@kaminari-ad/mcp 0.12.1 → 0.14.0

package/dist/{chunk-XCIH5HFZ.js → chunk-CUJWJSNJ.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { err, ok } from './chunk-MIYKHCDU.js';
+import { err, ok } from './chunk-FQTVDC5D.js';
 import { createHash, randomUUID } from 'crypto';
 import createClient from 'openapi-fetch';
 import { fetch } from 'undici';
@@ -103,6 +103,20 @@ function newRequestId() {
   return randomUUID();
 }
 
+// src/shared/artifact-limits.ts
+var MAX_TEXT_ARTIFACT_BYTES = 256 * 1024;
+var MAX_BINARY_ARTIFACT_BYTES = 8 * 1024 * 1024;
+function formatBytes(bytes) {
+  const kib = 1024;
+  if (bytes < kib) return `${String(bytes)} B`;
+  const mib = kib * kib;
+  if (bytes < mib) return `${(bytes / kib).toFixed(1)} KiB`;
+  return `${(bytes / mib).toFixed(1)} MiB`;
+}
+function decodeUtf8(bytes) {
+  return new TextDecoder("utf-8").decode(bytes);
+}
+
 // src/infrastructure/api/error-mapping.ts
 function detail(parsed) {
   if (parsed === null || typeof parsed !== "object") return "Upstream error";
@@ -893,7 +907,7 @@ z.object({
   filter_date_to: z.union([z.string(), z.null()]).optional(),
   filter_timezone: z.union([z.string(), z.null()]).optional()
 }).passthrough();
-z.object({ updated: z.number().int(), skipped: z.number().int() }).passthrough();
+var BulkUpdateAlertStatusResponse = z.object({ updated: z.number().int(), skipped: z.number().int() }).passthrough();
 var AlertStatsResponse = z.object({
   open: z.number().int(),
   escalated: z.number().int(),
@@ -1231,9 +1245,11 @@ var schemas = {
   CustomRuleResponse,
   RuleTestResponse,
   PolicyEntryResponse,
+  LinkedCampaignResponse,
   PolicySetResponse,
   PolicySetListItem,
   AlertResponse,
+  BulkUpdateAlertStatusResponse,
   AlertStatsResponse,
   BillingSummaryResponse,
   UsageResponse,
@@ -1388,7 +1404,8 @@ var CampaignGroupSchema = schemas.CampaignGroupResponse.pick({
   is_archived: true,
   schedule_paused: true,
   campaign_count: true,
-  created_at: true
+  created_at: true,
+  last_run_at: true
 }).strip();
 var parseCampaignGroup = (raw) => parseWithSchema(CampaignGroupSchema, raw, "campaign-group");
 var parseCampaignGroupArray = (raw) => parseArrayOrItemsWithSchema(CampaignGroupSchema, raw, "campaign-groups");
@@ -1600,6 +1617,11 @@ var AlertStatsSchema = schemas.AlertStatsResponse.pick({
   dismissed: true
 }).strip();
 var parseAlertStats = (raw) => parseWithSchema(AlertStatsSchema, raw, "alert-stats");
+var BulkUpdateAlertStatusSchema = schemas.BulkUpdateAlertStatusResponse.pick({
+  updated: true,
+  skipped: true
+}).strip();
+var parseBulkUpdateAlertStatus = (raw) => parseWithSchema(BulkUpdateAlertStatusSchema, raw, "bulk-update-alert-status");
 var UsageSchema = schemas.UsageResponse.pick({
   id: true,
   scan_id: true,
@@ -1724,6 +1746,14 @@ var GeoSchema = schemas.GeoResponse.pick({
 var GeoListSchema = z.array(GeoSchema);
 var parseGeoList = (raw) => parseWithSchema(GeoListSchema, raw, "geos");
 
+// src/infrastructure/api/parsers/parse-linked-campaign-page.ts
+var LinkedCampaignSchema = schemas.LinkedCampaignResponse.pick({
+  id: true,
+  name: true,
+  is_archived: true
+}).strip();
+var parseLinkedCampaignPage = (raw) => parsePagedWithItemSchema(LinkedCampaignSchema, raw, "policy-set-campaigns");
+
 // src/infrastructure/api/parsers/parse-policy-set.ts
 var PolicySetSchema = schemas.PolicySetResponse.pick({
   id: true,
@@ -1979,7 +2009,50 @@ function createHttpApiGateway(config) {
     }
     return err(toApiError(status2, error ?? data, response.headers.get("retry-after") ?? void 0));
   }
-  async function binaryGet(path, query) {
+  async function readCapped(response, maxBytes) {
+    const tooLarge = err({
+      kind: "upstream",
+      detail: `Artifact is larger than the ${formatBytes(maxBytes)} this tool will transfer. Open the report URL from \`get_scan\` to view it instead.`
+    });
+    const body = response.body;
+    if (body === null) {
+      return err({ kind: "upstream", detail: "Artifact response had no body." });
+    }
+    const declared = Number(response.headers.get("content-length") ?? Number.NaN);
+    if (Number.isFinite(declared) && declared > maxBytes) {
+      await body.cancel().catch(() => void 0);
+      return tooLarge;
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+          await reader.cancel().catch(() => void 0);
+          return tooLarge;
+        }
+        chunks.push(value);
+      }
+    } catch (cause) {
+      await reader.cancel().catch(() => void 0);
+      return err({
+        kind: "upstream",
+        detail: cause instanceof Error ? cause.message : "artifact stream failed"
+      });
+    }
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+      out.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return ok(out);
+  }
+  async function binaryGet(path, maxBytes, query) {
     const startedAtMs = Date.now();
     const qs = query && Object.keys(query).length > 0 ? `?${new URLSearchParams(
       Object.fromEntries(Object.entries(query).map(([k, v]) => [k, String(v)]))
@@ -1994,7 +2067,7 @@ function createHttpApiGateway(config) {
         // update + a tenant-isolation review.
