@kya-os/mcp-i-cloudflare 1.12.4 → 1.13.2

package/dist/services/consent-audit.service.js

@@ -1,12 +1,11 @@
 /**
  * Consent Audit Service
  *
- * Handles audit logging for consent-related events.
- * These events bypass session deduplication to allow multiple events per session.
+ * Coordinates two independent consent lifecycle outputs:
+ * canonical audit trail events and proof submission.
  */
 export class ConsentAuditService {
     proofService;
-    auditLogger;
     proofGenerator;
     config;
     runtime;
@@ -16,45 +15,22 @@ export class ConsentAuditService {
             // TODO: Send to error tracking service
         },
     };
-    constructor(proofService, auditLogger, proofGenerator, config, runtime // REQUIRED for identity
+    constructor(proofService, proofGenerator, config, runtime // REQUIRED for identity
     ) {
         this.proofService = proofService;
-        this.auditLogger = auditLogger;
         this.proofGenerator = proofGenerator;
         this.config = config;
         this.runtime = runtime;
     }
-    /**
-     * Create a minimal SessionContext for audit logging
-     * Only sessionId and audience are used by logEvent, but TypeScript requires full SessionContext
-     */
-    createSessionContext(sessionId) {
-        const now = Math.floor(Date.now() / 1000);
-        // Audience is typically from the handshake, but for consent events we use a default
-        const audience = "https://kya.vouched.id";
-        return {
-            sessionId,
-            audience,
-            nonce: "", // Not used by logEvent, but required by type
-            timestamp: now,
-            createdAt: now,
-            lastActivity: now,
-            ttlMinutes: 30,
-            identityState: "anonymous", // Phase 5: Default to anonymous
-        };
-    }
     /**
      * Log consent page view event
      */
     async logConsentPageView(event) {
         const timestamp = Math.floor(Date.now() / 1000); // Unix timestamp in seconds
-        const identity = await this.getServerIdentity();
-        // Log to audit system (bypasses session deduplication)
-        await this.auditLogger.logEvent({
-            eventType: "consent:page_viewed",
-            identity,
-            session: this.createSessionContext(event.sessionId),
-            eventData: event,
+        await this.runtime.recordConsentAudit({
+            phase: "requested",
+            outcome: "succeeded",
+            sessionId: event.sessionId,
         });
         // Generate proof for dashboard
         const proof = await this.generateConsentProof("consent:page_viewed", event, timestamp);
@@ -76,13 +52,12 @@ export class ConsentAuditService {
      */
     async logConsentApproval(event) {
         const timestamp = Math.floor(Date.now() / 1000); // Unix timestamp in seconds
-        const identity = await this.getServerIdentity();
-        // Log to audit system
-        await this.auditLogger.logEvent({
-            eventType: "consent:approved",
-            identity,
-            session: this.createSessionContext(event.sessionId),
-            eventData: event,
+        await this.runtime.recordConsentAudit({
+            phase: "approved",
+            outcome: "succeeded",
+            sessionId: event.sessionId,
+            userDid: event.userDid,
+            consentRef: event.delegationId,
         });
         // Generate proof
         const proof = await this.generateConsentProof("consent:approved", event, timestamp);
@@ -108,13 +83,10 @@ export class ConsentAuditService {
      */
     async logCredentialRequired(event) {
         const timestamp = Math.floor(Date.now() / 1000); // Unix timestamp in seconds
-        const identity = await this.getServerIdentity();
-        // Log to audit system
-        await this.auditLogger.logEvent({
-            eventType: "consent:credential_required",
-            identity,
-            session: this.createSessionContext(event.sessionId),
-            eventData: event,
+        await this.runtime.recordConsentAudit({
+            phase: "credential_required",
+            outcome: "challenged",
+            sessionId: event.sessionId,
         });
         // Generate proof
         const proof = await this.generateConsentProof("consent:credential_required", event, timestamp);
@@ -143,13 +115,12 @@ export class ConsentAuditService {
      */
     async logDelegationCreated(event) {
         const timestamp = Math.floor(Date.now() / 1000); // Unix timestamp in seconds
-        const identity = await this.getServerIdentity();
-        // Log to audit system
-        await this.auditLogger.logEvent({
-            eventType: "consent:delegation_created",
-            identity,
-            session: this.createSessionContext(event.sessionId),
-            eventData: event,
+        await this.runtime.recordDelegationAudit({
+            phase: "issued",
+            outcome: "succeeded",
+            sessionId: event.sessionId,
+            userDid: event.userDid,
+            delegationRef: event.delegationId,
         });
         // Generate proof
         const proof = await this.generateConsentProof("consent:delegation_created", event, timestamp);
@@ -174,12 +145,11 @@ export class ConsentAuditService {
      */
     async logCredentialAuthSuccess(event) {
