@kaminari-ad/mcp 0.22.0 → 0.24.0

package/CHANGELOG.md

@@ -7,6 +7,73 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.24.0] - 2026-09-30
+
+> Requires the API release with campaign `notifications` and label routing.
+> Until it lands, production ignores the new body fields and omits the new
+> response fields. Do not tag this release ahead of the API.
+
+### Added
+
+- **`notifications` on `create_campaign` and `update_campaign`.** A campaign's
+  alert routing (`mode`, `destination_ids`, `routing_label_key`) is saved in
+  the same request as the campaign. The API validates the block before it
+  writes anything, so an invalid block leaves the campaign untouched. Omit it
+  to keep the current routing (update) or inherit the org defaults (create).
+- **Label routing.** `set_campaign_alert_overrides` accepts
+  `routing_label_key` on top of `inherit` / `override`: each scan also reaches
+  the destinations whose label rule matches its value for that key (one DSP's
+  chat in a shared campaign). `get_campaign_alert_overrides` returns the key,
+  and `list_alert_destinations` returns each destination's rule as
+  `route_label_key` + `route_label_values`. The mode / destination / key
+  combination rules are checked locally before the call.
+
+### Changed
+
+- Regenerated `openapi.ts` / `zod-schemas.ts` from the current API, which also
+  picks up response fields added since the last regen (`ad_formats`,
+  `network_host`, `creative_redirect_chain`).
+- `set_campaign_alert_overrides` now replaces the label routing along with the
+  mode: a call without `routing_label_key` clears a key set earlier. Read
+  `get_campaign_alert_overrides` first to keep it.
+
+### Security
+
+- `brace-expansion` 5.0.12, `fast-uri` 3.1.8 and `axios` 1.20.0 (transitive)
+  for GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p,
+  GHSA-hrr3-gc8f-f4qj and the axios 1.19 advisories (GHSA-vh66-26gq-q6x8 et al.).
+
+## [0.23.0] - 2026-09-29
+
+> Requires the API-side ad-format deploy. Until it lands, production
+> silently ignores `ad_formats` as an unknown body field: a `['pop']` request
+> checks and bills every format and reads back without the field. Do not tag
+> this release ahead of the API.
+
+### Added
+
+- **`ad_formats` on `create_scan`, `create_campaign` and `update_campaign`.**
+  An ad-discovery run can now be narrowed to some formats: any of
+  `banner`, `video` and `pop` (pop-unders and tab-unders). A format left out
+  is neither captured nor billed, so `['pop']` checks a publisher's pops
+  without screenshotting or clicking every banner on the page. Omit the
+  field to check every format; on `update_campaign`, pass `null` to go back
+  to every format.
+
+  `ScanResponse` and `CampaignResponse` echo the selection (`null` for
+  every format). The read side is parsed as plain strings rather than the
+  request enum, so a format added on the API side cannot fail a whole
+  `get_scan` / `get_campaign` call. The generated schemas were left alone:
+  the field is declared through the port's escape hatch until the next
+  regen against the deployed API, like `max_discovered_ads` before it.
+
+### Security
+
+- `undici` 8.10.0 → 8.11.2 (GHSA-3wwx-pv8p-q78v, WebSocket
+  permessage-deflate DoS) and transitive `ip-address` 10.4.0 → 10.7.2
+  (link-local and NAT64 classification bypasses), which were failing
+  `audit:deps`.
