@kya-os/contracts 1.7.16 → 1.7.18

package/dist/delegation/schemas.js

@@ -322,6 +322,9 @@ exports.DELEGATION_CREDENTIAL_CONTEXT = 'https://schemas.kya-os.ai/xmcp-i/creden
  *
  * Per Python POC (Delegation-Service.md:136-146), delegations are issued AS
  * W3C VCs, with the delegation data embedded in the credentialSubject.
+ *
+ * Phase 7 Update: Added userDid, userIdentifier, sessionId, and scopes
+ * to support Agent Shield VC-JWT tokens and MCP session tracking.
  */
 exports.DelegationCredentialSubjectSchema = zod_1.z.object({
     /** Subject DID (delegatee) */
@@ -334,6 +337,38 @@ exports.DelegationCredentialSubjectSchema = zod_1.z.object({
         issuerDid: zod_1.z.string().min(1),
         /** DID of the delegatee (subject, e.g., agent) */
         subjectDid: zod_1.z.string().min(1),
+        /**
+         * DID of the user who granted the delegation.
+         *
+         * This is the authorizing user's identity. In simple cases, this equals
+         * issuerDid. In delegated scenarios (e.g., AgentShield issuing on behalf
+         * of a user), userDid identifies the actual user who consented.
+         *
+         * Required by Agent Shield API for user-scoped delegations.
+         * @see delegationCredentialSchema in agentshield-api/schemas.ts
+         */
+        userDid: zod_1.z.string().optional(),
+        /**
+         * Human-readable identifier for the user (e.g., email, OAuth subject).
+         *
+         * Used for backward compatibility and display purposes.
+         * Should not be used for cryptographic identity verification.
+         */
+        userIdentifier: zod_1.z.string().optional(),
+        /**
+         * MCP session ID for session tracking and integration.
+         *
+         * Links the delegation to a specific MCP session, enabling
+         * session-scoped token caching and audit trails.
+         */
+        sessionId: zod_1.z.string().optional(),
+        /**
+         * Authorized scopes for this delegation.
+         *
+         * Array of scope strings (e.g., ['tool:execute', 'resource:read']).
+         * When present, defines what actions the delegatee is authorized to perform.
+         */
+        scopes: zod_1.z.array(zod_1.z.string()).optional(),
         /** Optional controller (user account ID or DID) */
         controller: zod_1.z.string().optional(),
         /** Optional parent delegation ID for chain tracking */
@@ -456,7 +491,7 @@ function extractDelegationFromVC(vc) {
  * The caller must sign this to create a valid DelegationCredential.
  *
  * @param delegation - The delegation record
- * @param options - Optional VC options (id, issuanceDate, etc.)
+ * @param options - Optional VC options (id, issuanceDate, userDid, sessionId, etc.)
  * @returns Unsigned DelegationCredential
  */
 function wrapDelegationAsVC(delegation, options) {
@@ -469,6 +504,8 @@ function wrapDelegationAsVC(delegation, options) {
     if (!options?.issuanceDate && delegation.createdAt) {
         issuanceDate = new Date(delegation.createdAt).toISOString();
     }
+    // Extract scopes from constraints if not provided
+    const scopes = options?.scopes || delegation.constraints.scopes;
     return {
         '@context': [
             'https://www.w3.org/2018/credentials/v1',
@@ -485,6 +522,14 @@ function wrapDelegationAsVC(delegation, options) {
                 id: delegation.id,
                 issuerDid: delegation.issuerDid,
                 subjectDid: delegation.subjectDid,
+                // Include userDid if provided or fallback to controller
+                ...(options?.userDid && { userDid: options.userDid }),
+                // Include userIdentifier if provided
+                ...(options?.userIdentifier && { userIdentifier: options.userIdentifier }),
+                // Include sessionId if provided
+                ...(options?.sessionId && { sessionId: options.sessionId }),
+                // Include scopes if available
+                ...(scopes && scopes.length > 0 && { scopes }),
                 controller: delegation.controller,
                 parentId: delegation.parentId,
                 constraints: delegation.constraints,

