative /path, or set formId instead.`);
+    throw new Error(`Invalid ${label} "${trimmed}": Telegram needs an absolute http(s) URL.`);
   }
-  throw new Error(`Unsupported card buttonUrl protocol "${url.protocol}". Use http(s), mailto, tel, a site-relative /path, or set formId instead.`);
-}
-function eventFormIds(eventData) {
-  const rawForms = Array.isArray(eventData.forms) ? eventData.forms : [];
-  return new Set(rawForms.map((form) => form && typeof form === "object" && !Array.isArray(form) ? safeString(form.id).trim() : "").filter(Boolean));
-}
-function cardHasImage(item) {
-  return Boolean(item.imageMasterUrl || item.imageUrl || item.imageVariants);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error(`Unsupported ${label} protocol "${url.protocol}": Telegram needs an absolute http(s) URL.`);
+  }
+  return trimmed;
 }
-var cardIdSchema = external_exports.string().regex(CARD_ID_PATTERN, "Use 1-80 characters: letters, numbers, underscore, or hyphen.").describe("Stable card id. Omit to generate one; keep it to preserve images and analytics continuity.");
-var cardItemInputSchema = external_exports.object({
-  id: cardIdSchema.optional(),
-  title: external_exports.string().max(MAX_CARD_TITLE_LENGTH).nullable().optional(),
-  text: external_exports.string().max(MAX_CARD_TEXT_LENGTH).nullable().optional(),
-  buttonLabel: external_exports.string().max(MAX_CARD_BUTTON_LABEL_LENGTH).nullable().optional(),
-  buttonUrl: external_exports.string().max(MAX_CARD_BUTTON_URL_LENGTH).nullable().optional(),
-  formId: cardIdSchema.nullable().optional()
-}).strict();
-var imageSourceSchema = external_exports.object({
-  path: external_exports.string().min(1).optional().describe("Local image path on the MCP client machine (inside OKO_IMAGE_ROOTS)."),
-  url: external_exports.string().url().optional().describe("Public HTTPS image URL. The OKO server fetches it first (works behind VPNs and proxies); if the server cannot reach it, the MCP client fetches it from this machine; if both fail, ask the organizer for a local file via path.")
-}).strict().refine((source) => Boolean(source.path) !== Boolean(source.url), {
-  message: "Provide exactly one image source: path or url."
-});
-function buildCardsItems({ inputs, existing, formIds }) {
-  const existingById = new Map(existing.map((item) => [item.id, item]));
-  const seen = /* @__PURE__ */ new Set();
-  const generatedCardIds = [];
-  const preservedImageCardIds = [];
-  const items = inputs.map((input) => {
-    const id = input.id ?? randomUUID2();
-    if (seen.has(id))
-      throw new Error(`Duplicate card id "${id}". Each card id must be unique.`);
-    seen.add(id);
-    if (!CARD_ID_PATTERN.test(id))
-      throw new Error(`Invalid card id "${id}". Use 1-80 characters: letters, numbers, underscore, or hyphen.`);
-    if (!input.id)
-      generatedCardIds.push(id);
-    const formId = normalizeNullableText(input.formId);
-    if (formId && !formIds.has(formId)) {
-      throw new Error(`Form ${formId} not found in event.forms. Create it with oko_configure_blocks forms first, or set formId:null.`);
+function compactAnalyticsSession(raw, options2) {
+  const session = serialize(raw);
+  const timeline = Array.isArray(session.timeline) ? session.timeline : null;
+  if (timeline) {
+    session.timelineBucketCount = timeline.length;
+    if (options2.includeTimeline) {
+      const page = timeline.slice(-options2.timelineLimit);
+      session.timeline = page;
+      session.timelineTruncated = timeline.length > page.length;
+      session.timelineReturned = page.length;
+    } else {
+      delete session.timeline;
+      session.timelineOmitted = true;
     }
-    const previous = existingById.get(id);
-    if (previous && cardHasImage(previous))
-      preservedImageCardIds.push(id);
-    return {
-      id,
-      title: normalizeNullableText(input.title),
-      text: normalizeNullableText(input.text),
-      buttonLabel: normalizeNullableText(input.buttonLabel),
-      buttonUrl: normalizeCardButtonUrl(input.buttonUrl),
-      imageUrl: previous?.imageUrl ?? null,
-      imageMasterUrl: previous?.imageMasterUrl ?? null,
-      imageVariants: previous?.imageVariants ?? null,
-      imageWidth: previous?.imageWidth ?? null,
-      imageHeight: previous?.imageHeight ?? null,
-      formId
-    };
-  });
-  return { items, generatedCardIds, preservedImageCardIds };
-}
-async function deleteStoragePaths(eventId, paths) {
-  const uniquePaths = [...new Set(paths.filter(Boolean))];
-  if (uniquePaths.length === 0)
-    return [];
-  const removeImages = httpsCallable(functions, "deleteMcpImages");
-  try {
-    const result = await removeImages({ eventId, paths: uniquePaths });
-    return Array.isArray(result.data.warnings) ? result.data.warnings : [];
-  } catch (error3) {
-    return [`storage cleanup failed: ${error3 instanceof Error ? error3.message : String(error3)}`];
   }
-}
-async function deleteStorageUrls(eventId, masterUrl, fallbackUrl) {
-  const paths = [];
-  const masterPath = storagePathFromDownloadUrl(masterUrl);
-  if (masterPath) {
-    paths.push(masterPath, ...variantPathsFromMasterPath(masterPath));
-  } else {
-    const fallbackPath = storagePathFromDownloadUrl(fallbackUrl);
-    if (fallbackPath)
-      paths.push(fallbackPath);
+  if (!options2.includeSnapshots) {
+    if (session.baselineSnapshot !== void 0) {
+      delete session.baselineSnapshot;
+      session.baselineSnapshotOmitted = true;
+    }
+    if (session.finalSnapshot !== void 0) {
+      delete session.finalSnapshot;
+      session.finalSnapshotOmitted = true;
+    }
   }
-  const warnings = await deleteStoragePaths(eventId, paths);
-  return { attempted: [...new Set(paths)].length, warnings };
+  for (const field2 of RETIRED_SESSION_FIELDS)
+    delete session[field2];
+  const warnings = sessionQualityWarnings(session.dataQuality);
+  if (warnings.length > 0)
+    session.dataQualityWarnings = warnings;
+  return session;
 }
-async function uploadMasterImage(eventId, kind, cardId, source) {
-  const uploadImage = httpsCallable(functions, "uploadMcpImage");
-  const result = await uploadImage({
-    eventId,
-    kind,
-    ...cardId ? { cardId } : {},
-    ...source.sourceUrl ? { sourceUrl: source.sourceUrl } : { imageBase64: source.imageBase64 }
-  });
-  return result.data;
+function numberMetric(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
-function imageReplacedSinceRead(fresh, expected) {
-  return fresh.imageMasterUrl !== expected.imageMasterUrl || fresh.imageUrl !== expected.imageUrl;
+function formatSeconds(value) {
+  const seconds = numberMetric(value);
+  if (seconds == null)
+    return "n/a";
+  const total = Math.max(0, Math.round(seconds));
+  const h = Math.floor(total / 3600);
+  const m = Math.floor(total % 3600 / 60);
+  const s = total % 60;
+  if (h > 0)
+    return `${h}h ${String(m).padStart(2, "0")}m ${String(s).padStart(2, "0")}s`;
+  return `${m}m ${String(s).padStart(2, "0")}s`;
 }
-async function clearEventImageInTransaction(eventId, kind, cardId, expected) {
-  const eventRef = doc(firestore, "events", eventId);
-  await runTransaction2(firestore, async (transaction) => {
-    const snap = await transaction.get(eventRef);
-    if (!snap.exists())
-      throw new Error("Event not found.");
-    const data = snap.data();
-    const fresh = readImageRef(data, kind, cardId);
-    if (imageReplacedSinceRead(fresh, expected)) {
-      throw new Error("The image changed between reading it and deleting it \u2014 someone replaced it in the meantime. Nothing was deleted and no file was removed. Read the event again and repeat the call if the new image should go too.");
-    }
-    if (kind === "card") {
-      transaction.update(eventRef, {
-        "blocks.cards.items": cardItemsWithImage(data, cardId, {
-          imageUrl: null,
-          imageMasterUrl: null,
-          imageVariants: null,
-          imageWidth: null,
-          imageHeight: null
-        })
-      });
-      return;
-    }
-    const prefix = kind === "promoBanner" ? "blocks.promoBanner" : "blocks.video.placeholder";
-    transaction.update(eventRef, {
-      [`${prefix}.imageMasterUrl`]: deleteField(),
-      [`${prefix}.imageUrl`]: deleteField(),
-      [`${prefix}.imageVariants`]: deleteField(),
-      [`${prefix}.imageWidth`]: deleteField(),
-      [`${prefix}.imageHeight`]: deleteField()
-    });
-  });
+function formatDateTime(value) {
+  const millis2 = toMillis(value);
+  if (millis2 == null)
+    return "n/a";
+  return new Date(millis2).toISOString();
 }
-function descendPath(root, segments) {
-  let current = root;
-  for (const segment of segments) {
-    if (current === null || typeof current !== "object")
-      return void 0;
-    current = current[segment];
-  }
-  return current;
+function markdownMetric(label, value, suffix = "") {
+  const metric = value === null || value === void 0 || value === "" ? "n/a" : String(value);
+  return `- ${label}: ${metric}${suffix}`;
 }
-function valueAfterPatch(fresh, patch, path) {
-  if (Object.prototype.hasOwnProperty.call(patch, path))
-    return patch[path];
-  const segments = path.split(".");
-  for (let cut = segments.length - 1; cut > 0; cut--) {
-    const ancestor = segments.slice(0, cut).join(".");
-    if (!Object.prototype.hasOwnProperty.call(patch, ancestor))
-      continue;
-    return descendPath(patch[ancestor], segments.slice(cut));
-  }
-  return descendPath(fresh, segments);
+function reportQualityCaveats(dataQuality) {
+  if (!dataQuality || typeof dataQuality !== "object" || Array.isArray(dataQuality))
+    return [];
+  const marks = dataQuality;
+  const caveats = [];
+  if (marks.baselineSource === "none")
+    caveats.push("baselineMissing");
+  if (marks.startedAtSource === "end_time")
+    caveats.push("startTimeUnknown");
+  if (marks.watchTime === "unavailable")
+    caveats.push("watchTimeUnmeasured");
+  if (marks.watchTime === "unknown_duration")
+    caveats.push("watchTimeUncapped");
+  return caveats;
 }
-function scheduleMissesDate(sessionMode, eventDate) {
-  return sessionMode === "schedule" && !eventDate;
+var REPORT_QUALITY_CAVEAT_TEXT = {
+  baselineMissing: "The session baseline was not saved: every figure below is counted from zero and includes everything the event accumulated before this broadcast.",
+  startTimeUnknown: "The broadcast start time was not saved: the report is stamped with the moment it ended and its duration reads zero.",
+  watchTimeUnmeasured: "Watch time was not measured: the engagement snapshot could not be read.",
+  watchTimeUncapped: "Watch time is not capped by the broadcast length \u2014 it is unknown, so nothing vouches for the total, average and median times."
+};
+function sessionQualityWarnings(dataQuality) {
+  return reportQualityCaveats(dataQuality).map((caveat) => REPORT_QUALITY_CAVEAT_TEXT[caveat]);
 }
-async function writeEventPatchWithCards(eventId, basePatch, buildItems, validate = null) {
-  const eventRef = doc(firestore, "events", eventId);
-  await runTransaction2(firestore, async (transaction) => {
-    const snap = await transaction.get(eventRef);
-    if (!snap.exists())
-      throw new Error("Event not found.");
-    const fresh = snap.data();
-    const patch = { ...basePatch };
-    if (buildItems) {
-      patch["blocks.cards.items"] = buildItems(fresh);
-    }
-    if (validate)
-      validate(fresh, patch);
-    if (Object.keys(patch).length === 0)
-      return;
-    transaction.update(eventRef, patch);
-  });
+function sessionReportMarkdown({ eventId, event, sessionId, session }) {
+  const lines = [
+    `# OKO session report`,
+    "",
+    `Event: ${safeString(event.title, eventId)}`,
+    `Event URL: ${eventUrl(eventId)}`,
+    `Report URL: ${sessionReportUrl(eventId, sessionId)}`,
+    `Session: ${sessionId}`,
+    "",
+    "## Timing",
+    markdownMetric("Started", formatDateTime(session.startedAt)),
+    markdownMetric("Ended", formatDateTime(session.endedAt)),
+    markdownMetric("Duration", formatSeconds(session.durationSec)),
+    "",
+    "## Audience",
+    markdownMetric("Peak viewers", session.peakViewers),
+    markdownMetric("Unique visitors", session.uniqueVisitors),
+    markdownMetric("Views", session.viewCount),
+    markdownMetric("Average watch time", formatSeconds(session.avgTimeSec)),
+    markdownMetric("Median watch time", formatSeconds(session.medianTimeSec)),
+    "",
+    "## Engagement",
+    markdownMetric("Chat messages", session.chatMessages),
+    markdownMetric("Banner impressions", session.bannerImpressions),
+    markdownMetric("Banner clicks", session.bannerClicks),
+    markdownMetric("Banner CTR", session.bannerCtr, session.bannerCtr == null ? "" : "%"),
+    markdownMetric("CTA clicks", session.ctaClicks),
+    markdownMetric("Cards clicks", session.cardsClicks)
+  ];
+  const warnings = sessionQualityWarnings(session.dataQuality);
+  if (warnings.length > 0) {
+    lines.push("", "## What this report did not measure");
+    for (const warning of warnings)
+      lines.push(`- ${warning}`);
+  }
+  return lines.join("\n");
 }
-function imageVariantReason(ref2) {
-  if (!ref2.imageMasterUrl && !ref2.imageUrl)
-    return "image_missing";
-  if (!ref2.imageMasterUrl)
-    return "master_missing";
-  if (!ref2.imageVariants)
-    return "variants_pending";
-  if (!ref2.imageUrl)
-    return "image_url_pending";
-  return null;
+var TELEGRAM_COPYABLE_KEYS = ["enabled", "channelIds", "autoReminder"];
+function copyableTelegram(source) {
+  const out = {};
+  for (const key of TELEGRAM_COPYABLE_KEYS) {
+    if (source[key] !== void 0)
+      out[key] = source[key];
+  }
+  return out;
 }
-function imageVariantStatus(eventId, eventData, kind, cardId, elapsedMs) {
-  const ref2 = readImageRef(eventData, kind, cardId ?? void 0);
-  const reason = imageVariantReason(ref2);
-  return {
-    eventId,
-    kind,
-    cardId,
-    imageId: ref2.imageId,
-    imageUrl: ref2.imageUrl,
-    imageMasterUrl: ref2.imageMasterUrl,
-    imageVariants: ref2.imageVariants,
-    ready: reason === null,
-    reason,
-    elapsedMs
-  };
+
+// build/tools/eventAccess.js
+var EVENT_ACCESS_FIELD_BY_MODE = {
+  read: "accessibleBy",
+  edit: "editors",
+  delete: "deleters",
+  live: "liveControllers",
+  session: "sessionManagers",
+  analytics: "analyticsViewers",
+  report: "reportDownloaders",
+  moderate: "chatModerators",
+  notify: "notificationSenders"
+};
+var EVENT_ACCESS_COMPOSITION_FIELDS = [
+  ...Object.values(EVENT_ACCESS_FIELD_BY_MODE),
+  "moderators",
+  "participantUids"
+];
+function isPlainRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function sleep(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+var LAST_SESSION_SUMMARY_QUALITY_UNKNOWN_WARNING = "Data quality for this last-session snapshot is unknown: it was saved before CF49 started stamping dataQuality here. Call oko_get_session_report for this session before quoting these numbers.";
+function lastSessionSummaryForOutput(value) {
+  if (!isPlainRecord(value))
+    return value;
+  const { dataQuality, ...rest } = value;
+  if (dataQuality === void 0) {
+    return { ...rest, dataQualityWarnings: [LAST_SESSION_SUMMARY_QUALITY_UNKNOWN_WARNING] };
+  }
+  const warnings = sessionQualityWarnings(dataQuality);
+  return warnings.length > 0 ? { ...rest, dataQuality, dataQualityWarnings: warnings } : { ...rest, dataQuality };
 }
-async function waitForImageVariantTargets(uid, eventId, targets, timeoutSec) {
-  const startedAt = Date.now();
-  const deadline = startedAt + timeoutSec * 1e3;
-  let latest;
-  while (true) {
-    const elapsedMs = Date.now() - startedAt;
-    const event = await readEvent(eventId, uid, "read");
-    latest = targets.map((target) => imageVariantStatus(eventId, event, target.kind, target.cardId, elapsedMs));
-    if (latest.every((item) => item.ready) || Date.now() >= deadline)
-      return latest;
-    await sleep(Math.min(2e3, Math.max(250, deadline - Date.now())));
+function eventDocumentForOutput(data) {
