setlist-mcp 0.5.0 → 0.6.0

package/dist/fetchproxy-cookie.js

@@ -0,0 +1,52 @@
+import { readEnvVar } from '@chrischall/mcp-utils';
+import { VERSION } from './version.js';
+// The cookies that authenticate a www.setlist.fm session: JSESSIONID is the
+// (HttpOnly) Wicket session, RememberMeCookie re-establishes login, aws-waf-token
+// clears the WAF. read_cookies uses chrome.cookies.get, which DOES see HttpOnly
+// cookies (page JS cannot), so the bridge can lift JSESSIONID.
+const SESSION_COOKIE_KEYS = ['JSESSIONID', 'RememberMeCookie', 'aws-waf-token'];
+// Bound the bridge round-trip so a wedged/absent extension fails fast instead of
+// hanging the tool call.
+const BOOTSTRAP_TIMEOUT_MS = 15_000;
+function fetchproxyDisabled() {
+    const raw = readEnvVar('SETLIST_DISABLE_FETCHPROXY');
+    return raw !== undefined && ['1', 'true', 'yes', 'on'].includes(raw.toLowerCase());
+}
+function withTimeout(p, ms) {
+    return Promise.race([
+        p,
+        new Promise((_, reject) => setTimeout(() => reject(new Error('fetchproxy: timed out waiting for the browser bridge. Is the Transporter extension running and signed into setlist.fm in that browser?')), ms).unref?.()),
+    ]);
+}
+/**
+ * One-shot fetchproxy bootstrap: lift the logged-in setlist.fm session cookies
+ * out of the signed-in browser tab (via the Transporter extension), assemble a
+ * `Cookie` header, and return it — fetchproxy is NOT in the hot path afterward.
+ * Used only when `SETLIST_SESSION_COOKIE` is unset.
+ *
+ * Returns `null` when the fallback is disabled; throws an actionable error if the
+ * bridge is unreachable or no session cookie is present.
+ */
+export async function grabSessionCookie() {
+    if (fetchproxyDisabled())
+        return null;
+    let bootstrap;
+    try {
+        ({ bootstrap } = await import('@fetchproxy/bootstrap'));
+    }
+    catch {
+        return null; // bridge package unavailable (shouldn't happen — bundled)
+    }
+    const session = await withTimeout(bootstrap({
+        serverName: 'setlist-mcp',
+        version: VERSION,
+        domains: ['www.setlist.fm'],
+        declare: { cookies: SESSION_COOKIE_KEYS, localStorage: [], sessionStorage: [], captureHeaders: [] },
+    }), BOOTSTRAP_TIMEOUT_MS);
+    const cookies = session.cookies ?? {};
+    const header = SESSION_COOKIE_KEYS.filter((k) => cookies[k]).map((k) => `${k}=${cookies[k]}`).join('; ');
+    if (!cookies.JSESSIONID && !cookies.RememberMeCookie) {
+        throw new Error('fetchproxy: no setlist.fm session cookie found — sign in at https://www.setlist.fm in the browser running the Transporter extension, then retry.');
+    }
+    return header;
+}

package/dist/index.js

@@ -7,6 +7,7 @@ import { registerVenueTools } from './tools/venues.js';
 import { registerGeoTools } from './tools/geo.js';
 import { registerUserTools } from './tools/users.js';
 import { registerResolveTools } from './tools/resolve.js';
+import { registerAttendanceTools } from './tools/attendance.js';
 import { registerUtilityTools } from './tools/utilities.js';
 // The setlist.fm client is a module-level singleton (imported by each tool
 // module) that defers its config error to the first request. That preserves the
@@ -24,6 +25,7 @@ await runMcp({
         registerGeoTools,
         registerUserTools,
         registerResolveTools,
+        registerAttendanceTools,
         registerUtilityTools,
     ],
 });

package/dist/tools/attendance.js

@@ -0,0 +1,100 @@
+import { z } from 'zod';
+import { textResult } from '@chrischall/mcp-utils';
+import { client } from '../client.js';
+import { webClient } from '../web-client.js';
+import { ATTRIBUTION_NOTE } from '../attribution.js';
+function decodeEntities(s) {
+    return s
+        .replace(/&/g, '&')
+        .replace(/&#x([0-9a-f]+);/gi, (_, h) => String.fromCharCode(parseInt(h, 16)))
+        .replace(/&#(\d+);/g, (_, d) => String.fromCharCode(Number(d)));
+}
+/**
+ * Locate the attendance toggle in a logged-in setlist page and read its state.
