@kya-os/contracts 1.7.16 → 1.7.17

package/dist/delegation/schemas.d.ts

@@ -4680,6 +4680,9 @@ export declare const DELEGATION_CREDENTIAL_CONTEXT: "https://schemas.kya-os.ai/x
  *
  * Per Python POC (Delegation-Service.md:136-146), delegations are issued AS
  * W3C VCs, with the delegation data embedded in the credentialSubject.
+ *
+ * Phase 7 Update: Added userDid, userIdentifier, sessionId, and scopes
+ * to support Agent Shield VC-JWT tokens and MCP session tracking.
  */
 export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
     /** Subject DID (delegatee) */
@@ -4692,6 +4695,38 @@ export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
         issuerDid: z.ZodString;
         /** DID of the delegatee (subject, e.g., agent) */
         subjectDid: z.ZodString;
+        /**
+         * DID of the user who granted the delegation.
+         *
+         * This is the authorizing user's identity. In simple cases, this equals
+         * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+         * of a user), userDid identifies the actual user who consented.
+         *
+         * Required by Agent Shield API for user-scoped delegations.
+         * @see delegationCredentialSchema in agentshield-api/schemas.ts
+         */
+        userDid: z.ZodOptional<z.ZodString>;
+        /**
+         * Human-readable identifier for the user (e.g., email, OAuth subject).
+         *
+         * Used for backward compatibility and display purposes.
+         * Should not be used for cryptographic identity verification.
+         */
+        userIdentifier: z.ZodOptional<z.ZodString>;
+        /**
+         * MCP session ID for session tracking and integration.
+         *
+         * Links the delegation to a specific MCP session, enabling
+         * session-scoped token caching and audit trails.
+         */
+        sessionId: z.ZodOptional<z.ZodString>;
+        /**
+         * Authorized scopes for this delegation.
+         *
+         * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+         * When present, defines what actions the delegatee is authorized to perform.
+         */
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Optional controller (user account ID or DID) */
         controller: z.ZodOptional<z.ZodString>;
         /** Optional parent delegation ID for chain tracking */
@@ -5158,8 +5193,12 @@ export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
         };
         controller?: string | undefined;
         parentId?: string | undefined;
+        scopes?: string[] | undefined;
         createdAt?: number | undefined;
         metadata?: Record<string, any> | undefined;
+        userDid?: string | undefined;
+        userIdentifier?: string | undefined;
+        sessionId?: string | undefined;
     }, {
         id: string;
         issuerDid: string;
@@ -5218,8 +5257,12 @@ export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
         controller?: string | undefined;
         parentId?: string | undefined;
         status?: "active" | "revoked" | "expired" | undefined;
+        scopes?: string[] | undefined;
         createdAt?: number | undefined;
         metadata?: Record<string, any> | undefined;
+        userDid?: string | undefined;
+        userIdentifier?: string | undefined;
+        sessionId?: string | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
     id: string;
@@ -5281,8 +5324,12 @@ export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
         };
         controller?: string | undefined;
         parentId?: string | undefined;
+        scopes?: string[] | undefined;
         createdAt?: number | undefined;
         metadata?: Record<string, any> | undefined;
+        userDid?: string | undefined;
+        userIdentifier?: string | undefined;
+        sessionId?: string | undefined;
     };
 }, {
     id: string;
@@ -5344,8 +5391,12 @@ export declare const DelegationCredentialSubjectSchema: z.ZodObject<{
         controller?: string | undefined;
         parentId?: string | undefined;
         status?: "active" | "revoked" | "expired" | undefined;
+        scopes?: string[] | undefined;
         createdAt?: number | undefined;
         metadata?: Record<string, any> | undefined;
+        userDid?: string | undefined;
+        userIdentifier?: string | undefined;
+        sessionId?: string | undefined;
     };
 }>;
 export type DelegationCredentialSubject = z.infer<typeof DelegationCredentialSubjectSchema>;
@@ -5397,6 +5448,38 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             issuerDid: z.ZodString;
             /** DID of the delegatee (subject, e.g., agent) */
             subjectDid: z.ZodString;
+            /**
+             * DID of the user who granted the delegation.
+             *
+             * This is the authorizing user's identity. In simple cases, this equals
+             * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+             * of a user), userDid identifies the actual user who consented.
+             *
+             * Required by Agent Shield API for user-scoped delegations.
+             * @see delegationCredentialSchema in agentshield-api/schemas.ts
+             */
+            userDid: z.ZodOptional<z.ZodString>;
+            /**
+             * Human-readable identifier for the user (e.g., email, OAuth subject).
+             *
+             * Used for backward compatibility and display purposes.
+             * Should not be used for cryptographic identity verification.