         headers: {
           authorization: bearer.toAuthorizationHeader(),
-          accept: "image/*, application/pdf, application/octet-stream",
+          accept: "image/*, application/pdf, video/mp4, text/plain, application/xml, text/xml, application/octet-stream",
           "user-agent": "kaminari-ad-mcp",
           "x-request-id": requestId
         }
@@ -2012,9 +2085,10 @@ function createHttpApiGateway(config) {
       "api.done"
     );
     if (status2 >= 200 && status2 < 300) {
-      const buf = await response.arrayBuffer();
+      const read = await readCapped(response, maxBytes);
+      if (read.isErr()) return err(read.error);
       return ok({
-        bytes: new Uint8Array(buf),
+        bytes: read.value,
         contentType: response.headers.get("content-type") ?? "application/octet-stream"
       });
     }
@@ -2077,22 +2151,37 @@ function createHttpApiGateway(config) {
       return call("PUT", "/api/v1/account/labels", { body }, parseArrayOf(parseLabelDefinition));
     },
     async getScanScreenshot(scanId, w2) {
-      return binaryGet(`/api/v1/scans/${scanId}/screenshot`, w2 !== void 0 ? { w: w2 } : void 0);
+      return binaryGet(
+        `/api/v1/scans/${scanId}/screenshot`,
+        MAX_BINARY_ARTIFACT_BYTES,
+        w2 !== void 0 ? { w: w2 } : void 0
+      );
     },
     async getScanCreativeScreenshot(scanId, w2) {
       return binaryGet(
         `/api/v1/scans/${scanId}/creative-screenshot`,
+        MAX_BINARY_ARTIFACT_BYTES,
         w2 !== void 0 ? { w: w2 } : void 0
       );
     },
     async getScanLandingScreenshot(scanId, landingOrd, w2) {
       return binaryGet(
         `/api/v1/scans/${scanId}/landings/${String(landingOrd)}/screenshot`,
+        MAX_BINARY_ARTIFACT_BYTES,
         w2 !== void 0 ? { w: w2 } : void 0
       );
     },
+    async getScanCreativeHtml(scanId) {
+      return binaryGet(`/api/v1/scans/${scanId}/creative-html`, MAX_TEXT_ARTIFACT_BYTES);
+    },
+    async getScanCreativeVideo(scanId) {
+      return binaryGet(`/api/v1/scans/${scanId}/creative-video`, MAX_BINARY_ARTIFACT_BYTES);
+    },
+    async getScanVastXml(scanId) {
+      return binaryGet(`/api/v1/scans/${scanId}/vast-xml`, MAX_TEXT_ARTIFACT_BYTES);
+    },
     async getInvoicePdf(invoiceId) {
-      return binaryGet(`/api/v1/invoices/${invoiceId}/pdf`);
+      return binaryGet(`/api/v1/invoices/${invoiceId}/pdf`, MAX_BINARY_ARTIFACT_BYTES);
     },
     async listApiKeys() {
       return call("GET", "/api/v1/account/api-keys", {}, parseApiKeyList);
@@ -2435,6 +2524,30 @@ function createHttpApiGateway(config) {
         parseEmpty
       );
     },
+    async listPolicySetCampaigns(id, filters) {
+      return call(
+        "GET",
+        "/api/v1/policy-sets/{policy_set_id}/campaigns",
+        { params: { path: { policy_set_id: id }, query: filters } },
+        parseLinkedCampaignPage
+      );
+    },
+    async attachPolicySetCampaigns(id, body) {
+      return call(
+        "POST",
+        "/api/v1/policy-sets/{policy_set_id}/campaigns/attach",
+        { params: { path: { policy_set_id: id } }, body },
+        parseEmpty
+      );
+    },
+    async detachPolicySetCampaigns(id, body) {
+      return call(
+        "POST",
+        "/api/v1/policy-sets/{policy_set_id}/campaigns/detach",
+        { params: { path: { policy_set_id: id } }, body },
+        parseEmpty
+      );
+    },
     async requestPolicySetApproval(id) {
       return call(
         "POST",
@@ -2444,8 +2557,13 @@ function createHttpApiGateway(config) {
       );
     },
     // ── Custom taxonomies ─────────────────────────────────────────
-    async listCustomTaxonomies() {
-      return call("GET", "/api/v1/custom-taxonomies", {}, parseCustomTaxonomyList);
+    async listCustomTaxonomies(filters) {
+      return call(
+        "GET",
+        "/api/v1/custom-taxonomies",
+        { params: { query: filters ?? {} } },
+        parseCustomTaxonomyList
+      );
     },
     async getCustomTaxonomy(id) {
       return call(
@@ -2502,8 +2620,11 @@ function createHttpApiGateway(config) {
         parseEmpty
       );
     },
-    async getAlertStats() {
-      return call("GET", "/api/v1/alerts/stats", {}, parseAlertStats);
+    async bulkUpdateAlertStatus(body) {
+      return call("POST", "/api/v1/alerts/bulk-status", { body }, parseBulkUpdateAlertStatus);
+    },
+    async getAlertStats(filters) {
+      return call("GET", "/api/v1/alerts/stats", { params: { query: filters } }, parseAlertStats);
     },
     // ── Webhooks ──────────────────────────────────────────────────
     async listWebhooks() {
@@ -3107,7 +3228,7 @@ var GetCampaignAlertOverridesInputShape = {
 };
 var getCampaignAlertOverridesTool = {
   name: "get_campaign_alert_overrides",
-  description: "Get the per-campaign override of which alert destinations receive its alerts. `mode` is one of `inherit` (use org defaults), `include` (use the listed destinations), or `exclude` (use everything EXCEPT the listed destinations).",
+  description: "Get the per-campaign override of which alert destinations receive its alerts. `mode` is one of `inherit` (no override \u2014 the campaign follows the org-wide destinations), `override` (alerts go ONLY to the returned `destination_ids`), or `silence` (the campaign sends nothing).",
   annotations: {
     title: "Get Campaign Alert Overrides",
     readOnlyHint: true,
@@ -3167,16 +3288,21 @@ var setAlertDestinationVersionTool = {
 };
 var SetCampaignAlertOverridesInputShape = {
   campaign_id: z.string().uuid().describe("Campaign UUID."),
-  mode: z.enum(["inherit", "include", "exclude"]).describe(
-    "Routing mode: `inherit` (use org defaults), `include` (route ONLY to listed destinations), `exclude` (route everywhere EXCEPT listed)."
+  // enum-drift: allow — the API validates these three values but types
+  // the field as a plain string, so no generated schema constrains it.
+  // Swap to `schemas.CampaignOverrideMode` after the api enum change
+  // (`fix/type-override-mode-and-unlist-forms`) reaches prod and the
+  // next `make gen-api-types` picks it up.
+  mode: z.enum(["inherit", "override", "silence"]).describe(
+    "Routing mode: `inherit` (fall back to the org-wide destinations), `override` (route ONLY to `destination_ids`), `silence` (send nothing for this campaign)."
   ),
   destination_ids: z.array(z.string().uuid()).max(50).default([]).describe(
-    "Destination UUIDs the mode acts on. Required for `include`/`exclude`; ignored for `inherit`."
+    "Destination UUIDs to route to. Accepted ONLY with `mode: override` \u2014 the API rejects it for `inherit`/`silence`. An empty list with `override` routes nowhere, which is the same outcome as `silence`."
   )
 };
 var setCampaignAlertOverridesTool = {
   name: "set_campaign_alert_overrides",
-  description: "REPLACE the per-campaign alert-routing override. `mode=inherit` falls back to org defaults; `mode=include` routes ONLY to the listed destinations; `mode=exclude` routes everywhere EXCEPT the listed destinations. To read the new state, follow up with `get_campaign_alert_overrides`.",
+  description: "REPLACE the per-campaign alert-routing override. `mode=inherit` drops the override so the campaign follows the org-wide destinations; `mode=override` routes its alerts ONLY to `destination_ids`; `mode=silence` sends nothing for the campaign. There is no 'route everywhere except these' mode \u2014 to exclude one destination, pass `override` with the destinations you DO want (see `list_alert_destinations`). To read the new state, follow up with `get_campaign_alert_overrides`.",
   annotations: {
     title: "Set Campaign Alert Overrides",
     readOnlyHint: false,
@@ -3186,6 +3312,13 @@ var setCampaignAlertOverridesTool = {
   },
   inputSchema: z.object(SetCampaignAlertOverridesInputShape),
   handler: async (input, ctx) => {
+    if (input.mode !== "override" && input.destination_ids.length > 0) {
+      return err({
+        kind: "invalid-input",
+        message: `destination_ids is only accepted with mode "override", got "${input.mode}". Use mode "override" to route to specific destinations.`,
+        fieldErrors: { destination_ids: ["only valid with mode 'override'"] }
+      });
+    }
     const result = await ctx.api.setCampaignAlertOverrides(input.campaign_id, {
       mode: input.mode,
       destination_ids: input.destination_ids
@@ -3194,10 +3327,116 @@ var setCampaignAlertOverridesTool = {
     return ok({ updated: true });
   }
 };
-var GetAlertStatsInputShape = {};
+var MAX_IDS = 1e3;
+var FILTER_FIELDS = [
+  "filter_status",
+  "filter_campaign_id",
+  "filter_policy_set_ids",
+  "filter_tag_slugs",
+  "filter_country_codes",
+  "filter_date_from",
+  "filter_date_to",
+  "filter_timezone"
+];
+var BulkUpdateAlertStatusInputShape = {
+  status: z.enum(["open", "escalated", "resolved", "dismissed"]).describe("Status to move the selected alerts to."),
+  ids: z.array(z.string().uuid()).min(1).max(MAX_IDS).optional().describe(
+    `Explicit alert UUIDs, at most ${String(MAX_IDS)} per call. Mutually exclusive with \`all_matching\`.`
+  ),
+  all_matching: z.boolean().optional().describe(
+    "Apply to every alert matching the `filter_*` fields instead of an id list. With no filters this means EVERY alert in the organization, so filter first and confirm the scope with `get_alert_stats` using the same filters."
