@kya-os/contracts 1.7.15 → 1.7.17

package/dist/delegation/schemas.d.ts

@@ -1724,12 +1724,15 @@ export declare const DelegationChainEntrySchema: z.ZodObject<{
     /** Status */
     status: z.ZodEnum<["active", "revoked", "expired"]>;
 }, "strip", z.ZodTypeAny, {
+    issuerDid: string;
+    subjectDid: string;
+    vcId: string;
     status: "active" | "revoked" | "expired";
     constraints: {
-        scopes?: string[] | undefined;
-        audience?: string | string[] | undefined;
         notBefore?: number | undefined;
         notAfter?: number | undefined;
+        scopes?: string[] | undefined;
+        audience?: string | string[] | undefined;
         crisp?: z.objectOutputType<{
             budget: z.ZodOptional<z.ZodObject<{
                 unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -1776,18 +1779,18 @@ export declare const DelegationChainEntrySchema: z.ZodObject<{
     } & {
         [k: string]: unknown;
     };
-    issuerDid: string;
-    subjectDid: string;
-    vcId: string;
     delegationId: string;
     depth: number;
 }, {
+    issuerDid: string;
+    subjectDid: string;
+    vcId: string;
     status: "active" | "revoked" | "expired";
     constraints: {
-        scopes?: string[] | undefined;
-        audience?: string | string[] | undefined;
         notBefore?: number | undefined;
         notAfter?: number | undefined;
+        scopes?: string[] | undefined;
+        audience?: string | string[] | undefined;
         crisp?: z.objectInputType<{
             budget: z.ZodOptional<z.ZodObject<{
                 unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -1834,9 +1837,6 @@ export declare const DelegationChainEntrySchema: z.ZodObject<{
     } & {
         [k: string]: unknown;
     };
-    issuerDid: string;
-    subjectDid: string;
-    vcId: string;
     delegationId: string;
     depth: number;
 }>;
@@ -2264,12 +2264,15 @@ export declare const DelegationChainSchema: z.ZodObject<{
         /** Status */
         status: z.ZodEnum<["active", "revoked", "expired"]>;
     }, "strip", z.ZodTypeAny, {
+        issuerDid: string;
+        subjectDid: string;
+        vcId: string;
         status: "active" | "revoked" | "expired";
         constraints: {
-            scopes?: string[] | undefined;
-            audience?: string | string[] | undefined;
             notBefore?: number | undefined;
             notAfter?: number | undefined;
+            scopes?: string[] | undefined;
+            audience?: string | string[] | undefined;
             crisp?: z.objectOutputType<{
                 budget: z.ZodOptional<z.ZodObject<{
                     unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -2316,18 +2319,18 @@ export declare const DelegationChainSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
-        issuerDid: string;
-        subjectDid: string;
-        vcId: string;
         delegationId: string;
         depth: number;
     }, {
+        issuerDid: string;
+        subjectDid: string;
+        vcId: string;
         status: "active" | "revoked" | "expired";
         constraints: {
-            scopes?: string[] | undefined;
-            audience?: string | string[] | undefined;
             notBefore?: number | undefined;
             notAfter?: number | undefined;
+            scopes?: string[] | undefined;
+            audience?: string | string[] | undefined;
             crisp?: z.objectInputType<{
                 budget: z.ZodOptional<z.ZodObject<{
                     unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -2374,9 +2377,6 @@ export declare const DelegationChainSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
-        issuerDid: string;
-        subjectDid: string;
-        vcId: string;
         delegationId: string;
         depth: number;
     }>, "many">;
@@ -2392,12 +2392,15 @@ export declare const DelegationChainSchema: z.ZodObject<{
     rootIssuer: string;
     leafSubject: string;
     chain: {
+        issuerDid: string;
+        subjectDid: string;
+        vcId: string;
         status: "active" | "revoked" | "expired";
         constraints: {
-            scopes?: string[] | undefined;
-            audience?: string | string[] | undefined;
             notBefore?: number | undefined;
             notAfter?: number | undefined;
+            scopes?: string[] | undefined;
+            audience?: string | string[] | undefined;
             crisp?: z.objectOutputType<{
                 budget: z.ZodOptional<z.ZodObject<{
                     unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -2444,9 +2447,6 @@ export declare const DelegationChainSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
-        issuerDid: string;
-        subjectDid: string;
-        vcId: string;
         delegationId: string;
         depth: number;
     }[];
@@ -2457,12 +2457,15 @@ export declare const DelegationChainSchema: z.ZodObject<{
     rootIssuer: string;
     leafSubject: string;
     chain: {
+        issuerDid: string;
+        subjectDid: string;
+        vcId: string;
         status: "active" | "revoked" | "expired";
         constraints: {
-            scopes?: string[] | undefined;
-            audience?: string | string[] | undefined;
             notBefore?: number | undefined;
             notAfter?: number | undefined;
+            scopes?: string[] | undefined;
+            audience?: string | string[] | undefined;
             crisp?: z.objectInputType<{
                 budget: z.ZodOptional<z.ZodObject<{
                     unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -2509,9 +2512,6 @@ export declare const DelegationChainSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
-        issuerDid: string;
-        subjectDid: string;
-        vcId: string;
         delegationId: string;
         depth: number;
     }[];
@@ -2933,11 +2933,13 @@ export declare const DelegationCreationRequestSchema: z.ZodObject<{
     /** Optional VC ID (if not provided, will be created) */
     vcId: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
+    issuerDid: string;
+    subjectDid: string;
     constraints: {
-        scopes?: string[] | undefined;
-        audience?: string | string[] | undefined;
         notBefore?: number | undefined;
         notAfter?: number | undefined;
+        scopes?: string[] | undefined;
+        audience?: string | string[] | undefined;
         crisp?: z.objectOutputType<{
             budget: z.ZodOptional<z.ZodObject<{
                 unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -2984,17 +2986,17 @@ export declare const DelegationCreationRequestSchema: z.ZodObject<{
     } & {
         [k: string]: unknown;
     };
-    issuerDid: string;
-    subjectDid: string;
     controller?: string | undefined;
     vcId?: string | undefined;
     parentId?: string | undefined;
 }, {
+    issuerDid: string;
+    subjectDid: string;
     constraints: {
-        scopes?: string[] | undefined;
-        audience?: string | string[] | undefined;
         notBefore?: number | undefined;
         notAfter?: number | undefined;
+        scopes?: string[] | undefined;
+        audience?: string | string[] | undefined;
         crisp?: z.objectInputType<{
             budget: z.ZodOptional<z.ZodObject<{
                 unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -3041,13 +3043,262 @@ export declare const DelegationCreationRequestSchema: z.ZodObject<{
     } & {
         [k: string]: unknown;
     };
-    issuerDid: string;
-    subjectDid: string;
     controller?: string | undefined;
     vcId?: string | undefined;
     parentId?: string | undefined;
 }>;
 export type DelegationCreationRequest = z.infer<typeof DelegationCreationRequestSchema>;
+/**
+ * Authorization Info Schema
+ *
+ * Captures HOW the user verified their identity during consent.
+ * This is runtime verification metadata, separate from tool requirements.
