@kaminari-ad/mcp 0.18.0 → 0.19.1

package/CHANGELOG.md

@@ -7,6 +7,77 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.19.1] - 2026-09-10
+
+> Requires the API-side KAMIAD-104 deploy. Until it lands, production
+> rejects `invoice_payment_adjustment` as an unknown query enum (422,
+> surfaced as an `invalid_input` tool error), so do not tag this release
+> ahead of the API.
+
+### Fixed
+
+- **`list_balance_history` can filter on `invoice_payment_adjustment`.**
+  The API gained this `BalanceTransactionType` upstream (KAMIAD-104):
+  correcting an already-settled invoice appends a signed correction row
+  rather than editing the original `invoice_settlement`. Once the API
+  ships, an unfiltered call will return such rows without a parser change
+  — the response schema holds `type` as a plain string — but the filter
+  enum rejected the value, so an agent could neither select nor exclude
+  corrections. Same class of gap as `card_top_up` in 0.13.0, hence a
+  patch. No tool signature changed.
+
+  The two generated schemas were hand-edited rather than regenerated,
+  because `gen:api-types` defaults to the production spec and would drag
+  in unrelated drift that is not on this branch. Each hunk was verified
+  byte-equivalent to what a regen against the branch spec produces.
+
+### Security
+
+- Cleared the three advisory clusters that `audit:deps` flagged, taking
+  `npm audit` from 9 findings (5 high, 4 moderate) to zero. `vitest` and
+  its `@vitest/*` siblings 4.1.6 → 4.1.11 (GHSA-82fw-gwwq-j7x9) and the
+  `js-yaml` override 4.3.1 → 4.3.2 (GHSA-2883-xcg3-v3hh) are both
+  dev-only. The new `hono` override (`^4.13.7`, three advisories) is
+  **not**: `hono` reaches the runtime tree through
+  `@modelcontextprotocol/sdk`, on the streamable-HTTP transport's request
+  path, so this changes what the HTTP deployment resolves. The published
+  bundle is unaffected — the SDK stays external — and npm `overrides` do
+  not propagate to consumers, so a consumer pinning a vulnerable `hono`
+  needs its own bump.
+
+## [0.19.0] - 2026-09-08
+
+### Changed
+
+- **`network` on a discovered ad is now the ad network's NAME, and its
+  domain moved to `network_host`.** The API used to put whichever ad host
+  matched first into `network`, so an agent reading it got
+  `cdn.tsyndicate.com` where a name belongs — and sometimes
+  `www.googletagmanager.com`, which is not an ad network at all. Upstream
+  (KAMIAD-133) `network` became a display name resolved from a domain
+  catalog and is **empty when the ad server is not recognised**, while the
+  observed domain travels in the new `network_host`.
+
+  Both fields are exposed on every tool that returns a scan shape:
+  `get_scan`, `list_scans`, `list_scan_children`, `create_scan` and
+  `create_bulk_scans`. (`list_run_scans` returns the slim run tile, which
+  carries no network fields at all.) An
+  agent that identified networks by `network` should read `network_host`
+  when `network` is empty; one that treated `network` as a hostname needs
+  to stop. Scans created before the upstream release keep a hostname in
+  `network` and have an empty `network_host`, so a network breakdown is
+  only sound over scans created after it.
+
+  Ads served from infrastructure (tag managers, analytics, measurement,
+  DMPs) and from a publisher's own creative CDN are still found, scanned
+  and billed exactly as before — they simply no longer claim a network
+  name.
+
+  `network_host` is declared on the port rather than picked from the
+  generated types, the same escape hatch `max_discovered_ads` uses: the
+  generated files are regenerated off the DEPLOYED spec, and this field
+  ships in the release it describes. The next regen absorbs it.
+
 ## [0.17.1] - 2026-09-03
 
 ### Fixed

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { NAME, VERSION, err, ok } from './chunk-KCQ55TRV.js';
+import { NAME, VERSION, err, ok } from './chunk-MKBTS4IH.js';
 import process from 'process';
 import { z } from 'zod';
 