+
 ## [0.22.0] - 2026-09-15
 
 ### Changed

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { NAME, VERSION, err, ok } from './chunk-J6SALJR4.js';
+import { NAME, VERSION, err, ok } from './chunk-JTJY73XX.js';
 import process from 'process';
 import { z } from 'zod';
 
@@ -160,10 +160,10 @@ async function main() {
   }
   const config = configResult.value;
   if (config.transport === "stdio") {
-    const { bootstrapStdio } = await import('./stdio-bootstrap-6PXVYXHT.js');
+    const { bootstrapStdio } = await import('./stdio-bootstrap-HDLBAPCW.js');
     return bootstrapStdio(config);
   }
-  const { bootstrapHttp } = await import('./http-bootstrap-JX5RQALF.js');
+  const { bootstrapHttp } = await import('./http-bootstrap-URSEZ7YN.js');
   return bootstrapHttp(config);
 }
 main().then(

package/dist/{chunk-J6SALJR4.js → chunk-JTJY73XX.js}

@@ -3,8 +3,8 @@ export { err, ok } from 'neverthrow';
 
 // src/shared/version.ts
 var NAME = "@kaminari-ad/mcp";
-var VERSION = "0.22.0";
+var VERSION = "0.24.0";
 
 export { NAME, VERSION };
-//# sourceMappingURL=chunk-J6SALJR4.js.map
-//# sourceMappingURL=chunk-J6SALJR4.js.map
+//# sourceMappingURL=chunk-JTJY73XX.js.map
+//# sourceMappingURL=chunk-JTJY73XX.js.map

package/dist/{chunk-J6SALJR4.js.map → chunk-JTJY73XX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;;AASO,IAAM,IAAA,GAAO;AACb,IAAM,OAAA,GAAU","file":"chunk-J6SALJR4.js","sourcesContent":["/**\n * Package version and name. Hard-coded as constants here, asserted to\n * match `package.json` by a unit test.\n *\n * Why not import `package.json`: it would force JSON-module support at\n * runtime and tsup-bundling would inline the entire manifest. Two\n * constants + one assertion test is simpler and gives the same safety.\n */\n\nexport const NAME = \"@kaminari-ad/mcp\";\nexport const VERSION = \"0.22.0\";\n"]}
+{"version":3,"sources":["../src/shared/version.ts"],"names":[],"mappings":";;;;AASO,IAAM,IAAA,GAAO;AACb,IAAM,OAAA,GAAU","file":"chunk-JTJY73XX.js","sourcesContent":["/**\n * Package version and name. Hard-coded as constants here, asserted to\n * match `package.json` by a unit test.\n *\n * Why not import `package.json`: it would force JSON-module support at\n * runtime and tsup-bundling would inline the entire manifest. Two\n * constants + one assertion test is simpler and gives the same safety.\n */\n\nexport const NAME = \"@kaminari-ad/mcp\";\nexport const VERSION = \"0.24.0\";\n"]}

package/dist/{chunk-VEPJEI3S.js → chunk-VLIIUTPH.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { err, ok } from './chunk-J6SALJR4.js';
+import { err, ok } from './chunk-JTJY73XX.js';
 import { createHash, randomUUID } from 'crypto';
 import createClient from 'openapi-fetch';
 import { fetch } from 'undici';
@@ -254,12 +254,14 @@ var ProxyTargetRequest = z.object({
   city: z.string().default(""),
   isp: z.string().default("")
 }).partial().passthrough();
+var AdKind = z.enum(["banner", "pop", "video"]);
 var RepeatModeType = z.enum(["isolated", "shared"]);
 z.object({
   url: z.union([z.string(), z.null()]).optional(),
   ad_tag: z.union([z.string(), z.null()]).optional(),
   vast_tag: z.union([z.string(), z.null()]).optional(),
   referrer: z.union([z.string(), z.null()]).optional(),
+  ignore_first_n_domains: z.number().int().gte(0).lte(5).optional().default(0),
   country_code: z.string().min(2).max(2),
   emulator_id: z.string().min(1).max(100),
   proxy: ProxyTargetRequest.optional(),
@@ -267,6 +269,8 @@ z.object({
   campaign_id: z.union([z.string(), z.null()]).optional(),
   run_id: z.union([z.string(), z.null()]).optional(),
   ad_discovery: z.boolean().optional().default(false),
+  max_discovered_ads: z.union([z.number(), z.null()]).optional(),
+  ad_formats: z.union([z.array(AdKind), z.null()]).optional(),
   repeat_count: z.number().int().gte(1).optional().default(1),
   repeat_mode: RepeatModeType.optional(),
   retry_max_attempts: z.number().int().gte(0).optional().default(0)
@@ -367,9 +371,12 @@ var ScanResponse = z.object({
   status: ScanStatus,
   parent_scan_id: z.union([z.string(), z.null()]).optional(),
   ad_discovery: z.boolean().optional().default(false),
+  max_discovered_ads: z.union([z.number(), z.null()]).optional(),