package/dist/handshake.js

@@ -2,7 +2,16 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NONCE_LENGTH_BYTES = exports.DEFAULT_TIMESTAMP_SKEW_SECONDS = exports.DEFAULT_SESSION_TTL_MINUTES = exports.NonceCacheConfigSchema = exports.NonceCacheEntrySchema = exports.SessionContextSchema = exports.HandshakeRequestSchema = exports.MCPClientSessionInfoSchema = exports.MCPClientInfoSchema = exports.SessionIdentityStateSchema = void 0;
 const zod_1 = require("zod");
-const consent_1 = require("./consent");
+/**
+ * OAuth Identity schema (inlined to avoid ESM/CJS boundary issues with @kya-os/consent)
+ * This is a copy of OAuthIdentitySchema from @kya-os/consent for use in handshake types.
+ */
+const oauthIdentitySchema = zod_1.z.object({
+    provider: zod_1.z.string().min(1).max(50),
+    subject: zod_1.z.string().min(1).max(255),
+    email: zod_1.z.string().email().max(255).optional(),
+    name: zod_1.z.string().max(255).optional(),
+});
 /**
  * Handshake and session management schemas
  */
@@ -65,7 +74,7 @@ exports.SessionContextSchema = zod_1.z.object({
      * OAuth identity information (populated after successful OAuth)
      * Contains provider, subject, email from OAuth provider
      */
-    oauthIdentity: consent_1.oauthIdentitySchema.optional(),
+    oauthIdentity: oauthIdentitySchema.optional(),
 });
 exports.NonceCacheEntrySchema = zod_1.z.object({
     sessionId: zod_1.z.string().min(1),

package/dist/tool-protection/index.d.ts

@@ -943,12 +943,12 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
         source: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         version?: string | undefined;
-        source?: string | undefined;
         lastUpdated?: string | undefined;
+        source?: string | undefined;
     }, {
         version?: string | undefined;
-        source?: string | undefined;
         lastUpdated?: string | undefined;
+        source?: string | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
     toolProtections: Record<string, {
@@ -997,8 +997,8 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
     }>;
     metadata?: {
         version?: string | undefined;
-        source?: string | undefined;
         lastUpdated?: string | undefined;
+        source?: string | undefined;
     } | undefined;
 }, {
     toolProtections: Record<string, {
@@ -1047,8 +1047,8 @@ export declare const ToolProtectionResponseSchema: z.ZodObject<{
     }>;
     metadata?: {
         version?: string | undefined;
-        source?: string | undefined;
         lastUpdated?: string | undefined;
+        source?: string | undefined;
     } | undefined;
 }>;
 export declare const DelegationRequiredErrorDataSchema: z.ZodObject<{
@@ -1060,15 +1060,15 @@ export declare const DelegationRequiredErrorDataSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     requiredScopes: string[];
     toolName: string;
+    authorizationUrl?: string | undefined;
     reason?: string | undefined;
     consentUrl?: string | undefined;
-    authorizationUrl?: string | undefined;
 }, {
     requiredScopes: string[];
     toolName: string;
+    authorizationUrl?: string | undefined;
     reason?: string | undefined;
     consentUrl?: string | undefined;
-    authorizationUrl?: string | undefined;
 }>;
 /**
  * Type Guards

