@kaminari-ad/mcp 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -7,6 +7,55 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-07-28
+
+### Added
+
+- **Combo-rule match scope.** `create_custom_rule`, `update_custom_rule`, and
+  `test_custom_rule` now document the rule-level `config.match_scope` key used
+  by `rule_type='combo'`: `"scan"` (the default, and the behaviour when the key
+  is absent) counts conditions across the union of all tags on the scan, while
+  `"url"` requires every condition to be satisfied by tags on the same link and
+  assigns the output tag to that link. The description warns about the traps a
+  per-link rule falls into: a combo built only from link-less tags (AI verdicts,
+  crawler behaviour) has no link to attach to and never matches, AI verdicts and
+  per-link detections are not evaluated together today, and a per-link rule needs
+  at least one positive condition. Any other `match_scope` value is rejected
+  before the request is sent, so a misspelled scope surfaces as a tool-input
+  error instead of a round trip; the API validates `match_scope` on create,
+  update, and the rule-test preview as well, so this is early feedback rather
+  than the durable guarantee. The rest of a combo config is still validated only
+  for admin-authored system rules, which is why the per-link traps are documented
+  rather than enforced. `get_custom_rule` and `list_custom_rules` now flag that
+  the returned `config` may carry `match_scope` and that it must be resent
+  verbatim, since `update_custom_rule` replaces `config` wholesale.
+- **`referrer` on scan and campaign creation.** `create_scan`,
+  `create_bulk_scans`, `create_campaign`, and `update_campaign` accept an
+  optional http(s) page URL the check is performed from. With `ad_tag` or
+  `vast_tag` it is the publisher page the tag is embedded in: the browser
+  commits the page document on that URL without fetching the publisher, so the
+  creative renders as if embedded there. With `url` or `ad_discovery` it is
+  where the visitor came from, sent as the `Referer` of the page request.
+  `update_campaign` also accepts `referrer: null` to clear a stored one.
+  Scan and campaign responses surface `referrer` too, so an agent can confirm
+  what a scan actually ran with.
+
+  **Release ordering — this depends on an unreleased API.** The snapshots were
+  generated from api `feat/scan-referrer`
+  ([api!341](https://gitlab.sdev.pw/adverif/api/-/merge_requests/341)). API
+  request DTOs are `extra="ignore"`, so an API without the field drops
+  `referrer` silently: no 422, the scan runs with no referrer, and the response
+  carries no `referrer` key — the agent gets a green result for a check it
+  believes ran from a publisher page. **Do not cut the npm tag or the
+  `kaminariad-mcp` image until api!341 is merged and deployed to
+  `kaminariadprod1`.** Nothing automated enforces this.
+
+### Changed
+
+- Regenerated the OpenAPI type + zod-schema snapshots so the `/api/v1` surface
+  they describe carries `referrer`. That field is their only delta versus the
+  0.10.0 snapshots.
+
 ## [0.10.0] - 2026-07-28
 
 ### Added

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { NAME, VERSION, err, ok } from './chunk-KFVVS55N.js';
+import { NAME, VERSION, err, ok } from './chunk-XSI6SZTX.js';
 import process from 'process';
 import { z } from 'zod';
 
@@ -160,10 +160,10 @@ async function main() {
   }
   const config = configResult.value;
   if (config.transport === "stdio") {
-    const { bootstrapStdio } = await import('./stdio-bootstrap-7EXISZ66.js');
+    const { bootstrapStdio } = await import('./stdio-bootstrap-QK4ENRPP.js');
     return bootstrapStdio(config);
   }
-  const { bootstrapHttp } = await import('./http-bootstrap-3MGAQHND.js');
+  const { bootstrapHttp } = await import('./http-bootstrap-XJNTLL2C.js');
   return bootstrapHttp(config);
 }
 main().then(

package/dist/{chunk-5UVZYMC3.js → chunk-XCAKB2QW.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { err, ok } from './chunk-KFVVS55N.js';
+import { err, ok } from './chunk-XSI6SZTX.js';
 import { createHash, randomUUID } from 'crypto';
 import createClient from 'openapi-fetch';
 import { fetch } from 'undici';