+ * The control is a Wicket `wicketAjaxGet(...)` anchor whose title is
+ * "Add this setlist to your attended shows." (not attended) or
+ * "Remove this setlist from your attended shows." (attended).
+ */
+export function parseAttendance(html) {
+    for (const seg of html.split(/<a\b/i).slice(1)) {
+        const a = '<a ' + seg.slice(0, 800);
+        if (!/wicketAjaxGet/.test(a))
+            continue;
+        const title = (a.match(/title="([^"]*attended shows[^"]*)"/i) || [])[1];
+        if (!title)
+            continue;
+        const url = (a.match(/wicketAjaxGet\(\s*['"]([^'"]+)['"]/) || [])[1];
+        if (!url)
+            continue;
+        return { ajaxUrl: decodeEntities(url), attended: /remove/i.test(title) };
+    }
+    return null;
+}
+async function setAttendance(setlistId, desired, confirm) {
+    // Resolve the canonical setlist page URL via the public API.
+    const meta = await client.request('GET', `/1.0/setlist/${encodeURIComponent(setlistId)}`);
+    if (!meta?.url)
+        throw new Error(`No setlist found for id "${setlistId}".`);
+    const path = new URL(meta.url).pathname;
+    const summary = {
+        setlistId,
+        url: meta.url,
+        artist: meta.artist?.name,
+        eventDate: meta.eventDate,
+        venue: meta.venue?.name,
+        city: meta.venue?.city?.name,
+    };
+    const control = parseAttendance(await webClient.fetchPage(path));
+    if (!control) {
+        throw new Error('Could not find the attendance control on the setlist page — your setlist.fm session has likely expired (re-copy SETLIST_SESSION_COOKIE) or the page layout changed.');
+    }
+    if (control.attended === desired) {
+        return {
+            ...summary,
+            attended: desired,
+            changed: false,
+            note: desired ? 'Already marked as attended.' : 'Not currently attended — nothing to remove.',
+        };
+    }
+    if (!confirm) {
+        return {
+            ...summary,
+            currentlyAttended: control.attended,
+            wouldSetAttendedTo: desired,
+            dryRun: true,
+            note: `Dry run — re-run with confirm: true to ${desired ? 'record' : 'remove'} this attendance.`,
+        };
+    }
+    // Replay the per-render Wicket toggle, then VERIFY by re-reading (a 200 is not proof).
