@kaminari-ad/mcp 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.13.0] - 2026-08-20
+
+### Added
+
+- Added `regexp_request_url` support to `create_custom_rule`,
+  `test_custom_rule`, and `update_custom_rule`. Create and preview inputs
+  validate the strict config (`pattern`, optional `flags: "" | "i"`) and fixed
+  `page` target before dispatch; update documents the API-enforced,
+  full-replacement contract because its immutable rule type is not part of the
+  update payload. Fresh scans evaluate up to 5,000 captured URLs; stored-scan
+  tests and rechecks reconstruct a reduced request tree and are best-effort.
+
 ## [0.12.0] - 2026-08-07
 
 ### Security
@@ -1025,7 +1037,8 @@ Initial public release. The first version that ships to npm under
   need them.
 - Invoice PDF fetcher — same reason.
 
-[Unreleased]: https://github.com/kaminari-ad/mcp/compare/v0.12.0...HEAD
+[Unreleased]: https://github.com/kaminari-ad/mcp/compare/v0.13.0...HEAD
+[0.13.0]: https://github.com/kaminari-ad/mcp/compare/v0.12.0...v0.13.0
 [0.12.0]: https://github.com/kaminari-ad/mcp/compare/v0.11.0...v0.12.0
 [0.11.0]: https://github.com/kaminari-ad/mcp/compare/v0.10.0...v0.11.0
 [0.10.0]: https://github.com/kaminari-ad/mcp/compare/v0.8.0...v0.10.0

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { NAME, VERSION, err, ok } from './chunk-TMUGAKI2.js';
+import { NAME, VERSION, err, ok } from './chunk-VFDW3UL2.js';
 import process from 'process';
 import { z } from 'zod';
 
@@ -160,10 +160,10 @@ async function main() {
   }
   const config = configResult.value;
   if (config.transport === "stdio") {
-    const { bootstrapStdio } = await import('./stdio-bootstrap-JW6I4H3U.js');
+    const { bootstrapStdio } = await import('./stdio-bootstrap-VM6OOG2O.js');
     return bootstrapStdio(config);
   }
-  const { bootstrapHttp } = await import('./http-bootstrap-Y4YKT7KV.js');
+  const { bootstrapHttp } = await import('./http-bootstrap-ROIMZVK2.js');
   return bootstrapHttp(config);
 }
 main().then(

package/dist/{chunk-T6GEYHLP.js → chunk-HOKDLKJN.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { err, ok } from './chunk-TMUGAKI2.js';
+import { err, ok } from './chunk-VFDW3UL2.js';
 import { createHash, randomUUID } from 'crypto';
 import createClient from 'openapi-fetch';
 import { fetch } from 'undici';
@@ -3944,19 +3944,47 @@ var updateCampaignTool = {
     return ok(result.value);
   }
 };
+var requestUrlRuleConfigSchema = z.object({
+  pattern: z.string().min(1).max(4096).describe("Non-empty request-URL regular expression, at most 4,096 characters."),
+  flags: z.enum(["", "i"]).optional().describe("Omit or use '' for case-sensitive matching; use 'i' to ignore case.")
+}).strict();
+var REQUEST_URL_RULE_CONFIG_DOC = "For `rule_type='regexp_request_url'`, `config` must be exactly `{ pattern: string, flags?: '' | 'i' }`: pattern is non-empty and at most 4,096 characters; omit flags or use `''` for case-sensitive matching, or `'i'` for case-insensitive matching. `target` must be `'page'`. Fresh scans inspect up to 5,000 captured request URLs. Tests and rechecks of stored scans reconstruct main-frame hops plus up to 200 persisted subrequests with selected resource types omitted, so historical matching is best-effort.";
+function requestUrlRuleInputError(input) {
+  if (input.rule_type !== "regexp_request_url") return null;
+  if (input.target !== void 0 && input.target !== "page") {
+    return {
+      kind: "invalid-input",
+      message: "regexp_request_url requires target='page'.",
+      fieldErrors: { target: ["Must be 'page' for regexp_request_url."] }
+    };
+  }
+  const parsed = requestUrlRuleConfigSchema.safeParse(input.config);
+  if (parsed.success) return null;
+  const issue = parsed.error.issues[0];
+  const field = issue?.path.length ? `config.${issue.path.join(".")}` : "config";
+  const message = issue?.message ?? "Invalid request-URL rule config.";
+  return {
+    kind: "invalid-input",
+    message: `Invalid regexp_request_url config: ${message}`,
+    fieldErrors: { [field]: [message] }
+  };
+}
 var COMBO_MATCH_SCOPE_DOC = 'For `rule_type=\'combo\'` the optional rule-level key `match_scope` decides where conditions are counted. `"scan"` (the default, and the behaviour when the key is absent) checks them against the union of all tags on the scan. With `"url"`, every condition must be satisfied by tags on the same link, and the tag is assigned to that link \u2014 so a rule built only from link-less tags (AI verdicts, crawler behaviour) has no link to attach to and will never match; keep those on the whole scan. Mixing the two kinds does not help either: AI verdicts and per-link detections reach the engine in different scan parts and are not evaluated together today, so such a combo fires under neither scope. Give a `"url"` rule at least one positive condition (`all_of` / `any_of` / `tag_category` + `count_gte`) \u2014 a config carrying only `none_of` matches every link that merely lacks those tags, and the API does not reject that on this path. Thresholds stay "N or more" (`count_gte` / `any_of_min`) in both scopes; no other `match_scope` value is accepted.';
 var COMBO_MATCH_SCOPE_READ_DOC = 'For `rule_type=\'combo\'` the returned `config` may carry the rule-level key `match_scope` ("scan" = count conditions across the whole scan, "url" = every condition must be satisfied by tags on the same link). Resend it verbatim when updating: `update_custom_rule` replaces `config` wholesale, so dropping the key reverts the rule to whole-scan matching.';
 var ruleConfigField = z.record(z.unknown()).superRefine((config, ctx) => {
   const scope = config["match_scope"];
-  if (scope === void 0 || scope === "scan" || scope === "url") {
-    return;
+  if (scope !== void 0 && scope !== "scan" && scope !== "url") {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["match_scope"],
+      message: 'config.match_scope must be "scan" or "url". Omit the key for scan-wide matching (the default).'
+    });
   }
-  ctx.addIssue({
-    code: z.ZodIssueCode.custom,
-    path: ["match_scope"],
-    message: 'config.match_scope must be "scan" or "url". Omit the key for scan-wide matching (the default).'
-  });
 });
+var requestUrlAwareRuleConfigField = z.union([
+  requestUrlRuleConfigSchema,
+  ruleConfigField
+]);
 