+  ),
+  filter_status: z.enum(["open", "escalated", "resolved", "dismissed"]).optional().describe("Only with `all_matching`: restrict to alerts currently in this status."),
+  filter_campaign_id: z.string().uuid().optional().describe("Only with `all_matching`: restrict to one campaign."),
+  filter_policy_set_ids: z.array(z.string().uuid()).min(1).optional().describe("Only with `all_matching`: restrict to alerts raised by any of these policy sets."),
+  filter_tag_slugs: z.array(z.string().min(1)).min(1).optional().describe("Only with `all_matching`: restrict to alerts carrying any of these tag slugs."),
+  filter_country_codes: z.array(z.string().min(2).max(2)).min(1).optional().describe("Only with `all_matching`: restrict to these ISO 3166-1 alpha-2 countries."),
+  filter_date_from: z.string().date().optional().describe("Only with `all_matching`: inclusive lower bound (YYYY-MM-DD) on alert creation."),
+  filter_date_to: z.string().date().optional().describe("Only with `all_matching`: inclusive upper bound (YYYY-MM-DD) on alert creation."),
+  filter_timezone: z.string().optional().describe(
+    "IANA timezone for the filter date bounds. REQUIRED by the API whenever either date is set."
+  )
+};
+var bulkUpdateAlertStatusTool = {
+  name: "bulk_update_alert_status",
+  description: "Change the status of many alerts at once. Select EITHER an explicit `ids` list (max 1000) OR `all_matching: true` with the `filter_*` fields, which mirror `list_alerts`. Alerts already in a state the transition cannot leave are skipped rather than failing the call, so the response reports `updated` and `skipped` counts \u2014 compare `updated + skipped` against the selection size to see how many were no-ops. Prefer `update_alert_status` for a single alert.",
+  annotations: {
+    title: "Bulk Update Alert Status",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(BulkUpdateAlertStatusInputShape),
+  handler: async (input, ctx) => {
+    const matchesAll = input.all_matching === true;
+    if (input.ids !== void 0 === matchesAll) {
+      return err({
+        kind: "invalid-input",
+        message: "Select alerts with either `ids` or `all_matching: true` \u2014 not both, and not neither."
+      });
+    }
+    const suppliedFilters = FILTER_FIELDS.filter((field) => input[field] !== void 0);
+    if (!matchesAll && suppliedFilters.length > 0) {
+      return err({
+        kind: "invalid-input",
+        message: `\`${suppliedFilters.join("`, `")}\` applies only with \`all_matching: true\`. An explicit \`ids\` list is already the selection, so the filters would be ignored.`
+      });
+    }
+    if ((input.filter_date_from !== void 0 || input.filter_date_to !== void 0) && input.filter_timezone === void 0) {
+      return err({
+        kind: "invalid-input",
+        message: "filter_timezone is required whenever filter_date_from or filter_date_to is set.",
+        fieldErrors: { filter_timezone: ["required alongside a filter date bound"] }
+      });
+    }
+    const result = await ctx.api.bulkUpdateAlertStatus({
+      status: input.status,
+      all_matching: matchesAll,
+      ...input.ids !== void 0 ? { ids: [...input.ids] } : {},
+      ...input.filter_status !== void 0 ? { filter_status: input.filter_status } : {},
+      ...input.filter_campaign_id !== void 0 ? { filter_campaign_id: input.filter_campaign_id } : {},
+      ...input.filter_policy_set_ids !== void 0 ? { filter_policy_set_ids: [...input.filter_policy_set_ids] } : {},
+      ...input.filter_tag_slugs !== void 0 ? { filter_tag_slugs: [...input.filter_tag_slugs] } : {},
+      ...input.filter_country_codes !== void 0 ? { filter_country_codes: [...input.filter_country_codes] } : {},
+      ...input.filter_date_from !== void 0 ? { filter_date_from: input.filter_date_from } : {},
+      ...input.filter_date_to !== void 0 ? { filter_date_to: input.filter_date_to } : {},
+      ...input.filter_timezone !== void 0 ? { filter_timezone: input.filter_timezone } : {}
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var alertFilterFields = {
+  campaign_id: z.string().uuid().optional().describe("Filter to one campaign's alerts."),
+  policy_set_id: z.string().optional().describe(
+    "Comma-separated policy-set UUIDs. Matches alerts raised by any of them; see `list_policy_sets`."
+  ),
+  tag: z.string().optional().describe("Comma-separated tag slugs. Matches alerts carrying any of them; see `list_tags`."),
+  country_code: z.string().optional().describe("Comma-separated ISO 3166-1 alpha-2 country codes, e.g. US,DE,JP."),
+  date_from: z.string().date().optional().describe("ISO date (YYYY-MM-DD), inclusive lower bound on alert creation."),
+  date_to: z.string().date().optional().describe("ISO date (YYYY-MM-DD), inclusive upper bound on alert creation."),
+  timezone: z.string().optional().describe(
+    "IANA timezone (e.g. 'Europe/Berlin') the date bounds are read in. Defaults to UTC. Omitting both dates spans all time."
+  )
+};
+function toAlertFilterQuery(input) {
+  return {
+    ...input.campaign_id !== void 0 ? { campaign_id: input.campaign_id } : {},
+    ...input.policy_set_id !== void 0 ? { policy_set_id: input.policy_set_id } : {},
+    ...input.tag !== void 0 ? { tag: input.tag } : {},
+    ...input.country_code !== void 0 ? { country_code: input.country_code } : {},
+    ...input.date_from !== void 0 ? { date_from: input.date_from } : {},
+    ...input.date_to !== void 0 ? { date_to: input.date_to } : {},
+    ...input.timezone !== void 0 ? { timezone: input.timezone } : {}
+  };
+}
+
+// src/application/tools/alerts/get-alert-stats.tool.ts
+var GetAlertStatsInputShape = alertFilterFields;
 var getAlertStatsTool = {
   name: "get_alert_stats",
-  description: "Get alert counts grouped by status: open, escalated, resolved, dismissed. Counts cover the caller's organization over all time and are not filtered, so the four sum to the `total` an unfiltered `list_alerts` reports. Status names match the canonical AlertStatus enum used by `list_alerts` and `update_alert_status`.",
+  description: "Get alert counts grouped by status: open, escalated, resolved, dismissed. Accepts every filter `list_alerts` does except `status` \u2014 the response buckets BY status \u2014 so passing the same filters to both makes the four counts sum to the `total` that `list_alerts` reports. Unfiltered, the counts cover the whole organization over all time. Use this to size a selection before calling `bulk_update_alert_status` with `all_matching`.",
   annotations: {
     title: "Get Alert Stats",
     readOnlyHint: true,
@@ -3206,14 +3445,14 @@ var getAlertStatsTool = {
     openWorldHint: false
   },
   inputSchema: z.object(GetAlertStatsInputShape),
-  handler: async (_input, ctx) => {
-    const result = await ctx.api.getAlertStats();
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getAlertStats(toAlertFilterQuery(input));
     if (result.isErr()) return err(mapApiError(result.error));
     return ok(result.value);
   }
 };
 var ListAlertsInputShape = {
-  campaign_id: z.string().uuid().optional().describe("Filter to one campaign's alerts."),
+  ...alertFilterFields,
   status: z.enum(["open", "escalated", "resolved", "dismissed"]).optional().describe(
     "Filter by alert status. Open = unhandled; escalated = flagged for attention; resolved = closed; dismissed = closed without action."
