@kya-os/mcp-i-cloudflare 1.6.23-canary.0 → 1.6.24

package/dist/services/consent.service.js

@@ -13,12 +13,12 @@ import { STORAGE_KEYS } from "../constants/storage-keys";
 import { loadDay0Config, getDelegationFieldName } from "../utils/day0-config";
 import { validateConsentApprovalRequest, } from "@kya-os/contracts/consent";
 import { AGENTSHIELD_ENDPOINTS, createDelegationAPIResponseSchema, createDelegationResponseSchema, } from "@kya-os/contracts/agentshield-api";
-import { UserDidManager } from "@kya-os/mcp-i-core";
+import { fetchRemoteConfig, createUnsignedVCJWT, completeVCJWT, parseVCJWT, base64urlEncodeFromBytes, base64urlDecodeToBytes, bytesToBase64, createDelegationVerifier, createDidKeyResolver, } from "@kya-os/mcp-i-core";
+import { wrapDelegationAsVC } from "@kya-os/contracts";
 import { WebCryptoProvider } from "../providers/crypto";
 import { ConsentAuditService } from "./consent-audit.service";
 import { CloudflareProofGenerator } from "../proof-generator";
 import { ProofService } from "./proof.service";
-import { fetchRemoteConfig } from "@kya-os/mcp-i-core";
 export class ConsentService {
     configService;
     renderer;
@@ -195,9 +195,14 @@ export class ConsentService {
      * Public method to retrieve user DID from session storage or OAuth identity mapping.
      * Used by OAuth handler to get userDid when OAuth linking fails.
      *
+     * Phase 5: Anonymous Sessions Until OAuth
+     * - Returns existing DID from OAuth mapping or session storage
+     * - Returns null if no DID found (session is anonymous)
+     * - No ephemeral DID generation
+     *
      * @param sessionId - Session ID
      * @param oauthIdentity - Optional OAuth provider identity
-     * @returns User DID (did:key format)
+     * @returns User DID (did:key format) or null if session is anonymous
      */
     async getUserDidForSession(sessionId, oauthIdentity) {
         // Handle null explicitly (from JSON parsing)
@@ -205,7 +210,7 @@ export class ConsentService {
             typeof oauthIdentity === "object" &&
             oauthIdentity.provider &&
             oauthIdentity.subject;
-        // If OAuth identity provided, check for existing mapping first
+        // Priority 1: If OAuth identity provided, check for existing mapping
         if (hasOAuthIdentity && this.env.DELEGATION_STORAGE) {
             try {
                 const oauthKey = STORAGE_KEYS.oauthIdentity(oauthIdentity.provider, oauthIdentity.subject);
@@ -220,97 +225,273 @@ export class ConsentService {
             }
             catch (error) {
                 console.warn("[ConsentService] Failed to check OAuth mapping:", error);
-                // Continue with ephemeral DID generation
             }
         }
-        else if (oauthIdentity === null) {
-            // Explicitly handle null case (no OAuth)
-            console.log("[ConsentService] No OAuth identity provided (null), generating ephemeral DID");
+        // Priority 2: Check session storage for existing DID
+        if (this.env.DELEGATION_STORAGE) {
+            const sessionKey = STORAGE_KEYS.session(sessionId);
+            try {
+                const sessionData = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
+                if (sessionData?.userDid) {
+                    return sessionData.userDid;
+                }
+            }
+            catch (error) {
+                console.warn("[ConsentService] Failed to read session cache:", error);
+            }
         }
-        // Continue with existing ephemeral DID generation logic
+        // Phase 5: No ephemeral DID generation - session stays anonymous
+        // User DID will be resolved via AgentShield after OAuth completes
+        return null;
+    }
+    /**
+     * Update session with resolved identity (Phase 5)
+     *
+     * Called after AgentShield identity/resolve returns a persistent user DID.
+     * Stores the DID in session storage and creates OAuth mapping.
