@chrischall/eventbrite-mcp 0.0.0

package/dist/tools/account.js

@@ -0,0 +1,170 @@
+import { z } from 'zod';
+import { textResult } from '@chrischall/mcp-utils';
+import { enc, qs, schemaContinuation } from './params.js';
+/**
+ * Account-side tools on the documented API (`eventbriteapi.com/v3`, bearer
+ * token). Transport-neutral: the hosted connector registers these with a
+ * per-user client.
+ */
+export function registerAccountTools(server, deps) {
+    const { client } = deps;
+    server.registerTool('eb_me', {
+        description: "Get the authenticated Eventbrite user's profile (id, name, primary email).",
+        annotations: { readOnlyHint: true },
+    }, async () => {
+        const data = await client.request('GET', '/users/me/');
+        return textResult(data);
+    });
+    server.registerTool('eb_my_orders', {
+        description: "List the authenticated user's ticket orders (attendee side), with the event expanded. time_filter narrows to upcoming or past events.",
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            time_filter: z
+                .enum(['all', 'current_future', 'past'])
+                .optional()
+                .describe('Filter orders by event time (default all)'),
+            continuation: schemaContinuation,
+        },
+    }, async ({ time_filter, continuation }) => {
+        const params = new URLSearchParams({ expand: 'event' });
+        if (time_filter)
+            params.set('time_filter', time_filter);
+        if (continuation)
+            params.set('continuation', continuation);
+        const data = await client.request('GET', `/users/me/orders/?${params}`);
+        return textResult(data);
+    });
+    server.registerTool('eb_my_organizations', {
+        description: 'List the organizations the authenticated user belongs to (organizer side). Use the returned org id with eb_org_events / eb_org_attendees / eb_org_orders.',
+        annotations: { readOnlyHint: true },
+        inputSchema: { continuation: schemaContinuation },
+    }, async ({ continuation }) => {
+        const params = new URLSearchParams();
+        if (continuation)
+            params.set('continuation', continuation);
+        const data = await client.request('GET', `/users/me/organizations/${qs(params)}`);
+        return textResult(data);
+    });
+    server.registerTool('eb_org_events', {
+        description: "List an organization's events (as organizer), optionally filtered by status.",
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            org_id: z.string().describe('Organization id (from eb_my_organizations)'),
+            status: z
+                .enum(['all', 'live', 'draft', 'started', 'ended', 'completed', 'canceled'])
+                .optional()
+                .describe('Event status filter (default all)'),
+            order_by: z
+                .enum(['start_asc', 'start_desc', 'created_asc', 'created_desc'])
+                .optional(),
+            continuation: schemaContinuation,
+        },
+    }, async ({ org_id, status, order_by, continuation }) => {
+        const params = new URLSearchParams();
+        if (status)
+            params.set('status', status);
+        if (order_by)
+            params.set('order_by', order_by);
+        if (continuation)
+            params.set('continuation', continuation);
+        const data = await client.request('GET', `/organizations/${enc(org_id)}/events/${qs(params)}`);
+        return textResult(data);
+    });
+    server.registerTool('eb_org_attendees', {
+        description: "List attendees across an organization's events (organizer side).",
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            org_id: z.string().describe('Organization id (from eb_my_organizations)'),
+            status: z
+                .enum(['attending', 'not_attending', 'unpaid'])
+                .optional()
+                .describe('Attendee status filter'),
+            continuation: schemaContinuation,
+        },
+    }, async ({ org_id, status, continuation }) => {