+  ad_formats: z.union([z.array(AdKind), z.null()]).optional(),
   slot_index: z.union([z.number(), z.null()]).optional(),
   ad_kind: z.union([z.string(), z.null()]).optional(),
   network: z.string().optional().default(""),
+  network_host: z.string().optional().default(""),
   offer_url: z.string(),
   redirect_chain: z.array(RedirectHopResponse),
   screenshot_url: z.string().optional().default(""),
@@ -378,6 +385,7 @@ var ScanResponse = z.object({
   ad_tag: z.union([z.string(), z.null()]).optional(),
   vast_tag: z.union([z.string(), z.null()]).optional(),
   referrer: z.union([z.string(), z.null()]).optional(),
+  ignore_first_n_domains: z.number().int().optional().default(0),
   creative_kind: z.enum(["banner", "video"]).optional().default("banner"),
   creative_screenshot_url: z.string().optional().default(""),
   creative_video_url: z.string().optional().default(""),
@@ -385,6 +393,7 @@ var ScanResponse = z.object({
   creative_html_url: z.string().optional().default(""),
   creative_width: z.number().int().optional().default(0),
   creative_height: z.number().int().optional().default(0),
+  creative_redirect_chain: z.array(RedirectHopResponse).optional(),
   video: z.union([VideoMetaResponse, z.null()]).optional(),
   proxy: z.union([ProxyTargetResponse, z.null()]).optional(),
   page_title: z.string(),
@@ -430,6 +439,7 @@ var ScanBriefResponse = z.object({
   slot_index: z.union([z.number(), z.null()]).optional(),
   ad_kind: z.union([z.string(), z.null()]).optional(),
   network: z.string().optional().default(""),
+  network_host: z.string().optional().default(""),
   emulator_display_name: z.string().optional().default(""),
   emulator_category: z.string().optional().default(""),
   repeat_index: z.number().int().optional().default(0),
@@ -450,6 +460,7 @@ z.object({
   ad_tag: z.union([z.string(), z.null()]).optional(),
   vast_tag: z.union([z.string(), z.null()]).optional(),
   referrer: z.union([z.string(), z.null()]).optional(),
+  ignore_first_n_domains: z.number().int().gte(0).lte(5).optional().default(0),
   country_codes: z.array(z.string()).min(1),
   emulator_id: z.string().min(1).max(100),
   proxy: ProxyTargetRequest.optional(),
@@ -510,7 +521,13 @@ var GroupActionResponse = z.object({
   run_ids: z.array(z.string().uuid()).optional(),
   failures: z.array(BulkCampaignFailure).optional()
 }).passthrough();
+var DiscoveryAdFormat = z.enum(["banner", "pop", "video"]);
 var RepeatMode = z.enum(["isolated", "shared"]);
+var CampaignNotificationsRequest = z.object({
+  mode: z.enum(["inherit", "override", "silence"]),
+  destination_ids: z.array(z.string().uuid()).optional(),
+  routing_label_key: z.union([z.string(), z.null()]).optional()
+}).passthrough();
 z.object({
   name: z.string().min(1).max(200),
   campaign_type: z.string().optional().default("url"),
@@ -518,6 +535,9 @@ z.object({
   ad_tag: z.union([z.string(), z.null()]).optional(),
   vast_tag: z.union([z.string(), z.null()]).optional(),
   referrer: z.union([z.string(), z.null()]).optional(),
+  ignore_first_n_domains: z.number().int().gte(0).lte(5).optional().default(0),
+  max_discovered_ads: z.union([z.number(), z.null()]).optional(),
+  ad_formats: z.union([z.array(DiscoveryAdFormat), z.null()]).optional(),
   country_codes: z.array(z.string()).min(1),
   group_id: z.union([z.string(), z.null()]).optional(),
   emulator_categories: z.array(z.string()).optional(),
@@ -536,7 +556,8 @@ z.object({
   schedule_weekly: z.union([z.record(z.array(z.number().int())), z.null()]).optional(),
   schedule_interval_seconds: z.union([z.number(), z.null()]).optional(),
   schedule_enabled: z.union([z.boolean(), z.null()]).optional(),
-  schedule_timezone: z.union([z.string(), z.null()]).optional()
+  schedule_timezone: z.union([z.string(), z.null()]).optional(),
+  notifications: z.union([CampaignNotificationsRequest, z.null()]).optional()
 }).passthrough();
 var EmulatorSelectionResponse = z.object({
   categories: z.array(z.string()),
@@ -551,6 +572,9 @@ var CampaignResponse = z.object({
   ad_tag: z.union([z.string(), z.null()]).optional(),
   vast_tag: z.union([z.string(), z.null()]).optional(),
   referrer: z.union([z.string(), z.null()]).optional(),
+  ignore_first_n_domains: z.number().int().optional().default(0),