+  const projected = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (EVENT_ACCESS_COMPOSITION_FIELDS.includes(key))
+      continue;
+    projected[key] = value;
+  }
+  if (isPlainRecord(projected.analytics) && projected.analytics.lastSessionSummary !== void 0) {
+    projected.analytics = {
+      ...projected.analytics,
+      lastSessionSummary: lastSessionSummaryForOutput(projected.analytics.lastSessionSummary)
+    };
   }
+  return projected;
 }
-async function uploadEventImageForUser(uid, eventId, kind, cardId, source) {
-  if (kind === "card" && !cardId)
-    throw new Error("cardId is required when kind is card.");
-  if (kind !== "card" && cardId)
-    throw new Error("cardId is only valid when kind is card.");
-  const event = await readEvent(eventId, uid, "edit");
-  const previous = readImageRef(event, kind, cardId);
-  const eventBlocks = event.blocks && typeof event.blocks === "object" ? event.blocks : {};
-  const placeholderCfg = eventBlocks.video?.placeholder && typeof eventBlocks.video.placeholder === "object" ? eventBlocks.video.placeholder : {};
-  const blockEnabled = kind === "promoBanner" ? eventBlocks.promoBanner?.enabled === true : kind === "videoPlaceholder" ? placeholderCfg.enabled === true : readCardsConfig(event).enabled;
-  const enableInstruction = kind === "promoBanner" ? "oko_configure_blocks promoBanner.enabled=true" : kind === "videoPlaceholder" ? "oko_configure_blocks videoPlaceholder.enabled=true" : "oko_configure_cards enabled=true";
-  const uploadHints = [
-    blockEnabled ? `The ${kind} block is enabled: the new image appears on the page as soon as the variants are ready.` : `The ${kind} block is disabled in setup, so viewers will not see this image until it is enabled (${enableInstruction}). Uploading never enables a block by itself.`,
-    ...kind === "videoPlaceholder" && placeholderCfg.mode !== "image" ? ['The placeholder mode is not "image": set oko_configure_blocks videoPlaceholder.mode="image" for this picture to be used.'] : [],
-    ...kind === "videoPlaceholder" ? ['The placeholder is shown to viewers only while its live switch is on: oko_set_block_visibility block "placeholder" visible=true.'] : [],
-    IMAGE_ADVICE[kind]
-  ];
-  const previousMasterPath = storagePathFromDownloadUrl(previous.imageMasterUrl);
-  const deleteWarnings = [];
-  let deletesAttempted = 0;
-  const { uploaded, sourceBytes, sourceVia, notes: sourceNotes } = await uploadImageFromSource(eventId, kind, cardId, source);
-  if (!uploaded)
-    throw new Error("Image upload did not return a result.");
-  if (kind !== "card" || previousMasterPath && previousMasterPath !== uploaded.storagePath || !previous.imageMasterUrl && previous.imageUrl) {
-    const cleanup = await deleteStorageUrls(eventId, previous.imageMasterUrl, previous.imageUrl);
-    deletesAttempted += cleanup.attempted;
-    deleteWarnings.push(...cleanup.warnings);
+function grantAllowsMode(data, mode) {
+  const field2 = EVENT_ACCESS_FIELD_BY_MODE[mode];
+  return asRecord(data.capabilities)[field2] === true;
+}
+function legacyEventAllowsMode(data, uid, mode) {
+  if (data.ownerId === uid)
+    return true;
+  const fields = mode === "read" ? ["accessibleBy", "editors"] : [EVENT_ACCESS_FIELD_BY_MODE[mode]];
+  return fields.some((field2) => Array.isArray(data[field2]) && data[field2].includes(uid));
+}
+async function readEventAccess(eventId, uid, mode) {
+  const [snap, grant] = await Promise.all([
+    getDoc(doc(firestore, "events", eventId)),
+    getDoc(doc(firestore, "eventAccess", uid, "grants", eventId)).catch((error3) => {
+      if (!isFirestorePermissionDenied(error3))
+        throw error3;
+      return null;
+    })
+  ]);
+  const data = snap.data() ?? {};
+  const holds = (wanted) => grant === null ? legacyEventAllowsMode(data, uid, wanted) : data.ownerId === uid || grant.exists() && grantAllowsMode(grant.data(), wanted);
+  return { data, exists: snap.exists(), visible: holds("read"), allowed: holds(mode) };
+}
+async function eventGrantsMode(eventId, uid, mode) {
+  return (await readEventAccess(eventId, uid, mode)).allowed;
+}
+var EVENT_NOT_FOUND_MESSAGE = "Event not found.";
+async function readEvent(eventId, uid, mode = "read") {
+  const { data, exists, visible, allowed } = await readEventAccess(eventId, uid, mode);
+  if (!visible || !exists) {
+    throw new Error(EVENT_NOT_FOUND_MESSAGE);
   }
-  return {
-    eventId,
-    kind,
-    imageId: uploaded.imageId,
-    storagePath: uploaded.storagePath,
-    masterUrl: uploaded.masterUrl,
-    variantsPending: true,
-    sourceBytes,
-    sourceVia,
-    masterBytes: uploaded.masterBytes,
-    imageWidth: uploaded.imageWidth,
-    imageHeight: uploaded.imageHeight,
-    note: "Image master uploaded. CF generateImageVariants should publish thumb/card/hero variants and update imageUrl/imageVariants in about 10-30 seconds.",
-    storageDeletesAttempted: deletesAttempted,
-    storageDeleteWarnings: deleteWarnings,
-    hints: [...sourceNotes, ...uploadHints]
-  };
+  if (!allowed) {
+    throw new Error(`Event does not grant ${mode} access to this organizer.`);
+  }
+  if (data.trashedAt && mode !== "read" && mode !== "delete") {
+    throw new Error("Event is in trash. Restore it before making changes or live actions.");
+  }
+  return data;
 }
 
-// build/tools/schemas.js
-var boolOrNull = external_exports.boolean().nullable();
-var DEFAULT_LIST_LIMIT = 30;
-var MAX_LIST_LIMIT = 100;
-var MAX_EXPORT_LIMIT = 200;
-var ANALYTICS_DEFAULT_LIMIT = 10;
-var ANALYTICS_TIMELINE_DEFAULT_LIMIT = 120;
-var MAX_WORKSPACE_NAME_LENGTH = 120;
-var MAX_WORKSPACE_INVITE_CODE_LENGTH = 64;
-var TELEGRAM_POST_STATUSES = ["draft", "pending", "scheduled", "sent", "failed", "delivery_unknown"];
-var readOnlyTool = {
-  readOnlyHint: true,
-  destructiveHint: false,
-  idempotentHint: true,
-  openWorldHint: true
-};
-var writeTool = {
-  readOnlyHint: false,
-  destructiveHint: false,
-  idempotentHint: false,
-  openWorldHint: true
-};
-var idempotentWriteTool = {
-  readOnlyHint: false,
-  destructiveHint: false,
-  idempotentHint: true,
-  openWorldHint: true
-};
-var destructiveTool = {
-  readOnlyHint: false,
-  destructiveHint: true,
-  idempotentHint: false,
-  openWorldHint: true
-};
-var unknownRecordSchema = external_exports.record(external_exports.unknown());
-var basicEventOutputSchema = external_exports.object({
-  eventId: external_exports.string()
-}).passthrough();
-var updateOutputSchema = external_exports.object({
-  id: external_exports.string().optional(),
-  eventId: external_exports.string().optional(),
-  updated: external_exports.array(external_exports.string()).optional()
-}).passthrough();
-var eventLinksOutputShape = {
-  url: external_exports.string().url(),
-  setupUrl: external_exports.string().url(),
-  analyticsUrl: external_exports.string().url()
-};
-var createWebinarOutputSchema = external_exports.object({
-  id: external_exports.string(),
-  workspaceId: external_exports.string(),
-  sourceEventId: external_exports.string().optional(),
-  ...eventLinksOutputShape
-}).passthrough();
-var updateStatusSchema = external_exports.object({
-  current: external_exports.string(),
-  latest: external_exports.string().nullable(),
-  updateAvailable: external_exports.boolean(),
-  message: external_exports.string().optional(),
-  howTo: external_exports.array(external_exports.string()).optional()
-});
-var connectionStatusOutputSchema = external_exports.object({
-  connected: external_exports.boolean(),
-  status: external_exports.enum(OKO_CONNECTION_STATUSES),
-  errorCode: external_exports.string().nullable(),
-  message: external_exports.string(),
-  product: external_exports.object({
-    name: external_exports.string(),
-    summary: external_exports.string(),
-    videoBoundary: external_exports.string(),
-    accountRequirement: external_exports.string(),
-    accessModel: external_exports.string()
-  }),
-  organizerAccountRequired: external_exports.boolean(),
-  credentialConfigured: external_exports.boolean(),
-  links: external_exports.object({
-    website: external_exports.string().url(),
-    signIn: external_exports.string().url(),
-    installCenter: external_exports.string().url()
-  }),
-  nextSteps: external_exports.array(external_exports.object({
-    id: external_exports.string(),
-    label: external_exports.string(),
-    url: external_exports.string().url().optional(),
-    command: external_exports.string().optional()
-  })),
-  minimumVersion: external_exports.string().optional(),
-  update: updateStatusSchema.optional(),
-  uid: external_exports.string().optional(),
-  scopes: external_exports.array(external_exports.string()).optional()
-});
-var cursorMetaSchema = {
-  count: external_exports.number().int().nonnegative(),
-  limit: external_exports.number().int().positive(),
-  hasMore: external_exports.boolean(),
-  nextCursor: external_exports.string().nullable(),
-  has_more: external_exports.boolean(),
-  next_cursor: external_exports.string().nullable()
+// build/tools/imagePipeline.js
+var IMAGE_KINDS = ["promoBanner", "videoPlaceholder", "card"];
+var IMAGE_ADVICE = {
+  promoBanner: "Banner advice: a wide landscape image at least 1600 px wide (3:1 to 5:1 works best, for example 1600\xD7400); keep text inside the middle 80% so it survives mobile scaling; JPEG/PNG/WebP/AVIF up to 15 MB, stored as WebP with 320/800/1600 px variants.",
+  videoPlaceholder: "Placeholder advice: it covers the 16:9 video slot, so use a 16:9 image at least 1600\xD7900 px; avoid small text; JPEG/PNG/WebP/AVIF up to 15 MB, stored as WebP with 320/800/1600 px variants.",
+  card: "Card advice: match the cardImageRatio chosen in oko_configure_cards (1:1 is the safest), at least 800 px on the short side; JPEG/PNG/WebP/AVIF up to 15 MB, stored as WebP with 320/800/1600 px variants."
 };
-var workspacesOutputSchema = external_exports.object({
-  workspaces: external_exports.array(unknownRecordSchema),
-  count: external_exports.number().int().nonnegative()
-}).passthrough();
-var eventsOutputSchema = external_exports.object({
-  events: external_exports.array(unknownRecordSchema),
-  ...cursorMetaSchema
-}).passthrough();
-var eventOutputSchema = external_exports.object({
-  id: external_exports.string(),
-  ...eventLinksOutputShape
-}).passthrough();
-var liveStateOutputSchema = external_exports.object({
-  eventId: external_exports.string(),
-  agg: unknownRecordSchema,
-  ctrl: unknownRecordSchema,
-  chat: unknownRecordSchema
-}).passthrough();
-var analyticsOutputSchema = external_exports.object({
-  sessions: external_exports.array(unknownRecordSchema),
-  ...cursorMetaSchema
-}).passthrough();
-var chatOutputSchema = external_exports.object({
-  messages: external_exports.array(unknownRecordSchema),
-  ...cursorMetaSchema
-}).passthrough();
-var leadsOutputSchema = external_exports.object({
-  leads: external_exports.array(unknownRecordSchema).optional(),
-  csv: external_exports.string().optional(),
-  ...cursorMetaSchema
-}).passthrough();
-var imageOutputSchema = external_exports.object({
-  eventId: external_exports.string(),
-  kind: external_exports.enum(IMAGE_KINDS),
-  imageId: external_exports.string(),
-  storagePath: external_exports.string(),
-  masterUrl: external_exports.string().url(),
-  variantsPending: external_exports.boolean(),
-  sourceBytes: external_exports.number().int().nonnegative(),
-  sourceVia: external_exports.enum(["server", "client"]).optional(),
-  masterBytes: external_exports.number().int().nonnegative(),
-  imageWidth: external_exports.number().int().positive(),
-  imageHeight: external_exports.number().int().positive(),
-  note: external_exports.string()
-}).passthrough();
-var deleteImageOutputSchema = external_exports.object({
-  eventId: external_exports.string(),
-  kind: external_exports.enum(IMAGE_KINDS),
-  imageId: external_exports.string().nullable(),
-  deleted: external_exports.boolean(),
-  storageDeletesAttempted: external_exports.number().int().nonnegative(),
-  storageDeleteWarnings: external_exports.array(external_exports.string())
-}).passthrough();
-var imageVariantsOutputSchema = external_exports.object({
-  eventId: external_exports.string(),
-  kind: external_exports.enum(IMAGE_KINDS),
-  cardId: external_exports.string().nullable(),
-  imageId: external_exports.string().nullable(),
-  imageUrl: external_exports.string().url().nullable(),
-  imageMasterUrl: external_exports.string().url().nullable(),
-  imageVariants: unknownRecordSchema.nullable(),
-  ready: external_exports.boolean(),
-  reason: external_exports.string().nullable(),
-  elapsedMs: external_exports.number().int().nonnegative()
-}).passthrough();
-var cardImagesBatchOutputSchema = external_exports.object({
-  eventId: external_exports.string(),
-  uploads: external_exports.array(unknownRecordSchema),
-  variants: external_exports.array(unknownRecordSchema),
-  ready: external_exports.boolean(),
-  warnings: external_exports.array(external_exports.string())
-}).passthrough();
-var setupValidationOutputSchema = external_exports.object({
-  eventId: external_exports.string(),
-  ok: external_exports.boolean(),
-  score: external_exports.number().int().min(0).max(100),
-  errors: external_exports.array(unknownRecordSchema),
-  warnings: external_exports.array(unknownRecordSchema),
-  suggestions: external_exports.array(unknownRecordSchema),
-  nextActions: external_exports.array(external_exports.string()),
-  links: unknownRecordSchema
-}).passthrough();
-var workspaceAccessOutputSchema = external_exports.object({
-  workspaceId: external_exports.string(),
-  workspace: unknownRecordSchema,
-  members: external_exports.array(unknownRecordSchema),
-  invites: external_exports.array(unknownRecordSchema)
-}).passthrough();
-var telegramChannelsOutputSchema = external_exports.object({
-  channels: external_exports.array(canonicalTelegramChannelSchema),
-  count: external_exports.number().int().nonnegative()
-}).passthrough();
-var telegramPostsOutputSchema = external_exports.object({
-  posts: external_exports.array(unknownRecordSchema),
-  ...cursorMetaSchema
-}).passthrough();
-var sessionReportOutputSchema = external_exports.object({
-  eventId: external_exports.string(),
-  sessionId: external_exports.string(),
-  reportUrl: external_exports.string().url(),
-  markdown: external_exports.string(),
-  session: unknownRecordSchema
-}).passthrough();
-var profileOutputSchema = external_exports.object({
-  uid: external_exports.string(),
-  profile: unknownRecordSchema,
-  updated: external_exports.array(external_exports.string())
-}).passthrough();
-var deleteLeadOutputSchema = external_exports.object({
-  eventId: external_exports.string(),
-  leadId: external_exports.string(),
-  deleted: external_exports.boolean()
-}).passthrough();
-var notificationsOutputSchema = external_exports.object({
-  notifications: external_exports.array(unknownRecordSchema),
-  unreadCountOnPage: external_exports.number().int().nonnegative(),
-  ...cursorMetaSchema
-}).passthrough();
-var notificationsMarkOutputSchema = external_exports.object({
-  markedRead: external_exports.number().int().nonnegative(),
-  notificationIds: external_exports.array(external_exports.string())
-}).passthrough();
-var FORM_FIELD_TYPES = ["text", "tel", "email", "textarea", "select", "checkbox"];
-var formFieldSchema = external_exports.object({
-  id: external_exports.string().min(1).optional(),
-  label: external_exports.string().max(120),
-  type: external_exports.enum(FORM_FIELD_TYPES).default("text").describe("text | tel | email | textarea answer with free text; select (one answer) and checkbox (several) answer with one of `options`."),
-  required: external_exports.boolean().default(false),
-  placeholder: external_exports.string().max(160).nullable().optional(),
-  options: external_exports.array(external_exports.string().trim().min(1).max(80)).max(20).optional().describe("Choices of a select or checkbox field: 1\u201320 unique option texts. The lead stores the option text itself \u2014 a string for select, an array of strings for checkbox.")