+        const params = new URLSearchParams();
+        if (status)
+            params.set('status', status);
+        if (continuation)
+            params.set('continuation', continuation);
+        const data = await client.request('GET', `/organizations/${enc(org_id)}/attendees/${qs(params)}`);
+        return textResult(data);
+    });
+    server.registerTool('eb_org_orders', {
+        description: "List orders across an organization's events (organizer side).",
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            org_id: z.string().describe('Organization id (from eb_my_organizations)'),
+            continuation: schemaContinuation,
+        },
+    }, async ({ org_id, continuation }) => {
+        const params = new URLSearchParams();
+        if (continuation)
+            params.set('continuation', continuation);
+        const data = await client.request('GET', `/organizations/${enc(org_id)}/orders/${qs(params)}`);
+        return textResult(data);
+    });
+    // Simple org-scoped collections: same shape, same pagination, different noun.
+    const orgCollections = [
+        ['eb_org_venues', 'venues', "List an organization's saved venues (name, address, geo)."],
+        [
+            'eb_org_discounts',
+            'discounts',
+            "List an organization's discount and access codes, including their usage limits.",
+        ],
+        [
+            'eb_org_ticket_groups',
+            'ticket_groups',
+            "List an organization's ticket groups (ticket classes bundled across events).",
+        ],
+        [
+            'eb_org_webhooks',
+            'webhooks',
+            "List an organization's registered webhooks and the actions they subscribe to.",
+        ],
+    ];
+    for (const [name, noun, description] of orgCollections) {
+        server.registerTool(name, {
+            description,
+            annotations: { readOnlyHint: true },
+            inputSchema: {
+                org_id: z.string().describe('Organization id (from eb_my_organizations)'),
+                continuation: schemaContinuation,
+            },
+        }, async ({ org_id, continuation }) => {
+            const params = new URLSearchParams();
+            if (continuation)
+                params.set('continuation', continuation);
+            return textResult(await client.request('GET', `/organizations/${enc(org_id)}/${noun}/${qs(params)}`));
+        });
+    }
+    server.registerTool('eb_org_report', {
+        description: "Run an organization's sales or attendees report — the aggregated analytics behind its events, optionally windowed by date.",
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            org_id: z.string().describe('Organization id (from eb_my_organizations)'),
+            kind: z.enum(['sales', 'attendees']).describe('Which report to run'),
+            start_date: z.string().optional().describe('ISO date lower bound (YYYY-MM-DD)'),
+            end_date: z.string().optional().describe('ISO date upper bound (YYYY-MM-DD)'),
+            event_status: z.enum(['live', 'started', 'ended', 'completed', 'canceled']).optional(),
+            group_by: z
+                .string()
+                .optional()
+                .describe("Grouping dimension, e.g. 'event', 'day', 'ticket_class'"),
+            continuation: schemaContinuation,
+        },
+    }, async ({ org_id, kind, start_date, end_date, event_status, group_by, continuation }) => {
+        const params = new URLSearchParams();
+        if (start_date)
+            params.set('start_date', start_date);
+        if (end_date)
+            params.set('end_date', end_date);
+        if (event_status)
+            params.set('event_status', event_status);
+        if (group_by)
+            params.set('group_by', group_by);
+        if (continuation)
+            params.set('continuation', continuation);
+        return textResult(await client.request('GET', `/organizations/${enc(org_id)}/reports/${kind}/${qs(params)}`));
+    });
+}

