@kaminari-ad/mcp 0.2.0 → 0.2.2

package/dist/chunk-4MNLSWSZ.js

@@ -0,0 +1,4289 @@
+#!/usr/bin/env node
+import { err, ok } from './chunk-BAZQPU6T.js';
+import { createHash, randomUUID } from 'crypto';
+import createClient from 'openapi-fetch';
+import { fetch } from 'undici';
+import { z } from 'zod';
+import { stdTimeFunctions, pino } from 'pino';
+import pinoPretty from 'pino-pretty';
+import { ListResourcesRequestSchema, ListPromptsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+
+var REDACTED = "[BearerToken redacted]";
+var BEARER_HASH_PREFIX_LEN = 8;
+var MAX_HEADER_LEN = 4096;
+var BearerToken = class _BearerToken {
+  #raw;
+  constructor(raw) {
+    this.#raw = raw;
+  }
+  /**
+   * Construct from a raw string. Trims surrounding whitespace; rejects
+   * empty input. Does NOT validate format — the API is the single
+   * source of truth for token validity.
+   */
+  static fromString(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) return void 0;
+    return new _BearerToken(trimmed);
+  }
+  /**
+   * Parse from a raw `Authorization` header value. Returns `undefined`
+   * for missing / malformed input (anything not `Bearer <token>`).
+   *
+   * **Normalization policy.** The regex is case-insensitive on the
+   * `Bearer` scheme (per RFC 6750 §2.1, the scheme name is
+   * case-insensitive) but the outbound header is always re-emitted
+   * with the canonical capitalization (`Bearer <token>`) by
+   * {@link toAuthorizationHeader}. We intentionally do NOT preserve
+   * the inbound casing byte-for-byte:
+   *
+   *   - The Kaminari Ad API accepts the canonical form.
+   *   - Outbound canonicalization simplifies any future signature /
+   *     proxy that re-hashes the header.
+   *   - The TOKEN value itself is preserved exactly (the capture
+   *     group's `\S+` keeps the secret intact); only the SCHEME word
+   *     is normalized.
+   *
+   * Token length is capped at {@link MAX_TOKEN_LEN} bytes to keep a
+   * pathological client from blowing the heap; longer headers are
+   * rejected as malformed.
+   */
+  static fromAuthorizationHeader(headerValue) {
+    if (headerValue === void 0) return void 0;
+    if (headerValue.length > MAX_HEADER_LEN) return void 0;
+    const match = /^Bearer\s+(\S+)\s*$/i.exec(headerValue);
+    if (match?.[1] === void 0) return void 0;
+    return _BearerToken.fromString(match[1]);
+  }
+  /**
+   * Returns the first {@link BEARER_HASH_PREFIX_LEN} hex chars of
+   * `sha256(token)`. Used as the `bearer_hash` log field.
+   */
+  hash() {
+    return createHash("sha256").update(this.#raw).digest("hex").slice(0, BEARER_HASH_PREFIX_LEN);
+  }
+  /**
+   * Returns the full SHA-256 hex digest. Used as the session-binding
+   * key in {@link SessionStore}. Not for logs.
+   */
+  fullHash() {
+    return createHash("sha256").update(this.#raw).digest("hex");
+  }
+  /**
+   * Returns the literal `Authorization` header value. Use ONLY when
+   * constructing an outbound HTTP request to the API.
+   */
+  toAuthorizationHeader() {
+    return `Bearer ${this.#raw}`;
+  }
+  /**
+   * Redaction. Logger / JSON serialisation / template strings see the
+   * placeholder, not the token.
+   */
+  toString() {
+    return REDACTED;
+  }
+  /**
+   * `JSON.stringify(bearer)` -> `"[BearerToken redacted]"`. Same
+   * intent as {@link toString}: any path that serializes the VO never
+   * sees the secret.
+   */
+  toJSON() {
+    return REDACTED;
+  }
+  /**
+   * Node's `util.inspect` hook — keeps `console.log(token)` /
+   * structured logs from accidentally revealing the secret.
+   */
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
+    return REDACTED;
+  }
+};
+function newRequestId() {
+  return randomUUID();
+}
+
+// src/infrastructure/api/error-mapping.ts
+function detail(parsed) {
+  if (parsed === null || typeof parsed !== "object") return "Upstream error";
+  if (!("detail" in parsed)) return "Upstream error";
+  const d = parsed.detail;
+  if (typeof d === "string") return d;
+  if (Array.isArray(d)) {
+    const messages = d.map((entry) => {
+      if (entry === null || typeof entry !== "object") return void 0;
+      const e = entry;
+      const loc = Array.isArray(e.loc) ? e.loc.filter((p) => typeof p === "string").join(".") : "";
+      const msg = typeof e.msg === "string" ? e.msg : "";
+      if (loc === "" && msg === "") return void 0;
+      return loc === "" ? msg : `${loc}: ${msg}`;
+    }).filter((m) => m !== void 0);
+    if (messages.length > 0) return messages.join("; ");
+  }
+  return "Upstream error";
+}
+function errCode(parsed) {
+  if (parsed !== null && typeof parsed === "object" && "code" in parsed) {
+    const c = parsed.code;
+    if (typeof c === "string") return c;
+  }
+  return void 0;
+}
+function toApiError(status2, parsed, retryAfterHeader) {
+  const message = detail(parsed);
+  if (status2 === 401) return { kind: "unauthorized", detail: message };
+  if (status2 === 403) {
+    const code = errCode(parsed);
+    return code === void 0 ? { kind: "forbidden", detail: message } : { kind: "forbidden", detail: message, code };
+  }
+  if (status2 === 404) return { kind: "not-found", detail: message };
+  if (status2 === 422 || status2 === 400) {
+    const code = errCode(parsed);
+    return code === void 0 ? { kind: "invalid-input", detail: message } : { kind: "invalid-input", detail: message, code };
+  }
+  if (status2 === 429) {
+    const ra = Array.isArray(retryAfterHeader) ? retryAfterHeader[0] : retryAfterHeader;
+    const retryMs = ra === void 0 ? void 0 : Number.parseInt(ra, 10) * 1e3;
+    return retryMs === void 0 || Number.isNaN(retryMs) ? { kind: "rate-limited", detail: message } : { kind: "rate-limited", detail: message, retryAfterMs: retryMs };
+  }
+  return { kind: "upstream", detail: message, status: status2 };
+}
+var OrgResponse = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  owner_id: z.string().uuid(),
+  is_active: z.boolean(),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+z.object({ name: z.union([z.string(), z.null()]) }).partial().passthrough();
+var ValidationError = z.object({
+  loc: z.array(z.union([z.string(), z.number()])),
+  msg: z.string(),
+  type: z.string(),
+  input: z.unknown().optional(),
+  ctx: z.object({}).partial().passthrough().optional()
+}).passthrough();
+z.object({ detail: z.array(ValidationError) }).partial().passthrough();
+z.object({
+  key: z.string(),
+  display_name: z.string(),
+  position: z.number().int(),
+  auto_extract: z.boolean()
+}).passthrough();
+var LabelDefinitionItem = z.object({
+  key: z.string().max(50),
+  display_name: z.string().max(100),
+  auto_extract: z.boolean().optional().default(false)
+}).passthrough();
+z.object({ labels: z.array(LabelDefinitionItem) }).passthrough();
+var UserResponse = z.object({
+  id: z.string().uuid(),
+  email: z.string(),
+  name: z.string(),
+  role_name: z.string(),
+  is_active: z.boolean(),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+z.object({
+  email: z.string().max(254),
+  name: z.string().max(200).optional().default(""),
+  role_id: z.string().uuid(),
+  timezone: z.union([z.string(), z.null()]).optional()
+});
+z.object({ role_id: z.string().uuid() }).passthrough();
+var ApiKeyResponse = z.object({
+  id: z.string().uuid(),
+  key_prefix: z.string(),
+  name: z.string(),
+  expires_at: z.union([z.string(), z.null()]),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+z.object({
+  name: z.string(),
+  expires_at: z.union([z.string(), z.null()]).optional()
+}).passthrough();
+var ApiKeyCreatedResponse = z.object({
+  id: z.string().uuid(),
+  key_prefix: z.string(),
+  full_key: z.string(),
+  name: z.string(),
+  expires_at: z.union([z.string(), z.null()]),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+var RoleResponse = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  scope: z.string(),
+  is_system: z.boolean(),
+  permissions: z.array(z.string())
+}).passthrough();
+z.object({ name: z.string(), permissions: z.array(z.string()) }).passthrough();
+var ProxyTargetRequest = z.object({
+  proxy_type: z.string().default("residential"),
+  region: z.string().default(""),
+  city: z.string().default(""),
+  isp: z.string().default("")
+}).partial().passthrough();
+z.object({
+  url: z.union([z.string(), z.null()]).optional(),
+  ad_tag: z.union([z.string(), z.null()]).optional(),
+  country_code: z.string().min(2).max(2),
+  emulator_id: z.string().min(1).max(100),
+  proxy: ProxyTargetRequest.optional(),
+  labels: z.record(z.string()).optional(),
+  campaign_id: z.union([z.string(), z.null()]).optional(),
+  run_id: z.union([z.string(), z.null()]).optional()
+}).passthrough();
+var ScanStatus = z.enum([
+  "pending",
+  "running",
+  "crawled",
+  "checking",
+  "checking_async",
+  "completed",
+  "partial",
+  "failed",
+  "cancelled"
+]);
+var SubRequestResponse = z.lazy(
+  () => z.object({
+    url: z.string(),
+    resource_type: z.string(),
+    status_code: z.number().int(),
+    content_type: z.string(),
+    body_size: z.number().int(),
+    timestamp_ms: z.number().int(),
+    children: z.array(SubRequestResponse).optional()
+  }).passthrough()
+);
+var RedirectHopResponse = z.object({
+  url: z.string(),
+  status_code: z.number().int(),
+  content_type: z.string(),
+  body_size: z.number().int(),
+  timestamp_ms: z.number().int(),
+  redirected_from: z.string(),
+  sub_requests: z.array(SubRequestResponse)
+}).passthrough();
+var ProxyTargetResponse = z.object({
+  proxy_type: z.string(),
+  region: z.string().optional().default(""),
+  city: z.string().optional().default(""),
+  isp: z.string().optional().default("")
+}).passthrough();
+var IabCategoryResponse = z.object({
+  tier1: z.string(),
+  tier2: z.union([z.string(), z.null()]).optional(),
+  tier3: z.union([z.string(), z.null()]).optional(),
+  tier4: z.union([z.string(), z.null()]).optional()
+}).passthrough();
+var ScanClassificationResponse = z.object({
+  brand: z.union([z.string(), z.null()]),
+  iab_v2: z.union([IabCategoryResponse, z.null()]),
+  iab_v3: z.union([IabCategoryResponse, z.null()])
+}).partial().passthrough();
+var LandingResponse = z.object({
+  ord: z.number().int(),
+  opener_url: z.string().optional().default(""),
+  final_url: z.string().optional().default(""),
+  offer_url: z.string().optional().default(""),
+  page_title: z.string().optional().default(""),
+  screenshot_url: z.string().optional().default(""),
+  redirect_chain: z.array(RedirectHopResponse).optional(),
+  elapsed_ms: z.number().int().optional().default(0),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+var ScanResponse = z.object({
+  id: z.string().uuid(),
+  url: z.string(),
+  country_code: z.string(),
+  emulator_id: z.string(),
+  status: ScanStatus,
+  offer_url: z.string(),
+  redirect_chain: z.array(RedirectHopResponse),
+  screenshot_url: z.string().optional().default(""),
+  ad_tag: z.union([z.string(), z.null()]).optional(),
+  creative_screenshot_url: z.string().optional().default(""),
+  creative_width: z.number().int().optional().default(0),
+  creative_height: z.number().int().optional().default(0),
+  proxy: z.union([ProxyTargetResponse, z.null()]).optional(),
+  page_title: z.string(),
+  elapsed_ms: z.number().int(),
+  error: z.string(),
+  labels: z.record(z.string()).optional(),
+  classification: z.union([ScanClassificationResponse, z.null()]).optional(),
+  campaign_id: z.union([z.string(), z.null()]).optional(),
+  campaign_name: z.union([z.string(), z.null()]).optional(),
+  created_at: z.string().datetime({ offset: true }),
+  completed_at: z.union([z.string(), z.null()]),
+  landings: z.array(LandingResponse).optional()
+}).passthrough();
+z.union([z.string(), z.null()]).optional();
+var ScanBriefResponse = z.object({
+  id: z.string().uuid(),
+  url: z.string(),
+  country_code: z.string(),
+  proxy_type: z.string().optional().default("residential"),
+  status: ScanStatus,
+  offer_url: z.string(),
+  screenshot_url: z.string().optional().default(""),
+  labels: z.record(z.string()).optional(),
+  classification: z.union([ScanClassificationResponse, z.null()]).optional(),
+  elapsed_ms: z.number().int(),
+  created_at: z.string().datetime({ offset: true }),
+  campaign_id: z.union([z.string(), z.null()]).optional(),
+  campaign_name: z.union([z.string(), z.null()]).optional(),
+  is_ad_tag: z.boolean().optional().default(false)
+}).passthrough();
+z.object({
+  items: z.array(ScanBriefResponse),
+  total: z.number().int(),
+  page: z.number().int(),
+  limit: z.number().int(),
+  pages: z.number().int()
+}).passthrough();
+z.object({
+  url: z.union([z.string(), z.null()]).optional(),
+  ad_tag: z.union([z.string(), z.null()]).optional(),
+  country_codes: z.array(z.string()).min(1),
+  emulator_id: z.string().min(1).max(100),
+  proxy: ProxyTargetRequest.optional(),
+  labels: z.record(z.string()).optional()
+}).passthrough();
+z.object({
+  scope_type: z.enum(["last_n", "hours"]),
+  scope_value: z.number().int().gt(0)
+}).passthrough();
+z.object({ queued_count: z.number().int() }).passthrough();
+z.object({ cancelled_count: z.number().int() }).passthrough();
+z.union([z.number(), z.null()]).optional();
+var GeoResponse = z.object({
+  country_code: z.string(),
+  name: z.string(),
+  region: z.string(),
+  tier: z.string()
+}).passthrough();
+var EmulatorResponse = z.object({
+  id: z.string(),
+  display_name: z.string(),
+  category: z.string(),
+  browser: z.string()
+}).passthrough();
+z.object({ name: z.string().min(1).max(200) }).passthrough();
+var CampaignGroupResponse = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  is_default: z.boolean(),
+  is_archived: z.boolean(),
+  schedule_paused: z.boolean(),
+  created_at: z.string().datetime({ offset: true }),
+  campaign_count: z.union([z.number(), z.null()]).optional()
+}).passthrough();
+z.object({ name: z.union([z.string(), z.null()]) }).partial().passthrough();
+var BulkCampaignFailure = z.object({
+  campaign_id: z.string().uuid(),
+  error_code: z.string(),
+  detail: z.string()
+}).passthrough();
+var GroupActionResponse = z.object({
+  group_id: z.string().uuid(),
+  affected_campaigns: z.number().int(),
+  cancelled_count: z.number().int().optional().default(0),
+  run_ids: z.array(z.string().uuid()).optional(),
+  failures: z.array(BulkCampaignFailure).optional()
+}).passthrough();
+z.object({
+  name: z.string().min(1).max(200),
+  campaign_type: z.string().optional().default("url"),
+  url: z.union([z.string(), z.null()]).optional(),
+  ad_tag: z.union([z.string(), z.null()]).optional(),
+  country_codes: z.array(z.string()).min(1),
+  group_id: z.union([z.string(), z.null()]).optional(),
+  emulator_categories: z.array(z.string()).optional(),
+  emulator_specific_ids: z.array(z.string()).optional(),
+  emulator_mode: z.string().optional().default("random"),
+  proxy_type: z.string().optional().default("residential"),
+  proxy_region: z.string().optional().default(""),
+  proxy_city: z.string().optional().default(""),
+  proxy_isp: z.string().optional().default(""),
+  labels: z.record(z.string()).optional(),
+  policy_set_id: z.union([z.string(), z.null()]).optional(),
+  schedule_type: z.union([z.string(), z.null()]).optional(),
+  schedule_weekly: z.union([z.record(z.array(z.number().int())), z.null()]).optional(),
+  schedule_interval_seconds: z.union([z.number(), z.null()]).optional(),
+  schedule_enabled: z.union([z.boolean(), z.null()]).optional(),
+  schedule_timezone: z.union([z.string(), z.null()]).optional()
+}).passthrough();
+var EmulatorSelectionResponse = z.object({
+  categories: z.array(z.string()),
+  specific_ids: z.array(z.string()),
+  mode: z.string()
+}).passthrough();
+var CampaignResponse = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  campaign_type: z.string().optional().default("url"),
+  url: z.string(),
+  ad_tag: z.union([z.string(), z.null()]).optional(),
+  country_codes: z.array(z.string()),
+  group_id: z.string().uuid(),
+  emulator_selection: EmulatorSelectionResponse,
+  proxy_type: z.string().optional().default("residential"),
+  proxy_region: z.string().optional().default(""),
+  proxy_city: z.string().optional().default(""),
+  proxy_isp: z.string().optional().default(""),
+  schedule_type: z.union([z.string(), z.null()]).optional(),
+  schedule_weekly: z.union([z.record(z.array(z.number().int())), z.null()]).optional(),
+  schedule_interval_seconds: z.union([z.number(), z.null()]).optional(),
+  schedule_timezone: z.union([z.string(), z.null()]).optional(),
+  labels: z.record(z.string()).optional(),
+  policy_set_id: z.union([z.string(), z.null()]).optional(),
+  schedule_enabled: z.boolean(),
+  is_archived: z.boolean(),
+  created_at: z.string().datetime({ offset: true }),
+  last_run_at: z.union([z.string(), z.null()]).optional()
+}).passthrough();
+z.object({
+  items: z.array(CampaignResponse),
+  total: z.number().int(),
+  page: z.number().int(),
+  limit: z.number().int(),
+  pages: z.number().int()
+}).passthrough();
+var CampaignPickerItem = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  group_id: z.string().uuid(),
+  is_archived: z.boolean()
+}).passthrough();
+z.object({
+  name: z.union([z.string(), z.null()]),
+  url: z.union([z.string(), z.null()]),
