@kya-os/mcp-i-core 1.3.20 → 1.3.22

package/dist/services/access-control.service.js

@@ -688,12 +688,18 @@ function authorizationMatches(delegationAuth, toolAuth) {
     // Compare type
     if (delegationAuth.type !== toolAuth.type)
         return false;
-    // For OAuth, compare provider
+    // For OAuth, compare provider (undefined in toolAuth means "any provider is acceptable")
     if (delegationAuth.type === 'oauth') {
+        // If tool doesn't specify a provider, any provider is acceptable
+        if (!toolAuth.provider)
+            return true;
         return delegationAuth.provider === toolAuth.provider;
     }
-    // For credential, compare credentialType
+    // For credential, compare credentialType (undefined in toolAuth means "any type is acceptable")
     if (delegationAuth.type === 'credential') {
+        // If tool doesn't specify a credential type, any type is acceptable
+        if (!toolAuth.credentialType)
+            return true;
         return delegationAuth.credentialType === toolAuth.credentialType;
     }
     // For 'none' type, they match if both are 'none'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i-core",
-  "version": "1.3.20",
+  "version": "1.3.22",
   "description": "Core runtime and types for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -28,7 +28,7 @@
     "prepublishOnly": "npm run build && node ../create-mcpi-app/scripts/validate-no-workspace.js"
   },
   "dependencies": {
-    "@kya-os/contracts": "^1.6.12",
+    "@kya-os/contracts": "^1.6.15",
     "jose": "^5.6.3",
     "json-canonicalize": "^2.0.0",
     "zod": "^3.25.76"