@kya-os/mcp-i-cloudflare 1.15.0 → 1.16.0

package/dist/services/consent.service.js

@@ -8,9 +8,10 @@
  */
 import { ConsentConfigService } from "./consent-config.service";
 import { TemplateRenderer } from "./consent-templates/template-renderer";
-import { DEFAULT_CHECKPOINT_URL, DEFAULT_SESSION_CACHE_TTL, KEY_PAIR_TTL_SECONDS, CONSENT_PROVIDER_TYPES, } from "../constants";
+import { CHECKPOINT_CONFIG_TIMEOUT_MS, DEFAULT_CHECKPOINT_URL, DEFAULT_SESSION_CACHE_TTL, KEY_PAIR_TTL_SECONDS, CONSENT_PROVIDER_TYPES, } from "../constants";
 import { STORAGE_KEYS, isPendingDelegationId } from "../constants/storage-keys";
 import { loadDay0Config, getDelegationFieldName } from "../utils/day0-config";
+import { normalizeOAuthSubject, oauthProfileString, } from "../utils/oauth-profile";
 import { buildProviderAuthorizeUrl } from "../runtime/oidc/authorize-url.js";
 import { resolveIdpScopes } from "../runtime/oidc/idp-scopes.js";
 import { validateConsentApprovalRequest, } from "@kya-os/contracts/consent";
@@ -22,13 +23,17 @@ import { ConsentAuditService } from "./consent-audit.service";
 import { CloudflareProofGenerator } from "../proof-generator";
 import { ProofService } from "./proof.service";
 import { withMandateConstraints } from "./delegation-mandate";
+import { isPostCredentialMarker, isPostOAuthMarker, resolveApprovalRoute, stripServerOwnedFields, } from "./approval-route";
 import { createCredentialAuthHandler } from "./credential-auth.handler";
+import { parseMultipartFields, reconstructMalformedMultipart, isMalformedSingleEntry, extractFieldNameFromKey, } from "./multipart-parser";
 import { IdpTokenStorage } from "./idp-token-storage";
 import { OAuthSecurityService } from "./oauth-security.service";
 import { didKeyFragment } from "@kya-os/mcp";
 import { CONSENT_BUNDLE, CONSENT_BUNDLE_SIZE, CONSENT_BUNDLE_PATH, CONSENT_BUNDLE_HASH, resolveExpirationDays, DEFAULT_EXPIRATION_DAYS, resolveCapabilitiesForScopes, } from "@kya-os/consent";
 import { calculateDOInstanceId, parseDORoutingStrategy, parseDOShardCount, } from "../utils/do-routing";
 import { defaultProviders } from "@kya-os/provider-registry";
+import { z } from "zod";
+import { isValidCheckpointProjectId } from "../utils/checkpoint-project-id";
 const BUILTIN_OAUTH_PROVIDER_IDS = new Set(defaultProviders
     .filter((p) => p.authType === "oauth2")
     .map((p) => p.id.toLowerCase()));
@@ -59,6 +64,76 @@ const MANDATE_ERROR = {
     error: "Delegation limits could not be resolved",
     error_code: "mandate_error",
 };
+/**
+ * How long a credential sign-in's display fields wait for the clickwrap.
+ * Matches the identity assertion's lifetime (`mintIdentityAssertion`), since
+ * the clickwrap cannot mint after that anyway.
+ */
+const CREDENTIAL_CLICKWRAP_USER_TTL_SECONDS = 600;
+const OAUTH_REQUIREMENT_ERROR = {
+    error: "Sign-in requirement could not be determined",
+    error_code: "oauth_requirement_unavailable",
+};
+/**
+ * Thrown by `isOAuthRequired` when Checkpoint is in use (CHECKPOINT_API_KEY is
+ * set) but its answer about the project's sign-in provider cannot be read. The
+ * consent page refuses rather than render an approvable consent-only screen.
+ *
+ * `reason` is fixed text written here, plus at most an error's `name` or an
+ * HTTP status (never an upstream error message), so it is safe to log.
