@kaminari-ad/mcp 0.17.1 → 0.19.1

package/CHANGELOG.md

@@ -7,6 +7,77 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.19.1] - 2026-09-10
+
+> Requires the API-side KAMIAD-104 deploy. Until it lands, production
+> rejects `invoice_payment_adjustment` as an unknown query enum (422,
+> surfaced as an `invalid_input` tool error), so do not tag this release
+> ahead of the API.
+
+### Fixed
+
+- **`list_balance_history` can filter on `invoice_payment_adjustment`.**
+  The API gained this `BalanceTransactionType` upstream (KAMIAD-104):
+  correcting an already-settled invoice appends a signed correction row
+  rather than editing the original `invoice_settlement`. Once the API
+  ships, an unfiltered call will return such rows without a parser change
+  — the response schema holds `type` as a plain string — but the filter
+  enum rejected the value, so an agent could neither select nor exclude
+  corrections. Same class of gap as `card_top_up` in 0.13.0, hence a
+  patch. No tool signature changed.
+
+  The two generated schemas were hand-edited rather than regenerated,
+  because `gen:api-types` defaults to the production spec and would drag
+  in unrelated drift that is not on this branch. Each hunk was verified
+  byte-equivalent to what a regen against the branch spec produces.
+
+### Security
+
+- Cleared the three advisory clusters that `audit:deps` flagged, taking
+  `npm audit` from 9 findings (5 high, 4 moderate) to zero. `vitest` and
+  its `@vitest/*` siblings 4.1.6 → 4.1.11 (GHSA-82fw-gwwq-j7x9) and the
+  `js-yaml` override 4.3.1 → 4.3.2 (GHSA-2883-xcg3-v3hh) are both
+  dev-only. The new `hono` override (`^4.13.7`, three advisories) is
+  **not**: `hono` reaches the runtime tree through
+  `@modelcontextprotocol/sdk`, on the streamable-HTTP transport's request
+  path, so this changes what the HTTP deployment resolves. The published
+  bundle is unaffected — the SDK stays external — and npm `overrides` do
+  not propagate to consumers, so a consumer pinning a vulnerable `hono`
+  needs its own bump.
+
+## [0.19.0] - 2026-09-08
+
+### Changed
+
+- **`network` on a discovered ad is now the ad network's NAME, and its
+  domain moved to `network_host`.** The API used to put whichever ad host
+  matched first into `network`, so an agent reading it got
+  `cdn.tsyndicate.com` where a name belongs — and sometimes
+  `www.googletagmanager.com`, which is not an ad network at all. Upstream
+  (KAMIAD-133) `network` became a display name resolved from a domain
+  catalog and is **empty when the ad server is not recognised**, while the
+  observed domain travels in the new `network_host`.
+
+  Both fields are exposed on every tool that returns a scan shape:
+  `get_scan`, `list_scans`, `list_scan_children`, `create_scan` and
+  `create_bulk_scans`. (`list_run_scans` returns the slim run tile, which
+  carries no network fields at all.) An
+  agent that identified networks by `network` should read `network_host`
+  when `network` is empty; one that treated `network` as a hostname needs
+  to stop. Scans created before the upstream release keep a hostname in
+  `network` and have an empty `network_host`, so a network breakdown is
+  only sound over scans created after it.
+
+  Ads served from infrastructure (tag managers, analytics, measurement,
+  DMPs) and from a publisher's own creative CDN are still found, scanned
+  and billed exactly as before — they simply no longer claim a network
+  name.
+
+  `network_host` is declared on the port rather than picked from the
+  generated types, the same escape hatch `max_discovered_ads` uses: the
+  generated files are regenerated off the DEPLOYED spec, and this field
+  ships in the release it describes. The next regen absorbs it.
+
 ## [0.17.1] - 2026-09-03
 
 ### Fixed

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { NAME, VERSION, err, ok } from './chunk-HZDWYWEN.js';
+import { NAME, VERSION, err, ok } from './chunk-MKBTS4IH.js';
 import process from 'process';
 import { z } from 'zod';
 