+             */
+            userIdentifier: z.ZodOptional<z.ZodString>;
+            /**
+             * MCP session ID for session tracking and integration.
+             *
+             * Links the delegation to a specific MCP session, enabling
+             * session-scoped token caching and audit trails.
+             */
+            sessionId: z.ZodOptional<z.ZodString>;
+            /**
+             * Authorized scopes for this delegation.
+             *
+             * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+             * When present, defines what actions the delegatee is authorized to perform.
+             */
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             /** Optional controller (user account ID or DID) */
             controller: z.ZodOptional<z.ZodString>;
             /** Optional parent delegation ID for chain tracking */
@@ -5863,8 +5946,12 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             };
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }, {
             id: string;
             issuerDid: string;
@@ -5923,8 +6010,12 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             controller?: string | undefined;
             parentId?: string | undefined;
             status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
         id: string;
@@ -5986,8 +6077,12 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             };
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
     }, {
         id: string;
@@ -6049,8 +6144,12 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             controller?: string | undefined;
             parentId?: string | undefined;
             status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
     }>;
     credentialStatus: z.ZodOptional<z.ZodObject<{
@@ -6113,6 +6212,38 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             issuerDid: z.ZodString;
             /** DID of the delegatee (subject, e.g., agent) */
             subjectDid: z.ZodString;
+            /**
+             * DID of the user who granted the delegation.
+             *
+             * This is the authorizing user's identity. In simple cases, this equals
+             * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+             * of a user), userDid identifies the actual user who consented.
+             *
+             * Required by Agent Shield API for user-scoped delegations.
+             * @see delegationCredentialSchema in agentshield-api/schemas.ts
+             */
+            userDid: z.ZodOptional<z.ZodString>;
+            /**
+             * Human-readable identifier for the user (e.g., email, OAuth subject).
+             *
+             * Used for backward compatibility and display purposes.
+             * Should not be used for cryptographic identity verification.
+             */
+            userIdentifier: z.ZodOptional<z.ZodString>;
+            /**
+             * MCP session ID for session tracking and integration.
+             *
+             * Links the delegation to a specific MCP session, enabling
+             * session-scoped token caching and audit trails.
+             */
+            sessionId: z.ZodOptional<z.ZodString>;
+            /**
+             * Authorized scopes for this delegation.
+             *
+             * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+             * When present, defines what actions the delegatee is authorized to perform.
+             */
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             /** Optional controller (user account ID or DID) */
             controller: z.ZodOptional<z.ZodString>;
             /** Optional parent delegation ID for chain tracking */
@@ -6579,8 +6710,12 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             };
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }, {
             id: string;
             issuerDid: string;
@@ -6639,8 +6774,12 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             controller?: string | undefined;
             parentId?: string | undefined;
             status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
         id: string;
@@ -6702,8 +6841,12 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             };
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
     }, {
         id: string;
@@ -6765,8 +6908,12 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             controller?: string | undefined;
             parentId?: string | undefined;
             status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
     }>;
     credentialStatus: z.ZodOptional<z.ZodObject<{
@@ -6829,6 +6976,38 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             issuerDid: z.ZodString;
             /** DID of the delegatee (subject, e.g., agent) */
             subjectDid: z.ZodString;
+            /**
+             * DID of the user who granted the delegation.
+             *
+             * This is the authorizing user's identity. In simple cases, this equals
+             * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+             * of a user), userDid identifies the actual user who consented.
+             *
+             * Required by Agent Shield API for user-scoped delegations.
+             * @see delegationCredentialSchema in agentshield-api/schemas.ts
+             */
+            userDid: z.ZodOptional<z.ZodString>;
+            /**
+             * Human-readable identifier for the user (e.g., email, OAuth subject).
+             *
+             * Used for backward compatibility and display purposes.
+             * Should not be used for cryptographic identity verification.
+             */
+            userIdentifier: z.ZodOptional<z.ZodString>;
+            /**
+             * MCP session ID for session tracking and integration.
+             *
+             * Links the delegation to a specific MCP session, enabling
+             * session-scoped token caching and audit trails.
+             */
+            sessionId: z.ZodOptional<z.ZodString>;
+            /**
+             * Authorized scopes for this delegation.
+             *
+             * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+             * When present, defines what actions the delegatee is authorized to perform.
+             */
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             /** Optional controller (user account ID or DID) */
             controller: z.ZodOptional<z.ZodString>;
             /** Optional parent delegation ID for chain tracking */
@@ -7295,8 +7474,12 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             };
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }, {
             id: string;
             issuerDid: string;
@@ -7355,8 +7538,12 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             controller?: string | undefined;
             parentId?: string | undefined;
             status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
         id: string;
@@ -7418,8 +7605,12 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             };
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
     }, {
         id: string;
@@ -7481,8 +7672,12 @@ export declare const DelegationCredentialSchema: z.ZodObject<{
             controller?: string | undefined;
             parentId?: string | undefined;
             status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
     }>;
     credentialStatus: z.ZodOptional<z.ZodObject<{
@@ -7553,6 +7748,38 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             issuerDid: z.ZodString;
             /** DID of the delegatee (subject, e.g., agent) */
             subjectDid: z.ZodString;
+            /**
+             * DID of the user who granted the delegation.