+ */
+export class OAuthRequirementUnavailableError extends Error {
+    projectId;
+    reason;
+    constructor(projectId, reason) {
+        super(`Could not determine whether project "${projectId}" requires sign-in: ${reason}`);
+        this.projectId = projectId;
+        this.reason = reason;
+        this.name = "OAuthRequirementUnavailableError";
+    }
+}
+/**
+ * A project's default sign-in provider, as Checkpoint's merged config reports
+ * it (`oauth: { provider, type: "oauth2" | "credential" } | null`, see
+ * Checkpoint `apps/web/lib/services/kyaos-config.service.ts`). `type` stays a
+ * plain string: every configured provider, whatever its type, is a sign-in
+ * step, so an unknown future type must not make the answer unreadable.
+ */
+const defaultProviderSchema = z
+    .object({ provider: z.string().min(1), type: z.string().optional() })
+    .nullable();
+/** Checkpoint's response: `{ success: true, data: { config: { oauth } } }`. */
+const checkpointConfigResponseSchema = z.object({
+    success: z.literal(true),
+    data: z.object({ config: z.object({ oauth: defaultProviderSchema }) }),
+});
+/** Root-level shapes the fallback read before it followed Checkpoint's envelope. */
+const legacyRootOAuthSchema = z.object({ oauth: defaultProviderSchema });
+const legacyRootOAuthProviderSchema = z.object({
+    oauth_provider: z.string().min(1).nullable(),
+});
+/**
+ * Read the default provider out of a Checkpoint config response body.
+ * `ok: false` means the body has none of the known shapes, so the answer
+ * cannot be read (a missing `oauth` key included: Checkpoint sends `null`
+ * when a project has no provider).
+ */
+function parseProjectDefaultProvider(body) {
+    const current = checkpointConfigResponseSchema.safeParse(body);
+    if (current.success) {
+        return { ok: true, defaultProvider: current.data.data.config.oauth };
+    }
+    const legacyOAuth = legacyRootOAuthSchema.safeParse(body);
+    if (legacyOAuth.success) {
+        return { ok: true, defaultProvider: legacyOAuth.data.oauth };
+    }
+    const legacyOAuthProvider = legacyRootOAuthProviderSchema.safeParse(body);
+    if (legacyOAuthProvider.success) {
+        const provider = legacyOAuthProvider.data.oauth_provider;
+        return { ok: true, defaultProvider: provider ? { provider } : null };
+    }
+    return { ok: false };
+}
 export class ConsentService {
     configService;
     renderer;
@@ -659,6 +734,51 @@ export class ConsentService {
     generateDidKeyFromPublicKey(publicKeyBase64) {
         return generateDidKeyFromBase64(publicKeyBase64);
     }
+    /**
+     * The session's own throwaway DID, or undefined.
+     *
+     * A session record also holds a signed-in user's DID once the OAuth callback
+     * or the credential handler has run (`updateSessionWithIdentity`), and that
+     * write keeps the earlier throwaway `keyPair`. So the DID counts as
+     * throwaway only when it is the did:key of the key pair stored with it.
+     */
+    sessionThrowawayDid(session) {
+        const userDid = session?.userDid;
+        const publicKey = session?.keyPair?.publicKey;
+        if (typeof userDid !== "string" || typeof publicKey !== "string") {
+            return undefined;
+        }
+        try {
+            return this.generateDidKeyFromPublicKey(publicKey) === userDid
+                ? userDid
+                : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * A fresh throwaway did:key and its key pair. Nothing is stored.
+     *
+     * @returns The key pair (its `did` is the throwaway DID), or null if key
+     *   generation fails
+     */
+    async createThrowawayIdentity() {
+        try {
+            const rawKeyPair = await new WebCryptoProvider().generateKeyPair();
+            const did = this.generateDidKeyFromPublicKey(rawKeyPair.publicKey);
+            return {
+                did,
+                publicKey: rawKeyPair.publicKey,
+                privateKey: rawKeyPair.privateKey,
+                keyId: `${did}#${didKeyFragment(did)}`,
+            };
+        }
+        catch (error) {
+            logger.error("[ConsentService] Failed to generate a throwaway identity:", error);
+            return null;
+        }
+    }
     /**
      * Generate an ephemeral userDid for consent-only flows
      *
@@ -671,7 +791,10 @@ export class ConsentService {
      * and used for delegation storage during the current session.