+  max_discovered_ads: z.union([z.number(), z.null()]).optional(),
+  ad_formats: z.union([z.array(DiscoveryAdFormat), z.null()]).optional(),
   country_codes: z.array(z.string()),
   group_id: z.string().uuid(),
   emulator_selection: EmulatorSelectionResponse,
@@ -592,6 +616,9 @@ z.object({
   ad_tag: z.union([z.string(), z.null()]),
   vast_tag: z.union([z.string(), z.null()]),
   referrer: z.union([z.string(), z.null()]),
+  ignore_first_n_domains: z.number().int().gte(0).lte(5).default(0),
+  max_discovered_ads: z.union([z.number(), z.null()]),
+  ad_formats: z.union([z.array(DiscoveryAdFormat), z.null()]),
   country_codes: z.union([z.array(z.string()), z.null()]),
   group_id: z.union([z.string(), z.null()]),
   emulator_categories: z.union([z.array(z.string()), z.null()]),
@@ -610,7 +637,8 @@ z.object({
   schedule_weekly: z.union([z.record(z.array(z.number().int())), z.null()]),
   schedule_interval_seconds: z.union([z.number(), z.null()]),
   schedule_enabled: z.union([z.boolean(), z.null()]),
-  schedule_timezone: z.union([z.string(), z.null()])
+  schedule_timezone: z.union([z.string(), z.null()]),
+  notifications: z.union([CampaignNotificationsRequest, z.null()])
 }).partial().passthrough();
 var RunSource = z.enum(["ui", "api"]);
 var RunResponse = z.object({
@@ -1102,6 +1130,8 @@ var AlertNotificationDestinationResponse = z.object({
   email_address: z.union([z.string(), z.null()]),
   included_label_keys: z.array(z.string()),
   included_statuses: z.array(z.string()),
+  route_label_key: z.union([z.string(), z.null()]),
+  route_label_values: z.array(z.string()),
   created_at: z.string().datetime({ offset: true }),
   updated_at: z.string().datetime({ offset: true })
 }).passthrough();
@@ -1110,11 +1140,13 @@ var CampaignOverrideMode = z.enum(["inherit", "override", "silence"]);
 var CampaignOverridesResponse = z.object({
   campaign_id: z.string().uuid(),
   mode: CampaignOverrideMode,
-  destination_ids: z.array(z.string().uuid())
+  destination_ids: z.array(z.string().uuid()),
+  routing_label_key: z.union([z.string(), z.null()])
 }).passthrough();
 z.object({
   mode: CampaignOverrideMode,
-  destination_ids: z.array(z.string().uuid()).optional().default([])
+  destination_ids: z.array(z.string().uuid()).optional().default([]),
+  routing_label_key: z.union([z.string(), z.null()]).optional()
 }).passthrough();
 var InvoiceType = z.enum(["proforma", "final"]);
 z.union([InvoiceType, z.null()]).optional();
@@ -1380,7 +1412,7 @@ var CampaignSchema = schemas.CampaignResponse.pick({
   is_archived: true,
   created_at: true,
   last_run_at: true
-}).extend({ repeat_mode: schemas.RepeatMode.default("isolated") }).extend({ max_discovered_ads: z.number().int().nullable().optional() }).extend({ ignore_first_n_domains: z.number().int().optional() }).strip();
+}).extend({ repeat_mode: schemas.RepeatMode.default("isolated") }).extend({ max_discovered_ads: z.number().int().nullable().optional() }).extend({ ad_formats: z.array(z.string()).nullable().optional() }).extend({ ignore_first_n_domains: z.number().int().optional() }).strip();
 var parseCampaign = (raw) => parseWithSchema(CampaignSchema, raw, "campaign");
 var parseCampaignPage = (raw) => parsePagedWithItemSchema(CampaignSchema, raw, "campaigns");
 
@@ -1506,8 +1538,6 @@ var EmulatorSchema = schemas.EmulatorResponse.pick({
 }).strip();
 var EmulatorListSchema = z.array(EmulatorSchema);
 var parseEmulatorList = (raw) => parseWithSchema(EmulatorListSchema, raw, "emulators");
-
-// src/infrastructure/api/parsers/parse-generic.ts
 function parsePageOf(parseItem) {
   return (raw) => {
     if (raw === null || typeof raw !== "object") {
@@ -1694,13 +1724,16 @@ var AlertDestinationSchema = schemas.AlertNotificationDestinationResponse.pick({
   included_label_keys: true,
   created_at: true,
   updated_at: true
+}).extend({
+  route_label_key: z.string().nullable().optional(),
+  route_label_values: z.array(z.string()).optional()
 }).strip();
 var parseAlertDestination = (raw) => parseWithSchema(AlertDestinationSchema, raw, "alert-destination");
 var CampaignOverridesSchema = schemas.CampaignOverridesResponse.pick({
   campaign_id: true,
   mode: true,
   destination_ids: true
-}).strip();
+}).extend({ routing_label_key: z.string().nullable().optional() }).strip();