@@ -160,10 +160,10 @@ async function main() {
   }
   const config = configResult.value;
   if (config.transport === "stdio") {
-    const { bootstrapStdio } = await import('./stdio-bootstrap-UYBS3TK4.js');
+    const { bootstrapStdio } = await import('./stdio-bootstrap-4PXPX6BD.js');
     return bootstrapStdio(config);
   }
-  const { bootstrapHttp } = await import('./http-bootstrap-MEVOCFTE.js');
+  const { bootstrapHttp } = await import('./http-bootstrap-FN4DOOJT.js');
   return bootstrapHttp(config);
 }
 main().then(

package/dist/{chunk-HZDWYWEN.js → chunk-MKBTS4IH.js}

@@ -3,8 +3,8 @@ export { err, ok } from 'neverthrow';
 
 // src/shared/version.ts
 var NAME = "@kaminari-ad/mcp";
-var VERSION = "0.17.1";
+var VERSION = "0.19.1";
 
 export { NAME, VERSION };
-//# sourceMappingURL=chunk-HZDWYWEN.js.map
-//# sourceMappingURL=chunk-HZDWYWEN.js.map
+//# sourceMappingURL=chunk-MKBTS4IH.js.map
+//# sourceMappingURL=chunk-MKBTS4IH.js.map

package/dist/{chunk-HZDWYWEN.js.map → chunk-MKBTS4IH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;;AASO,IAAM,IAAA,GAAO;AACb,IAAM,OAAA,GAAU","file":"chunk-HZDWYWEN.js","sourcesContent":["/**\n * Package version and name. Hard-coded as constants here, asserted to\n * match `package.json` by a unit test.\n *\n * Why not import `package.json`: it would force JSON-module support at\n * runtime and tsup-bundling would inline the entire manifest. Two\n * constants + one assertion test is simpler and gives the same safety.\n */\n\nexport const NAME = \"@kaminari-ad/mcp\";\nexport const VERSION = \"0.17.1\";\n"]}
+{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;;AASO,IAAM,IAAA,GAAO;AACb,IAAM,OAAA,GAAU","file":"chunk-MKBTS4IH.js","sourcesContent":["/**\n * Package version and name. Hard-coded as constants here, asserted to\n * match `package.json` by a unit test.\n *\n * Why not import `package.json`: it would force JSON-module support at\n * runtime and tsup-bundling would inline the entire manifest. Two\n * constants + one assertion test is simpler and gives the same safety.\n */\n\nexport const NAME = \"@kaminari-ad/mcp\";\nexport const VERSION = \"0.19.1\";\n"]}

package/dist/{chunk-WOYPDCIR.js → chunk-NPSDASQE.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { err, ok } from './chunk-HZDWYWEN.js';
+import { err, ok } from './chunk-MKBTS4IH.js';
 import { createHash, randomUUID } from 'crypto';
 import createClient from 'openapi-fetch';
 import { fetch } from 'undici';
@@ -978,6 +978,7 @@ var BalanceTransactionType = z.enum([
   "admin_adjustment",
   "refund",
   "invoice_settlement",
+  "invoice_payment_adjustment",
   "crypto_top_up",
   "card_top_up"
 ]);
@@ -1348,8 +1349,6 @@ var BillingSummarySchema = schemas.BillingSummaryResponse.pick({
   scheduled_effective_at: true
 }).strip();
 var parseBillingSummary = (raw) => parseWithSchema(BillingSummarySchema, raw, "billing-summary");
-
-// src/infrastructure/api/parsers/parse-campaign.ts
 var CampaignSchema = schemas.CampaignResponse.pick({
   id: true,
   name: true,
@@ -1378,7 +1377,7 @@ var CampaignSchema = schemas.CampaignResponse.pick({
   is_archived: true,
   created_at: true,
   last_run_at: true
-}).extend({ repeat_mode: schemas.RepeatMode.default("isolated") }).strip();
+}).extend({ repeat_mode: schemas.RepeatMode.default("isolated") }).extend({ max_discovered_ads: z.number().int().nullable().optional() }).strip();
 var parseCampaign = (raw) => parseWithSchema(CampaignSchema, raw, "campaign");
 var parseCampaignPage = (raw) => parsePagedWithItemSchema(CampaignSchema, raw, "campaigns");
 