-}).strict().superRefine((field2, ctx) => {
-  const choice = field2.type === "select" || field2.type === "checkbox";
-  const count = new Set(field2.options ?? []).size;
-  if (choice && count === 0) {
-    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["options"], message: `A ${field2.type} field needs at least one option.` });
+var IMAGE_VARIANT_NAMES = ["thumb_320.webp", "card_800.webp", "hero_1600.webp"];
+var CARD_IMAGE_RATIOS = ["auto", "1:1", "4:3", "3:2", "16:9", "2:3", "3:4"];
+var CARD_ID_PATTERN = /^[A-Za-z0-9_-]{1,80}$/;
+var MAX_CARD_ITEMS = 6;
+var MAX_CARD_TITLE_LENGTH = 160;
+var MAX_CARD_TEXT_LENGTH = 500;
+var MAX_CARD_BUTTON_LABEL_LENGTH = 80;
+var MAX_CARD_BUTTON_URL_LENGTH = 1e3;
+var MAX_SOURCE_IMAGE_BYTES = 15 * 1024 * 1024;
+var REMOTE_IMAGE_TIMEOUT_MS = 15e3;
+var REMOTE_IMAGE_TOTAL_TIMEOUT_MS = 4e4;
+var REMOTE_IMAGE_MAX_REDIRECTS = 3;
+function remoteImageHopBudget(deadlineAt, now, perHopMs) {
+  const left = deadlineAt - now;
+  if (left <= 0)
+    return { kind: "exhausted" };
+  if (left < perHopMs)
+    return { kind: "budget", ms: left, capped: true };
+  return { kind: "budget", ms: perHopMs, capped: false };
+}
+var ALLOWED_REMOTE_IMAGE_TYPES = /* @__PURE__ */ new Set(["image/jpeg", "image/jpg", "image/png", "image/webp", "image/gif", "image/avif"]);
+function storagePathFromDownloadUrl(downloadUrl) {
+  if (!downloadUrl)
+    return null;
+  const match = downloadUrl.match(/\/o\/([^?]+)/);
+  if (!match)
+    return null;
+  const encodedPath = match[1];
+  if (!encodedPath)
+    return null;
+  try {
+    return decodeURIComponent(encodedPath);
+  } catch {
+    return null;
+  }
+}
+function variantPathsFromMasterPath(masterPath) {
+  if (!masterPath.endsWith("/master.webp"))
+    return [];
+  return IMAGE_VARIANT_NAMES.map((name7) => masterPath.replace(/master\.webp$/, name7));
+}
+function resolveLocalImagePath(inputPath) {
+  const expanded = inputPath === "~" || inputPath.startsWith("~/") ? join2(homedir2(), inputPath.slice(2)) : inputPath;
+  return isAbsolute2(expanded) ? resolve2(expanded) : resolve2(process.cwd(), expanded);
+}
+function isBlockedHostname(hostname2) {
+  const host = hostname2.toLowerCase();
+  return host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local");
+}
+function nonPublicResolutionMessage(hostname2, addresses) {
+  const list = addresses.length ? addresses.join(", ") : "no address";
+  const fakeIp = addresses.some((address) => /^198\.1[89]\./.test(address));
+  const environmentHint = fakeIp ? "Addresses in 198.18.0.0/15 mean a VPN or proxy with DNS interception (fake-IP mode) is active on this machine: every public host resolves there, so no remote URL can be verified." : "If other public hosts resolve to private addresses too, a VPN or proxy with DNS interception is active on this machine.";
+  return `Image URL resolves to a non-public IP address (${hostname2} \u2192 ${list}), which is not allowed. ${environmentHint} Workarounds: upload the file from disk via source.path (allowed directories come from OKO_IMAGE_ROOTS; the organizer can download the image first), or disable the VPN/proxy for this upload.`;
+}
+async function resolveRemoteImageAddress(url) {
+  if (url.protocol !== "https:") {
+    throw new Error("Image URL must use https://.");
+  }
+  if (url.username || url.password) {
+    throw new Error("Image URL must not include embedded credentials.");
+  }
+  if (isBlockedHostname(url.hostname)) {
+    throw new Error(`Image URL host "${url.hostname}" is not allowed (local names are blocked). Use a public HTTPS image URL, or upload the file from disk via source.path (requires OKO_IMAGE_ROOTS).`);
+  }
+  const literalAddress = normalizeIpLiteralHostname(url.hostname);
+  const literalFamily = ipLiteralFamily(literalAddress);
+  if (literalFamily !== 0) {
+    if (!isPublicUnicastAddress(literalAddress)) {
+      throw new Error(`Image URL points to a private/local IP address (${literalAddress}), which is not allowed. Use a public HTTPS image URL, or upload the file from disk via source.path (requires OKO_IMAGE_ROOTS).`);
+    }
+    return { addresses: [{ address: literalAddress, family: literalFamily }], transparentProxy: false };
+  }
+  const addresses = await lookup(url.hostname, { all: true });
+  const transparentProxy = addresses.length > 0 && addresses.every((item) => isTransparentProxyAddress(item.address));
+  if (!transparentProxy && (addresses.length === 0 || addresses.some((item) => !isPublicUnicastAddress(item.address)))) {
+    throw new Error(nonPublicResolutionMessage(url.hostname, addresses.map((item) => item.address)));
   }
-  if (!choice && field2.options !== void 0) {
-    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["options"], message: `options belong to select or checkbox fields only; this field is ${field2.type}.` });
+  const candidates = orderAddressCandidates(addresses);
+  if (candidates.length === 0) {
+    throw new Error("Image URL host could not be resolved safely.");
   }
-});
-var formSchema = external_exports.object({
-  id: external_exports.string().min(1).optional(),
-  title: external_exports.string().max(160).nullable().optional(),
-  description: external_exports.string().max(1e3).nullable().optional(),
-  submitLabel: external_exports.string().max(80).nullable().optional(),
-  successText: external_exports.string().max(500).nullable().optional(),
-  consentText: external_exports.string().max(500).nullable().optional(),
-  consentRequired: external_exports.boolean().default(true),
-  fields: external_exports.array(formFieldSchema).max(30)
-}).strict();
-var profileDisplayNameSchema = external_exports.string().max(40).nullable();
-var timezoneSchema = external_exports.string().min(1).max(100).regex(/^[A-Za-z0-9_+./-]+$/, "Use an IANA timezone such as Europe/Moscow or UTC.").refine((value) => {
+  return { addresses: candidates, transparentProxy };
+}
+async function responseBufferWithLimit(response, maxBytes) {
+  const body = response.body;
+  if (!body) {
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (bytes.byteLength > maxBytes)
+      throw new Error(`Image exceeds ${Math.floor(maxBytes / 1024 / 1024)}MB limit.`);
+    return bytes;
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let total = 0;
   try {
-    new Intl.DateTimeFormat("en-CA", { timeZone: value });
-    return true;
-  } catch {
-    return false;
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      const chunk = Buffer.from(value);
+      total += chunk.byteLength;
+      if (total > maxBytes) {
+        throw new Error(`Image exceeds ${Math.floor(maxBytes / 1024 / 1024)}MB limit.`);
+      }
+      chunks.push(chunk);
+    }
+  } finally {
+    reader.releaseLock();
   }
-}, "Unknown IANA timezone: use a value such as Europe/Moscow, America/New_York or UTC.");
-var cardsConfigOutputSchema = external_exports.object({
-  eventId: external_exports.string(),
-  updated: external_exports.array(external_exports.string()),
-  cards: external_exports.object({
-    enabled: external_exports.boolean(),
-    visibility: external_exports.enum(["always", "hidden"]),
-    cardImageRatio: external_exports.enum(CARD_IMAGE_RATIOS),
-    items: external_exports.array(unknownRecordSchema)
-  }).passthrough(),
-  generatedCardIds: external_exports.array(external_exports.string()),
-  removedCardIds: external_exports.array(external_exports.string()),
-  removedCardsWithImages: external_exports.array(external_exports.string()),
-  preservedImageCardIds: external_exports.array(external_exports.string()),
-  warnings: external_exports.array(external_exports.string())
-}).passthrough();
-var workspacePermissionsSchema = external_exports.object({
-  createEvents: external_exports.boolean(),
-  editSetup: external_exports.boolean(),
-  deleteEvents: external_exports.boolean(),
-  controlLive: external_exports.boolean(),
-  moderateChat: external_exports.boolean(),
-  startSession: external_exports.boolean(),
-  viewAnalytics: external_exports.boolean(),
-  downloadReports: external_exports.boolean(),
-  sendNotifications: external_exports.boolean()
-}).strict();
-var WORKSPACE_PERMISSION_KEYS = [
-  "createEvents",
-  "editSetup",
-  "deleteEvents",
-  "controlLive",
-  "moderateChat",
-  "startSession",
-  "viewAnalytics",
-  "downloadReports",
-  "sendNotifications"
-];
-var eventIdField = external_exports.string().min(1).describe("OKO event document id, for example KJsAku48821hB4PXTW0S.");
-var limitField = (max = MAX_LIST_LIMIT, defaultValue = DEFAULT_LIST_LIMIT) => external_exports.number().int().min(1).max(max).default(defaultValue).describe(`Maximum items to return, 1-${max}.`);
-var cursorField = external_exports.string().min(1).optional().describe("Cursor returned as nextCursor by the previous page.");
-function toolDescription({ summary, args = [], returns, examples = [], notes = [], exampleCall }) {
-  return [
-    summary,
-    args.length ? `Args:
-${args.map((item) => `- ${item}`).join("\n")}` : "",
-    `Returns:
-- ${returns}`,
-    exampleCall ? `Example call (arguments JSON):
-${JSON.stringify(exampleCall)}` : "",
-    examples.length ? `Examples:
-${examples.map((item) => `- ${item}`).join("\n")}` : "",
-    notes.length ? `Notes:
-${notes.map((item) => `- ${item}`).join("\n")}` : ""
-  ].filter(Boolean).join("\n\n");
+  return Buffer.concat(chunks, total);
 }
-
-// build/tools/account.js
-var SCOPE_UNLOCKS = {
-  "events:read": "reading events, setup, and validation",
-  "events:write": "creating, editing, duplicating events and configuring blocks",
-  "events:delete": "moving events to trash and deleting them permanently",
-  "setup:write": "image uploads and setup-only changes",
-  "analytics:read": "analytics, sessions, and reports",
-  "analytics:write": "starting, ending, and repairing analytics sessions",
-  "live:control": "live block visibility, live badge, viewer refresh",
-  "chat:write": "sending organizer chat messages",
-  "chat:moderate": "chat mode, moderation, bans and mutes",
-  "telegram:write": "claiming channels and publishing Telegram posts",
-  "workspace:read": "listing workspaces, members, invites, notifications",
-  "workspace:write": "workspace management, invites, profile edits",
-  "leads:read": "reading and exporting leads"
-};
-function presetsWithScope(scope) {
-  return Object.entries(MCP_PRESETS).filter(([, scopes]) => scopes.includes(scope)).map(([name7]) => name7);
+function shareLinkHint(url) {
+  let host = "";
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return "";
+  }
+  if (host === "drive.google.com" || host === "docs.google.com") {
+    return " This is a Google Drive page, not the file: share it as 'anyone with the link' and use https://drive.google.com/uc?export=download&id=<fileId>, or download the file and pass source.path.";
+  }
+  if (host.endsWith("disk.yandex.ru") || host.endsWith("disk.yandex.com") || host === "yadi.sk" || host.endsWith("disk.360.yandex.ru")) {
+    return " This is a Yandex Disk page, not the file: use the direct download link from the page (\u0421\u043A\u0430\u0447\u0430\u0442\u044C \u2192 copy link), or download the file and pass source.path.";
+  }
+  if (host === "dropbox.com" || host.endsWith(".dropbox.com")) {
+    return " This is a Dropbox page: replace ?dl=0 with ?dl=1 in the link, or download the file and pass source.path.";
+  }
+  if (host.endsWith("onedrive.live.com") || host === "1drv.ms" || host.endsWith("sharepoint.com")) {
+    return " This is a OneDrive page: use its direct download link, or download the file and pass source.path.";
+  }
+  return " Use a direct link to the image file (right-click the image \u2192 copy image address), or download the file and pass source.path.";
 }
-function registerAccountTools(server2) {
-  server2.registerTool("oko_connection_status", {
-    title: "Check OKO connection",
-    description: toolDescription({
-      summary: "Check whether this MCP process is connected to an active OKO organizer account.",
-      returns: "A factual connection status, product boundary, and setup links. This tool works without OKO_API_KEY and never changes data.",
-      examples: [
-        "Use when an OKO request is made and the organizer connection state is unknown.",
-        "Use after installing the package without a key to explain the exact next setup step."
-      ],
-      notes: ["This tool does not create accounts, invitations, or API keys."]
-    }),
-    outputSchema: connectionStatusOutputSchema,
-    annotations: readOnlyTool
-  }, async () => textResult(await getConnectionStatus()));
-  server2.registerTool("oko_whoami", {
-    title: "Who am I",
-    description: toolDescription({
-      summary: "Return the authenticated OKO organizer uid, granted MCP scopes, missing scopes, and the client update status.",
-      returns: "uid, scopes granted by OKO API key exchange, missingScopes with the tools they unlock, and update (current vs latest published client version). Use this before write workflows to check permissions.",
-      examples: ['Use when starting a session: call first, then choose tools allowed by "scopes". If update.updateAvailable is true, tell the organizer how to update before continuing.']
-    }),
-    outputSchema: {
-      uid: external_exports.string(),
-      scopes: external_exports.array(external_exports.string()),
-      missingScopes: external_exports.array(external_exports.object({ scope: external_exports.string(), unlocks: external_exports.string(), presets: external_exports.array(external_exports.string()) })),
-      update: updateStatusSchema
-    },
-    annotations: readOnlyTool
-  }, async () => {
-    const auth2 = await authed([]);
-    const scopes = currentScopes();
-    return textResult({
-      uid: auth2.uid,
-      scopes,
-      missingScopes: MCP_SCOPES.filter((scope) => !scopes.includes(scope)).map((scope) => ({
-        scope,
-        unlocks: SCOPE_UNLOCKS[scope] ?? "",
-        presets: presetsWithScope(scope)
-      })),
-      update: updateStatus()
-    });
-  });
-  server2.registerTool("oko_update_profile", {
-    title: "Update profile",
-    description: toolDescription({
-      summary: "Update the authenticated organizer profile fields used by OKO UI.",
-      args: [
-        "displayName: optional display name, max 40 chars; null clears it.",
-        "timezone: optional IANA timezone such as Europe/Moscow or UTC."
-      ],
-      returns: "uid, updated field names, and the resulting profile snapshot.",
-      examples: ["Use when the organizer asks to change their visible OKO name or timezone."],
-      notes: ["Edits the organizer profile that owns this key. Requires workspace:write: the key holder is not necessarily the organizer, so a read-only key must not rewrite the owner's name, avatar or timezone."]
-    }),
-    inputSchema: {
-      displayName: profileDisplayNameSchema.optional().describe("Display name, max 40 chars. Null clears it."),
-      timezone: timezoneSchema.optional().describe("IANA timezone, for example Europe/Moscow or UTC.")