package/dist/tools/discovery.js

@@ -0,0 +1,126 @@
+import { z } from 'zod';
+import { textResult } from '@chrischall/mcp-utils';
+import { toCompactEvent } from '../discovery.js';
+/**
+ * Public event discovery. Verified live 2026-07-30: the documented host serves
+ * the consumer search at POST /destination/search/ with a plain bearer token —
+ * no WAF, no CSRF, no cookies — so these tools no longer require a browser and
+ * ARE registered by the hosted connector. The fetchproxy bridge remains a
+ * fallback on the stdio path.
+ */
+export async function registerDiscoveryTools(server, deps) {
+    const { discovery, transport } = deps;
+    server.registerTool('eb_resolve_place', {
+        description: "Resolve a location to Eventbrite's internal place id for eb_search_events. Accepts a plain location ('Charlotte, NC', 'Berlin, Germany') or a browse slug ('nc--charlotte'). A city on its own is rejected — include the state or country. Returns {placeId, name, slug, region, country} plus `shelves` — curated browse shelves (Popular, This Weekend, Online) harvested free from the same fetch.",
+        annotations: { readOnlyHint: true, openWorldHint: true },
+        inputSchema: {
+            location: z
+                .string()
+                .min(2)
+                .describe("Location, e.g. 'Charlotte, NC', 'Berlin, Germany', or the slug 'nc--charlotte'"),
+        },
+    }, async ({ location }) => {
+        const place = await discovery.resolveLocation(location);
+        return textResult(place);
+    });
+    server.registerTool('eb_search_events', {
+        description: 'Search public Eventbrite events (the consumer search absent from the documented API). Resolve the location to a place id first with eb_resolve_place. Filters: keyword, dates, category/subcategory/format ids (see eb_reference), free/paid, online-only. Set compact=true for slim results suited to browsing/ranking.',
+        annotations: { readOnlyHint: true, openWorldHint: true },
+        inputSchema: {
+            q: z.string().optional().describe('Keyword query'),
+            place_id: z
+                .string()
+                .optional()
+                .describe('Eventbrite place id from eb_resolve_place (e.g. 85981333 = Charlotte NC)'),
+            date_keyword: z
+                .enum(['today', 'tomorrow', 'this_weekend', 'this_week', 'next_week', 'this_month'])
+                .optional()
+                .describe('Relative date filter'),
+            date_range_from: z.string().optional().describe('ISO date lower bound (YYYY-MM-DD)'),
+            date_range_to: z.string().optional().describe('ISO date upper bound (YYYY-MM-DD)'),
+            category_id: z.string().optional().describe('Category id (eb_reference categories)'),
+            subcategory_id: z.string().optional().describe('Subcategory id'),
+            format_id: z.string().optional().describe('Format id'),
+            price: z.enum(['free', 'paid']).optional(),
+            online_events_only: z.boolean().optional(),
+            page: z.number().int().positive().optional().describe('Page number (default 1)'),
+            page_size: z.number().int().positive().max(50).optional().describe('Results per page (default 20)'),
+            aggs: z
+                .array(z.enum(['places_borough', 'places_neighborhood']))
+                .optional()
+                .describe('Facet buckets to aggregate alongside results'),
+            compact: z
+                .boolean()