@@ -245,6 +245,7 @@ z.object({
   url: z.union([z.string(), z.null()]).optional(),
   ad_tag: z.union([z.string(), z.null()]).optional(),
   vast_tag: z.union([z.string(), z.null()]).optional(),
+  referrer: z.union([z.string(), z.null()]).optional(),
   country_code: z.string().min(2).max(2),
   emulator_id: z.string().min(1).max(100),
   proxy: ProxyTargetRequest.optional(),
@@ -362,6 +363,7 @@ var ScanResponse = z.object({
   public_report_url: z.string().optional().default(""),
   ad_tag: z.union([z.string(), z.null()]).optional(),
   vast_tag: z.union([z.string(), z.null()]).optional(),
+  referrer: z.union([z.string(), z.null()]).optional(),
   creative_kind: z.enum(["banner", "video"]).optional().default("banner"),
   creative_screenshot_url: z.string().optional().default(""),
   creative_video_url: z.string().optional().default(""),
@@ -433,6 +435,7 @@ z.object({
   url: z.union([z.string(), z.null()]).optional(),
   ad_tag: z.union([z.string(), z.null()]).optional(),
   vast_tag: z.union([z.string(), z.null()]).optional(),
+  referrer: z.union([z.string(), z.null()]).optional(),
   country_codes: z.array(z.string()).min(1),
   emulator_id: z.string().min(1).max(100),
   proxy: ProxyTargetRequest.optional(),
@@ -490,6 +493,7 @@ z.object({
   url: z.union([z.string(), z.null()]).optional(),
   ad_tag: z.union([z.string(), z.null()]).optional(),
   vast_tag: z.union([z.string(), z.null()]).optional(),
+  referrer: z.union([z.string(), z.null()]).optional(),
   country_codes: z.array(z.string()).min(1),
   group_id: z.union([z.string(), z.null()]).optional(),
   emulator_categories: z.array(z.string()).optional(),
@@ -522,6 +526,7 @@ var CampaignResponse = z.object({
   url: z.string(),
   ad_tag: z.union([z.string(), z.null()]).optional(),
   vast_tag: z.union([z.string(), z.null()]).optional(),
+  referrer: z.union([z.string(), z.null()]).optional(),
   country_codes: z.array(z.string()),
   group_id: z.string().uuid(),
   emulator_selection: EmulatorSelectionResponse,
@@ -562,6 +567,7 @@ z.object({
   url: z.union([z.string(), z.null()]),
   ad_tag: z.union([z.string(), z.null()]),
   vast_tag: z.union([z.string(), z.null()]),
+  referrer: z.union([z.string(), z.null()]),
   country_codes: z.union([z.array(z.string()), z.null()]),
   group_id: z.union([z.string(), z.null()]),
   emulator_categories: z.union([z.array(z.string()), z.null()]),
@@ -1339,6 +1345,7 @@ var CampaignSchema = schemas.CampaignResponse.pick({
   url: true,
   ad_tag: true,
   vast_tag: true,
+  referrer: true,
   country_codes: true,
   group_id: true,
   emulator_selection: true,
@@ -1772,6 +1779,7 @@ var ScanSchema = schemas.ScanResponse.pick({
   public_report_url: true,
   ad_tag: true,
   vast_tag: true,
+  referrer: true,
   creative_kind: true,
   video: true,
   creative_screenshot_url: true,
@@ -3672,6 +3680,10 @@ function pickCampaignConfigBody(input) {
   if (input.schedule_timezone !== void 0) body.schedule_timezone = input.schedule_timezone;
   return body;
 }
+var campaignReferrerUrl = z.string().url().regex(/^https?:\/\//i, "Must be an http(s) URL.").max(2048);
+var CAMPAIGN_REFERRER_DESCRIPTION = "Optional http(s) page URL every scan of this campaign is checked from. For `ad_tag` and `vast` campaigns this is the publisher page the tag is embedded in \u2014 NOT the creative and NOT its landing page; the browser commits the page document on this URL without fetching the publisher, so the creative renders as if embedded there, and its cross-origin subrequests receive the origin only (https://publisher.example/, no path). For `url` and `ad_discovery` campaigns this is where the visitor came from, sent in full as the Referer of the page request.";
+var campaignReferrerField = campaignReferrerUrl.optional().describe(CAMPAIGN_REFERRER_DESCRIPTION);
+var campaignReferrerUpdateField = campaignReferrerUrl.nullable().optional().describe(`${CAMPAIGN_REFERRER_DESCRIPTION} Pass null to clear it.`);
 
 // src/application/tools/campaigns/create-campaign.tool.ts
 var CreateCampaignInputShape = {
@@ -3686,6 +3698,7 @@ var CreateCampaignInputShape = {
   vast_tag: z.string().optional().describe(
     "VAST video ad tag: an http(s) URL of a VAST endpoint OR raw VAST XML (required if campaign_type=vast)."