-    },
-    outputSchema: profileOutputSchema,
-    annotations: idempotentWriteTool
-  }, async ({ displayName, timezone }) => {
-    const { uid } = await authed(["workspace:write"]);
-    const patch = { updatedAt: serverTimestamp2() };
-    if (displayName !== void 0)
-      patch.displayName = displayName?.trim() || null;
-    if (timezone !== void 0)
-      patch.timezone = timezone.trim();
-    const updated = Object.keys(patch).filter((key) => key !== "updatedAt");
-    if (updated.length === 0)
-      throw new Error("Provide displayName and/or timezone.");
-    const profileRef = doc(firestore, "userProfiles", uid);
-    await setDoc(profileRef, patch, { merge: true });
-    const profileSnap = await getDoc(profileRef);
-    return textResult({ uid, updated, profile: profileSnap.exists() ? serialize(profileSnap.data()) : {} });
-  });
+async function readRemoteImage(rawUrl, redirects = 0, notes = [], deadlineAt = Date.now() + REMOTE_IMAGE_TOTAL_TIMEOUT_MS) {
+  if (redirects > REMOTE_IMAGE_MAX_REDIRECTS) {
+    throw new Error("Image URL has too many redirects.");
+  }
+  const url = new URL(rawUrl);
+  const pinned = await resolveRemoteImageAddress(url);
+  if (pinned.transparentProxy && redirects === 0) {
+    notes.push(`Image fetched through a VPN/proxy with DNS interception: ${url.hostname} resolved to ${pinned.addresses[0]?.address}, so OKO could not verify the destination address itself; the connection went through the proxy. This is expected on such machines and fine for public image links.`);
+  }
+  let lastConnectError = null;
+  for (const candidate of pinned.addresses) {
+    const attempt = await readRemoteImageFrom(url, rawUrl, candidate, redirects, deadlineAt);
+    if ("buffer" in attempt)
+      return attempt.buffer;
+    if ("redirectTo" in attempt)
+      return readRemoteImage(attempt.redirectTo, redirects + 1, notes, deadlineAt);
+    lastConnectError = attempt.connectError;
+  }
+  throw new Error(`Image URL host ${url.hostname} could not be reached at any of its addresses (${pinned.addresses.map((item) => item.address).join(", ")}): ${lastConnectError?.message ?? "connection failed"}.`);
 }
-
-// build/videoUrl.js
-var TWITCH_PARENT = "okostream.app";
-function extractIframeSrc(input) {
-  const trimmed = input.trim();
-  if (!trimmed.startsWith("<iframe"))
-    return null;
-  const match = trimmed.match(/\bsrc=["']([^"']+)["']/i);
-  return match?.[1] ?? null;
+function totalBudgetMessage() {
+  return `Image URL did not finish loading within ${REMOTE_IMAGE_TOTAL_TIMEOUT_MS / 1e3} seconds, including redirects.`;
 }
-var YT_ID_RE = /^[\w-]{11}$/;
-function extractYouTubeId(url) {
-  let parsed;
+async function readRemoteImageFrom(url, rawUrl, candidate, redirects, deadlineAt) {
+  const budget = remoteImageHopBudget(deadlineAt, Date.now(), REMOTE_IMAGE_TIMEOUT_MS);
+  if (budget.kind === "exhausted") {
+    throw new Error(totalBudgetMessage());
+  }
+  const dispatcher = new import_undici.Agent({
+    connect: { lookup: pinnedLookup(candidate.address, candidate.family) }
+  });
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), budget.ms);
   try {
-    parsed = new URL(url);
-  } catch {
-    return null;
+    let response;
+    try {
+      response = await (0, import_undici.fetch)(url, {
+        redirect: "manual",
+        signal: controller.signal,
+        headers: { accept: "image/avif,image/webp,image/png,image/jpeg,image/gif" },
+        dispatcher
+      });
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new Error(budget.capped ? totalBudgetMessage() : `Image URL did not respond within ${REMOTE_IMAGE_TIMEOUT_MS / 1e3} seconds.`);
+      }
+      return { connectError: err instanceof Error ? err : new Error(String(err)) };
+    }
+    if (response.status >= 300 && response.status < 400) {
+      const location2 = response.headers.get("location");
+      if (!location2)
+        throw new Error(`Image URL redirected with HTTP ${response.status} but no Location header.`);
+      return { redirectTo: new URL(location2, url).toString() };
+    }
+    if (!response.ok) {
+      throw new Error(`Image URL fetch failed with HTTP ${response.status}.`);
+    }
+    const contentType = (response.headers.get("content-type") ?? "").split(";")[0]?.trim().toLowerCase();
+    if (!contentType || !contentType.startsWith("image/")) {
+      throw new Error(`Image URL must return Content-Type image/* (got ${contentType || "none"}).${shareLinkHint(rawUrl)}`);
+    }
+    if (!ALLOWED_REMOTE_IMAGE_TYPES.has(contentType)) {
+      throw new Error(`Image URL Content-Type ${contentType} is not supported. Use JPEG, PNG, WEBP, GIF, or AVIF.`);
+    }
+    const contentLength = Number(response.headers.get("content-length") ?? 0);
+    if (Number.isFinite(contentLength) && contentLength > MAX_SOURCE_IMAGE_BYTES) {
+      throw new Error("Image URL is larger than 15MB.");
+    }
+    return { buffer: await responseBufferWithLimit(response, MAX_SOURCE_IMAGE_BYTES) };
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error("Image URL fetch timed out.");
+    }
+    throw err;
+  } finally {
+    clearTimeout(timeout);
+    await dispatcher.destroy();
   }
-  const host = parsed.hostname.replace(/^www\./, "");
-  if (host === "youtu.be") {
-    const id = parsed.pathname.slice(1).split("/")[0] ?? "";
-    return YT_ID_RE.test(id) ? id : null;
+}
+async function readLocalImage(inputPath) {
+  if (env.imageRoots.length === 0) {
+    throw new Error("Local image reads are disabled. Set OKO_IMAGE_ROOTS to an explicit trusted directory and restart the MCP client.");
   }
-  if (host !== "youtube.com" && host !== "m.youtube.com")
+  const filePath = await realpath(resolveLocalImagePath(inputPath));
+  const roots = await Promise.all(env.imageRoots.map(async (root) => {
+    try {
+      return await realpath(root);
+    } catch {
+      return resolve2(root);
+    }
+  }));
+  const allowed = roots.some((root) => {
+    const child2 = relative(root, filePath);
+    return child2 === "" || !child2.startsWith(`..${sep}`) && child2 !== ".." && !isAbsolute2(child2);
+  });
+  if (!allowed) {
+    throw new Error("Image path is outside OKO_IMAGE_ROOTS. Add a trusted root to the MCP client environment.");
+  }
+  const info = await stat(filePath);
+  if (!info.isFile())
+    throw new Error("Image path must point to a regular file.");
+  if (info.size > MAX_SOURCE_IMAGE_BYTES)
+    throw new Error("Image file is larger than 15MB.");
+  return readFile(filePath);
+}
+function serverFetchRefusal(error3) {
+  if (!error3 || typeof error3 !== "object")
     return null;
-  const path = parsed.pathname;
-  if (path.startsWith("/embed/")) {
-    const id = path.slice(7).split("/")[0] ?? "";
-    return YT_ID_RE.test(id) ? id : null;
+  const details = error3.details;
+  if (details && typeof details === "object" && details.code === "REMOTE_FETCH_FAILED") {
+    const record3 = details;
+    const fallbackMessage = String(error3.message ?? "the server could not fetch the URL");
+    return {
+      reason: typeof record3.reason === "string" ? record3.reason : "unknown",
+      message: typeof record3.message === "string" ? record3.message : fallbackMessage
+    };
   }
-  if (path.startsWith("/shorts/")) {
-    const id = path.slice(8).split("/")[0] ?? "";
-    return YT_ID_RE.test(id) ? id : null;
+  const code = error3.code;
+  const message = String(error3.message ?? "");
+  if (code === "functions/invalid-argument" && message.includes("Image payload is empty or too large")) {
+    return { reason: "server_without_url_support", message: "The OKO server release in use does not fetch URLs yet." };
   }
-  if (path.startsWith("/live/")) {
-    const id = path.slice(6).split("/")[0] ?? "";
-    return YT_ID_RE.test(id) ? id : null;
+  if (code === "functions/deadline-exceeded") {
+    return { reason: "server_timeout", message: "The OKO server did not finish fetching the URL within its time limit." };
   }
-  if (path === "/watch") {
-    const id = parsed.searchParams.get("v") ?? "";
-    return YT_ID_RE.test(id) ? id : null;
+  if (code === "functions/internal") {
+    return { reason: "server_error", message: message && message !== "internal" ? message : "The OKO server failed while fetching the URL." };
   }
   return null;
 }
-function hostOf(url) {
+var SERVER_FETCH_NOTE = "Image fetched by the OKO server directly from the URL; this machine's network was not involved.";
+function localFallbackNote(serverFailure) {
+  return `The OKO server could not fetch the URL (${serverFailure.reason}: ${serverFailure.message}), so the image was fetched from this machine instead.`;
+}
+function remoteImageUnavailableMessage(url, serverFailure, localError) {
+  const localMessage = localError instanceof Error ? localError.message : String(localError);
+  return `Image URL could not be fetched by the OKO server or from this machine. Server (${serverFailure.reason}): ${serverFailure.message} This machine: ${localMessage} Ask the organizer to download the image and pass its path via source.path (allowed directories come from OKO_IMAGE_ROOTS), or to share a public HTTPS link that returns the image file directly. URL: ${url}`;
+}
+async function uploadImageFromSource(eventId, kind, cardId, source) {
+  if (source.path) {
+    const buffer2 = await readLocalImage(source.path);
+    const uploaded2 = await uploadMasterImage(eventId, kind, cardId, { imageBase64: buffer2.toString("base64") });
+    return { uploaded: uploaded2, sourceBytes: buffer2.byteLength, sourceVia: "client", notes: [] };
+  }
+  if (!source.url)
+    throw new Error("Provide image source path or url.");
+  let serverFailure;
   try {
-    return new URL(url).hostname.replace(/^www\./, "").replace(/^m\./, "");
-  } catch {
+    const uploaded2 = await uploadMasterImage(eventId, kind, cardId, { sourceUrl: source.url });
+    return { uploaded: uploaded2, sourceBytes: uploaded2.sourceBytes ?? 0, sourceVia: "server", notes: [SERVER_FETCH_NOTE] };
+  } catch (error3) {
+    const refusal3 = serverFetchRefusal(error3);
+    if (!refusal3)
+      throw error3;
+    serverFailure = refusal3;
+  }
+  let buffer;
+  const fetchNotes = [];
+  try {
+    buffer = await readRemoteImage(source.url, 0, fetchNotes);
+  } catch (localError) {
+    throw new Error(remoteImageUnavailableMessage(source.url, serverFailure, localError));
+  }
+  const uploaded = await uploadMasterImage(eventId, kind, cardId, { imageBase64: buffer.toString("base64") });
+  return {
+    uploaded,
+    sourceBytes: buffer.byteLength,
+    sourceVia: "client",
+    notes: [localFallbackNote(serverFailure), ...fetchNotes]
+  };
+}
+function readImageRef(eventData, kind, cardId) {
+  const blocks = eventData.blocks && typeof eventData.blocks === "object" ? eventData.blocks : {};
+  if (kind === "promoBanner") {
+    const banner = blocks.promoBanner && typeof blocks.promoBanner === "object" ? blocks.promoBanner : {};
+    return {
+      imageId: storagePathFromDownloadUrl(safeString(banner.imageMasterUrl))?.split("/").at(-2) ?? null,
+      imageUrl: safeString(banner.imageUrl) || null,
+      imageMasterUrl: safeString(banner.imageMasterUrl) || null,
+      imageVariants: readImageVariants(banner.imageVariants)
+    };
+  }
+  if (kind === "videoPlaceholder") {
+    const video = blocks.video && typeof blocks.video === "object" ? blocks.video : {};
+    const placeholder = video.placeholder && typeof video.placeholder === "object" ? video.placeholder : {};
+    return {
+      imageId: storagePathFromDownloadUrl(safeString(placeholder.imageMasterUrl))?.split("/").at(-2) ?? null,
+      imageUrl: safeString(placeholder.imageUrl) || null,
+      imageMasterUrl: safeString(placeholder.imageMasterUrl) || null,
+      imageVariants: readImageVariants(placeholder.imageVariants)
+    };
+  }
+  if (!cardId)
+    throw new Error("cardId is required when kind is card.");
+  const cards = blocks.cards && typeof blocks.cards === "object" ? blocks.cards : {};
+  const items = Array.isArray(cards.items) ? cards.items : [];
+  const item = items.find((raw) => Boolean(raw) && typeof raw === "object" && raw.id === cardId);
+  if (!item)
+    throw new Error(`Card ${cardId} not found in blocks.cards.items. Create/configure the card before uploading its image.`);
+  return {
+    imageId: cardId,
+    imageUrl: safeString(item.imageUrl) || null,
+    imageMasterUrl: safeString(item.imageMasterUrl) || null,
+    imageVariants: readImageVariants(item.imageVariants)
+  };
+}
+function cardItemsWithImage(eventData, cardId, patch) {
+  const blocks = eventData.blocks && typeof eventData.blocks === "object" ? eventData.blocks : {};
+  const cards = blocks.cards && typeof blocks.cards === "object" ? blocks.cards : {};
+  const items = Array.isArray(cards.items) ? cards.items : [];
+  let found = false;
+  const next = items.map((raw) => {
+    const item = raw && typeof raw === "object" ? raw : {};
+    if (item.id !== cardId)
+      return item;
+    found = true;
+    return { ...item, ...patch };
+  });
+  if (!found)
+    throw new Error(`Card ${cardId} not found in blocks.cards.items.`);
+  return next;
+}
+function readImageVariants(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const data = value;
+  if (typeof data.thumbUrl !== "string" || typeof data.cardUrl !== "string" || typeof data.heroUrl !== "string") {
     return null;
   }
+  return {
+    thumbUrl: data.thumbUrl,
+    cardUrl: data.cardUrl,
+    heroUrl: data.heroUrl
+  };
+}
+function readCardsConfig(eventData) {
+  const blocks = eventData.blocks && typeof eventData.blocks === "object" ? eventData.blocks : {};
+  const raw = blocks.cards && typeof blocks.cards === "object" ? blocks.cards : {};
+  const rawItems = Array.isArray(raw.items) ? raw.items : [];
+  const repairedIdPositions = [];
+  const items = rawItems.map((item, position) => ({ item, position })).filter((entry) => Boolean(entry.item) && typeof entry.item === "object" && !Array.isArray(entry.item)).map(({ item, position }) => {
+    const hasUsableId = typeof item.id === "string" && CARD_ID_PATTERN.test(item.id);
+    if (!hasUsableId)
+      repairedIdPositions.push(position);
+    return {
+      // 🔴 The UUID is generated only when it is needed: previously the
+      // crypto RNG was invoked for every card on every read, and the value
+      // was discarded (review 02.09, R3c-14)
+      id: hasUsableId ? item.id : randomUUID2(),
+      title: safeString(item.title).trim() || null,
+      text: safeString(item.text).trim() || null,
+      buttonLabel: safeString(item.buttonLabel).trim() || null,
+      buttonUrl: safeString(item.buttonUrl).trim() || null,
+      imageUrl: safeString(item.imageUrl).trim() || null,
+      imageMasterUrl: safeString(item.imageMasterUrl).trim() || null,
+      imageVariants: readImageVariants(item.imageVariants),
+      imageWidth: typeof item.imageWidth === "number" ? item.imageWidth : null,
+      imageHeight: typeof item.imageHeight === "number" ? item.imageHeight : null,
+      formId: safeString(item.formId).trim() || null
+    };
+  });
+  const ratio = safeString(raw.cardImageRatio);
+  return {
+    enabled: raw.enabled === true,
+    visibility: raw.visibility === "hidden" ? "hidden" : "always",
+    cardImageRatio: CARD_IMAGE_RATIOS.includes(ratio) ? ratio : "16:9",
+    items,
+    repairedIdPositions
+  };
 }
-function extractVkVideoIds(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
+function normalizeNullableText(value) {
+  if (value == null)
     return null;
-  }
-  if (parsed.pathname.includes("video_ext.php")) {
-    const oid = parsed.searchParams.get("oid");
-    const id = parsed.searchParams.get("id");
-    return oid && id ? { oid, id } : null;
-  }
-  const match = parsed.pathname.match(/\/video(-?\d+)_(\d+)/);
-  return match ? { oid: match[1] ?? "", id: match[2] ?? "" } : null;
+  return value.trim() || null;
 }
-function extractPathId(url, host, patterns) {
-  let parsed;
+var CARD_LINK_SCHEME = /^(https?:\/\/|mailto:|tel:|\/(?!\/))/i;
+var CARD_BARE_DOMAIN = /^[\p{L}\d-]+(\.[\p{L}\d-]+)+(:\d+)?(\/\S*)?$/u;
+function normalizeCardButtonUrl(value) {
+  const trimmed = normalizeNullableText(value);
+  if (!trimmed)
+    return null;
+  if (CARD_LINK_SCHEME.test(trimmed))
+    return trimmed;
+  if (CARD_BARE_DOMAIN.test(trimmed))
+    return `https://${trimmed}`;
+  let url;
   try {
-    parsed = new URL(url);
+    url = new URL(trimmed);
   } catch {
-    return null;
-  }
-  if (parsed.hostname.replace(/^www\./, "") !== host && !parsed.hostname.endsWith(`.${host}`))
-    return null;
-  for (const pattern of patterns) {
-    const match = parsed.pathname.match(pattern);
-    if (match?.[1])
-      return match[1];
+    throw new Error(`Invalid card buttonUrl "${trimmed}". Use http(s), mailto, tel, a site-relative /path, or set formId instead.`);
   }
-  return null;
+  throw new Error(`Unsupported card buttonUrl protocol "${url.protocol}". Use http(s), mailto, tel, a site-relative /path, or set formId instead.`);
 }
-function extractTwitchEmbed(url) {
-  let parsed;
+function eventFormIds(eventData) {
+  const rawForms = Array.isArray(eventData.forms) ? eventData.forms : [];
+  return new Set(rawForms.map((form) => form && typeof form === "object" && !Array.isArray(form) ? safeString(form.id).trim() : "").filter(Boolean));
+}
+function cardHasImage(item) {
+  return Boolean(item.imageMasterUrl || item.imageUrl || item.imageVariants);
+}
+var cardIdSchema = external_exports.string().regex(CARD_ID_PATTERN, "Use 1-80 characters: letters, numbers, underscore, or hyphen.").describe("Stable card id. Omit to generate one; keep it to preserve images and analytics continuity.");
+var cardItemInputSchema = external_exports.object({
+  id: cardIdSchema.optional(),
+  title: external_exports.string().max(MAX_CARD_TITLE_LENGTH).nullable().optional(),
+  text: external_exports.string().max(MAX_CARD_TEXT_LENGTH).nullable().optional(),
+  buttonLabel: external_exports.string().max(MAX_CARD_BUTTON_LABEL_LENGTH).nullable().optional(),
+  buttonUrl: external_exports.string().max(MAX_CARD_BUTTON_URL_LENGTH).nullable().optional(),
+  formId: cardIdSchema.nullable().optional()
+}).strict();
+var imageSourceSchema = external_exports.object({
+  path: external_exports.string().min(1).optional().describe("Local image path on the MCP client machine (inside OKO_IMAGE_ROOTS)."),
+  url: external_exports.string().url().optional().describe("Public HTTPS image URL. The OKO server fetches it first (works behind VPNs and proxies); if the server cannot reach it, the MCP client fetches it from this machine; if both fail, ask the organizer for a local file via path.")