+                .optional()
+                .describe('Return slim event summaries instead of full records (default false)'),
+        },
+    }, async (args) => {
+        const data = await discovery.search({
+            q: args.q,
+            placeId: args.place_id,
+            dateKeyword: args.date_keyword,
+            dateRangeFrom: args.date_range_from,
+            dateRangeTo: args.date_range_to,
+            categoryId: args.category_id,
+            subcategoryId: args.subcategory_id,
+            formatId: args.format_id,
+            price: args.price,
+            onlineEventsOnly: args.online_events_only,
+            page: args.page,
+            pageSize: args.page_size,
+            aggs: args.aggs,
+        });
+        if (args.compact) {
+            const results = data.events?.results;
+            // Drift fallback: if the envelope isn't the shape we know, return the
+            // raw response rather than an empty/wrong projection.
+            if (!Array.isArray(results)) {
+                console.error('[eventbrite-mcp] destination search response missing events.results — returning raw response');
+                return textResult(data);
+            }
+            return textResult({
+                pagination: data.events?.pagination,
+                results: results.map(toCompactEvent),
+            });
+        }
+        return textResult(data);
+    });
+    server.registerTool('eb_event_details', {
+        description: "Batch-fetch public event details by id. Uses your bearer token by default, falling back to the browser bridge when no token is configured. For ticket-class detail prefer eb_ticket_classes.",
+        annotations: { readOnlyHint: true, openWorldHint: true },
+        inputSchema: {
+            event_ids: z.array(z.string()).min(1).max(20).describe('Numeric event ids'),
+            expand: z
+                .string()
+                .optional()
+                .describe('Comma-separated expansions (default primary_venue,image,ticket_availability,event_sales_status,primary_organizer)'),
+        },
+    }, async ({ event_ids, expand }) => {
+        const data = await discovery.eventsByIds(event_ids, expand ? expand.split(',').map((s) => s.trim()) : undefined);
+        return textResult(data);
+    });
+    // eb_healthcheck diagnoses the BRIDGE. With no bridge (the Worker connector)
+    // there is nothing for it to report on, so it is not registered at all —
+    // better than a tool that always answers "no transport".
+    if (!transport)
+        return;
+    // Imported lazily, AFTER the guard: a static import would drag the fetchproxy
+    // helper into the Worker bundle where it can never run.
+    const { registerBridgeHealthcheckTool } = await import('@chrischall/mcp-utils/fetchproxy');
+    // The categories endpoint answers 200 JSON on the www host regardless of
+    // login state, so it isolates bridge problems from Eventbrite-side problems.
+    registerBridgeHealthcheckTool({
+        server,
+        prefix: 'eb',
+        hostLabel: 'www.eventbrite.com',
+        probePath: '/api/v3/categories/',
+        transport,
+        probeFn: async (path) => {
+            const result = await transport.fetch({ path, method: 'GET' });
+            if (result.status !== 200) {
+                throw new Error(`probe returned HTTP ${result.status}`);
+            }
+            return typeof result.body === 'string' ? result.body : '';
+        },
+    });
+}