+             *
+             * This is the authorizing user's identity. In simple cases, this equals
+             * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+             * of a user), userDid identifies the actual user who consented.
+             *
+             * Required by Agent Shield API for user-scoped delegations.
+             * @see delegationCredentialSchema in agentshield-api/schemas.ts
+             */
+            userDid: z.ZodOptional<z.ZodString>;
+            /**
+             * Human-readable identifier for the user (e.g., email, OAuth subject).
+             *
+             * Used for backward compatibility and display purposes.
+             * Should not be used for cryptographic identity verification.
+             */
+            userIdentifier: z.ZodOptional<z.ZodString>;
+            /**
+             * MCP session ID for session tracking and integration.
+             *
+             * Links the delegation to a specific MCP session, enabling
+             * session-scoped token caching and audit trails.
+             */
+            sessionId: z.ZodOptional<z.ZodString>;
+            /**
+             * Authorized scopes for this delegation.
+             *
+             * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+             * When present, defines what actions the delegatee is authorized to perform.
+             */
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             /** Optional controller (user account ID or DID) */
             controller: z.ZodOptional<z.ZodString>;
             /** Optional parent delegation ID for chain tracking */
@@ -8019,8 +8246,12 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             };
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }, {
             id: string;
             issuerDid: string;
@@ -8079,8 +8310,12 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             controller?: string | undefined;
             parentId?: string | undefined;
             status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
         id: string;
@@ -8142,8 +8377,12 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             };
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
     }, {
         id: string;
@@ -8205,8 +8444,12 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             controller?: string | undefined;
             parentId?: string | undefined;
             status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
     }>;
     credentialStatus: z.ZodOptional<z.ZodObject<{
@@ -8269,6 +8512,38 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             issuerDid: z.ZodString;
             /** DID of the delegatee (subject, e.g., agent) */
             subjectDid: z.ZodString;
+            /**
+             * DID of the user who granted the delegation.
+             *
+             * This is the authorizing user's identity. In simple cases, this equals
+             * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+             * of a user), userDid identifies the actual user who consented.
+             *
+             * Required by Agent Shield API for user-scoped delegations.
+             * @see delegationCredentialSchema in agentshield-api/schemas.ts
+             */
+            userDid: z.ZodOptional<z.ZodString>;
+            /**
+             * Human-readable identifier for the user (e.g., email, OAuth subject).
+             *
+             * Used for backward compatibility and display purposes.
+             * Should not be used for cryptographic identity verification.
+             */
+            userIdentifier: z.ZodOptional<z.ZodString>;
+            /**
+             * MCP session ID for session tracking and integration.
+             *
+             * Links the delegation to a specific MCP session, enabling
+             * session-scoped token caching and audit trails.
+             */
+            sessionId: z.ZodOptional<z.ZodString>;
+            /**
+             * Authorized scopes for this delegation.
+             *
+             * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+             * When present, defines what actions the delegatee is authorized to perform.
+             */
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             /** Optional controller (user account ID or DID) */
             controller: z.ZodOptional<z.ZodString>;
             /** Optional parent delegation ID for chain tracking */
@@ -8735,8 +9010,12 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             };
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }, {
             id: string;
             issuerDid: string;
@@ -8795,8 +9074,12 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             controller?: string | undefined;
             parentId?: string | undefined;
             status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
         id: string;
@@ -8858,8 +9141,12 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             };
             controller?: string | undefined;
             parentId?: string | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
     }, {
         id: string;
@@ -8921,8 +9208,12 @@ export declare function validateDelegationCredential(credential: unknown): z.Saf
             controller?: string | undefined;
             parentId?: string | undefined;
             status?: "active" | "revoked" | "expired" | undefined;
+            scopes?: string[] | undefined;
             createdAt?: number | undefined;
             metadata?: Record<string, any> | undefined;
+            userDid?: string | undefined;
+            userIdentifier?: string | undefined;
+            sessionId?: string | undefined;
         };
     }>;
     credentialStatus: z.ZodOptional<z.ZodObject<{
@@ -8978,7 +9269,7 @@ export declare function extractDelegationFromVC(vc: DelegationCredential): Deleg
  * The caller must sign this to create a valid DelegationCredential.
  *
  * @param delegation - The delegation record
- * @param options - Optional VC options (id, issuanceDate, etc.)