+}).strict().refine((source) => Boolean(source.path) !== Boolean(source.url), {
+  message: "Provide exactly one image source: path or url."
+});
+function buildCardsItems({ inputs, existing, formIds }) {
+  const existingById = new Map(existing.map((item) => [item.id, item]));
+  const seen = /* @__PURE__ */ new Set();
+  const generatedCardIds = [];
+  const preservedImageCardIds = [];
+  const items = inputs.map((input) => {
+    const id = input.id ?? randomUUID2();
+    if (seen.has(id))
+      throw new Error(`Duplicate card id "${id}". Each card id must be unique.`);
+    seen.add(id);
+    if (!CARD_ID_PATTERN.test(id))
+      throw new Error(`Invalid card id "${id}". Use 1-80 characters: letters, numbers, underscore, or hyphen.`);
+    if (!input.id)
+      generatedCardIds.push(id);
+    const formId = normalizeNullableText(input.formId);
+    if (formId && !formIds.has(formId)) {
+      throw new Error(`Form ${formId} not found in event.forms. Create it with oko_configure_blocks forms first, or set formId:null.`);
+    }
+    const previous = existingById.get(id);
+    if (previous && cardHasImage(previous))
+      preservedImageCardIds.push(id);
+    return {
+      id,
+      title: normalizeNullableText(input.title),
+      text: normalizeNullableText(input.text),
+      buttonLabel: normalizeNullableText(input.buttonLabel),
+      buttonUrl: normalizeCardButtonUrl(input.buttonUrl),
+      imageUrl: previous?.imageUrl ?? null,
+      imageMasterUrl: previous?.imageMasterUrl ?? null,
+      imageVariants: previous?.imageVariants ?? null,
+      imageWidth: previous?.imageWidth ?? null,
+      imageHeight: previous?.imageHeight ?? null,
+      formId
+    };
+  });
+  return { items, generatedCardIds, preservedImageCardIds };
+}
+async function deleteStoragePaths(eventId, paths) {
+  const uniquePaths = [...new Set(paths.filter(Boolean))];
+  if (uniquePaths.length === 0)
+    return [];
+  const removeImages = httpsCallable(functions, "deleteMcpImages");
   try {
-    parsed = new URL(url);
-  } catch {
-    return null;
-  }
-  const host = parsed.hostname.replace(/^www\./, "");
-  if (host === "player.twitch.tv") {
-    const channel = parsed.searchParams.get("channel");
-    const video = parsed.searchParams.get("video");
-    if (channel)
-      return `https://player.twitch.tv/?channel=${channel}&parent=${TWITCH_PARENT}`;
-    if (video)
-      return `https://player.twitch.tv/?video=${video}&parent=${TWITCH_PARENT}`;
+    const result = await removeImages({ eventId, paths: uniquePaths });
+    return Array.isArray(result.data.warnings) ? result.data.warnings : [];
+  } catch (error3) {
+    return [`storage cleanup failed: ${error3 instanceof Error ? error3.message : String(error3)}`];
   }
-  if (host === "twitch.tv") {
-    const vodMatch = parsed.pathname.match(/\/videos\/(\d+)/);
-    if (vodMatch?.[1])
-      return `https://player.twitch.tv/?video=v${vodMatch[1]}&parent=${TWITCH_PARENT}`;
-    const channelMatch = parsed.pathname.match(/^\/([a-zA-Z0-9_]+)$/);
-    if (channelMatch?.[1])
-      return `https://player.twitch.tv/?channel=${channelMatch[1]}&parent=${TWITCH_PARENT}`;
+}
+async function deleteStorageUrls(eventId, masterUrl, fallbackUrl) {
+  const paths = [];
+  const masterPath = storagePathFromDownloadUrl(masterUrl);
+  if (masterPath) {
+    paths.push(masterPath, ...variantPathsFromMasterPath(masterPath));
+  } else {
+    const fallbackPath = storagePathFromDownloadUrl(fallbackUrl);
+    if (fallbackPath)
+      paths.push(fallbackPath);
   }
-  return null;
+  const warnings = await deleteStoragePaths(eventId, paths);
+  return { attempted: [...new Set(paths)].length, warnings };
 }
-function detectAndNormalize(url) {
-  const trimmed = url.trim();
-  if (!trimmed)
-    return { provider: "unknown", normalizedUrl: null };
-  const host = hostOf(trimmed);
-  if (host === "youtube.com" || host === "youtu.be") {
-    const id = extractYouTubeId(trimmed);
-    return { provider: "youtube", normalizedUrl: id ? `https://www.youtube.com/embed/${id}` : null };
+async function uploadMasterImage(eventId, kind, cardId, source) {
+  const uploadImage = httpsCallable(functions, "uploadMcpImage");
+  const result = await uploadImage({
+    eventId,
+    kind,
+    ...cardId ? { cardId } : {},
+    ...source.sourceUrl ? { sourceUrl: source.sourceUrl } : { imageBase64: source.imageBase64 }
+  });
+  return result.data;
+}
+function imageReplacedSinceRead(fresh, expected) {
+  return fresh.imageMasterUrl !== expected.imageMasterUrl || fresh.imageUrl !== expected.imageUrl;
+}
+async function clearEventImageInTransaction(eventId, kind, cardId, expected) {
+  const eventRef = doc(firestore, "events", eventId);
+  await runTransaction2(firestore, async (transaction) => {
+    const snap = await transaction.get(eventRef);
+    if (!snap.exists())
+      throw new Error("Event not found.");
+    const data = snap.data();
+    const fresh = readImageRef(data, kind, cardId);
+    if (imageReplacedSinceRead(fresh, expected)) {
+      throw new Error("The image changed between reading it and deleting it \u2014 someone replaced it in the meantime. Nothing was deleted and no file was removed. Read the event again and repeat the call if the new image should go too.");
+    }
+    if (kind === "card") {
+      transaction.update(eventRef, {
+        "blocks.cards.items": cardItemsWithImage(data, cardId, {
+          imageUrl: null,
+          imageMasterUrl: null,
+          imageVariants: null,
+          imageWidth: null,
+          imageHeight: null
+        })
+      });
+      return;
+    }
+    const prefix = kind === "promoBanner" ? "blocks.promoBanner" : "blocks.video.placeholder";
+    transaction.update(eventRef, {
+      [`${prefix}.imageMasterUrl`]: deleteField(),
+      [`${prefix}.imageUrl`]: deleteField(),
+      [`${prefix}.imageVariants`]: deleteField(),
+      [`${prefix}.imageWidth`]: deleteField(),
+      [`${prefix}.imageHeight`]: deleteField()
+    });
+  });
+}
+function descendPath(root, segments) {
+  let current = root;
+  for (const segment of segments) {
+    if (current === null || typeof current !== "object")
+      return void 0;
+    current = current[segment];
   }
-  if (host === "vk.com" || host === "vkvideo.ru") {
-    const ids = extractVkVideoIds(trimmed);
-    return { provider: "vk", normalizedUrl: ids ? `https://vk.com/video_ext.php?oid=${ids.oid}&id=${ids.id}&hd=2` : null };
+  return current;
+}
+function valueAfterPatch(fresh, patch, path) {
+  if (Object.prototype.hasOwnProperty.call(patch, path))
+    return patch[path];
+  const segments = path.split(".");
+  for (let cut = segments.length - 1; cut > 0; cut--) {
+    const ancestor = segments.slice(0, cut).join(".");
+    if (!Object.prototype.hasOwnProperty.call(patch, ancestor))
+      continue;
+    return descendPath(patch[ancestor], segments.slice(cut));
   }
-  const rutubeId = extractPathId(trimmed, "rutube.ru", [/\/play\/embed\/([a-f0-9]+)/i, /\/video\/([a-f0-9]+)/i]);
-  if (rutubeId)
-    return { provider: "rutube", normalizedUrl: `https://rutube.ru/play/embed/${rutubeId}` };
-  if (trimmed.includes("rutube.ru"))
-    return { provider: "rutube", normalizedUrl: null };
-  const vimeoId = extractPathId(trimmed, "vimeo.com", [/\/video\/(\d+)/, /^\/(\d+)/]);
-  if (vimeoId)
-    return { provider: "vimeo", normalizedUrl: `https://player.vimeo.com/video/${vimeoId}` };
-  if (trimmed.includes("vimeo.com"))
-    return { provider: "vimeo", normalizedUrl: null };
-  const kinescopeId = extractPathId(trimmed, "kinescope.io", [/\/embed\/([a-zA-Z0-9]+)/, /^\/([a-zA-Z0-9]+)$/]);
-  if (kinescopeId)
-    return { provider: "kinescope", normalizedUrl: `https://kinescope.io/embed/${kinescopeId}` };
-  if (trimmed.includes("kinescope.io"))
-    return { provider: "kinescope", normalizedUrl: null };
-  const dzenId = extractPathId(trimmed, "dzen.ru", [/\/embed\/([a-zA-Z0-9_-]+)/, /\/video\/watch\/([a-zA-Z0-9_-]+)/]);
-  if (dzenId)
-    return { provider: "dzen", normalizedUrl: `https://dzen.ru/embed/${dzenId}` };
-  if (trimmed.includes("dzen.ru"))
-    return { provider: "dzen", normalizedUrl: null };
-  const twitchEmbed = extractTwitchEmbed(trimmed);
-  if (twitchEmbed)
-    return { provider: "twitch", normalizedUrl: twitchEmbed };
-  if (trimmed.includes("twitch.tv"))
-    return { provider: "twitch", normalizedUrl: null };
-  const dailymotionId = extractPathId(trimmed, "dailymotion.com", [/\/embed\/video\/([a-zA-Z0-9]+)/, /\/video\/([a-zA-Z0-9]+)/]) ?? extractPathId(trimmed, "dai.ly", [/^\/([a-zA-Z0-9]+)/]);
-  if (dailymotionId)
-    return { provider: "dailymotion", normalizedUrl: `https://www.dailymotion.com/embed/video/${dailymotionId}` };
-  if (trimmed.includes("dailymotion.com") || trimmed.includes("dai.ly"))
-    return { provider: "dailymotion", normalizedUrl: null };
-  const wistiaId = extractPathId(trimmed, "wistia.com", [/\/medias\/([a-zA-Z0-9]+)/]) ?? extractPathId(trimmed, "fast.wistia.net", [/\/embed\/iframe\/([a-zA-Z0-9]+)/]);
-  if (wistiaId)
-    return { provider: "wistia", normalizedUrl: `https://fast.wistia.net/embed/iframe/${wistiaId}` };
-  if (trimmed.includes("wistia.com") || trimmed.includes("wistia.net"))
-    return { provider: "wistia", normalizedUrl: null };
-  return { provider: "unknown", normalizedUrl: null };
+  return descendPath(fresh, segments);
 }
-
-// build/tools/formatting.js
-var RETIRED_SESSION_FIELDS = ["nmoEvaluation"];
-function cursorMeta(count, max, hasMore, nextCursor) {
-  return {
-    count,
-    limit: max,
-    hasMore,
-    nextCursor,
-    has_more: hasMore,
-    next_cursor: nextCursor
-  };
+function scheduleMissesDate(sessionMode, eventDate) {
+  return sessionMode === "schedule" && !eventDate;
 }
-function pickPage(items, max) {
+async function writeEventPatchWithCards(eventId, basePatch, buildItems, validate = null) {
+  const eventRef = doc(firestore, "events", eventId);
+  await runTransaction2(firestore, async (transaction) => {
+    const snap = await transaction.get(eventRef);
+    if (!snap.exists())
+      throw new Error("Event not found.");
+    const fresh = snap.data();
+    const patch = { ...basePatch };
+    if (buildItems) {
+      patch["blocks.cards.items"] = buildItems(fresh);
+    }
+    if (validate)
+      validate(fresh, patch);
+    if (Object.keys(patch).length === 0)
+      return;
+    transaction.update(eventRef, patch);
+  });
+}
+function imageVariantReason(ref2) {
+  if (!ref2.imageMasterUrl && !ref2.imageUrl)
+    return "image_missing";
+  if (!ref2.imageMasterUrl)
+    return "master_missing";
+  if (!ref2.imageVariants)
+    return "variants_pending";
+  if (!ref2.imageUrl)
+    return "image_url_pending";
+  return null;
+}
+function imageVariantStatus(eventId, eventData, kind, cardId, elapsedMs) {
+  const ref2 = readImageRef(eventData, kind, cardId ?? void 0);
+  const reason = imageVariantReason(ref2);
   return {
-    page: items.slice(0, max),
-    hasMore: items.length > max
+    eventId,
+    kind,
+    cardId,
+    imageId: ref2.imageId,
+    imageUrl: ref2.imageUrl,
+    imageMasterUrl: ref2.imageMasterUrl,
+    imageVariants: ref2.imageVariants,
+    ready: reason === null,
+    reason,
+    elapsedMs
   };
 }
-function assertEmbeddableUrl(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error(`Invalid videoUrl "${value}". Provide an https:// link or a full <iframe> embed code.`);
-  }
-  if (url.protocol !== "https:") {
-    throw new Error(`Unsupported videoUrl protocol "${url.protocol}". The player must be served over https:// \u2014 http:// links are refused by the platform.`);
-  }
-  return value;
-}
-function assertNotNullLiteral(value, field2) {
-  if (typeof value === "string" && value.trim().toLowerCase() === "null") {
-    throw new Error(`${field2}: received the literal text "null". To clear the field pass an empty string "" (or JSON null); to keep it unchanged, omit the parameter.`);
-  }
+function sleep(ms) {
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
-function normalizeVideo(videoUrl) {
-  const raw = videoUrl?.trim();
-  if (!raw)
-    return { originalUrl: null, embedUrl: null };
-  const effective = extractIframeSrc(raw) ?? raw;
-  const detected = detectAndNormalize(effective);
-  if (detected.provider !== "unknown" && !detected.normalizedUrl) {
-    throw new Error(`Could not extract a valid ${detected.provider} video id from videoUrl.`);
+async function waitForImageVariantTargets(uid, eventId, targets, timeoutSec) {
+  const startedAt = Date.now();
+  const deadline = startedAt + timeoutSec * 1e3;
+  let latest;
+  while (true) {
+    const elapsedMs = Date.now() - startedAt;
+    const event = await readEvent(eventId, uid, "read");
+    latest = targets.map((target) => imageVariantStatus(eventId, event, target.kind, target.cardId, elapsedMs));
+    if (latest.every((item) => item.ready) || Date.now() >= deadline)
+      return latest;
+    await sleep(Math.min(2e3, Math.max(250, deadline - Date.now())));
   }
-  return { originalUrl: raw, embedUrl: assertEmbeddableUrl(detected.normalizedUrl ?? effective) };
-}
-function csvRows(headers, rows) {
-  return [headers, ...rows].map((row) => row.map(csvCell).join(",")).join("\n");
 }
-function toMillis(value) {
-  if (typeof value === "number" && Number.isFinite(value))
-    return value;
-  if (value && typeof value === "object" && typeof value.toMillis === "function") {