+  ad_tag: z.union([z.string(), z.null()]),
+  country_codes: z.union([z.array(z.string()), z.null()]),
+  group_id: z.union([z.string(), z.null()]),
+  emulator_categories: z.union([z.array(z.string()), z.null()]),
+  emulator_specific_ids: z.union([z.array(z.string()), z.null()]),
+  emulator_mode: z.union([z.string(), z.null()]),
+  proxy_type: z.union([z.string(), z.null()]),
+  proxy_region: z.union([z.string(), z.null()]),
+  proxy_city: z.union([z.string(), z.null()]),
+  proxy_isp: z.union([z.string(), z.null()]),
+  labels: z.union([z.record(z.string()), z.null()]),
+  policy_set_id: z.union([z.string(), z.null()]),
+  schedule_type: z.union([z.string(), z.null()]),
+  schedule_weekly: z.union([z.record(z.array(z.number().int())), z.null()]),
+  schedule_interval_seconds: z.union([z.number(), z.null()]),
+  schedule_enabled: z.union([z.boolean(), z.null()]),
+  schedule_timezone: z.union([z.string(), z.null()])
+}).partial().passthrough();
+var RunSource = z.enum(["ui", "api"]);
+var RunResponse = z.object({
+  id: z.string().uuid(),
+  campaign_id: z.string().uuid(),
+  label: z.string(),
+  total: z.number().int(),
+  completed: z.number().int(),
+  failed: z.number().int(),
+  partial: z.number().int(),
+  cancelled: z.number().int(),
+  source: RunSource,
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+z.object({
+  items: z.array(RunResponse),
+  total: z.number().int(),
+  page: z.number().int(),
+  limit: z.number().int(),
+  pages: z.number().int()
+}).passthrough();
+var ScanTileResponse = z.object({
+  id: z.string().uuid(),
+  country_code: z.string(),
+  status: z.string(),
+  offer_url: z.string().optional().default(""),
+  screenshot_url: z.string().optional().default(""),
+  elapsed_ms: z.number().int().optional().default(0),
+  error: z.string().optional().default("")
+}).passthrough();
+z.object({
+  items: z.array(ScanTileResponse),
+  total: z.number().int(),
+  page: z.number().int(),
+  limit: z.number().int(),
+  pages: z.number().int()
+}).passthrough();
+var ScanTagResponse = z.object({
+  id: z.string().uuid(),
+  scan_id: z.string().uuid(),
+  tag_slug: z.string(),
+  detail: z.string(),
+  url: z.string().optional().default(""),
+  display_name: z.string().optional().default(""),
+  category: z.string().optional().default(""),
+  severity: z.string().optional().default(""),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+var TagDefinitionWithStatsResponse = z.object({
+  slug: z.string(),
+  category: z.string(),
+  source: z.string(),
+  display_name: z.string(),
+  description: z.string(),
+  is_system: z.boolean(),
+  organization_id: z.union([z.string(), z.null()]),
+  show_in_public_report: z.boolean(),
+  severity: z.string(),
+  scans_count: z.number().int(),
+  rules_count: z.number().int()
+}).passthrough();
+var LinkedRuleResponse = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  rule_type: z.string(),
+  target: z.string(),
+  is_active: z.boolean()
+}).passthrough();
+var TagDefinitionDetailResponse = z.object({
+  slug: z.string(),
+  category: z.string(),
+  source: z.string(),
+  display_name: z.string(),
+  description: z.string(),
+  is_system: z.boolean(),
+  organization_id: z.union([z.string(), z.null()]),
+  show_in_public_report: z.boolean(),
+  severity: z.string(),
+  scans_count: z.number().int(),
+  rules_count: z.number().int(),
+  linked_rules: z.array(LinkedRuleResponse).optional()
+}).passthrough();
+var TagSeverity = z.enum(["high", "medium", "low"]);
+z.object({
+  display_name: z.union([z.string(), z.null()]),
+  description: z.union([z.string(), z.null()]),
+  show_in_public_report: z.union([z.boolean(), z.null()]),
+  severity: z.union([TagSeverity, z.null()])
+}).partial().passthrough();
+z.object({
+  name: z.string().min(1).max(200),
+  tag_slug: z.string().max(100).optional().default(""),
+  rule_type: z.string().max(50),
+  config: z.object({}).partial().passthrough(),
+  target: z.string().max(30).optional().default("page")
+}).passthrough();
+var CustomRuleResponse = z.object({
+  id: z.string().uuid(),
+  organization_id: z.string().uuid(),
+  name: z.string(),
+  tag_slug: z.string(),
+  rule_type: z.string(),
+  config: z.object({}).partial().passthrough(),
+  target: z.string(),
+  is_active: z.boolean(),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+z.object({
+  items: z.array(CustomRuleResponse),
+  total: z.number().int(),
+  page: z.number().int(),
+  limit: z.number().int(),
+  pages: z.number().int()
+}).passthrough();
+z.object({
+  name: z.union([z.string(), z.null()]),
+  tag_slug: z.union([z.string(), z.null()]),
+  config: z.union([z.object({}).partial().passthrough(), z.null()]),
+  target: z.union([z.string(), z.null()]),
+  is_active: z.union([z.boolean(), z.null()])
+}).partial().passthrough();
+z.object({
+  scan_id: z.string().uuid(),
+  rule_type: z.string(),
+  config: z.object({}).partial().passthrough(),
+  target: z.string().optional().default("page")
+}).passthrough();
+var RuleTestTagResult = z.object({ tag_slug: z.string(), detail: z.string().optional().default("") }).passthrough();
+var RuleTestResponse = z.object({
+  matched: z.boolean(),
+  tags: z.array(RuleTestTagResult),
+  elapsed_ms: z.number().int(),
+  llm_failed: z.boolean().optional().default(false),
+  llm_call_id: z.union([z.string(), z.null()]).optional(),
+  llm_prompt_url: z.string().optional().default(""),
+  llm_response_url: z.string().optional().default("")
+}).passthrough();
+var PolicyEntryRequest = z.object({
+  tag_slug: z.string().min(1).max(100),
+  country_codes: z.array(z.string()).max(50).optional()
+}).passthrough();
+z.object({
+  name: z.string().min(1).max(200),
+  description: z.string().max(2e3).optional().default(""),
+  entries: z.array(PolicyEntryRequest).min(1).max(500)
+}).passthrough();
+var PolicyEntryResponse = z.object({
+  id: z.string().uuid(),
+  tag_slug: z.string(),
+  country_codes: z.array(z.string())
+}).passthrough();
+var PolicySetResponse = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  description: z.string(),
+  organization_id: z.string().uuid(),
+  visibility: z.string(),
+  is_approved: z.boolean(),
+  entries: z.array(PolicyEntryResponse),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+var VisibilityType = z.enum(["private", "public"]);
+z.union([VisibilityType, z.null()]).optional();
+var PolicySetListItem = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  description: z.string(),
+  organization_id: z.string().uuid(),
+  visibility: z.string(),
+  is_approved: z.boolean(),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+z.object({
+  items: z.array(PolicySetListItem),
+  total: z.number().int(),
+  page: z.number().int(),
+  limit: z.number().int(),
+  pages: z.number().int()
+}).passthrough();
+z.object({
+  name: z.string().min(1).max(200),
+  description: z.string().max(2e3).optional().default(""),
+  entries: z.array(PolicyEntryRequest).min(1).max(500)
+}).passthrough();
+var AlertStatus = z.enum(["open", "acknowledged", "resolved", "dismissed"]);
+z.union([AlertStatus, z.null()]).optional();
+var AlertResponse = z.object({
+  id: z.string().uuid(),
+  scan_id: z.string().uuid(),
+  campaign_id: z.string().uuid(),
+  policy_set_id: z.union([z.string(), z.null()]),
+  violation_rule_id: z.union([z.string(), z.null()]),
+  organization_id: z.string().uuid(),
+  tag_slug: z.string(),
+  country_code: z.string(),
+  status: z.string(),
+  closed_by: z.union([z.string(), z.null()]),
+  created_at: z.string().datetime({ offset: true }),
+  updated_at: z.union([z.string(), z.null()]),
+  scan_url: z.string(),
+  offer_url: z.string(),
+  tag_display_name: z.string()
+}).passthrough();
+z.object({
+  items: z.array(AlertResponse),
+  total: z.number().int(),
+  page: z.number().int(),
+  limit: z.number().int(),
+  pages: z.number().int()
+}).passthrough();
+z.object({ status: AlertStatus }).passthrough();
+var AlertStatsResponse = z.object({
+  open: z.number().int(),
+  acknowledged: z.number().int(),
+  resolved: z.number().int(),
+  dismissed: z.number().int()
+}).passthrough();
+var BlockReason = z.enum(["no_subscription", "suspended", "insufficient_funds"]);
+var BillingSummaryResponse = z.object({
+  balance_micros: z.number().int(),
+  plan_name: z.union([z.string(), z.null()]),
+  plan_id: z.union([z.string(), z.null()]),
+  checks_per_period: z.union([z.number(), z.null()]),
+  checks_used: z.union([z.number(), z.null()]),
+  period_start: z.union([z.string(), z.null()]),
+  period_end: z.union([z.string(), z.null()]),
+  price_per_extra_check_micros: z.union([z.number(), z.null()]),
+  current_plan_is_custom: z.boolean().optional().default(false),
+  is_suspended: z.boolean().optional().default(false),
+  scheduled_next_plan_id: z.union([z.string(), z.null()]).optional(),
+  scheduled_next_plan_name: z.union([z.string(), z.null()]).optional(),
+  scheduled_effective_at: z.union([z.string(), z.null()]).optional(),
+  can_create_scan: z.boolean().optional().default(true),
+  block_reason: z.union([BlockReason, z.null()]).optional(),
+  billing_mode: z.string().optional().default("prepaid"),
+  credit_limit_micros: z.number().int().optional().default(0),
+  effective_minimum_balance_micros: z.number().int().optional().default(0)
+}).passthrough();
+var UsageResponse = z.object({
+  id: z.string().uuid(),
+  scan_id: z.string().uuid(),
+  charged_micros: z.number().int(),
+  balance_after_micros: z.number().int(),
+  within_plan: z.boolean(),
+  event_type: z.string(),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+z.object({
+  items: z.array(UsageResponse),
+  total: z.number().int(),
+  page: z.number().int(),
+  limit: z.number().int(),
+  pages: z.number().int()
+}).passthrough();
+var UsagePeriodSummaryResponse = z.object({
+  period_start: z.string().datetime({ offset: true }),
+  period_end: z.string().datetime({ offset: true }),
+  checks: z.number().int(),
+  rechecks: z.number().int(),
+  within_plan: z.number().int(),
+  overage: z.number().int(),
+  charged_micros: z.number().int()
+}).passthrough();
+var BalanceTransactionType = z.enum([
+  "initial_balance",
+  "top_up_manual",
+  "usage_charge",
+  "subscription_renewal",
+  "subscription_upgrade",
+  "admin_adjustment",
+  "refund",
+  "invoice_settlement",
+  "crypto_top_up"
+]);
+z.union([z.array(BalanceTransactionType), z.null()]).optional();
+var BalanceTransactionResponse = z.object({
+  id: z.string().uuid(),
+  type: z.string(),
+  amount_micros: z.number().int(),
+  balance_after_micros: z.number().int(),
+  description: z.string(),
+  reference_kind: z.union([z.string(), z.null()]),
+  reference_id: z.union([z.string(), z.null()]),
+  actor_user_id: z.union([z.string(), z.null()]),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+z.object({
+  items: z.array(BalanceTransactionResponse),
+  total: z.number().int(),
+  page: z.number().int(),
+  limit: z.number().int(),
+  pages: z.number().int()
+}).passthrough();
+var EndpointHealthResponse = z.object({
+  consecutive_failures: z.number().int(),
+  last_delivery_at: z.union([z.string(), z.null()]),
+  last_delivery_status: z.union([z.number(), z.null()]),
+  success_rate_7d: z.number()
+}).passthrough();
+var WebhookResponse = z.object({
+  id: z.string().uuid(),
+  url: z.string(),
+  description: z.string(),
+  event_types: z.array(z.string()),
+  campaign_ids: z.union([z.array(z.string().uuid()), z.null()]),
+  is_active: z.boolean(),
+  disabled_reason: z.union([z.string(), z.null()]),
+  disabled_reason_detail: z.union([z.string(), z.null()]),
+  disabled_at: z.union([z.string(), z.null()]),
+  health: EndpointHealthResponse,
+  created_at: z.string().datetime({ offset: true }),
+  updated_at: z.string().datetime({ offset: true })
+}).passthrough();
+z.object({
+  url: z.string().min(1).max(2048),
+  description: z.string().max(256).optional().default(""),
+  event_types: z.array(z.string()).optional(),
+  campaign_ids: z.union([z.array(z.string().uuid()), z.null()]).optional()
+}).passthrough();
+z.object({ webhook: WebhookResponse, secret: z.string() }).passthrough();
+var EventCatalogEntryResponse = z.object({
+  event_type: z.string(),
+  description: z.string(),
+  sample_payload: z.object({}).partial().passthrough()
+}).passthrough();
+var EventCatalogResponse = z.object({ entries: z.array(EventCatalogEntryResponse) }).passthrough();
+z.object({
+  url: z.union([z.string(), z.null()]),
+  description: z.union([z.string(), z.null()]),
+  event_types: z.union([z.array(z.string()), z.null()]),
+  campaign_ids: z.union([z.array(z.string().uuid()), z.null()]),
+  clear_campaign_ids: z.boolean().default(false),
+  is_active: z.union([z.boolean(), z.null()])
+}).partial().passthrough();
+z.object({ event_type: z.string() }).passthrough();
+var TestWebhookResponse = z.object({
+  success: z.boolean(),
+  response_status: z.union([z.number(), z.null()]),
+  elapsed_ms: z.number().int(),
+  error_code: z.union([z.string(), z.null()]),
+  response_body: z.string()
+}).passthrough();
+z.union([z.boolean(), z.null()]).optional();
+var DeliveryAttemptResponse = z.object({
+  id: z.string().uuid(),
+  event_id: z.string().uuid(),
+  event_type: z.string(),
+  response_status: z.union([z.number(), z.null()]),
+  response_body: z.union([z.string(), z.null()]),
+  success: z.boolean(),
+  attempt_number: z.number().int(),
+  error_code: z.union([z.string(), z.null()]),
+  elapsed_ms: z.union([z.number(), z.null()]),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+z.object({
+  items: z.array(DeliveryAttemptResponse),
+  total: z.number().int(),
+  page: z.number().int(),
+  limit: z.number().int(),
+  pages: z.number().int()
+}).passthrough();
+z.object({
+  from_ts: z.string().datetime({ offset: true }),
+  to_ts: z.string().datetime({ offset: true })
+}).passthrough();
+var BulkReplayResponse = z.object({ replayed: z.number().int(), skipped: z.number().int() }).passthrough();
+var AlertNotificationVersion = z.enum(["public", "internal"]);
+var AlertNotificationDestinationResponse = z.object({
+  id: z.string().uuid(),
+  organization_id: z.string().uuid(),
+  channel: z.string(),
+  name: z.string(),
+  is_active: z.boolean(),
+  is_default_target: z.boolean(),
+  version: AlertNotificationVersion,
+  consecutive_failures: z.number().int(),
+  last_delivery_at: z.union([z.string(), z.null()]),
+  last_delivery_status: z.union([z.number(), z.null()]),
+  slack_workspace_id: z.union([z.string(), z.null()]),
+  slack_channel_id: z.union([z.string(), z.null()]),
+  slack_channel_name: z.union([z.string(), z.null()]),
+  telegram_chat_id: z.union([z.number(), z.null()]),
+  telegram_chat_title: z.union([z.string(), z.null()]),
+  telegram_chat_type: z.union([z.string(), z.null()]),
+  email_address: z.union([z.string(), z.null()]),
+  included_label_keys: z.array(z.string()),
+  created_at: z.string().datetime({ offset: true }),
+  updated_at: z.string().datetime({ offset: true })
+}).passthrough();
+z.object({ version: AlertNotificationVersion }).passthrough();
+var CampaignOverridesResponse = z.object({
+  campaign_id: z.string().uuid(),
+  mode: z.string(),
+  destination_ids: z.array(z.string().uuid())
+}).passthrough();
+z.object({
+  mode: z.string().min(1).max(16),
+  destination_ids: z.array(z.string().uuid()).optional().default([])
+}).passthrough();
+var InvoiceType = z.enum(["proforma", "final"]);
+z.union([InvoiceType, z.null()]).optional();
+var InvoiceStatus = z.enum(["draft", "issued", "paid", "voided", "overdue"]);
+z.union([InvoiceStatus, z.null()]).optional();
+var InvoiceResponse = z.object({
+  id: z.string().uuid(),
+  number: z.string(),
+  organization_id: z.string().uuid(),
+  type: z.string(),
+  status: z.string(),
+  total_micros: z.number().int(),
+  currency: z.string(),
+  period_start: z.union([z.string(), z.null()]),
+  period_end: z.union([z.string(), z.null()]),
+  issued_at: z.union([z.string(), z.null()]),
+  paid_at: z.union([z.string(), z.null()]),
+  voided_at: z.union([z.string(), z.null()]),
+  has_pdf: z.boolean(),
+  description: z.string(),
+  payment_method: z.string(),
+  created_at: z.string().datetime({ offset: true })
+}).passthrough();
+z.object({
+  items: z.array(InvoiceResponse),
+  total: z.number().int(),
+  page: z.number().int(),
+  limit: z.number().int(),
+  pages: z.number().int()
+}).passthrough();
+z.object({ url: z.union([z.string(), z.null()]), ready: z.boolean() }).passthrough();
+z.object({
+  name: z.string().min(2).max(100),
+  email: z.string().email(),
+  message: z.string().min(10).max(2e3),
+  source: z.string().max(512).optional().default("")
+}).passthrough();
+z.object({
+  id: z.string().uuid(),
+  received_at: z.string().datetime({ offset: true })
+}).passthrough();
+var PreferredContactChannel = z.enum(["telegram", "whatsapp", "email"]);
+z.object({
+  first_name: z.string().min(2).max(60),
+  last_name: z.string().min(2).max(60),
+  company_email: z.string().email(),
+  company_name: z.string().min(2).max(120),
+  preferred_channel: PreferredContactChannel,
+  contact_handle: z.string().max(120).optional().default(""),
+  comment: z.string().max(2e3).optional().default(""),
+  privacy_accepted: z.boolean(),
+  source: z.string().max(512).optional().default("")
+}).passthrough();
+z.object({