   ),
@@ -3222,7 +3461,7 @@ var ListAlertsInputShape = {
 };
 var listAlertsTool = {
   name: "list_alerts",
-  description: "List violation alerts (one per scan + violating rule combo) with offer URL, country, status, scan back-reference, and the kind-aware fields `rule_type` (tag / iab_v3 / brand / ai_category / custom_taxonomy) + `matched_value` (the canonical text the scan matched against).",
+  description: "List violation alerts (one per scan + violating rule combo) with offer URL, country, status, scan back-reference, and the kind-aware fields `rule_type` (tag / iab_v3 / brand / ai_category / custom_taxonomy) + `matched_value` (the canonical text the scan matched against). Filter by campaign, status, policy set, tag, country and creation-date range; `policy_set_id`, `tag` and `country_code` take comma-separated values and match any of them. Pass the same filters to `get_alert_stats` to get counts that agree with this list.",
   annotations: {
     title: "List Alerts",
     readOnlyHint: true,
@@ -3235,7 +3474,7 @@ var listAlertsTool = {
     const filters = {
       page: input.page,
       limit: input.limit,
-      ...input.campaign_id !== void 0 ? { campaign_id: input.campaign_id } : {},
+      ...toAlertFilterQuery(input),
       ...input.status !== void 0 ? { status: input.status } : {}
     };
     const result = await ctx.api.listAlerts(filters);
@@ -3458,12 +3697,34 @@ var getCampaignGroupTool = {
     return ok(result.value);
   }
 };
+var campaignDateFilterFields = {
+  created_from: z.string().date().optional().describe("ISO date (YYYY-MM-DD), inclusive lower bound on the creation day."),
+  created_to: z.string().date().optional().describe("ISO date (YYYY-MM-DD), inclusive upper bound on the creation day."),
+  last_run_from: z.string().date().optional().describe(
+    "ISO date (YYYY-MM-DD), inclusive lower bound on the most recent run. Setting either last-run bound excludes anything that has never run."
+  ),
+  last_run_to: z.string().date().optional().describe("ISO date (YYYY-MM-DD), inclusive upper bound on the most recent run."),
+  timezone: z.string().optional().describe("IANA timezone (e.g. 'Europe/Berlin') the date bounds are read in. Defaults to UTC.")
+};
+function toCampaignDateFilterQuery(input) {
+  return {
+    ...input.created_from !== void 0 ? { created_from: input.created_from } : {},
+    ...input.created_to !== void 0 ? { created_to: input.created_to } : {},
+    ...input.last_run_from !== void 0 ? { last_run_from: input.last_run_from } : {},
+    ...input.last_run_to !== void 0 ? { last_run_to: input.last_run_to } : {},
+    ...input.timezone !== void 0 ? { timezone: input.timezone } : {}
+  };
+}
+
+// src/application/tools/campaign-groups/list-campaign-groups.tool.ts
 var ListCampaignGroupsInputShape = {
-  archived: z.boolean().optional().describe("If true, list ONLY archived groups. Default: only active groups.")
+  archived: z.boolean().optional().describe("If true, list ONLY archived groups. Default: only active groups."),
+  q: z.string().min(1).max(200).optional().describe("Substring search against group name (case-insensitive)."),
+  ...campaignDateFilterFields
 };
 var listCampaignGroupsTool = {
   name: "list_campaign_groups",
-  description: "List campaign groups \u2014 folders that group related campaigns. Includes per-group campaign count. Not paginated; the org-scoped list is typically small (a few dozen groups max).",
+  description: "List campaign groups \u2014 folders that group related campaigns \u2014 with per-group campaign count and `last_run_at`. Filter by archived flag, name substring, or creation / last-run date range; a group's last run is the newest run across its campaigns. Not paginated; the org-scoped list is typically small (a few dozen groups max).",
   annotations: {
     title: "List Campaign Groups",
     readOnlyHint: true,
@@ -3473,7 +3734,11 @@ var listCampaignGroupsTool = {
   },
   inputSchema: z.object(ListCampaignGroupsInputShape),
   handler: async (input, ctx) => {
-    const filters = input.archived === void 0 ? {} : { archived: input.archived };
+    const filters = {
+      ...toCampaignDateFilterQuery(input),
+      ...input.archived !== void 0 ? { archived: input.archived } : {},
+      ...input.q !== void 0 ? { q: input.q } : {}
+    };
     const result = await ctx.api.listCampaignGroups(filters);
     if (result.isErr()) return err(mapApiError(result.error));
     return ok({ items: result.value });
@@ -3798,12 +4063,13 @@ var ListCampaignsInputShape = {
     "When omitted, the API returns active campaigns only. Pass `true` to see archived campaigns, `false` for active-only (explicit)."
   ),
   q: z.string().min(1).max(200).optional().describe("Substring search against campaign name (case-insensitive)."),
+  ...campaignDateFilterFields,
   page: z.number().int().min(1).max(500).default(1).describe("1-indexed page number."),
   limit: z.number().int().min(1).max(200).default(50).describe("Page size (1-200).")
 };
 var listCampaignsTool = {
   name: "list_campaigns",
-  description: "List campaigns for the caller's organization, optionally filtered by group, archived flag, or name substring. Paginated. Each row carries the same fields as `get_campaign`, including the repeat / retry settings (`repeat_count`, `repeat_mode`, `retry_max_attempts`) \u2014 use them to spot the campaigns that multiply their per-run scan count.",
+  description: "List campaigns for the caller's organization, optionally filtered by group, archived flag, name substring, or creation / last-run date range. Paginated. Each row carries the same fields as `get_campaign`, including the repeat / retry settings (`repeat_count`, `repeat_mode`, `retry_max_attempts`) \u2014 use them to spot the campaigns that multiply their per-run scan count.",
   annotations: {
     title: "List Campaigns",
     readOnlyHint: true,
@@ -3816,6 +4082,7 @@ var listCampaignsTool = {
     const filters = {
       page: input.page,
       limit: input.limit,
+      ...toCampaignDateFilterQuery(input),
       ...input.group_id !== void 0 ? { group_id: input.group_id } : {},
       ...input.archived !== void 0 ? { archived: input.archived } : {},
       ...input.q !== void 0 ? { q: input.q } : {}
@@ -3944,19 +4211,47 @@ var updateCampaignTool = {
     return ok(result.value);
   }
 };
+var requestUrlRuleConfigSchema = z.object({
+  pattern: z.string().min(1).max(4096).describe("Non-empty request-URL regular expression, at most 4,096 characters."),
+  flags: z.enum(["", "i"]).optional().describe("Omit or use '' for case-sensitive matching; use 'i' to ignore case.")