+     *
+     * @param sessionId - Session ID
+     * @param userDid - Persistent user DID from AgentShield
+     * @param oauthIdentity - OAuth identity for creating persistent mapping
+     */
+    async updateSessionWithIdentity(sessionId, userDid, oauthIdentity) {
         if (!this.env.DELEGATION_STORAGE) {
-            // No storage - use cached UserDidManager instance for consistent DID generation
-            if (!this.userDidManager) {
-                this.userDidManager = new UserDidManager({
-                    crypto: new WebCryptoProvider(),
-                });
-            }
-            return await this.userDidManager.getOrCreateUserDid(sessionId);
+            console.warn("[ConsentService] No DELEGATION_STORAGE - cannot persist session identity");
+            return;
         }
         const sessionKey = STORAGE_KEYS.session(sessionId);
-        // Try session cache first
+        // Update session storage with resolved identity
         try {
-            const sessionData = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
-            if (sessionData?.userDid) {
-                return sessionData.userDid;
-            }
+            const existingSession = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
+            const sessionData = {
+                ...existingSession,
+                userDid,
+                identityState: "authenticated",
+                identityUpdatedAt: Date.now(),
+                ...(oauthIdentity && {
+                    oauthIdentity: {
+                        provider: oauthIdentity.provider,
+                        subject: oauthIdentity.subject,
+                        email: oauthIdentity.email,
+                    },
+                }),
+            };
+            await this.env.DELEGATION_STORAGE.put(sessionKey, JSON.stringify(sessionData), { expirationTtl: DEFAULT_SESSION_CACHE_TTL });
+            console.log("[ConsentService] Session identity updated (Phase 5):", {
+                sessionId: sessionId.substring(0, 8) + "...",
+                userDid: userDid.substring(0, 20) + "...",
+                provider: oauthIdentity?.provider,
+            });
         }
         catch (error) {
-            console.warn("[ConsentService] Failed to read session cache:", error);
+            console.warn("[ConsentService] Failed to update session with identity:", error);
+            throw error;
+        }
+        // Create OAuth → DID mapping for future lookups
+        if (oauthIdentity?.provider && oauthIdentity?.subject) {
+            try {
+                const oauthKey = STORAGE_KEYS.oauthIdentity(oauthIdentity.provider, oauthIdentity.subject);
+                await this.env.DELEGATION_STORAGE.put(oauthKey, userDid, {
+                    expirationTtl: 90 * 24 * 60 * 60, // 90 days for persistent mapping
+                });
+                console.log("[ConsentService] Created OAuth → DID mapping:", {
+                    provider: oauthIdentity.provider,
+                    userDid: userDid.substring(0, 20) + "...",
+                });
+            }
+            catch (error) {
+                console.warn("[ConsentService] Failed to create OAuth mapping:", error);
+                // Non-fatal - session was updated successfully
+            }
+        }
+    }
+    /**
+     * Get key pair for a session (for VC signing)
+     *
+     * Returns the Ed25519 key pair for a session if available.
+     * Key pairs are generated when DIDs are created via UserDidManager.
+     *
+     * @param sessionId - Session ID
+     * @param oauthIdentity - Optional OAuth identity for persistent lookup
+     * @returns UserKeyPair or null if not available
+     */
+    async getKeyPairForSession(sessionId, oauthIdentity) {
+        // Ensure UserDidManager is initialized
+        if (!this.userDidManager) {
+            // Initialize with storage if available
+            await this.getUserDidForSession(sessionId, oauthIdentity);
         }
-        // Generate ephemeral DID using cached UserDidManager instance
         if (!this.userDidManager) {
-            this.userDidManager = new UserDidManager({
-                crypto: new WebCryptoProvider(),
-                storage: {
-                    get: async (key) => {
-                        try {
-                            const data = await this.env.DELEGATION_STORAGE.get(`userDid:${key}`, "text");
-                            return data || null;
-                        }
-                        catch {
-                            return null;
-                        }
-                    },
-                    set: async (key, value, ttl) => {
-                        await this.env.DELEGATION_STORAGE.put(`userDid:${key}`, value, {
-                            expirationTtl: ttl || DEFAULT_SESSION_CACHE_TTL,
-                        });
-                    },
-                    delete: async (key) => {
-                        await this.env.DELEGATION_STORAGE.delete(`userDid:${key}`);
-                    },
-                    // OAuth-based lookup for persistent user DID