+  id: z.string().uuid(),
+  received_at: z.string().datetime({ offset: true })
+}).passthrough();
+var schemas = {
+  OrgResponse,
+  UserResponse,
+  ApiKeyResponse,
+  ApiKeyCreatedResponse,
+  RoleResponse,
+  ScanResponse,
+  ScanBriefResponse,
+  GeoResponse,
+  EmulatorResponse,
+  CampaignGroupResponse,
+  GroupActionResponse,
+  CampaignResponse,
+  CampaignPickerItem,
+  RunResponse,
+  ScanTileResponse,
+  ScanTagResponse,
+  TagDefinitionWithStatsResponse,
+  LinkedRuleResponse,
+  TagDefinitionDetailResponse,
+  CustomRuleResponse,
+  RuleTestResponse,
+  PolicyEntryResponse,
+  PolicySetResponse,
+  PolicySetListItem,
+  AlertResponse,
+  AlertStatsResponse,
+  BillingSummaryResponse,
+  UsageResponse,
+  UsagePeriodSummaryResponse,
+  BalanceTransactionResponse,
+  WebhookResponse,
+  EventCatalogResponse,
+  TestWebhookResponse,
+  DeliveryAttemptResponse,
+  BulkReplayResponse,
+  AlertNotificationDestinationResponse,
+  CampaignOverridesResponse,
+  InvoiceResponse};
+function parseWithSchema(schema, raw, label) {
+  const parsed = schema.safeParse(raw);
+  if (parsed.success) return ok(stripUndefinedKeys(parsed.data));
+  const first = parsed.error.issues[0];
+  const path = first?.path.join(".") ?? "";
+  const message = first?.message ?? "validation failed";
+  const detail2 = path === "" ? `malformed ${label}: ${message}` : `malformed ${label}: ${path}: ${message}`;
+  return err({ kind: "upstream", detail: detail2 });
+}
+function stripUndefinedKeys(value) {
+  if (Array.isArray(value)) return value.map(stripUndefinedKeys);
+  if (value === null || typeof value !== "object") return value;
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    if (v === void 0) continue;
+    out[k] = stripUndefinedKeys(v);
+  }
+  return out;
+}
+function parsePagedWithItemSchema(itemSchema, raw, label) {
+  const envelope = z.object({
+    items: z.array(itemSchema),
+    total: z.number(),
+    page: z.number(),
+    limit: z.number()
+  }).passthrough();
+  return parseWithSchema(envelope, raw, `${label} page`);
+}
+function parseArrayOrItemsWithSchema(itemSchema, raw, label) {
+  if (Array.isArray(raw)) {
+    return parseWithSchema(z.array(itemSchema), raw, label);
+  }
+  if (raw !== null && typeof raw === "object" && "items" in raw) {
+    const items = raw.items;
+    return parseWithSchema(z.array(itemSchema), items, label);
+  }
+  return err({
+    kind: "upstream",
+    detail: `expected array (or {items:[]}) of ${label}`
+  });
+}
+
+// src/infrastructure/api/parsers/parse-alert.ts
+var AlertSchema = schemas.AlertResponse.pick({
+  id: true,
+  scan_id: true,
+  campaign_id: true,
+  policy_set_id: true,
+  violation_rule_id: true,
+  tag_slug: true,
+  tag_display_name: true,
+  country_code: true,
+  status: true,
+  closed_by: true,
+  scan_url: true,
+  offer_url: true,
+  created_at: true,
+  updated_at: true
+}).strip();
+var parseAlertPage = (raw) => parsePagedWithItemSchema(AlertSchema, raw, "alerts");
+var ApiKeySchema = schemas.ApiKeyResponse.pick({
+  id: true,
+  key_prefix: true,
+  name: true,
+  expires_at: true,
+  created_at: true
+}).strip();
+var ApiKeyListSchema = z.array(ApiKeySchema);
+var parseApiKeyList = (raw) => parseWithSchema(ApiKeyListSchema, raw, "api-keys");
+
+// src/infrastructure/api/parsers/parse-billing-summary.ts
+var BillingSummarySchema = schemas.BillingSummaryResponse.pick({
+  balance_micros: true,
+  plan_id: true,
+  plan_name: true,
+  checks_per_period: true,
+  checks_used: true,
+  period_start: true,
+  period_end: true,
+  price_per_extra_check_micros: true,
+  is_suspended: true,
+  can_create_scan: true,
+  billing_mode: true,
+  block_reason: true
+}).strip();
+var parseBillingSummary = (raw) => parseWithSchema(BillingSummarySchema, raw, "billing-summary");
+
+// src/infrastructure/api/parsers/parse-campaign.ts
+var CampaignSchema = schemas.CampaignResponse.pick({
+  id: true,
+  name: true,
+  campaign_type: true,
+  url: true,
+  ad_tag: true,
+  country_codes: true,
+  group_id: true,
+  labels: true,
+  policy_set_id: true,
+  schedule_enabled: true,
+  schedule_type: true,
+  is_archived: true,
+  created_at: true,
+  last_run_at: true
+}).strip();
+var parseCampaign = (raw) => parseWithSchema(CampaignSchema, raw, "campaign");
+var parseCampaignPage = (raw) => parsePagedWithItemSchema(CampaignSchema, raw, "campaigns");
+
+// src/infrastructure/api/parsers/parse-campaign-group.ts
+var CampaignGroupSchema = schemas.CampaignGroupResponse.pick({
+  id: true,
+  name: true,
+  is_default: true,
+  is_archived: true,
+  schedule_paused: true,
+  campaign_count: true,
+  created_at: true
+}).strip();
+var parseCampaignGroup = (raw) => parseWithSchema(CampaignGroupSchema, raw, "campaign-group");
+var parseCampaignGroupArray = (raw) => parseArrayOrItemsWithSchema(CampaignGroupSchema, raw, "campaign-groups");
+var CampaignPickerSchema = schemas.CampaignPickerItem.pick({
+  id: true,
+  name: true,
+  group_id: true,
+  is_archived: true
+}).strip();
+var CampaignPickerArraySchema = z.array(CampaignPickerSchema);
+var parseCampaignPickerArray = (raw) => parseWithSchema(CampaignPickerArraySchema, raw, "campaigns-picker");
+
+// src/infrastructure/api/parsers/shared.ts
+function isStringRecord(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+
+// src/infrastructure/api/parsers/parse-count-envelope.ts
+function parseIntField(raw, fieldName) {
+  if (!isStringRecord(raw)) {
+    return err({ kind: "upstream", detail: `expected object with ${fieldName}` });
+  }
+  const value = raw[fieldName];
+  if (typeof value !== "number" || !Number.isInteger(value)) {
+    return err({ kind: "upstream", detail: `${fieldName} must be an integer` });
+  }
+  return ok({ [fieldName]: value });
+}
+
+// src/infrastructure/api/parsers/parse-custom-rule.ts
+var CustomRuleSchema = schemas.CustomRuleResponse.pick({
+  id: true,
+  organization_id: true,
+  name: true,
+  tag_slug: true,
+  rule_type: true,
+  config: true,
+  target: true,
+  is_active: true,
+  created_at: true
+}).strip();
+var parseCustomRule = (raw) => parseWithSchema(CustomRuleSchema, raw, "custom-rule");
+
+// src/infrastructure/api/parsers/parse-custom-rule-page.ts
+var CustomRuleSchema2 = schemas.CustomRuleResponse.pick({
+  id: true,
+  organization_id: true,
+  name: true,
+  tag_slug: true,
+  rule_type: true,
+  config: true,
+  target: true,
+  is_active: true,
+  created_at: true
+}).strip();
+var parseCustomRulePage = (raw) => parsePagedWithItemSchema(CustomRuleSchema2, raw, "custom-rules");
+
+// src/infrastructure/api/parsers/parse-empty.ts
+function parseEmpty(_raw) {
+  return ok(null);
+}
+var EmulatorSchema = schemas.EmulatorResponse.pick({
+  id: true,
+  display_name: true,
+  category: true,
+  browser: true
+}).strip();
+var EmulatorListSchema = z.array(EmulatorSchema);
+var parseEmulatorList = (raw) => parseWithSchema(EmulatorListSchema, raw, "emulators");
+
+// src/infrastructure/api/parsers/parse-generic.ts
+function parsePageOf(parseItem) {
+  return (raw) => {
+    if (raw === null || typeof raw !== "object") {
+      return err({ kind: "upstream", detail: "malformed page envelope" });
+    }
+    const r = raw;
+    if (!Array.isArray(r.items) || typeof r.total !== "number" || typeof r.page !== "number" || typeof r.limit !== "number") {
+      return err({ kind: "upstream", detail: "page envelope: wrong field types" });
+    }
+    const out = [];
+    for (const item of r.items) {
+      const parsed = parseItem(item);
+      if (parsed.isErr()) return err(parsed.error);
+      out.push(parsed.value);
+    }
+    return ok({ items: out, total: r.total, page: r.page, limit: r.limit });
+  };
+}
+function parseArrayOf(parseItem) {
+  return (raw) => {
+    if (!Array.isArray(raw)) return err({ kind: "upstream", detail: "expected array" });
+    const out = [];
+    for (const item of raw) {
+      const r = parseItem(item);
+      if (r.isErr()) return err(r.error);
+      out.push(r.value);
+    }
+    return ok(out);
+  };
+}
+var OrgSchema = schemas.OrgResponse.pick({
+  id: true,
+  name: true,
+  owner_id: true,
+  is_active: true,
+  created_at: true
+}).strip();
+var parseOrg = (raw) => parseWithSchema(OrgSchema, raw, "org");
+var UserSchema = schemas.UserResponse.pick({
+  id: true,
+  email: true,
+  name: true,
+  role_name: true,
+  is_active: true,
+  created_at: true
+}).strip();
+var parseUser = (raw) => parseWithSchema(UserSchema, raw, "user");
+var RoleSchema = schemas.RoleResponse.pick({
+  id: true,
+  name: true,
+  scope: true,
+  is_system: true,
+  permissions: true
+}).strip();
+var parseRole = (raw) => parseWithSchema(RoleSchema, raw, "role");
+var ApiKeyCreatedSchema = schemas.ApiKeyCreatedResponse.pick({
+  id: true,
+  key_prefix: true,
+  full_key: true,
+  name: true,
+  expires_at: true,
+  created_at: true
+}).strip();
+var parseApiKeyCreated = (raw) => parseWithSchema(ApiKeyCreatedSchema, raw, "api-key-created");
+var ScanTagSchema = schemas.ScanTagResponse.pick({
+  id: true,
+  scan_id: true,
+  tag_slug: true,
+  detail: true,
+  url: true,
+  display_name: true,
+  category: true,
+  severity: true,
+  created_at: true
+}).strip();
+var parseScanTag = (raw) => parseWithSchema(ScanTagSchema, raw, "scan-tag");
+var RuleTestSchema = schemas.RuleTestResponse.pick({
+  matched: true,
+  elapsed_ms: true,
+  tags: true
+}).strip();
+var parseRuleTest = (raw) => parseWithSchema(RuleTestSchema, raw, "rule-test");
+var AlertStatsSchema = schemas.AlertStatsResponse.pick({
+  open: true,
+  acknowledged: true,
+  resolved: true,
+  dismissed: true
+}).strip();
+var parseAlertStats = (raw) => parseWithSchema(AlertStatsSchema, raw, "alert-stats");
+var UsageSchema = schemas.UsageResponse.pick({
+  id: true,
+  scan_id: true,
+  charged_micros: true,
+  balance_after_micros: true,
+  within_plan: true,
+  event_type: true,
+  created_at: true
+}).strip();
+var parseUsage = (raw) => parseWithSchema(UsageSchema, raw, "usage");
+var UsageSummarySchema = schemas.UsagePeriodSummaryResponse.pick({
+  period_start: true,
+  period_end: true,
+  checks: true,
+  rechecks: true,
+  within_plan: true,
+  overage: true,
+  charged_micros: true
+}).strip();
+var parseUsageSummary = (raw) => parseWithSchema(UsageSummarySchema, raw, "usage-summary");
+var BalanceTxSchema = schemas.BalanceTransactionResponse.pick({
+  id: true,
+  type: true,
+  amount_micros: true,
+  balance_after_micros: true,
+  description: true,
+  reference_kind: true,
+  reference_id: true,
+  actor_user_id: true,
+  created_at: true
+}).strip();
+var parseBalanceTx = (raw) => parseWithSchema(BalanceTxSchema, raw, "balance-tx");
+var InvoiceSchema = schemas.InvoiceResponse.pick({
+  id: true,
+  number: true,
+  type: true,
+  status: true,
+  total_micros: true,
+  currency: true,
+  period_start: true,
+  period_end: true,
+  issued_at: true,
+  paid_at: true,
+  voided_at: true,
+  has_pdf: true,
+  description: true,
+  payment_method: true,
+  created_at: true
+}).strip();
+var parseInvoice = (raw) => parseWithSchema(InvoiceSchema, raw, "invoice");
+var WebhookDeliverySchema = schemas.DeliveryAttemptResponse.pick({
+  id: true,
+  event_id: true,
+  event_type: true,
+  response_status: true,
+  success: true,
+  attempt_number: true,
+  error_code: true,
+  elapsed_ms: true,
+  created_at: true
+}).strip();
+var parseWebhookDelivery = (raw) => parseWithSchema(WebhookDeliverySchema, raw, "webhook-delivery");
+var EventCatalogSchema = schemas.EventCatalogResponse.pick({
+  entries: true
+}).strip();
+var parseEventCatalog = (raw) => parseWithSchema(EventCatalogSchema, raw, "event-catalog");
+var AlertDestinationSchema = schemas.AlertNotificationDestinationResponse.pick({
+  id: true,
+  channel: true,
+  name: true,
+  is_active: true,
+  is_default_target: true,
+  version: true,
+  consecutive_failures: true,
+  last_delivery_at: true,
+  last_delivery_status: true,
+  slack_workspace_id: true,
+  slack_channel_name: true,
+  telegram_chat_title: true,
+  telegram_chat_type: true,
+  email_address: true,
+  included_label_keys: true,
+  created_at: true,
+  updated_at: true
+}).strip();
+var parseAlertDestination = (raw) => parseWithSchema(AlertDestinationSchema, raw, "alert-destination");
+var CampaignOverridesSchema = schemas.CampaignOverridesResponse.pick({
+  campaign_id: true,
+  mode: true,
+  destination_ids: true
+}).strip();
+var parseCampaignAlertOverrides = (raw) => parseWithSchema(CampaignOverridesSchema, raw, "campaign-overrides");
+var BulkReplaySchema = schemas.BulkReplayResponse.pick({
+  replayed: true,
+  skipped: true
+}).strip();
+var parseBulkReplay = (raw) => parseWithSchema(BulkReplaySchema, raw, "bulk-replay");
+var GroupActionSchema = schemas.GroupActionResponse.pick({
+  group_id: true,
+  affected_campaigns: true,
+  cancelled_count: true,
+  run_ids: true,
+  failures: true
+}).strip();
+var parseGroupAction = (raw) => parseWithSchema(GroupActionSchema, raw, "group-action");
+schemas.PolicyEntryResponse.pick({
+  id: true,
+  tag_slug: true,
+  country_codes: true
+}).strip();
+var GeoSchema = schemas.GeoResponse.pick({
+  country_code: true,
+  name: true,
+  region: true,
+  tier: true
+}).strip();
+var GeoListSchema = z.array(GeoSchema);
+var parseGeoList = (raw) => parseWithSchema(GeoListSchema, raw, "geos");
+
+// src/infrastructure/api/parsers/parse-policy-set.ts
+var PolicySetSchema = schemas.PolicySetResponse.pick({
+  id: true,
+  name: true,
+  description: true,
+  organization_id: true,
+  visibility: true,
+  is_approved: true,
+  entries: true,
+  created_at: true
+}).strip();
+var parsePolicySet = (raw) => parseWithSchema(PolicySetSchema, raw, "policy-set");
+
+// src/infrastructure/api/parsers/parse-policy-set-page.ts
+var PolicySetListItemSchema = schemas.PolicySetListItem.pick({
+  id: true,
+  name: true,
+  description: true,
+  organization_id: true,
+  visibility: true,
+  is_approved: true,
+  created_at: true
+}).strip();
+var parsePolicySetPage = (raw) => parsePagedWithItemSchema(PolicySetListItemSchema, raw, "policy-sets");
+
+// src/infrastructure/api/parsers/parse-run.ts
+var RunSchema = schemas.RunResponse.pick({
+  id: true,
+  campaign_id: true,
+  label: true,
+  total: true,
+  completed: true,
+  failed: true,
+  partial: true,
+  cancelled: true,
+  source: true,
+  created_at: true
+}).strip();
+var parseRun = (raw) => parseWithSchema(RunSchema, raw, "run");
+
+// src/infrastructure/api/parsers/parse-run-scan-page.ts
+var ScanTileSchema = schemas.ScanTileResponse.pick({
+  id: true,
+  country_code: true,
+  status: true,
+  offer_url: true,
+  screenshot_url: true,
+  elapsed_ms: true,
+  error: true
+}).strip();
+var parseRunScanPage = (raw) => parsePagedWithItemSchema(ScanTileSchema, raw, "run-scans");
+var ScanSchema = schemas.ScanResponse.pick({
+  id: true,
+  url: true,
+  country_code: true,
+  emulator_id: true,
+  status: true,
+  offer_url: true,
+  screenshot_url: true,
+  ad_tag: true,
+  creative_screenshot_url: true,
+  page_title: true,
+  elapsed_ms: true,
+  error: true,
+  labels: true,
+  campaign_id: true,
+  campaign_name: true,
+  created_at: true,
+  completed_at: true
+}).strip();
+var ScanArraySchema = z.array(ScanSchema);
+var parseScan = (raw) => parseWithSchema(ScanSchema, raw, "scan");
+var parseScanArray = (raw) => parseWithSchema(ScanArraySchema, raw, "scans");
+
+// src/infrastructure/api/parsers/parse-scan-page.ts
+var ScanBriefSchema = schemas.ScanBriefResponse.pick({
+  id: true,
+  url: true,
+  country_code: true,
+  status: true,
+  offer_url: true,
+  screenshot_url: true,
+  labels: true,
+  elapsed_ms: true,
+  campaign_id: true,
+  campaign_name: true,
+  is_ad_tag: true,
+  created_at: true
+}).strip();
+var parseScanPage = (raw) => parsePagedWithItemSchema(ScanBriefSchema, raw, "scans");
+var TagDefinitionSchema = schemas.TagDefinitionWithStatsResponse.pick({
+  slug: true,
+  category: true,
+  source: true,
+  display_name: true,
+  description: true,
+  severity: true,
+  is_system: true,
+  organization_id: true,
+  show_in_public_report: true,
+  scans_count: true,
+  rules_count: true
+}).strip();
+var TagDefinitionArraySchema = z.array(TagDefinitionSchema);
+var LinkedRuleSchema = schemas.LinkedRuleResponse.pick({
+  id: true,
+  name: true,
+  is_active: true
+}).strip();
+var TagDetailSchema = schemas.TagDefinitionDetailResponse.pick({
+  slug: true,
+  category: true,
+  source: true,
+  display_name: true,
+  description: true,
+  severity: true,
+  is_system: true,
+  organization_id: true,
+  show_in_public_report: true,
+  scans_count: true,
+  rules_count: true
+}).extend({ linked_rules: z.array(LinkedRuleSchema).optional() }).strip();
+var parseTagDefinitionArray = (raw) => parseWithSchema(TagDefinitionArraySchema, raw, "tag-definitions");
+var parseTagDetail = (raw) => parseWithSchema(TagDetailSchema, raw, "tag-definition");
+var WebhookSchema = schemas.WebhookResponse.pick({
+  id: true,
+  url: true,
+  description: true,
+  event_types: true,
+  campaign_ids: true,
+  is_active: true,
+  disabled_reason: true,
+  disabled_at: true,
+  health: true,
+  created_at: true,
+  updated_at: true
+}).strip();
+var WebhookListSchema = z.array(WebhookSchema);
+var WebhookCreatedSchema = z.object({
+  webhook: WebhookSchema,