         const timestamp = Math.floor(Date.now() / 1000);
-        const identity = await this.getServerIdentity();
-        await this.auditLogger.logEvent({
-            eventType: "auth:credential_success",
-            identity,
-            session: this.createSessionContext(event.sessionId),
-            eventData: event,
+        await this.runtime.recordConsentAudit({
+            phase: "credential_verified",
+            outcome: "succeeded",
+            sessionId: event.sessionId,
+            userDid: event.userDid,
         });
         const proof = await this.generateConsentProof("auth:credential_success", event, timestamp);
         await this.proofService.submitProof(proof, {
@@ -203,12 +173,11 @@ export class ConsentAuditService {
      */
     async logCredentialAuthFailed(event) {
         const timestamp = Math.floor(Date.now() / 1000);
-        const identity = await this.getServerIdentity();
-        await this.auditLogger.logEvent({
-            eventType: "auth:credential_failed",
-            identity,
-            session: this.createSessionContext(event.sessionId),
-            eventData: event,
+        await this.runtime.recordConsentAudit({
+            phase: "credential_failed",
+            outcome: "failed",
+            sessionId: event.sessionId,
+            reasonCode: "CREDENTIAL_AUTH_FAILED",
         });
         const proof = await this.generateConsentProof("auth:credential_failed", event, timestamp);
         await this.proofService.submitProof(proof, {
@@ -230,12 +199,11 @@ export class ConsentAuditService {
      */
     async logOAuthSuccess(event) {
         const timestamp = Math.floor(Date.now() / 1000);
-        const identity = await this.getServerIdentity();
-        await this.auditLogger.logEvent({
-            eventType: "auth:oauth_success",
-            identity,
-            session: this.createSessionContext(event.sessionId),
-            eventData: event,
+        await this.runtime.recordConsentAudit({
+            phase: "credential_verified",
+            outcome: "succeeded",
+            sessionId: event.sessionId,
+            userDid: event.userDid,
         });
         const proof = await this.generateConsentProof("auth:oauth_success", event, timestamp);
         await this.proofService.submitProof(proof, {
@@ -259,12 +227,11 @@ export class ConsentAuditService {
      */
     async logOAuthFailed(event) {
         const timestamp = Math.floor(Date.now() / 1000);
-        const identity = await this.getServerIdentity();
-        await this.auditLogger.logEvent({
-            eventType: "auth:oauth_failed",
-            identity,
-            session: this.createSessionContext(event.sessionId),
-            eventData: event,
+        await this.runtime.recordConsentAudit({
+            phase: "credential_failed",
+            outcome: "failed",
+            sessionId: event.sessionId,
+            reasonCode: "OAUTH_FAILED",
         });
         const proof = await this.generateConsentProof("auth:oauth_failed", event, timestamp);
         await this.proofService.submitProof(proof, {
@@ -354,7 +321,7 @@ export class ConsentAuditService {
             this.logger.error("Failed to get server identity", {
                 error: error instanceof Error ? error.message : String(error),
             });
-            throw new Error("Server identity required for consent audit logging");
+            throw new Error("Server identity required for consent proof generation");
         }
     }
 }

package/dist/services/consent-audit.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent-audit.service.js","sourceRoot":"","sources":["../../src/services/consent-audit.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,MAAM,OAAO,mBAAmB;IASpB;IACA;IACA;IACA;IACA;IAZF,MAAM,GAAG;QACf,KAAK,EAAE,CAAC,OAAe,EAAE,IAAyB,EAAE,EAAE;YACpD,OAAO,CAAC,KAAK,CAAC,yBAAyB,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;YACxD,uCAAuC;QACzC,CAAC;KACF,CAAC;IAEF,YACU,YAA0B,EAC1B,WAAyB,EACzB,cAAwC,EACxC,MAA+B,EAC/B,OAA0B,CAAC,wBAAwB;;QAJnD,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAc;QACzB,mBAAc,GAAd,cAAc,CAA0B;QACxC,WAAM,GAAN,MAAM,CAAyB;QAC/B,YAAO,GAAP,OAAO,CAAmB;IACjC,CAAC;IAEJ;;;OAGG;IACK,oBAAoB,CAAC,SAAiB;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,oFAAoF;QACpF,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QAC1C,OAAO;YACL,SAAS;YACT,QAAQ;YACR,KAAK,EAAE,EAAE,EAAE,6CAA6C;YACxD,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;YACjB,UAAU,EAAE,EAAE;YACd,aAAa,EAAE,WAAoB,EAAE,gCAAgC;SACtE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAMxB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,uDAAuD;QACvD,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,qBAAqB;YAChC,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,+BAA+B;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,qBAAqB,EACrB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,qBAAqB;gBAChC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAUxB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,sBAAsB;QACtB,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,kBAAkB;YAC7B,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,iBAAiB;QACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,kBAAkB,EAClB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,kBAAkB;gBAC7B,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