+    const u = new URL(control.ajaxUrl, meta.url);
+    await webClient.wicketAjaxGet(u.pathname + u.search, path.replace(/^\//, ''));
+    const after = parseAttendance(await webClient.fetchPage(path));
+    const verified = after?.attended === desired;
+    return {
+        ...summary,
+        attended: desired,
+        changed: true,
+        verified,
+        ...(verified ? {} : { warning: 'Toggle sent, but the re-read did not confirm the new state — check on setlist.fm.' }),
+    };
+}
+export function registerAttendanceTools(server) {
+    server.registerTool('setlist_mark_attended', {
+        description: "Record on YOUR setlist.fm account that you attended a show — the site's \"I was there\" marker — by setlist ID. Authenticated via your session (needs SETLIST_SESSION_COOKIE). Idempotent: a no-op if already marked. Without confirm: true it returns a dry-run preview and makes NO change; with confirm: true it toggles attendance and verifies by re-reading your attended list." +
+            ATTRIBUTION_NOTE,
+        annotations: { readOnlyHint: false, idempotentHint: true, openWorldHint: true },
+        inputSchema: {
+            setlistId: z.string().describe('Setlist ID (e.g. from setlist_search_setlists / resolve_concerts)'),
+            confirm: z.boolean().optional().describe('Must be true to actually record attendance; omit for a dry-run preview.'),
+        },
+    }, async ({ setlistId, confirm }) => textResult(await setAttendance(setlistId, true, confirm === true)));
+    server.registerTool('setlist_unmark_attended', {
+        description: 'Remove a show from YOUR attended list on setlist.fm, by setlist ID (reverses setlist_mark_attended). Authenticated via your session. Idempotent: a no-op if not currently attended. Without confirm: true it returns a dry-run preview and makes NO change; with confirm: true it removes the attendance and verifies by re-reading.' +
+            ATTRIBUTION_NOTE,
+        annotations: { readOnlyHint: false, idempotentHint: true, destructiveHint: true, openWorldHint: true },
+        inputSchema: {
+            setlistId: z.string().describe('Setlist ID to remove from your attended shows'),
+            confirm: z.boolean().optional().describe('Must be true to actually remove attendance; omit for a dry-run preview.'),
+        },
+    }, async ({ setlistId, confirm }) => textResult(await setAttendance(setlistId, false, confirm === true)));
+}

package/dist/tools/resolve.js

@@ -3,10 +3,36 @@ import { textResult, isoToDmy, messageOf } from '@chrischall/mcp-utils';
 import { client } from '../client.js';
 import { ATTRIBUTION_NOTE } from '../attribution.js';
 const MAX_BATCH = 24;
+// Pace upstream calls to ~2 req/sec (setlist.fm's standard-tier limit). Bursting
+// a whole batch trips the limit → 429s → retries stack up → the tool call times
+// out; spacing the requests keeps the batch steady and predictable.
+const PACE_MS = 500;
+// Overall wall-clock budget for one tool call. When it's exhausted, the
+// remaining concerts come back `pending` instead of timing the whole call out.
+const BUDGET_MS = 45_000;
 function songCountOf(s) {
     const sets = Array.isArray(s.sets?.set) ? s.sets.set : [];
     return sets.reduce((n, set) => n + (Array.isArray(set?.song) ? set.song.length : 0), 0);
 }
+function songNamesOf(s) {
+    const sets = Array.isArray(s.sets?.set) ? s.sets.set : [];
+    const names = [];
+    for (const set of sets) {
+        for (const song of Array.isArray(set?.song) ? set.song : []) {
+            if (typeof song?.name === 'string')
+                names.push(song.name);
+        }
+    }
+    return names;
+}
+// Absolute day distance between two ISO dates; Infinity if either is unparseable.
+function daysApart(isoA, isoB) {
+    const a = isoA ? Date.parse(isoA) : NaN;
+    const b = isoB ? Date.parse(isoB) : NaN;
+    if (Number.isNaN(a) || Number.isNaN(b))
+        return Number.POSITIVE_INFINITY;
+    return Math.abs(a - b) / 86_400_000;
+}
 // Loosen punctuation/format variants for a fuzzy retry: drop quotes, turn + / &
 // into "and", drop stray periods, collapse whitespace. (Dan + Shay, "Weird Al"
 // Yankovic, DJ Pee .Wee.)
