@snokam/mcp-api 0.110.2 → 0.111.1

package/dist/auth.d.ts

@@ -1,16 +1,15 @@
 /**
  * Token acquisition for Snokam backend APIs.
  *
- * Supports three modes (auto-detected):
+ * Modes (auto-detected, in order):
  *
- * 1. **OBO (On-Behalf-Of):** When SNOKAM_USER_JWT is set, exchanges the user
- *    JWT for a service-specific token via Azure AD OBO flow.
- *    Requires AZURE_AD_CLIENT_ID, AZURE_AD_TENANT_ID, and either
- *    AZURE_AD_SECRET (client secret) or managed identity.
+ * 1. **SNOKAM_ACCESS_TOKEN_FILE:** path to a bearer the host refreshes (every
+ *    ~30 min via the VM managed identity). Read fresh per call so a rotated
+ *    token is picked up without restarting. Preferred for egress-isolated
+ *    containers that can't reach IMDS.
+ * 2. **SNOKAM_ACCESS_TOKEN:** a pre-minted bearer injected directly.
+ * 3. **DefaultAzureCredential:** Azure CLI (local dev) or managed identity (Azure).
  *
- * 2. **DefaultAzureCredential:** When no user JWT is present, falls back to
- *    Azure CLI (local dev), managed identity (Azure), etc.
- *
- * 3. **No auth:** Endpoints without a scope get no Authorization header.
+ * Endpoints without a scope get no Authorization header.
  */
 export declare function getAccessToken(scope: string | null): Promise<string | null>;

package/dist/auth.js

@@ -1,68 +1,40 @@
 /**
  * Token acquisition for Snokam backend APIs.
  *
- * Supports three modes (auto-detected):
+ * Modes (auto-detected, in order):
  *
- * 1. **OBO (On-Behalf-Of):** When SNOKAM_USER_JWT is set, exchanges the user
- *    JWT for a service-specific token via Azure AD OBO flow.
- *    Requires AZURE_AD_CLIENT_ID, AZURE_AD_TENANT_ID, and either
- *    AZURE_AD_SECRET (client secret) or managed identity.
+ * 1. **SNOKAM_ACCESS_TOKEN_FILE:** path to a bearer the host refreshes (every
+ *    ~30 min via the VM managed identity). Read fresh per call so a rotated
+ *    token is picked up without restarting. Preferred for egress-isolated
+ *    containers that can't reach IMDS.
+ * 2. **SNOKAM_ACCESS_TOKEN:** a pre-minted bearer injected directly.
+ * 3. **DefaultAzureCredential:** Azure CLI (local dev) or managed identity (Azure).
  *
- * 2. **DefaultAzureCredential:** When no user JWT is present, falls back to
- *    Azure CLI (local dev), managed identity (Azure), etc.
- *
- * 3. **No auth:** Endpoints without a scope get no Authorization header.
+ * Endpoints without a scope get no Authorization header.
  */
-import { DefaultAzureCredential, OnBehalfOfCredential, } from "@azure/identity";
-// Cache credentials per scope to avoid re-creating them
-const credentialCache = new Map();
-function getOboCredential(userJwt, clientId, tenantId) {
-    const clientSecret = process.env.AZURE_AD_SECRET;
-    if (clientSecret) {
-        return new OnBehalfOfCredential({
-            tenantId,
-            clientId,
-            clientSecret,
-            userAssertionToken: userJwt,
-        });
-    }
-    // Managed identity as client assertion (federated identity)
-    const mi = new DefaultAzureCredential();
-    return new OnBehalfOfCredential({
-        tenantId,
-        clientId,
-        userAssertionToken: userJwt,
-        getAssertion: async () => {
-            const token = await mi.getToken("api://AzureADTokenExchange");
-            return token.token;
-        },
-    });
-}
+import { readFileSync } from "fs";
+import { DefaultAzureCredential } from "@azure/identity";
+let defaultCredential = null;
 export async function getAccessToken(scope) {
     if (!scope)
         return null;
-    const userJwt = process.env.SNOKAM_USER_JWT;
-    const clientId = process.env.AZURE_AD_CLIENT_ID ?? "";
-    const tenantId = process.env.AZURE_AD_TENANT_ID ?? "";
-    let credential;
-    if (userJwt && clientId && tenantId) {
-        // OBO mode
-        const cacheKey = `obo:${scope}`;
-        if (!credentialCache.has(cacheKey)) {
-            credentialCache.set(cacheKey, getOboCredential(userJwt, clientId, tenantId));
+    const tokenFile = process.env.SNOKAM_ACCESS_TOKEN_FILE;
+    if (tokenFile) {
+        try {
+            const fromFile = readFileSync(tokenFile, "utf8").trim();
+            if (fromFile)
+                return fromFile;
         }
-        credential = credentialCache.get(cacheKey);
-    }
-    else {
-        // Default credential (Azure CLI locally, managed identity in Azure)
-        const cacheKey = "default";
-        if (!credentialCache.has(cacheKey)) {
-            credentialCache.set(cacheKey, new DefaultAzureCredential());
+        catch {
+            // fall through to the other modes
         }
-        credential = credentialCache.get(cacheKey);
     }
+    const preMinted = process.env.SNOKAM_ACCESS_TOKEN;
+    if (preMinted)
+        return preMinted;
     try {
-        const token = await credential.getToken(scope);
+        defaultCredential ??= new DefaultAzureCredential();
+        const token = await defaultCredential.getToken(scope);
         return token?.token ?? null;
     }
     catch (error) {