+ *
+ * Note: This schema describes authorization info in verification results,
+ * not tool protection requirements (which use AuthorizationRequirementSchema).
+ */
+export declare const AuthorizationInfoSchema: z.ZodObject<{
+    /**
+     * The authorization method used during consent
+     *
+     * - 'oauth2': OAuth 2.0 provider authentication (canonical)
+     * - 'oauth': Deprecated, use 'oauth2' (will be removed in v2.0.0)
+     * - 'password': Password/credential authentication
+     * - 'credential': Deprecated, use 'verifiable_credential' (will be removed in v2.0.0)
+     * - 'verifiable_credential': W3C Verifiable Credential
+     * - 'mdl': Mobile Driver's License
+     * - 'idv': Identity Verification
+     * - 'webauthn': WebAuthn/Passkey authentication
+     * - 'siwe': Sign-In with Ethereum (EIP-4361)
+     * - 'none': Consent-only (no authentication)
+     */
+    type: z.ZodEnum<["oauth", "oauth2", "password", "credential", "verifiable_credential", "mdl", "idv", "webauthn", "siwe", "none"]>;
+    /** OAuth/Password/IDV provider name (e.g., 'github', 'google', 'credentials') */
+    provider: z.ZodOptional<z.ZodString>;
+    /** Credential type for verifiable_credential or mdl auth */
+    credentialType: z.ZodOptional<z.ZodString>;
+    /** MDL issuer DID or identifier */
+    issuer: z.ZodOptional<z.ZodString>;
+    /** IDV verification level */
+    verificationLevel: z.ZodOptional<z.ZodEnum<["basic", "enhanced", "loa3"]>>;
+    /** WebAuthn Relying Party ID */
+    rpId: z.ZodOptional<z.ZodString>;
+    /** WebAuthn user verification level */
+    userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+    /** SIWE Ethereum chain ID */
+    chainId: z.ZodOptional<z.ZodNumber>;
+    /** SIWE domain */
+    domain: z.ZodOptional<z.ZodString>;
+    /** Timestamp when authorization was verified (milliseconds since epoch) */
+    verifiedAt: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+    provider?: string | undefined;
+    credentialType?: string | undefined;
+    issuer?: string | undefined;
+    verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+    rpId?: string | undefined;
+    userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    chainId?: number | undefined;
+    domain?: string | undefined;
+    verifiedAt?: number | undefined;
+}, {
+    type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+    provider?: string | undefined;
+    credentialType?: string | undefined;
+    issuer?: string | undefined;
+    verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+    rpId?: string | undefined;
+    userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    chainId?: number | undefined;
+    domain?: string | undefined;
+    verifiedAt?: number | undefined;
+}>;
+export type AuthorizationInfo = z.infer<typeof AuthorizationInfoSchema>;
+/**
+ * Delegation Verification Details Schema
+ *
+ * Typed details object for verification results
+ */
+export declare const DelegationVerificationDetailsSchema: z.ZodObject<{
+    /** Authorization info - how identity was verified during consent */
+    authorization: z.ZodOptional<z.ZodObject<{
+        /**
+         * The authorization method used during consent
+         *
+         * - 'oauth2': OAuth 2.0 provider authentication (canonical)
+         * - 'oauth': Deprecated, use 'oauth2' (will be removed in v2.0.0)
+         * - 'password': Password/credential authentication
+         * - 'credential': Deprecated, use 'verifiable_credential' (will be removed in v2.0.0)
+         * - 'verifiable_credential': W3C Verifiable Credential
+         * - 'mdl': Mobile Driver's License
+         * - 'idv': Identity Verification
+         * - 'webauthn': WebAuthn/Passkey authentication
+         * - 'siwe': Sign-In with Ethereum (EIP-4361)
+         * - 'none': Consent-only (no authentication)
+         */
+        type: z.ZodEnum<["oauth", "oauth2", "password", "credential", "verifiable_credential", "mdl", "idv", "webauthn", "siwe", "none"]>;
+        /** OAuth/Password/IDV provider name (e.g., 'github', 'google', 'credentials') */
+        provider: z.ZodOptional<z.ZodString>;
+        /** Credential type for verifiable_credential or mdl auth */
+        credentialType: z.ZodOptional<z.ZodString>;
+        /** MDL issuer DID or identifier */
+        issuer: z.ZodOptional<z.ZodString>;
+        /** IDV verification level */
+        verificationLevel: z.ZodOptional<z.ZodEnum<["basic", "enhanced", "loa3"]>>;
+        /** WebAuthn Relying Party ID */
+        rpId: z.ZodOptional<z.ZodString>;
+        /** WebAuthn user verification level */
+        userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+        /** SIWE Ethereum chain ID */
+        chainId: z.ZodOptional<z.ZodNumber>;
+        /** SIWE domain */
+        domain: z.ZodOptional<z.ZodString>;
+        /** Timestamp when authorization was verified (milliseconds since epoch) */
+        verifiedAt: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+        provider?: string | undefined;
+        credentialType?: string | undefined;
+        issuer?: string | undefined;
+        verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        chainId?: number | undefined;
+        domain?: string | undefined;
+        verifiedAt?: number | undefined;
+    }, {
+        type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+        provider?: string | undefined;
+        credentialType?: string | undefined;
+        issuer?: string | undefined;
+        verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        chainId?: number | undefined;
+        domain?: string | undefined;
+        verifiedAt?: number | undefined;
+    }>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Authorization info - how identity was verified during consent */
+    authorization: z.ZodOptional<z.ZodObject<{
+        /**
+         * The authorization method used during consent
+         *
+         * - 'oauth2': OAuth 2.0 provider authentication (canonical)
+         * - 'oauth': Deprecated, use 'oauth2' (will be removed in v2.0.0)
+         * - 'password': Password/credential authentication
+         * - 'credential': Deprecated, use 'verifiable_credential' (will be removed in v2.0.0)
+         * - 'verifiable_credential': W3C Verifiable Credential
+         * - 'mdl': Mobile Driver's License
+         * - 'idv': Identity Verification
+         * - 'webauthn': WebAuthn/Passkey authentication
+         * - 'siwe': Sign-In with Ethereum (EIP-4361)
+         * - 'none': Consent-only (no authentication)
+         */
+        type: z.ZodEnum<["oauth", "oauth2", "password", "credential", "verifiable_credential", "mdl", "idv", "webauthn", "siwe", "none"]>;
+        /** OAuth/Password/IDV provider name (e.g., 'github', 'google', 'credentials') */
+        provider: z.ZodOptional<z.ZodString>;
+        /** Credential type for verifiable_credential or mdl auth */
+        credentialType: z.ZodOptional<z.ZodString>;
+        /** MDL issuer DID or identifier */
+        issuer: z.ZodOptional<z.ZodString>;
+        /** IDV verification level */
+        verificationLevel: z.ZodOptional<z.ZodEnum<["basic", "enhanced", "loa3"]>>;
+        /** WebAuthn Relying Party ID */
+        rpId: z.ZodOptional<z.ZodString>;
+        /** WebAuthn user verification level */
+        userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+        /** SIWE Ethereum chain ID */
+        chainId: z.ZodOptional<z.ZodNumber>;
+        /** SIWE domain */
+        domain: z.ZodOptional<z.ZodString>;
+        /** Timestamp when authorization was verified (milliseconds since epoch) */
+        verifiedAt: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+        provider?: string | undefined;
+        credentialType?: string | undefined;
+        issuer?: string | undefined;
+        verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        chainId?: number | undefined;