,KAO3B;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,sBAAsB;QACtB,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,6BAA6B;YACxC,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,iBAAiB;QACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,6BAA6B,EAC7B,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,6BAA6B;gBACxC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,gBAAgB,EAAE,UAAU;gBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAChC,CAAC,CAAC;wBACE,QAAQ,EAAE,KAAK,CAAC,aAAa;wBAC7B,UAAU,EAAE,EAAE;qBACf;oBACH,CAAC,CAAC,SAAS;aACd;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAQ1B;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,sBAAsB;QACtB,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,4BAA4B;YACvC,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,iBAAiB;QACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,4BAA4B,EAC5B,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,4BAA4B;gBACvC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAAC,KAQ9B;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,yBAAyB;YACpC,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,yBAAyB,EACzB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,yBAAyB;gBACpC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,gBAAgB,EAAE,UAAU;aAC7B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAAC,KAQ7B;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,wBAAwB;YACnC,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,wBAAwB,EACxB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,wBAAwB;gBACnC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,KAQrB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,oBAAoB;YAC/B,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,oBAAoB,EACpB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,oBAAoB;gBAC/B,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,KAQpB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,mBAAmB;YAC9B,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,mBAAmB,EACnB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,mBAAmB;gBAC9B,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE;oBACb,QAAQ,EAAE,KAAK,CAAC,aAAa;oBAC7B,UAAU,EAAE,EAAE;iBACf;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,oBAAoB,CAChC,SAAiB,EACjB,KAAU,EACV,SAAiB;QAEjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE7D,+CAA+C;QAC/C,2EAA2E;QAC3E,MAAM,gBAAgB,GAAG;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE;gBACN,SAAS;gBACT,SAAS;gBACT,GAAG,KAAK;aACT;SACF,CAAC;QAEF,MAAM,iBAAiB,GAAG;YACxB,IAAI,EAAE;gBACJ,OAAO,EAAE,IAAI;gBACb,SAAS;gBACT,SAAS;gBACT,SAAS,EAAE,QAAQ,CAAC,GAAG;aACxB;SACF,CAAC;QAEF,yDAAyD;QACzD,gFAAgF;QAChF,0CAA0C;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAmB;YACrC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,4BAA4B;YACnC,QAAQ,EAAE,wBAAwB;YAClC,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;YACjB,UAAU,EAAE,EAAE;YACd,aAAa,EAAE,WAAoB,EAAE,gCAAgC;SACtE,CAAC;QAEF,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAC5C,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EAAE,kCAAkC;QAClD;YACE,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,8CAA8C;SACzE,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;gBACjD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"consent-audit.service.js","sourceRoot":"","sources":["../../src/services/consent-audit.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,MAAM,OAAO,mBAAmB;IASpB;IACA;IACA;IACA;IAXF,MAAM,GAAG;QACf,KAAK,EAAE,CAAC,OAAe,EAAE,IAAyB,EAAE,EAAE;YACpD,OAAO,CAAC,KAAK,CAAC,yBAAyB,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;YACxD,uCAAuC;QACzC,CAAC;KACF,CAAC;IAEF,YACU,YAA0B,EAC1B,cAAwC,EACxC,MAA+B,EAC/B,OAA0B,CAAC,wBAAwB;;QAHnD,iBAAY,GAAZ,YAAY,CAAc;QAC1B,mBAAc,GAAd,cAAc,CAA0B;QACxC,WAAM,GAAN,MAAM,CAAyB;QAC/B,YAAO,GAAP,OAAO,CAAmB;IACjC,CAAC;IAEJ;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAMxB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC7E,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACpC,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,WAAW;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QAEH,+BAA+B;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,qBAAqB,EACrB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,qBAAqB;gBAChC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAUxB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC7E,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACpC,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,WAAW;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,YAAY;SAC/B,CAAC,CAAC;QAEH,iBAAiB;QACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,kBAAkB,EAClB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,kBAAkB;gBAC7B,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,KAO3B;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC7E,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACpC,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QAEH,iBAAiB;QACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,6BAA6B,EAC7B,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,6BAA6B;gBACxC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,gBAAgB,EAAE,UAAU;gBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAChC,CAAC,CAAC;wBACE,QAAQ,EAAE,KAAK,CAAC,aAAa;wBAC7B,UAAU,EAAE,EAAE;qBACf;oBACH,CAAC,CAAC,SAAS;aACd;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAQ1B;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC7E,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;YACvC,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,WAAW;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,KAAK,CAAC,YAAY;SAClC,CAAC,CAAC;QAEH,iBAAiB;QACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,4BAA4B,EAC5B,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,4BAA4B;gBACvC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAAC,KAQ9B;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACpC,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,WAAW;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,yBAAyB,EACzB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,yBAAyB;gBACpC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,gBAAgB,EAAE,UAAU;aAC7B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAAC,KAQ7B;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACpC,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,wBAAwB;SACrC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,wBAAwB,EACxB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,wBAAwB;gBACnC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,KAQrB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACpC,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,WAAW;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,oBAAoB,EACpB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,oBAAoB;gBAC/B,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,KAQpB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACpC,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,cAAc;SAC3B,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,mBAAmB,EACnB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,mBAAmB;gBAC9B,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE;oBACb,QAAQ,EAAE,KAAK,CAAC,aAAa;oBAC7B,UAAU,EAAE,EAAE;iBACf;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,oBAAoB,CAChC,SAAiB,EACjB,KAAU,EACV,SAAiB;QAEjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE7D,+CAA+C;QAC/C,2EAA2E;QAC3E,MAAM,gBAAgB,GAAG;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE;gBACN,SAAS;gBACT,SAAS;gBACT,GAAG,KAAK;aACT;SACF,CAAC;QAEF,MAAM,iBAAiB,GAAG;YACxB,IAAI,EAAE;gBACJ,OAAO,EAAE,IAAI;gBACb,SAAS;gBACT,SAAS;gBACT,SAAS,EAAE,QAAQ,CAAC,GAAG;aACxB;SACF,CAAC;QAEF,yDAAyD;QACzD,gFAAgF;QAChF,0CAA0C;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAmB;YACrC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,4BAA4B;YACnC,QAAQ,EAAE,wBAAwB;YAClC,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;YACjB,UAAU,EAAE,EAAE;YACd,aAAa,EAAE,WAAoB,EAAE,gCAAgC;SACtE,CAAC;QAEF,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAC5C,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EAAE,kCAAkC;QAClD;YACE,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,8CAA8C;SACzE,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;gBACjD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;CACF"}

package/dist/services/consent.service.d.ts

@@ -384,6 +384,13 @@ export declare class ConsentService {
      * @returns Parsed body object
      */
     private parseRequestBody;
+    /**
+     * Interpret the `CONSENT_REQUIRE_IDENTITY` env override that gates the
+     * identity-required refusal in `handleApproval`. Defaults to enabled - only
+     * an explicit `"false"`/`"0"` disables it, mirroring the escape-hatch
+     * convention used for `MCPI_HTTP_CHALLENGE` in config.ts.
+     */
+    private isIdentityRequired;
     /**
      * Handle consent approval
      *

package/dist/services/consent.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent.service.d.ts","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAcpD,OAAO,KAAK,EAIV,aAAa,EACd,MAAM,2BAA2B,CAAC;AAYnC,OAAO,EAYL,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AA6D/B,qBAAa,cAAc;IACzB,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;IACpC,OAAO,CAAC,cAAc,CAAC,CAAiB;IAGxC,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C,OAAO,CAAC,gBAAgB,CAAC,CAAgB;IAGzC,OAAO,CAAC,gBAAgB,CAAC,CAAmD;IAC5E,OAAO,CAAC,gBAAgB,CAAC,CAAwD;IAEjF;;;OAGG;gBAED,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,iBAAiB,EAC3B,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,gBAAgB,EACnE,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,qBAAqB;IAW1E;;;;;;;OAOG;YACW,eAAe;IAmC7B;;;;;;;OAOG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACzD,GAAG,OAAO,CAAC,IAAI,CAAC;IAMX,kBAAkB,CAAC,KAAK,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjB;;;;;;;;;;;;OAYG;IACG,uBAAuB,CAC3B,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IAWnB;;;;;OAKG;YACW,sBAAsB;IA8CpC;;;;;;;;;;OAUG;YACW,sBAAsB;IAqEpC;;;;;;;;;;;;;;OAcG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkFzB;;;;;;;;;;;OAWG;YACW,iCAAiC;IA0D/C;;;;;;;;;OASG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,IAAI,CAAC;IAuIhB;;;;;;;;;OASG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsE9B;;;;;;;;;;;;;;OAcG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA0F9B;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAInC;;;;;;;;;;;;;OAaG;IACU,kCAAkC,CAC7C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmGzB;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAC5B,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,EACpC,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA4DzB;;;;;;;;;;;;;;;;OAgBG;IACU,kBAAkB,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;IAwJjD;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,EAC7B,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,CAAC,EAAE,OAAO,mCAAmC,EAAE,cAAc,GAC1E,OAAO,CAAC,OAAO,CAAC;IA+HnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAAE,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,6DAA6D;IAChF,oBAAoB,CAAC,EAAE,OAAO,0BAA0B,EAAE,oBAAoB,EAC9E,SAAS,CAAC,EAAE,MAAM,EAAE,sDAAsD;IAC1E,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAkQlB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAuB3B;;;;;;;;;;;OAWG;IACG,kBAAkB,CACtB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IAyElB;;;;;;;;;;OAUG;IACG,oBAAoB,CACxB,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAgFhB;;;;;;;;;;OAUG;IACG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqCjD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kBAAkB;IAkB1B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,8BAA8B;IAYtC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;;;;;;;;OAaG;YACW,iBAAiB;IAk1B/B;;;;;;;;OAQG;YACW,gBAAgB;IA2lC9B;;;;;;;;OAQG;YACW,cAAc;IAwd5B;;;;;OAKG;YACW,gBAAgB;IA+S9B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;;;;OASG;YACW,oBAAoB;IAkElC;;;;;;;;;;;;OAYG;YACW,oBAAoB;IA4FlC;;;;;OAKG;YACW,iBAAiB;IAmC/B;;;;OAIG;YACW,sBAAsB;IA4FpC;;;;;;;;;OASG;YACW,wBAAwB;IAoftC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IA2BnB;;;;;;;OAOG;YACW,2BAA2B;IAkGzC;;;;;;;;;OASG;IACH,OAAO,CAAC,2BAA2B;IA4GnC;;OAEG;YACW,yBAAyB;IAsDvC;;OAEG;YACW,oBAAoB;IAmDlC;;;;;;;;;;;OAWG;YACW,2BAA2B;IAmDzC;;;;;;;;;OASG;IACU,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBzE;;;;;OAKG;YACW,eAAe;IAgB7B;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAK7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;YACW,sBAAsB;IAmJpC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;OASG;IACH,OAAO,CAAC,4BAA4B;IAqLpC;;OAEG;YACW,UAAU;IAqDxB;;;;;OAKG;YACW,WAAW;IA0GzB;;OAEG;YACW,qBAAqB;CAsBpC"}
+{"version":3,"file":"consent.service.d.ts","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAepD,OAAO,KAAK,EAIV,aAAa,EACd,MAAM,2BAA2B,CAAC;AAYnC,OAAO,EAYL,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AA6D/B,qBAAa,cAAc;IACzB,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;IACpC,OAAO,CAAC,cAAc,CAAC,CAAiB;IAGxC,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C,OAAO,CAAC,gBAAgB,CAAC,CAAgB;IAGzC,OAAO,CAAC,gBAAgB,CAAC,CAAmD;IAC5E,OAAO,CAAC,gBAAgB,CAAC,CAAwD;IAEjF;;;OAGG;gBAED,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,iBAAiB,EAC3B,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,gBAAgB,EACnE,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,qBAAqB;IAW1E;;;;;;;OAOG;YACW,eAAe;IAmC7B;;;;;;;OAOG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACzD,GAAG,OAAO,CAAC,IAAI,CAAC;IAMX,kBAAkB,CAAC,KAAK,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjB;;;;;;;;;;;;OAYG;IACG,uBAAuB,CAC3B,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IAWnB;;;;;OAKG;YACW,sBAAsB;IAwCpC;;;;;;;;;;OAUG;YACW,sBAAsB;IAqEpC;;;;;;;;;;;;;;OAcG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkFzB;;;;;;;;;;;OAWG;YACW,iCAAiC;IA0D/C;;;;;;;;;OASG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,IAAI,CAAC;IAuIhB;;;;;;;;;OASG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsE9B;;;;;;;;;;;;;;OAcG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA0F9B;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAInC;;;;;;;;;;;;;OAaG;IACU,kCAAkC,CAC7C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmGzB;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAC5B,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,EACpC,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA4DzB;;;;;;;;;;;;;;;;OAgBG;IACU,kBAAkB,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;IAwJjD;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,EAC7B,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,CAAC,EAAE,OAAO,mCAAmC,EAAE,cAAc,GAC1E,OAAO,CAAC,OAAO,CAAC;IA+HnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAAE,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,6DAA6D;IAChF,oBAAoB,CAAC,EAAE,OAAO,0BAA0B,EAAE,oBAAoB,EAC9E,SAAS,CAAC,EAAE,MAAM,EAAE,sDAAsD;IAC1E,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IA0QlB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAuB3B;;;;;;;;;;;OAWG;IACG,kBAAkB,CACtB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IAyElB;;;;;;;;;;OAUG;IACG,oBAAoB,CACxB,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAgFhB;;;;;;;;;;OAUG;IACG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqCjD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kBAAkB;IAkB1B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,8BAA8B;IAYtC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;;;;;;;;OAaG;YACW,iBAAiB;IAk1B/B;;;;;;;;OAQG;YACW,gBAAgB;IA2lC9B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;;;;;;OAQG;YACW,cAAc;IAof5B;;;;;OAKG;YACW,gBAAgB;IA+T9B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;;;;OASG;YACW,oBAAoB;IAkElC;;;;;;;;;;;;OAYG;YACW,oBAAoB;IA4FlC;;;;;OAKG;YACW,iBAAiB;IAmC/B;;;;OAIG;YACW,sBAAsB;IA4FpC;;;;;;;;;OASG;YACW,wBAAwB;IAoftC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IA2BnB;;;;;;;OAOG;YACW,2BAA2B;IAkGzC;;;;;;;;;OASG;IACH,OAAO,CAAC,2BAA2B;IA4GnC;;OAEG;YACW,yBAAyB;IAsDvC;;OAEG;YACW,oBAAoB;IAmDlC;;;;;;;;;;;OAWG;YACW,2BAA2B;IAmDzC;;;;;;;;;OASG;IACU,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBzE;;;;;OAKG;YACW,eAAe;IAgB7B;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAK7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;YACW,sBAAsB;IAmJpC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;OASG;IACH,OAAO,CAAC,4BAA4B;IAqLpC;;OAEG;YACW,UAAU;IAqDxB;;;;;OAKG;YACW,WAAW;IA0GzB;;OAEG;YACW,qBAAqB;CAsBpC"}