+}).strict();
+var REQUEST_URL_RULE_CONFIG_DOC = "For `rule_type='regexp_request_url'`, `config` must be exactly `{ pattern: string, flags?: '' | 'i' }`: pattern is non-empty and at most 4,096 characters; omit flags or use `''` for case-sensitive matching, or `'i'` for case-insensitive matching. `target` must be `'page'`. Fresh scans inspect up to 5,000 captured request URLs. Tests and rechecks of stored scans reconstruct main-frame hops plus up to 200 persisted subrequests with selected resource types omitted, so historical matching is best-effort.";
+function requestUrlRuleInputError(input) {
+  if (input.rule_type !== "regexp_request_url") return null;
+  if (input.target !== void 0 && input.target !== "page") {
+    return {
+      kind: "invalid-input",
+      message: "regexp_request_url requires target='page'.",
+      fieldErrors: { target: ["Must be 'page' for regexp_request_url."] }
+    };
+  }
+  const parsed = requestUrlRuleConfigSchema.safeParse(input.config);
+  if (parsed.success) return null;
+  const issue = parsed.error.issues[0];
+  const field = issue?.path.length ? `config.${issue.path.join(".")}` : "config";
+  const message = issue?.message ?? "Invalid request-URL rule config.";
+  return {
+    kind: "invalid-input",
+    message: `Invalid regexp_request_url config: ${message}`,
+    fieldErrors: { [field]: [message] }
+  };
+}
 var COMBO_MATCH_SCOPE_DOC = 'For `rule_type=\'combo\'` the optional rule-level key `match_scope` decides where conditions are counted. `"scan"` (the default, and the behaviour when the key is absent) checks them against the union of all tags on the scan. With `"url"`, every condition must be satisfied by tags on the same link, and the tag is assigned to that link \u2014 so a rule built only from link-less tags (AI verdicts, crawler behaviour) has no link to attach to and will never match; keep those on the whole scan. Mixing the two kinds does not help either: AI verdicts and per-link detections reach the engine in different scan parts and are not evaluated together today, so such a combo fires under neither scope. Give a `"url"` rule at least one positive condition (`all_of` / `any_of` / `tag_category` + `count_gte`) \u2014 a config carrying only `none_of` matches every link that merely lacks those tags, and the API does not reject that on this path. Thresholds stay "N or more" (`count_gte` / `any_of_min`) in both scopes; no other `match_scope` value is accepted.';
 var COMBO_MATCH_SCOPE_READ_DOC = 'For `rule_type=\'combo\'` the returned `config` may carry the rule-level key `match_scope` ("scan" = count conditions across the whole scan, "url" = every condition must be satisfied by tags on the same link). Resend it verbatim when updating: `update_custom_rule` replaces `config` wholesale, so dropping the key reverts the rule to whole-scan matching.';
 var ruleConfigField = z.record(z.unknown()).superRefine((config, ctx) => {
   const scope = config["match_scope"];
-  if (scope === void 0 || scope === "scan" || scope === "url") {
-    return;
+  if (scope !== void 0 && scope !== "scan" && scope !== "url") {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["match_scope"],
+      message: 'config.match_scope must be "scan" or "url". Omit the key for scan-wide matching (the default).'
+    });
   }
-  ctx.addIssue({
-    code: z.ZodIssueCode.custom,
-    path: ["match_scope"],
-    message: 'config.match_scope must be "scan" or "url". Omit the key for scan-wide matching (the default).'
-  });
 });
+var requestUrlAwareRuleConfigField = z.union([
+  requestUrlRuleConfigSchema,
+  ruleConfigField
+]);
 
 // src/application/tools/custom-rules/create-custom-rule.tool.ts
 var CreateCustomRuleInputShape = {
@@ -3967,18 +4262,18 @@ var CreateCustomRuleInputShape = {
     "Tag slug to assign on match. Empty = create-only (advanced). The API auto-registers a custom tag definition for this slug with `display_name = name`. **MUST NOT collide with a built-in system tag slug** (see `list_tags` where `scope=system`); colliding requests return 422 with code `checking.system_slug_reserved`. For `rule_type='llm'` use `config.tags` keys instead and leave `tag_slug` empty."
   ),
   rule_type: z.string().max(50).describe(
-    "Rule engine. One of: `stopword_content`, `stopword_url`, `regexp_content`, `regexp_url`, `blacklist_domain`, `combo`, `llm`. The API validates."
+    "Rule engine. One of: `stopword_content`, `stopword_url`, `regexp_content`, `regexp_url`, `regexp_request_url`, `blacklist_domain`, `combo`, `llm`. `regexp_url` checks redirect-chain URLs only; `regexp_request_url` checks captured network and subresource URLs. The API validates."
   ),
-  config: ruleConfigField.describe(
-    "Rule-type-specific configuration object. Shape depends on `rule_type`. For `rule_type='llm'` the shape is `{ prompt: string, tags: { <tag_slug>: <description>, ... } }`; each key in `config.tags` is auto-registered as a custom tag definition AND must not collide with a system slug (same 422 contract as `tag_slug`). " + COMBO_MATCH_SCOPE_DOC
+  config: requestUrlAwareRuleConfigField.describe(
+    "Rule-type-specific configuration object. Shape depends on `rule_type`. " + REQUEST_URL_RULE_CONFIG_DOC + " `regexp_url` remains redirect-chain-only. For `rule_type='llm'` the shape is `{ prompt: string, tags: { <tag_slug>: <description>, ... } }`; each key in `config.tags` is auto-registered as a custom tag definition AND must not collide with a system slug (same 422 contract as `tag_slug`). " + COMBO_MATCH_SCOPE_DOC
   ),
   target: z.string().max(30).optional().describe(
-    "Where to apply the rule (e.g. 'page' for landing HTML). Default: page. See API docs for the full set of valid values."
+    "Where to apply the rule (e.g. 'page' for landing HTML). `regexp_request_url` requires `target='page'`. Default: page. See API docs for the full set of valid values."
   )
 };
 var createCustomRuleTool = {
   name: "create_custom_rule",
-  description: "Define a custom tag-detection rule. The API auto-registers a tag definition for each slug the rule emits (`tag_slug` for non-LLM rules; `config.tags` keys for `rule_type='llm'`); slugs that collide with a built-in system tag are rejected with HTTP 422 / code `checking.system_slug_reserved`. For `rule_type='combo'` set `config.match_scope='url'` when the thresholds must be met inside one link instead of anywhere on the scan (default `'scan'`). Matches tag every future scan; existing scans are untouched until you call `recheck_scans`.",
+  description: "Define a custom tag-detection rule. Use `rule_type='regexp_request_url'` to match captured network and subresource URLs on the fixed `page` target; fresh scans carry up to 5,000 URLs, while later tests/rechecks use a reduced persisted request tree and are best-effort. `rule_type='regexp_url'` remains redirect-chain-only. The API auto-registers a tag definition for each emitted slug and rejects built-in system-slug collisions with HTTP 422 / `checking.system_slug_reserved`. Matches tag future scans; existing scans are untouched until `recheck_scans`.",
   annotations: {
     title: "Create Custom Rule",
     readOnlyHint: false,
@@ -3988,6 +4283,8 @@ var createCustomRuleTool = {
   },
   inputSchema: z.object(CreateCustomRuleInputShape),
   handler: async (input, ctx) => {
+    const inputError = requestUrlRuleInputError(input);
+    if (inputError) return err(inputError);
     const body = {
       name: input.name,
       rule_type: input.rule_type,
@@ -4061,19 +4358,19 @@ var listCustomRulesTool = {
 };
 var TestCustomRuleInputShape = {
   rule_type: z.string().max(50).describe(
-    "Rule engine type. One of: `stopword_content`, `stopword_url`, `regexp_content`, `regexp_url`, `blacklist_domain`, `combo`, `llm`."
+    "Rule engine type. One of: `stopword_content`, `stopword_url`, `regexp_content`, `regexp_url`, `regexp_request_url`, `blacklist_domain`, `combo`, `llm`. `regexp_url` checks redirect-chain URLs only; `regexp_request_url` checks captured network and subresource URLs."
   ),
-  config: ruleConfigField.describe(
-    "Rule-type-specific config to test. Same shape as `create_custom_rule`'s `config`. NOTE: `test_custom_rule` evaluates the rule against a scan WITHOUT persisting it, so slug-collision validation does NOT run here \u2014 verify slugs against `list_tags` (`scope=system`) before promoting to `create_custom_rule`. " + COMBO_MATCH_SCOPE_DOC
+  config: requestUrlAwareRuleConfigField.describe(
+    "Rule-type-specific config to test. Same shape as `create_custom_rule`'s `config`. " + REQUEST_URL_RULE_CONFIG_DOC + " `regexp_url` remains redirect-chain-only. NOTE: `test_custom_rule` evaluates the rule against a scan WITHOUT persisting it, so slug-collision validation does NOT run here \u2014 verify slugs against `list_tags` (`scope=system`) before promoting to `create_custom_rule`. " + COMBO_MATCH_SCOPE_DOC
   ),
   target: z.string().max(30).describe(
-    "Where to apply the rule (e.g. 'page' for landing HTML). See API docs for the full set of valid values."