+        domain?: string | undefined;
+        verifiedAt?: number | undefined;
+    }, {
+        type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+        provider?: string | undefined;
+        credentialType?: string | undefined;
+        issuer?: string | undefined;
+        verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        chainId?: number | undefined;
+        domain?: string | undefined;
+        verifiedAt?: number | undefined;
+    }>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Authorization info - how identity was verified during consent */
+    authorization: z.ZodOptional<z.ZodObject<{
+        /**
+         * The authorization method used during consent
+         *
+         * - 'oauth2': OAuth 2.0 provider authentication (canonical)
+         * - 'oauth': Deprecated, use 'oauth2' (will be removed in v2.0.0)
+         * - 'password': Password/credential authentication
+         * - 'credential': Deprecated, use 'verifiable_credential' (will be removed in v2.0.0)
+         * - 'verifiable_credential': W3C Verifiable Credential
+         * - 'mdl': Mobile Driver's License
+         * - 'idv': Identity Verification
+         * - 'webauthn': WebAuthn/Passkey authentication
+         * - 'siwe': Sign-In with Ethereum (EIP-4361)
+         * - 'none': Consent-only (no authentication)
+         */
+        type: z.ZodEnum<["oauth", "oauth2", "password", "credential", "verifiable_credential", "mdl", "idv", "webauthn", "siwe", "none"]>;
+        /** OAuth/Password/IDV provider name (e.g., 'github', 'google', 'credentials') */
+        provider: z.ZodOptional<z.ZodString>;
+        /** Credential type for verifiable_credential or mdl auth */
+        credentialType: z.ZodOptional<z.ZodString>;
+        /** MDL issuer DID or identifier */
+        issuer: z.ZodOptional<z.ZodString>;
+        /** IDV verification level */
+        verificationLevel: z.ZodOptional<z.ZodEnum<["basic", "enhanced", "loa3"]>>;
+        /** WebAuthn Relying Party ID */
+        rpId: z.ZodOptional<z.ZodString>;
+        /** WebAuthn user verification level */
+        userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+        /** SIWE Ethereum chain ID */
+        chainId: z.ZodOptional<z.ZodNumber>;
+        /** SIWE domain */
+        domain: z.ZodOptional<z.ZodString>;
+        /** Timestamp when authorization was verified (milliseconds since epoch) */
+        verifiedAt: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+        provider?: string | undefined;
+        credentialType?: string | undefined;
+        issuer?: string | undefined;
+        verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        chainId?: number | undefined;
+        domain?: string | undefined;
+        verifiedAt?: number | undefined;
+    }, {
+        type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+        provider?: string | undefined;
+        credentialType?: string | undefined;
+        issuer?: string | undefined;
+        verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+        rpId?: string | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        chainId?: number | undefined;
+        domain?: string | undefined;
+        verifiedAt?: number | undefined;
+    }>>;
+}, z.ZodTypeAny, "passthrough">>;
+export type DelegationVerificationDetails = z.infer<typeof DelegationVerificationDetailsSchema>;
 /**
  * Delegation Verification Result
  *
@@ -3068,26 +3319,321 @@ export declare const DelegationVerificationResultSchema: z.ZodObject<{
     chainValid: z.ZodOptional<z.ZodBoolean>;
     /** Timestamp of verification */
     verifiedAt: z.ZodNumber;
-    /** Optional verification details */
-    details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    /** Verification details including authorization info */
+    details: z.ZodOptional<z.ZodObject<{
+        /** Authorization info - how identity was verified during consent */
+        authorization: z.ZodOptional<z.ZodObject<{
+            /**
+             * The authorization method used during consent
+             *
+             * - 'oauth2': OAuth 2.0 provider authentication (canonical)
+             * - 'oauth': Deprecated, use 'oauth2' (will be removed in v2.0.0)
+             * - 'password': Password/credential authentication
+             * - 'credential': Deprecated, use 'verifiable_credential' (will be removed in v2.0.0)
+             * - 'verifiable_credential': W3C Verifiable Credential
+             * - 'mdl': Mobile Driver's License
+             * - 'idv': Identity Verification
+             * - 'webauthn': WebAuthn/Passkey authentication
+             * - 'siwe': Sign-In with Ethereum (EIP-4361)
+             * - 'none': Consent-only (no authentication)
+             */
+            type: z.ZodEnum<["oauth", "oauth2", "password", "credential", "verifiable_credential", "mdl", "idv", "webauthn", "siwe", "none"]>;
+            /** OAuth/Password/IDV provider name (e.g., 'github', 'google', 'credentials') */
+            provider: z.ZodOptional<z.ZodString>;
+            /** Credential type for verifiable_credential or mdl auth */
+            credentialType: z.ZodOptional<z.ZodString>;
+            /** MDL issuer DID or identifier */
+            issuer: z.ZodOptional<z.ZodString>;
+            /** IDV verification level */
+            verificationLevel: z.ZodOptional<z.ZodEnum<["basic", "enhanced", "loa3"]>>;
+            /** WebAuthn Relying Party ID */
+            rpId: z.ZodOptional<z.ZodString>;
+            /** WebAuthn user verification level */
+            userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+            /** SIWE Ethereum chain ID */
+            chainId: z.ZodOptional<z.ZodNumber>;
+            /** SIWE domain */
+            domain: z.ZodOptional<z.ZodString>;
+            /** Timestamp when authorization was verified (milliseconds since epoch) */
+            verifiedAt: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+            provider?: string | undefined;
+            credentialType?: string | undefined;
+            issuer?: string | undefined;
+            verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            chainId?: number | undefined;
+            domain?: string | undefined;
+            verifiedAt?: number | undefined;
+        }, {
+            type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+            provider?: string | undefined;
+            credentialType?: string | undefined;
+            issuer?: string | undefined;
+            verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            chainId?: number | undefined;
+            domain?: string | undefined;
+            verifiedAt?: number | undefined;
+        }>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Authorization info - how identity was verified during consent */
+        authorization: z.ZodOptional<z.ZodObject<{
+            /**
+             * The authorization method used during consent
+             *
+             * - 'oauth2': OAuth 2.0 provider authentication (canonical)
+             * - 'oauth': Deprecated, use 'oauth2' (will be removed in v2.0.0)
+             * - 'password': Password/credential authentication
+             * - 'credential': Deprecated, use 'verifiable_credential' (will be removed in v2.0.0)
+             * - 'verifiable_credential': W3C Verifiable Credential
+             * - 'mdl': Mobile Driver's License
+             * - 'idv': Identity Verification
+             * - 'webauthn': WebAuthn/Passkey authentication
+             * - 'siwe': Sign-In with Ethereum (EIP-4361)
+             * - 'none': Consent-only (no authentication)
+             */
+            type: z.ZodEnum<["oauth", "oauth2", "password", "credential", "verifiable_credential", "mdl", "idv", "webauthn", "siwe", "none"]>;
+            /** OAuth/Password/IDV provider name (e.g., 'github', 'google', 'credentials') */