@@ -160,10 +160,10 @@ async function main() {
   }
   const config = configResult.value;
   if (config.transport === "stdio") {
-    const { bootstrapStdio } = await import('./stdio-bootstrap-ZWMO4KXK.js');
+    const { bootstrapStdio } = await import('./stdio-bootstrap-4PXPX6BD.js');
     return bootstrapStdio(config);
   }
-  const { bootstrapHttp } = await import('./http-bootstrap-WTWLW2LP.js');
+  const { bootstrapHttp } = await import('./http-bootstrap-FN4DOOJT.js');
   return bootstrapHttp(config);
 }
 main().then(

package/dist/{chunk-KCQ55TRV.js → chunk-MKBTS4IH.js}

@@ -3,8 +3,8 @@ export { err, ok } from 'neverthrow';
 
 // src/shared/version.ts
 var NAME = "@kaminari-ad/mcp";
-var VERSION = "0.18.0";
+var VERSION = "0.19.1";
 
 export { NAME, VERSION };
-//# sourceMappingURL=chunk-KCQ55TRV.js.map
-//# sourceMappingURL=chunk-KCQ55TRV.js.map
+//# sourceMappingURL=chunk-MKBTS4IH.js.map
+//# sourceMappingURL=chunk-MKBTS4IH.js.map

package/dist/{chunk-KCQ55TRV.js.map → chunk-MKBTS4IH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;;AASO,IAAM,IAAA,GAAO;AACb,IAAM,OAAA,GAAU","file":"chunk-KCQ55TRV.js","sourcesContent":["/**\n * Package version and name. Hard-coded as constants here, asserted to\n * match `package.json` by a unit test.\n *\n * Why not import `package.json`: it would force JSON-module support at\n * runtime and tsup-bundling would inline the entire manifest. Two\n * constants + one assertion test is simpler and gives the same safety.\n */\n\nexport const NAME = \"@kaminari-ad/mcp\";\nexport const VERSION = \"0.18.0\";\n"]}
+{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;;AASO,IAAM,IAAA,GAAO;AACb,IAAM,OAAA,GAAU","file":"chunk-MKBTS4IH.js","sourcesContent":["/**\n * Package version and name. Hard-coded as constants here, asserted to\n * match `package.json` by a unit test.\n *\n * Why not import `package.json`: it would force JSON-module support at\n * runtime and tsup-bundling would inline the entire manifest. Two\n * constants + one assertion test is simpler and gives the same safety.\n */\n\nexport const NAME = \"@kaminari-ad/mcp\";\nexport const VERSION = \"0.19.1\";\n"]}