+    "Where to apply the rule (e.g. 'page' for landing HTML). `regexp_request_url` requires `target='page'`. See API docs for the full set of valid values."
   ),
   scan_id: z.string().uuid().describe("Existing scan UUID to evaluate the rule against.")
 };
 var testCustomRuleTool = {
   name: "test_custom_rule",
-  description: "Preview-test a rule definition against an existing scan WITHOUT persisting the rule. Returns `matched: bool`, evaluation time, and per-tag-slug details. Use to validate config before `create_custom_rule`. Combo rules are evaluated against the scan's existing tags, so `config.match_scope` is honoured \u2014 but per-URL hits are collapsed to one row per tag slug, so the result says whether the rule fires, not which URLs it would tag. NOTE: slug-collision validation does NOT run in preview mode \u2014 verify any `tag_slug` (or LLM `config.tags` keys) against `list_tags` (`scope=system`) before promoting to `create_custom_rule`, which would otherwise reject the same payload with HTTP 422 / code `checking.system_slug_reserved`.",
+  description: "Preview-test a rule definition against a stored scan without persisting it. For `regexp_request_url`, the historical snapshot contains main-frame hops plus at most 200 persisted subrequests with selected resource types omitted, so a no-match does not prove the original fresh scan lacked the request. Returns match state, elapsed time, and per-tag detail; the preview response does not expose the matched request URL separately. Slug-collision validation does not run in preview mode.",
   annotations: {
     title: "Test Custom Rule",
     readOnlyHint: true,
@@ -4083,6 +4380,8 @@ var testCustomRuleTool = {
   },
   inputSchema: z.object(TestCustomRuleInputShape),
   handler: async (input, ctx) => {
+    const inputError = requestUrlRuleInputError(input);
+    if (inputError) return err(inputError);
     const result = await ctx.api.testCustomRule({
       rule_type: input.rule_type,
       config: input.config,
@@ -4096,22 +4395,22 @@ var testCustomRuleTool = {
 var UpdateCustomRuleInputShape = {
   rule_id: z.string().uuid().describe("Rule UUID to update."),
   name: z.string().min(1).max(200).optional().describe(
-    "New display name. For non-LLM rules this also becomes the new `display_name` of the auto-registered tag definition."
+    "New rule display name. For PERSONAL non-LLM rules this refreshes the auto-registered tag's display name. A same-slug GLOBAL rule keeps its separately managed tag metadata unchanged; use `update_tag_definition` for that tag."
   ),
   tag_slug: z.string().max(100).optional().describe(
-    "New tag slug to assign on match. **MUST NOT collide with a built-in system tag slug** (see `list_tags` where `scope=system`); colliding requests return 422 with code `checking.system_slug_reserved`. Re-registering an existing custom slug refreshes its tag definition's `display_name` / `description`."
+    "New tag slug to assign on match. **MUST NOT collide with a built-in system tag slug** (see `list_tags` where `scope=system`); colliding requests return 422 with code `checking.system_slug_reserved`. Leaving a GLOBAL rule on the same slug preserves its admin-managed tag metadata."
   ),
-  config: ruleConfigField.optional().describe(
-    "New rule-type-specific config object. Replaces the stored config wholesale \u2014 resend every key you want to keep, including a combo rule's `match_scope`. For `rule_type='llm'` the keys of `config.tags` are auto-registered as tag definitions; any key that collides with a system slug returns the same 422 contract. " + COMBO_MATCH_SCOPE_DOC
+  config: requestUrlAwareRuleConfigField.optional().describe(
+    "New rule-type-specific config object. Replaces the stored config wholesale \u2014 resend every key you want to keep, including a combo rule's `match_scope`. For `rule_type='llm'` the keys of `config.tags` are auto-registered as tag definitions; any key that collides with a system slug returns the same 422 contract. " + REQUEST_URL_RULE_CONFIG_DOC + " Read the rule first because `rule_type` is immutable and is not repeated in this update input. " + COMBO_MATCH_SCOPE_DOC
   ),
   target: z.string().max(30).optional().describe(
-    "Where to apply the rule (e.g. 'page' for landing HTML). See API docs for the full set of valid values."
+    "Where to apply the rule. `regexp_request_url` is fixed to `page`; do not change it. See API docs for the valid targets of other rule types."
   ),
   is_active: z.boolean().optional().describe("Enable/disable the rule.")
 };
 var updateCustomRuleTool = {
   name: "update_custom_rule",
-  description: "Update a custom tag-detection rule. Only supplied fields are sent, but a supplied `config` replaces the stored one wholesale (omitting a combo rule's `match_scope` reverts it to the scan-wide default). Changing `tag_slug` (or `config.tags` keys for `rule_type='llm'`) onto a built-in system slug returns HTTP 422 / code `checking.system_slug_reserved`. To toggle activation, pass `is_active`. Existing tagged scans are NOT re-evaluated \u2014 call `recheck_scans` for that. (Rule engine `rule_type` cannot be changed after creation; create a new rule instead.)",
+  description: "Update a custom tag-detection rule. Only supplied fields are sent, but `config` replaces the stored object wholesale; read the rule first and resend every required key. `regexp_request_url` needs a non-empty pattern (max 4,096), flags `''`/`'i'`, and the fixed `page` target. Same-slug GLOBAL rule edits preserve separately managed tag metadata; use `update_tag_definition` to change it. Existing scans are not re-evaluated until `recheck_scans`.",
   annotations: {
     title: "Update Custom Rule",
     readOnlyHint: false,
@@ -4227,10 +4526,14 @@ var getCustomTaxonomyTool = {
     return ok(result.value);
   }
 };
-var ListCustomTaxonomiesInputShape = {};
+var ListCustomTaxonomiesInputShape = {
+  include_inactive: z.boolean().optional().describe(
+    "Include soft-deleted taxonomies, which are excluded by default. Pass `true` to find one to `restore_custom_taxonomy`, or to resolve a taxonomy id seen on an older scan."