   ),
+  referrer: campaignReferrerField,
   country_codes: z.array(z.string().length(2)).min(1).describe("ISO 3166-1 alpha-2 codes \u2014 one scan per country per run."),
   group_id: z.string().uuid().optional().describe("Parent group UUID; defaults to the org's default group."),
   ...campaignConfigFields,
@@ -3712,6 +3725,7 @@ var createCampaignTool = {
       ...input.url !== void 0 ? { url: input.url } : {},
       ...input.ad_tag !== void 0 ? { ad_tag: input.ad_tag } : {},
       ...input.vast_tag !== void 0 ? { vast_tag: input.vast_tag } : {},
+      ...input.referrer !== void 0 ? { referrer: input.referrer } : {},
       ...input.group_id !== void 0 ? { group_id: input.group_id } : {},
       ...input.labels !== void 0 ? { labels: input.labels } : {},
       ...input.policy_set_id !== void 0 ? { policy_set_id: input.policy_set_id } : {},
@@ -3882,6 +3896,7 @@ var UpdateCampaignInputShape = {
   vast_tag: z.string().optional().describe(
     "New VAST video ad tag: an http(s) URL of a VAST endpoint OR raw VAST XML (vast-type campaigns)."
   ),
+  referrer: campaignReferrerUpdateField,
   country_codes: z.array(z.string().length(2)).optional().describe("Replace the country list."),
   group_id: z.string().uuid().optional().describe("Move the campaign to another group."),
   ...campaignConfigFields,
@@ -3891,7 +3906,7 @@ var UpdateCampaignInputShape = {
 };
 var updateCampaignTool = {
   name: "update_campaign",
-  description: "Update one or more fields of a campaign. Fields not supplied are left unchanged. `policy_set_id` accepts null to clear the binding.",
+  description: "Update one or more fields of a campaign. Fields not supplied are left unchanged. `policy_set_id` accepts null to clear the binding, and `referrer` accepts null to clear the publisher page scans are checked from.",
   annotations: {
     title: "Update Campaign",
     readOnlyHint: false,
@@ -3906,6 +3921,7 @@ var updateCampaignTool = {
       ...input.url !== void 0 ? { url: input.url } : {},
       ...input.ad_tag !== void 0 ? { ad_tag: input.ad_tag } : {},
       ...input.vast_tag !== void 0 ? { vast_tag: input.vast_tag } : {},
+      ...input.referrer !== void 0 ? { referrer: input.referrer } : {},
       ...input.country_codes !== void 0 ? { country_codes: input.country_codes } : {},
       ...input.group_id !== void 0 ? { group_id: input.group_id } : {},
       ...input.labels !== void 0 ? { labels: input.labels } : {},
@@ -3918,6 +3934,21 @@ var updateCampaignTool = {
     return ok(result.value);
   }
 };
+var COMBO_MATCH_SCOPE_DOC = 'For `rule_type=\'combo\'` the optional rule-level key `match_scope` decides where conditions are counted. `"scan"` (the default, and the behaviour when the key is absent) checks them against the union of all tags on the scan. With `"url"`, every condition must be satisfied by tags on the same link, and the tag is assigned to that link \u2014 so a rule built only from link-less tags (AI verdicts, crawler behaviour) has no link to attach to and will never match; keep those on the whole scan. Mixing the two kinds does not help either: AI verdicts and per-link detections reach the engine in different scan parts and are not evaluated together today, so such a combo fires under neither scope. Give a `"url"` rule at least one positive condition (`all_of` / `any_of` / `tag_category` + `count_gte`) \u2014 a config carrying only `none_of` matches every link that merely lacks those tags, and the API does not reject that on this path. Thresholds stay "N or more" (`count_gte` / `any_of_min`) in both scopes; no other `match_scope` value is accepted.';
+var COMBO_MATCH_SCOPE_READ_DOC = 'For `rule_type=\'combo\'` the returned `config` may carry the rule-level key `match_scope` ("scan" = count conditions across the whole scan, "url" = every condition must be satisfied by tags on the same link). Resend it verbatim when updating: `update_custom_rule` replaces `config` wholesale, so dropping the key reverts the rule to whole-scan matching.';
+var ruleConfigField = z.record(z.unknown()).superRefine((config, ctx) => {
+  const scope = config["match_scope"];
+  if (scope === void 0 || scope === "scan" || scope === "url") {
+    return;
+  }
+  ctx.addIssue({
+    code: z.ZodIssueCode.custom,
+    path: ["match_scope"],
+    message: 'config.match_scope must be "scan" or "url". Omit the key for scan-wide matching (the default).'