package/dist/{chunk-MYBWPFWG.js → chunk-NPSDASQE.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { err, ok } from './chunk-KCQ55TRV.js';
+import { err, ok } from './chunk-MKBTS4IH.js';
 import { createHash, randomUUID } from 'crypto';
 import createClient from 'openapi-fetch';
 import { fetch } from 'undici';
@@ -978,6 +978,7 @@ var BalanceTransactionType = z.enum([
   "admin_adjustment",
   "refund",
   "invoice_settlement",
+  "invoice_payment_adjustment",
   "crypto_top_up",
   "card_top_up"
 ]);
@@ -1838,12 +1839,10 @@ var ScanSchema = schemas.ScanResponse.pick({
   repeat_scan_ids: true,
   retry_attempt: true,
   retry_max_attempts: true
-}).extend({ creative_kind: z.string().default("banner") }).extend({ max_discovered_ads: z.number().int().nullable().optional() }).strip();
+}).extend({ creative_kind: z.string().default("banner") }).extend({ max_discovered_ads: z.number().int().nullable().optional() }).extend({ network_host: z.string().optional() }).strip();
 var ScanArraySchema = z.array(ScanSchema);
 var parseScan = (raw) => parseWithSchema(ScanSchema, raw, "scan");
 var parseScanArray = (raw) => parseWithSchema(ScanArraySchema, raw, "scans");
-
-// src/infrastructure/api/parsers/parse-scan-page.ts
 var ScanBriefSchema = schemas.ScanBriefResponse.pick({
   id: true,
   url: true,
@@ -1870,7 +1869,7 @@ var ScanBriefSchema = schemas.ScanBriefResponse.pick({
   repeat_session_id: true,
   retry_attempt: true,
   retry_max_attempts: true
-}).strip();
+}).extend({ network_host: z.string().optional() }).strip();
 var parseScanPage = (raw) => parsePagedWithItemSchema(ScanBriefSchema, raw, "scans");
 var TagDefinitionSchema = schemas.TagDefinitionWithStatsResponse.pick({
   slug: true,
@@ -3550,6 +3549,7 @@ var TransactionTypeEnum = z.enum([
   "admin_adjustment",
   "refund",
   "invoice_settlement",
+  "invoice_payment_adjustment",
   "crypto_top_up",
   "card_top_up"
 ]);
@@ -3557,14 +3557,14 @@ var ListBalanceHistoryInputShape = {
   date_from: z.string().date().optional().describe("ISO date, inclusive."),
   date_to: z.string().date().optional().describe("ISO date, inclusive."),
   type: z.array(TransactionTypeEnum).max(TransactionTypeEnum.options.length).optional().describe(
-    "Filter by transaction kind. Pass several values to OR them (e.g. ['top_up_manual','crypto_top_up','card_top_up'] for credits-only)."
+    "Filter by transaction kind. Pass several values to OR them (e.g. ['top_up_manual','crypto_top_up','card_top_up','invoice_settlement'] for every way a balance is funded). Note `invoice_payment_adjustment` is signed: a correction to an already-settled invoice can be either a credit or a debit."
   ),
   page: z.number().int().min(1).max(500).default(1).describe("1-indexed page."),
   limit: z.number().int().min(1).max(200).default(50).describe("Page size.")
 };
 var listBalanceHistoryTool = {
   name: "list_balance_history",
-  description: "List ledger transactions (charges, refunds, top-ups, invoice settlements) on the organization's balance. Each row: type, amount in micros, description, timestamp. Filter by `type` (multi-select) and / or date range.",
+  description: "List ledger transactions (charges, refunds, top-ups, invoice settlements and their corrections) on the organization's balance. Each row: type, amount in micros, description, timestamp. Filter by `type` (multi-select) and / or date range.",
   annotations: {
     title: "List Balance History",
     readOnlyHint: true,
@@ -5532,7 +5532,7 @@ var ListScanChildrenInputShape = {
 };
 var listScanChildrenTool = {
   name: "list_scan_children",
-  description: "List the discovered-ad child scans of a publisher ad-discovery scan \u2014 one per detected ad block on the page. Each child brief carries ad_kind (banner|pop), the attributed ad network, and slot_index. The repeat / retry fields are present but never meaningful here: a child is always its own group of one (`repeat_index` 0, `repeat_total` 1, `repeat_session_id` null) and is never re-crawled, because repeats and retries apply to the publisher scan \u2014 repeating an ad-discovery scan gives you several parents, each with its own children. Returns a paginated envelope with screenshot + report deep-links; link users with those, never hand-build URLs.",
+  description: "List the discovered-ad child scans of a publisher ad-discovery scan \u2014 one per detected ad block on the page. Each child brief carries ad_kind (banner|pop), slot_index, and the ad's attribution split in two: network is the ad network's NAME and is empty when the ad server is unrecognised, network_host is the domain observed \u2014 so read network first and fall back to network_host. Both are empty when the ad came from infrastructure that is not an ad network (tag manager, analytics) or from the publisher's own creative CDN; a pop carries a network but no host, because pop networks rotate their serving domains. The repeat / retry fields are present but never meaningful here: a child is always its own group of one (`repeat_index` 0, `repeat_total` 1, `repeat_session_id` null) and is never re-crawled, because repeats and retries apply to the publisher scan \u2014 repeating an ad-discovery scan gives you several parents, each with its own children. Returns a paginated envelope with screenshot + report deep-links; link users with those, never hand-build URLs.",
   annotations: {
     title: "List Scan Children",
     readOnlyHint: true,
@@ -6240,5 +6240,5 @@ function formatToolError(error) {
 }
 
 export { BearerToken, SERVER_INSTRUCTIONS, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
-//# sourceMappingURL=chunk-MYBWPFWG.js.map
-//# sourceMappingURL=chunk-MYBWPFWG.js.map
+//# sourceMappingURL=chunk-NPSDASQE.js.map
+//# sourceMappingURL=chunk-NPSDASQE.js.map