+  secret: z.string()
+}).strip();
+var TestWebhookResponseSchema = schemas.TestWebhookResponse.pick({
+  success: true,
+  response_status: true,
+  elapsed_ms: true,
+  error_code: true,
+  response_body: true
+}).strip();
+var parseWebhook = (raw) => parseWithSchema(WebhookSchema, raw, "webhook");
+var parseWebhookList = (raw) => parseWithSchema(WebhookListSchema, raw, "webhooks");
+var parseWebhookCreated = (raw) => parseWithSchema(WebhookCreatedSchema, raw, "webhook-created");
+var parseTestWebhookResponse = (raw) => parseWithSchema(TestWebhookResponseSchema, raw, "test-webhook");
+
+// src/infrastructure/api/http-api-gateway.ts
+function createHttpApiGateway(config) {
+  const { baseUrl, bearer, requestId, logger, dispatcher } = config;
+  const fetchImpl = async (input, init) => {
+    if (typeof input === "string" || input instanceof URL) {
+      throw new TypeError(
+        "createHttpApiGateway.fetchImpl: openapi-fetch is expected to always pass a Request"
+      );
+    }
+    const baseInit = { ...init ?? {} };
+    baseInit["method"] ??= input.method;
+    if (baseInit["headers"] === void 0) {
+      const merged = {};
+      input.headers.forEach((value, key) => {
+        merged[key] = value;
+      });
+      baseInit["headers"] = merged;
+    }
+    if (baseInit["body"] === void 0 && input.body !== null) {
+      baseInit["body"] = await input.text();
+      baseInit["duplex"] ??= "half";
+    }
+    if (dispatcher !== void 0) {
+      baseInit["dispatcher"] = dispatcher;
+    }
+    return fetch(
+      input.url,
+      baseInit
+    );
+  };
+  const client = createClient({
+    baseUrl,
+    fetch: fetchImpl,
+    headers: {
+      authorization: bearer.toAuthorizationHeader(),
+      "content-type": "application/json",
+      accept: "application/json",
+      "user-agent": "kaminari-ad-mcp",
+      "x-request-id": requestId
+    }
+  });
+  const dispatch = {
+    GET: client.GET.bind(client),
+    POST: client.POST.bind(client),
+    PATCH: client.PATCH.bind(client),
+    PUT: client.PUT.bind(client),
+    DELETE: client.DELETE.bind(client)
+  };
+  async function call(method, path, init, parse) {
+    const startedAtMs = Date.now();
+    let result;
+    try {
+      result = await dispatch[method](path, init);
+    } catch (cause) {
+      logger.warn({ api_path: path, elapsed_ms: Date.now() - startedAtMs }, "api.network_error");
+      const inner = cause instanceof Error && cause.cause instanceof Error ? cause.cause : cause instanceof Error ? cause : null;
+      return err({
+        kind: "upstream",
+        detail: inner !== null ? inner.message : "network error"
+      });
+    }
+    const { data, error, response } = result;
+    const status2 = response.status;
+    logger.info(
+      { api_path: path, api_status: status2, elapsed_ms: Date.now() - startedAtMs },
+      "api.done"
+    );
+    if (status2 >= 200 && status2 < 300) {
+      return parse(data === void 0 ? null : data);
+    }
+    return err(toApiError(status2, error ?? data, response.headers.get("retry-after") ?? void 0));
+  }
+  return {
+    // ── Account ───────────────────────────────────────────────────
+    async getAccount() {
+      return call("GET", "/api/v1/account", {}, parseOrg);
+    },
+    async updateOrg(body) {
+      return call("PATCH", "/api/v1/account", { body }, parseOrg);
+    },
+    async listOrgUsers() {
+      return call("GET", "/api/v1/account/users", {}, parseArrayOf(parseUser));
+    },
+    async inviteUser(body) {
+      return call("POST", "/api/v1/account/users/invite", { body }, parseUser);
+    },
+    async updateUserRole(userId, body) {
+      return call(
+        "PATCH",
+        "/api/v1/account/users/{user_id}/role",
+        { params: { path: { user_id: userId } }, body },
+        parseEmpty
+      );
+    },
+    async removeUser(userId) {
+      return call(
+        "DELETE",
+        "/api/v1/account/users/{user_id}",
+        { params: { path: { user_id: userId } } },
+        parseEmpty
+      );
+    },
+    async transferOwnership(userId) {
+      return call(
+        "POST",
+        "/api/v1/account/users/{user_id}/transfer-ownership",
+        { params: { path: { user_id: userId } } },
+        parseEmpty
+      );
+    },
+    async listOrgRoles() {
+      return call("GET", "/api/v1/account/roles", {}, parseArrayOf(parseRole));
+    },
+    async listApiKeys() {
+      return call("GET", "/api/v1/account/api-keys", {}, parseApiKeyList);
+    },
+    async createApiKey(body) {
+      return call("POST", "/api/v1/account/api-keys", { body }, parseApiKeyCreated);
+    },
+    async revokeApiKey(keyId) {
+      return call(
+        "DELETE",
+        "/api/v1/account/api-keys/{key_id}",
+        { params: { path: { key_id: keyId } } },
+        parseEmpty
+      );
+    },
+    // ── Scans ─────────────────────────────────────────────────────
+    async listScans(filters) {
+      return call("GET", "/api/v1/scans", { params: { query: filters } }, parseScanPage);
+    },
+    async getScan(scanId) {
+      return call(
+        "GET",
+        "/api/v1/scans/{scan_id}",
+        { params: { path: { scan_id: scanId } } },
+        parseScan
+      );
+    },
+    async createScan(body) {
+      return call("POST", "/api/v1/scans", { body }, parseScan);
+    },
+    async createBulkScans(body) {
+      return call("POST", "/api/v1/scans/bulk", { body }, parseScanArray);
+    },
+    async recheckScans(body) {
+      return call(
+        "POST",
+        "/api/v1/scans/recheck",
+        { body },
+        (raw) => parseIntField(raw, "queued_count")
+      );
+    },
+    async cancelScan(scanId) {
+      return call(
+        "POST",
+        "/api/v1/scans/{scan_id}/cancel",
+        { params: { path: { scan_id: scanId } } },
+        (raw) => parseIntField(raw, "cancelled_count")
+      );
+    },
+    async listScanTags(scanId) {
+      return call(
+        "GET",
+        "/api/v1/scans/{scan_id}/tags",
+        { params: { path: { scan_id: scanId } } },
+        parseArrayOf(parseScanTag)
+      );
+    },
+    // ── Geos / emulators ──────────────────────────────────────────
+    async listGeos() {
+      return call("GET", "/api/v1/geos", {}, parseGeoList);
+    },
+    async listEmulators() {
+      return call("GET", "/api/v1/emulators", {}, parseEmulatorList);
+    },
+    // ── Campaigns ─────────────────────────────────────────────────
+    async listCampaigns(filters) {
+      return call("GET", "/api/v1/campaigns", { params: { query: filters } }, parseCampaignPage);
+    },
+    async getCampaign(id) {
+      return call(
+        "GET",
+        "/api/v1/campaigns/{campaign_id}",
+        { params: { path: { campaign_id: id } } },
+        parseCampaign
+      );
+    },
+    async createCampaign(body) {
+      return call("POST", "/api/v1/campaigns", { body }, parseCampaign);
+    },
+    async updateCampaign(id, body) {
+      return call(
+        "PATCH",
+        "/api/v1/campaigns/{campaign_id}",
+        { params: { path: { campaign_id: id } }, body },
+        parseCampaign
+      );
+    },
+    async runCampaign(id) {
+      return call(
+        "POST",
+        "/api/v1/campaigns/{campaign_id}/run",
+        { params: { path: { campaign_id: id } } },
+        parseRun
+      );
+    },
+    async archiveCampaign(id) {
+      return call(
+        "POST",
+        "/api/v1/campaigns/{campaign_id}/archive",
+        { params: { path: { campaign_id: id } } },
+        parseCampaign
+      );
+    },
+    async unarchiveCampaign(id) {
+      return call(
+        "POST",
+        "/api/v1/campaigns/{campaign_id}/unarchive",
+        { params: { path: { campaign_id: id } } },
+        parseCampaign
+      );
+    },
+    async cancelCampaign(id) {
+      return call(
+        "POST",
+        "/api/v1/campaigns/{campaign_id}/cancel",
+        { params: { path: { campaign_id: id } } },
+        (raw) => parseIntField(raw, "cancelled_count")
+      );
+    },
+    async listCampaignRuns(campaignId, filters) {
+      return call(
+        "GET",
+        "/api/v1/campaigns/{campaign_id}/runs",
+        { params: { path: { campaign_id: campaignId }, query: filters } },
+        parsePageOf(parseRun)
+      );
+    },
+    async listCampaignsPicker() {
+      return call("GET", "/api/v1/campaigns/picker", {}, parseCampaignPickerArray);
+    },
+    // ── Runs ──────────────────────────────────────────────────────
+    async getRun(id) {
+      return call("GET", "/api/v1/runs/{run_id}", { params: { path: { run_id: id } } }, parseRun);
+    },
+    async cancelRun(id) {
+      return call(
+        "POST",
+        "/api/v1/runs/{run_id}/cancel",
+        { params: { path: { run_id: id } } },
+        (raw) => parseIntField(raw, "cancelled_count")
+      );
+    },
+    async listRunScans(runId, filters) {
+      return call(
+        "GET",
+        "/api/v1/runs/{run_id}/scans",
+        { params: { path: { run_id: runId }, query: filters } },
+        parseRunScanPage
+      );
+    },
+    // ── Campaign groups ───────────────────────────────────────────
+    async listCampaignGroups(filters) {
+      return call(
+        "GET",
+        "/api/v1/campaign-groups",
+        { params: { query: filters ?? {} } },
+        parseCampaignGroupArray
+      );
+    },
+    async getCampaignGroup(id) {
+      return call(
+        "GET",
+        "/api/v1/campaign-groups/{group_id}",
+        { params: { path: { group_id: id } } },
+        parseCampaignGroup
+      );
+    },
+    async createCampaignGroup(body) {
+      return call("POST", "/api/v1/campaign-groups", { body }, parseCampaignGroup);
+    },
+    async updateCampaignGroup(id, body) {
+      return call(
+        "PATCH",
+        "/api/v1/campaign-groups/{group_id}",
+        { params: { path: { group_id: id } }, body },
+        parseCampaignGroup
+      );
+    },
+    async runCampaignGroup(id) {
+      return call(
+        "POST",
+        "/api/v1/campaign-groups/{group_id}/run",
+        { params: { path: { group_id: id } } },
+        parseGroupAction
+      );
+    },
+    async cancelCampaignGroup(id) {
+      return call(
+        "POST",
+        "/api/v1/campaign-groups/{group_id}/cancel",
+        { params: { path: { group_id: id } } },
+        parseGroupAction
+      );
+    },
+    async archiveCampaignGroup(id) {
+      return call(
+        "POST",
+        "/api/v1/campaign-groups/{group_id}/archive",
+        { params: { path: { group_id: id } } },
+        parseGroupAction
+      );
+    },
+    async unarchiveCampaignGroup(id) {
+      return call(
+        "POST",
+        "/api/v1/campaign-groups/{group_id}/unarchive",
+        { params: { path: { group_id: id } } },
+        parseGroupAction
+      );
+    },
+    async pauseCampaignGroupSchedule(id) {
+      return call(
+        "POST",
+        "/api/v1/campaign-groups/{group_id}/pause-schedule",
+        { params: { path: { group_id: id } } },
+        parseCampaignGroup
+      );
+    },
+    async resumeCampaignGroupSchedule(id) {
+      return call(
+        "POST",
+        "/api/v1/campaign-groups/{group_id}/resume-schedule",
+        { params: { path: { group_id: id } } },
+        parseCampaignGroup
+      );
+    },
+    // ── Tag definitions ───────────────────────────────────────────
+    async listTags() {
+      return call("GET", "/api/v1/tag-definitions", {}, parseTagDefinitionArray);
+    },
+    async getTagDefinition(slug) {
+      return call(
+        "GET",
+        "/api/v1/tag-definitions/{slug}",
+        { params: { path: { slug } } },
+        parseTagDetail
+      );
+    },
+    async updateTagDefinition(slug, body) {
+      return call(
+        "PATCH",
+        "/api/v1/tag-definitions/{slug}",
+        { params: { path: { slug } }, body },
+        parseEmpty
+      );
+    },
+    async deleteTagDefinition(slug) {
+      return call(
+        "DELETE",
+        "/api/v1/tag-definitions/{slug}",
+        { params: { path: { slug } } },
+        parseEmpty
+      );
+    },
+    // ── Custom rules ──────────────────────────────────────────────
+    async listCustomRules(filters) {
+      return call(
+        "GET",
+        "/api/v1/custom-rules",
+        { params: { query: filters } },
+        parseCustomRulePage
+      );
+    },
+    async getCustomRule(id) {
+      return call(
+        "GET",
+        "/api/v1/custom-rules/{rule_id}",
+        { params: { path: { rule_id: id } } },
+        parseCustomRule
+      );
+    },
+    async createCustomRule(body) {
+      return call("POST", "/api/v1/custom-rules", { body }, parseCustomRule);
+    },
+    async updateCustomRule(id, body) {
+      return call(
+        "PUT",
+        "/api/v1/custom-rules/{rule_id}",
+        { params: { path: { rule_id: id } }, body },
+        parseCustomRule
+      );
+    },
+    async deleteCustomRule(id) {
+      return call(
+        "DELETE",
+        "/api/v1/custom-rules/{rule_id}",
+        { params: { path: { rule_id: id } } },
+        parseEmpty
+      );
+    },
+    async testCustomRule(body) {
+      return call("POST", "/api/v1/custom-rules/test", { body }, parseRuleTest);
+    },
+    // ── Policy sets ───────────────────────────────────────────────
+    async listPolicySets(filters) {
+      return call("GET", "/api/v1/policy-sets", { params: { query: filters } }, parsePolicySetPage);
+    },
+    async getPolicySet(id) {
+      return call(
+        "GET",
+        "/api/v1/policy-sets/{policy_set_id}",
+        { params: { path: { policy_set_id: id } } },
+        parsePolicySet
+      );
+    },
+    async createPolicySet(body) {
+      return call("POST", "/api/v1/policy-sets", { body }, parsePolicySet);
+    },
+    async updatePolicySet(id, body) {
+      return call(
+        "PUT",
+        "/api/v1/policy-sets/{policy_set_id}",
+        { params: { path: { policy_set_id: id } }, body },
+        parsePolicySet
+      );
+    },
+    async deletePolicySet(id) {
+      return call(
+        "DELETE",
+        "/api/v1/policy-sets/{policy_set_id}",
+        { params: { path: { policy_set_id: id } } },
+        parseEmpty
+      );
+    },
+    async requestPolicySetApproval(id) {
+      return call(
+        "POST",
+        "/api/v1/policy-sets/{policy_set_id}/request-approval",
+        { params: { path: { policy_set_id: id } } },
+        parseEmpty
+      );
+    },
+    // ── Alerts ────────────────────────────────────────────────────
+    async listAlerts(filters) {
+      return call("GET", "/api/v1/alerts", { params: { query: filters } }, parseAlertPage);
+    },
+    async updateAlertStatus(alertId, body) {
+      return call(
+        "PATCH",
+        "/api/v1/alerts/{alert_id}/status",
+        { params: { path: { alert_id: alertId } }, body },
+        parseEmpty
+      );
+    },
+    async getAlertStats() {
+      return call("GET", "/api/v1/alerts/stats", {}, parseAlertStats);
+    },
+    // ── Webhooks ──────────────────────────────────────────────────
+    async listWebhooks() {
+      return call("GET", "/api/v1/webhooks", {}, parseWebhookList);
+    },
+    async getWebhook(id) {
+      return call(
+        "GET",
+        "/api/v1/webhooks/{endpoint_id}",
+        { params: { path: { endpoint_id: id } } },
+        parseWebhook
+      );
+    },
+    async createWebhook(body) {
+      return call("POST", "/api/v1/webhooks", { body }, parseWebhookCreated);
+    },
+    async updateWebhook(id, body) {
+      return call(
+        "PATCH",
+        "/api/v1/webhooks/{endpoint_id}",
+        { params: { path: { endpoint_id: id } }, body },
+        parseWebhook
+      );
+    },
+    async deleteWebhook(id) {
+      return call(
+        "DELETE",
+        "/api/v1/webhooks/{endpoint_id}",
+        { params: { path: { endpoint_id: id } } },
+        parseEmpty
+      );
+    },
+    async testWebhook(endpointId, body) {
+      return call(
+        "POST",
+        "/api/v1/webhooks/{endpoint_id}/test",
+        { params: { path: { endpoint_id: endpointId } }, body },
+        parseTestWebhookResponse
+      );
+    },
+    async rotateWebhookSecret(endpointId) {
+      return call(
+        "POST",
+        "/api/v1/webhooks/{endpoint_id}/rotate-secret",
+        { params: { path: { endpoint_id: endpointId } } },
+        parseWebhookCreated
+      );
+    },
+    async listWebhookEventTypes() {
+      return call("GET", "/api/v1/webhooks/event-types", {}, parseEventCatalog);
+    },
+    async listWebhookDeliveries(endpointId, filters) {
+      return call(
+        "GET",
+        "/api/v1/webhooks/{endpoint_id}/deliveries",
+        { params: { path: { endpoint_id: endpointId }, query: filters } },
+        parsePageOf(parseWebhookDelivery)
+      );
+    },
+    async replayWebhookDelivery(attemptId) {
+      return call(
+        "POST",
+        "/api/v1/webhooks/deliveries/{attempt_id}/replay",
+        { params: { path: { attempt_id: attemptId } } },
+        parseEmpty
+      );
+    },
+    async bulkReplayWebhook(endpointId, body) {
+      return call(
+        "POST",
+        "/api/v1/webhooks/{endpoint_id}/replay",
+        { params: { path: { endpoint_id: endpointId } }, body },
+        parseBulkReplay
+      );
+    },
+    // ── Billing ───────────────────────────────────────────────────