+  });
+});
+
+// src/application/tools/custom-rules/create-custom-rule.tool.ts
 var CreateCustomRuleInputShape = {
   name: z.string().min(1).max(200).describe(
     "Display name. For non-LLM rules this also becomes the `display_name` of the auto-registered tag definition (see `tag_slug`)."
@@ -3928,8 +3959,8 @@ var CreateCustomRuleInputShape = {
   rule_type: z.string().max(50).describe(
     "Rule engine. One of: `stopword_content`, `stopword_url`, `regexp_content`, `regexp_url`, `blacklist_domain`, `combo`, `llm`. The API validates."
   ),
-  config: z.record(z.unknown()).describe(
-    "Rule-type-specific configuration object. Shape depends on `rule_type`. For `rule_type='llm'` the shape is `{ prompt: string, tags: { <tag_slug>: <description>, ... } }`; each key in `config.tags` is auto-registered as a custom tag definition AND must not collide with a system slug (same 422 contract as `tag_slug`)."
+  config: ruleConfigField.describe(
+    "Rule-type-specific configuration object. Shape depends on `rule_type`. For `rule_type='llm'` the shape is `{ prompt: string, tags: { <tag_slug>: <description>, ... } }`; each key in `config.tags` is auto-registered as a custom tag definition AND must not collide with a system slug (same 422 contract as `tag_slug`). " + COMBO_MATCH_SCOPE_DOC
   ),
   target: z.string().max(30).optional().describe(
     "Where to apply the rule (e.g. 'page' for landing HTML). Default: page. See API docs for the full set of valid values."
@@ -3937,7 +3968,7 @@ var CreateCustomRuleInputShape = {
 };
 var createCustomRuleTool = {
   name: "create_custom_rule",
-  description: "Define a custom tag-detection rule. The API auto-registers a tag definition for each slug the rule emits (`tag_slug` for non-LLM rules; `config.tags` keys for `rule_type='llm'`); slugs that collide with a built-in system tag are rejected with HTTP 422 / code `checking.system_slug_reserved`. Matches tag every future scan; existing scans are untouched until you call `recheck_scans`.",
+  description: "Define a custom tag-detection rule. The API auto-registers a tag definition for each slug the rule emits (`tag_slug` for non-LLM rules; `config.tags` keys for `rule_type='llm'`); slugs that collide with a built-in system tag are rejected with HTTP 422 / code `checking.system_slug_reserved`. For `rule_type='combo'` set `config.match_scope='url'` when the thresholds must be met inside one link instead of anywhere on the scan (default `'scan'`). Matches tag every future scan; existing scans are untouched until you call `recheck_scans`.",
   annotations: {
     title: "Create Custom Rule",
     readOnlyHint: false,
@@ -3982,7 +4013,7 @@ var deleteCustomRuleTool = {
 var GetCustomRuleInputShape = { rule_id: z.string().uuid().describe("Rule UUID.") };
 var getCustomRuleTool = {
   name: "get_custom_rule",
-  description: "Get one custom rule by UUID with name, tag-slug, type, config object, target, active flag.",
+  description: "Get one custom rule by UUID with name, tag-slug, type, config object, target, active flag. " + COMBO_MATCH_SCOPE_READ_DOC,
   annotations: {
     title: "Get Custom Rule",
     readOnlyHint: true,
@@ -4003,7 +4034,7 @@ var ListCustomRulesInputShape = {
 };
 var listCustomRulesTool = {
   name: "list_custom_rules",
-  description: "Paginated list of the organization's custom tag-detection rules (regex / heuristics) with their config, target, and active flag. Returns `{items, total, page, limit}`. To iterate: there is a next page iff `page * limit < total` (or equivalently `items.length === limit` until the last page). `page` is 1-indexed.",
+  description: "Paginated list of the organization's custom tag-detection rules (regex / heuristics) with their config, target, and active flag. Returns `{items, total, page, limit}`. To iterate: there is a next page iff `page * limit < total` (or equivalently `items.length === limit` until the last page). `page` is 1-indexed. " + COMBO_MATCH_SCOPE_READ_DOC,
   annotations: {
     title: "List Custom Rules",
     readOnlyHint: true,
@@ -4022,8 +4053,8 @@ var TestCustomRuleInputShape = {
   rule_type: z.string().max(50).describe(
     "Rule engine type. One of: `stopword_content`, `stopword_url`, `regexp_content`, `regexp_url`, `blacklist_domain`, `combo`, `llm`."