-                    getByOAuth: async (provider, subject) => {
-                        try {
-                            const oauthKey = STORAGE_KEYS.oauthIdentity(provider, subject);
-                            const userDid = await this.env.DELEGATION_STORAGE.get(oauthKey, "text");
-                            return userDid || null;
-                        }
-                        catch {
-                            return null;
-                        }
-                    },
-                    // OAuth-based storage for persistent user DID mapping
-                    setByOAuth: async (provider, subject, did, ttl) => {
-                        try {
-                            const oauthKey = STORAGE_KEYS.oauthIdentity(provider, subject);
-                            await this.env.DELEGATION_STORAGE.put(oauthKey, did, {
-                                expirationTtl: ttl || 90 * 24 * 60 * 60, // Default 90 days for persistent mapping
-                            });
-                        }
-                        catch (error) {
-                            console.warn("[ConsentService] Failed to store OAuth mapping:", error);
-                            throw error;
-                        }
-                    },
-                },
-            });
+            console.warn("[ConsentService] UserDidManager not initialized");
+            return null;
+        }
+        return await this.userDidManager.getKeyPairForSession(sessionId, oauthIdentity);
+    }
+    /**
+     * Issue a Delegation Verifiable Credential as JWT
+     *
+     * Creates a W3C Verifiable Credential for a delegation record and encodes it as a JWT.
+     * The JWT is signed with the user's Ed25519 key pair.
+     *
+     * Phase 2 VC-Only: This enables verifiable delegations without full account-centric identity.
+     *
+     * @param delegation - The delegation record to wrap as a VC
+     * @param sessionId - Session ID for key pair retrieval
+     * @param oauthIdentity - Optional OAuth identity for persistent key lookup
+     * @returns JWT string (header.payload.signature) or null if key pair unavailable
+     */
+    async issueDelegationVC(delegation, sessionId, oauthIdentity) {
+        // Get the key pair for signing
+        const keyPair = await this.getKeyPairForSession(sessionId, oauthIdentity);
+        if (!keyPair) {
+            console.warn("[ConsentService] Cannot issue VC: no key pair available for session");
+            return null;
         }
-        const userDid = await this.userDidManager.getOrCreateUserDid(sessionId, oauthIdentity);
-        // Cache in session storage
         try {
-            const existingSession = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
-            await this.env.DELEGATION_STORAGE.put(sessionKey, JSON.stringify({
-                ...existingSession,
-                userDid,
-            }), { expirationTtl: DEFAULT_SESSION_CACHE_TTL });
+            // Step 1: Create the unsigned VC
+            const unsignedVC = wrapDelegationAsVC(delegation, {
+                id: `urn:uuid:${delegation.id}`,
+                issuanceDate: new Date().toISOString(),
+                expirationDate: delegation.constraints.notAfter
+                    ? new Date(delegation.constraints.notAfter).toISOString()
+                    : undefined,
+            });
+            // Override issuer with the user's DID (not the agent's DID)
+            const vcWithCorrectIssuer = {
+                ...unsignedVC,
+                issuer: keyPair.did,
+            };
+            // Step 2: Create unsigned JWT parts
+            const { signingInput } = createUnsignedVCJWT(vcWithCorrectIssuer, { keyId: keyPair.keyId });
+            // Step 3: Sign the JWT with the user's private key
+            const crypto = new WebCryptoProvider();
+            const signingInputBytes = new TextEncoder().encode(signingInput);
+            const signatureBytes = await crypto.sign(signingInputBytes, keyPair.privateKey);
+            const signature = base64urlEncodeFromBytes(signatureBytes);
+            // Step 4: Complete the JWT
+            const jwt = completeVCJWT(signingInput, signature);
+            console.log("[ConsentService] VC issued successfully:", {
+                issuerDid: keyPair.did.substring(0, 20) + "...",
+                subjectDid: delegation.subjectDid.substring(0, 20) + "...",
+                delegationId: delegation.id,
+                jwtLength: jwt.length,
+            });
+            return jwt;
         }
         catch (error) {
-            console.warn("[ConsentService] Failed to cache userDid in session:", error);
-            // Non-fatal - continue with generated DID
+            console.error("[ConsentService] Failed to issue VC:", error);
+            return null;
         }
-        return userDid;
+    }
+    /**
+     * Verify a VC-JWT delegation credential
+     *
+     * Verifies the JWT signature and validates the embedded VC using the
+     * DelegationCredentialVerifier from mcp-i-core. This implements Phase 3
+     * of W3C VC-based delegation verification.