 var parseCampaignAlertOverrides = (raw) => parseWithSchema(CampaignOverridesSchema, raw, "campaign-overrides");
 var BulkReplaySchema = schemas.BulkReplayResponse.pick({
   replayed: true,
@@ -1844,7 +1877,7 @@ var ScanSchema = schemas.ScanResponse.pick({
   repeat_scan_ids: true,
   retry_attempt: true,
   retry_max_attempts: true
-}).extend({ creative_kind: z.string().default("banner") }).extend({ max_discovered_ads: z.number().int().nullable().optional() }).extend({ network_host: z.string().optional() }).extend({ ignore_first_n_domains: z.number().int().optional() }).strip();
+}).extend({ creative_kind: z.string().default("banner") }).extend({ max_discovered_ads: z.number().int().nullable().optional() }).extend({ ad_formats: z.array(z.string()).nullable().optional() }).extend({ network_host: z.string().optional() }).extend({ ignore_first_n_domains: z.number().int().optional() }).strip();
 var ScanArraySchema = z.array(ScanSchema);
 var parseScan = (raw) => parseWithSchema(ScanSchema, raw, "scan");
 var parseScanArray = (raw) => parseWithSchema(ScanArraySchema, raw, "scans");
@@ -3247,7 +3280,7 @@ var GetCampaignAlertOverridesInputShape = {
 };
 var getCampaignAlertOverridesTool = {
   name: "get_campaign_alert_overrides",
-  description: "Get the per-campaign override of which alert destinations receive its alerts. `mode` is one of `inherit` (no override \u2014 the campaign follows the org-wide destinations), `override` (alerts go ONLY to the returned `destination_ids`), or `silence` (the campaign sends nothing).",
+  description: "Get the per-campaign override of which alert destinations receive its alerts. `mode` is one of `inherit` (no override \u2014 the campaign follows the org-wide destinations), `override` (alerts go ONLY to the returned `destination_ids`), or `silence` (the campaign sends nothing). `routing_label_key`, when set, adds label routing on top of inherit/override: each scan also reaches the destinations whose label rule on that key matches the scan's value.",
   annotations: {
     title: "Get Campaign Alert Overrides",
     readOnlyHint: true,
@@ -3265,7 +3298,7 @@ var getCampaignAlertOverridesTool = {
 var ListAlertDestinationsInputShape = {};
 var listAlertDestinationsTool = {
   name: "list_alert_destinations",
-  description: "List configured alert-notification destinations (channels): Slack workspaces, Telegram chats, email lists, generic webhooks. Each entry has id, kind, display name, version, and creation timestamp.",
+  description: "List configured alert-notification destinations (channels): Slack workspaces, Telegram chats, email lists, generic webhooks. Each entry has id, kind, display name, version, creation timestamp and, when set, its label routing rule (`route_label_key` + `route_label_values`) used by campaigns that route by that label key.",
   annotations: {
     title: "List Alert Destinations",
     readOnlyHint: true,
@@ -3305,18 +3338,43 @@ var setAlertDestinationVersionTool = {
     return ok({ updated: true });
   }
 };
-var SetCampaignAlertOverridesInputShape = {
-  campaign_id: z.string().uuid().describe("Campaign UUID."),
+var alertRoutingFields = {
   mode: schemas.CampaignOverrideMode.describe(
     "Routing mode: `inherit` (fall back to the org-wide destinations), `override` (route ONLY to `destination_ids`), `silence` (send nothing for this campaign)."
   ),
   destination_ids: z.array(z.string().uuid()).max(50).default([]).describe(
     "Destination UUIDs to route to. Accepted ONLY with `mode: override` \u2014 the API rejects it for `inherit`/`silence`. An empty list with `override` routes nowhere, which is the same outcome as `silence`."
+  ),
+  routing_label_key: z.string().min(1).max(64).nullable().optional().describe(
+    "Scan label key to route by on top of `inherit` or `override` (e.g. `dspName`): each scan also goes to the destinations whose label rule matches the scan's value for this key, as shown by `route_label_key` / `route_label_values` in `list_alert_destinations`. Omit or pass null for no label routing \u2014 the routing is replaced as a whole, so omitting it clears a key already set (read `get_campaign_alert_overrides` first to keep it). Not allowed with `silence`."