-    return value.toMillis();
+async function uploadEventImageForUser(uid, eventId, kind, cardId, source) {
+  if (kind === "card" && !cardId)
+    throw new Error("cardId is required when kind is card.");
+  if (kind !== "card" && cardId)
+    throw new Error("cardId is only valid when kind is card.");
+  const event = await readEvent(eventId, uid, "edit");
+  const previous = readImageRef(event, kind, cardId);
+  const eventBlocks = event.blocks && typeof event.blocks === "object" ? event.blocks : {};
+  const placeholderCfg = eventBlocks.video?.placeholder && typeof eventBlocks.video.placeholder === "object" ? eventBlocks.video.placeholder : {};
+  const blockEnabled = kind === "promoBanner" ? eventBlocks.promoBanner?.enabled === true : kind === "videoPlaceholder" ? placeholderCfg.enabled === true : readCardsConfig(event).enabled;
+  const enableInstruction = kind === "promoBanner" ? "oko_configure_blocks promoBanner.enabled=true" : kind === "videoPlaceholder" ? "oko_configure_blocks videoPlaceholder.enabled=true" : "oko_configure_cards enabled=true";
+  const uploadHints = [
+    blockEnabled ? `The ${kind} block is enabled: the new image appears on the page as soon as the variants are ready.` : `The ${kind} block is disabled in setup, so viewers will not see this image until it is enabled (${enableInstruction}). Uploading never enables a block by itself.`,
+    ...kind === "videoPlaceholder" && placeholderCfg.mode !== "image" ? ['The placeholder mode is not "image": set oko_configure_blocks videoPlaceholder.mode="image" for this picture to be used.'] : [],
+    ...kind === "videoPlaceholder" ? ['The placeholder is shown to viewers only while its live switch is on: oko_set_block_visibility block "placeholder" visible=true.'] : [],
+    IMAGE_ADVICE[kind]
+  ];
+  const previousMasterPath = storagePathFromDownloadUrl(previous.imageMasterUrl);
+  const deleteWarnings = [];
+  let deletesAttempted = 0;
+  const { uploaded, sourceBytes, sourceVia, notes: sourceNotes } = await uploadImageFromSource(eventId, kind, cardId, source);
+  if (!uploaded)
+    throw new Error("Image upload did not return a result.");
+  if (kind !== "card" || previousMasterPath && previousMasterPath !== uploaded.storagePath || !previous.imageMasterUrl && previous.imageUrl) {
+    const cleanup = await deleteStorageUrls(eventId, previous.imageMasterUrl, previous.imageUrl);
+    deletesAttempted += cleanup.attempted;
+    deleteWarnings.push(...cleanup.warnings);
   }
-  return null;
+  return {
+    eventId,
+    kind,
+    imageId: uploaded.imageId,
+    storagePath: uploaded.storagePath,
+    masterUrl: uploaded.masterUrl,
+    variantsPending: true,
+    sourceBytes,
+    sourceVia,
+    masterBytes: uploaded.masterBytes,
+    imageWidth: uploaded.imageWidth,
+    imageHeight: uploaded.imageHeight,
+    note: "Image master uploaded. CF generateImageVariants should publish thumb/card/hero variants and update imageUrl/imageVariants in about 10-30 seconds.",
+    storageDeletesAttempted: deletesAttempted,
+    storageDeleteWarnings: deleteWarnings,
+    hints: [...sourceNotes, ...uploadHints]
+  };
 }
-function parseTimestampCursor(cursor) {
-  const separator = cursor.indexOf("|");
-  const head = separator === -1 ? cursor : cursor.slice(0, separator);
-  const docId = separator === -1 ? "" : cursor.slice(separator + 1);
-  const millis2 = Number(head);
-  const at = Number.isFinite(millis2) && millis2 > 0 ? millis2 : Date.parse(head);
-  if (!Number.isFinite(at)) {
-    throw new Error("Invalid cursor. Use the nextCursor value returned by the previous page.");
+
+// build/tools/schemas.js
+var boolOrNull = external_exports.boolean().nullable();
+var DEFAULT_LIST_LIMIT = 30;
+var MAX_LIST_LIMIT = 100;
+var MAX_EXPORT_LIMIT = 200;
+var ANALYTICS_DEFAULT_LIMIT = 10;
+var ANALYTICS_TIMELINE_DEFAULT_LIMIT = 120;
+var MAX_WORKSPACE_NAME_LENGTH = 120;
+var MAX_WORKSPACE_INVITE_CODE_LENGTH = 64;
+var TELEGRAM_POST_STATUSES = ["draft", "pending", "scheduled", "sent", "failed", "delivery_unknown"];
+var readOnlyTool = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true
+};
+var writeTool = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: false,
+  openWorldHint: true
+};
+var idempotentWriteTool = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true
+};
+var destructiveTool = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true
+};
+var unknownRecordSchema = external_exports.record(external_exports.unknown());
+var basicEventOutputSchema = external_exports.object({
+  eventId: external_exports.string()
+}).passthrough();
+var updateOutputSchema = external_exports.object({
+  id: external_exports.string().optional(),
+  eventId: external_exports.string().optional(),
+  updated: external_exports.array(external_exports.string()).optional()
+}).passthrough();
+var eventLinksOutputShape = {
+  url: external_exports.string().url(),
+  setupUrl: external_exports.string().url(),
+  analyticsUrl: external_exports.string().url()
+};
+var createWebinarOutputSchema = external_exports.object({
+  id: external_exports.string(),
+  workspaceId: external_exports.string(),
+  sourceEventId: external_exports.string().optional(),
+  ...eventLinksOutputShape
+}).passthrough();
+var updateStatusSchema = external_exports.object({
+  current: external_exports.string(),
+  latest: external_exports.string().nullable(),
+  updateAvailable: external_exports.boolean(),
+  message: external_exports.string().optional(),
+  howTo: external_exports.array(external_exports.string()).optional()
+});
+var connectionStatusOutputSchema = external_exports.object({
+  connected: external_exports.boolean(),
+  status: external_exports.enum(OKO_CONNECTION_STATUSES),
+  errorCode: external_exports.string().nullable(),
+  message: external_exports.string(),
+  product: external_exports.object({
+    name: external_exports.string(),
+    summary: external_exports.string(),
+    videoBoundary: external_exports.string(),
+    accountRequirement: external_exports.string(),
+    accessModel: external_exports.string()
+  }),
+  organizerAccountRequired: external_exports.boolean(),
+  credentialConfigured: external_exports.boolean(),
+  links: external_exports.object({
+    website: external_exports.string().url(),
+    signIn: external_exports.string().url(),
+    installCenter: external_exports.string().url()
+  }),
+  nextSteps: external_exports.array(external_exports.object({
+    id: external_exports.string(),
+    label: external_exports.string(),
+    url: external_exports.string().url().optional(),
+    command: external_exports.string().optional()
+  })),
+  minimumVersion: external_exports.string().optional(),
+  update: updateStatusSchema.optional(),
+  uid: external_exports.string().optional(),
+  scopes: external_exports.array(external_exports.string()).optional()
+});
+var cursorMetaSchema = {
+  count: external_exports.number().int().nonnegative(),
+  limit: external_exports.number().int().positive(),
+  hasMore: external_exports.boolean(),
+  nextCursor: external_exports.string().nullable(),
+  has_more: external_exports.boolean(),
+  next_cursor: external_exports.string().nullable()
+};
+var workspacesOutputSchema = external_exports.object({
+  workspaces: external_exports.array(unknownRecordSchema),
+  count: external_exports.number().int().nonnegative()
+}).passthrough();
+var eventsOutputSchema = external_exports.object({
+  events: external_exports.array(unknownRecordSchema),
+  ...cursorMetaSchema
+}).passthrough();
+var eventOutputSchema = external_exports.object({
+  id: external_exports.string(),
+  ...eventLinksOutputShape
+}).passthrough();
+var liveStateOutputSchema = external_exports.object({
+  eventId: external_exports.string(),
+  agg: unknownRecordSchema,
+  ctrl: unknownRecordSchema,
+  chat: unknownRecordSchema
+}).passthrough();
+var analyticsOutputSchema = external_exports.object({
+  sessions: external_exports.array(unknownRecordSchema),
+  ...cursorMetaSchema
+}).passthrough();
+var chatOutputSchema = external_exports.object({
+  messages: external_exports.array(unknownRecordSchema),
+  ...cursorMetaSchema
+}).passthrough();
+var leadsOutputSchema = external_exports.object({
+  leads: external_exports.array(unknownRecordSchema).optional(),
+  csv: external_exports.string().optional(),
+  ...cursorMetaSchema
+}).passthrough();
+var imageOutputSchema = external_exports.object({
+  eventId: external_exports.string(),
+  kind: external_exports.enum(IMAGE_KINDS),
+  imageId: external_exports.string(),
+  storagePath: external_exports.string(),
+  masterUrl: external_exports.string().url(),
+  variantsPending: external_exports.boolean(),
+  sourceBytes: external_exports.number().int().nonnegative(),
+  sourceVia: external_exports.enum(["server", "client"]).optional(),
+  masterBytes: external_exports.number().int().nonnegative(),
+  imageWidth: external_exports.number().int().positive(),
+  imageHeight: external_exports.number().int().positive(),
+  note: external_exports.string()
+}).passthrough();
+var deleteImageOutputSchema = external_exports.object({
+  eventId: external_exports.string(),
+  kind: external_exports.enum(IMAGE_KINDS),
+  imageId: external_exports.string().nullable(),
+  deleted: external_exports.boolean(),
+  storageDeletesAttempted: external_exports.number().int().nonnegative(),
+  storageDeleteWarnings: external_exports.array(external_exports.string())
+}).passthrough();
+var imageVariantsOutputSchema = external_exports.object({
+  eventId: external_exports.string(),
+  kind: external_exports.enum(IMAGE_KINDS),
+  cardId: external_exports.string().nullable(),
+  imageId: external_exports.string().nullable(),
+  imageUrl: external_exports.string().url().nullable(),
+  imageMasterUrl: external_exports.string().url().nullable(),
+  imageVariants: unknownRecordSchema.nullable(),
+  ready: external_exports.boolean(),
+  reason: external_exports.string().nullable(),
+  elapsedMs: external_exports.number().int().nonnegative()
+}).passthrough();
+var cardImagesBatchOutputSchema = external_exports.object({
+  eventId: external_exports.string(),
+  uploads: external_exports.array(unknownRecordSchema),
+  variants: external_exports.array(unknownRecordSchema),
+  ready: external_exports.boolean(),
+  warnings: external_exports.array(external_exports.string())
+}).passthrough();
+var setupValidationOutputSchema = external_exports.object({
+  eventId: external_exports.string(),
+  ok: external_exports.boolean(),
+  score: external_exports.number().int().min(0).max(100),
+  errors: external_exports.array(unknownRecordSchema),
+  warnings: external_exports.array(unknownRecordSchema),
+  suggestions: external_exports.array(unknownRecordSchema),
+  nextActions: external_exports.array(external_exports.string()),
+  links: unknownRecordSchema
+}).passthrough();
+var workspaceAccessOutputSchema = external_exports.object({
+  workspaceId: external_exports.string(),
+  workspace: unknownRecordSchema,
+  members: external_exports.array(unknownRecordSchema),
+  invites: external_exports.array(unknownRecordSchema)
+}).passthrough();
+var telegramChannelsOutputSchema = external_exports.object({
+  channels: external_exports.array(canonicalTelegramChannelSchema),
+  count: external_exports.number().int().nonnegative()
+}).passthrough();
+var telegramPostsOutputSchema = external_exports.object({
+  posts: external_exports.array(unknownRecordSchema),
+  ...cursorMetaSchema
+}).passthrough();
+var sessionReportOutputSchema = external_exports.object({
+  eventId: external_exports.string(),
+  sessionId: external_exports.string(),
+  reportUrl: external_exports.string().url(),
+  markdown: external_exports.string(),
+  session: unknownRecordSchema
+}).passthrough();
+var profileOutputSchema = external_exports.object({
+  uid: external_exports.string(),
+  profile: unknownRecordSchema,
+  updated: external_exports.array(external_exports.string())
+}).passthrough();
+var deleteLeadOutputSchema = external_exports.object({
+  eventId: external_exports.string(),
+  leadId: external_exports.string(),
+  deleted: external_exports.boolean()
+}).passthrough();
+var notificationsOutputSchema = external_exports.object({
+  notifications: external_exports.array(unknownRecordSchema),
+  unreadCountOnPage: external_exports.number().int().nonnegative(),
+  ...cursorMetaSchema
+}).passthrough();
+var notificationsMarkOutputSchema = external_exports.object({
+  markedRead: external_exports.number().int().nonnegative(),
+  notificationIds: external_exports.array(external_exports.string())
+}).passthrough();
+var FORM_FIELD_TYPES = ["text", "tel", "email", "textarea", "select", "checkbox"];
+var formFieldSchema = external_exports.object({
+  id: external_exports.string().min(1).optional(),
+  label: external_exports.string().max(120),
+  type: external_exports.enum(FORM_FIELD_TYPES).default("text").describe("text | tel | email | textarea answer with free text; select (one answer) and checkbox (several) answer with one of `options`."),
+  required: external_exports.boolean().default(false),
+  placeholder: external_exports.string().max(160).nullable().optional(),
+  options: external_exports.array(external_exports.string().trim().min(1).max(80)).max(20).optional().describe("Choices of a select or checkbox field: 1\u201320 unique option texts. The lead stores the option text itself \u2014 a string for select, an array of strings for checkbox.")
