@okostream/mcp 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.5.2 - 2026-07-10
+
+- Fixed webinar create/duplicate output schemas so successful writes cannot be reported as protocol failures.
+- Made Firestore event creation compensate automatically when the required RTDB mirror fails.
+- Removed a stale RTDB mirror rewrite from metadata updates.
+- Routed event deletion through an authorized server callable that cleans Firestore subcollections, both RTDB instances, Storage, participants, active sessions, and scheduled Telegram posts.
+- Added a repeatable production smoke workflow against an exact published npm version.
+
+## 0.5.1 - 2026-07-10
+
+- Replaced hand-maintained remote-image IP ranges with a tested public-unicast policy covering IPv4, IPv6, mapped, reserved, documentation, benchmark, multicast, and private address classes.
+
 ## 0.5.0 - 2026-07-10
 
 - Isolated every API key behind a synthetic Firebase identity with immediate revocation across Firestore, main RTDB, and chat RTDB.

package/dist/networkPolicy.js

@@ -0,0 +1,18 @@
+import ipaddr from "ipaddr.js";
+export function normalizeIpLiteralHostname(hostname) {
+    return hostname.startsWith("[") && hostname.endsWith("]")
+        ? hostname.slice(1, -1)
+        : hostname;
+}
+export function ipLiteralFamily(address) {
+    const normalized = normalizeIpLiteralHostname(address);
+    if (!ipaddr.isValid(normalized))
+        return 0;
+    return ipaddr.parse(normalized).kind() === "ipv4" ? 4 : 6;
+}
+export function isPublicUnicastAddress(address) {
+    const normalized = normalizeIpLiteralHostname(address);
+    if (!ipaddr.isValid(normalized))
+        return false;
+    return ipaddr.parse(normalized).range() === "unicast";
+}

package/dist/server.js

@@ -23,7 +23,7 @@ if (process.argv.includes("--help")) {
 }
 const server = new McpServer({
     name: "oko-mcp-server",
-    version: "0.5.0",
+    version: "0.5.2",
 }, {
     instructions: OKO_MCP_INSTRUCTIONS,
 });