+            provider: z.ZodOptional<z.ZodString>;
+            /** Credential type for verifiable_credential or mdl auth */
+            credentialType: z.ZodOptional<z.ZodString>;
+            /** MDL issuer DID or identifier */
+            issuer: z.ZodOptional<z.ZodString>;
+            /** IDV verification level */
+            verificationLevel: z.ZodOptional<z.ZodEnum<["basic", "enhanced", "loa3"]>>;
+            /** WebAuthn Relying Party ID */
+            rpId: z.ZodOptional<z.ZodString>;
+            /** WebAuthn user verification level */
+            userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+            /** SIWE Ethereum chain ID */
+            chainId: z.ZodOptional<z.ZodNumber>;
+            /** SIWE domain */
+            domain: z.ZodOptional<z.ZodString>;
+            /** Timestamp when authorization was verified (milliseconds since epoch) */
+            verifiedAt: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+            provider?: string | undefined;
+            credentialType?: string | undefined;
+            issuer?: string | undefined;
+            verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            chainId?: number | undefined;
+            domain?: string | undefined;
+            verifiedAt?: number | undefined;
+        }, {
+            type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+            provider?: string | undefined;
+            credentialType?: string | undefined;
+            issuer?: string | undefined;
+            verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            chainId?: number | undefined;
+            domain?: string | undefined;
+            verifiedAt?: number | undefined;
+        }>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Authorization info - how identity was verified during consent */
+        authorization: z.ZodOptional<z.ZodObject<{
+            /**
+             * The authorization method used during consent
+             *
+             * - 'oauth2': OAuth 2.0 provider authentication (canonical)
+             * - 'oauth': Deprecated, use 'oauth2' (will be removed in v2.0.0)
+             * - 'password': Password/credential authentication
+             * - 'credential': Deprecated, use 'verifiable_credential' (will be removed in v2.0.0)
+             * - 'verifiable_credential': W3C Verifiable Credential
+             * - 'mdl': Mobile Driver's License
+             * - 'idv': Identity Verification
+             * - 'webauthn': WebAuthn/Passkey authentication
+             * - 'siwe': Sign-In with Ethereum (EIP-4361)
+             * - 'none': Consent-only (no authentication)
+             */
+            type: z.ZodEnum<["oauth", "oauth2", "password", "credential", "verifiable_credential", "mdl", "idv", "webauthn", "siwe", "none"]>;
+            /** OAuth/Password/IDV provider name (e.g., 'github', 'google', 'credentials') */
+            provider: z.ZodOptional<z.ZodString>;
+            /** Credential type for verifiable_credential or mdl auth */
+            credentialType: z.ZodOptional<z.ZodString>;
+            /** MDL issuer DID or identifier */
+            issuer: z.ZodOptional<z.ZodString>;
+            /** IDV verification level */
+            verificationLevel: z.ZodOptional<z.ZodEnum<["basic", "enhanced", "loa3"]>>;
+            /** WebAuthn Relying Party ID */
+            rpId: z.ZodOptional<z.ZodString>;
+            /** WebAuthn user verification level */
+            userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+            /** SIWE Ethereum chain ID */
+            chainId: z.ZodOptional<z.ZodNumber>;
+            /** SIWE domain */
+            domain: z.ZodOptional<z.ZodString>;
+            /** Timestamp when authorization was verified (milliseconds since epoch) */
+            verifiedAt: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+            provider?: string | undefined;
+            credentialType?: string | undefined;
+            issuer?: string | undefined;
+            verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            chainId?: number | undefined;
+            domain?: string | undefined;
+            verifiedAt?: number | undefined;
+        }, {
+            type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+            provider?: string | undefined;
+            credentialType?: string | undefined;
+            issuer?: string | undefined;
+            verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            chainId?: number | undefined;
+            domain?: string | undefined;
+            verifiedAt?: number | undefined;
+        }>>;
+    }, z.ZodTypeAny, "passthrough">>>;
 }, "strip", z.ZodTypeAny, {
     valid: boolean;
     status: "active" | "revoked" | "expired";
-    verifiedAt: number;
     delegationId: string;
-    details?: Record<string, any> | undefined;
+    verifiedAt: number;
     reason?: string | undefined;
     credentialValid?: boolean | undefined;
     chainValid?: boolean | undefined;
+    details?: z.objectOutputType<{
+        /** Authorization info - how identity was verified during consent */
+        authorization: z.ZodOptional<z.ZodObject<{
+            /**
+             * The authorization method used during consent
+             *
+             * - 'oauth2': OAuth 2.0 provider authentication (canonical)
+             * - 'oauth': Deprecated, use 'oauth2' (will be removed in v2.0.0)
+             * - 'password': Password/credential authentication
+             * - 'credential': Deprecated, use 'verifiable_credential' (will be removed in v2.0.0)
+             * - 'verifiable_credential': W3C Verifiable Credential
+             * - 'mdl': Mobile Driver's License
+             * - 'idv': Identity Verification
+             * - 'webauthn': WebAuthn/Passkey authentication
+             * - 'siwe': Sign-In with Ethereum (EIP-4361)
+             * - 'none': Consent-only (no authentication)
+             */
+            type: z.ZodEnum<["oauth", "oauth2", "password", "credential", "verifiable_credential", "mdl", "idv", "webauthn", "siwe", "none"]>;
+            /** OAuth/Password/IDV provider name (e.g., 'github', 'google', 'credentials') */
+            provider: z.ZodOptional<z.ZodString>;
+            /** Credential type for verifiable_credential or mdl auth */
+            credentialType: z.ZodOptional<z.ZodString>;
+            /** MDL issuer DID or identifier */
+            issuer: z.ZodOptional<z.ZodString>;
+            /** IDV verification level */
+            verificationLevel: z.ZodOptional<z.ZodEnum<["basic", "enhanced", "loa3"]>>;
+            /** WebAuthn Relying Party ID */
+            rpId: z.ZodOptional<z.ZodString>;
+            /** WebAuthn user verification level */
+            userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+            /** SIWE Ethereum chain ID */
+            chainId: z.ZodOptional<z.ZodNumber>;
+            /** SIWE domain */
+            domain: z.ZodOptional<z.ZodString>;
+            /** Timestamp when authorization was verified (milliseconds since epoch) */
+            verifiedAt: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+            provider?: string | undefined;
+            credentialType?: string | undefined;
+            issuer?: string | undefined;
+            verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            chainId?: number | undefined;
+            domain?: string | undefined;
+            verifiedAt?: number | undefined;
+        }, {
+            type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+            provider?: string | undefined;
+            credentialType?: string | undefined;
+            issuer?: string | undefined;
+            verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            chainId?: number | undefined;
+            domain?: string | undefined;