package/dist/services/consent.service.js

@@ -12,6 +12,7 @@ import { DEFAULT_AGENTSHIELD_URL, DEFAULT_SESSION_CACHE_TTL, KEY_PAIR_TTL_SECOND
 import { STORAGE_KEYS } from "../constants/storage-keys";
 import { loadDay0Config, getDelegationFieldName } from "../utils/day0-config";
 import { buildProviderAuthorizeUrl } from "../runtime/oidc/authorize-url.js";
+import { resolveIdpScopes } from "../runtime/oidc/idp-scopes.js";
 import { validateConsentApprovalRequest, } from "@kya-os/contracts/consent";
 import { AGENTSHIELD_ENDPOINTS, createDelegationAPIResponseSchema, createDelegationResponseSchema, } from "@kya-os/contracts/agentshield-api";
 import { createUnsignedVCJWT, completeVCJWT, parseVCJWT, generateDidKeyFromBase64, createDelegationVerifier, createDidKeyResolver, logger, base64urlEncodeFromBytes, base64urlDecodeToBytes, bytesToBase64, wrapDelegationAsVC, } from "@kya-os/mcp";
@@ -168,14 +169,10 @@ export class ConsentService {
             const identity = await this.runtime.getIdentity();
             // ✅ FIXED: CloudflareProofGenerator only takes identity, not providers
             const proofGenerator = new CloudflareProofGenerator(identity);
-            // Get audit logger
-            const auditLogger = this.runtime.getAuditLogger();
-            if (!auditLogger) {
-                logger.warn("[ConsentService] AuditLogger not available");
-                return;
-            }
-            // Create audit service with fetched config
-            this.auditService = new ConsentAuditService(new ProofService(config, this.runtime), auditLogger, proofGenerator, config, // ✅ Config fetched from remote API
+            // Proof submission and canonical audit delivery are independent. The
+            // lifecycle service submits proofs whenever proofing is enabled and
+            // records events only when the runtime has an auditTrail configured.
+            this.auditService = new ConsentAuditService(new ProofService(config, this.runtime), proofGenerator, config, // ✅ Config fetched from remote API
             this.runtime);
             logger.debug("[ConsentService] Audit service initialized successfully");
         }
@@ -1158,13 +1155,19 @@ export class ConsentService {
             !providerConfig.proxyMode) {
             // Use providerConfig.clientId from AgentShield dashboard config
             const oauthClientId = providerConfig.clientId || projectId;
+            // The `scopes` argument holds MCP-I delegation scopes (e.g. "greet:execute"),
+            // which the identity provider has never heard of. Only the provider's own
+            // scopes belong in its authorization URL; delegation scopes already travel
+            // separately in `stateData.scopes` above, for the callback to mint the
+            // delegation.
+            const idpScopes = resolveIdpScopes(providerConfig);
             logger.debug("[ConsentService] Using direct OAuth mode (PKCE)", {
                 provider: provider || "unknown",
                 authorizationUrl: providerConfig.authorizationUrl,
                 supportsPKCE: providerConfig.supportsPKCE,
                 clientId: oauthClientId.substring(0, 8) + "...",
             });
-            return this.buildDirectOAuthUrl(providerConfig, oauthClientId, `${serverUrl}/oauth/callback`, scopes, stateParam, codeChallenge);
+            return this.buildDirectOAuthUrl(providerConfig, oauthClientId, `${serverUrl}/oauth/callback`, idpScopes, stateParam, codeChallenge);
         }
         // Phase 3: Validate custom parameters don't conflict with reserved parameters
         const RESERVED_PARAMS = [
@@ -1199,7 +1202,9 @@ export class ConsentService {
         oauthUrl.searchParams.set("response_type", "code");
         oauthUrl.searchParams.set("client_id", projectId); // Use projectId as client_id
         oauthUrl.searchParams.set("redirect_uri", `${serverUrl}/oauth/callback`);
-        oauthUrl.searchParams.set("scope", scopes.join(" "));
+        // Same separation as the direct-PKCE branch above: `scopes` is the MCP-I
+        // delegation scopes, not what belongs in the IdP-facing `scope` param.
+        oauthUrl.searchParams.set("scope", resolveIdpScopes(providerConfig).join(" "));
         oauthUrl.searchParams.set("state", stateParam);
         // ✅ Pass provider to AgentShield bouncer so it selects the correct auth method
         // This is critical when multiple providers are configured for a project
@@ -3223,6 +3228,19 @@ export class ConsentService {
             throw new Error(`Failed to parse request body: ${error instanceof Error ? error.message : "Unknown error"}`);
         }
     }
+    /**
+     * Interpret the `CONSENT_REQUIRE_IDENTITY` env override that gates the
+     * identity-required refusal in `handleApproval`. Defaults to enabled - only
+     * an explicit `"false"`/`"0"` disables it, mirroring the escape-hatch
+     * convention used for `MCPI_HTTP_CHALLENGE` in config.ts.