package/dist/tools/events.js

@@ -0,0 +1,131 @@
+import { z } from 'zod';
+import { textResult } from '@chrischall/mcp-utils';
+import { enc, qs, schemaContinuation } from './params.js';
+/** Reference lists served under /system/ rather than the API root. */
+const SYSTEM_LISTS = new Set(['timezones', 'countries', 'regions']);
+/**
+ * Event lookup + reference-data tools on the documented API. `eb_event` works
+ * for ANY public event by id (not just your own) — event ids are the trailing
+ * digits of an event URL (`…-tickets-<id>`).
+ */
+export function registerEventTools(server, deps) {
+    const { client } = deps;
+    server.registerTool('eb_event', {
+        description: 'Get an Eventbrite event by id (works for any public event, not just yours). Event ids are the trailing digits in an event URL (…-tickets-<id>).',
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            event_id: z.string().describe('Numeric event id'),
+            expand: z
+                .string()
+                .optional()
+                .describe('Comma-separated expansions (default venue,organizer,ticket_availability)'),
+        },
+    }, async ({ event_id, expand }) => {
+        const exp = expand ?? 'venue,organizer,ticket_availability';
+        const data = await client.request('GET', `/events/${encodeURIComponent(event_id)}/?expand=${encodeURIComponent(exp)}`);
+        return textResult(data);
+    });
+    server.registerTool('eb_ticket_classes', {
+        description: "List an event's ticket classes (name, cost, free/paid, on-sale status).",
+        annotations: { readOnlyHint: true },
+        inputSchema: { event_id: z.string().describe('Numeric event id') },
+    }, async ({ event_id }) => {
+        const data = await client.request('GET', `/events/${encodeURIComponent(event_id)}/ticket_classes/`);
+        return textResult(data);
+    });
+    server.registerTool('eb_event_description', {
+        description: "Get an event's full HTML description.",
+        annotations: { readOnlyHint: true },
+        inputSchema: { event_id: z.string().describe('Numeric event id') },
+    }, async ({ event_id }) => {
+        const data = await client.request('GET', `/events/${encodeURIComponent(event_id)}/description/`);
+        return textResult(data);
+    });
+    server.registerTool('eb_reference', {
+        description: 'List Eventbrite reference data: categories (103=Music, 101=Business, 110=Food & Drink, …), subcategories, formats, timezones, countries or regions. Category/subcategory/format ids feed eb_search_events filters.',
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            kind: z
+                .enum(['categories', 'subcategories', 'formats', 'timezones', 'countries', 'regions'])
+                .describe('Which list to fetch'),
+        },
+    }, async ({ kind }) => {
+        // timezones/countries/regions hang off /system/; the bare /countries/ and
+        // /regions/ paths 404 (verified live 2026-07-30). The taxonomy lists
+        // (categories, subcategories, formats) sit at the root.
+        const path = SYSTEM_LISTS.has(kind) ? `/system/${kind}/` : `/${kind}/`;
+        const data = await client.request('GET', path);
+        return textResult(data);
+    });
+    server.registerTool('eb_event_attendees', {
+        description: "List a single event's attendees (organizer-side; requires access to that event). Use changed_since to poll incrementally instead of re-reading the whole list.",
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            event_id: z.string().describe('Numeric event id'),
+            status: z.enum(['attending', 'not_attending', 'unpaid']).optional(),
+            changed_since: z
+                .string()
+                .optional()
+                .describe('ISO 8601 UTC timestamp — only attendees changed since then'),
+            continuation: schemaContinuation,
+        },
+    }, async ({ event_id, status, changed_since, continuation }) => {
+        const params = new URLSearchParams();
+        if (status)
+            params.set('status', status);
+        if (changed_since)
+            params.set('changed_since', changed_since);
+        if (continuation)
+            params.set('continuation', continuation);
+        return textResult(await client.request('GET', `/events/${enc(event_id)}/attendees/${qs(params)}`));
+    });
+    server.registerTool('eb_event_attendee', {
+        description: "Get one attendee of an event by id (barcode, profile answers, check-in state).",
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            event_id: z.string().describe('Numeric event id'),
+            attendee_id: z.string().describe('Numeric attendee id'),
+        },
+    }, async ({ event_id, attendee_id }) => textResult(await client.request('GET', `/events/${enc(event_id)}/attendees/${enc(attendee_id)}/`)));
+    server.registerTool('eb_event_orders', {
+        description: "List a single event's orders (organizer-side; requires access to that event).",
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            event_id: z.string().describe('Numeric event id'),
+            status: z.enum(['all', 'placed', 'refunded']).optional(),
+            changed_since: z
+                .string()
+                .optional()
+                .describe('ISO 8601 UTC timestamp — only orders changed since then'),
+            continuation: schemaContinuation,
+        },
+    }, async ({ event_id, status, changed_since, continuation }) => {
+        const params = new URLSearchParams();
+        if (status)
+            params.set('status', status);
+        if (changed_since)
+            params.set('changed_since', changed_since);
+        if (continuation)
+            params.set('continuation', continuation);
+        return textResult(await client.request('GET', `/events/${enc(event_id)}/orders/${qs(params)}`));
+    });
+    server.registerTool('eb_ticket_class', {
+        description: 'Get one ticket class of an event by id. Use eb_ticket_classes to list them first.',
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            event_id: z.string().describe('Numeric event id'),
+            ticket_class_id: z.string().describe('Numeric ticket class id'),
+        },
+    }, async ({ event_id, ticket_class_id }) => textResult(await client.request('GET', `/events/${enc(event_id)}/ticket_classes/${enc(ticket_class_id)}/`)));
+    server.registerTool('eb_event_questions', {
+        description: "List the registration questions an event asks its buyers. Set canned=true for Eventbrite's standard question bank instead of the event's custom ones.",
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            event_id: z.string().describe('Numeric event id'),
+            canned: z
+                .boolean()
+                .optional()
+                .describe("Fetch the standard question bank instead of the event's custom questions"),
+        },
+    }, async ({ event_id, canned }) => textResult(await client.request('GET', `/events/${enc(event_id)}/${canned ? 'canned_questions' : 'questions'}/`)));
+}

