@kaminari-ad/mcp 0.22.0 → 0.23.0

package/CHANGELOG.md

@@ -7,6 +7,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.23.0] - 2026-09-29
+
+> Requires the API-side ad-format deploy. Until it lands, production
+> silently ignores `ad_formats` as an unknown body field: a `['pop']` request
+> checks and bills every format and reads back without the field. Do not tag
+> this release ahead of the API.
+
+### Added
+
+- **`ad_formats` on `create_scan`, `create_campaign` and `update_campaign`.**
+  An ad-discovery run can now be narrowed to some formats: any of
+  `banner`, `video` and `pop` (pop-unders and tab-unders). A format left out
+  is neither captured nor billed, so `['pop']` checks a publisher's pops
+  without screenshotting or clicking every banner on the page. Omit the
+  field to check every format; on `update_campaign`, pass `null` to go back
+  to every format.
+
+  `ScanResponse` and `CampaignResponse` echo the selection (`null` for
+  every format). The read side is parsed as plain strings rather than the
+  request enum, so a format added on the API side cannot fail a whole
+  `get_scan` / `get_campaign` call. The generated schemas were left alone:
+  the field is declared through the port's escape hatch until the next
+  regen against the deployed API, like `max_discovered_ads` before it.
+
+### Security
+
+- `undici` 8.10.0 → 8.11.2 (GHSA-3wwx-pv8p-q78v, WebSocket
+  permessage-deflate DoS) and transitive `ip-address` 10.4.0 → 10.7.2
+  (link-local and NAT64 classification bypasses), which were failing
+  `audit:deps`.
+
 ## [0.22.0] - 2026-09-15
 
 ### Changed

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { NAME, VERSION, err, ok } from './chunk-J6SALJR4.js';
+import { NAME, VERSION, err, ok } from './chunk-6INS6YMW.js';
 import process from 'process';
 import { z } from 'zod';
 
@@ -160,10 +160,10 @@ async function main() {
   }
   const config = configResult.value;
   if (config.transport === "stdio") {
-    const { bootstrapStdio } = await import('./stdio-bootstrap-6PXVYXHT.js');
+    const { bootstrapStdio } = await import('./stdio-bootstrap-M7I2WD5F.js');
     return bootstrapStdio(config);
   }
-  const { bootstrapHttp } = await import('./http-bootstrap-JX5RQALF.js');
+  const { bootstrapHttp } = await import('./http-bootstrap-NSZVATPV.js');
   return bootstrapHttp(config);
 }
 main().then(

package/dist/{chunk-J6SALJR4.js → chunk-6INS6YMW.js}

@@ -3,8 +3,8 @@ export { err, ok } from 'neverthrow';
 
 // src/shared/version.ts
 var NAME = "@kaminari-ad/mcp";
-var VERSION = "0.22.0";
+var VERSION = "0.23.0";
 
 export { NAME, VERSION };
-//# sourceMappingURL=chunk-J6SALJR4.js.map
-//# sourceMappingURL=chunk-J6SALJR4.js.map
+//# sourceMappingURL=chunk-6INS6YMW.js.map
+//# sourceMappingURL=chunk-6INS6YMW.js.map

package/dist/{chunk-J6SALJR4.js.map → chunk-6INS6YMW.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;;AASO,IAAM,IAAA,GAAO;AACb,IAAM,OAAA,GAAU","file":"chunk-J6SALJR4.js","sourcesContent":["/**\n * Package version and name. Hard-coded as constants here, asserted to\n * match `package.json` by a unit test.\n *\n * Why not import `package.json`: it would force JSON-module support at\n * runtime and tsup-bundling would inline the entire manifest. Two\n * constants + one assertion test is simpler and gives the same safety.\n */\n\nexport const NAME = \"@kaminari-ad/mcp\";\nexport const VERSION = \"0.22.0\";\n"]}
+{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;;AASO,IAAM,IAAA,GAAO;AACb,IAAM,OAAA,GAAU","file":"chunk-6INS6YMW.js","sourcesContent":["/**\n * Package version and name. Hard-coded as constants here, asserted to\n * match `package.json` by a unit test.\n *\n * Why not import `package.json`: it would force JSON-module support at\n * runtime and tsup-bundling would inline the entire manifest. Two\n * constants + one assertion test is simpler and gives the same safety.\n */\n\nexport const NAME = \"@kaminari-ad/mcp\";\nexport const VERSION = \"0.23.0\";\n"]}