+            verifiedAt?: number | undefined;
+        }>>;
+    }, z.ZodTypeAny, "passthrough"> | undefined;
 }, {
     valid: boolean;
     status: "active" | "revoked" | "expired";
-    verifiedAt: number;
     delegationId: string;
-    details?: Record<string, any> | undefined;
+    verifiedAt: number;
     reason?: string | undefined;
     credentialValid?: boolean | undefined;
     chainValid?: boolean | undefined;
+    details?: z.objectInputType<{
+        /** Authorization info - how identity was verified during consent */
+        authorization: z.ZodOptional<z.ZodObject<{
+            /**
+             * The authorization method used during consent
+             *
+             * - 'oauth2': OAuth 2.0 provider authentication (canonical)
+             * - 'oauth': Deprecated, use 'oauth2' (will be removed in v2.0.0)
+             * - 'password': Password/credential authentication
+             * - 'credential': Deprecated, use 'verifiable_credential' (will be removed in v2.0.0)
+             * - 'verifiable_credential': W3C Verifiable Credential
+             * - 'mdl': Mobile Driver's License
+             * - 'idv': Identity Verification
+             * - 'webauthn': WebAuthn/Passkey authentication
+             * - 'siwe': Sign-In with Ethereum (EIP-4361)
+             * - 'none': Consent-only (no authentication)
+             */
+            type: z.ZodEnum<["oauth", "oauth2", "password", "credential", "verifiable_credential", "mdl", "idv", "webauthn", "siwe", "none"]>;
+            /** OAuth/Password/IDV provider name (e.g., 'github', 'google', 'credentials') */
+            provider: z.ZodOptional<z.ZodString>;
+            /** Credential type for verifiable_credential or mdl auth */
+            credentialType: z.ZodOptional<z.ZodString>;
+            /** MDL issuer DID or identifier */
+            issuer: z.ZodOptional<z.ZodString>;
+            /** IDV verification level */
+            verificationLevel: z.ZodOptional<z.ZodEnum<["basic", "enhanced", "loa3"]>>;
+            /** WebAuthn Relying Party ID */
+            rpId: z.ZodOptional<z.ZodString>;
+            /** WebAuthn user verification level */
+            userVerification: z.ZodOptional<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+            /** SIWE Ethereum chain ID */
+            chainId: z.ZodOptional<z.ZodNumber>;
+            /** SIWE domain */
+            domain: z.ZodOptional<z.ZodString>;
+            /** Timestamp when authorization was verified (milliseconds since epoch) */
+            verifiedAt: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+            provider?: string | undefined;
+            credentialType?: string | undefined;
+            issuer?: string | undefined;
+            verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            chainId?: number | undefined;
+            domain?: string | undefined;
+            verifiedAt?: number | undefined;
+        }, {
+            type: "oauth" | "oauth2" | "password" | "credential" | "verifiable_credential" | "mdl" | "idv" | "webauthn" | "siwe" | "none";
+            provider?: string | undefined;
+            credentialType?: string | undefined;
+            issuer?: string | undefined;
+            verificationLevel?: "basic" | "enhanced" | "loa3" | undefined;
+            rpId?: string | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            chainId?: number | undefined;
+            domain?: string | undefined;
+            verifiedAt?: number | undefined;
+        }>>;
+    }, z.ZodTypeAny, "passthrough"> | undefined;
 }>;
 export type DelegationVerificationResult = z.infer<typeof DelegationVerificationResultSchema>;
 /**
@@ -3958,12 +4504,15 @@ export declare function validateDelegationChain(chain: unknown): z.SafeParseRetu
     rootIssuer: string;
     leafSubject: string;
     chain: {
+        issuerDid: string;
+        subjectDid: string;
+        vcId: string;
         status: "active" | "revoked" | "expired";
         constraints: {
-            scopes?: string[] | undefined;
-            audience?: string | string[] | undefined;
             notBefore?: number | undefined;
             notAfter?: number | undefined;
+            scopes?: string[] | undefined;
+            audience?: string | string[] | undefined;
             crisp?: z.objectInputType<{
                 budget: z.ZodOptional<z.ZodObject<{
                     unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -4010,9 +4559,6 @@ export declare function validateDelegationChain(chain: unknown): z.SafeParseRetu
         } & {
             [k: string]: unknown;
         };
-        issuerDid: string;
-        subjectDid: string;
-        vcId: string;
         delegationId: string;
         depth: number;
     }[];
@@ -4023,12 +4569,15 @@ export declare function validateDelegationChain(chain: unknown): z.SafeParseRetu
     rootIssuer: string;
     leafSubject: string;
     chain: {
+        issuerDid: string;
+        subjectDid: string;
+        vcId: string;
         status: "active" | "revoked" | "expired";
         constraints: {
-            scopes?: string[] | undefined;
-            audience?: string | string[] | undefined;
             notBefore?: number | undefined;
             notAfter?: number | undefined;
+            scopes?: string[] | undefined;
+            audience?: string | string[] | undefined;
             crisp?: z.objectOutputType<{
                 budget: z.ZodOptional<z.ZodObject<{
                     unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -4075,9 +4624,6 @@ export declare function validateDelegationChain(chain: unknown): z.SafeParseRetu
         } & {
             [k: string]: unknown;
         };
-        issuerDid: string;
-        subjectDid: string;
-        vcId: string;
         delegationId: string;
         depth: number;
     }[];
@@ -4134,6 +4680,9 @@ export declare const DELEGATION_CREDENTIAL_CONTEXT: "https://schemas.kya-os.ai/x
  *
  * Per Python POC (Delegation-Service.md:136-146), delegations are issued AS
  * W3C VCs, with the delegation data embedded in the credentialSubject.
+ *
+ * Phase 7 Update: Added userDid, userIdentifier, sessionId, and scopes
+ * to support Agent Shield VC-JWT tokens and MCP session tracking.
  */
 export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
     /** Subject DID (delegatee) */
@@ -4146,6 +4695,38 @@ export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
         issuerDid: z.ZodString;
         /** DID of the delegatee (subject, e.g., agent) */
         subjectDid: z.ZodString;
+        /**
+         * DID of the user who granted the delegation.
+         *
+         * This is the authorizing user's identity. In simple cases, this equals
+         * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+         * of a user), userDid identifies the actual user who consented.
+         *
+         * Required by Agent Shield API for user-scoped delegations.
+         * @see delegationCredentialSchema in agentshield-api/schemas.ts
+         */
+        userDid: z.ZodOptional<z.ZodString>;
+        /**
+         * Human-readable identifier for the user (e.g., email, OAuth subject).
+         *
+         * Used for backward compatibility and display purposes.
+         * Should not be used for cryptographic identity verification.
+         */
+        userIdentifier: z.ZodOptional<z.ZodString>;
+        /**
+         * MCP session ID for session tracking and integration.
+         *
+         * Links the delegation to a specific MCP session, enabling
+         * session-scoped token caching and audit trails.
+         */
+        sessionId: z.ZodOptional<z.ZodString>;
+        /**
+         * Authorized scopes for this delegation.
+         *
+         * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+         * When present, defines what actions the delegatee is authorized to perform.