@@ -30,17 +56,15 @@ async function emptyOn404(run, fallback) {
         throw err;
     }
 }
-async function searchSetlists(query) {
+async function searchSetlists(req, query) {
     return emptyOn404(async () => {
-        const data = await client.request('GET', '/1.0/search/setlists', {
-            query,
-        });
+        const data = await req('GET', '/1.0/search/setlists', { query });
         return data?.setlist ?? [];
     }, []);
 }
-async function topArtistMbid(artistName) {
+async function topArtistMbid(req, artistName) {
     return emptyOn404(async () => {
-        const data = await client.request('GET', '/1.0/search/artists', {
+        const data = await req('GET', '/1.0/search/artists', {
             query: { artistName, sort: 'relevance' },
         });
         return data?.artist?.[0]?.mbid;
@@ -64,32 +88,71 @@ function pickBest(list, city, venue) {
     // Best location/song score wins; prefer a populated setlist on ties via songCount.
     return [...list].sort((a, b) => score(b, city, venue) - score(a, city, venue) || songCountOf(b) - songCountOf(a))[0];
 }
-async function resolveOne(c) {
+// When a show is an empty stub but the act toured a repeating set, find a
+// populated setlist from the SAME tour (setlist.fm only) to offer as a labeled
+// reference. Picks the populated date closest to the show. Returns undefined if
+// the stub has no tour or no other populated tour date exists.
+async function findTourReference(req, stub, targetDate) {
+    const tour = stub.tour?.name;
+    if (!tour)
+        return undefined;
+    const query = stub.artist?.mbid
+        ? { artistMbid: stub.artist.mbid, tourName: tour }
+        : { artistName: stub.artist?.name, tourName: tour };
+    // Without an artist, a tour-name-only search could return a different act on a
+    // same-named tour — don't guess.
+    if (!query.artistMbid && !query.artistName)
+        return undefined;
+    const candidates = (await searchSetlists(req, query)).filter((s) => s.id !== stub.id && songCountOf(s) > 0);
+    if (candidates.length === 0)
+        return undefined;
+    // Prefer a *representative* night: a setlist that's substantially complete
+    // relative to the tour's best-documented show (≥60%), so we don't surface
+    // another thin/partial entry just because it's the nearest date. Among those,
+    // pick the date closest to the target show.
+    // The best-documented night always passes its own threshold, so `substantial`
+    // is non-empty whenever `candidates` is.
+    const maxSongs = Math.max(...candidates.map(songCountOf));
+    const substantial = candidates.filter((s) => songCountOf(s) >= Math.max(1, maxSongs * 0.6));
+    const ref = [...substantial].sort((a, b) => daysApart(a.eventDate, targetDate) - daysApart(b.eventDate, targetDate) || songCountOf(b) - songCountOf(a))[0];
+    return {
+        note: `No songs are logged for this show on setlist.fm. This is the typical set for the "${tour}" tour, from a different date — verify before treating it as this exact show's setlist.`,
+        tour,
+        fromDate: ref.eventDate,
+        fromVenue: ref.venue?.name,
+        fromCity: ref.venue?.city?.name,
+        setlistId: ref.id,
+        url: ref.url,
+        songCount: songCountOf(ref),
+        songs: songNamesOf(ref),
+    };
+}
+async function resolveOne(req, c, tourFallback) {
     const filters = {
         date: isoToDmy(c.date),
         ...(c.city ? { cityName: c.city } : {}),
         ...(c.venue ? { venueName: c.venue } : {}),
     };
-    let list = await searchSetlists({ artistName: c.artist, ...filters });
+    let list = await searchSetlists(req, { artistName: c.artist, ...filters });
     // Fuzzy fallback 1: resolve the artist via the (more forgiving) relevance
     // search, then query by its mbid.
     if (list.length === 0) {
-        const mbid = await topArtistMbid(c.artist);
+        const mbid = await topArtistMbid(req, c.artist);
         if (mbid)
-            list = await searchSetlists({ artistMbid: mbid, ...filters });
+            list = await searchSetlists(req, { artistMbid: mbid, ...filters });
     }
     // Fuzzy fallback 2: a punctuation-normalized name.
     if (list.length === 0) {
         const norm = normalizeArtist(c.artist);
         if (norm && norm.toLowerCase() !== c.artist.toLowerCase()) {
-            list = await searchSetlists({ artistName: norm, ...filters });
+            list = await searchSetlists(req, { artistName: norm, ...filters });
         }
     }
     const best = pickBest(list, c.city, c.venue);
     if (!best)
         return { input: c, match: null, alternatives: 0 };
     const songCount = songCountOf(best);
-    return {
+    const result = {
         input: c,
         match: {
             setlistId: best.id,
@@ -104,10 +167,73 @@ async function resolveOne(c) {
         },
         alternatives: list.length - 1,
     };
+    // Empty stub: try to offer the tour's typical (populated) setlist as a labeled reference.