 // src/application/tools/custom-rules/create-custom-rule.tool.ts
 var CreateCustomRuleInputShape = {
@@ -3967,18 +3995,18 @@ var CreateCustomRuleInputShape = {
     "Tag slug to assign on match. Empty = create-only (advanced). The API auto-registers a custom tag definition for this slug with `display_name = name`. **MUST NOT collide with a built-in system tag slug** (see `list_tags` where `scope=system`); colliding requests return 422 with code `checking.system_slug_reserved`. For `rule_type='llm'` use `config.tags` keys instead and leave `tag_slug` empty."
   ),
   rule_type: z.string().max(50).describe(
-    "Rule engine. One of: `stopword_content`, `stopword_url`, `regexp_content`, `regexp_url`, `blacklist_domain`, `combo`, `llm`. The API validates."
+    "Rule engine. One of: `stopword_content`, `stopword_url`, `regexp_content`, `regexp_url`, `regexp_request_url`, `blacklist_domain`, `combo`, `llm`. `regexp_url` checks redirect-chain URLs only; `regexp_request_url` checks captured network and subresource URLs. The API validates."
   ),
-  config: ruleConfigField.describe(
-    "Rule-type-specific configuration object. Shape depends on `rule_type`. For `rule_type='llm'` the shape is `{ prompt: string, tags: { <tag_slug>: <description>, ... } }`; each key in `config.tags` is auto-registered as a custom tag definition AND must not collide with a system slug (same 422 contract as `tag_slug`). " + COMBO_MATCH_SCOPE_DOC
+  config: requestUrlAwareRuleConfigField.describe(
+    "Rule-type-specific configuration object. Shape depends on `rule_type`. " + REQUEST_URL_RULE_CONFIG_DOC + " `regexp_url` remains redirect-chain-only. For `rule_type='llm'` the shape is `{ prompt: string, tags: { <tag_slug>: <description>, ... } }`; each key in `config.tags` is auto-registered as a custom tag definition AND must not collide with a system slug (same 422 contract as `tag_slug`). " + COMBO_MATCH_SCOPE_DOC
   ),
   target: z.string().max(30).optional().describe(
-    "Where to apply the rule (e.g. 'page' for landing HTML). Default: page. See API docs for the full set of valid values."
+    "Where to apply the rule (e.g. 'page' for landing HTML). `regexp_request_url` requires `target='page'`. Default: page. See API docs for the full set of valid values."
   )
 };
 var createCustomRuleTool = {
   name: "create_custom_rule",
-  description: "Define a custom tag-detection rule. The API auto-registers a tag definition for each slug the rule emits (`tag_slug` for non-LLM rules; `config.tags` keys for `rule_type='llm'`); slugs that collide with a built-in system tag are rejected with HTTP 422 / code `checking.system_slug_reserved`. For `rule_type='combo'` set `config.match_scope='url'` when the thresholds must be met inside one link instead of anywhere on the scan (default `'scan'`). Matches tag every future scan; existing scans are untouched until you call `recheck_scans`.",
+  description: "Define a custom tag-detection rule. Use `rule_type='regexp_request_url'` to match captured network and subresource URLs on the fixed `page` target; fresh scans carry up to 5,000 URLs, while later tests/rechecks use a reduced persisted request tree and are best-effort. `rule_type='regexp_url'` remains redirect-chain-only. The API auto-registers a tag definition for each emitted slug and rejects built-in system-slug collisions with HTTP 422 / `checking.system_slug_reserved`. Matches tag future scans; existing scans are untouched until `recheck_scans`.",
   annotations: {
     title: "Create Custom Rule",
     readOnlyHint: false,
@@ -3988,6 +4016,8 @@ var createCustomRuleTool = {
   },
   inputSchema: z.object(CreateCustomRuleInputShape),
   handler: async (input, ctx) => {
+    const inputError = requestUrlRuleInputError(input);
+    if (inputError) return err(inputError);
     const body = {
       name: input.name,