   )
 };
+function alertRoutingInputError(input) {
+  if (input.mode !== "override" && input.destination_ids.length > 0) {
+    return {
+      kind: "invalid-input",
+      message: `destination_ids is only accepted with mode "override", got "${input.mode}". Use mode "override" to route to specific destinations.`,
+      fieldErrors: { destination_ids: ["only valid with mode 'override'"] }
+    };
+  }
+  if (input.mode === "silence" && input.routing_label_key) {
+    return {
+      kind: "invalid-input",
+      message: 'routing_label_key cannot be combined with mode "silence". Use "inherit" or "override" to route by a label.',
+      fieldErrors: { routing_label_key: ["not valid with mode 'silence'"] }
+    };
+  }
+  return void 0;
+}
+
+// src/application/tools/alert-notifications/set-campaign-alert-overrides.tool.ts
+var SetCampaignAlertOverridesInputShape = {
+  campaign_id: z.string().uuid().describe("Campaign UUID."),
+  ...alertRoutingFields
+};
 var setCampaignAlertOverridesTool = {
   name: "set_campaign_alert_overrides",
-  description: "REPLACE the per-campaign alert-routing override. `mode=inherit` drops the override so the campaign follows the org-wide destinations; `mode=override` routes its alerts ONLY to `destination_ids`; `mode=silence` sends nothing for the campaign. There is no 'route everywhere except these' mode \u2014 to exclude one destination, pass `override` with the destinations you DO want (see `list_alert_destinations`). To read the new state, follow up with `get_campaign_alert_overrides`.",
+  description: "REPLACE the per-campaign alert-routing override. `mode=inherit` drops the override so the campaign follows the org-wide destinations; `mode=override` routes its alerts ONLY to `destination_ids`; `mode=silence` sends nothing for the campaign. `routing_label_key` adds label routing on top of inherit/override: each scan also reaches the destinations whose label rule matches its value (e.g. one DSP's chat in a shared campaign). There is no 'route everywhere except these' mode \u2014 to exclude one destination, pass `override` with the destinations you DO want (see `list_alert_destinations`). To read the new state, follow up with `get_campaign_alert_overrides`.",
   annotations: {
     title: "Set Campaign Alert Overrides",
     readOnlyHint: false,
@@ -3326,16 +3384,12 @@ var setCampaignAlertOverridesTool = {
   },
   inputSchema: z.object(SetCampaignAlertOverridesInputShape),
   handler: async (input, ctx) => {
-    if (input.mode !== "override" && input.destination_ids.length > 0) {
-      return err({
-        kind: "invalid-input",
-        message: `destination_ids is only accepted with mode "override", got "${input.mode}". Use mode "override" to route to specific destinations.`,
-        fieldErrors: { destination_ids: ["only valid with mode 'override'"] }
-      });
-    }
+    const invalid = alertRoutingInputError(input);
+    if (invalid) return err(invalid);
     const result = await ctx.api.setCampaignAlertOverrides(input.campaign_id, {
       mode: input.mode,
-      destination_ids: input.destination_ids
+      destination_ids: input.destination_ids,
+      routing_label_key: input.routing_label_key ?? null
     });
     if (result.isErr()) return err(mapApiError(result.error));
     return ok({ updated: true });
@@ -3903,6 +3957,13 @@ var cancelCampaignTool = {
     return ok(result.value);
   }
 };
+var AD_FORMATS_DESCRIPTION = "Which ad formats an ad-discovery run checks: any of `banner`, `video` and `pop` (`pop` covers pop-unders and tab-unders), each at most once. A format left out is neither captured nor billed \u2014 `['pop']` checks the page's pops without screenshotting or clicking a single banner. A tab-under the page forces on its own is still reported as a pop. Only valid on an ad-discovery target \u2014 `ad_discovery: true` on a scan, or `campaign_type: \"ad_discovery\"` on a campaign \u2014 and rejected with 422 anywhere else, as is an empty list.";
+var adFormat = z.enum(["banner", "video", "pop"]);
+var adFormats = z.array(adFormat).min(1).max(adFormat.options.length);
+var adFormatsField = adFormats.optional().describe(`${AD_FORMATS_DESCRIPTION} Omit it to check every format.`);
+var adFormatsUpdateField = adFormats.nullable().optional().describe(
+  `${AD_FORMATS_DESCRIPTION} Omitting the field leaves the campaign's current selection unchanged; pass null to go back to checking every format.`
+);
 var IGNORE_FIRST_N_DOMAINS_DESCRIPTION = "How many leading domains of the redirect chain to exclude from detection and tagging (0-5). Use it when the check enters through the caller's OWN click or tracking domains: without it a reputation hit on one of those tags the material and raises an alert about the caller's infrastructure rather than about the offer. Counting starts at the entry point and follows chain order; domains fold to their registrable form, so www.example.com and example.com consume one slot between them, and any other request to one of those domains is excluded too. A skipped domain is checked by NOTHING, so never set this higher than the number of domains the caller actually owns at the head of the chain \u2014 ask rather than guess. The full redirect chain is still captured and returned either way.";
 var ignoreFirstNDomains = z.number().int().min(0).max(5);
 var ignoreFirstNDomainsField = ignoreFirstNDomains.optional().describe(`${IGNORE_FIRST_N_DOMAINS_DESCRIPTION} Omit it to skip nothing (0).`);
@@ -3996,6 +4057,17 @@ function pickCampaignConfigBody(input) {
   if (input.schedule_timezone !== void 0) body.schedule_timezone = input.schedule_timezone;
   return body;
 }
+var notificationsBlock = z.object(alertRoutingFields);
+function notificationsBody(input) {
+  return {
+    mode: input.mode,
+    destination_ids: input.destination_ids,
+    routing_label_key: input.routing_label_key ?? null
+  };
+}
+var campaignNotificationsField = notificationsBlock.optional().describe(
+  "Alert routing saved together with the campaign: `mode`, `destination_ids`, `routing_label_key` \u2014 same meaning as in `set_campaign_alert_overrides`. The block REPLACES the whole routing: an omitted `destination_ids` means none and an omitted `routing_label_key` clears it. Omit the block to keep the current routing (update) or inherit the org defaults (create). Needs the alert_notifications.manage permission; the whole request is rejected before anything is written if the block is invalid."