+         */
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Optional controller (user account ID or DID) */
         controller: z.ZodOptional<z.ZodString>;
         /** Optional parent delegation ID for chain tracking */
@@ -4555,13 +5136,15 @@ export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
         /** Optional metadata */
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     }, "strip", z.ZodTypeAny, {
-        status: "active" | "revoked" | "expired";
         id: string;
+        issuerDid: string;
+        subjectDid: string;
+        status: "active" | "revoked" | "expired";
         constraints: {
-            scopes?: string[] | undefined;
-            audience?: string | string[] | undefined;
             notBefore?: number | undefined;
             notAfter?: number | undefined;
+            scopes?: string[] | undefined;
+            audience?: string | string[] | undefined;
             crisp?: z.objectOutputType<{
                 budget: z.ZodOptional<z.ZodObject<{
                     unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -4608,19 +5191,23 @@ export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
-        issuerDid: string;
-        subjectDid: string;
-        metadata?: Record<string, any> | undefined;
-        createdAt?: number | undefined;
         controller?: string | undefined;
         parentId?: string | undefined;
+        scopes?: string[] | undefined;
+        createdAt?: number | undefined;
+        metadata?: Record<string, any> | undefined;
+        userDid?: string | undefined;
+        userIdentifier?: string | undefined;
+        sessionId?: string | undefined;
     }, {
         id: string;
+        issuerDid: string;
+        subjectDid: string;
         constraints: {
-            scopes?: string[] | undefined;
-            audience?: string | string[] | undefined;
             notBefore?: number | undefined;
             notAfter?: number | undefined;
+            scopes?: string[] | undefined;
+            audience?: string | string[] | undefined;
             crisp?: z.objectInputType<{
                 budget: z.ZodOptional<z.ZodObject<{
                     unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -4667,23 +5254,28 @@ export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
-        issuerDid: string;
-        subjectDid: string;
-        status?: "active" | "revoked" | "expired" | undefined;
-        metadata?: Record<string, any> | undefined;
-        createdAt?: number | undefined;
         controller?: string | undefined;
         parentId?: string | undefined;
+        status?: "active" | "revoked" | "expired" | undefined;
+        scopes?: string[] | undefined;
+        createdAt?: number | undefined;
+        metadata?: Record<string, any> | undefined;
+        userDid?: string | undefined;
+        userIdentifier?: string | undefined;
+        sessionId?: string | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
+    id: string;
     delegation: {
-        status: "active" | "revoked" | "expired";
         id: string;
+        issuerDid: string;
+        subjectDid: string;
+        status: "active" | "revoked" | "expired";
         constraints: {
-            scopes?: string[] | undefined;
-            audience?: string | string[] | undefined;
             notBefore?: number | undefined;
             notAfter?: number | undefined;
+            scopes?: string[] | undefined;
+            audience?: string | string[] | undefined;
             crisp?: z.objectOutputType<{
                 budget: z.ZodOptional<z.ZodObject<{
                     unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -4730,22 +5322,26 @@ export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
-        issuerDid: string;
-        subjectDid: string;
-        metadata?: Record<string, any> | undefined;
-        createdAt?: number | undefined;
         controller?: string | undefined;
         parentId?: string | undefined;
+        scopes?: string[] | undefined;
+        createdAt?: number | undefined;
+        metadata?: Record<string, any> | undefined;
+        userDid?: string | undefined;
+        userIdentifier?: string | undefined;
+        sessionId?: string | undefined;
     };
-    id: string;
 }, {
+    id: string;
     delegation: {
         id: string;
+        issuerDid: string;
+        subjectDid: string;
         constraints: {
-            scopes?: string[] | undefined;
-            audience?: string | string[] | undefined;
             notBefore?: number | undefined;
             notAfter?: number | undefined;
+            scopes?: string[] | undefined;
+            audience?: string | string[] | undefined;
             crisp?: z.objectInputType<{
                 budget: z.ZodOptional<z.ZodObject<{
                     unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -4792,15 +5388,16 @@ export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
-        issuerDid: string;
-        subjectDid: string;
-        status?: "active" | "revoked" | "expired" | undefined;
-        metadata?: Record<string, any> | undefined;
-        createdAt?: number | undefined;
         controller?: string | undefined;
         parentId?: string | undefined;
+        status?: "active" | "revoked" | "expired" | undefined;
+        scopes?: string[] | undefined;
+        createdAt?: number | undefined;
+        metadata?: Record<string, any> | undefined;
+        userDid?: string | undefined;
+        userIdentifier?: string | undefined;
+        sessionId?: string | undefined;
     };
-    id: string;
 }>;
 export type DelegationCredentialSubject = z.infer<typeof DelegationCredentialSubjectSchema>;
 /**
@@ -4851,6 +5448,38 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             issuerDid: z.ZodString;
             /** DID of the delegatee (subject, e.g., agent) */
             subjectDid: z.ZodString;
+            /**
+             * DID of the user who granted the delegation.
+             *
+             * This is the authorizing user's identity. In simple cases, this equals
+             * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+             * of a user), userDid identifies the actual user who consented.
+             *
+             * Required by Agent Shield API for user-scoped delegations.
+             * @see delegationCredentialSchema in agentshield-api/schemas.ts
+             */
+            userDid: z.ZodOptional<z.ZodString>;
+            /**
+             * Human-readable identifier for the user (e.g., email, OAuth subject).
+             *
+             * Used for backward compatibility and display purposes.
+             * Should not be used for cryptographic identity verification.
+             */
+            userIdentifier: z.ZodOptional<z.ZodString>;
+            /**
+             * MCP session ID for session tracking and integration.
+             *
+             * Links the delegation to a specific MCP session, enabling
+             * session-scoped token caching and audit trails.
+             */
+            sessionId: z.ZodOptional<z.ZodString>;
+            /**
+             * Authorized scopes for this delegation.
+             *
+             * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+             * When present, defines what actions the delegatee is authorized to perform.
+             */
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             /** Optional controller (user account ID or DID) */
             controller: z.ZodOptional<z.ZodString>;
             /** Optional parent delegation ID for chain tracking */
@@ -5260,13 +5889,15 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             /** Optional metadata */
             metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
         }, "strip", z.ZodTypeAny, {
-            status: "active" | "revoked" | "expired";
             id: string;
+            issuerDid: string;
+            subjectDid: string;
+            status: "active" | "revoked" | "expired";
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectOutputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -5313,19 +5944,23 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }, {
             id: string;
+            issuerDid: string;
+            subjectDid: string;
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectInputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -5372,23 +6007,28 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            status?: "active" | "revoked" | "expired" | undefined;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
+        id: string;
         delegation: {
-            status: "active" | "revoked" | "expired";
             id: string;
+            issuerDid: string;
+            subjectDid: string;
+            status: "active" | "revoked" | "expired";
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectOutputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -5435,22 +6075,26 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
-        id: string;
     }, {
+        id: string;
         delegation: {
             id: string;
+            issuerDid: string;
+            subjectDid: string;
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectInputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -5497,15 +6141,16 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            status?: "active" | "revoked" | "expired" | undefined;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
-        id: string;
     }>;
     credentialStatus: z.ZodOptional<z.ZodObject<{
         id: z.ZodString;
@@ -5514,14 +6159,14 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
         statusListIndex: z.ZodString;
         statusListCredential: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        type: "StatusList2021Entry";
         id: string;
+        type: "StatusList2021Entry";
         statusPurpose: "revocation" | "suspension";
         statusListIndex: string;
         statusListCredential: string;
     }, {
-        type: "StatusList2021Entry";
         id: string;
+        type: "StatusList2021Entry";
         statusPurpose: "revocation" | "suspension";
         statusListIndex: string;
         statusListCredential: string;
@@ -5567,6 +6212,38 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             issuerDid: z.ZodString;
             /** DID of the delegatee (subject, e.g., agent) */
             subjectDid: z.ZodString;
+            /**
+             * DID of the user who granted the delegation.