       rule_type: input.rule_type,
@@ -4061,19 +4091,19 @@ var listCustomRulesTool = {
 };
 var TestCustomRuleInputShape = {
   rule_type: z.string().max(50).describe(
-    "Rule engine type. One of: `stopword_content`, `stopword_url`, `regexp_content`, `regexp_url`, `blacklist_domain`, `combo`, `llm`."
+    "Rule engine type. One of: `stopword_content`, `stopword_url`, `regexp_content`, `regexp_url`, `regexp_request_url`, `blacklist_domain`, `combo`, `llm`. `regexp_url` checks redirect-chain URLs only; `regexp_request_url` checks captured network and subresource URLs."
   ),
-  config: ruleConfigField.describe(
-    "Rule-type-specific config to test. Same shape as `create_custom_rule`'s `config`. NOTE: `test_custom_rule` evaluates the rule against a scan WITHOUT persisting it, so slug-collision validation does NOT run here \u2014 verify slugs against `list_tags` (`scope=system`) before promoting to `create_custom_rule`. " + COMBO_MATCH_SCOPE_DOC
+  config: requestUrlAwareRuleConfigField.describe(
+    "Rule-type-specific config to test. Same shape as `create_custom_rule`'s `config`. " + REQUEST_URL_RULE_CONFIG_DOC + " `regexp_url` remains redirect-chain-only. NOTE: `test_custom_rule` evaluates the rule against a scan WITHOUT persisting it, so slug-collision validation does NOT run here \u2014 verify slugs against `list_tags` (`scope=system`) before promoting to `create_custom_rule`. " + COMBO_MATCH_SCOPE_DOC
   ),
   target: z.string().max(30).describe(
-    "Where to apply the rule (e.g. 'page' for landing HTML). See API docs for the full set of valid values."
+    "Where to apply the rule (e.g. 'page' for landing HTML). `regexp_request_url` requires `target='page'`. See API docs for the full set of valid values."
   ),
   scan_id: z.string().uuid().describe("Existing scan UUID to evaluate the rule against.")
 };
 var testCustomRuleTool = {
   name: "test_custom_rule",
-  description: "Preview-test a rule definition against an existing scan WITHOUT persisting the rule. Returns `matched: bool`, evaluation time, and per-tag-slug details. Use to validate config before `create_custom_rule`. Combo rules are evaluated against the scan's existing tags, so `config.match_scope` is honoured \u2014 but per-URL hits are collapsed to one row per tag slug, so the result says whether the rule fires, not which URLs it would tag. NOTE: slug-collision validation does NOT run in preview mode \u2014 verify any `tag_slug` (or LLM `config.tags` keys) against `list_tags` (`scope=system`) before promoting to `create_custom_rule`, which would otherwise reject the same payload with HTTP 422 / code `checking.system_slug_reserved`.",
+  description: "Preview-test a rule definition against a stored scan without persisting it. For `regexp_request_url`, the historical snapshot contains main-frame hops plus at most 200 persisted subrequests with selected resource types omitted, so a no-match does not prove the original fresh scan lacked the request. Returns match state, elapsed time, and per-tag detail; the preview response does not expose the matched request URL separately. Slug-collision validation does not run in preview mode.",
   annotations: {
     title: "Test Custom Rule",
     readOnlyHint: true,
@@ -4083,6 +4113,8 @@ var testCustomRuleTool = {
   },
   inputSchema: z.object(TestCustomRuleInputShape),
   handler: async (input, ctx) => {
+    const inputError = requestUrlRuleInputError(input);
+    if (inputError) return err(inputError);
     const result = await ctx.api.testCustomRule({
       rule_type: input.rule_type,
       config: input.config,
@@ -4096,22 +4128,22 @@ var testCustomRuleTool = {
 var UpdateCustomRuleInputShape = {
   rule_id: z.string().uuid().describe("Rule UUID to update."),
   name: z.string().min(1).max(200).optional().describe(