+  )
+};
 var listCustomTaxonomiesTool = {
   name: "list_custom_taxonomies",
-  description: "List the calling org's custom classification taxonomies. Returns slim summaries (id, name, slug, version, node_count, is_active). Soft-deleted taxonomies are included with `is_active=false`. Fetch the full tree via `get_custom_taxonomy`.",
+  description: "List the calling org's custom classification taxonomies. Returns slim summaries (id, name, slug, version, node_count, is_active). Only active taxonomies are listed unless you pass `include_inactive: true`; soft-deleted ones then appear with `is_active=false`. Fetch the full tree via `get_custom_taxonomy`.",
   annotations: {
     title: "List Custom Taxonomies",
     readOnlyHint: true,
@@ -4239,8 +4542,10 @@ var listCustomTaxonomiesTool = {
     openWorldHint: false
   },
   inputSchema: z.object(ListCustomTaxonomiesInputShape),
-  handler: async (_input, ctx) => {
-    const result = await ctx.api.listCustomTaxonomies();
+  handler: async (input, ctx) => {
+    const result = await ctx.api.listCustomTaxonomies(
+      input.include_inactive !== void 0 ? { include_inactive: input.include_inactive } : {}
+    );
     if (result.isErr()) return err(mapApiError(result.error));
     return ok({ items: result.value });
   }
@@ -4446,6 +4751,34 @@ var listInvoicesTool = {
     return ok(result.value);
   }
 };
+var MAX_CAMPAIGNS = 500;
+var AttachPolicySetCampaignsInputShape = {
+  policy_set_id: z.string().uuid().describe("Policy set UUID."),
+  campaign_ids: z.array(z.string().uuid()).min(1).max(MAX_CAMPAIGNS).describe(
+    `Campaign UUIDs to bind, at most ${String(MAX_CAMPAIGNS)} per call. A campaign already on THIS set is a no-op; a campaign on a DIFFERENT set is moved to this one.`
+  )
+};
+var attachPolicySetCampaignsTool = {
+  name: "attach_policy_set_campaigns",
+  description: "Bind campaigns to a policy set. This and `detach_policy_set_campaigns` are the only way to change membership \u2014 `update_policy_set` edits the set's name, description and rules, never its campaigns. Membership changes here are incremental: this set's other members are left alone. IMPORTANT: a campaign can belong to only one policy set, so naming a campaign currently on a DIFFERENT set MOVES it here \u2014 it stops being evaluated against its old set's rules, and no warning is returned. Check `list_campaigns` (`policy_set_id`) first when the campaign may already be bound elsewhere. Split lists longer than 500 across calls; verify with `list_policy_set_campaigns`.",
+  annotations: {
+    title: "Attach Policy Set Campaigns",
+    readOnlyHint: false,
+    // Reassigns a campaign away from whatever set it was on, and the
+    // previous binding is not recoverable from this tool's output.
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(AttachPolicySetCampaignsInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.attachPolicySetCampaigns(input.policy_set_id, {
+      campaign_ids: [...input.campaign_ids]
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ attached: input.campaign_ids.length });
+  }
+};
 var TIER1 = z.string().min(1).max(200);
 var TIER_OPT = z.string().max(200).nullable().optional();
 var IabV3Block = z.object({
@@ -4590,6 +4923,43 @@ var deletePolicySetTool = {
     return ok({ deleted: true });
   }
 };
+var MAX_CAMPAIGNS2 = 500;
+var DetachPolicySetCampaignsInputShape = {
+  policy_set_id: z.string().uuid().describe("Policy set UUID."),
+  campaign_ids: z.array(z.string().uuid()).min(1).max(MAX_CAMPAIGNS2).optional().describe(
+    `Campaign UUIDs to unbind, at most ${String(MAX_CAMPAIGNS2)} per call. Omit when using \`detach_all\`.`
+  ),
+  detach_all: z.boolean().optional().describe(
+    "Unbind EVERY campaign from this policy set. Check the current membership with `list_policy_set_campaigns` first \u2014 the campaigns stop being evaluated against these rules, so alerts they would have raised simply stop."
+  )
+};
+var detachPolicySetCampaignsTool = {
+  name: "detach_policy_set_campaigns",
+  description: "Unbind campaigns from a policy set INCREMENTALLY \u2014 the bindings you don't name survive. Pass `campaign_ids` for specific campaigns or `detach_all: true` to clear the whole membership. This and `attach_policy_set_campaigns` are the only way to change membership; `update_policy_set` edits the set's name, description and rules, never its campaigns. Detaching leaves the policy set and its rules intact, and alerts already raised under it are kept.",
+  annotations: {
+    title: "Detach Policy Set Campaigns",
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(DetachPolicySetCampaignsInputShape),
+  handler: async (input, ctx) => {
+    const detachAll = input.detach_all === true;
+    if (input.campaign_ids !== void 0 === detachAll) {
+      return err({
+        kind: "invalid-input",
+        message: "Choose either `campaign_ids` or `detach_all: true` \u2014 not both, and not neither. Passing neither would be a silent no-op."
+      });
+    }
+    const result = await ctx.api.detachPolicySetCampaigns(input.policy_set_id, {
+      detach_all: detachAll,
+      ...input.campaign_ids !== void 0 ? { campaign_ids: [...input.campaign_ids] } : {}
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ detached: detachAll ? "all" : input.campaign_ids?.length ?? 0 });
+  }
+};
 var GetPolicySetInputShape = {
   policy_set_id: z.string().uuid().describe("Policy set UUID.")
 };
@@ -4610,6 +4980,33 @@ var getPolicySetTool = {
     return ok(result.value);
   }
 };
+var ListPolicySetCampaignsInputShape = {
+  policy_set_id: z.string().uuid().describe("Policy set UUID."),
+  q: z.string().min(1).max(200).optional().describe("Substring search against campaign name (case-insensitive)."),
+  page: z.number().int().min(1).max(500).default(1).describe("1-indexed page number."),
+  limit: z.number().int().min(1).max(200).default(50).describe("Page size (1-200).")
+};
+var listPolicySetCampaignsTool = {
+  name: "list_policy_set_campaigns",
+  description: "List the campaigns bound to a policy set, paginated, each with `id`, `name` and `is_archived`. `get_policy_set` returns only the first page of bindings plus a `campaigns_total`, so use this tool when a set has more campaigns than that page holds, or to search them by name. Read the membership here before `detach_policy_set_campaigns` \u2014 and before `delete_policy_set`, which the API refuses while any active campaign is still bound.",
+  annotations: {
+    title: "List Policy Set Campaigns",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListPolicySetCampaignsInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.listPolicySetCampaigns(input.policy_set_id, {
+      page: input.page,
+      limit: input.limit,
+      ...input.q !== void 0 ? { q: input.q } : {}
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
 var ListPolicySetsInputShape = {
   page: z.number().int().min(1).max(500).default(1).describe("1-indexed page number."),
   limit: z.number().int().min(1).max(200).default(50).describe("Page size."),
@@ -4895,6 +5292,32 @@ var getScanTool = {
     return ok(result.value);
   }
 };
+var GetScanCreativeHtmlInputShape = {
+  scan_id: z.string().uuid().describe("Scan UUID.")
+};
+var getScanCreativeHtmlTool = {
+  name: "get_scan_creative_html",
+  description: "Fetch the generated creative markup for an ad-tag scan as text \u2014 the HTML the ad tag produced, with the scripts, iframes and click-through URLs it embedded. Use it to explain WHY a creative was tagged when a screenshot cannot show it (obfuscated redirectors, hidden trackers, injected handlers). Only ad-tag scans have this artifact; a URL or VAST scan returns not-found. The markup is returned inert as text and is never executed. Markup over 256 KiB is refused \u2014 open the report URL from `get_scan` for those.",
+  annotations: {
+    title: "Get Scan Creative HTML",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetScanCreativeHtmlInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getScanCreativeHtml(input.scan_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    const { bytes, contentType } = result.value;
+    return ok({
+      scan_id: input.scan_id,
+      content_type: contentType,
+      byte_size: bytes.byteLength,
+      html: decodeUtf8(bytes)
+    });
+  }
+};
 var GetScanCreativeScreenshotInputShape = {
   scan_id: z.string().uuid().describe("Scan UUID \u2014 must be an ad-tag scan (is_ad_tag=true)."),
   width: z.number().int().min(50).max(2e3).optional().describe("Optional resize width in pixels.")
@@ -4916,6 +5339,27 @@ var getScanCreativeScreenshotTool = {
     return ok(imageBlock(result.value.bytes, result.value.contentType));
   }
 };
+var GetScanCreativeVideoInputShape = {
+  scan_id: z.string().uuid().describe("Scan UUID.")