+    if (songCount === 0 && tourFallback) {
+        const ref = await findTourReference(req, best, c.date);
+        if (ref)
+            result.tourReference = ref;
+    }
+    return result;
+}
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * Resolve each concert sequentially, pacing upstream calls to stay under
+ * setlist.fm's rate limit and stopping (remaining → `pending`) once the
+ * wall-clock budget is spent, so a large batch returns partial results instead
+ * of timing the whole call out. Exported for testing.
+ */
+export async function resolveConcerts(concerts, deps = {}) {
+    const baseRequest = deps.request ?? ((m, p, o) => client.request(m, p, o));
+    const sleep = deps.sleep ?? defaultSleep;
+    const now = deps.now ?? Date.now;
+    const paceMs = deps.paceMs ?? PACE_MS;
+    const budgetMs = deps.budgetMs ?? BUDGET_MS;
+    const tourFallback = deps.tourFallback ?? true;
+    // Gate every upstream call to at least `paceMs` apart (the first runs immediately).
+    let lastCallAt = 0;
+    const req = async (method, path, opts) => {
+        const wait = paceMs - (now() - lastCallAt);
+        if (wait > 0)
+            await sleep(wait);
+        lastCallAt = now();
+        return baseRequest(method, path, opts);
+    };
+    const start = now();
+    const results = [];
+    let budgetSpent = false;
+    for (const c of concerts) {
+        if (budgetSpent || now() - start >= budgetMs) {
+            budgetSpent = true;
+            results.push({ input: c, match: null, alternatives: 0, pending: true });
+            continue;
+        }
+        results.push(await resolveOne(req, c, tourFallback));
+    }
+    return results;
+}
+/** Build the tool payload (results + summary, plus a note when work was deferred). */
+export function summarizeResults(results) {
+    const pending = results.filter((r) => r.pending).length;
+    const matched = results.filter((r) => r.match).length;
+    const stubs = results.filter((r) => r.match && !r.match.hasSongs).length;
+    const tourReferenced = results.filter((r) => r.tourReference).length;
+    const summary = {
+        total: results.length,
+        matched,
+        stubs,
+        tourReferenced,
+        unmatched: results.length - matched - pending,
+        pending,
+    };
+    const payload = { results, summary };
+    if (pending > 0) {
+        payload.note = `Reached the time budget after ${results.length - pending} of ${results.length} concerts. Re-call setlist_resolve_concerts with just the ${pending} pending concert(s).`;
+    }
+    return payload;
 }
 export function registerResolveTools(server) {
     server.registerTool('setlist_resolve_concerts', {
-        description: "Resolve many concerts to their setlists in ONE call (instead of 2+ per show). Given up to 24 `{artist, date, city?, venue?}`, returns the best-match setlist for each — `{setlistId, url, eventDate, artist, venue, city, tour, songCount, hasSongs}` — plus a `{matched, stubs, unmatched}` summary. For each: searches artist + date (narrowed by your city/venue), and on a miss falls back to a relevance artist lookup (by mbid) and a punctuation-normalized name so format variants still resolve. `hasSongs: false` flags an empty stub page. Processed sequentially to respect setlist.fm's rate limit; chunk lists longer than 24 across calls." +