+    async getBillingSummary() {
+      return call("GET", "/api/v1/billing", {}, parseBillingSummary);
+    },
+    async listUsage(filters) {
+      return call(
+        "GET",
+        "/api/v1/billing/usage",
+        { params: { query: filters } },
+        parsePageOf(parseUsage)
+      );
+    },
+    async getUsageSummary() {
+      return call("GET", "/api/v1/billing/usage/summary", {}, parseUsageSummary);
+    },
+    async listBalanceHistory(filters) {
+      return call(
+        "GET",
+        "/api/v1/billing/history",
+        { params: { query: filters } },
+        parsePageOf(parseBalanceTx)
+      );
+    },
+    // ── Invoicing ─────────────────────────────────────────────────
+    async listInvoices(filters) {
+      return call(
+        "GET",
+        "/api/v1/invoices",
+        { params: { query: filters } },
+        parsePageOf(parseInvoice)
+      );
+    },
+    // ── Alert notifications ───────────────────────────────────────
+    async listAlertDestinations() {
+      return call(
+        "GET",
+        "/api/v1/alert-notifications/destinations",
+        {},
+        parseArrayOf(parseAlertDestination)
+      );
+    },
+    async deleteAlertDestination(id) {
+      return call(
+        "DELETE",
+        "/api/v1/alert-notifications/destinations/{destination_id}",
+        { params: { path: { destination_id: id } } },
+        parseEmpty
+      );
+    },
+    async setAlertDestinationVersion(id, body) {
+      return call(
+        "PATCH",
+        "/api/v1/alert-notifications/destinations/{destination_id}/version",
+        { params: { path: { destination_id: id } }, body },
+        parseEmpty
+      );
+    },
+    async getCampaignAlertOverrides(campaignId) {
+      return call(
+        "GET",
+        "/api/v1/alert-notifications/campaigns/{campaign_id}/overrides",
+        { params: { path: { campaign_id: campaignId } } },
+        parseCampaignAlertOverrides
+      );
+    },
+    async setCampaignAlertOverrides(campaignId, body) {
+      return call(
+        "PUT",
+        "/api/v1/alert-notifications/campaigns/{campaign_id}/overrides",
+        { params: { path: { campaign_id: campaignId } }, body },
+        parseEmpty
+      );
+    }
+  };
+}
+var REDACTION_PATHS = [
+  "authorization",
+  "Authorization",
+  "bearer",
+  "Bearer",
+  "*.authorization",
+  "*.Authorization",
+  "headers.authorization",
+  "headers.Authorization",
+  "req.headers.authorization",
+  "req.headers.Authorization"
+];
+function createPinoLogger(level, format = "json", destination) {
+  const options = {
+    level,
+    redact: { paths: [...REDACTION_PATHS], censor: "[REDACTED]" },
+    base: null,
+    timestamp: stdTimeFunctions.isoTime,
+    formatters: {
+      level: (label) => ({ level: label })
+    }
+  };
+  const sink = destination ?? (format === "pretty" ? pinoPretty({
+    colorize: true,
+    ignore: "pid,hostname",
+    destination: process.stderr.fd,
+    sync: true
+  }) : pino.destination(process.stderr.fd));
+  return wrap(pino(options, sink));
+}
+function wrap(impl) {
+  return {
+    child(fields) {
+      return wrap(impl.child({ ...fields }));
+    },
+    trace(fields, message) {
+      impl.trace({ ...fields }, message);
+    },
+    debug(fields, message) {
+      impl.debug({ ...fields }, message);
+    },
+    info(fields, message) {
+      impl.info({ ...fields }, message);
+    },
+    warn(fields, message) {
+      impl.warn({ ...fields }, message);
+    },
+    error(fields, message) {
+      impl.error({ ...fields }, message);
+    },
+    fatal(fields, message) {
+      impl.fatal({ ...fields }, message);
+    }
+  };
+}
+function declareEmptyResourcesAndPrompts(server) {
+  server.server.registerCapabilities({ resources: {}, prompts: {} });
+  server.server.setRequestHandler(ListResourcesRequestSchema, async () => {
+    await Promise.resolve();
+    return { resources: [] };
+  });
+  server.server.setRequestHandler(ListPromptsRequestSchema, async () => {
+    await Promise.resolve();
+    return { prompts: [] };
+  });
+}
+
+// src/application/services/api-error-mapper.ts
+function mapApiError(apiError) {
+  switch (apiError.kind) {
+    case "unauthorized":
+      return { kind: "unauthorized", message: apiError.detail };
+    case "forbidden":
+      return apiError.code === void 0 ? { kind: "forbidden", message: apiError.detail } : { kind: "forbidden", message: apiError.detail, code: apiError.code };
+    case "not-found":
+      return { kind: "not-found", message: apiError.detail };
+    case "rate-limited":
+      return apiError.retryAfterMs === void 0 ? { kind: "rate-limited", message: apiError.detail } : { kind: "rate-limited", message: apiError.detail, retryAfterMs: apiError.retryAfterMs };
+    case "invalid-input": {
+      const out = { kind: "invalid-input", message: apiError.detail };
+      if (apiError.fieldErrors !== void 0) out.fieldErrors = apiError.fieldErrors;
+      if (apiError.code !== void 0) out.code = apiError.code;
+      return out;
+    }
+    case "upstream":
+      return apiError.status === void 0 ? { kind: "upstream", message: apiError.detail } : { kind: "upstream", message: apiError.detail, status: apiError.status };
+  }
+}
+
+// src/application/tools/account/create-api-key.tool.ts
+var CreateApiKeyInputShape = {
+  name: z.string().min(1).max(100).describe("Human-readable label (e.g. `ci-pipeline`, `claude-mcp`)."),
+  // Accept BOTH `null` and omit for "no expiry" — many JSON clients
+  // (including a hand-written curl) send `null` explicitly; rejecting
+  // it forces awkward request-body construction on the caller side.
+  // Either form maps to API-side `expires_at: null` (the only shape
+  // the API accepts for "no expiry").
+  expires_at: z.string().datetime().nullable().optional().describe(
+    "Optional ISO-8601 expiry timestamp. Omit or send `null` for a non-expiring key (operator can revoke any time)."
+  )
+};
+var createApiKeyTool = {
+  name: "create_api_key",
+  description: "Mint a new API key for the caller's organization. The full secret is returned in `full_key` THIS ONE TIME ONLY \u2014 show it to the user and instruct them to store it; the server keeps only a hash and cannot reveal it again.",
+  annotations: {
+    title: "Create API Key",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(CreateApiKeyInputShape),
+  handler: async (input, ctx) => {
+    const body = {
+      name: input.name,
+      // Forward both `null` and omitted as omitted to the gateway DTO
+      // (gateway treats absent field as "no expiry"). `null` would
+      // collide with the gateway's `Pick<CreateApiKeyRequest, ...>`
+      // type that does not include `null`.
+      ...input.expires_at !== void 0 && input.expires_at !== null ? { expires_at: input.expires_at } : {}
+    };
+    const result = await ctx.api.createApiKey(body);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var GetAccountInputShape = {};
+var getAccountTool = {
+  name: "get_account",
+  description: "Get the organization owning the current API key (id, name, owner_id, is_active, created_at). Use this to confirm authentication and capture the org context for follow-up tool calls.",
+  annotations: {
+    title: "Get Account",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetAccountInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.getAccount();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var InviteUserInputShape = {
+  email: z.string().email().describe("Email of the person to invite. They get a signup link."),
+  role_id: z.string().uuid().describe("UUID of the role to assign on accept. Get UUIDs from `list_org_roles`."),
+  name: z.string().min(1).optional().describe("Optional display name for the invitee.")
+};
+var inviteUserTool = {
+  name: "invite_user",
+  description: "Send an invitation email so a new person can join the caller's organization with a chosen role. Returns the pending member record.",
+  annotations: {
+    title: "Invite User",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(InviteUserInputShape),
+  handler: async (input, ctx) => {
+    const body = {
+      email: input.email,
+      role_id: input.role_id
+    };
+    if (input.name !== void 0) body.name = input.name;
+    const result = await ctx.api.inviteUser(body);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListApiKeysInputShape = {};
+var listApiKeysTool = {
+  name: "list_api_keys",
+  description: "List the organization's API keys: id, key prefix (first 8 chars of the secret), display name, expiry, created_at. The full secret is NEVER returned by this endpoint \u2014 only the prefix.",
+  annotations: {
+    title: "List Api Keys",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListApiKeysInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.listApiKeys();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ items: result.value, total: result.value.length });
+  }
+};
+var ListOrgRolesInputShape = {};
+var listOrgRolesTool = {
+  name: "list_org_roles",
+  description: "List the roles defined for the organization \u2014 built-in (owner, admin, member) plus any custom roles, with each role's permission set.",
+  annotations: {
+    title: "List Organization Roles",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListOrgRolesInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.listOrgRoles();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ items: result.value, total: result.value.length });
+  }
+};
+var ListOrgUsersInputShape = {};
+var listOrgUsersTool = {
+  name: "list_org_users",
+  description: "List every member of the caller's organization with their role, ownership flag, and join date.",
+  annotations: {
+    title: "List Organization Members",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListOrgUsersInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.listOrgUsers();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ items: result.value, total: result.value.length });
+  }
+};
+var RemoveUserInputShape = {
+  user_id: z.string().uuid().describe("UUID of the member to remove.")
+};
+var removeUserTool = {
+  name: "remove_user",
+  description: "Revoke a member's access to the organization. The user is signed out and any active API keys they created remain unless revoked separately. CANNOT remove the owner \u2014 use `transfer_ownership` first.",
+  annotations: {
+    title: "Remove User",
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(RemoveUserInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.removeUser(input.user_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ removed: true });
+  }
+};
+var RevokeApiKeyInputShape = {
+  key_id: z.string().uuid().describe("UUID of the key to revoke (from `list_api_keys`).")
+};
+var revokeApiKeyTool = {
+  name: "revoke_api_key",
+  description: "Permanently invalidate an API key. Any subsequent request using it returns 401. Cannot be undone \u2014 the user would have to `create_api_key` again.",
+  annotations: {
+    title: "Revoke API Key",
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(RevokeApiKeyInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.revokeApiKey(input.key_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ revoked: true });
+  }
+};
+var TransferOwnershipInputShape = {
+  user_id: z.string().uuid().describe("UUID of the existing member to become the new owner.")
+};
+var transferOwnershipTool = {
+  name: "transfer_ownership",
+  description: "Hand the organization owner role to another existing member. ONE-WAY: the previous owner becomes a regular member afterwards. Require explicit confirmation from the user.",
+  annotations: {
+    title: "Transfer Organization Ownership",
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(TransferOwnershipInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.transferOwnership(input.user_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ transferred: true });
+  }
+};
+var UpdateOrgInputShape = {
+  name: z.string().min(1).max(200).optional().describe("New organization display name."),
+  settings: z.record(z.unknown()).optional().describe("Replacement settings object. Fields not supplied are left unchanged.")
+};
+var updateOrgTool = {
+  name: "update_org",
+  description: "Update the caller's organization \u2014 display name and/or settings object. Only supplied fields are touched.",
+  annotations: {
+    title: "Update Organization",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(UpdateOrgInputShape),
+  handler: async (input, ctx) => {
+    const body = {
+      ...input.name !== void 0 ? { name: input.name } : {},
+      ...input.settings !== void 0 ? { settings: input.settings } : {}
+    };
+    const result = await ctx.api.updateOrg(body);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var UpdateUserRoleInputShape = {
+  user_id: z.string().uuid().describe("UUID of the member to update."),
+  role_id: z.string().uuid().describe("UUID of the new role (see `list_org_roles`).")
+};
+var updateUserRoleTool = {
+  name: "update_user_role",
+  description: "Change an organization member's role. The owner role can only be transferred via `transfer_ownership`. Returns `{updated: true}` on success; refetch with `list_org_users` if you need the new role echoed.",
+  annotations: {
+    title: "Update User Role",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(UpdateUserRoleInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.updateUserRole(input.user_id, { role_id: input.role_id });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ updated: true });
+  }
+};
+var DeleteAlertDestinationInputShape = {
+  destination_id: z.string().uuid().describe("Destination UUID.")
+};
+var deleteAlertDestinationTool = {
+  name: "delete_alert_destination",
+  description: "Remove an alert-notification destination. The org stops receiving pings on this channel immediately; campaign-level overrides referencing it are pruned.",
+  annotations: {
+    title: "Delete Alert Destination",
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(DeleteAlertDestinationInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.deleteAlertDestination(input.destination_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ deleted: true });
+  }
+};
+var GetCampaignAlertOverridesInputShape = {
+  campaign_id: z.string().uuid().describe("Campaign UUID.")
+};
+var getCampaignAlertOverridesTool = {
+  name: "get_campaign_alert_overrides",
+  description: "Get the per-campaign override of which alert destinations receive its alerts. `mode` is one of `inherit` (use org defaults), `include` (use the listed destinations), or `exclude` (use everything EXCEPT the listed destinations).",
+  annotations: {
+    title: "Get Campaign Alert Overrides",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetCampaignAlertOverridesInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getCampaignAlertOverrides(input.campaign_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListAlertDestinationsInputShape = {};
+var listAlertDestinationsTool = {
+  name: "list_alert_destinations",
+  description: "List configured alert-notification destinations (channels): Slack workspaces, Telegram chats, email lists, generic webhooks. Each entry has id, kind, display name, version, and creation timestamp.",
+  annotations: {
+    title: "List Alert Destinations",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListAlertDestinationsInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.listAlertDestinations();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ items: result.value, total: result.value.length });
+  }
+};
+var SetAlertDestinationVersionInputShape = {
+  destination_id: z.string().uuid().describe("Destination UUID."),
+  version: z.enum(["public", "internal"]).describe(
+    "Which version of the scan-report link to embed in alert messages: `public` (anonymous, no auth) or `internal` (requires UI login)."
+  )
+};
+var setAlertDestinationVersionTool = {
+  name: "set_alert_destination_version",
+  description: "Switch a destination to a specific versioned config \u2014 used after re-authorizing a Slack workspace, rotating a Telegram bot token, etc. The new version must already exist in the destination's history. The API returns no body on success; this tool reports `{ updated: true }`. Use `list_alert_destinations` to read the new state if needed.",
+  annotations: {
+    title: "Set Destination Version",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(SetAlertDestinationVersionInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.setAlertDestinationVersion(input.destination_id, {
+      version: input.version
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ updated: true });
+  }
+};
+var SetCampaignAlertOverridesInputShape = {
+  campaign_id: z.string().uuid().describe("Campaign UUID."),
+  mode: z.enum(["inherit", "include", "exclude"]).describe(
+    "Routing mode: `inherit` (use org defaults), `include` (route ONLY to listed destinations), `exclude` (route everywhere EXCEPT listed)."
+  ),
+  destination_ids: z.array(z.string().uuid()).max(50).default([]).describe(
+    "Destination UUIDs the mode acts on. Required for `include`/`exclude`; ignored for `inherit`."