   ),
-  config: z.record(z.unknown()).describe(
-    "Rule-type-specific config to test. Same shape as `create_custom_rule`'s `config`. NOTE: `test_custom_rule` evaluates the rule against a scan WITHOUT persisting it, so slug-collision validation does NOT run here \u2014 verify slugs against `list_tags` (`scope=system`) before promoting to `create_custom_rule`."
+  config: ruleConfigField.describe(
+    "Rule-type-specific config to test. Same shape as `create_custom_rule`'s `config`. NOTE: `test_custom_rule` evaluates the rule against a scan WITHOUT persisting it, so slug-collision validation does NOT run here \u2014 verify slugs against `list_tags` (`scope=system`) before promoting to `create_custom_rule`. " + COMBO_MATCH_SCOPE_DOC
   ),
   target: z.string().max(30).describe(
     "Where to apply the rule (e.g. 'page' for landing HTML). See API docs for the full set of valid values."
@@ -4032,7 +4063,7 @@ var TestCustomRuleInputShape = {
 };
 var testCustomRuleTool = {
   name: "test_custom_rule",
-  description: "Preview-test a rule definition against an existing scan WITHOUT persisting the rule. Returns `matched: bool`, evaluation time, and per-tag-slug details. Use to validate config before `create_custom_rule`. NOTE: slug-collision validation does NOT run in preview mode \u2014 verify any `tag_slug` (or LLM `config.tags` keys) against `list_tags` (`scope=system`) before promoting to `create_custom_rule`, which would otherwise reject the same payload with HTTP 422 / code `checking.system_slug_reserved`.",
+  description: "Preview-test a rule definition against an existing scan WITHOUT persisting the rule. Returns `matched: bool`, evaluation time, and per-tag-slug details. Use to validate config before `create_custom_rule`. Combo rules are evaluated against the scan's existing tags, so `config.match_scope` is honoured \u2014 but per-URL hits are collapsed to one row per tag slug, so the result says whether the rule fires, not which URLs it would tag. NOTE: slug-collision validation does NOT run in preview mode \u2014 verify any `tag_slug` (or LLM `config.tags` keys) against `list_tags` (`scope=system`) before promoting to `create_custom_rule`, which would otherwise reject the same payload with HTTP 422 / code `checking.system_slug_reserved`.",
   annotations: {
     title: "Test Custom Rule",
     readOnlyHint: true,
@@ -4060,8 +4091,8 @@ var UpdateCustomRuleInputShape = {
   tag_slug: z.string().max(100).optional().describe(
     "New tag slug to assign on match. **MUST NOT collide with a built-in system tag slug** (see `list_tags` where `scope=system`); colliding requests return 422 with code `checking.system_slug_reserved`. Re-registering an existing custom slug refreshes its tag definition's `display_name` / `description`."
   ),
-  config: z.record(z.unknown()).optional().describe(
-    "New rule-type-specific config object. For `rule_type='llm'` the keys of `config.tags` are auto-registered as tag definitions; any key that collides with a system slug returns the same 422 contract."
+  config: ruleConfigField.optional().describe(
+    "New rule-type-specific config object. Replaces the stored config wholesale \u2014 resend every key you want to keep, including a combo rule's `match_scope`. For `rule_type='llm'` the keys of `config.tags` are auto-registered as tag definitions; any key that collides with a system slug returns the same 422 contract. " + COMBO_MATCH_SCOPE_DOC
   ),
   target: z.string().max(30).optional().describe(
     "Where to apply the rule (e.g. 'page' for landing HTML). See API docs for the full set of valid values."
@@ -4070,7 +4101,7 @@ var UpdateCustomRuleInputShape = {
 };
 var updateCustomRuleTool = {
   name: "update_custom_rule",
-  description: "Update a custom tag-detection rule. Only supplied fields are sent. Changing `tag_slug` (or `config.tags` keys for `rule_type='llm'`) onto a built-in system slug returns HTTP 422 / code `checking.system_slug_reserved`. To toggle activation, pass `is_active`. Existing tagged scans are NOT re-evaluated \u2014 call `recheck_scans` for that. (Rule engine `rule_type` cannot be changed after creation; create a new rule instead.)",
+  description: "Update a custom tag-detection rule. Only supplied fields are sent, but a supplied `config` replaces the stored one wholesale (omitting a combo rule's `match_scope` reverts it to the scan-wide default). Changing `tag_slug` (or `config.tags` keys for `rule_type='llm'`) onto a built-in system slug returns HTTP 422 / code `checking.system_slug_reserved`. To toggle activation, pass `is_active`. Existing tagged scans are NOT re-evaluated \u2014 call `recheck_scans` for that. (Rule engine `rule_type` cannot be changed after creation; create a new rule instead.)",
   annotations: {
     title: "Update Custom Rule",
     readOnlyHint: false,
@@ -4733,6 +4764,9 @@ var scanProxyField = z.object({
   city: z.string().optional().describe("Proxy city targeting."),
   isp: z.string().optional().describe("Proxy ISP targeting.")