+        description: "Resolve many concerts to their setlists in ONE call (instead of 2+ per show). Given up to 24 `{artist, date, city?, venue?}`, returns the best-match setlist for each — `{setlistId, url, eventDate, artist, venue, city, tour, songCount, hasSongs}` — plus a `{matched, stubs, tourReferenced, unmatched, pending}` summary. For each: searches artist + date (narrowed by your city/venue), and on a miss falls back to a relevance artist lookup (by mbid) and a punctuation-normalized name so format variants still resolve. `hasSongs: false` flags an empty stub page (no songs logged on setlist.fm). When a show is a stub, if the act toured a repeating set the result also includes a `tourReference` — a populated setlist from the SAME tour on a different date (with `songs` + its own `url`), clearly labeled as a reference, NOT this exact show (set `tourFallback: false` to skip these extra lookups). Calls are paced to setlist.fm's ~2 req/sec limit; if a big batch can't finish within the time budget the rest come back `pending: true` (re-call with just those) rather than timing out. Keep batches ≤24." +
             ATTRIBUTION_NOTE,
         annotations: { readOnlyHint: true },
         inputSchema: {
@@ -121,19 +247,13 @@ export function registerResolveTools(server) {
                 .min(1)
                 .max(MAX_BATCH)
                 .describe(`Concerts to resolve (1–${MAX_BATCH} per call)`),
+            tourFallback: z
+                .boolean()
+                .optional()
+                .describe('For empty stubs, also fetch a same-tour reference setlist (default true). Set false to skip the extra lookups.'),
         },
-    }, async ({ concerts }) => {
-        const results = [];
-        // Sequential on purpose: one request at a time keeps us within setlist.fm's
-        // ~2 req/sec limit (the client also retries once on a 429).
-        for (const c of concerts) {
-            results.push((await resolveOne(c)));
-        }
-        const matched = results.filter((r) => r.match).length;
-        const stubs = results.filter((r) => r.match && !r.match.hasSongs).length;
-        return textResult({
-            results,
-            summary: { total: results.length, matched, stubs, unmatched: results.length - matched },
-        });
+    }, async ({ concerts, tourFallback }) => {
+        const results = await resolveConcerts(concerts, { tourFallback });
+        return textResult(summarizeResults(results));
     });
 }

package/dist/version.js

@@ -3,4 +3,4 @@
 // release-please-config.json's `extra-files`), and `versionSyncTest` guards
 // that it stays equal to package.json. Import VERSION wherever the version is
 // needed rather than re-declaring it.
-export const VERSION = '0.5.0'; // x-release-please-version
+export const VERSION = '0.6.0'; // x-release-please-version

package/dist/web-client.js

@@ -0,0 +1,79 @@
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+import { loadDotenvSafely, readEnvVar, createApiClient } from '@chrischall/mcp-utils';
+// Load .env for local dev (guarded; the mcpb bundle omits dotenv).
+const __dirname = dirname(fileURLToPath(import.meta.url));
+await loadDotenvSafely({ path: join(__dirname, '..', '.env'), override: false });
+const BASE_URL = 'https://www.setlist.fm';
+const SERVICE_NAME = 'setlist.fm (web)';
+const REQUEST_TIMEOUT_MS = 20_000;
+// A browser-like UA; the bare default can trip the site's bot heuristics.
+const USER_AGENT = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36';
+/**
+ * Authenticated client for the setlist.fm **website** (not the public REST API).
+ * The site has no JSON API for user actions — it's server-rendered HTML plus
+ * Apache Wicket stateful AJAX, authenticated by the logged-in session cookie.
+ *
+ * Auth resolves in order: `SETLIST_SESSION_COOKIE` (env) → a fetchproxy
+ * `read_cookies` bootstrap from the signed-in browser tab (lazy, optional) →
+ * a deferred config error at request time. Kept entirely separate from the
+ * api-key `SetlistClient` so the public-API tools never depend on a session.
