@kya-os/mcp-i 1.5.0 → 1.5.1

package/dist/runtime/auth-handshake.js

@@ -120,9 +120,12 @@ async function verifyOrHints(agentDid, scopes, config, resumeToken) {
     }
     catch (error) {
         console.error('[AuthHandshake] Delegation verification failed:', error);
+        const errorMessage = `Delegation verification error: ${error instanceof Error ? error.message : 'Unknown error'}`;
+        const authError = await buildNeedsAuthorizationError(agentDid, scopes, config, errorMessage);
         return {
             authorized: false,
-            reason: `Delegation verification error: ${error instanceof Error ? error.message : 'Unknown error'}`,
+            authError,
+            reason: errorMessage,
         };
     }
     // Step 3: If delegation exists and valid, authorize immediately

package/dist/runtime/delegation-verifier-kv.js

@@ -100,10 +100,9 @@ class CloudflareKVDelegationVerifier {
         if (this.debug) {
             console.log(`[KV] Cache MISS for ${agentDid}, querying KV...`);
         }
-        // Try to find delegation by agent DID lookup key
-        const lookupKey = `agent:${agentDid}:scopes:${scopesKey}`;
-        const delegationId = await this.kv.get(lookupKey, 'text');
-        if (!delegationId) {
+        // List all delegations for this agent (to support subset scope matching)
+        const listResult = await this.kv.list({ prefix: `agent:${agentDid}:scopes:` });
+        if (!listResult.keys || listResult.keys.length === 0) {
             const result = {
                 valid: false,
                 reason: 'No delegation found for agent',
@@ -116,17 +115,37 @@ class CloudflareKVDelegationVerifier {
             }
             return result;
         }
-        // Fetch full delegation record
-        const delegation = await this.get(delegationId);
-        if (!delegation) {
+        // Try each delegation to find one that matches the requested scopes
+        let matchingDelegation = null;
+        for (const key of listResult.keys) {
+            const delegationId = await this.kv.get(key.name, 'text');
+            if (!delegationId)
+                continue;
+            const delegation = await this.get(delegationId);
+            if (!delegation)
+                continue;
+            // Check if this delegation has the required scopes
+            const delegationScopes = (0, delegation_verifier_1.extractScopes)(delegation);
+            const scopesMatch = (0, delegation_verifier_1.checkScopes)(delegationScopes, scopes);
+            if (scopesMatch) {
+                // Found a matching delegation!
+                matchingDelegation = delegation;
+                break;
+            }
+        }
+        if (!matchingDelegation) {
             const result = {
                 valid: false,
-                reason: 'Delegation not found',
+                reason: 'No delegation found with required scopes',
                 cached: false,
             };
             this.cache.set(cacheKey, result, this.cacheTtl / 2);
+            if (this.debug) {
+                console.log(`[KV] No matching delegation found (${Date.now() - startTime}ms)`);
+            }
             return result;
         }
+        const delegation = matchingDelegation;
         // Validate delegation
         const validation = (0, delegation_verifier_1.validateDelegation)(delegation);
         if (!validation.valid) {

package/dist/runtime/mcpi-runtime.js

@@ -127,6 +127,9 @@ class MCPIRuntime {
             const verifyResult = await (0, auth_handshake_1.verifyOrHints)(options.agentDid, requiredScopes, authConfig);
             // If not authorized, return needs_authorization error
             if (!verifyResult.authorized) {
+                if (!verifyResult.authError) {
+                    throw new Error('Authorization failed but no authError was provided');
+                }
                 return verifyResult.authError;
             }
             // If authorized, log the delegation ID for audit trail

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "The TypeScript MCP framework with identity features built-in",
   "type": "commonjs",
   "main": "dist/index.js",