package/dist/tools.js

@@ -1,6 +1,5 @@
 import { lookup } from "node:dns/promises";
 import { stat, readFile, realpath } from "node:fs/promises";
-import { isIP } from "node:net";
 import { homedir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -12,6 +11,7 @@ import { get, endBefore, limitToLast, orderByKey, push, query as dbQuery, ref, r
 import { httpsCallable } from "firebase/functions";
 import { ensureAuth, currentScopes } from "./auth.js";
 import { env } from "./env.js";
+import { ipLiteralFamily, isPublicUnicastAddress, normalizeIpLiteralHostname, } from "./networkPolicy.js";
 import { chatRtdb, firestore, functions, rtdb } from "./firebase.js";
 import { csvCell, requireConfirm, safeString, serialize, textResult } from "./utils.js";
 import { detectAndNormalize, extractIframeSrc } from "./videoUrl.js";
@@ -77,11 +77,21 @@ const updateOutputSchema = z.object({
     eventId: z.string().optional(),
     updated: z.array(z.string()).optional(),
 }).passthrough();
-const createWebinarOutputSchema = {
-    id: z.string(),
+const eventLinksOutputShape = {
     url: z.string().url(),
-    workspaceId: z.string(),
+    setupUrl: z.string().url(),
+    analyticsUrl: z.string().url(),
+    registrationUrl: z.string().url(),
+    loginUrl: z.string().url(),
+    nmoRegistrationUrl: z.string().url().optional(),
+    nmoLoginUrl: z.string().url().optional(),
 };
+const createWebinarOutputSchema = z.object({
+    id: z.string(),
+    workspaceId: z.string(),
+    sourceEventId: z.string().optional(),
+    ...eventLinksOutputShape,
+}).passthrough();
 const cursorMetaSchema = {
     count: z.number().int().nonnegative(),
     limit: z.number().int().positive(),
@@ -100,7 +110,7 @@ const eventsOutputSchema = z.object({
 }).passthrough();
 const eventOutputSchema = z.object({
     id: z.string(),
-    url: z.string().url(),
+    ...eventLinksOutputShape,
 }).passthrough();
 const liveStateOutputSchema = z.object({
     eventId: z.string(),
@@ -372,33 +382,6 @@ function isBlockedHostname(hostname) {
     const host = hostname.toLowerCase();
     return host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local");
 }
-function isBlockedIp(address) {
-    const normalized = address.toLowerCase().startsWith("::ffff:")
-        ? address.slice(7)
-        : address;
-    const version = isIP(normalized);
-    if (version === 4) {
-        const [a = -1, b = -1] = normalized.split(".").map((part) => Number(part));
-        return a === 0
-            || a === 10
-            || a === 127
-            || (a === 100 && b >= 64 && b <= 127)
-            || (a === 169 && b === 254)
-            || (a === 172 && b >= 16 && b <= 31)
-            || (a === 192 && b === 168)
-            || (a === 198 && (b === 18 || b === 19))
-            || a >= 224;
-    }
-    if (version === 6) {
-        return normalized === "::"
-            || normalized === "::1"
-            || normalized.startsWith("fc")
-            || normalized.startsWith("fd")
-            || normalized.startsWith("fe80:")
-            || normalized.startsWith("ff");
-    }
-    return false;
-}
 async function resolveRemoteImageAddress(url) {
     if (url.protocol !== "https:") {
         throw new Error("Image URL must use https://.");
@@ -409,15 +392,17 @@ async function resolveRemoteImageAddress(url) {
     if (isBlockedHostname(url.hostname)) {
         throw new Error("Image URL host is not allowed. Use a public HTTPS image URL.");
     }
-    if (isIP(url.hostname)) {
-        if (isBlockedIp(url.hostname)) {
+    const literalAddress = normalizeIpLiteralHostname(url.hostname);
+    const literalFamily = ipLiteralFamily(literalAddress);
+    if (literalFamily !== 0) {
+        if (!isPublicUnicastAddress(literalAddress)) {
             throw new Error("Image URL points to a private/local IP address, which is not allowed.");
         }
-        return { address: url.hostname, family: isIP(url.hostname) };
+        return { address: literalAddress, family: literalFamily };
     }
     const addresses = await lookup(url.hostname, { all: true });
-    if (addresses.length === 0 || addresses.some((item) => isBlockedIp(item.address))) {
-        throw new Error("Image URL resolves to a private/local IP address, which is not allowed.");
+    if (addresses.length === 0 || addresses.some((item) => !isPublicUnicastAddress(item.address))) {
+        throw new Error("Image URL resolves to a non-public IP address, which is not allowed.");
     }
     const selected = addresses[0];
     if (!selected || (selected.family !== 4 && selected.family !== 6)) {
@@ -1124,6 +1109,22 @@ function initialEventAccess(uid) {
         notificationSenders: [uid],
     };
 }
+async function addEventWithRtdbMirror(uid, workspaceId, eventData) {
+    const eventRef = await addDoc(collection(firestore, "events"), eventData);
+    try {
+        await update(ref(rtdb, `events/${eventRef.id}`), { ownerId: uid, workspaceId });
+    }
+    catch (error) {
+        try {
+            await deleteDoc(eventRef);
+        }
+        catch (rollbackError) {
+            throw new AggregateError([error, rollbackError], `RTDB mirror failed for event ${eventRef.id}, and Firestore rollback also failed.`);
+        }
+        throw error;
+    }
+    return eventRef;
+}
 async function assertCanCreateInWorkspace(uid, workspaceId) {
     if (workspaceId === uid)
         return;
@@ -2065,7 +2066,7 @@ export function registerTools(server) {