+             *
+             * This is the authorizing user's identity. In simple cases, this equals
+             * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+             * of a user), userDid identifies the actual user who consented.
+             *
+             * Required by Agent Shield API for user-scoped delegations.
+             * @see delegationCredentialSchema in agentshield-api/schemas.ts
+             */
+            userDid: z.ZodOptional<z.ZodString>;
+            /**
+             * Human-readable identifier for the user (e.g., email, OAuth subject).
+             *
+             * Used for backward compatibility and display purposes.
+             * Should not be used for cryptographic identity verification.
+             */
+            userIdentifier: z.ZodOptional<z.ZodString>;
+            /**
+             * MCP session ID for session tracking and integration.
+             *
+             * Links the delegation to a specific MCP session, enabling
+             * session-scoped token caching and audit trails.
+             */
+            sessionId: z.ZodOptional<z.ZodString>;
+            /**
+             * Authorized scopes for this delegation.
+             *
+             * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+             * When present, defines what actions the delegatee is authorized to perform.
+             */
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             /** Optional controller (user account ID or DID) */
             controller: z.ZodOptional<z.ZodString>;
             /** Optional parent delegation ID for chain tracking */
@@ -5976,13 +6653,15 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             /** Optional metadata */
             metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
         }, "strip", z.ZodTypeAny, {
-            status: "active" | "revoked" | "expired";
             id: string;
+            issuerDid: string;
+            subjectDid: string;
+            status: "active" | "revoked" | "expired";
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectOutputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -6029,19 +6708,23 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }, {
             id: string;
+            issuerDid: string;
+            subjectDid: string;
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectInputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -6088,23 +6771,28 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            status?: "active" | "revoked" | "expired" | undefined;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
+        id: string;
         delegation: {
-            status: "active" | "revoked" | "expired";
             id: string;
+            issuerDid: string;
+            subjectDid: string;
+            status: "active" | "revoked" | "expired";
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectOutputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -6151,22 +6839,26 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
-        id: string;
     }, {
+        id: string;
         delegation: {
             id: string;
+            issuerDid: string;
+            subjectDid: string;
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectInputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -6213,15 +6905,16 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            status?: "active" | "revoked" | "expired" | undefined;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
-        id: string;
     }>;
     credentialStatus: z.ZodOptional<z.ZodObject<{
         id: z.ZodString;
@@ -6230,14 +6923,14 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
         statusListIndex: z.ZodString;
         statusListCredential: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        type: "StatusList2021Entry";
         id: string;
+        type: "StatusList2021Entry";
         statusPurpose: "revocation" | "suspension";
         statusListIndex: string;
         statusListCredential: string;
     }, {
-        type: "StatusList2021Entry";
         id: string;
+        type: "StatusList2021Entry";
         statusPurpose: "revocation" | "suspension";
         statusListIndex: string;
         statusListCredential: string;
@@ -6283,6 +6976,38 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             issuerDid: z.ZodString;
             /** DID of the delegatee (subject, e.g., agent) */
             subjectDid: z.ZodString;
+            /**
+             * DID of the user who granted the delegation.
+             *
+             * This is the authorizing user's identity. In simple cases, this equals
+             * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+             * of a user), userDid identifies the actual user who consented.
+             *
+             * Required by Agent Shield API for user-scoped delegations.
+             * @see delegationCredentialSchema in agentshield-api/schemas.ts
+             */
+            userDid: z.ZodOptional<z.ZodString>;
+            /**
+             * Human-readable identifier for the user (e.g., email, OAuth subject).
+             *
+             * Used for backward compatibility and display purposes.
+             * Should not be used for cryptographic identity verification.
+             */
+            userIdentifier: z.ZodOptional<z.ZodString>;
+            /**
+             * MCP session ID for session tracking and integration.
+             *
+             * Links the delegation to a specific MCP session, enabling
+             * session-scoped token caching and audit trails.
+             */
+            sessionId: z.ZodOptional<z.ZodString>;
+            /**
+             * Authorized scopes for this delegation.
+             *
+             * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+             * When present, defines what actions the delegatee is authorized to perform.
+             */
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             /** Optional controller (user account ID or DID) */
             controller: z.ZodOptional<z.ZodString>;
             /** Optional parent delegation ID for chain tracking */
@@ -6692,13 +7417,15 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             /** Optional metadata */
             metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
         }, "strip", z.ZodTypeAny, {
-            status: "active" | "revoked" | "expired";
             id: string;
+            issuerDid: string;
+            subjectDid: string;
+            status: "active" | "revoked" | "expired";
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectOutputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -6745,19 +7472,23 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }, {
             id: string;
+            issuerDid: string;
+            subjectDid: string;
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectInputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -6804,23 +7535,28 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            status?: "active" | "revoked" | "expired" | undefined;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
+        id: string;
         delegation: {
-            status: "active" | "revoked" | "expired";
             id: string;
+            issuerDid: string;
+            subjectDid: string;
+            status: "active" | "revoked" | "expired";
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectOutputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -6867,22 +7603,26 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
-        id: string;
     }, {
+        id: string;
         delegation: {
             id: string;
+            issuerDid: string;
+            subjectDid: string;
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectInputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -6929,15 +7669,16 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            status?: "active" | "revoked" | "expired" | undefined;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
-        id: string;
     }>;
     credentialStatus: z.ZodOptional<z.ZodObject<{
         id: z.ZodString;
@@ -6946,14 +7687,14 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
         statusListIndex: z.ZodString;
         statusListCredential: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        type: "StatusList2021Entry";
         id: string;
+        type: "StatusList2021Entry";
         statusPurpose: "revocation" | "suspension";
         statusListIndex: string;
         statusListCredential: string;
     }, {
-        type: "StatusList2021Entry";
         id: string;
+        type: "StatusList2021Entry";
         statusPurpose: "revocation" | "suspension";
         statusListIndex: string;
         statusListCredential: string;
@@ -7007,6 +7748,38 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             issuerDid: z.ZodString;
             /** DID of the delegatee (subject, e.g., agent) */
             subjectDid: z.ZodString;
+            /**
+             * DID of the user who granted the delegation.
+             *
+             * This is the authorizing user's identity. In simple cases, this equals
+             * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+             * of a user), userDid identifies the actual user who consented.
+             *
+             * Required by Agent Shield API for user-scoped delegations.
+             * @see delegationCredentialSchema in agentshield-api/schemas.ts
+             */
+            userDid: z.ZodOptional<z.ZodString>;
+            /**
+             * Human-readable identifier for the user (e.g., email, OAuth subject).
+             *
+             * Used for backward compatibility and display purposes.
+             * Should not be used for cryptographic identity verification.
+             */
+            userIdentifier: z.ZodOptional<z.ZodString>;
+            /**
+             * MCP session ID for session tracking and integration.