-    "New display name. For non-LLM rules this also becomes the new `display_name` of the auto-registered tag definition."
+    "New rule display name. For PERSONAL non-LLM rules this refreshes the auto-registered tag's display name. A same-slug GLOBAL rule keeps its separately managed tag metadata unchanged; use `update_tag_definition` for that tag."
   ),
   tag_slug: z.string().max(100).optional().describe(
-    "New tag slug to assign on match. **MUST NOT collide with a built-in system tag slug** (see `list_tags` where `scope=system`); colliding requests return 422 with code `checking.system_slug_reserved`. Re-registering an existing custom slug refreshes its tag definition's `display_name` / `description`."
+    "New tag slug to assign on match. **MUST NOT collide with a built-in system tag slug** (see `list_tags` where `scope=system`); colliding requests return 422 with code `checking.system_slug_reserved`. Leaving a GLOBAL rule on the same slug preserves its admin-managed tag metadata."
   ),
-  config: ruleConfigField.optional().describe(
-    "New rule-type-specific config object. Replaces the stored config wholesale \u2014 resend every key you want to keep, including a combo rule's `match_scope`. For `rule_type='llm'` the keys of `config.tags` are auto-registered as tag definitions; any key that collides with a system slug returns the same 422 contract. " + COMBO_MATCH_SCOPE_DOC
+  config: requestUrlAwareRuleConfigField.optional().describe(
+    "New rule-type-specific config object. Replaces the stored config wholesale \u2014 resend every key you want to keep, including a combo rule's `match_scope`. For `rule_type='llm'` the keys of `config.tags` are auto-registered as tag definitions; any key that collides with a system slug returns the same 422 contract. " + REQUEST_URL_RULE_CONFIG_DOC + " Read the rule first because `rule_type` is immutable and is not repeated in this update input. " + COMBO_MATCH_SCOPE_DOC
   ),
   target: z.string().max(30).optional().describe(
-    "Where to apply the rule (e.g. 'page' for landing HTML). See API docs for the full set of valid values."
+    "Where to apply the rule. `regexp_request_url` is fixed to `page`; do not change it. See API docs for the valid targets of other rule types."
   ),
   is_active: z.boolean().optional().describe("Enable/disable the rule.")
 };
 var updateCustomRuleTool = {
   name: "update_custom_rule",
-  description: "Update a custom tag-detection rule. Only supplied fields are sent, but a supplied `config` replaces the stored one wholesale (omitting a combo rule's `match_scope` reverts it to the scan-wide default). Changing `tag_slug` (or `config.tags` keys for `rule_type='llm'`) onto a built-in system slug returns HTTP 422 / code `checking.system_slug_reserved`. To toggle activation, pass `is_active`. Existing tagged scans are NOT re-evaluated \u2014 call `recheck_scans` for that. (Rule engine `rule_type` cannot be changed after creation; create a new rule instead.)",
+  description: "Update a custom tag-detection rule. Only supplied fields are sent, but `config` replaces the stored object wholesale; read the rule first and resend every required key. `regexp_request_url` needs a non-empty pattern (max 4,096), flags `''`/`'i'`, and the fixed `page` target. Same-slug GLOBAL rule edits preserve separately managed tag metadata; use `update_tag_definition` to change it. Existing scans are not re-evaluated until `recheck_scans`.",
   annotations: {
     title: "Update Custom Rule",
     readOnlyHint: false,
@@ -5659,5 +5691,5 @@ function formatToolError(error) {
 }
 
 export { BearerToken, SERVER_INSTRUCTIONS, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
-//# sourceMappingURL=chunk-T6GEYHLP.js.map
-//# sourceMappingURL=chunk-T6GEYHLP.js.map
+//# sourceMappingURL=chunk-HOKDLKJN.js.map
+//# sourceMappingURL=chunk-HOKDLKJN.js.map