+     *
+     * Verification stages:
+     * 1. Parse JWT format (header.payload.signature)
+     * 2. Resolve issuer DID (did:key) to public key
+     * 3. Verify JWT signature using Ed25519
+     * 4. Validate VC contents (expiration, schema, etc.)
+     *
+     * @param vcJwt - The VC-JWT string to verify
+     * @param options - Optional verification options
+     * @returns Verification result or null if JWT parsing fails
+     */
+    async verifyDelegationVC(vcJwt, options) {
+        const startTime = Date.now();
+        // Step 1: Parse JWT
+        const parsed = parseVCJWT(vcJwt);
+        if (!parsed) {
+            console.warn("[ConsentService] verifyDelegationVC: Invalid JWT format");
+            return {
+                valid: false,
+                reason: "Invalid JWT format",
+                stage: "basic",
+                metrics: { totalMs: Date.now() - startTime },
+            };
+        }
+        // Step 2: Extract VC from payload
+        const vc = parsed.payload.vc;
+        if (!vc) {
+            console.warn("[ConsentService] verifyDelegationVC: No VC in JWT payload");
+            return {
+                valid: false,
+                reason: "No VC in JWT payload",
+                stage: "basic",
+                metrics: { totalMs: Date.now() - startTime },
+            };
+        }
+        // Step 3: Verify JWT signature (unless skipped)
+        if (!options?.skipSignature) {
+            const issuerDid = parsed.payload.iss;
+            if (!issuerDid) {
+                return {
+                    valid: false,
+                    reason: "Missing issuer (iss) in JWT payload",
+                    stage: "signature",
+                    metrics: { totalMs: Date.now() - startTime },
+                };
+            }
+            // Resolve issuer DID to get public key
+            const resolver = createDidKeyResolver();
+            const didDoc = await resolver.resolve(issuerDid);
+            if (!didDoc?.verificationMethod?.[0]?.publicKeyJwk) {
+                return {
+                    valid: false,
+                    reason: `Cannot resolve issuer DID: ${issuerDid}`,
+                    stage: "signature",
+                    metrics: { totalMs: Date.now() - startTime },
+                };
+            }
+            // Get public key bytes from JWK
+            const jwk = didDoc.verificationMethod[0].publicKeyJwk;
+            const publicKeyBytes = base64urlDecodeToBytes(jwk.x);
+            const publicKeyBase64 = bytesToBase64(publicKeyBytes);
+            // Verify signature
+            const signingInputBytes = new TextEncoder().encode(parsed.signingInput);
+            const signatureBytes = base64urlDecodeToBytes(parsed.signature);
+            const crypto = new WebCryptoProvider();
+            const isValid = await crypto.verify(signingInputBytes, signatureBytes, publicKeyBase64);
+            if (!isValid) {
+                console.warn("[ConsentService] verifyDelegationVC: JWT signature verification failed");
+                return {
+                    valid: false,
+                    reason: "JWT signature verification failed",
+                    stage: "signature",
+                    metrics: { totalMs: Date.now() - startTime },
+                };
+            }
+            console.log("[ConsentService] verifyDelegationVC: JWT signature verified successfully");
+        }
+        // Step 4: Run basic VC validation via DelegationCredentialVerifier
+        // Skip signature verification since we already verified the JWT signature above
+        const verifier = createDelegationVerifier({
+            didResolver: createDidKeyResolver(),
+        });
+        const result = await verifier.verifyDelegationCredential(vc, {
+            skipSignature: true, // Already verified above
+            skipStatus: options?.skipStatus,
+        });
+        // Update metrics to include our signature verification time
+        if (result.metrics) {
+            result.metrics.totalMs = Date.now() - startTime;
+        }
+        if (result.valid) {
+            console.log("[ConsentService] verifyDelegationVC: VC verified successfully", {
+                issuer: vc.issuer,
+                subject: vc.credentialSubject?.id,
+            });
+        }
+        else {
+            console.warn("[ConsentService] verifyDelegationVC: VC validation failed", {
+                reason: result.reason,
+                stage: result.stage,
+            });
+        }
+        return result;
     }
     /**
      * Check if OAuth is required for delegation creation
@@ -629,9 +810,8 @@ export class ConsentService {
      */
     async linkOAuthToUserDid(oauthIdentity, sessionId) {
         if (!this.env.DELEGATION_STORAGE) {
-            // No storage - can't persist mapping, return ephemeral DID