+     */
+    isIdentityRequired() {
+        const raw = this.env.CONSENT_REQUIRE_IDENTITY;
+        if (raw === undefined || raw === null)
+            return true;
+        const normalized = String(raw).trim().toLowerCase();
+        return normalized !== "false" && normalized !== "0";
+    }
     /**
      * Handle consent approval
      *
@@ -3457,11 +3475,30 @@ export class ConsentService {
             // ✅ Lazy initialization with projectId
             const auditService = await this.getAuditService(projectId);
             // Check if user needs credentials before delegation
-            // Skip credential requirement for consent-only mode (provider_type: 'none')
-            const isConsentOnlyMode = providerType === CONSENT_PROVIDER_TYPES.NONE;
-            const needsCredentials = !isConsentOnlyMode &&
-                !approvalRequest.user_did &&
-                !approvalRequest.oauth_identity;
+            // Skip credential requirement for consent-only mode (provider_type: 'none').
+            // Read the EFFECTIVE provider_type off bodyObj, not the `providerType`
+            // captured above: the post-OAuth/post-credential clickwrap branches above
+            // rewrite bodyObj.provider_type to 'oauth'/'password' while `providerType`
+            // stays the original raw 'none'. Gating on the stale value would treat
+            // those already-authenticated clickwrap submissions as consent-only and
+            // skip the identity check entirely.
+            const effectiveProviderType = bodyObj.provider_type;
+            const isConsentOnlyMode = effectiveProviderType === CONSENT_PROVIDER_TYPES.NONE;
+            // Resolve identity once, ahead of the gate below, using the same priority
+            // createDelegation used to apply internally (request.user_did first, then
+            // session lookup). The resolved value is threaded into createDelegation so
+            // it is never resolved a second time.
+            let resolvedUserDid = approvalRequest.user_did;
+            if (!resolvedUserDid && approvalRequest.session_id) {
+                try {
+                    resolvedUserDid =
+                        (await this.getUserDidForSession(approvalRequest.session_id, approvalRequest.oauth_identity || undefined)) ?? undefined;
+                }
+                catch (error) {
+                    logger.debug("[ConsentService] Failed to resolve userDid ahead of identity gate:", error);
+                }
+            }
+            const needsCredentials = !isConsentOnlyMode && !resolvedUserDid;
             if (needsCredentials && auditService) {
                 await auditService
                     .logCredentialRequired({
@@ -3479,12 +3516,25 @@ export class ConsentService {
                         error: err instanceof Error ? err.message : String(err),
                     });
                 });
-                // Note: We don't redirect here - the consent flow continues
-                // The credential_required event is just for audit tracking
+            }
+            // Fail closed: an authenticated-provider approval with no resolvable user
+            // identity must not mint a delegation. Consent-only mode is exempt - it
+            // legitimately has no user identity. Gated on CONSENT_REQUIRE_IDENTITY so
+            // a bad interaction can be switched off in production without a redeploy;
+            // defaults to enabled.
+            if (needsCredentials && this.isIdentityRequired()) {
+                return new Response(JSON.stringify({
+                    success: false,
+                    error: "User identity is required to approve this request",
+                    error_code: "identity_required",
+                }), {
+                    status: 403,
+                    headers: { "Content-Type": "application/json" },
+                });
             }
             // Create delegation via AgentShield API
             logger.debug("[ConsentService] Creating delegation...");
-            const delegationResult = await this.createDelegation(approvalRequest, resolveExpirationDays(consentConfig.expirationDays));
+            const delegationResult = await this.createDelegation(approvalRequest, resolveExpirationDays(consentConfig.expirationDays), resolvedUserDid ?? null);
             if (!delegationResult.success) {
                 logger.error("[ConsentService] Delegation creation failed:", {
                     error: delegationResult.error,
@@ -3511,19 +3561,9 @@ export class ConsentService {
             // ✅ After successful delegation creation - log audit events
             if (auditService && delegationResult.success) {
                 try {
-                    // Get userDid (resolved via OAuth identity resolution)
-                    // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
-                    let userDid;
-                    if (approvalRequest.session_id) {
-                        try {
-                            userDid =
-                                (await this.getUserDidForSession(approvalRequest.session_id, approvalRequest.oauth_identity || undefined)) ?? undefined; // Phase 5: Convert null to undefined
-                        }
-                        catch (error) {
-                            logger.warn("[ConsentService] Failed to get userDid for audit logging:", error);
-                            // Continue without userDid - audit events can still be logged
-                        }
-                    }
+                    // Reuse the identity resolved ahead of the gate above - do not
+                    // read KV a second time for the same session.