+}).strict().superRefine((field2, ctx) => {
+  const choice = field2.type === "select" || field2.type === "checkbox";
+  const count = new Set(field2.options ?? []).size;
+  if (choice && count === 0) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["options"], message: `A ${field2.type} field needs at least one option.` });
   }
-  const boundary = Timestamp.fromMillis(at);
-  return docId ? [boundary, docId] : [boundary];
-}
-function timestampCursorFrom(value, docId) {
-  const millis2 = toMillis(value);
-  if (millis2 == null)
-    return null;
-  return docId ? `${millis2}|${docId}` : String(millis2);
-}
-var ISO_WITH_OFFSET = /(?:Z|[+-]\d{2}:?\d{2})$/;
-function parseIsoBound(value, label) {
-  if (value === void 0)
-    return null;
-  const parsed = Date.parse(value);
-  if (!Number.isFinite(parsed) || !ISO_WITH_OFFSET.test(value.trim())) {
-    throw new Error(`Invalid ${label}: expected an ISO timestamp with an explicit offset, such as 2026-08-28T00:00:00+03:00 or 2026-08-27T21:00:00Z.`);
+  if (!choice && field2.options !== void 0) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["options"], message: `options belong to select or checkbox fields only; this field is ${field2.type}.` });
   }
-  return Timestamp.fromMillis(parsed);
-}
-function absoluteHttpUrl(value, label) {
-  const trimmed = (value ?? "").trim();
-  if (!trimmed)
-    return null;
-  let url;
+});
+var formSchema = external_exports.object({
+  id: external_exports.string().min(1).optional(),
+  title: external_exports.string().max(160).nullable().optional(),
+  description: external_exports.string().max(1e3).nullable().optional(),
+  submitLabel: external_exports.string().max(80).nullable().optional(),
+  successText: external_exports.string().max(500).nullable().optional(),
+  consentText: external_exports.string().max(500).nullable().optional(),
+  consentRequired: external_exports.boolean().default(true),
+  fields: external_exports.array(formFieldSchema).max(30)
+}).strict();
+var profileDisplayNameSchema = external_exports.string().max(40).nullable();
+var timezoneSchema = external_exports.string().min(1).max(100).regex(/^[A-Za-z0-9_+./-]+$/, "Use an IANA timezone such as Europe/Moscow or UTC.").refine((value) => {
   try {
-    url = new URL(trimmed);
+    new Intl.DateTimeFormat("en-CA", { timeZone: value });
+    return true;
   } catch {
-    throw new Error(`Invalid ${label} "${trimmed}": Telegram needs an absolute http(s) URL.`);
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new Error(`Unsupported ${label} protocol "${url.protocol}": Telegram needs an absolute http(s) URL.`);
-  }
-  return trimmed;
-}
-function compactAnalyticsSession(raw, options2) {
-  const session = serialize(raw);
-  const timeline = Array.isArray(session.timeline) ? session.timeline : null;
-  if (timeline) {
-    session.timelineBucketCount = timeline.length;
-    if (options2.includeTimeline) {
-      const page = timeline.slice(-options2.timelineLimit);
-      session.timeline = page;
-      session.timelineTruncated = timeline.length > page.length;
-      session.timelineReturned = page.length;
-    } else {
-      delete session.timeline;
-      session.timelineOmitted = true;
-    }
-  }
-  if (!options2.includeSnapshots) {
-    if (session.baselineSnapshot !== void 0) {
-      delete session.baselineSnapshot;
-      session.baselineSnapshotOmitted = true;
-    }
-    if (session.finalSnapshot !== void 0) {
-      delete session.finalSnapshot;
-      session.finalSnapshotOmitted = true;
-    }
-  }
-  for (const field2 of RETIRED_SESSION_FIELDS)
-    delete session[field2];
-  const warnings = sessionQualityWarnings(session.dataQuality);
-  if (warnings.length > 0)
-    session.dataQualityWarnings = warnings;
-  return session;
-}
-function numberMetric(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : null;
-}
-function formatSeconds(value) {
-  const seconds = numberMetric(value);
-  if (seconds == null)
-    return "n/a";
-  const total = Math.max(0, Math.round(seconds));
-  const h = Math.floor(total / 3600);
-  const m = Math.floor(total % 3600 / 60);
-  const s = total % 60;
-  if (h > 0)
-    return `${h}h ${String(m).padStart(2, "0")}m ${String(s).padStart(2, "0")}s`;
-  return `${m}m ${String(s).padStart(2, "0")}s`;
-}
-function formatDateTime(value) {
-  const millis2 = toMillis(value);
-  if (millis2 == null)
-    return "n/a";
-  return new Date(millis2).toISOString();
-}
-function markdownMetric(label, value, suffix = "") {
-  const metric = value === null || value === void 0 || value === "" ? "n/a" : String(value);
-  return `- ${label}: ${metric}${suffix}`;
-}
-function reportQualityCaveats(dataQuality) {
-  if (!dataQuality || typeof dataQuality !== "object" || Array.isArray(dataQuality))
-    return [];
-  const marks = dataQuality;
-  const caveats = [];
-  if (marks.baselineSource === "none")
-    caveats.push("baselineMissing");
-  if (marks.startedAtSource === "end_time")
-    caveats.push("startTimeUnknown");
-  if (marks.watchTime === "unavailable")
-    caveats.push("watchTimeUnmeasured");
-  if (marks.watchTime === "unknown_duration")
-    caveats.push("watchTimeUncapped");
-  return caveats;
+    return false;
+  }
+}, "Unknown IANA timezone: use a value such as Europe/Moscow, America/New_York or UTC.");
+var cardsConfigOutputSchema = external_exports.object({
+  eventId: external_exports.string(),
+  updated: external_exports.array(external_exports.string()),
+  cards: external_exports.object({
+    enabled: external_exports.boolean(),
+    visibility: external_exports.enum(["always", "hidden"]),
+    cardImageRatio: external_exports.enum(CARD_IMAGE_RATIOS),
+    items: external_exports.array(unknownRecordSchema)
+  }).passthrough(),
+  generatedCardIds: external_exports.array(external_exports.string()),
+  removedCardIds: external_exports.array(external_exports.string()),
+  removedCardsWithImages: external_exports.array(external_exports.string()),
+  preservedImageCardIds: external_exports.array(external_exports.string()),
+  warnings: external_exports.array(external_exports.string())
+}).passthrough();
+var workspacePermissionsSchema = external_exports.object({
+  createEvents: external_exports.boolean(),
+  editSetup: external_exports.boolean(),
+  deleteEvents: external_exports.boolean(),
+  controlLive: external_exports.boolean(),
+  moderateChat: external_exports.boolean(),
+  startSession: external_exports.boolean(),
+  viewAnalytics: external_exports.boolean(),
+  downloadReports: external_exports.boolean(),
+  sendNotifications: external_exports.boolean()
+}).strict();
+var WORKSPACE_PERMISSION_KEYS = [
+  "createEvents",
+  "editSetup",
+  "deleteEvents",
+  "controlLive",
+  "moderateChat",
+  "startSession",
+  "viewAnalytics",
+  "downloadReports",
+  "sendNotifications"
+];
+var eventIdField = external_exports.string().min(1).describe("OKO event document id, for example KJsAku48821hB4PXTW0S.");
+var limitField = (max = MAX_LIST_LIMIT, defaultValue = DEFAULT_LIST_LIMIT) => external_exports.number().int().min(1).max(max).default(defaultValue).describe(`Maximum items to return, 1-${max}.`);
+var cursorField = external_exports.string().min(1).optional().describe("Cursor returned as nextCursor by the previous page.");
+function toolDescription({ summary, args = [], returns, examples = [], notes = [], exampleCall }) {
+  return [
+    summary,
+    args.length ? `Args:
+${args.map((item) => `- ${item}`).join("\n")}` : "",
+    `Returns:
+- ${returns}`,
+    exampleCall ? `Example call (arguments JSON):
+${JSON.stringify(exampleCall)}` : "",
+    examples.length ? `Examples:
+${examples.map((item) => `- ${item}`).join("\n")}` : "",
+    notes.length ? `Notes:
+${notes.map((item) => `- ${item}`).join("\n")}` : ""
+  ].filter(Boolean).join("\n\n");
 }
-var REPORT_QUALITY_CAVEAT_TEXT = {
-  baselineMissing: "The session baseline was not saved: every figure below is counted from zero and includes everything the event accumulated before this broadcast.",
-  startTimeUnknown: "The broadcast start time was not saved: the report is stamped with the moment it ended and its duration reads zero.",
-  watchTimeUnmeasured: "Watch time was not measured: the engagement snapshot could not be read.",
-  watchTimeUncapped: "Watch time is not capped by the broadcast length \u2014 it is unknown, so nothing vouches for the total, average and median times."
+
+// build/tools/account.js
+var SCOPE_UNLOCKS = {
+  "events:read": "reading events, setup, and validation",
+  "events:write": "creating, editing, duplicating events and configuring blocks",
+  "events:delete": "moving events to trash and deleting them permanently",
+  "setup:write": "image uploads and setup-only changes",
+  "analytics:read": "analytics, sessions, and reports",
+  "analytics:write": "starting, ending, and repairing analytics sessions",
+  "live:control": "live block visibility, live badge, viewer refresh",
+  "chat:write": "sending organizer chat messages",
+  "chat:moderate": "chat mode, moderation, bans and mutes",
+  "telegram:write": "claiming channels and publishing Telegram posts",
+  "workspace:read": "listing workspaces, members, invites, notifications",
+  "workspace:write": "workspace management, invites, profile edits",
+  "leads:read": "reading and exporting leads"
 };
-function sessionQualityWarnings(dataQuality) {
-  return reportQualityCaveats(dataQuality).map((caveat) => REPORT_QUALITY_CAVEAT_TEXT[caveat]);
-}
-function sessionReportMarkdown({ eventId, event, sessionId, session }) {
-  const lines = [
-    `# OKO session report`,
-    "",
-    `Event: ${safeString(event.title, eventId)}`,
-    `Event URL: ${eventUrl(eventId)}`,
-    `Report URL: ${sessionReportUrl(eventId, sessionId)}`,
-    `Session: ${sessionId}`,
-    "",
-    "## Timing",
-    markdownMetric("Started", formatDateTime(session.startedAt)),
-    markdownMetric("Ended", formatDateTime(session.endedAt)),
-    markdownMetric("Duration", formatSeconds(session.durationSec)),
-    "",
-    "## Audience",
-    markdownMetric("Peak viewers", session.peakViewers),
-    markdownMetric("Unique visitors", session.uniqueVisitors),
-    markdownMetric("Views", session.viewCount),
-    markdownMetric("Average watch time", formatSeconds(session.avgTimeSec)),
-    markdownMetric("Median watch time", formatSeconds(session.medianTimeSec)),
-    "",
-    "## Engagement",
-    markdownMetric("Chat messages", session.chatMessages),
-    markdownMetric("Banner impressions", session.bannerImpressions),
-    markdownMetric("Banner clicks", session.bannerClicks),
-    markdownMetric("Banner CTR", session.bannerCtr, session.bannerCtr == null ? "" : "%"),
-    markdownMetric("CTA clicks", session.ctaClicks),
-    markdownMetric("Cards clicks", session.cardsClicks)
-  ];
-  const warnings = sessionQualityWarnings(session.dataQuality);
-  if (warnings.length > 0) {
-    lines.push("", "## What this report did not measure");
-    for (const warning of warnings)
-      lines.push(`- ${warning}`);
-  }
-  return lines.join("\n");
+function presetsWithScope(scope) {
+  return Object.entries(MCP_PRESETS).filter(([, scopes]) => scopes.includes(scope)).map(([name7]) => name7);
 }
-var TELEGRAM_COPYABLE_KEYS = ["enabled", "channelIds", "autoReminder"];
-function copyableTelegram(source) {
-  const out = {};
-  for (const key of TELEGRAM_COPYABLE_KEYS) {
-    if (source[key] !== void 0)
-      out[key] = source[key];
-  }
-  return out;
+function registerAccountTools(server2) {
+  server2.registerTool("oko_connection_status", {
+    title: "Check OKO connection",
+    description: toolDescription({
+      summary: "Check whether this MCP process is connected to an active OKO organizer account.",
+      returns: "A factual connection status, product boundary, and setup links. This tool works without OKO_API_KEY and never changes data.",
+      examples: [
+        "Use when an OKO request is made and the organizer connection state is unknown.",
+        "Use after installing the package without a key to explain the exact next setup step."
+      ],
+      notes: ["This tool does not create accounts, invitations, or API keys."]
+    }),
+    outputSchema: connectionStatusOutputSchema,
+    annotations: readOnlyTool
+  }, async () => textResult(await getConnectionStatus()));
+  server2.registerTool("oko_whoami", {
+    title: "Who am I",
+    description: toolDescription({
+      summary: "Return the authenticated OKO organizer uid, granted MCP scopes, missing scopes, and the client update status.",
+      returns: "uid, scopes granted by OKO API key exchange, missingScopes with the tools they unlock, and update (current vs latest published client version). Use this before write workflows to check permissions.",
+      examples: ['Use when starting a session: call first, then choose tools allowed by "scopes". If update.updateAvailable is true, tell the organizer how to update before continuing.']
+    }),
+    outputSchema: {
+      uid: external_exports.string(),
+      scopes: external_exports.array(external_exports.string()),
+      missingScopes: external_exports.array(external_exports.object({ scope: external_exports.string(), unlocks: external_exports.string(), presets: external_exports.array(external_exports.string()) })),
+      update: updateStatusSchema
+    },
+    annotations: readOnlyTool
+  }, async () => {
+    const auth2 = await authed([]);
+    const scopes = currentScopes();
+    return textResult({
+      uid: auth2.uid,
+      scopes,
+      missingScopes: MCP_SCOPES.filter((scope) => !scopes.includes(scope)).map((scope) => ({
+        scope,
+        unlocks: SCOPE_UNLOCKS[scope] ?? "",
+        presets: presetsWithScope(scope)
+      })),
+      update: updateStatus()
+    });
+  });
+  server2.registerTool("oko_update_profile", {
+    title: "Update profile",
+    description: toolDescription({
+      summary: "Update the authenticated organizer profile fields used by OKO UI.",
+      args: [
+        "displayName: optional display name, max 40 chars; null clears it.",
+        "timezone: optional IANA timezone such as Europe/Moscow or UTC."
+      ],
+      returns: "uid, updated field names, and the resulting profile snapshot.",
+      examples: ["Use when the organizer asks to change their visible OKO name or timezone."],
+      notes: ["Edits the organizer profile that owns this key. Requires workspace:write: the key holder is not necessarily the organizer, so a read-only key must not rewrite the owner's name, avatar or timezone."]
+    }),
+    inputSchema: {
+      displayName: profileDisplayNameSchema.optional().describe("Display name, max 40 chars. Null clears it."),
+      timezone: timezoneSchema.optional().describe("IANA timezone, for example Europe/Moscow or UTC.")
+    },
+    outputSchema: profileOutputSchema,
+    annotations: idempotentWriteTool
+  }, async ({ displayName, timezone }) => {
+    const { uid } = await authed(["workspace:write"]);
+    const patch = { updatedAt: serverTimestamp2() };
+    if (displayName !== void 0)
+      patch.displayName = displayName?.trim() || null;
+    if (timezone !== void 0)
+      patch.timezone = timezone.trim();
+    const updated = Object.keys(patch).filter((key) => key !== "updatedAt");
+    if (updated.length === 0)
+      throw new Error("Provide displayName and/or timezone.");
+    const profileRef = doc(firestore, "userProfiles", uid);
+    await setDoc(profileRef, patch, { merge: true });
+    const profileSnap = await getDoc(profileRef);
+    return textResult({ uid, updated, profile: profileSnap.exists() ? serialize(profileSnap.data()) : {} });
+  });
 }
 
 // build/tools/workspaceAccess.js
@@ -118453,6 +118473,35 @@ function livePermissionRejectionResult(toolName, args) {
     isError: true
   };
 }
+function mirrorOutOfSyncRejectionResult(toolName, args, mode) {
+  const ids = idsFromArgs(args);
+  const uid = currentUid();
+  const at = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    ...textResult({
+      errorCode: "MIRROR_OUT_OF_SYNC",
+      tool: toolName,
+      ...ids,
+      message: `OKO refused this write, but the "${mode}" right it needs was confirmed for this organizer moments earlier, in this same call, from the Firestore grant. The refusal did not come from that grant: it came from a different copy of the same right \u2014 the realtime-database mirror the rule actually checks \u2014 which a background function updates asynchronously after a rights change (adding a workspace member, moving the event, restoring it from the trash) and which can briefly lag behind. Nothing was changed.`,
+      whatToDo: [
+        "Wait a few seconds and repeat the exact same call: the mirror normally catches up within seconds of the change that granted this right.",
+        "Do not tell the organizer they lack the permission, and do not send them to change workspace access \u2014 the grant was just confirmed; there is nothing to grant.",
+        `If the same call still refuses after several minutes, this is a platform inconsistency, not a missing permission: ask the organizer to report it at ${REPORT_URL} with the "report" block below.`
+      ],
+      report: { tool: toolName, ...ids, uid, at }
+    }),
+    isError: true
+  };
+}
+async function confirmedGrantWrite(toolName, args, mode, action) {
+  try {
+    return await action();
+  } catch (error3) {
+    if (!isRtdbPermissionDenied(error3))
+      throw error3;
+    throw new ToolRefusal(mirrorOutOfSyncRejectionResult(toolName, args, mode));
+  }
+}
 function platformRejectionResult(toolName, args, readOnly) {
   const ids = idsFromArgs(args);
   const at = (/* @__PURE__ */ new Date()).toISOString();
@@ -118592,7 +118641,7 @@ function chatSendRefusalResult(eventId, facts) {
       message: "OKO refused the message because the event is in the trash, and a trashed event's chat accepts no messages. This is the event's state, not a missing permission. Nothing was sent.",
       whatToDo: [
         "Tell the organizer the event is in the trash.",
-        "If they want its chat back, restore it with oko_restore_event (after their confirmation), then send the message again.",
+        "Restoring needs the event owner or a workspace member with the deleteEvents permission (`deleters`) on this event; if that's the organizer behind this key, call oko_restore_event after their confirmation, then send the message again.",
         "Do not retry as is: the answer will not change while the event is in the trash."