+  )
+};
+var setCampaignAlertOverridesTool = {
+  name: "set_campaign_alert_overrides",
+  description: "REPLACE the per-campaign alert-routing override. `mode=inherit` falls back to org defaults; `mode=include` routes ONLY to the listed destinations; `mode=exclude` routes everywhere EXCEPT the listed destinations. To read the new state, follow up with `get_campaign_alert_overrides`.",
+  annotations: {
+    title: "Set Campaign Alert Overrides",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(SetCampaignAlertOverridesInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.setCampaignAlertOverrides(input.campaign_id, {
+      mode: input.mode,
+      destination_ids: input.destination_ids
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ updated: true });
+  }
+};
+var GetAlertStatsInputShape = {};
+var getAlertStatsTool = {
+  name: "get_alert_stats",
+  description: "Get alert counts grouped by status: open, ack, resolved, ignored, total.",
+  annotations: {
+    title: "Get Alert Stats",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetAlertStatsInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.getAlertStats();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListAlertsInputShape = {
+  campaign_id: z.string().uuid().optional().describe("Filter to one campaign's alerts."),
+  status: z.enum(["open", "ack", "resolved", "ignored"]).optional().describe("Filter by alert status."),
+  page: z.number().int().min(1).max(500).default(1).describe("1-indexed page number."),
+  limit: z.number().int().min(1).max(200).default(50).describe("Page size.")
+};
+var listAlertsTool = {
+  name: "list_alerts",
+  description: "List violation alerts (one per scan + violating-tag combo) with offer URL, tag, country, status, scan back-reference.",
+  annotations: {
+    title: "List Alerts",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListAlertsInputShape),
+  handler: async (input, ctx) => {
+    const filters = {
+      page: input.page,
+      limit: input.limit,
+      ...input.campaign_id !== void 0 ? { campaign_id: input.campaign_id } : {},
+      ...input.status !== void 0 ? { status: input.status } : {}
+    };
+    const result = await ctx.api.listAlerts(filters);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var UpdateAlertStatusInputShape = {
+  alert_id: z.string().uuid().describe("Alert UUID."),
+  status: z.enum(["open", "acknowledged", "resolved", "dismissed"]).describe("New status: open | acknowledged | resolved | dismissed.")
+};
+var updateAlertStatusTool = {
+  name: "update_alert_status",
+  description: "Update an alert's status in its lifecycle: open \u2192 acknowledged \u2192 resolved | dismissed. The API enforces valid transitions; an invalid one returns 422.",
+  annotations: {
+    title: "Update Alert Status",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(UpdateAlertStatusInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.updateAlertStatus(input.alert_id, { status: input.status });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ updated: true });
+  }
+};
+var GetBillingSummaryInputShape = {};
+var getBillingSummaryTool = {
+  name: "get_billing_summary",
+  description: "Get the organization's billing snapshot: balance (in micros), current plan, period usage counters, suspension state, and whether new scans are accepted right now.",
+  annotations: {
+    title: "Get Billing Summary",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetBillingSummaryInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.getBillingSummary();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var GetUsageSummaryInputShape = {};
+var getUsageSummaryTool = {
+  name: "get_usage_summary",
+  description: "Get a one-liner aggregate of usage for the current billing period: total cost (micros), check count, period start/end.",
+  annotations: {
+    title: "Get Usage Summary",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetUsageSummaryInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.getUsageSummary();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListBalanceHistoryInputShape = {
+  date_from: z.string().date().optional().describe("ISO date, inclusive."),
+  date_to: z.string().date().optional().describe("ISO date, inclusive."),
+  page: z.number().int().min(1).max(500).default(1).describe("1-indexed page."),
+  limit: z.number().int().min(1).max(200).default(50).describe("Page size.")
+};
+var listBalanceHistoryTool = {
+  name: "list_balance_history",
+  description: "List ledger transactions (charges, refunds, top-ups, invoice settlements) on the organization's balance. Each row: type, amount in micros, description, timestamp.",
+  annotations: {
+    title: "List Balance History",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListBalanceHistoryInputShape),
+  handler: async (input, ctx) => {
+    const filters = {
+      page: input.page,
+      limit: input.limit,
+      ...input.date_from !== void 0 ? { date_from: input.date_from } : {},
+      ...input.date_to !== void 0 ? { date_to: input.date_to } : {}
+    };
+    const result = await ctx.api.listBalanceHistory(filters);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListUsageInputShape = {
+  date_from: z.string().date().optional().describe("ISO date (YYYY-MM-DD), inclusive."),
+  date_to: z.string().date().optional().describe("ISO date (YYYY-MM-DD), inclusive."),
+  scan_id: z.string().uuid().optional().describe("Filter to one scan's cost rows."),
+  page: z.number().int().min(1).max(500).default(1).describe("1-indexed page."),
+  limit: z.number().int().min(1).max(200).default(50).describe("Page size.")
+};
+var listUsageTool = {
+  name: "list_usage",
+  description: "List per-scan usage rows (cost in micros, kind, scan id, timestamp). Use to attribute cost to specific scans or campaigns.",
+  annotations: {
+    title: "List Usage",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListUsageInputShape),
+  handler: async (input, ctx) => {
+    const filters = {
+      page: input.page,
+      limit: input.limit,
+      ...input.date_from !== void 0 ? { date_from: input.date_from } : {},
+      ...input.date_to !== void 0 ? { date_to: input.date_to } : {},
+      ...input.scan_id !== void 0 ? { scan_id: input.scan_id } : {}
+    };
+    const result = await ctx.api.listUsage(filters);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ArchiveCampaignGroupInputShape = {
+  group_id: z.string().uuid().describe("Campaign group UUID.")
+};
+var archiveCampaignGroupTool = {
+  name: "archive_campaign_group",
+  description: "Soft-delete the group AND every campaign in it. The default group cannot be archived; ask the user to move campaigns out first.",
+  annotations: {
+    title: "Archive Campaign Group",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ArchiveCampaignGroupInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.archiveCampaignGroup(input.group_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var CancelCampaignGroupInputShape = {
+  group_id: z.string().uuid().describe("Campaign group UUID.")
+};
+var cancelCampaignGroupTool = {
+  name: "cancel_campaign_group",
+  description: "Cancel every pending scan across every campaign in the group. Refunds credits for cancelled scans. Returns the total cancelled count.",
+  annotations: {
+    title: "Cancel Campaign Group",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(CancelCampaignGroupInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.cancelCampaignGroup(input.group_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var CreateCampaignGroupInputShape = {
+  name: z.string().min(1).max(200).describe("Display name (1-200 chars).")
+};
+var createCampaignGroupTool = {
+  name: "create_campaign_group",
+  description: "Create a new campaign group (folder). Free operation, no scans queued.",
+  annotations: {
+    title: "Create Campaign Group",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(CreateCampaignGroupInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.createCampaignGroup({ name: input.name });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var GetCampaignGroupInputShape = {
+  group_id: z.string().uuid().describe("Campaign group UUID.")
+};
+var getCampaignGroupTool = {
+  name: "get_campaign_group",
+  description: "Get one campaign group by UUID with default/archive/pause flags and campaign count.",
+  annotations: {
+    title: "Get Campaign Group",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetCampaignGroupInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getCampaignGroup(input.group_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListCampaignGroupsInputShape = {
+  archived: z.boolean().optional().describe("If true, list ONLY archived groups. Default: only active groups.")
+};
+var listCampaignGroupsTool = {
+  name: "list_campaign_groups",
+  description: "List campaign groups \u2014 folders that group related campaigns. Includes per-group campaign count. Not paginated; the org-scoped list is typically small (a few dozen groups max).",
+  annotations: {
+    title: "List Campaign Groups",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListCampaignGroupsInputShape),
+  handler: async (input, ctx) => {
+    const filters = input.archived === void 0 ? {} : { archived: input.archived };
+    const result = await ctx.api.listCampaignGroups(filters);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ items: result.value });
+  }
+};
+var PauseCampaignGroupScheduleInputShape = {
+  group_id: z.string().uuid().describe("Campaign group UUID.")
+};
+var pauseCampaignGroupScheduleTool = {
+  name: "pause_campaign_group_schedule",
+  description: "Pause the scheduler for EVERY campaign in the group. Already-pending scans complete; no new scheduled runs are produced until you `resume_campaign_group_schedule`.",
+  annotations: {
+    title: "Pause Group Schedule",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(PauseCampaignGroupScheduleInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.pauseCampaignGroupSchedule(input.group_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ResumeCampaignGroupScheduleInputShape = {
+  group_id: z.string().uuid().describe("Campaign group UUID.")
+};
+var resumeCampaignGroupScheduleTool = {
+  name: "resume_campaign_group_schedule",
+  description: "Re-enable the scheduler for every campaign in the group. Inverse of `pause_campaign_group_schedule`.",
+  annotations: {
+    title: "Resume Group Schedule",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ResumeCampaignGroupScheduleInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.resumeCampaignGroupSchedule(input.group_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var RunCampaignGroupInputShape = {
+  group_id: z.string().uuid().describe("Campaign group UUID.")
+};
+var runCampaignGroupTool = {
+  name: "run_campaign_group",
+  description: "Fire an immediate run of every active (non-archived, non-paused) campaign in the group. Returns aggregate stats: how many campaigns triggered, the per-campaign run UUIDs, and any per-campaign failures.",
+  annotations: {
+    title: "Run Campaign Group",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(RunCampaignGroupInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.runCampaignGroup(input.group_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var UnarchiveCampaignGroupInputShape = {
+  group_id: z.string().uuid().describe("Campaign group UUID.")
+};
+var unarchiveCampaignGroupTool = {
+  name: "unarchive_campaign_group",
+  description: "Restore an archived campaign group and re-expose its campaigns in default lists.",
+  annotations: {
+    title: "Unarchive Campaign Group",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(UnarchiveCampaignGroupInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.unarchiveCampaignGroup(input.group_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var UpdateCampaignGroupInputShape = {
+  group_id: z.string().uuid().describe("Group UUID to update."),
+  name: z.string().min(1).max(200).optional().describe("New display name."),
+  schedule_paused: z.boolean().optional().describe("Pause/resume the scheduler for every campaign in this group.")
+};
+var updateCampaignGroupTool = {
+  name: "update_campaign_group",
+  description: "Update a campaign group: rename, or pause/resume the scheduler (the pause cascades to every campaign in the group).",
+  annotations: {
+    title: "Update Campaign Group",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(UpdateCampaignGroupInputShape),
+  handler: async (input, ctx) => {
+    const body = {
+      ...input.name !== void 0 ? { name: input.name } : {},
+      ...input.schedule_paused !== void 0 ? { schedule_paused: input.schedule_paused } : {}
+    };
+    const result = await ctx.api.updateCampaignGroup(input.group_id, body);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ArchiveCampaignInputShape = {
+  campaign_id: z.string().uuid().describe("Campaign UUID to archive.")
+};
+var archiveCampaignTool = {
+  name: "archive_campaign",
+  description: "Soft-delete (archive) a campaign. Removes it from default lists and stops the scheduler; previously-collected scans are preserved.",
+  annotations: {
+    title: "Archive Campaign",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ArchiveCampaignInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.archiveCampaign(input.campaign_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var CancelCampaignInputShape = {
+  campaign_id: z.string().uuid().describe("Campaign UUID.")
+};
+var cancelCampaignTool = {
+  name: "cancel_campaign",
+  description: "Cancel every pending scan across all unfinished runs of a campaign. Running scans complete normally; pending scans are marked cancelled and credits refunded. Returns count of cancelled scans.",
+  annotations: {
+    title: "Cancel Campaign",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(CancelCampaignInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.cancelCampaign(input.campaign_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var CreateCampaignInputShape = {
+  name: z.string().min(1).max(200).describe("Display name (1-200 chars)."),
+  campaign_type: z.enum(["url", "ad_tag"]).describe("`url` or `ad_tag` \u2014 must match the target field below."),
+  url: z.string().url().optional().describe("Target URL (required if campaign_type=url)."),
+  ad_tag: z.string().optional().describe("Ad-tag HTML/JS (required if campaign_type=ad_tag)."),
+  country_codes: z.array(z.string().length(2)).min(1).describe("ISO 3166-1 alpha-2 codes \u2014 one scan per country per run."),
+  group_id: z.string().uuid().optional().describe("Parent group UUID; defaults to the org's default group."),
+  emulator_categories: z.array(z.string()).optional().describe("Categories of device profiles to rotate through. Default: all available."),
+  labels: z.record(z.string()).optional().describe("Arbitrary metadata applied to every queued scan."),
+  policy_set_id: z.string().uuid().optional().describe("Policy set to evaluate every scan against."),
+  schedule_enabled: z.boolean().optional().describe("If true, the scheduler runs immediately. Default: false (manual run).")
+};
+var createCampaignTool = {
+  name: "create_campaign",
+  description: "Create a recurring scan campaign (template). The schedule produces N scans per run where N = number of countries times number of device profiles. Scans cost credits when they run, not when the campaign is created.",
+  annotations: {
+    title: "Create Campaign",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(CreateCampaignInputShape),
+  handler: async (input, ctx) => {
+    const body = {
+      name: input.name,
+      campaign_type: input.campaign_type,
+      country_codes: input.country_codes,
+      ...input.url !== void 0 ? { url: input.url } : {},
+      ...input.ad_tag !== void 0 ? { ad_tag: input.ad_tag } : {},
+      ...input.group_id !== void 0 ? { group_id: input.group_id } : {},
+      ...input.emulator_categories !== void 0 ? { emulator_categories: input.emulator_categories } : {},
+      ...input.labels !== void 0 ? { labels: input.labels } : {},
+      ...input.policy_set_id !== void 0 ? { policy_set_id: input.policy_set_id } : {},
+      ...input.schedule_enabled !== void 0 ? { schedule_enabled: input.schedule_enabled } : {}
+    };
+    const result = await ctx.api.createCampaign(body);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var GetCampaignInputShape = {
+  campaign_id: z.string().uuid().describe("Campaign UUID.")
+};
+var getCampaignTool = {
+  name: "get_campaign",
+  description: "Get one campaign by UUID: name, type, target URL/ad-tag, countries, schedule status, archive status, parent group.",
+  annotations: {
+    title: "Get Campaign",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetCampaignInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getCampaign(input.campaign_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListCampaignRunsInputShape = {
+  campaign_id: z.string().uuid().describe("Campaign UUID."),
+  page: z.number().int().min(1).max(500).default(1).describe("1-indexed page."),
+  limit: z.number().int().min(1).max(200).default(50).describe("Page size.")
+};
+var listCampaignRunsTool = {
+  name: "list_campaign_runs",
+  description: "List every run (scheduled execution) of one campaign, paginated, with per-run counters.",
+  annotations: {
+    title: "List Campaign Runs",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListCampaignRunsInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.listCampaignRuns(input.campaign_id, {
+      page: input.page,
+      limit: input.limit
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListCampaignsInputShape = {
+  group_id: z.string().uuid().optional().describe("Optional campaign-group UUID to filter by."),
+  page: z.number().int().min(1).max(500).default(1).describe("1-indexed page number."),
+  limit: z.number().int().min(1).max(200).default(50).describe("Page size (1-200).")
+};
+var listCampaignsTool = {
+  name: "list_campaigns",
+  description: "List campaigns for the caller's organization, optionally filtered by group, paginated.",
+  annotations: {
+    title: "List Campaigns",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListCampaignsInputShape),
+  handler: async (input, ctx) => {
+    const filters = {
+      page: input.page,
+      limit: input.limit,
+      ...input.group_id !== void 0 ? { group_id: input.group_id } : {}
+    };
+    const result = await ctx.api.listCampaigns(filters);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListCampaignsPickerInputShape = {};
+var listCampaignsPickerTool = {
+  name: "list_campaigns_picker",
+  description: "Slim per-row campaign list for selection UIs \u2014 id, name, group_id, is_archived. Cheaper than `list_campaigns` for orgs with thousands of campaigns. Use `get_campaign(id)` after a selection to fetch full details.",
+  annotations: {
+    title: "List Campaigns (Picker)",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListCampaignsPickerInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.listCampaignsPicker();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var RunCampaignInputShape = {
+  campaign_id: z.string().uuid().describe("Campaign UUID to run now.")
+};
+var runCampaignTool = {
+  name: "run_campaign",
+  description: "Trigger an immediate, ad-hoc run of a campaign. Costs N credits where N = number of countries \xD7 number of emulators in the campaign config. Returns the new run with progress counters (total / completed / failed / partial / cancelled); track further progress via `get_run`.",
+  annotations: {
+    title: "Run Campaign Now",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(RunCampaignInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.runCampaign(input.campaign_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var UnarchiveCampaignInputShape = {
+  campaign_id: z.string().uuid().describe("Campaign UUID.")
+};
+var unarchiveCampaignTool = {
+  name: "unarchive_campaign",
+  description: "Restore an archived campaign. Inverse of `archive_campaign`. The campaign re-appears in default lists; if `schedule_enabled` was true, the scheduler resumes producing runs.",
+  annotations: {
+    title: "Unarchive Campaign",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(UnarchiveCampaignInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.unarchiveCampaign(input.campaign_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var UpdateCampaignInputShape = {
+  campaign_id: z.string().uuid().describe("Campaign UUID to update."),
+  name: z.string().min(1).max(200).optional().describe("New display name."),
+  country_codes: z.array(z.string().length(2)).optional().describe("Replace the country list."),
+  labels: z.record(z.string()).optional().describe("Replace the label map."),
+  policy_set_id: z.string().uuid().nullable().optional().describe("New policy set UUID; pass null to clear."),
+  schedule_enabled: z.boolean().optional().describe("Pause / resume the scheduler.")