+             *
+             * Links the delegation to a specific MCP session, enabling
+             * session-scoped token caching and audit trails.
+             */
+            sessionId: z.ZodOptional<z.ZodString>;
+            /**
+             * Authorized scopes for this delegation.
+             *
+             * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+             * When present, defines what actions the delegatee is authorized to perform.
+             */
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             /** Optional controller (user account ID or DID) */
             controller: z.ZodOptional<z.ZodString>;
             /** Optional parent delegation ID for chain tracking */
@@ -7416,13 +8189,15 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             /** Optional metadata */
             metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
         }, "strip", z.ZodTypeAny, {
-            status: "active" | "revoked" | "expired";
             id: string;
+            issuerDid: string;
+            subjectDid: string;
+            status: "active" | "revoked" | "expired";
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectOutputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -7469,19 +8244,23 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }, {
             id: string;
+            issuerDid: string;
+            subjectDid: string;
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectInputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -7528,23 +8307,28 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            status?: "active" | "revoked" | "expired" | undefined;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
+        id: string;
         delegation: {
-            status: "active" | "revoked" | "expired";
             id: string;
+            issuerDid: string;
+            subjectDid: string;
+            status: "active" | "revoked" | "expired";
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectOutputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -7591,22 +8375,26 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
-        id: string;
     }, {
+        id: string;
         delegation: {
             id: string;
+            issuerDid: string;
+            subjectDid: string;
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectInputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -7653,15 +8441,16 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            status?: "active" | "revoked" | "expired" | undefined;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
-        id: string;
     }>;
     credentialStatus: z.ZodOptional<z.ZodObject<{
         id: z.ZodString;
@@ -7670,14 +8459,14 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
         statusListIndex: z.ZodString;
         statusListCredential: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        type: "StatusList2021Entry";
         id: string;
+        type: "StatusList2021Entry";
         statusPurpose: "revocation" | "suspension";
         statusListIndex: string;
         statusListCredential: string;
     }, {
-        type: "StatusList2021Entry";
         id: string;
+        type: "StatusList2021Entry";
         statusPurpose: "revocation" | "suspension";
         statusListIndex: string;
         statusListCredential: string;
@@ -7723,6 +8512,38 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             issuerDid: z.ZodString;
             /** DID of the delegatee (subject, e.g., agent) */
             subjectDid: z.ZodString;
+            /**
+             * DID of the user who granted the delegation.
+             *
+             * This is the authorizing user's identity. In simple cases, this equals
+             * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+             * of a user), userDid identifies the actual user who consented.
+             *
+             * Required by Agent Shield API for user-scoped delegations.
+             * @see delegationCredentialSchema in agentshield-api/schemas.ts
+             */
+            userDid: z.ZodOptional<z.ZodString>;
+            /**
+             * Human-readable identifier for the user (e.g., email, OAuth subject).
+             *
+             * Used for backward compatibility and display purposes.
+             * Should not be used for cryptographic identity verification.
+             */
+            userIdentifier: z.ZodOptional<z.ZodString>;
+            /**
+             * MCP session ID for session tracking and integration.
+             *
+             * Links the delegation to a specific MCP session, enabling
+             * session-scoped token caching and audit trails.
+             */
+            sessionId: z.ZodOptional<z.ZodString>;
+            /**
+             * Authorized scopes for this delegation.
+             *
+             * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+             * When present, defines what actions the delegatee is authorized to perform.
+             */
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             /** Optional controller (user account ID or DID) */
             controller: z.ZodOptional<z.ZodString>;
             /** Optional parent delegation ID for chain tracking */
@@ -8132,13 +8953,15 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             /** Optional metadata */
             metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
         }, "strip", z.ZodTypeAny, {
-            status: "active" | "revoked" | "expired";
             id: string;
+            issuerDid: string;
+            subjectDid: string;
+            status: "active" | "revoked" | "expired";
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectOutputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -8185,19 +9008,23 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }, {
             id: string;
+            issuerDid: string;
+            subjectDid: string;
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectInputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -8244,23 +9071,28 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            status?: "active" | "revoked" | "expired" | undefined;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
+        id: string;
         delegation: {
-            status: "active" | "revoked" | "expired";
             id: string;
+            issuerDid: string;
+            subjectDid: string;
+            status: "active" | "revoked" | "expired";
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectOutputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -8307,22 +9139,26 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
-        id: string;
     }, {
+        id: string;
         delegation: {
             id: string;
+            issuerDid: string;
+            subjectDid: string;
             constraints: {
-                scopes?: string[] | undefined;
-                audience?: string | string[] | undefined;
                 notBefore?: number | undefined;
                 notAfter?: number | undefined;
+                scopes?: string[] | undefined;
+                audience?: string | string[] | undefined;
                 crisp?: z.objectInputType<{
                     budget: z.ZodOptional<z.ZodObject<{
                         unit: z.ZodEnum<["USD", "ops", "points"]>;
@@ -8369,15 +9205,16 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             } & {
                 [k: string]: unknown;
             };
-            issuerDid: string;
-            subjectDid: string;
-            status?: "active" | "revoked" | "expired" | undefined;
-            metadata?: Record<string, any> | undefined;
-            createdAt?: number | undefined;
             controller?: string | undefined;
             parentId?: string | undefined;
+            status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
+            createdAt?: number | undefined;
+            metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
-        id: string;
     }>;
     credentialStatus: z.ZodOptional<z.ZodObject<{
         id: z.ZodString;
@@ -8386,14 +9223,14 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
         statusListIndex: z.ZodString;
         statusListCredential: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        type: "StatusList2021Entry";
         id: string;
+        type: "StatusList2021Entry";
         statusPurpose: "revocation" | "suspension";
         statusListIndex: string;
         statusListCredential: string;
     }, {
-        type: "StatusList2021Entry";
         id: string;
+        type: "StatusList2021Entry";
         statusPurpose: "revocation" | "suspension";
         statusListIndex: string;
         statusListCredential: string;
@@ -8432,7 +9269,7 @@ export declare function extractDelegationFromVC(vc: DelegationCredential): Deleg
  * The caller must sign this to create a valid DelegationCredential.
  *
  * @param delegation - The delegation record
- * @param options - Optional VC options (id, issuanceDate, etc.)
+ * @param options - Optional VC options (id, issuanceDate, userDid, sessionId, etc.)
  * @returns Unsigned DelegationCredential
  */
 export declare function wrapDelegationAsVC(delegation: DelegationRecord, options?: {
@@ -8440,6 +9277,14 @@ export declare function wrapDelegationAsVC(delegation: DelegationRecord, options
     issuanceDate?: string;
     expirationDate?: string;
     credentialStatus?: z.infer<typeof CredentialStatusSchema>;
+    /** User DID who granted the delegation (if different from issuer) */
+    userDid?: string;
+    /** Human-readable user identifier */
+    userIdentifier?: string;
+    /** MCP session ID for session tracking */
+    sessionId?: string;
+    /** Authorized scopes */
+    scopes?: string[];
 }): Omit<DelegationCredential, 'proof'>;
 /**
  * Check if a delegation credential is expired