package/dist/tools/lookup.js

@@ -0,0 +1,96 @@
+import { z } from 'zod';
+import { textResult } from '@chrischall/mcp-utils';
+import { enc, qs, schemaContinuation, schemaEventStatus } from './params.js';
+/**
+ * Single-object lookups on the documented API: resolve an id that appears
+ * inside another response (an order on a ticket, the venue/organizer/series a
+ * search result points at) into the full record.
+ *
+ * All read-only. Every id is percent-encoded — ids arrive from model output and
+ * must not be able to traverse out of their path segment.
+ */
+export function registerLookupTools(server, deps) {
+    const { client } = deps;
+    server.registerTool('eb_order', {
+        description: 'Get a single order by id (the buyer-side record behind a ticket). Order ids appear in eb_my_orders / eb_event_orders results.',
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            order_id: z.string().describe('Numeric order id'),
+            expand: z
+                .string()
+                .optional()
+                .describe("Comma-separated expansions, e.g. 'attendees,event'"),
+        },
+    }, async ({ order_id, expand }) => {
+        const params = new URLSearchParams();
+        if (expand)
+            params.set('expand', expand);
+        return textResult(await client.request('GET', `/orders/${enc(order_id)}/${qs(params)}`));
+    });
+    server.registerTool('eb_venue', {
+        description: 'Get a venue by id (name, address, geo). Venue ids appear on expanded events and in eb_org_venues.',
+        annotations: { readOnlyHint: true },
+        inputSchema: { venue_id: z.string().describe('Numeric venue id') },
+    }, async ({ venue_id }) => textResult(await client.request('GET', `/venues/${enc(venue_id)}/`)));
+    server.registerTool('eb_venue_events', {
+        description: 'List the events held at a venue.',
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            venue_id: z.string().describe('Numeric venue id'),
+            status: schemaEventStatus,
+            continuation: schemaContinuation,
+        },
+    }, async ({ venue_id, status, continuation }) => {
+        const params = new URLSearchParams();
+        if (status)
+            params.set('status', status);
+        if (continuation)
+            params.set('continuation', continuation);
+        return textResult(await client.request('GET', `/venues/${enc(venue_id)}/events/${qs(params)}`));
+    });
+    server.registerTool('eb_organizer', {
+        description: "Get an organizer's public profile by id (name, description, logo, social links).",
+        annotations: { readOnlyHint: true },
+        inputSchema: { organizer_id: z.string().describe('Numeric organizer id') },
+    }, async ({ organizer_id }) => textResult(await client.request('GET', `/organizers/${enc(organizer_id)}/`)));
+    server.registerTool('eb_organizer_events', {
+        description: "List an organizer's events — the public way to see everything one organizer is running.",
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            organizer_id: z.string().describe('Numeric organizer id'),
+            status: schemaEventStatus,
+            order_by: z.enum(['start_asc', 'start_desc', 'created_asc', 'created_desc']).optional(),
+            continuation: schemaContinuation,
+        },
+    }, async ({ organizer_id, status, order_by, continuation }) => {
+        const params = new URLSearchParams();
+        if (status)
+            params.set('status', status);
+        if (order_by)
+            params.set('order_by', order_by);
+        if (continuation)
+            params.set('continuation', continuation);
+        return textResult(await client.request('GET', `/organizers/${enc(organizer_id)}/events/${qs(params)}`));
+    });
+    server.registerTool('eb_series_events', {
+        description: 'List the occurrences of a recurring event series. Search results and events carry a series_id when they belong to one.',
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            series_id: z.string().describe('Numeric series id (from an event/search result)'),
+            status: schemaEventStatus,
+            continuation: schemaContinuation,
+        },
+    }, async ({ series_id, status, continuation }) => {
+        const params = new URLSearchParams();
+        if (status)
+            params.set('status', status);
+        if (continuation)
+            params.set('continuation', continuation);
+        return textResult(await client.request('GET', `/series/${enc(series_id)}/events/${qs(params)}`));
+    });
+    server.registerTool('eb_user', {
+        description: "Get a public user profile by id. Use eb_me for the authenticated user (that call also returns private fields like emails).",
+        annotations: { readOnlyHint: true },
+        inputSchema: { user_id: z.string().describe('Numeric user id') },
+    }, async ({ user_id }) => textResult(await client.request('GET', `/users/${enc(user_id)}/`)));
+}