@@ -1840,12 +1839,10 @@ var ScanSchema = schemas.ScanResponse.pick({
   repeat_scan_ids: true,
   retry_attempt: true,
   retry_max_attempts: true
-}).extend({ creative_kind: z.string().default("banner") }).strip();
+}).extend({ creative_kind: z.string().default("banner") }).extend({ max_discovered_ads: z.number().int().nullable().optional() }).extend({ network_host: z.string().optional() }).strip();
 var ScanArraySchema = z.array(ScanSchema);
 var parseScan = (raw) => parseWithSchema(ScanSchema, raw, "scan");
 var parseScanArray = (raw) => parseWithSchema(ScanArraySchema, raw, "scans");
-
-// src/infrastructure/api/parsers/parse-scan-page.ts
 var ScanBriefSchema = schemas.ScanBriefResponse.pick({
   id: true,
   url: true,
@@ -1872,7 +1869,7 @@ var ScanBriefSchema = schemas.ScanBriefResponse.pick({
   repeat_session_id: true,
   retry_attempt: true,
   retry_max_attempts: true
-}).strip();
+}).extend({ network_host: z.string().optional() }).strip();
 var parseScanPage = (raw) => parsePagedWithItemSchema(ScanBriefSchema, raw, "scans");
 var TagDefinitionSchema = schemas.TagDefinitionWithStatsResponse.pick({
   slug: true,
@@ -3552,6 +3549,7 @@ var TransactionTypeEnum = z.enum([
   "admin_adjustment",
   "refund",
   "invoice_settlement",
+  "invoice_payment_adjustment",
   "crypto_top_up",
   "card_top_up"
 ]);
@@ -3559,14 +3557,14 @@ var ListBalanceHistoryInputShape = {
   date_from: z.string().date().optional().describe("ISO date, inclusive."),
   date_to: z.string().date().optional().describe("ISO date, inclusive."),
   type: z.array(TransactionTypeEnum).max(TransactionTypeEnum.options.length).optional().describe(
-    "Filter by transaction kind. Pass several values to OR them (e.g. ['top_up_manual','crypto_top_up','card_top_up'] for credits-only)."
+    "Filter by transaction kind. Pass several values to OR them (e.g. ['top_up_manual','crypto_top_up','card_top_up','invoice_settlement'] for every way a balance is funded). Note `invoice_payment_adjustment` is signed: a correction to an already-settled invoice can be either a credit or a debit."
   ),
   page: z.number().int().min(1).max(500).default(1).describe("1-indexed page."),
   limit: z.number().int().min(1).max(200).default(50).describe("Page size.")
 };
 var listBalanceHistoryTool = {
   name: "list_balance_history",
-  description: "List ledger transactions (charges, refunds, top-ups, invoice settlements) on the organization's balance. Each row: type, amount in micros, description, timestamp. Filter by `type` (multi-select) and / or date range.",
+  description: "List ledger transactions (charges, refunds, top-ups, invoice settlements and their corrections) on the organization's balance. Each row: type, amount in micros, description, timestamp. Filter by `type` (multi-select) and / or date range.",
   annotations: {
     title: "List Balance History",
     readOnlyHint: true,
@@ -3892,6 +3890,15 @@ var cancelCampaignTool = {
     return ok(result.value);
   }
 };
+var MAX_DISCOVERED_ADS_DESCRIPTION = 'How many ad blocks to look for on each publisher page before stopping (1-25). Every ad found becomes its own scan with its own report and is BILLED AS A SEPARATE CHECK, so this multiplies the cost: a page scanned at 25 can cost 26 checks \u2014 one parent plus its children. Only valid on an ad-discovery target \u2014 `ad_discovery: true` on a scan, or `campaign_type: "ad_discovery"` on a campaign \u2014 and rejected with 422 anywhere else.';
+var PLATFORM_DEFAULT_NOTE = "The platform default is 12 unless an operator retuned it.";