-            console.warn("[ConsentService] No storage available for OAuth linking");
-            return await this.getUserDidForSession(sessionId);
+            // Phase 5: No storage - can't persist mapping
+            throw new Error("[ConsentService] No storage available for OAuth linking");
         }
         const oauthKey = STORAGE_KEYS.oauthIdentity(oauthIdentity.provider, oauthIdentity.subject);
         // Check if OAuth identity already mapped
@@ -648,10 +828,14 @@ export class ConsentService {
         }
         catch (error) {
             console.warn("[ConsentService] Failed to check OAuth mapping:", error);
-            // Continue to create new mapping
+            // Continue to check session
         }
-        // Get/create User DID for session (may be ephemeral)
+        // Phase 5: Check for existing user DID in session
         const userDid = await this.getUserDidForSession(sessionId);
+        if (!userDid) {
+            // Phase 5: No existing DID - user must complete OAuth via AgentShield first
+            throw new Error("[ConsentService] No user DID found for session - OAuth identity resolution required via AgentShield");
+        }
         // Store OAuth identity mapping (persistent - 90 days)
         try {
             await this.env.DELEGATION_STORAGE.put(oauthKey, userDid, {
@@ -672,12 +856,68 @@ export class ConsentService {
             console.error("[ConsentService] Failed to store OAuth mapping:", error);
             // Non-fatal - continue with User DID
         }
-        // Note: Ephemeral → persistent migration happens automatically
-        // The ephemeral DID becomes persistent when linked to OAuth identity
-        // Existing delegations with ephemeral DID will continue to work
-        // New delegations will use the persistent DID
         return userDid;
     }
+    /**
+     * Cache an externally-resolved User DID (from AgentShield identity resolution)
+     *
+     * Phase 5: When AgentShield provides a persistent user_did, we cache the
+     * OAuth identity → userDid mapping in KV so future lookups don't require
+     * calling AgentShield again.
+     *
+     * @param oauthIdentity - OAuth identity from provider
+     * @param userDid - Persistent user DID from AgentShield
+     * @returns void
+     */
+    async cacheExternalUserDid(oauthIdentity, userDid) {
+        if (!this.env.DELEGATION_STORAGE) {
+            console.warn("[ConsentService] No storage available for caching external User DID");
+            return;
+        }
+        const oauthKey = STORAGE_KEYS.oauthIdentity(oauthIdentity.provider, oauthIdentity.subject);
+        // Check if mapping already exists
+        try {
+            const existingUserDid = await this.env.DELEGATION_STORAGE.get(oauthKey, "text");
+            if (existingUserDid) {
+                // Mapping already exists - verify it matches
+                if (existingUserDid !== userDid) {
+                    console.warn("[ConsentService] OAuth identity already mapped to different User DID:", {
+                        provider: oauthIdentity.provider,
+                        subject: oauthIdentity.subject.substring(0, 20) + "...",
+                        existingUserDid: existingUserDid.substring(0, 30) + "...",
+                        newUserDid: userDid.substring(0, 30) + "...",
+                    });
+                    // Don't overwrite - AgentShield is source of truth
+                }
+                return;
+            }
+        }
+        catch (error) {
+            console.warn("[ConsentService] Failed to check existing OAuth mapping:", error);
+            // Continue to store new mapping
+        }
+        // Store OAuth identity → userDid mapping (persistent - 90 days)
+        try {
+            await this.env.DELEGATION_STORAGE.put(oauthKey, userDid, {
+                expirationTtl: 90 * 24 * 60 * 60, // 90 days
+            });
+            // Also store full OAuth identity info for reference
+            const oauthIdentityKey = STORAGE_KEYS.userDid(oauthIdentity.provider, oauthIdentity.subject);
+            await this.env.DELEGATION_STORAGE.put(oauthIdentityKey, JSON.stringify(oauthIdentity), {
+                expirationTtl: 90 * 24 * 60 * 60, // 90 days
+            });
+            console.log("[ConsentService] Cached external User DID from AgentShield:", {
+                provider: oauthIdentity.provider,
+                subject: oauthIdentity.subject.substring(0, 20) + "...",
+                userDid: userDid.substring(0, 30) + "...",
+                source: "agentshield_identity_resolution",
+            });
+        }
+        catch (error) {
+            console.error("[ConsentService] Failed to cache external User DID:", error);
+            // Non-fatal - the persistent user_did will still be used
+        }
+    }
     /**
      * Handle consent requests
      *