package/dist/{chunk-VEPJEI3S.js → chunk-XJZE6KTY.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { err, ok } from './chunk-J6SALJR4.js';
+import { err, ok } from './chunk-6INS6YMW.js';
 import { createHash, randomUUID } from 'crypto';
 import createClient from 'openapi-fetch';
 import { fetch } from 'undici';
@@ -1380,7 +1380,7 @@ var CampaignSchema = schemas.CampaignResponse.pick({
   is_archived: true,
   created_at: true,
   last_run_at: true
-}).extend({ repeat_mode: schemas.RepeatMode.default("isolated") }).extend({ max_discovered_ads: z.number().int().nullable().optional() }).extend({ ignore_first_n_domains: z.number().int().optional() }).strip();
+}).extend({ repeat_mode: schemas.RepeatMode.default("isolated") }).extend({ max_discovered_ads: z.number().int().nullable().optional() }).extend({ ad_formats: z.array(z.string()).nullable().optional() }).extend({ ignore_first_n_domains: z.number().int().optional() }).strip();
 var parseCampaign = (raw) => parseWithSchema(CampaignSchema, raw, "campaign");
 var parseCampaignPage = (raw) => parsePagedWithItemSchema(CampaignSchema, raw, "campaigns");
 
@@ -1844,7 +1844,7 @@ var ScanSchema = schemas.ScanResponse.pick({
   repeat_scan_ids: true,
   retry_attempt: true,
   retry_max_attempts: true
-}).extend({ creative_kind: z.string().default("banner") }).extend({ max_discovered_ads: z.number().int().nullable().optional() }).extend({ network_host: z.string().optional() }).extend({ ignore_first_n_domains: z.number().int().optional() }).strip();
+}).extend({ creative_kind: z.string().default("banner") }).extend({ max_discovered_ads: z.number().int().nullable().optional() }).extend({ ad_formats: z.array(z.string()).nullable().optional() }).extend({ network_host: z.string().optional() }).extend({ ignore_first_n_domains: z.number().int().optional() }).strip();
 var ScanArraySchema = z.array(ScanSchema);
 var parseScan = (raw) => parseWithSchema(ScanSchema, raw, "scan");
 var parseScanArray = (raw) => parseWithSchema(ScanArraySchema, raw, "scans");
@@ -3903,6 +3903,13 @@ var cancelCampaignTool = {
     return ok(result.value);
   }
 };
+var AD_FORMATS_DESCRIPTION = "Which ad formats an ad-discovery run checks: any of `banner`, `video` and `pop` (`pop` covers pop-unders and tab-unders), each at most once. A format left out is neither captured nor billed \u2014 `['pop']` checks the page's pops without screenshotting or clicking a single banner. A tab-under the page forces on its own is still reported as a pop. Only valid on an ad-discovery target \u2014 `ad_discovery: true` on a scan, or `campaign_type: \"ad_discovery\"` on a campaign \u2014 and rejected with 422 anywhere else, as is an empty list.";
+var adFormat = z.enum(["banner", "video", "pop"]);
+var adFormats = z.array(adFormat).min(1).max(adFormat.options.length);
+var adFormatsField = adFormats.optional().describe(`${AD_FORMATS_DESCRIPTION} Omit it to check every format.`);
+var adFormatsUpdateField = adFormats.nullable().optional().describe(
+  `${AD_FORMATS_DESCRIPTION} Omitting the field leaves the campaign's current selection unchanged; pass null to go back to checking every format.`
+);
 var IGNORE_FIRST_N_DOMAINS_DESCRIPTION = "How many leading domains of the redirect chain to exclude from detection and tagging (0-5). Use it when the check enters through the caller's OWN click or tracking domains: without it a reputation hit on one of those tags the material and raises an alert about the caller's infrastructure rather than about the offer. Counting starts at the entry point and follows chain order; domains fold to their registrable form, so www.example.com and example.com consume one slot between them, and any other request to one of those domains is excluded too. A skipped domain is checked by NOTHING, so never set this higher than the number of domains the caller actually owns at the head of the chain \u2014 ask rather than guess. The full redirect chain is still captured and returned either way.";
 var ignoreFirstNDomains = z.number().int().min(0).max(5);
 var ignoreFirstNDomainsField = ignoreFirstNDomains.optional().describe(`${IGNORE_FIRST_N_DOMAINS_DESCRIPTION} Omit it to skip nothing (0).`);
@@ -4017,6 +4024,7 @@ var CreateCampaignInputShape = {
   referrer: campaignReferrerField,
   ignore_first_n_domains: ignoreFirstNDomainsField,
   max_discovered_ads: maxDiscoveredAdsField,
+  ad_formats: adFormatsField,
   country_codes: z.array(z.string().length(2)).min(1).describe("ISO 3166-1 alpha-2 codes \u2014 one scan per country per run."),