+var maxDiscoveredAds = z.number().int().min(1).max(25);
+var maxDiscoveredAdsField = maxDiscoveredAds.optional().describe(
+  `${MAX_DISCOVERED_ADS_DESCRIPTION} Omit it to use the platform default. ` + PLATFORM_DEFAULT_NOTE
+);
+var maxDiscoveredAdsUpdateField = maxDiscoveredAds.nullable().optional().describe(
+  `${MAX_DISCOVERED_ADS_DESCRIPTION} Omitting the field leaves the campaign's current setting unchanged; pass null to drop its own number and go back to the platform default. ${PLATFORM_DEFAULT_NOTE}`
+);
 var repeatRetryFields = {
   repeat_count: z.number().int().min(1).max(20).optional().describe(
     "How many times to repeat every scan this call already produces (1-20). It is a multiplier on top of the tool's own fan-out \u2014 see that tool's description for the exact formula \u2014 and each resulting repeat is a full scan with its own report and its own billing. 1-20 is the API's default ceiling; an operator can lower it during an incident, and then a value accepted here still comes back as a 422 from the API. Default: 1."
@@ -3986,6 +3993,7 @@ var CreateCampaignInputShape = {
     "VAST video ad tag: an http(s) URL of a VAST endpoint OR raw VAST XML (required if campaign_type=vast)."
   ),
   referrer: campaignReferrerField,
+  max_discovered_ads: maxDiscoveredAdsField,
   country_codes: z.array(z.string().length(2)).min(1).describe("ISO 3166-1 alpha-2 codes \u2014 one scan per country per run."),
   group_id: z.string().uuid().optional().describe("Parent group UUID; defaults to the org's default group."),
   ...campaignConfigFields,
@@ -4013,6 +4021,7 @@ var createCampaignTool = {
       ...input.ad_tag !== void 0 ? { ad_tag: input.ad_tag } : {},
       ...input.vast_tag !== void 0 ? { vast_tag: input.vast_tag } : {},
       ...input.referrer !== void 0 ? { referrer: input.referrer } : {},
+      ...input.max_discovered_ads !== void 0 ? { max_discovered_ads: input.max_discovered_ads } : {},
       ...input.group_id !== void 0 ? { group_id: input.group_id } : {},
       ...input.labels !== void 0 ? { labels: input.labels } : {},
       ...input.policy_set_id !== void 0 ? { policy_set_id: input.policy_set_id } : {},
@@ -4186,6 +4195,7 @@ var UpdateCampaignInputShape = {
     "New VAST video ad tag: an http(s) URL of a VAST endpoint OR raw VAST XML (vast-type campaigns)."
   ),
   referrer: campaignReferrerUpdateField,
+  max_discovered_ads: maxDiscoveredAdsUpdateField,
   country_codes: z.array(z.string().length(2)).optional().describe("Replace the country list."),
   group_id: z.string().uuid().optional().describe("Move the campaign to another group."),
   ...campaignConfigFields,
@@ -4195,7 +4205,7 @@ var UpdateCampaignInputShape = {
 };
 var updateCampaignTool = {
   name: "update_campaign",
-  description: "Update one or more fields of a campaign. Fields not supplied are left unchanged. `policy_set_id` accepts null to clear the binding, and `referrer` accepts null to clear the publisher page scans are checked from.",
+  description: "Update one or more fields of a campaign. Fields not supplied are left unchanged. `policy_set_id` accepts null to clear the binding, `referrer` accepts null to clear the publisher page scans are checked from, and `max_discovered_ads` accepts null to go back to the platform ad cap.",
   annotations: {
     title: "Update Campaign",
     readOnlyHint: false,
@@ -4211,6 +4221,7 @@ var updateCampaignTool = {
       ...input.ad_tag !== void 0 ? { ad_tag: input.ad_tag } : {},
       ...input.vast_tag !== void 0 ? { vast_tag: input.vast_tag } : {},