+};
+var updateCampaignTool = {
+  name: "update_campaign",
+  description: "Update one or more fields of a campaign. Fields not supplied are left unchanged. `policy_set_id` accepts null to clear the binding.",
+  annotations: {
+    title: "Update Campaign",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(UpdateCampaignInputShape),
+  handler: async (input, ctx) => {
+    const body = {
+      ...input.name !== void 0 ? { name: input.name } : {},
+      ...input.country_codes !== void 0 ? { country_codes: input.country_codes } : {},
+      ...input.labels !== void 0 ? { labels: input.labels } : {},
+      ...input.policy_set_id !== void 0 ? { policy_set_id: input.policy_set_id } : {},
+      ...input.schedule_enabled !== void 0 ? { schedule_enabled: input.schedule_enabled } : {}
+    };
+    const result = await ctx.api.updateCampaign(input.campaign_id, body);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var CreateCustomRuleInputShape = {
+  name: z.string().min(1).max(200).describe("Display name."),
+  tag_slug: z.string().max(100).optional().describe("Tag slug to assign on match. Empty = create-only (advanced)."),
+  rule_type: z.string().max(50).describe("Rule engine: regex | substring | iab_category | etc. (API validates)."),
+  config: z.record(z.unknown()).describe("Rule-type-specific configuration object. Shape depends on rule_type."),
+  target: z.string().max(30).optional().describe(
+    "Where to apply the rule (e.g. 'page' for landing HTML). Default: page. See API docs for the full set of valid values."
+  )
+};
+var createCustomRuleTool = {
+  name: "create_custom_rule",
+  description: "Define a custom tag-detection rule (regex / substring / category). Matches will tag every future scan; existing scans are untouched until you call `recheck_scans`.",
+  annotations: {
+    title: "Create Custom Rule",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(CreateCustomRuleInputShape),
+  handler: async (input, ctx) => {
+    const body = {
+      name: input.name,
+      rule_type: input.rule_type,
+      config: input.config
+    };
+    if (input.tag_slug !== void 0) body.tag_slug = input.tag_slug;
+    if (input.target !== void 0) body.target = input.target;
+    const result = await ctx.api.createCustomRule(body);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var DeleteCustomRuleInputShape = {
+  rule_id: z.string().uuid().describe("Rule UUID to delete.")
+};
+var deleteCustomRuleTool = {
+  name: "delete_custom_rule",
+  description: "Permanently delete a custom rule. Already-applied tags on past scans are preserved; the rule simply stops running on future scans.",
+  annotations: {
+    title: "Delete Custom Rule",
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(DeleteCustomRuleInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.deleteCustomRule(input.rule_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ deleted: true });
+  }
+};
+var GetCustomRuleInputShape = { rule_id: z.string().uuid().describe("Rule UUID.") };
+var getCustomRuleTool = {
+  name: "get_custom_rule",
+  description: "Get one custom rule by UUID with name, tag-slug, type, config object, target, active flag.",
+  annotations: {
+    title: "Get Custom Rule",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetCustomRuleInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getCustomRule(input.rule_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListCustomRulesInputShape = {
+  page: z.number().int().min(1).max(500).default(1).describe("1-indexed page number."),
+  limit: z.number().int().min(1).max(200).default(50).describe("Page size.")
+};
+var listCustomRulesTool = {
+  name: "list_custom_rules",
+  description: "Paginated list of the organization's custom tag-detection rules (regex / heuristics) with their config, target, and active flag. Returns `{items, total, page, limit}`. To iterate: there is a next page iff `page * limit < total` (or equivalently `items.length === limit` until the last page). `page` is 1-indexed.",
+  annotations: {
+    title: "List Custom Rules",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListCustomRulesInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.listCustomRules({ page: input.page, limit: input.limit });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var TestCustomRuleInputShape = {
+  rule_type: z.string().max(50).describe("Rule engine type (regex, substring, ...)."),
+  config: z.record(z.unknown()).describe("Rule-type-specific config to test."),
+  target: z.string().max(30).describe(
+    "Where to apply the rule (e.g. 'page' for landing HTML). See API docs for the full set of valid values."
+  ),
+  scan_id: z.string().uuid().describe("Existing scan UUID to evaluate the rule against.")
+};
+var testCustomRuleTool = {
+  name: "test_custom_rule",
+  description: "Preview-test a rule definition against an existing scan WITHOUT persisting the rule. Returns `matched: bool`, evaluation time, and per-tag-slug details. Use to validate config before `create_custom_rule`.",
+  annotations: {
+    title: "Test Custom Rule",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(TestCustomRuleInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.testCustomRule({
+      rule_type: input.rule_type,
+      config: input.config,
+      target: input.target,
+      scan_id: input.scan_id
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var UpdateCustomRuleInputShape = {
+  rule_id: z.string().uuid().describe("Rule UUID to update."),
+  name: z.string().min(1).max(200).optional().describe("New display name."),
+  tag_slug: z.string().max(100).optional().describe("New tag slug to assign on match."),
+  config: z.record(z.unknown()).optional().describe("New rule-type-specific config object."),
+  target: z.string().max(30).optional().describe(
+    "Where to apply the rule (e.g. 'page' for landing HTML). See API docs for the full set of valid values."
+  ),
+  is_active: z.boolean().optional().describe("Enable/disable the rule.")
+};
+var updateCustomRuleTool = {
+  name: "update_custom_rule",
+  description: "Update a custom tag-detection rule. Only supplied fields are sent. To toggle activation, pass `is_active`. Existing tagged scans are NOT re-evaluated \u2014 call `recheck_scans` for that. (Rule engine `rule_type` cannot be changed after creation; create a new rule instead.)",
+  annotations: {
+    title: "Update Custom Rule",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(UpdateCustomRuleInputShape),
+  handler: async (input, ctx) => {
+    const body = {};
+    if (input.name !== void 0) body.name = input.name;
+    if (input.tag_slug !== void 0) body.tag_slug = input.tag_slug;
+    if (input.config !== void 0) body.config = input.config;
+    if (input.target !== void 0) body.target = input.target;
+    if (input.is_active !== void 0) body.is_active = input.is_active;
+    const result = await ctx.api.updateCustomRule(input.rule_id, body);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListEmulatorsInputShape = {};
+var listEmulatorsTool = {
+  name: "list_emulators",
+  description: "List every device/OS emulator profile available for scans (id, display name, category, browser). Use the `id` as `emulator_id` in `create_scan` / `create_campaign`.",
+  annotations: {
+    title: "List Emulators",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListEmulatorsInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.listEmulators();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ items: result.value, total: result.value.length });
+  }
+};
+var ListGeosInputShape = {};
+var listGeosTool = {
+  name: "list_geos",
+  description: "List every country the Kaminari Ad platform can scan ads from, with ISO 3166-1 alpha-2 code, name, continent, and emoji.",
+  annotations: {
+    title: "List Geos",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListGeosInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.listGeos();
+    if (result.isErr()) {
+      return err(mapApiError(result.error));
+    }
+    return ok({ items: result.value, total: result.value.length });
+  }
+};
+var ListInvoicesInputShape = {
+  page: z.number().int().min(1).max(500).default(1).describe("1-indexed page."),
+  limit: z.number().int().min(1).max(200).default(50).describe("Page size.")
+};
+var listInvoicesTool = {
+  name: "list_invoices",
+  description: "List invoices issued to the organization with number, status, total in micros, currency, due/paid dates. Use to find an invoice id; PDFs are available at https://app.kaminari.ad/api/v1/invoices/{id}/pdf (not exposed via MCP \u2014 agents return the URL to the user).",
+  annotations: {
+    title: "List Invoices",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListInvoicesInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.listInvoices({ page: input.page, limit: input.limit });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var PolicyEntryShape = z.object({
+  tag_slug: z.string().min(1).max(100).describe("Tag slug that triggers a violation."),
+  country_codes: z.array(z.string().length(2)).max(50).describe("Restrict the violation to these countries. Empty array = all countries.")
+});
+var CreatePolicySetInputShape = {
+  name: z.string().min(1).max(200).describe("Display name."),
+  description: z.string().max(2e3).describe("Free-form description (use empty string for none)."),
+  entries: z.array(PolicyEntryShape).min(1).max(500).describe("At least one entry. Each entry pairs a tag-slug with country codes.")
+};
+var createPolicySetTool = {
+  name: "create_policy_set",
+  description: "Create a new policy set (named collection of tag + country-list entries). Once created, you can bind campaigns to it via `update_campaign`.",
+  annotations: {
+    title: "Create Policy Set",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(CreatePolicySetInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.createPolicySet({
+      name: input.name,
+      description: input.description,
+      entries: input.entries.map((e) => ({ tag_slug: e.tag_slug, country_codes: e.country_codes }))
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var DeletePolicySetInputShape = {
+  policy_set_id: z.string().uuid().describe("Policy set UUID.")
+};
+var deletePolicySetTool = {
+  name: "delete_policy_set",
+  description: "Permanently delete a policy set. IMPORTANT: API returns HTTP 400 if any active campaign is still bound to this set. To unbind first, call `list_campaigns` with a `policy_set_id` filter (when available) or scan your campaigns for matches, then `update_campaign` for each match setting `policy_set_id=null`, then retry delete. Alerts created under this set persist (their `policy_set_id` becomes `null`).",
+  annotations: {
+    title: "Delete Policy Set",
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(DeletePolicySetInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.deletePolicySet(input.policy_set_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ deleted: true });
+  }
+};
+var GetPolicySetInputShape = {
+  policy_set_id: z.string().uuid().describe("Policy set UUID.")
+};
+var getPolicySetTool = {
+  name: "get_policy_set",
+  description: "Get one policy set by UUID with its complete list of entries (tag-slug + applicable country codes).",
+  annotations: {
+    title: "Get Policy Set",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetPolicySetInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getPolicySet(input.policy_set_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListPolicySetsInputShape = {
+  page: z.number().int().min(1).max(500).default(1).describe("1-indexed page number."),
+  limit: z.number().int().min(1).max(200).default(50).describe("Page size.")
+};
+var listPolicySetsTool = {
+  name: "list_policy_sets",
+  description: "Paginated list of policy sets: named collections of (tag, country-list) entries that define what counts as a violation. Campaigns bind to one policy set. Returns `{items, total, page, limit}`. List items omit `entries` for payload size \u2014 fetch a single set via `get_policy_set` when you need them.",
+  annotations: {
+    title: "List Policy Sets",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListPolicySetsInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.listPolicySets({ page: input.page, limit: input.limit });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var RequestPolicySetApprovalInputShape = {
+  policy_set_id: z.string().uuid().describe("Policy set UUID.")
+};
+var requestPolicySetApprovalTool = {
+  name: "request_policy_set_approval",
+  description: "Submit a private policy set for Kaminari Ad team review so it can be marked PUBLIC and used by other organizations. The set must be complete and well-formed. Returns immediately; approval status is reflected on the policy set entity once the review completes.",
+  annotations: {
+    title: "Request Policy Set Approval",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(RequestPolicySetApprovalInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.requestPolicySetApproval(input.policy_set_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ requested: true });
+  }
+};
+var PolicyEntryShape2 = z.object({
+  tag_slug: z.string().min(1).max(100),
+  country_codes: z.array(z.string().length(2)).max(50)
+});
+var UpdatePolicySetInputShape = {
+  policy_set_id: z.string().uuid().describe("Policy set UUID."),
+  name: z.string().min(1).max(200).describe("New name (always required by the API on update)."),
+  description: z.string().max(2e3).describe("New description (empty string allowed)."),
+  entries: z.array(PolicyEntryShape2).min(1).max(500).describe("REPLACEMENT entries list \u2014 REPLACES the current list, not a merge.")
+};
+var updatePolicySetTool = {
+  name: "update_policy_set",
+  description: "REPLACE a policy set's name, description, and entry list. The API requires all three fields on every update \u2014 read the current set with `get_policy_set` first if you only want to change one thing.",
+  annotations: {
+    title: "Update Policy Set",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(UpdatePolicySetInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.updatePolicySet(input.policy_set_id, {
+      name: input.name,
+      description: input.description,
+      entries: input.entries.map((e) => ({ tag_slug: e.tag_slug, country_codes: e.country_codes }))
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var CancelRunInputShape = { run_id: z.string().uuid().describe("Run UUID.") };
+var cancelRunTool = {
+  name: "cancel_run",
+  description: "Cancel every pending scan within one run. Running scans complete; pending ones get refunded. Returns the count of cancelled scans.",
+  annotations: {
+    title: "Cancel Run",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(CancelRunInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.cancelRun(input.run_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var GetRunInputShape = { run_id: z.string().uuid().describe("Run UUID.") };
+var getRunTool = {
+  name: "get_run",
+  description: "Get one run by UUID with totals (queued, completed, failed, partial, cancelled), parent campaign, label, source.",
+  annotations: {
+    title: "Get Run",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetRunInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getRun(input.run_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListRunScansInputShape = {
+  run_id: z.string().uuid().describe("Run UUID."),
+  page: z.number().int().min(1).max(500).default(1).describe("1-indexed page."),
+  limit: z.number().int().min(1).max(200).default(50).describe("Page size.")
+};
+var listRunScansTool = {
+  name: "list_run_scans",
+  description: "List the tile-scan items produced by one run (status, country, offer URL, screenshot, elapsed ms, error). For full scan details (input URL, labels, classification, redirect chain) fetch a specific scan via `get_scan`.",
+  annotations: {
+    title: "List Run Scans",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListRunScansInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.listRunScans(input.run_id, {
+      page: input.page,
+      limit: input.limit
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var CancelScanInputShape = {
+  scan_id: z.string().uuid().describe("UUID of the pending scan to cancel.")
+};
+var cancelScanTool = {
+  name: "cancel_scan",
+  description: "Cancel one pending scan by UUID. Already-running or completed scans are no-ops. Cancellation refunds the scan credit.",
+  annotations: {
+    title: "Cancel Scan",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(CancelScanInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.cancelScan(input.scan_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var CreateBulkScansInputShape = {
+  url: z.string().url().optional().describe("Direct URL. EITHER `url` OR `ad_tag` is required."),
+  ad_tag: z.string().optional().describe("Raw ad-tag HTML/JS. EITHER `url` OR `ad_tag` is required."),
+  country_codes: z.array(z.string().length(2)).min(1).max(50).describe("List of ISO 3166-1 alpha-2 country codes; one scan per country is created."),
+  emulator_id: z.string().min(1).max(100).describe("Device/OS profile slug; same for every country in the batch."),
+  labels: z.record(z.string()).optional().describe("Arbitrary metadata copied onto every created scan.")
+};
+var createBulkScansTool = {
+  name: "create_bulk_scans",
+  description: "Queue one new scan per country in a single call (e.g. test the same URL from US + DE + JP). COSTS N CREDITS where N = number of countries. Returns the list of created scans.",
+  annotations: {
+    title: "Create Bulk Scans",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(CreateBulkScansInputShape),
+  handler: async (input, ctx) => {
+    const body = {
+      country_codes: input.country_codes,
+      emulator_id: input.emulator_id,
+      ...input.url !== void 0 ? { url: input.url } : {},
+      ...input.ad_tag !== void 0 ? { ad_tag: input.ad_tag } : {},
+      ...input.labels !== void 0 ? { labels: input.labels } : {}
+    };
+    const result = await ctx.api.createBulkScans(body);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ items: result.value, total: result.value.length });
+  }
+};
+var CreateScanInputShape = {
+  url: z.string().url().optional().describe("Direct URL of the ad / landing page. EITHER `url` OR `ad_tag` is required."),
+  ad_tag: z.string().optional().describe("Raw HTML/JS ad tag (script, iframe, image). EITHER `url` OR `ad_tag` is required."),
+  country_code: z.string().length(2).describe("ISO 3166-1 alpha-2 country code, e.g. US, DE, JP. Determines proxy geo."),
+  emulator_id: z.string().min(1).max(100).describe("Device/OS profile slug; use `list_emulators` to discover valid values."),
+  labels: z.record(z.string()).optional().describe("Arbitrary string -> string metadata attached to the scan."),
+  campaign_id: z.string().uuid().optional().describe("Optional campaign UUID to attribute the scan to."),
+  run_id: z.string().uuid().optional().describe("Optional run UUID inside the campaign.")
+};
+var createScanTool = {
+  name: "create_scan",
+  description: "Queue a single new scan for a URL or ad-tag against one country. COSTS CREDITS and bills the caller's organization. Returns the newly-created scan record.",
+  annotations: {
+    title: "Create Scan",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(CreateScanInputShape),
+  handler: async (input, ctx) => {
+    const body = {
+      country_code: input.country_code,
+      emulator_id: input.emulator_id,
+      ...input.url !== void 0 ? { url: input.url } : {},
+      ...input.ad_tag !== void 0 ? { ad_tag: input.ad_tag } : {},
+      ...input.labels !== void 0 ? { labels: input.labels } : {},
+      ...input.campaign_id !== void 0 ? { campaign_id: input.campaign_id } : {},
+      ...input.run_id !== void 0 ? { run_id: input.run_id } : {}
+    };
+    const result = await ctx.api.createScan(body);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var GetScanInputShape = {
+  scan_id: z.string().uuid().describe("The scan's UUID (returned by `list_scans` or `create_scan`).")
+};
+var getScanTool = {
+  name: "get_scan",
+  description: "Get full detail for one scan by UUID: status, offer URL, screenshot URL, timing, labels, and the parent campaign if any.",
+  annotations: {
+    title: "Get Scan",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetScanInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getScan(input.scan_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListScansInputShape = {
+  status: z.string().optional().describe(
+    "Comma-separated statuses to filter by. One of: pending, running, done, failed, cancelled."
+  ),
+  country_code: z.string().optional().describe("Comma-separated ISO 3166-1 alpha-2 country codes, e.g. US,DE,JP."),
+  url: z.string().optional().describe("Substring match against the scanned URL."),
+  scan_id: z.string().optional().describe("Comma-separated scan UUIDs to fetch a specific set."),
+  date_from: z.string().date().optional().describe("ISO date (YYYY-MM-DD), inclusive lower bound on scan creation."),
+  date_to: z.string().date().optional().describe("ISO date (YYYY-MM-DD), inclusive upper bound on scan creation."),
+  tag: z.string().optional().describe("Comma-separated tag slugs to filter by."),
+  page: z.number().int().min(1).max(500).default(1).describe("1-indexed page number."),
+  limit: z.number().int().min(1).max(200).default(50).describe("Page size (1-200). Default 50.")