         const workspaceId = args.workspaceId ?? uid;
         await assertCanCreateInWorkspace(uid, workspaceId);
         const video = normalizeVideo(args.videoUrl);
-        const docRef = await addDoc(collection(firestore, "events"), {
+        const docRef = await addEventWithRtdbMirror(uid, workspaceId, {
             ownerId: uid,
             workspaceId,
             ...initialEventAccess(uid),
@@ -2083,10 +2084,6 @@ export function registerTools(server) {
                 promoBanner: { enabled: false, text: "", link: "", visibility: "always" },
             },
         });
-        await update(ref(rtdb, `events/${docRef.id}`), {
-            ownerId: uid,
-            workspaceId,
-        });
         return textResult({ id: docRef.id, ...eventLinks(docRef.id), workspaceId });
     });
     server.registerTool("oko_update_event", {
@@ -2121,7 +2118,7 @@ export function registerTools(server) {
         if (requiredScopes.size === 0)
             throw new Error("Provide at least one field to update.");
         const { uid } = await authed([...requiredScopes]);
-        const data = await readEvent(args.eventId, uid, "edit");
+        await readEvent(args.eventId, uid, "edit");
         const patch = {};
         if (args.title !== undefined)
             patch.title = args.title.trim();
@@ -2139,10 +2136,6 @@ export function registerTools(server) {
         if (args.pinned !== undefined)
             patch.pinned = args.pinned;
         await updateDoc(doc(firestore, "events", args.eventId), patch);
-        await update(ref(rtdb, `events/${args.eventId}`), {
-            ownerId: safeString(data.ownerId, uid),
-            workspaceId: safeString(data.workspaceId, uid),
-        });
         return textResult({ id: args.eventId, updated: Object.keys(patch) });
     });
     server.registerTool("oko_configure_blocks", {
@@ -2524,11 +2517,11 @@ export function registerTools(server) {
     server.registerTool("oko_delete_event", {
         title: "Delete event",
         description: toolDescription({
-            summary: "Delete an OKO event document.",
+            summary: "Delete an OKO event and its associated Firestore, RTDB, chat, Storage, participant, and scheduled-post data.",
             args: ["eventId: event to delete.", "confirm: must be true."],
-            returns: "deleted event id.",
+            returns: "deleted event id and cross-store cleanup counts.",
             examples: ["Use only after the user explicitly confirms the exact event title/id."],
-            notes: ["Destructive. Does not control stream state; it deletes the event record."],
+            notes: ["Destructive. The server validates the current per-event delete capability and performs idempotent cross-store cleanup."],
         }),
         inputSchema: { eventId: eventIdField, confirm: z.boolean().optional().describe("Required true for deletion.") },
         outputSchema: z.object({ deleted: z.string() }).passthrough(),
@@ -2537,8 +2530,9 @@ export function registerTools(server) {
         const { uid } = await authed(["events:delete"]);
         const data = await readEvent(eventId, uid, "delete");
         requireConfirm(confirm, "oko_delete_event", { eventId, title: data.title });
-        await deleteDoc(doc(firestore, "events", eventId));
-        return textResult({ deleted: eventId });
+        const deleteEvent = httpsCallable(functions, "deleteEventCompletely");
+        const result = await deleteEvent({ eventId });
+        return textResult(result.data);
     });
     server.registerTool("oko_duplicate_event", {
         title: "Duplicate event",
@@ -2560,7 +2554,7 @@ export function registerTools(server) {
         const source = await readEvent(eventId, uid, "read");
         const workspaceId = targetWorkspaceId ?? safeString(source.workspaceId, uid);
         await assertCanCreateInWorkspace(uid, workspaceId);
-        const newRef = await addDoc(collection(firestore, "events"), {
+        const newRef = await addEventWithRtdbMirror(uid, workspaceId, {
             ownerId: uid,
             workspaceId,
             ...initialEventAccess(uid),
@@ -2576,7 +2570,6 @@ export function registerTools(server) {
             ...(source.nmoCriteria && typeof source.nmoCriteria === "object" ? { nmoCriteria: source.nmoCriteria } : {}),
             ...(source.nmoExtraFields && typeof source.nmoExtraFields === "object" ? { nmoExtraFields: source.nmoExtraFields } : {}),
         });
-        await update(ref(rtdb, `events/${newRef.id}`), { ownerId: uid, workspaceId });
         return textResult({ id: newRef.id, sourceEventId: eventId, workspaceId, ...eventLinks(newRef.id) });
     });
     server.registerTool("oko_move_event", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@okostream/mcp",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "MCP server for managing OKO Stream webinars as an organizer.",
   "license": "UNLICENSED",
   "type": "module",
@@ -26,6 +26,7 @@
     "test": "npm run build && node --test test/*.test.mjs",
     "eval:contract": "npm run build && node eval/contract-eval.mjs",
     "eval:model": "npm run build && node eval/model-eval.mjs",
+    "smoke:prod": "node eval/prod-smoke.mjs",
     "prepublishOnly": "npm run build",
     "start": "node dist/server.js"
   },
@@ -36,6 +37,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.2.3",
     "firebase": "^12.16.0",
+    "ipaddr.js": "2.4.0",
     "sharp": "^0.35.3",
     "undici": "7.28.0",
     "zod": "^3.25.76"