package/dist/tool-protection/index.js

@@ -352,20 +352,23 @@ function getAuthorizationTypeKey(auth) {
     switch (auth.type) {
         case 'oauth':
             // Keep original key format for backward compatibility with existing cache entries
-            return `oauth:${auth.provider}`;
+            // Handle undefined provider gracefully (may come from loose API response types)
+            return auth.provider ? `oauth:${auth.provider}` : 'oauth';
         case 'oauth2':
-            return `oauth2:${auth.provider}`;
+            return auth.provider ? `oauth2:${auth.provider}` : 'oauth2';
         case 'password':
-            return `password:${auth.provider}`;
+            return auth.provider ? `password:${auth.provider}` : 'password';
         case 'mdl':
-            return `mdl:${auth.issuer}:${auth.credentialType || ''}`;
+            // Keep trailing colon for backward compatibility with existing cache entries
+            return `mdl:${auth.issuer || 'unknown'}:${auth.credentialType || ''}`;
         case 'idv':
-            return `idv:${auth.provider}:${auth.verificationLevel || ''}`;
+            // Keep trailing colon for backward compatibility with existing cache entries
+            return `idv:${auth.provider || 'unknown'}:${auth.verificationLevel || ''}`;
         case 'verifiable_credential':
-            return `vc:${auth.issuer || 'any'}:${auth.credentialType}`;
+            return `vc:${auth.issuer || 'any'}:${auth.credentialType || 'unknown'}`;
         case 'credential':
             // Deprecated: treat as verifiable_credential
-            return `vc:${auth.issuer || 'any'}:${auth.credentialType}`;
+            return `vc:${auth.issuer || 'any'}:${auth.credentialType || 'unknown'}`;
         case 'webauthn':
             return `webauthn:${auth.rpId || 'default'}`;
         case 'siwe':

package/dist/verifier.d.ts

@@ -20,8 +20,8 @@ export declare const AgentContextSchema: z.ZodObject<{
     confidence: "verified";
     registry: string;
     verifiedAt: number;
-    delegationRef?: string | undefined;
     subject?: string | undefined;
+    delegationRef?: string | undefined;
 }, {
     did: string;
     kid: string;
@@ -30,8 +30,8 @@ export declare const AgentContextSchema: z.ZodObject<{
     registry: string;
     verifiedAt: number;
     scopes?: string[] | undefined;
-    delegationRef?: string | undefined;
     subject?: string | undefined;
+    delegationRef?: string | undefined;
 }>;
 export declare const VerifierResultSchema: z.ZodObject<{
     success: z.ZodBoolean;
@@ -54,8 +54,8 @@ export declare const VerifierResultSchema: z.ZodObject<{
         confidence: "verified";
         registry: string;
         verifiedAt: number;
-        delegationRef?: string | undefined;
         subject?: string | undefined;
+        delegationRef?: string | undefined;
     }, {
         did: string;
         kid: string;
@@ -64,8 +64,8 @@ export declare const VerifierResultSchema: z.ZodObject<{
         registry: string;
         verifiedAt: number;
         scopes?: string[] | undefined;
-        delegationRef?: string | undefined;
         subject?: string | undefined;
+        delegationRef?: string | undefined;
     }>>;
     error: z.ZodOptional<z.ZodObject<{
         code: z.ZodString;
@@ -100,8 +100,8 @@ export declare const VerifierResultSchema: z.ZodObject<{
         confidence: "verified";
         registry: string;
         verifiedAt: number;
-        delegationRef?: string | undefined;
         subject?: string | undefined;
+        delegationRef?: string | undefined;
     } | undefined;
 }, {
     success: boolean;
@@ -120,8 +120,8 @@ export declare const VerifierResultSchema: z.ZodObject<{
         registry: string;
         verifiedAt: number;
         scopes?: string[] | undefined;
-        delegationRef?: string | undefined;
         subject?: string | undefined;
+        delegationRef?: string | undefined;
     } | undefined;
 }>;
 export declare const StructuredErrorSchema: z.ZodObject<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/contracts",
-  "version": "1.7.16",
+  "version": "1.7.18",
   "description": "Shared contracts, types, and schemas for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -95,7 +95,7 @@
   },
   "sideEffects": false,
   "dependencies": {
-    "@kya-os/consent": "^0.1.12",
+    "@kya-os/consent": "^0.1.20",
     "zod": "^3.25.76"
   },
   "devDependencies": {