+};
+var listScansTool = {
+  name: "list_scans",
+  description: "List scans for the caller's organization with optional filters (status, country, URL substring, date range, tags). Returns a paginated envelope.",
+  annotations: {
+    title: "List Scans",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListScansInputShape),
+  handler: async (input, ctx) => {
+    const filters = {
+      page: input.page,
+      limit: input.limit,
+      ...input.status !== void 0 ? { status: input.status } : {},
+      ...input.country_code !== void 0 ? { country_code: input.country_code } : {},
+      ...input.url !== void 0 ? { url: input.url } : {},
+      ...input.scan_id !== void 0 ? { scan_id: input.scan_id } : {},
+      ...input.date_from !== void 0 ? { date_from: input.date_from } : {},
+      ...input.date_to !== void 0 ? { date_to: input.date_to } : {},
+      ...input.tag !== void 0 ? { tag: input.tag } : {}
+    };
+    const result = await ctx.api.listScans(filters);
+    if (result.isErr()) {
+      return err(mapApiError(result.error));
+    }
+    return ok(result.value);
+  }
+};
+var RecheckScansInputShape = {
+  scope_type: z.enum(["last_n", "hours"]).describe(
+    "Selection mode. `last_n` = most recent N scans; `hours` = scans from the past N hours."
+  ),
+  scope_value: z.number().int().min(1).max(5e3).describe(
+    "Number of scans (`last_n`, max 5000) OR number of hours (`hours`, max 72). API enforces tighter caps per mode."
+  )
+};
+var recheckScansTool = {
+  name: "recheck_scans",
+  description: "Re-run the checker pipeline against recent COMPLETED scans (e.g. after updating policies or custom rules). Returns the number of scans queued for re-evaluation. No new crawl fee \u2014 only the checker cost.",
+  annotations: {
+    title: "Recheck Scans",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(RecheckScansInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.recheckScans({
+      scope_type: input.scope_type,
+      scope_value: input.scope_value
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var DeleteTagDefinitionInputShape = {
+  slug: z.string().min(1).max(100).describe("Custom tag slug to delete.")
+};
+var deleteTagDefinitionTool = {
+  name: "delete_tag_definition",
+  description: "Delete a CUSTOM tag definition. Historical tag assignments are preserved; future scans will not receive this tag. System tags cannot be deleted.",
+  annotations: {
+    title: "Delete Tag Definition",
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(DeleteTagDefinitionInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.deleteTagDefinition(input.slug);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ deleted: true });
+  }
+};
+var GetTagDefinitionInputShape = {
+  slug: z.string().min(1).max(100).describe("Tag slug (e.g. `malware`, `redirect_chain_too_long`).")
+};
+var getTagDefinitionTool = {
+  name: "get_tag_definition",
+  description: "Get full definition of one tag: display name, description, severity, category, source (system vs custom), public-report visibility, usage counts, plus `linked_rules` \u2014 the custom rules currently producing this tag (id, name, active flag). Fetch a specific rule's full config via `get_custom_rule`.",
+  annotations: {
+    title: "Get Tag Definition",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetTagDefinitionInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getTagDefinition(input.slug);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListScanTagsInputShape = {
+  scan_id: z.string().uuid().describe("Scan UUID.")
+};
+var listScanTagsTool = {
+  name: "list_scan_tags",
+  description: "List every tag (system + custom) attached to one scan by the checker pipeline, with display name, category, and severity.",
+  annotations: {
+    title: "List Scan Tags",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListScanTagsInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.listScanTags(input.scan_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ items: result.value, total: result.value.length });
+  }
+};
+var ListTagsInputShape = {};
+var listTagsTool = {
+  name: "list_tags",
+  description: "List every tag definition the platform knows (system tags + organization custom tags) with category, severity, and usage counters (scans + rules per tag).",
+  annotations: {
+    title: "List Tags",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListTagsInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.listTags();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ items: result.value, total: result.value.length });
+  }
+};
+var UpdateTagDefinitionInputShape = {
+  slug: z.string().min(1).max(100).describe("Tag slug."),
+  display_name: z.string().min(1).max(200).optional().describe("New human-readable name."),
+  description: z.string().max(2e3).optional().describe("New description."),
+  severity: z.enum(["high", "medium", "low"]).optional().describe("New severity level."),
+  show_in_public_report: z.boolean().optional().describe("Whether the tag appears in the public scan-report view.")
+};
+var updateTagDefinitionTool = {
+  name: "update_tag_definition",
+  description: "Update display fields of a CUSTOM tag (system tags are read-only). Only supplied fields are touched. To read the updated definition, follow up with `get_tag_definition`.",
+  annotations: {
+    title: "Update Tag Definition",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(UpdateTagDefinitionInputShape),
+  handler: async (input, ctx) => {
+    const body = {};
+    if (input.display_name !== void 0) body.display_name = input.display_name;
+    if (input.description !== void 0) body.description = input.description;
+    if (input.severity !== void 0) body.severity = input.severity;
+    if (input.show_in_public_report !== void 0) {
+      body.show_in_public_report = input.show_in_public_report;
+    }
+    const result = await ctx.api.updateTagDefinition(input.slug, body);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ updated: true });
+  }
+};
+var BulkReplayWebhookInputShape = {
+  webhook_id: z.string().uuid().describe("Webhook endpoint UUID."),
+  from_ts: z.string().datetime().describe("ISO-8601 lower bound (inclusive) of the time window to replay."),
+  to_ts: z.string().datetime().describe("ISO-8601 upper bound (exclusive) of the time window to replay.")
+};
+var bulkReplayWebhookTool = {
+  name: "bulk_replay_webhook",
+  description: "Replay every delivery attempt for this webhook endpoint that landed in [from_ts, to_ts). Returns `{ replayed, skipped }` counts. Use to recover after a downstream outage \u2014 every event in the window is re-fired.",
+  annotations: {
+    title: "Bulk Replay Webhook",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(BulkReplayWebhookInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.bulkReplayWebhook(input.webhook_id, {
+      from_ts: input.from_ts,
+      to_ts: input.to_ts
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var CreateWebhookInputShape = {
+  url: z.string().url().describe("HTTPS endpoint URL."),
+  description: z.string().max(200).default("").describe("Free-form label shown in the dashboard."),
+  event_types: z.array(z.string()).min(0).max(50).default([]).describe(
+    "Event-type slugs to subscribe to (see `list_webhook_event_types`). Empty array = subscribe to ALL events."
+  ),
+  campaign_ids: z.array(z.string().uuid()).max(50).default([]).describe("Restrict to events from these campaigns. Empty array = events from every campaign.")
+};
+var createWebhookTool = {
+  name: "create_webhook",
+  description: "Register a webhook endpoint for the chosen event types. Response is a `{ webhook, secret }` envelope \u2014 the HMAC-SHA256 SIGNING SECRET is returned once and the caller MUST store it to verify event signatures.",
+  annotations: {
+    title: "Create Webhook",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(CreateWebhookInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.createWebhook({
+      url: input.url,
+      description: input.description,
+      event_types: input.event_types,
+      campaign_ids: input.campaign_ids
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var DeleteWebhookInputShape = {
+  webhook_id: z.string().uuid().describe("Webhook endpoint UUID to remove.")
+};
+var deleteWebhookTool = {
+  name: "delete_webhook",
+  description: "Unregister a webhook endpoint. No further events are delivered; in-flight retries are dropped. Past delivery history is preserved.",
+  annotations: {
+    title: "Delete Webhook",
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(DeleteWebhookInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.deleteWebhook(input.webhook_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ deleted: true });
+  }
+};
+var GetWebhookInputShape = {
+  webhook_id: z.string().uuid().describe("Webhook endpoint UUID.")
+};
+var getWebhookTool = {
+  name: "get_webhook",
+  description: "Get one webhook endpoint by UUID with URL, subscribed event types, active flag.",
+  annotations: {
+    title: "Get Webhook",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(GetWebhookInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.getWebhook(input.webhook_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListWebhookDeliveriesInputShape = {
+  webhook_id: z.string().uuid().describe("Webhook endpoint UUID."),
+  page: z.number().int().min(1).max(500).default(1).describe("1-indexed page."),
+  limit: z.number().int().min(1).max(200).default(50).describe("Page size.")
+};
+var listWebhookDeliveriesTool = {
+  name: "list_webhook_deliveries",
+  description: "List delivery attempts for one webhook endpoint with event type, status (pending / delivered / failed), HTTP response status if any, and attempt timestamp. Paginated.",
+  annotations: {
+    title: "List Webhook Deliveries",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListWebhookDeliveriesInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.listWebhookDeliveries(input.webhook_id, {
+      page: input.page,
+      limit: input.limit
+    });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var ListWebhookEventTypesInputShape = {};
+var listWebhookEventTypesTool = {
+  name: "list_webhook_event_types",
+  description: "List the catalog of event types a webhook can subscribe to (e.g. `scan.done`, `alert.opened`, `campaign.run.completed`) with each event's description and a sample payload.",
+  annotations: {
+    title: "List Webhook Event Types",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListWebhookEventTypesInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.listWebhookEventTypes();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ items: result.value.entries, total: result.value.entries.length });
+  }
+};
+var ListWebhooksInputShape = {};
+var listWebhooksTool = {
+  name: "list_webhooks",
+  description: "List the organization's registered webhook endpoints with their URL, subscribed event types, and active flag.",
+  annotations: {
+    title: "List Webhooks",
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ListWebhooksInputShape),
+  handler: async (_input, ctx) => {
+    const result = await ctx.api.listWebhooks();
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ items: result.value, total: result.value.length });
+  }
+};
+var ReplayWebhookDeliveryInputShape = {
+  attempt_id: z.string().uuid().describe("Delivery-attempt UUID (from `list_webhook_deliveries`).")
+};
+var replayWebhookDeliveryTool = {
+  name: "replay_webhook_delivery",
+  description: "Queue a re-attempt for one specific webhook-delivery attempt by id. Useful when an endpoint was temporarily down. Result of the replay shows up as a new entry in `list_webhook_deliveries`.",
+  annotations: {
+    title: "Replay Webhook Delivery",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(ReplayWebhookDeliveryInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.replayWebhookDelivery(input.attempt_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok({ queued: true });
+  }
+};
+var RotateWebhookSecretInputShape = {
+  webhook_id: z.string().uuid().describe("Webhook endpoint UUID.")
+};
+var rotateWebhookSecretTool = {
+  name: "rotate_webhook_secret",
+  description: "Generate a new signing secret for a webhook. The new secret is returned IN FULL once \u2014 tell the user to store it. Subsequent deliveries are signed with the new secret; the old one stops working immediately.",
+  annotations: {
+    title: "Rotate Webhook Secret",
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  inputSchema: z.object(RotateWebhookSecretInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.rotateWebhookSecret(input.webhook_id);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var TestWebhookInputShape = {
+  webhook_id: z.string().uuid().describe("Webhook endpoint UUID."),
+  event_type: z.string().min(1).max(100).describe(
+    "Event type slug whose sample payload to send (see `list_webhook_event_types` for the catalog)."
+  )
+};
+var testWebhookTool = {
+  name: "test_webhook",
+  description: "Dispatch a synthetic event with the sample payload for the given `event_type` to the webhook endpoint and return the receiver's response synchronously. Includes HTTP status, elapsed time, and a snippet of the response body so the operator can diagnose receiver bugs.",
+  annotations: {
+    title: "Test Webhook",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: true
+  },
+  inputSchema: z.object(TestWebhookInputShape),
+  handler: async (input, ctx) => {
+    const result = await ctx.api.testWebhook(input.webhook_id, { event_type: input.event_type });
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+var UpdateWebhookInputShape = {
+  webhook_id: z.string().uuid().describe("Webhook UUID."),
+  url: z.string().url().optional().describe("New endpoint URL."),
+  event_types: z.array(z.string()).max(50).optional().describe("Replace the subscribed-event-types list."),
+  is_active: z.boolean().optional().describe("Enable / disable delivery.")
+};
+var updateWebhookTool = {
+  name: "update_webhook",
+  description: "Update a webhook endpoint's URL, event-type subscriptions, and/or active flag. Signing secret is NOT rotated by this call \u2014 use `rotate_webhook_secret` for that.",
+  annotations: {
+    title: "Update Webhook",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  inputSchema: z.object(UpdateWebhookInputShape),
+  handler: async (input, ctx) => {
+    const body = {
+      ...input.url !== void 0 ? { url: input.url } : {},
+      ...input.event_types !== void 0 ? { event_types: input.event_types } : {},
+      ...input.is_active !== void 0 ? { is_active: input.is_active } : {}
+    };
+    const result = await ctx.api.updateWebhook(input.webhook_id, body);
+    if (result.isErr()) return err(mapApiError(result.error));
+    return ok(result.value);
+  }
+};
+
+// src/application/tool-registry.ts
+function registerAllTools(register) {
+  register(getAccountTool);
+  register(updateOrgTool);
+  register(listOrgUsersTool);
+  register(inviteUserTool);
+  register(updateUserRoleTool);
+  register(removeUserTool);
+  register(transferOwnershipTool);
+  register(listOrgRolesTool);
+  register(listApiKeysTool);
+  register(createApiKeyTool);
+  register(revokeApiKeyTool);
+  register(listGeosTool);
+  register(listEmulatorsTool);
+  register(getScanTool);
+  register(listScansTool);
+  register(cancelScanTool);
+  register(createBulkScansTool);
+  register(createScanTool);
+  register(recheckScansTool);
+  register(getCampaignTool);
+  register(listCampaignsTool);
+  register(archiveCampaignTool);
+  register(unarchiveCampaignTool);
+  register(cancelCampaignTool);
+  register(runCampaignTool);
+  register(createCampaignTool);
+  register(updateCampaignTool);
+  register(listCampaignRunsTool);
+  register(listCampaignsPickerTool);
+  register(getRunTool);
+  register(listRunScansTool);
+  register(cancelRunTool);
+  register(getCampaignGroupTool);
+  register(listCampaignGroupsTool);
+  register(createCampaignGroupTool);
+  register(updateCampaignGroupTool);
+  register(runCampaignGroupTool);
+  register(cancelCampaignGroupTool);
+  register(archiveCampaignGroupTool);
+  register(unarchiveCampaignGroupTool);
+  register(pauseCampaignGroupScheduleTool);
+  register(resumeCampaignGroupScheduleTool);
+  register(listTagsTool);
+  register(getTagDefinitionTool);
+  register(updateTagDefinitionTool);
+  register(deleteTagDefinitionTool);
+  register(listScanTagsTool);
+  register(listCustomRulesTool);
+  register(getCustomRuleTool);
+  register(createCustomRuleTool);
+  register(updateCustomRuleTool);
+  register(deleteCustomRuleTool);
+  register(testCustomRuleTool);
+  register(listPolicySetsTool);
+  register(getPolicySetTool);
+  register(createPolicySetTool);
+  register(updatePolicySetTool);
+  register(deletePolicySetTool);
+  register(requestPolicySetApprovalTool);
+  register(listAlertsTool);
+  register(updateAlertStatusTool);
+  register(getAlertStatsTool);
+  register(listWebhooksTool);
+  register(getWebhookTool);
+  register(createWebhookTool);
+  register(updateWebhookTool);
+  register(deleteWebhookTool);
+  register(listWebhookEventTypesTool);
+  register(listWebhookDeliveriesTool);
+  register(testWebhookTool);
+  register(rotateWebhookSecretTool);
+  register(replayWebhookDeliveryTool);
+  register(bulkReplayWebhookTool);
+  register(getBillingSummaryTool);
+  register(listUsageTool);
+  register(getUsageSummaryTool);
+  register(listBalanceHistoryTool);
+  register(listInvoicesTool);
+  register(listAlertDestinationsTool);
+  register(deleteAlertDestinationTool);
+  register(setAlertDestinationVersionTool);
+  register(getCampaignAlertOverridesTool);
+  register(setCampaignAlertOverridesTool);
+}
+
+// src/presentation/shared/wire-tools.ts
+function wireToolsIntoMcpServer(server, ctxProvider) {
+  registerAllTools((tool) => {
+    server.registerTool(
+      tool.name,
+      {
+        title: tool.annotations.title,
+        description: tool.description,
+        inputSchema: tool.inputSchema,
+        annotations: {
+          title: tool.annotations.title,
+          readOnlyHint: tool.annotations.readOnlyHint,
+          destructiveHint: tool.annotations.destructiveHint,
+          idempotentHint: tool.annotations.idempotentHint,
+          openWorldHint: tool.annotations.openWorldHint
+        }
+      },
+      (async (rawArgs, _extra) => {
+        const ctx = ctxProvider();
+        const parsed = tool.inputSchema.parse(rawArgs);
+        const result = await tool.handler(parsed, ctx);
+        if (result.isErr()) {
+          return toolErrorToMcpResult(result.error);
+        }
+        return toolOkToMcpResult(result.value);
+      })
+    );
+  });
+}
+function toolOkToMcpResult(value) {
+  const isPlainObject = value !== null && typeof value === "object" && !Array.isArray(value);
+  return {
+    content: [{ type: "text", text: JSON.stringify(value, null, 2) }],
+    ...isPlainObject ? { structuredContent: value } : {}
+  };
+}
+function toolErrorToMcpResult(error) {
+  return {
+    isError: true,
+    content: [{ type: "text", text: formatToolError(error) }]
+  };
+}
+function formatToolError(error) {
+  switch (error.kind) {
+    case "unauthorized":
+      return `Unauthorized: ${error.message}`;
+    case "forbidden":
+      return `Forbidden${error.code === void 0 ? "" : ` (${error.code})`}: ${error.message}`;
+    case "not-found":
+      return `Not found: ${error.message}`;
+    case "rate-limited":
+      return `Rate limited: ${error.message}${error.retryAfterMs === void 0 ? "" : ` (retry after ${String(error.retryAfterMs)} ms)`}`;
+    case "invalid-input":
+      return `Invalid input${error.code === void 0 ? "" : ` (${error.code})`}: ${error.message}`;
+    case "upstream":
+      return `Upstream error: ${error.message}`;
+    case "internal":
+      return `Internal error: ${error.message}`;
+  }
+}
+
+export { BearerToken, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
+//# sourceMappingURL=chunk-4MNLSWSZ.js.map
+//# sourceMappingURL=chunk-4MNLSWSZ.js.map