package/dist/index.d.ts

@@ -3,7 +3,7 @@
  * Snokam MCP Server
  *
  * Exposes Snokam backend APIs as MCP tools by reading bundled OpenAPI specs.
- * Auth is handled via @azure/identity — supports Azure CLI (local),
- * managed identity (Azure), and OBO (when SNOKAM_USER_JWT is set).
+ * Auth: a pre-minted SNOKAM_ACCESS_TOKEN when present, else @azure/identity
+ * (Azure CLI locally, managed identity in Azure).
  */
 export {};

package/dist/index.js

@@ -3,8 +3,8 @@
  * Snokam MCP Server
  *
  * Exposes Snokam backend APIs as MCP tools by reading bundled OpenAPI specs.
- * Auth is handled via @azure/identity — supports Azure CLI (local),
- * managed identity (Azure), and OBO (when SNOKAM_USER_JWT is set).
+ * Auth: a pre-minted SNOKAM_ACCESS_TOKEN when present, else @azure/identity
+ * (Azure CLI locally, managed identity in Azure).
  */
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -111,13 +111,13 @@ const resetUrlToolDef = {
 const SWITCH_DOMAIN_TOOL_NAME = "SwitchDomain";
 const switchDomainToolDef = {
     name: SWITCH_DOMAIN_TOOL_NAME,
-    description: "Point all Snokam API calls at a specific business's API domain, so the same MCP can serve any tenant. Pass the business's API domain (custom, e.g. api.acme.com, or its snosky fallback, e.g. api.acme.snosky.no); calls then go to {service}.{domain}. Pass an empty string to reset to the environment default (snokam).",
+    description: "Point all Snokam API calls at a specific business's API domain, so the same MCP can serve any tenant. Pass the business's API domain (custom, e.g. api.acme.com, or its snosky fallback, e.g. api.acme.snosky.no); calls then go to {service}.{domain}. Pass an empty string to reset to the platform-wide snosky default.",
     inputSchema: {
         type: "object",
         properties: {
             domain: {
                 type: "string",
-                description: "The business's API base domain (e.g. api.acme.com). Empty string resets to the snokam default.",
+                description: "The business's API base domain (e.g. api.acme.com). Empty string resets to the platform-wide snosky default.",
             },
         },
         required: ["domain"],

package/dist/openapi-loader.d.ts

@@ -1,10 +1,11 @@
 /**
  * Fetch OpenAPI specs from live Snokam APIs and produce tool definitions.
  *
- * Each backend function is available at `{service}.api.snokam.no` (prod)
- * or `{service}.api.test.snokam.no` (test). The loader fetches `/swagger.json`
- * from each, extracts endpoints, parameters, and OAuth scopes to generate
- * MCP-compatible tool metadata.
+ * Backends are reached on the platform-wide snosky domain, which is uniform
+ * across every business (no per-customer hostname): `{service}.api.snosky.no`
+ * (prod) or `{service}.api.test.snosky.no` (test). A specific business domain
+ * can still be targeted at runtime via the SwitchDomain tool. The loader
+ * extracts endpoints, parameters, and OAuth scopes for MCP tool metadata.
  */
 export interface ApiEndpoint {
     service: string;

package/dist/openapi-loader.js

@@ -1,10 +1,11 @@
 /**
  * Fetch OpenAPI specs from live Snokam APIs and produce tool definitions.
  *
- * Each backend function is available at `{service}.api.snokam.no` (prod)
- * or `{service}.api.test.snokam.no` (test). The loader fetches `/swagger.json`
- * from each, extracts endpoints, parameters, and OAuth scopes to generate
- * MCP-compatible tool metadata.
+ * Backends are reached on the platform-wide snosky domain, which is uniform
+ * across every business (no per-customer hostname): `{service}.api.snosky.no`
+ * (prod) or `{service}.api.test.snosky.no` (test). A specific business domain
+ * can still be targeted at runtime via the SwitchDomain tool. The loader
+ * extracts endpoints, parameters, and OAuth scopes for MCP tool metadata.
  */
 // ---------------------------------------------------------------------------
 // Service discovery - reads from bundled specs directory at runtime
@@ -30,8 +31,8 @@ async function discoverServices(environment) {
 // ---------------------------------------------------------------------------
 // Environment-aware URL resolution
 // ---------------------------------------------------------------------------
-const PROD_DOMAIN = "api.snokam.no";
-const TEST_DOMAIN = "api.test.snokam.no";
+const PROD_DOMAIN = "api.snosky.no";
+const TEST_DOMAIN = "api.test.snosky.no";
 function getBaseDomain(environment) {
     return environment === "test" ? TEST_DOMAIN : PROD_DOMAIN;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@snokam/mcp-api",
-  "version": "0.110.2",
+  "version": "0.111.1",
   "description": "MCP server exposing Snokam backend APIs as tools for Claude Code and other MCP clients",
   "type": "module",
   "bin": {