@okostream/mcp 0.7.2 → 0.8.0

package/dist/version.js

@@ -1 +1 @@
-export const OKO_MCP_VERSION = "0.7.2";
+export const OKO_MCP_VERSION = "0.8.0";

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@okostream/mcp",
-  "version": "0.7.2",
+  "version": "0.8.0",
   "description": "Control OKO Stream webinars from Claude, Codex, and other MCP clients.",
   "license": "UNLICENSED",
   "author": {
     "name": "OKO Stream",
     "url": "https://okostream.app"
   },
-  "homepage": "https://okostream.app/app/mcp",
+  "homepage": "https://okostream.app/mcp",
   "keywords": [
     "mcp",
     "model-context-protocol",
@@ -24,18 +24,19 @@
   },
   "files": [
     "dist",
-    "README.md",
-    "CHANGELOG.md"
+    "README.md"
   ],
   "bin": {
     "oko-mcp": "dist/server.js"
   },
   "scripts": {
+    "prebuild": "node ../scripts/generateMcpContract.mjs --check",
     "build": "tsc && node -e \"require('node:fs').chmodSync('dist/server.js', 0o755)\"",
     "test": "npm run build && node --test test/*.test.mjs",
     "eval:contract": "npm run build && node eval/contract-eval.mjs",
     "eval:model": "npm run build && node eval/model-eval.mjs",
     "smoke:prod": "node eval/prod-smoke.mjs",
+    "bundle:mcpb": "node ../scripts/buildMcpBundle.mjs",
     "prepublishOnly": "npm run build",
     "start": "node dist/server.js"
   },
@@ -47,7 +48,6 @@
     "dotenv": "^17.2.3",
     "firebase": "^12.16.0",
     "ipaddr.js": "2.4.0",
-    "sharp": "^0.35.3",
     "undici": "7.28.0",
     "zod": "^3.25.76"
   },

package/CHANGELOG.md

@@ -1,71 +0,0 @@
-# Changelog
-
-## 0.7.2 - 2026-07-23
-
-- Replaced the maintainer-oriented npm README with a concise organizer setup,
-  capability, safety, image-access, and troubleshooting guide.
-- Removed the private repository link and added public homepage, author, and
-  discovery metadata.
-- Disabled local image reads until `OKO_IMAGE_ROOTS` explicitly lists trusted
-  directories.
-- Added the MCP client version to API-key exchange requests so the platform can
-  introduce a controlled minimum-version gate in a separate auth release.
-
-## 0.7.1 - 2026-07-22
-
-- Refreshed transitive dependencies after new npm advisories without changing the MCP tool/resource/prompt surface.
-- Kept the remaining Windows-only static-server advisory below the release threshold; OKO MCP continues to run over stdio.
-
-## 0.7.0 - 2026-07-22
-
-- Routed standard webinar analytics Start/End through the same idempotent server callables used by the dashboard.
-- Added Analytics v3 report fields for deduplicated session visitors, watch time, Geo v2, timeline quality, and cleanup warnings.
-- Made chat counter bookkeeping best-effort after confirmed delivery so a delivered message is never reported as failed.
-- Kept the unfinished NMO special mode on its existing isolated session path.
-
-## 0.6.0 - 2026-07-10
-
-- Replaced legacy profile/workspace Telegram arrays with canonical server-owned channel operations.
-- Added personal Telegram linking, explicit workspace sharing, channel disconnect, and event-scoped channel discovery.
-- Added 30-day event trash, restore, and exact-title permanent deletion tools; retained `oko_delete_event` as a recoverable trash alias.
-- Prevented cancellation of `delivery_unknown` Telegram posts and resolved channels server-side before publication to reduce duplicate or unauthorized sends.
-
-## 0.5.4 - 2026-07-10
-
-- Separated NMO from the standard webinar workflow throughout instructions, resources, prompts, README, and the companion skill.
-- Marked NMO as an unfinished special MVP mode that must only be enabled after an explicit organizer request and limitation disclosure.
-- Documented the current NMO gaps: hardened email-link/strict single-device, checkpoint auto-close, official portal integration, and remaining Sprint 2 UX/automation.
-- Added protocol assertions preventing future onboarding from silently presenting NMO as a normal production-ready webinar option.
-
-## 0.5.3 - 2026-07-10
-
-- Added an explicit product model: OKO wraps an organizer-supplied video player and does not host or start the underlying stream.
-- Added `oko://guide/nmo` and `oko://guide/telegram` for the complete NMO/CME and Telegram claim/publication workflows.
-- Documented form-button precedence, MCP product boundaries, and the Telegram auto-reminder limitation.
-- Updated the README and companion skill, and added protocol coverage for all seven onboarding resources.
-
-## 0.5.2 - 2026-07-10
-
-- Fixed webinar create/duplicate output schemas so successful writes cannot be reported as protocol failures.
-- Made Firestore event creation compensate automatically when the required RTDB mirror fails.
-- Removed a stale RTDB mirror rewrite from metadata updates.
-- Routed event deletion through an authorized server callable that cleans Firestore subcollections, both RTDB instances, Storage, participants, active sessions, and scheduled Telegram posts.
-- Added a repeatable production smoke workflow against an exact published npm version.
-
-## 0.5.1 - 2026-07-10
-
-- Replaced hand-maintained remote-image IP ranges with a tested public-unicast policy covering IPv4, IPv6, mapped, reserved, documentation, benchmark, multicast, and private address classes.
-
-## 0.5.0 - 2026-07-10
-
-- Isolated every API key behind a synthetic Firebase identity with immediate revocation across Firestore, main RTDB, and chat RTDB.
-- Enforced MCP scopes and event/workspace capabilities at the Firebase Rules and callable boundaries.
-- Moved key lifecycle, event moves, MCP image uploads, and write audit records to server-owned callables.
-- Added explicit confirmation contracts for destructive, live, claim, public-upload, chat, and Telegram actions.
-- Hardened local and remote image loading against path traversal, symlink escapes, SSRF, redirects, DNS rebinding, and oversized payloads.
-- Added clean-stdio protocol tests, a 59-tool inventory contract, read-only evals, and release thresholds.
-- Updated dependencies and package metadata; the package now requires Node.js 20.18.1 or newer.
-
-## 0.4.1 - 2026-07-09
-
-- Restored executable package bin permissions and silenced dotenv stdout output for MCP stdio compatibility.