+                    const userDid = resolvedUserDid;
                     await auditService.logConsentApproval({
                         sessionId: approvalRequest.session_id,
                         userDid,
@@ -3587,7 +3627,7 @@ export class ConsentService {
      * @param request - Approval request
      * @returns Delegation creation result
      */
-    async createDelegation(request, expirationDaysOverride) {
+    async createDelegation(request, expirationDaysOverride, resolvedUserDid) {
         const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
         const apiKey = this.env.AGENTSHIELD_API_KEY;
         if (!apiKey) {
@@ -3602,46 +3642,59 @@ export class ConsentService {
             // Load Day0 configuration to determine field name and API capabilities
             await loadDay0Config(this.env.DELEGATION_STORAGE);
             const fieldName = await getDelegationFieldName(this.env.DELEGATION_STORAGE);
-            // Get userDID - FIRST check if passed in request, THEN fallback to session storage
-            // request.user_did takes priority to avoid KV eventual consistency issues
-            // This fixes the bug where credential auth resolves userDid but it's not found in storage
-            let userDid = request.user_did;
-            // Only fetch from storage if not already provided in request
-            if (!userDid && request.session_id) {
-                try {
-                    logger.debug("[ConsentService] Getting User DID for session:", {
-                        sessionId: request.session_id.substring(0, 20) + "...",
-                        hasOAuthIdentity: !!request.oauth_identity,
-                        oauthProvider: request.oauth_identity?.provider,
-                        hasStorage: !!this.env.DELEGATION_STORAGE,
-                    });
-                    // Pass OAuth identity if available in approval request (can be null/undefined)
-                    // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
-                    // Phase 5: Returns null if no identity found (session stays anonymous)
-                    userDid =
-                        (await this.getUserDidForSession(request.session_id, request.oauth_identity || undefined // Explicitly handle null as undefined
-                        )) ?? undefined;
-                    logger.debug("[ConsentService] User DID retrieved from storage:", {
-                        userDid: userDid?.substring(0, 20) + "...",
-                        hasUserDid: !!userDid,
-                    });
-                }
-                catch (error) {
-                    logger.debug("[ConsentService] Failed to get/generate userDid:", error);
-                    // Continue without userDid - delegation will work without user_identifier
-                    // This is valid for non-OAuth scenarios, but we should log this as a warning
-                    logger.warn("[ConsentService] Delegation will be created without user_identifier - this may affect user tracking");
-                }
-            }
-            else if (userDid) {
-                // userDid was provided in request (e.g., from credential auth flow)
-                logger.debug("[ConsentService] Using provided user_did from request:", {
-                    userDid: userDid.substring(0, 20) + "...",
-                    source: "request.user_did",
+            // Get userDID. If the caller (handleApproval) already resolved it, use that
+            // directly and skip the lookup below entirely - it was already attempted
+            // with the same priority (request.user_did first, then session storage),
+            // and repeating it would read KV a second time for no benefit.
+            let userDid;
+            if (resolvedUserDid !== undefined) {
+                userDid = resolvedUserDid ?? undefined;
+                logger.debug("[ConsentService] Using pre-resolved userDid:", {
+                    hasUserDid: !!userDid,
                 });
             }
             else {
-                logger.debug("[ConsentService] No session_id provided - skipping User DID generation");
+                // FIRST check if passed in request, THEN fallback to session storage
+                // request.user_did takes priority to avoid KV eventual consistency issues
+                // This fixes the bug where credential auth resolves userDid but it's not found in storage
+                userDid = request.user_did;
+                // Only fetch from storage if not already provided in request
+                if (!userDid && request.session_id) {
+                    try {
+                        logger.debug("[ConsentService] Getting User DID for session:", {
+                            sessionId: request.session_id.substring(0, 20) + "...",
+                            hasOAuthIdentity: !!request.oauth_identity,
+                            oauthProvider: request.oauth_identity?.provider,
+                            hasStorage: !!this.env.DELEGATION_STORAGE,
+                        });
+                        // Pass OAuth identity if available in approval request (can be null/undefined)
+                        // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
+                        // Phase 5: Returns null if no identity found (session stays anonymous)
+                        userDid =
+                            (await this.getUserDidForSession(request.session_id, request.oauth_identity || undefined // Explicitly handle null as undefined
+                            )) ?? undefined;
+                        logger.debug("[ConsentService] User DID retrieved from storage:", {
+                            userDid: userDid?.substring(0, 20) + "...",
+                            hasUserDid: !!userDid,
+                        });
+                    }
+                    catch (error) {
+                        logger.debug("[ConsentService] Failed to get/generate userDid:", error);
+                        // Continue without userDid - delegation will work without user_identifier
+                        // This is valid for non-OAuth scenarios, but we should log this as a warning
+                        logger.warn("[ConsentService] Delegation will be created without user_identifier - this may affect user tracking");
+                    }
+                }
+                else if (userDid) {
+                    // userDid was provided in request (e.g., from credential auth flow)
+                    logger.debug("[ConsentService] Using provided user_did from request:", {
+                        userDid: userDid.substring(0, 20) + "...",
+                        source: "request.user_did",
+                    });
+                }
+                else {
+                    logger.debug("[ConsentService] No session_id provided - skipping User DID generation");
+                }
             }
             const expiresInDays = expirationDaysOverride ?? DEFAULT_EXPIRATION_DAYS;
             // Phase 2 VC-Only: Issue Delegation VC if we have a session and userDid