@@ -2117,12 +2357,13 @@ export class ConsentService {
             // ✅ After successful delegation creation - log audit events
             if (auditService && delegationResult.success) {
                 try {
-                    // Get userDid (may have been generated during delegation creation)
+                    // Get userDid (resolved via OAuth identity resolution)
                     // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
                     let userDid;
                     if (approvalRequest.session_id) {
                         try {
-                            userDid = await this.getUserDidForSession(approvalRequest.session_id, approvalRequest.oauth_identity || undefined);
+                            userDid =
+                                (await this.getUserDidForSession(approvalRequest.session_id, approvalRequest.oauth_identity || undefined)) ?? undefined; // Phase 5: Convert null to undefined
                         }
                         catch (error) {
                             console.warn("[ConsentService] Failed to get userDid for audit logging:", error);
@@ -2222,8 +2463,10 @@ export class ConsentService {
                     });
                     // Pass OAuth identity if available in approval request (can be null/undefined)
                     // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
-                    userDid = await this.getUserDidForSession(request.session_id, request.oauth_identity || undefined // Explicitly handle null as undefined
-                    );
+                    // Phase 5: Returns null if no identity found (session stays anonymous)
+                    userDid =
+                        (await this.getUserDidForSession(request.session_id, request.oauth_identity || undefined // Explicitly handle null as undefined
+                        )) ?? undefined;
                     console.log("[ConsentService] User DID retrieved:", {
                         userDid: userDid?.substring(0, 20) + "...",
                         hasUserDid: !!userDid,
@@ -2240,9 +2483,45 @@ export class ConsentService {
                 console.log("[ConsentService] No session_id provided - skipping User DID generation");
             }
             const expiresInDays = 7; // Default to 7 days
+            // Phase 2 VC-Only: Issue Delegation VC if we have a session and userDid
+            let credentialJwt;
+            if (request.session_id && userDid) {
+                try {
+                    // Create a local delegation record for VC issuance
+                    const delegationId = crypto.randomUUID();
+                    const notAfter = Date.now() + expiresInDays * 24 * 60 * 60 * 1000;
+                    const scopes = request.scopes ?? [];
+                    const localDelegation = {
+                        id: delegationId,
+                        issuerDid: userDid,
+                        subjectDid: request.agent_did,
+                        vcId: `urn:uuid:${delegationId}`,
+                        constraints: {
+                            scopes,
+                            notAfter,
+                            notBefore: Date.now(),
+                        },
+                        signature: "", // Will be in JWT
+                        status: "active",
+                        createdAt: Date.now(),
+                    };
+                    const vcResult = await this.issueDelegationVC(localDelegation, request.session_id, request.oauth_identity || undefined);
+                    credentialJwt = vcResult ?? undefined;
+                    if (credentialJwt) {
+                        console.log("[ConsentService] VC issued for delegation:", {
+                            delegationId,
+                            jwtLength: credentialJwt.length,
+                        });
+                    }
+                }
+                catch (error) {
+                    console.warn("[ConsentService] Failed to issue VC, continuing without it:", error);
+                    // Non-fatal - delegation will work without VC
+                }
+            }
             // Build delegation request with error-based format detection
             // Try full format first, fallback to simplified format on error
-            const delegationRequest = await this.buildDelegationRequest(request, userDid, expiresInDays, fieldName);
+            const delegationRequest = await this.buildDelegationRequest(request, userDid, expiresInDays, fieldName, credentialJwt);
             console.log("[ConsentService] Creating delegation:", {
                 url: `${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`,
                 agentDid: request.agent_did.substring(0, 20) + "...",
@@ -2441,7 +2720,7 @@ export class ConsentService {
      *
      * Uses Day0 config to determine field name and includes issuerDid when available.