       ]
     });
@@ -118620,8 +118669,10 @@ function chatSendRefusalResult(eventId, facts) {
     });
   }
   const exempt = EXEMPT_ROLES.has(role);
-  const ruledOut = ["The event is not in the trash."];
-  const mayBeCausedBy = [];
+  const ruledOut = [];
+  const mayBeCausedBy = [
+    "A lagging trash mirror: Firestore, read before the write, has this event out of the trash, so the trash is likely not the cause \u2014 but not certainly, because the chat rule checks a separate RTDB mirror this key cannot re-read here, and that mirror can lag Firestore by hundreds of milliseconds right after a trash or a restore under concurrent access. If this is the cause, it clears itself: wait about a minute and send the message again."
+  ];
   if (modeReading.read === "ok") {
     ruledOut.push(`A paused chat: the chat mode, re-read right after the refusal, is ${modeReading.value === null || modeReading.value === void 0 ? "not set, which the chat treats as open" : JSON.stringify(modeReading.value)}.`, "Access to this event's chat: the same key could read the chat state, which the same account, key and access check guards.");
   } else {
@@ -118641,6 +118692,7 @@ function chatSendRefusalResult(eventId, facts) {
     mayBeCausedBy,
     whatToDo: [
       "Tell the organizer the chat refused the message, that the cause could not be established, and name the remaining possibilities as possibilities.",
+      "If the event was trashed or restored in roughly the last minute, wait about a minute and send the message again: the chat's copy of that state can lag Firestore briefly.",
       ...exempt ? [] : [
         "A moderator or the event owner can check this organizer for a mute or a ban in the chat panel and lift it (oko_unmute_user / oko_unban_user). If the text contains a link, the organizer may send it without the link, or a moderator can allow viewer links (oko_set_chat_settings allowViewerLinks=true)."
       ],
@@ -118757,7 +118809,7 @@ function registerChatTools(server2) {
     const { uid } = await authed(["chat:moderate"]);
     await readEvent(eventId, uid, "moderate");
     requireConfirm(confirm, "oko_delete_chat_message", { eventId, messageId });
-    await set(ref(chatRtdb, `mod/deleted/${eventId}/${messageId}`), { deletedAt: serverTimestamp(), ts: await serverNowMs(), by: uid, reason: "manual" });
+    await confirmedGrantWrite("oko_delete_chat_message", { eventId }, "moderate", async () => set(ref(chatRtdb, `mod/deleted/${eventId}/${messageId}`), { deletedAt: serverTimestamp(), ts: await serverNowMs(), by: uid, reason: "manual" }));
     return textResult({ eventId, messageId, deleted: true });
   });
   server2.registerTool("oko_mute_user", {
@@ -118775,7 +118827,7 @@ function registerChatTools(server2) {
     const actor = await authed(["chat:moderate"]);
     await readEvent(eventId, actor.uid, "moderate");
     requireConfirm(confirm, "oko_mute_user", { eventId, targetUid, minutes });
-    await set(ref(chatRtdb, `mutes/${eventId}/${targetUid}`), { until: await serverNowMs() + minutes * 6e4, by: actor.uid, reason: "manual" });
+    await confirmedGrantWrite("oko_mute_user", { eventId }, "moderate", async () => set(ref(chatRtdb, `mutes/${eventId}/${targetUid}`), { until: await serverNowMs() + minutes * 6e4, by: actor.uid, reason: "manual" }));
     return textResult({ eventId, targetUid, mutedMinutes: minutes });
   });
   server2.registerTool("oko_ban_user", {
@@ -118793,7 +118845,7 @@ function registerChatTools(server2) {
     const actor = await authed(["chat:moderate"]);
     await readEvent(eventId, actor.uid, "moderate");
     requireConfirm(confirm, "oko_ban_user", { eventId, targetUid });
-    await set(ref(chatRtdb, `bans/${eventId}/${targetUid}`), true);
+    await confirmedGrantWrite("oko_ban_user", { eventId }, "moderate", () => set(ref(chatRtdb, `bans/${eventId}/${targetUid}`), true));
     const messagesSnap = await get(query(ref(chatRtdb, `messages/${eventId}`), limitToLast(500)));
     const messages = messagesSnap.val() ?? {};
     const deletes = {};
@@ -118802,8 +118854,9 @@ function registerChatTools(server2) {
       if (message.uid === targetUid)
         deletes[`mod/deleted/${eventId}/${messageId}`] = { deletedAt: serverTimestamp(), ts: nowMs, by: actor.uid, reason: "ban" };
     }
-    if (Object.keys(deletes).length > 0)
-      await update(ref(chatRtdb), deletes);
+    if (Object.keys(deletes).length > 0) {
+      await confirmedGrantWrite("oko_ban_user", { eventId }, "moderate", () => update(ref(chatRtdb), deletes));
+    }
     return textResult({ eventId, targetUid, banned: true, deletedMessages: Object.keys(deletes).length });
   });
   server2.registerTool("oko_unmute_user", {
@@ -118821,7 +118874,7 @@ function registerChatTools(server2) {
     const actor = await authed(["chat:moderate"]);
     await readEvent(eventId, actor.uid, "moderate");
     requireConfirm(confirm, "oko_unmute_user", { eventId, targetUid });
-    await remove(ref(chatRtdb, `mutes/${eventId}/${targetUid}`));
+    await confirmedGrantWrite("oko_unmute_user", { eventId }, "moderate", () => remove(ref(chatRtdb, `mutes/${eventId}/${targetUid}`)));
     return textResult({ eventId, targetUid, unmuted: true });
   });
   server2.registerTool("oko_unban_user", {
@@ -118839,7 +118892,7 @@ function registerChatTools(server2) {
     const actor = await authed(["chat:moderate"]);
     await readEvent(eventId, actor.uid, "moderate");
     requireConfirm(confirm, "oko_unban_user", { eventId, targetUid });
-    await remove(ref(chatRtdb, `bans/${eventId}/${targetUid}`));
+    await confirmedGrantWrite("oko_unban_user", { eventId }, "moderate", () => remove(ref(chatRtdb, `bans/${eventId}/${targetUid}`)));
     return textResult({ eventId, targetUid, unbanned: true });
   });
   server2.registerTool("oko_set_chat_settings", {
@@ -118873,7 +118926,7 @@ function registerChatTools(server2) {
     if (Object.keys(patch).length === 0) {
       throw new Error("Provide slowModeMs and/or automodEnabled to change chat settings.");
     }
-    await update(ref(chatRtdb), patch);
+    await confirmedGrantWrite("oko_set_chat_settings", { eventId }, "moderate", () => update(ref(chatRtdb), patch));
     return textResult({ eventId, updated: Object.keys(patch) });
   });
 }
@@ -120352,14 +120405,11 @@ function registerLiveTools(server2) {
       placeholder: "placeholderVisible"
     };
     if (block === "chat") {
-      await writeChatControl(eventId, visible === null ? null : visible ? "public" : "off");
+      await confirmedGrantWrite("oko_set_block_visibility", { eventId, block }, "live", () => writeChatControl(eventId, visible === null ? null : visible ? "public" : "off"));
       return textResult({ eventId, block, visible, hints });
     }
     const target = ref(rtdb, `events/${eventId}/ctrl/${paths[block]}`);
-    if (visible === null)
-      await remove(target);
-    else
-      await set(target, visible);
+    await confirmedGrantWrite("oko_set_block_visibility", { eventId, block }, "live", () => visible === null ? remove(target) : set(target, visible));
     return textResult({ eventId, block, visible, hints });
   });
   server2.registerTool("oko_refresh_viewers", {
@@ -120367,7 +120417,7 @@ function registerLiveTools(server2) {
     description: toolDescription({
       summary: "Refresh what viewers see: recount the online viewers and make open event pages re-read their config.",
       args: ["eventId: event whose viewers should refresh.", "confirm: must be true."],
-      returns: "eventId, refreshed=true, and online \u2014 the recounted number of viewers present.",
+      returns: "eventId, refreshed=true, online \u2014 the recounted number of viewers present, and analyticsPaused \u2014 true/false, or null when the platform's kill switch could not be read.",
       examples: ["Use after a setup/live change if viewers should reload state immediately.", "Use when the online counter looks wrong: it is recounted from the actual presence nodes."]
     }),
     inputSchema: { eventId: eventIdField, confirm: external_exports.boolean().optional().describe("Required true to refresh connected viewers.") },
@@ -120378,12 +120428,20 @@ function registerLiveTools(server2) {
     await readEvent(eventId, uid, "live");
     requireConfirm(confirm, "oko_refresh_viewers", { eventId });
     const resyncPresence = httpsCallable(functions, "resyncPresence");
-    const [resynced] = await Promise.all([
+    const [resynced, , killSwitch] = await Promise.all([
       resyncPresence({ eventId }),
-      runTransaction(ref(rtdb, `events/${eventId}/ctrl/refreshTick`), (current) => (current ?? 0) + 1)
+      confirmedGrantWrite("oko_refresh_viewers", { eventId }, "live", () => runTransaction(ref(rtdb, `events/${eventId}/ctrl/refreshTick`), (current) => (current ?? 0) + 1)),
+      readKillSwitch(eventId)
     ]);
     const online = typeof resynced.data?.online === "number" ? resynced.data.online : null;
-    return textResult({ eventId, refreshed: true, online });
+    const killSwitchNote = killSwitchHint(killSwitch);
+    return textResult({
+      eventId,
+      refreshed: true,
+      online,
+      analyticsPaused: killSwitchFlag(killSwitch),
+      ...killSwitchNote ? { hints: [killSwitchNote] } : {}
+    });
   });
   server2.registerTool("oko_set_live_badge", {
     title: "Set live badge",
@@ -120423,7 +120481,7 @@ function registerLiveTools(server2) {
         storedDuration = stored.durationMinutes;
     }
     const value = { mode, durationMinutes: durationMinutes ?? storedDuration ?? 120 };
-    await set(badgeRef, value);
+    await confirmedGrantWrite("oko_set_live_badge", { eventId }, "live", () => set(badgeRef, value));
     const hints = mode === "manual" ? ["Manual mode has no automatic end: the badge stays visible until this tool changes the mode again. durationMinutes is stored but has no effect in manual mode \u2014 only mode=schedule uses it as a time window."] : void 0;
     return textResult({ eventId, ...value, ...hints ? { hints } : {} });
   });
@@ -120459,7 +120517,7 @@ function registerLiveTools(server2) {
     const { uid } = await authed(["live:control"]);
     await readEvent(eventId, uid, "live");
     requireConfirm(confirm, "oko_set_chat_mode", { eventId, mode });
-    await writeChatControl(eventId, mode);
+    await confirmedGrantWrite("oko_set_chat_mode", { eventId }, "live", () => writeChatControl(eventId, mode));
     return textResult({ eventId, mode });
   });
   server2.registerTool("oko_force_viewer_reload", {
@@ -120578,12 +120636,40 @@ function registerNotificationTools(server2) {
 
 // build/tools/publication.js
 var SERVER_REFUSAL_CODES = /* @__PURE__ */ new Set(["ENTITLEMENT_REQUIRED", "INSUFFICIENT_TOKENS"]);
-function isToolResult(value) {
-  return Array.isArray(value.content);
-}
 function refusal2(eventId, body) {
   return { ...textResult({ tool: "oko_publish_event", eventId, ...body }), isError: true };
 }
+function editPermissionRefusal(eventId) {
+  return refusal2(eventId, {
+    errorCode: "EDIT_PERMISSION_REQUIRED",
+    message: "Publishing needs the right to edit this event's setup, and the organizer behind this key does not hold it. Nothing was charged.",
+    whatToDo: [
+      "Ask the event owner to grant this organizer the edit-setup permission in the event's workspace (OKO cabinet \u2192 workspace \u2192 members), then repeat.",
+      "Do not retry as is: rights do not change between attempts."
+    ]
+  });
+}
+function eventInTrashRefusal(eventId) {
+  return refusal2(eventId, {
+    errorCode: "EVENT_IN_TRASH",
+    message: "The event is in the trash. Nothing was charged.",
+    whatToDo: [
+      "Restoring needs the event owner or a workspace member with the deleteEvents permission (`deleters`) on this event; if that's the organizer behind this key, call oko_restore_event after their confirmation, then ask for the bill again.",
+      "Otherwise, ask the event owner or that workspace member to restore it, then ask for the bill again."
+    ]
+  });
+}
+function readEventRefusal(eventId, error3) {
+  if (!(error3 instanceof Error))
+    return null;
+  if (error3.message === "Event does not grant edit access to this organizer.") {
+    return editPermissionRefusal(eventId);
+  }
+  if (error3.message === "Event is in trash. Restore it before making changes or live actions.") {
+    return eventInTrashRefusal(eventId);
+  }
+  return null;
+}
 function publicationRefusalResult(eventId, error3) {
   if (!error3 || typeof error3 !== "object")
     return null;
@@ -120618,14 +120704,7 @@ function publicationRefusalResult(eventId, error3) {
     });
   }
   if (code === "functions/permission-denied" && /editSetup/.test(text)) {
-    return refusal2(eventId, {
-      errorCode: "EDIT_PERMISSION_REQUIRED",
-      message: "Publishing needs the right to edit this event's setup, and the organizer behind this key does not hold it. Nothing was charged.",
-      whatToDo: [
-        "Ask the event owner to grant this organizer the edit-setup permission in the event's workspace (OKO cabinet \u2192 workspace \u2192 members), then repeat.",
-        "Do not retry as is: rights do not change between attempts."
-      ]
-    });
+    return editPermissionRefusal(eventId);
   }
   if (code === "functions/not-found") {
     return refusal2(eventId, {
@@ -120635,11 +120714,7 @@ function publicationRefusalResult(eventId, error3) {
     });
   }
   if (code === "functions/failed-precondition" && /trash/i.test(text)) {
-    return refusal2(eventId, {
-      errorCode: "EVENT_IN_TRASH",
-      message: "The event is in the trash. Nothing was charged.",
-      whatToDo: ["Restore it with oko_restore_event first, then ask for the bill again."]
-    });
+    return eventInTrashRefusal(eventId);
   }
   return null;
 }
@@ -120682,7 +120757,12 @@ function registerPublicationTools(server2) {
     annotations: idempotentWriteTool
   }, async ({ eventId, controlRoom, confirm }) => {
     const { uid } = await authed(["events:write"]);
-    const event = await readEvent(eventId, uid, "edit");
+    const event = await readEvent(eventId, uid, "edit").catch((error3) => {
+      const named = readEventRefusal(eventId, error3);
+      if (named)
+        throw new ToolRefusal(named);
+      throw error3;
+    });
     const title = safeString(event.title);
     const publish = httpsCallable(functions, "publishEvent");
     const call2 = async (confirmed) => {
@@ -120691,19 +120771,17 @@ function registerPublicationTools(server2) {
       } catch (error3) {
         const named = publicationRefusalResult(eventId, error3);
         if (named)
-          return named;
+          throw new ToolRefusal(named);
         throw error3;
       }
     };
     const published = (data) => textResult({ ...data, title, ...eventLinks(eventId), nextStep: nextStep(data) });
     if (confirm !== true) {
       const quote = await call2(false);
-      if (isToolResult(quote))
-        return quote;
       if (quote.status === "published")
         return published(quote);
       if (quote.refusal && typeof quote.refusal === "object") {
-        return refusal2(eventId, { ...quote.refusal, invoice: quote.invoice ?? null });
+        throw new ToolRefusal(refusal2(eventId, { ...quote.refusal, invoice: quote.invoice ?? null }));
       }
       requireConfirm(confirm, "oko_publish_event", {
         eventId,
@@ -120717,8 +120795,6 @@ function registerPublicationTools(server2) {
       });
     }
     const outcome = await call2(true);
-    if (isToolResult(outcome))
-      return outcome;
     return published(outcome);
   });
 }