package/dist/tools/params.js

@@ -0,0 +1,39 @@
+import { z } from 'zod';
+import { McpToolError } from '@chrischall/mcp-utils';
+/**
+ * Shared request-building helpers for the documented-API tool modules.
+ * Keeping these in one place means every tool paginates, filters and encodes
+ * ids the same way.
+ */
+export const schemaContinuation = z
+    .string()
+    .optional()
+    .describe('Pagination continuation token from a previous response');
+export const schemaEventStatus = z
+    .enum(['all', 'live', 'draft', 'started', 'ended', 'completed', 'canceled'])
+    .optional()
+    .describe('Event status filter (default all)');
+/**
+ * Render a query string, or '' when nothing is set. Eventbrite 301s on a bare
+ * trailing '?', which would silently drop the Authorization header on the
+ * redirect — so never emit one.
+ */
+export function qs(params) {
+    return params.size > 0 ? `?${params}` : '';
+}
+/**
+ * Percent-encode a path segment, rejecting ids that would traverse.
+ *
+ * `encodeURIComponent` alone is NOT sufficient: `.` is an unreserved character,
+ * so `encodeURIComponent('..') === '..'` and `/orders/../` climbs a segment
+ * before the request is ever sent. Slashes do encode, so only dot-only ids are
+ * dangerous — reject those outright rather than trying to sanitise them.
+ */
+export function enc(id) {
+    if (/^\.+$/.test(id)) {
+        throw new McpToolError(`Invalid id '${id}'.`, {
+            hint: 'Ids must be Eventbrite object ids (normally digits), not path segments.',
+        });
+    }
+    return encodeURIComponent(id);
+}

package/dist/transport-fetchproxy.js

@@ -0,0 +1,57 @@
+// EventbriteTransport backed by the shared fetchproxy factory: every request
+// runs as a same-origin fetch inside the user's signed-in eventbrite.com tab
+// (Transporter extension), which is what clears the WAF that blocks any
+// server-side client. The `csrftoken` cookie scope is declared up front so the
+// ONE pairing approval covers both fetch and the cookie read — fpx 1.4.0
+// cannot widen scope after the first pair (see the fleet skill's gotcha).
+import { createBootstrapOpts, createFetchproxyTransport, } from '@chrischall/mcp-utils/fetchproxy';
+// Re-export typed errors so callers importing from this module keep working.
+export { FetchproxyBridgeDownError, FetchproxyTimeoutError, } from '@chrischall/mcp-utils/fetchproxy';
+const DEFAULT_PORT = 37_149; // fleet-wide concentrator port — do NOT change
+export class FetchproxyTransport {
+    inner;
+    constructor(opts) {
+        const port = opts.port ?? DEFAULT_PORT;
+        this.inner = createFetchproxyTransport({
+            port,
+            serverName: opts.server ?? 'eventbrite-mcp',
+            version: opts.version,
+            // Declares domains + the csrftoken cookie scope, and derives the
+            // `read_cookies` capability so the pair prompt covers it from day one.
+            ...createBootstrapOpts({
+                domains: ['eventbrite.com'],
+                bootstrap: { cookieKeys: ['csrftoken'] },
+            }),
+            // Every eventbrite.com request targets www unless a caller overrides.
+            defaultSubdomain: 'www',
+            logListening: true,
+            debugEnvVar: 'EVENTBRITE_DEBUG',
+            ...(opts.fetchTimeoutMs !== undefined ? { fetchTimeoutMs: opts.fetchTimeoutMs } : {}),
+            ...(opts.bridgeReviveDelayMs !== undefined
+                ? { bridgeReviveDelayMs: opts.bridgeReviveDelayMs }
+                : {}),
+            ...(opts.createServer ? { createServer: opts.createServer } : {}),
+        });
+    }
+    start() {
+        return this.inner.start();
+    }
+    close() {
+        return this.inner.close();
+    }
+    status() {
+        return this.inner.status();
+    }
+    fetch(init) {
+        return this.inner.fetch(init);
+    }
+    requestJson(method, path, init) {
+        return this.inner.requestJson(method, path, init);
+    }
+    async readCookies(keys) {
+        return this.inner.server.readCookies({ domain: 'eventbrite.com', subdomain: 'www', keys });
+    }
+    runProbe(fetchFn, probePath) {
+        return this.inner.runProbe(fetchFn, probePath);
+    }
+}

package/dist/transport.js

@@ -0,0 +1,5 @@
+// Transport contract for the WAF-walled consumer surface
+// (`www.eventbrite.com/api/v3/destination/…` and the SSR `/d/…` pages).
+// The production implementation is `transport-fetchproxy.ts` (requests ride
+// the user's signed-in browser tab); tests inject a mock.
+export {};

package/dist/version.js

@@ -0,0 +1 @@
+export const VERSION = '0.0.0'; // x-release-please-version