+);
 var campaignReferrerUrl = z.string().url().regex(/^https?:\/\//i, "Must be an http(s) URL.").max(2048);
 var CAMPAIGN_REFERRER_DESCRIPTION = "Optional http(s) page URL every scan of this campaign is checked from. For `ad_tag` and `vast` campaigns this is the publisher page the tag is embedded in \u2014 NOT the creative and NOT its landing page; the browser commits the page document on this URL without fetching the publisher, so the creative renders as if embedded there, and its cross-origin subrequests receive the origin only (https://publisher.example/, no path). For `url` and `ad_discovery` campaigns this is where the visitor came from, sent in full as the Referer of the page request.";
 var campaignReferrerField = campaignReferrerUrl.optional().describe(CAMPAIGN_REFERRER_DESCRIPTION);
@@ -4017,6 +4089,7 @@ var CreateCampaignInputShape = {
   referrer: campaignReferrerField,
   ignore_first_n_domains: ignoreFirstNDomainsField,
   max_discovered_ads: maxDiscoveredAdsField,
+  ad_formats: adFormatsField,
   country_codes: z.array(z.string().length(2)).min(1).describe("ISO 3166-1 alpha-2 codes \u2014 one scan per country per run."),
   group_id: z.string().uuid().optional().describe("Parent group UUID; defaults to the org's default group."),
   ...campaignConfigFields,
@@ -4024,7 +4097,8 @@ var CreateCampaignInputShape = {
   policy_set_id: z.union([z.string().uuid(), z.null()]).optional().describe(
     "Policy set to evaluate every scan against. Omit to bind the organization's default (if any). Pass null for no policy set and no policy alerts."
   ),
-  schedule_enabled: z.boolean().optional().describe("If true, the scheduler runs immediately. Default: false (manual run).")
+  schedule_enabled: z.boolean().optional().describe("If true, the scheduler runs immediately. Default: false (manual run)."),
+  notifications: campaignNotificationsField
 };
 var createCampaignTool = {
   name: "create_campaign",
@@ -4038,6 +4112,8 @@ var createCampaignTool = {
   },
   inputSchema: z.object(CreateCampaignInputShape),
   handler: async (input, ctx) => {
+    const invalid = input.notifications && alertRoutingInputError(input.notifications);
+    if (invalid) return err(invalid);
     const body = {
       name: input.name,
       campaign_type: input.campaign_type,
@@ -4048,10 +4124,12 @@ var createCampaignTool = {
       ...input.referrer !== void 0 ? { referrer: input.referrer } : {},
       ...input.ignore_first_n_domains !== void 0 ? { ignore_first_n_domains: input.ignore_first_n_domains } : {},
       ...input.max_discovered_ads !== void 0 ? { max_discovered_ads: input.max_discovered_ads } : {},
+      ...input.ad_formats !== void 0 ? { ad_formats: input.ad_formats } : {},
       ...input.group_id !== void 0 ? { group_id: input.group_id } : {},
       ...input.labels !== void 0 ? { labels: input.labels } : {},
       ...input.policy_set_id !== void 0 ? { policy_set_id: input.policy_set_id } : {},
       ...input.schedule_enabled !== void 0 ? { schedule_enabled: input.schedule_enabled } : {},
+      ...input.notifications !== void 0 ? { notifications: notificationsBody(input.notifications) } : {},
       ...pickCampaignConfigBody(input)
     };
     const result = await ctx.api.createCampaign(body);
@@ -4223,16 +4301,18 @@ var UpdateCampaignInputShape = {
   referrer: campaignReferrerUpdateField,
   ignore_first_n_domains: ignoreFirstNDomainsUpdateField,
   max_discovered_ads: maxDiscoveredAdsUpdateField,
+  ad_formats: adFormatsUpdateField,
   country_codes: z.array(z.string().length(2)).optional().describe("Replace the country list."),
   group_id: z.string().uuid().optional().describe("Move the campaign to another group."),
   ...campaignConfigFields,
   labels: z.record(z.string()).optional().describe("Replace the label map."),
   policy_set_id: z.string().uuid().nullable().optional().describe("New policy set UUID; pass null to clear."),
-  schedule_enabled: z.boolean().optional().describe("Pause / resume the scheduler.")