+ */
+export class SetlistWebClient {
+    cookie;
+    configError;
+    api;
+    constructor() {
+        this.cookie = readEnvVar('SETLIST_SESSION_COOKIE') ?? null;
+        this.configError = new Error('No setlist.fm session: set SETLIST_SESSION_COOKIE (copy the Cookie header from a logged-in www.setlist.fm request) or connect the fetchproxy browser bridge.');
+        this.api = createApiClient({
+            baseUrl: BASE_URL,
+            serviceName: SERVICE_NAME,
+            timeout: REQUEST_TIMEOUT_MS,
+            retry: { count: 1, delayMs: 2000 },
+            baseHeaders: { 'User-Agent': USER_AGENT },
+        });
+    }
+    /**
+     * Resolve the session cookie: `SETLIST_SESSION_COOKIE` (env) first, else a
+     * one-time fetchproxy `read_cookies` grab from the signed-in tab (lazy-imported
+     * so the env path never loads the bridge), else the deferred config error.
+     * The grabbed cookie is cached on the instance for the process lifetime.
+     */
+    async requireCookie() {
+        if (this.cookie)
+            return this.cookie;
+        const { grabSessionCookie } = await import('./fetchproxy-cookie.js');
+        const grabbed = await grabSessionCookie();
+        if (grabbed) {
+            this.cookie = grabbed;
+            return grabbed;
+        }
+        throw this.configError;
+    }
+    /** GET a page as HTML, authenticated. `path` is appended to the www base URL. */
+    async fetchPage(path) {
+        const cookie = await this.requireCookie();
+        return this.api.fetchHtml('GET', path, { headers: { Cookie: cookie } });
+    }
+    /**
+     * Replay an Apache Wicket AJAX behavior GET (e.g. the attendance toggle).
+     * `ajaxPath` is the per-render URL parsed from a page's `wicketAjaxGet(...)`;
+     * `baseUrl` is the rendering page's path (no leading slash) for the
+     * `Wicket-Ajax-BaseURL` header. Returns the `<ajax-response>` XML body.
+     */
+    async wicketAjaxGet(ajaxPath, baseUrl) {
+        const cookie = await this.requireCookie();
+        return this.api.fetchHtml('GET', ajaxPath, {
+            headers: {
+                Cookie: cookie,
+                'Wicket-Ajax': 'true',
+                'Wicket-Ajax-BaseURL': baseUrl,
+                'X-Requested-With': 'XMLHttpRequest',
+                Accept: 'text/xml, text/javascript, application/xml, text/html, */*',
+            },
+        });
+    }
+}
+/** Module-level singleton (deferred-config: missing session surfaces at request time). */
+export const webClient = new SetlistWebClient();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "setlist-mcp",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "mcpName": "io.github.chrischall/setlist-mcp",
   "description": "setlist.fm MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -35,7 +35,7 @@
   ],
   "scripts": {
     "build": "tsc && npm run bundle",
-    "bundle": "esbuild src/index.ts --bundle --platform=node --format=esm --external:dotenv --outfile=dist/bundle.js",
+    "bundle": "esbuild src/index.ts --bundle --platform=node --format=esm --external:dotenv --banner:js='import { createRequire as __createRequire } from \"module\"; const require = __createRequire(import.meta.url);' --outfile=dist/bundle.js",
     "dev": "node dist/index.js",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -43,6 +43,8 @@
   },
   "dependencies": {
     "@chrischall/mcp-utils": "^0.6.0",
+    "@fetchproxy/bootstrap": "^1.3.0",
+    "@fetchproxy/server": "^1.3.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.0",
     "zod": "^4.4.2"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/setlist-mcp",
     "source": "github"
   },
-  "version": "0.5.0",
+  "version": "0.6.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "setlist-mcp",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "transport": {
         "type": "stdio"
       },
@@ -29,6 +29,13 @@
           "isRequired": false,
           "format": "string",
           "isSecret": false
+        },
+        {
+          "name": "SETLIST_SESSION_COOKIE",
+          "description": "Optional. Logged-in www.setlist.fm Cookie header — enables the attendance write tools.",
+          "isRequired": false,
+          "format": "string",
+          "isSecret": true
         }
       ]
     }