+ * @param options - Optional VC options (id, issuanceDate, userDid, sessionId, etc.)
  * @returns Unsigned DelegationCredential
  */
 export declare function wrapDelegationAsVC(delegation: DelegationRecord, options?: {
@@ -8986,6 +9277,14 @@ export declare function wrapDelegationAsVC(delegation: DelegationRecord, options
     issuanceDate?: string;
     expirationDate?: string;
     credentialStatus?: z.infer<typeof CredentialStatusSchema>;
+    /** User DID who granted the delegation (if different from issuer) */
+    userDid?: string;
+    /** Human-readable user identifier */
+    userIdentifier?: string;
+    /** MCP session ID for session tracking */
+    sessionId?: string;
+    /** Authorized scopes */
+    scopes?: string[];
 }): Omit<DelegationCredential, 'proof'>;
 /**
  * Check if a delegation credential is expired

package/dist/delegation/schemas.js

@@ -322,6 +322,9 @@ exports.DELEGATION_CREDENTIAL_CONTEXT = 'https://schemas.kya-os.ai/xmcp-i/creden
  *
  * Per Python POC (Delegation-Service.md:136-146), delegations are issued AS
  * W3C VCs, with the delegation data embedded in the credentialSubject.
+ *
+ * Phase 7 Update: Added userDid, userIdentifier, sessionId, and scopes
+ * to support Agent Shield VC-JWT tokens and MCP session tracking.
  */
 exports.DelegationCredentialSubjectSchema = zod_1.z.object({
     /** Subject DID (delegatee) */
@@ -334,6 +337,38 @@ exports.DelegationCredentialSubjectSchema = zod_1.z.object({
         issuerDid: zod_1.z.string().min(1),
         /** DID of the delegatee (subject, e.g., agent) */
         subjectDid: zod_1.z.string().min(1),
+        /**
+         * DID of the user who granted the delegation.
+         *
+         * This is the authorizing user's identity. In simple cases, this equals
+         * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+         * of a user), userDid identifies the actual user who consented.
+         *
+         * Required by Agent Shield API for user-scoped delegations.
+         * @see delegationCredentialSchema in agentshield-api/schemas.ts
+         */
+        userDid: zod_1.z.string().optional(),
+        /**
+         * Human-readable identifier for the user (e.g., email, OAuth subject).
+         *
+         * Used for backward compatibility and display purposes.
+         * Should not be used for cryptographic identity verification.
+         */
+        userIdentifier: zod_1.z.string().optional(),
+        /**
+         * MCP session ID for session tracking and integration.
+         *
+         * Links the delegation to a specific MCP session, enabling
+         * session-scoped token caching and audit trails.
+         */
+        sessionId: zod_1.z.string().optional(),
+        /**
+         * Authorized scopes for this delegation.
+         *
+         * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+         * When present, defines what actions the delegatee is authorized to perform.
+         */
+        scopes: zod_1.z.array(zod_1.z.string()).optional(),
         /** Optional controller (user account ID or DID) */
         controller: zod_1.z.string().optional(),
         /** Optional parent delegation ID for chain tracking */
@@ -456,7 +491,7 @@ function extractDelegationFromVC(vc) {
  * The caller must sign this to create a valid DelegationCredential.
  *
  * @param delegation - The delegation record
- * @param options - Optional VC options (id, issuanceDate, etc.)
+ * @param options - Optional VC options (id, issuanceDate, userDid, sessionId, etc.)
  * @returns Unsigned DelegationCredential
  */
 function wrapDelegationAsVC(delegation, options) {
@@ -469,6 +504,8 @@ function wrapDelegationAsVC(delegation, options) {
     if (!options?.issuanceDate && delegation.createdAt) {
         issuanceDate = new Date(delegation.createdAt).toISOString();
     }
+    // Extract scopes from constraints if not provided
+    const scopes = options?.scopes || delegation.constraints.scopes;
     return {
         '@context': [
             'https://www.w3.org/2018/credentials/v1',
@@ -485,6 +522,14 @@ function wrapDelegationAsVC(delegation, options) {
                 id: delegation.id,
                 issuerDid: delegation.issuerDid,
                 subjectDid: delegation.subjectDid,
+                // Include userDid if provided or fallback to controller
+                ...(options?.userDid && { userDid: options.userDid }),
+                // Include userIdentifier if provided
+                ...(options?.userIdentifier && { userIdentifier: options.userIdentifier }),
+                // Include sessionId if provided
+                ...(options?.sessionId && { sessionId: options.sessionId }),
+                // Include scopes if available
+                ...(scopes && scopes.length > 0 && { scopes }),
                 controller: delegation.controller,
                 parentId: delegation.parentId,
                 constraints: delegation.constraints,