      */
-    async buildDelegationRequest(request, userDid, expiresInDays, fieldName) {
+    async buildDelegationRequest(request, userDid, expiresInDays, fieldName, credentialJwt) {
         const baseRequest = {
             agent_did: request.agent_did,
             scopes: request.scopes,
@@ -2473,39 +2752,45 @@ export class ConsentService {
         }
         // If we have a cached preference, use it directly
         if (cachedFormat === "full") {
-            return this.buildFullFormatRequest(request, userDid, expiresInDays);
+            return this.buildFullFormatRequest(request, userDid, expiresInDays, credentialJwt);
         }
         else if (cachedFormat === "simplified") {
-            return this.buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName);
+            return this.buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName, credentialJwt);
         }
         // No cache - return request that will be tried with error-based detection
         return {
             _tryFormats: true,
-            fullFormat: await this.buildFullFormatRequest(request, userDid, expiresInDays),
-            simplifiedFormat: this.buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName),
+            fullFormat: await this.buildFullFormatRequest(request, userDid, expiresInDays, credentialJwt),
+            simplifiedFormat: this.buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName, credentialJwt),
         };
     }
     /**
      * Build full DelegationRecord format request (future format)
      */
-    async buildFullFormatRequest(request, userDid, expiresInDays) {
+    async buildFullFormatRequest(request, userDid, expiresInDays, credentialJwt) {
         const notAfter = Date.now() + expiresInDays * 24 * 60 * 60 * 1000;
         // Defensive check: ensure scopes is always defined (should be guaranteed by validation)
         const scopes = request.scopes ?? [];
-        return {
-            delegation: {
-                id: crypto.randomUUID(),
-                issuerDid: userDid || "did:key:z6MkEphemeral", // Use ephemeral if no userDid
-                subjectDid: request.agent_did,
-                constraints: {
-                    scopes,
-                    notAfter,
-                    notBefore: Date.now(),
-                },
-                status: "active",
-                createdAt: Date.now(),
+        const delegationRecord = {
+            id: crypto.randomUUID(),
+            issuerDid: userDid || "did:key:z6MkEphemeral", // Use ephemeral if no userDid
+            subjectDid: request.agent_did,
+            constraints: {
+                scopes,
+                notAfter,
+                notBefore: Date.now(),
             },
+            status: "active",
+            createdAt: Date.now(),
+        };
+        const result = {
+            delegation: delegationRecord,
         };
+        // Phase 2 VC-Only: Include credential_jwt if available
+        if (credentialJwt) {
+            result.credential_jwt = credentialJwt;
+        }
+        return result;
     }
     /**
      * Check if a string is a valid UUID
@@ -2531,7 +2816,7 @@ export class ConsentService {
      *
      * Including these fields will cause validation errors (400 Bad Request).
      */
-    buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName) {
+    buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName, credentialJwt) {
         // Build request with ONLY fields that are in AgentShield's schema
         // Defensive check: ensure scopes is always defined (should be guaranteed by validation)
         const scopes = request.scopes ?? [];
@@ -2551,6 +2836,11 @@ export class ConsentService {
         else {
             console.log("[ConsentService] No user_identifier (no OAuth or ephemeral DID) - delegation will proceed without it");
         }
+        // Phase 2 VC-Only: Include credential_jwt if available
+        if (credentialJwt) {
+            simplifiedRequest.credential_jwt = credentialJwt;
+            console.log("[ConsentService] Including credential_jwt in delegation request");
+        }
         // AgentShield API only accepts "custom_fields", not "metadata"
         // Always use "custom_fields" regardless of Day0 config
         if (userDid) {