 }).optional().describe("Optional proxy geo targeting for the crawl. Omit to use the org default.");
+var scanReferrerField = z.string().url().regex(/^https?:\/\//i, "Must be an http(s) URL.").max(2048).optional().describe(
+  "Optional http(s) page URL the check is performed from. With `ad_tag` or `vast_tag` this is the publisher page the tag is embedded in \u2014 NOT the creative and NOT its landing page; the browser commits the page document on this URL without fetching the publisher, so the creative renders as if embedded there, and its cross-origin subrequests receive the origin only (https://publisher.example/, no path). With a `url` target this is where the visitor came from, sent in full as the Referer of the page request."
+);
 
 // src/application/tools/scans/create-bulk-scans.tool.ts
 var CreateBulkScansInputShape = {
@@ -4743,6 +4777,7 @@ var CreateBulkScansInputShape = {
   vast_tag: z.string().optional().describe(
     "VAST video ad tag: an http(s) URL of a VAST endpoint OR raw VAST XML. Provide exactly one of `url`, `ad_tag`, or `vast_tag`."
   ),
+  referrer: scanReferrerField,
   country_codes: z.array(z.string().length(2)).min(1).max(50).describe("List of ISO 3166-1 alpha-2 country codes; one scan per country is created."),
   emulator_id: z.string().min(1).max(100).describe("Device/OS profile slug; same for every country in the batch."),
   proxy: scanProxyField,
@@ -4767,6 +4802,7 @@ var createBulkScansTool = {
       ...input.url !== void 0 ? { url: input.url } : {},
       ...input.ad_tag !== void 0 ? { ad_tag: input.ad_tag } : {},
       ...input.vast_tag !== void 0 ? { vast_tag: input.vast_tag } : {},
+      ...input.referrer !== void 0 ? { referrer: input.referrer } : {},
       ...input.proxy !== void 0 ? { proxy: input.proxy } : {},
       ...input.labels !== void 0 ? { labels: input.labels } : {},
       ...pickRepeatRetryBody(input)
@@ -4786,6 +4822,7 @@ var CreateScanInputShape = {
   vast_tag: z.string().optional().describe(
     "VAST video ad tag: an http(s) URL of a VAST endpoint OR raw VAST XML (a document containing a <VAST> element). Fetched and played in a real browser. Provide exactly one of `url`, `ad_tag`, or `vast_tag`."
   ),
+  referrer: scanReferrerField,
   country_code: z.string().length(2).describe("ISO 3166-1 alpha-2 country code, e.g. US, DE, JP. Determines proxy geo."),
   emulator_id: z.string().min(1).max(100).describe("Device/OS profile slug; use `list_emulators` to discover valid values."),
   proxy: scanProxyField,
@@ -4815,6 +4852,7 @@ var createScanTool = {
       ...input.url !== void 0 ? { url: input.url } : {},
       ...input.ad_tag !== void 0 ? { ad_tag: input.ad_tag } : {},
       ...input.vast_tag !== void 0 ? { vast_tag: input.vast_tag } : {},
+      ...input.referrer !== void 0 ? { referrer: input.referrer } : {},
       ...input.proxy !== void 0 ? { proxy: input.proxy } : {},
       ...input.labels !== void 0 ? { labels: input.labels } : {},
       ...input.campaign_id !== void 0 ? { campaign_id: input.campaign_id } : {},
@@ -5611,5 +5649,5 @@ function formatToolError(error) {
 }
 
 export { BearerToken, SERVER_INSTRUCTIONS, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
-//# sourceMappingURL=chunk-5UVZYMC3.js.map
-//# sourceMappingURL=chunk-5UVZYMC3.js.map
+//# sourceMappingURL=chunk-XCAKB2QW.js.map
+//# sourceMappingURL=chunk-XCAKB2QW.js.map