+};
+var getScanCreativeVideoTool = {
+  name: "get_scan_creative_video",
+  description: "Fetch the MP4 MediaFile a VAST scan downloaded, as one inline resource block. Only VAST scans have it; others return not-found. Prefer `get_scan_creative_screenshot` for a still frame and `get_scan_vast_xml` for the declared metadata \u2014 both are far cheaper. Reach for the video itself only when the moving image is the evidence. Files over 8 MiB are refused rather than inlined; fall back to `get_scan_creative_screenshot` or the report URL from `get_scan` for those.",
+  annotations: {
+    title: "Get Scan Creative Video",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetScanCreativeVideoInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getScanCreativeVideo(input.scan_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    const { bytes, contentType } = result.value;
+    return ok(resourceBlock(bytes, contentType, `/api/v1/scans/${input.scan_id}/creative-video`));
+  }
+};
 var GetScanLandingScreenshotInputShape = {
   scan_id: z.string().uuid().describe("Scan UUID (ad-tag scan)."),
   landing_ord: z.number().int().min(0).max(50).describe("0-indexed landing slot (see `get_scan(...).landings[*].ord`)."),
@@ -4967,6 +5411,32 @@ var getScanScreenshotTool = {
     return ok(imageBlock(result.value.bytes, result.value.contentType));
   }
 };
+var GetScanVastXmlInputShape = {
+  scan_id: z.string().uuid().describe("Scan UUID.")
+};
+var getScanVastXmlTool = {
+  name: "get_scan_vast_xml",
+  description: "Fetch the VAST document for a VAST scan as text, with wrappers already resolved so the whole chain is visible in one payload. Use it to inspect the tracking pixels, verification vendors, companion ads and click-through targets a video ad declared \u2014 the parsed summary on `get_scan` (`video` block) covers duration, media file and ad system, but not the full element tree. Only VAST scans have this artifact; others return not-found. Documents over 256 KiB are refused.",
+  annotations: {
+    title: "Get Scan VAST XML",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetScanVastXmlInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getScanVastXml(input.scan_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    const { bytes, contentType } = result.value;
+    return ok({
+      scan_id: input.scan_id,
+      content_type: contentType,
+      byte_size: bytes.byteLength,
+      xml: decodeUtf8(bytes)
+    });
+  }
+};
 var ListScanChildrenInputShape = {
   scan_id: z.string().uuid().describe("The publisher scan's UUID (an ad-discovery scan created with ad_discovery=true)."),
   page: z.number().int().min(1).max(500).default(1).describe("1-indexed page number."),
@@ -4994,7 +5464,7 @@ var listScanChildrenTool = {
 };
 var ListScansInputShape = {
   status: z.string().optional().describe(
-    "Comma-separated statuses to filter by. Lifecycle values: pending, running, crawled, checking, checking_async, completed, partial, failed, cancelled."
+    "Comma-separated statuses to filter by. Lifecycle values: pending, running, crawled, checking, checking_async, rechecking, completed, partial, failed, cancelled."
   ),
   country_code: z.string().optional().describe("Comma-separated ISO 3166-1 alpha-2 country codes, e.g. US,DE,JP."),
   url: z.string().optional().describe("Substring match against the scanned URL."),
@@ -5007,7 +5477,13 @@ var ListScansInputShape = {
   run_id: z.string().uuid().optional().describe("Filter to scans of one run."),
   campaign_id: z.string().uuid().optional().describe("Filter to scans of one campaign."),
   group_id: z.string().uuid().optional().describe("Filter to scans of one campaign group."),
+  parent_scan_id: z.string().uuid().optional().describe(
+    "Filter to the ad-discovery child scans of one parent scan. Setting this lifts the default 7-day window, so old children stay reachable. `list_scan_children` is the paginated equivalent."
+  ),
   tag: z.string().optional().describe("Comma-separated tag slugs to filter by."),
+  tag_match: z.enum(["any", "all"]).optional().describe(
+    "How multiple `tag` slugs combine: `any` (default) returns scans carrying at least one, `all` requires every one of them."
+  ),
   ai_category: z.string().optional().describe(
     "Filter by the freeform LLM-generated category prefix on the scan (slash-separated tier path, e.g. 'Gambling/Online Casinos')."
   ),
@@ -5054,7 +5530,9 @@ var listScansTool = {
       ...input.run_id !== void 0 ? { run_id: input.run_id } : {},
       ...input.campaign_id !== void 0 ? { campaign_id: input.campaign_id } : {},
       ...input.group_id !== void 0 ? { group_id: input.group_id } : {},
+      ...input.parent_scan_id !== void 0 ? { parent_scan_id: input.parent_scan_id } : {},
       ...input.tag !== void 0 ? { tag: input.tag } : {},
+      ...input.tag_match !== void 0 ? { tag_match: input.tag_match } : {},
       ...input.ai_category !== void 0 ? { ai_category: input.ai_category } : {},
       ...input.iab_v3_category !== void 0 ? { iab_v3_category: input.iab_v3_category } : {},
       ...input.iab_category !== void 0 ? { iab_category: input.iab_category } : {},
@@ -5159,11 +5637,14 @@ var listScanTagsTool = {
 var ListTagsInputShape = {
   category: z.string().min(1).max(100).optional().describe(
     "Filter to tags in one category slug (e.g. 'security', 'malware', 'compliance'). Use the slug exactly as it appears in `category` of an existing tag."
+  ),
+  include_archived: z.boolean().optional().describe(
+    "Include archived tag definitions, which are excluded by default. Archived tags still appear on the scans that carry them, so pass `true` when resolving a slug seen on an older scan."
   )
 };
 var listTagsTool = {
   name: "list_tags",
-  description: "List every tag definition the platform knows (system tags + organization custom tags) with category, severity, visibility, and usage counters (scans + rules per tag). Optionally filter by category.",
+  description: "List every tag definition the platform knows (system tags + organization custom tags) with category, severity, visibility, and usage counters (scans + rules per tag). Optionally filter by category, and pass `include_archived` to also see retired definitions.",
   annotations: {
     title: "List Tags",
     readOnlyHint: true,
@@ -5173,7 +5654,10 @@ var listTagsTool = {
   },
   inputSchema: z.object(ListTagsInputShape),
   handler: async (input, ctx) => {
-    const filters = input.category !== void 0 ? { category: input.category } : void 0;
+    const filters = {
+      ...input.category !== void 0 ? { category: input.category } : {},
+      ...input.include_archived !== void 0 ? { include_archived: input.include_archived } : {}
+    };
     const result = await ctx.api.listTags(filters);
     if (result.isErr()) return err(mapApiError(result.error));
     return ok({ items: result.value, total: result.value.length });
@@ -5507,6 +5991,9 @@ function registerAllTools(register) {
   register(getScanScreenshotTool);
   register(getScanCreativeScreenshotTool);
   register(getScanLandingScreenshotTool);
+  register(getScanCreativeHtmlTool);
+  register(getScanCreativeVideoTool);
+  register(getScanVastXmlTool);
   register(getCampaignTool);
   register(listCampaignsTool);
   register(archiveCampaignTool);
@@ -5554,8 +6041,12 @@ function registerAllTools(register) {
   register(updatePolicySetTool);
   register(deletePolicySetTool);
   register(requestPolicySetApprovalTool);
+  register(listPolicySetCampaignsTool);
+  register(attachPolicySetCampaignsTool);
+  register(detachPolicySetCampaignsTool);
   register(listAlertsTool);
   register(updateAlertStatusTool);
+  register(bulkUpdateAlertStatusTool);
   register(getAlertStatsTool);
   register(listWebhooksTool);
   register(getWebhookTool);
@@ -5659,5 +6150,5 @@ function formatToolError(error) {
 }
 
 export { BearerToken, SERVER_INSTRUCTIONS, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
-//# sourceMappingURL=chunk-XCIH5HFZ.js.map
-//# sourceMappingURL=chunk-XCIH5HFZ.js.map
+//# sourceMappingURL=chunk-CUJWJSNJ.js.map
+//# sourceMappingURL=chunk-CUJWJSNJ.js.map