   group_id: z.string().uuid().optional().describe("Parent group UUID; defaults to the org's default group."),
   ...campaignConfigFields,
@@ -4048,6 +4056,7 @@ var createCampaignTool = {
       ...input.referrer !== void 0 ? { referrer: input.referrer } : {},
       ...input.ignore_first_n_domains !== void 0 ? { ignore_first_n_domains: input.ignore_first_n_domains } : {},
       ...input.max_discovered_ads !== void 0 ? { max_discovered_ads: input.max_discovered_ads } : {},
+      ...input.ad_formats !== void 0 ? { ad_formats: input.ad_formats } : {},
       ...input.group_id !== void 0 ? { group_id: input.group_id } : {},
       ...input.labels !== void 0 ? { labels: input.labels } : {},
       ...input.policy_set_id !== void 0 ? { policy_set_id: input.policy_set_id } : {},
@@ -4223,6 +4232,7 @@ var UpdateCampaignInputShape = {
   referrer: campaignReferrerUpdateField,
   ignore_first_n_domains: ignoreFirstNDomainsUpdateField,
   max_discovered_ads: maxDiscoveredAdsUpdateField,
+  ad_formats: adFormatsUpdateField,
   country_codes: z.array(z.string().length(2)).optional().describe("Replace the country list."),
   group_id: z.string().uuid().optional().describe("Move the campaign to another group."),
   ...campaignConfigFields,
@@ -4232,7 +4242,7 @@ var UpdateCampaignInputShape = {
 };
 var updateCampaignTool = {
   name: "update_campaign",
-  description: "Update one or more fields of a campaign. Fields not supplied are left unchanged. `policy_set_id` accepts null to clear the binding, `referrer` accepts null to clear the publisher page scans are checked from, and `max_discovered_ads` accepts null to go back to the platform ad cap. `ignore_first_n_domains` is the exception: it is not nullable, so pass 0 to go back to skipping nothing.",
+  description: "Update one or more fields of a campaign. Fields not supplied are left unchanged. `policy_set_id` accepts null to clear the binding, `referrer` accepts null to clear the publisher page scans are checked from, `max_discovered_ads` accepts null to go back to the platform ad cap, and `ad_formats` accepts null to go back to checking every ad format. `ignore_first_n_domains` is the exception: it is not nullable, so pass 0 to go back to skipping nothing.",
   annotations: {
     title: "Update Campaign",
     readOnlyHint: false,
@@ -4250,6 +4260,7 @@ var updateCampaignTool = {
       ...input.referrer !== void 0 ? { referrer: input.referrer } : {},
       ...input.ignore_first_n_domains !== void 0 ? { ignore_first_n_domains: input.ignore_first_n_domains } : {},
       ...input.max_discovered_ads !== void 0 ? { max_discovered_ads: input.max_discovered_ads } : {},
+      ...input.ad_formats !== void 0 ? { ad_formats: input.ad_formats } : {},
       ...input.country_codes !== void 0 ? { country_codes: input.country_codes } : {},
       ...input.group_id !== void 0 ? { group_id: input.group_id } : {},
       ...input.labels !== void 0 ? { labels: input.labels } : {},
@@ -5382,9 +5393,10 @@ var CreateScanInputShape = {
   campaign_id: z.string().uuid().optional().describe("Optional campaign UUID to attribute the scan to."),
   run_id: z.string().uuid().optional().describe("Optional run UUID inside the campaign."),
   ad_discovery: z.boolean().optional().describe(
-    "Publisher ad discovery: detect ad blocks on the page and spawn one child scan per detected ad (banner/pop). Only valid with `url`. Each child is a separate billed scan; list them with `list_scan_children`."
+    "Publisher ad discovery: detect ad blocks on the page and spawn one child scan per detected ad (banner/video/pop). Only valid with `url`. Each child is a separate billed scan; list them with `list_scan_children`."
   ),
   max_discovered_ads: maxDiscoveredAdsField,
+  ad_formats: adFormatsField,
   ...repeatRetryFields
 };
 var createScanTool = {
@@ -5413,6 +5425,7 @@ var createScanTool = {
       ...input.run_id !== void 0 ? { run_id: input.run_id } : {},
       ...input.ad_discovery !== void 0 ? { ad_discovery: input.ad_discovery } : {},
       ...input.max_discovered_ads !== void 0 ? { max_discovered_ads: input.max_discovered_ads } : {},
+      ...input.ad_formats !== void 0 ? { ad_formats: input.ad_formats } : {},
       ...pickRepeatRetryBody(input)
     };
     const result = await ctx.api.createScan(body);
@@ -6301,5 +6314,5 @@ function formatToolError(error) {
 }
 
 export { BearerToken, SERVER_INSTRUCTIONS, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
-//# sourceMappingURL=chunk-VEPJEI3S.js.map
-//# sourceMappingURL=chunk-VEPJEI3S.js.map
+//# sourceMappingURL=chunk-XJZE6KTY.js.map
+//# sourceMappingURL=chunk-XJZE6KTY.js.map