       ...input.referrer !== void 0 ? { referrer: input.referrer } : {},
+      ...input.max_discovered_ads !== void 0 ? { max_discovered_ads: input.max_discovered_ads } : {},
       ...input.country_codes !== void 0 ? { country_codes: input.country_codes } : {},
       ...input.group_id !== void 0 ? { group_id: input.group_id } : {},
       ...input.labels !== void 0 ? { labels: input.labels } : {},
@@ -5314,6 +5325,7 @@ var CreateScanInputShape = {
   ad_discovery: z.boolean().optional().describe(
     "Publisher ad discovery: detect ad blocks on the page and spawn one child scan per detected ad (banner/pop). Only valid with `url`. Each child is a separate billed scan; list them with `list_scan_children`."
   ),
+  max_discovered_ads: maxDiscoveredAdsField,
   ...repeatRetryFields
 };
 var createScanTool = {
@@ -5340,6 +5352,7 @@ var createScanTool = {
       ...input.campaign_id !== void 0 ? { campaign_id: input.campaign_id } : {},
       ...input.run_id !== void 0 ? { run_id: input.run_id } : {},
       ...input.ad_discovery !== void 0 ? { ad_discovery: input.ad_discovery } : {},
+      ...input.max_discovered_ads !== void 0 ? { max_discovered_ads: input.max_discovered_ads } : {},
       ...pickRepeatRetryBody(input)
     };
     const result = await ctx.api.createScan(body);
@@ -5519,7 +5532,7 @@ var ListScanChildrenInputShape = {
 };
 var listScanChildrenTool = {
   name: "list_scan_children",
-  description: "List the discovered-ad child scans of a publisher ad-discovery scan \u2014 one per detected ad block on the page. Each child brief carries ad_kind (banner|pop), the attributed ad network, and slot_index. The repeat / retry fields are present but never meaningful here: a child is always its own group of one (`repeat_index` 0, `repeat_total` 1, `repeat_session_id` null) and is never re-crawled, because repeats and retries apply to the publisher scan \u2014 repeating an ad-discovery scan gives you several parents, each with its own children. Returns a paginated envelope with screenshot + report deep-links; link users with those, never hand-build URLs.",
+  description: "List the discovered-ad child scans of a publisher ad-discovery scan \u2014 one per detected ad block on the page. Each child brief carries ad_kind (banner|pop), slot_index, and the ad's attribution split in two: network is the ad network's NAME and is empty when the ad server is unrecognised, network_host is the domain observed \u2014 so read network first and fall back to network_host. Both are empty when the ad came from infrastructure that is not an ad network (tag manager, analytics) or from the publisher's own creative CDN; a pop carries a network but no host, because pop networks rotate their serving domains. The repeat / retry fields are present but never meaningful here: a child is always its own group of one (`repeat_index` 0, `repeat_total` 1, `repeat_session_id` null) and is never re-crawled, because repeats and retries apply to the publisher scan \u2014 repeating an ad-discovery scan gives you several parents, each with its own children. Returns a paginated envelope with screenshot + report deep-links; link users with those, never hand-build URLs.",
   annotations: {
     title: "List Scan Children",
     readOnlyHint: true,
@@ -6227,5 +6240,5 @@ function formatToolError(error) {
 }
 
 export { BearerToken, SERVER_INSTRUCTIONS, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
-//# sourceMappingURL=chunk-WOYPDCIR.js.map
-//# sourceMappingURL=chunk-WOYPDCIR.js.map
+//# sourceMappingURL=chunk-NPSDASQE.js.map
+//# sourceMappingURL=chunk-NPSDASQE.js.map