+  schedule_enabled: z.boolean().optional().describe("Pause / resume the scheduler."),
+  notifications: campaignNotificationsField
 };
 var updateCampaignTool = {
   name: "update_campaign",
-  description: "Update one or more fields of a campaign. Fields not supplied are left unchanged. `policy_set_id` accepts null to clear the binding, `referrer` accepts null to clear the publisher page scans are checked from, and `max_discovered_ads` accepts null to go back to the platform ad cap. `ignore_first_n_domains` is the exception: it is not nullable, so pass 0 to go back to skipping nothing.",
+  description: "Update one or more fields of a campaign. Fields not supplied are left unchanged. `policy_set_id` accepts null to clear the binding, `referrer` accepts null to clear the publisher page scans are checked from, `max_discovered_ads` accepts null to go back to the platform ad cap, and `ad_formats` accepts null to go back to checking every ad format. `ignore_first_n_domains` is the exception: it is not nullable, so pass 0 to go back to skipping nothing. `notifications` is not merged either: when supplied it replaces the campaign's whole alert routing.",
   annotations: {
     title: "Update Campaign",
     readOnlyHint: false,
@@ -4242,6 +4322,8 @@ var updateCampaignTool = {
   },
   inputSchema: z.object(UpdateCampaignInputShape),
   handler: async (input, ctx) => {
+    const invalid = input.notifications && alertRoutingInputError(input.notifications);
+    if (invalid) return err(invalid);
     const body = {
       ...input.name !== void 0 ? { name: input.name } : {},
       ...input.url !== void 0 ? { url: input.url } : {},
@@ -4250,11 +4332,13 @@ var updateCampaignTool = {
       ...input.referrer !== void 0 ? { referrer: input.referrer } : {},
       ...input.ignore_first_n_domains !== void 0 ? { ignore_first_n_domains: input.ignore_first_n_domains } : {},
       ...input.max_discovered_ads !== void 0 ? { max_discovered_ads: input.max_discovered_ads } : {},
+      ...input.ad_formats !== void 0 ? { ad_formats: input.ad_formats } : {},
       ...input.country_codes !== void 0 ? { country_codes: input.country_codes } : {},
       ...input.group_id !== void 0 ? { group_id: input.group_id } : {},
       ...input.labels !== void 0 ? { labels: input.labels } : {},
       ...input.policy_set_id !== void 0 ? { policy_set_id: input.policy_set_id } : {},
       ...input.schedule_enabled !== void 0 ? { schedule_enabled: input.schedule_enabled } : {},
+      ...input.notifications !== void 0 ? { notifications: notificationsBody(input.notifications) } : {},
       ...pickCampaignConfigBody(input)
     };
     const result = await ctx.api.updateCampaign(input.campaign_id, body);
@@ -5382,9 +5466,10 @@ var CreateScanInputShape = {
   campaign_id: z.string().uuid().optional().describe("Optional campaign UUID to attribute the scan to."),
   run_id: z.string().uuid().optional().describe("Optional run UUID inside the campaign."),
   ad_discovery: z.boolean().optional().describe(
-    "Publisher ad discovery: detect ad blocks on the page and spawn one child scan per detected ad (banner/pop). Only valid with `url`. Each child is a separate billed scan; list them with `list_scan_children`."
+    "Publisher ad discovery: detect ad blocks on the page and spawn one child scan per detected ad (banner/video/pop). Only valid with `url`. Each child is a separate billed scan; list them with `list_scan_children`."
   ),
   max_discovered_ads: maxDiscoveredAdsField,
+  ad_formats: adFormatsField,
   ...repeatRetryFields
 };
 var createScanTool = {
@@ -5413,6 +5498,7 @@ var createScanTool = {
       ...input.run_id !== void 0 ? { run_id: input.run_id } : {},
       ...input.ad_discovery !== void 0 ? { ad_discovery: input.ad_discovery } : {},
       ...input.max_discovered_ads !== void 0 ? { max_discovered_ads: input.max_discovered_ads } : {},
+      ...input.ad_formats !== void 0 ? { ad_formats: input.ad_formats } : {},
       ...pickRepeatRetryBody(input)
     };
     const result = await ctx.api.createScan(body);
@@ -6301,5 +6387,5 @@ function formatToolError(error) {
 }
 
 export { BearerToken, SERVER_INSTRUCTIONS, createHttpApiGateway, createPinoLogger, declareEmptyResourcesAndPrompts, newRequestId, wireToolsIntoMcpServer };
-//# sourceMappingURL=chunk-VEPJEI3S.js.map
-//# sourceMappingURL=chunk-VEPJEI3S.js.map
+//# sourceMappingURL=chunk-VLIIUTPH.js.map
+//# sourceMappingURL=chunk-VLIIUTPH.js.map