      *
      * @param sessionId - Session ID to associate the ephemeral userDid with
-     * @returns Ephemeral userDid (did:key format) or null if generation fails
+     * @returns Ephemeral userDid (did:key format), or null if generation fails,
+     *   the session record can't be read before the write, or the session
+     *   already holds a signed-in user's DID (which is never returned or
+     *   overwritten here)
      */
     async generateEphemeralUserDidForSession(sessionId) {
         // Check if session already has a userDid and key pair
@@ -679,13 +802,18 @@ export class ConsentService {
             try {
                 const sessionKey = STORAGE_KEYS.session(sessionId);
                 const existingSession = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
-                if (existingSession?.userDid) {
-                    logger.debug("[ConsentService] Session already has userDid, reusing:", {
+                const throwawayDid = this.sessionThrowawayDid(existingSession);
+                if (throwawayDid) {
+                    logger.debug("[ConsentService] Session already has a throwaway userDid, reusing:", {
                         sessionId: sessionId.substring(0, 20) + "...",
-                        userDid: existingSession.userDid.substring(0, 20) + "...",
-                        hasKeyPair: !!existingSession.keyPair,
+                        userDid: throwawayDid.substring(0, 20) + "...",
                     });
-                    return existingSession.userDid;
+                    return throwawayDid;
+                }
+                // SECURITY: a signed-in user's DID is neither returned (consent-only
+                // must not mint under it) nor overwritten.
+                if (existingSession?.userDid) {
+                    return null;
                 }
             }
             catch (error) {
@@ -695,24 +823,34 @@ export class ConsentService {
         // Generate new ephemeral keypair - THIS TIME WE STORE IT!
         logger.debug("[ConsentService] Generating ephemeral key pair for consent-only VC signing");
         try {
-            const crypto = new WebCryptoProvider();
-            const rawKeyPair = await crypto.generateKeyPair();
-            // Generate did:key from public key
-            const ephemeralUserDid = this.generateDidKeyFromPublicKey(rawKeyPair.publicKey);
-            const keyId = `${ephemeralUserDid}#${didKeyFragment(ephemeralUserDid)}`;
-            // Create full UserKeyPair for VC signing
-            const keyPair = {
-                did: ephemeralUserDid,
-                publicKey: rawKeyPair.publicKey,
-                privateKey: rawKeyPair.privateKey,
-                keyId,
-            };
+            // Full UserKeyPair for VC signing
+            const keyPair = await this.createThrowawayIdentity();
+            if (!keyPair) {
+                return null;
+            }
+            const ephemeralUserDid = keyPair.did;
             // Store key pair in session for VC signing
             // This enables consent-only users to sign their delegation VCs!
             if (this.env.DELEGATION_STORAGE) {
+                const sessionKey = STORAGE_KEYS.session(sessionId);
+                let existingSession;
+                try {
+                    existingSession = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
+                }
+                catch (readError) {
+                    // The check above may have been skipped by a failed read too, so
+                    // without this record there is no proof the session holds no
+                    // signed-in DID. Write nothing.
+                    logger.warn("[ConsentService] Failed to re-read session before storing ephemeral key pair:", readError);
+                    return null;
+                }
+                // SECURITY: re-check before writing, so a signed-in DID is never
+                // overwritten even when the first read failed.
+                if (existingSession?.userDid &&
+                    !this.sessionThrowawayDid(existingSession)) {
+                    return null;
+                }
                 try {
-                    const sessionKey = STORAGE_KEYS.session(sessionId);
-                    const existingSession = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
                     await this.env.DELEGATION_STORAGE.put(sessionKey, JSON.stringify({
                         ...existingSession,
                         userDid: ephemeralUserDid,
@@ -929,17 +1067,45 @@ export class ConsentService {
     /**
      * Check if OAuth is required for delegation creation
      *
-     * Determines if OAuth flow should be used instead of direct delegation creation.
-     * OAuth is required if:
-     * - Project has OAuth provider configured in Checkpoint
+     * Determines if a sign-in step must come before consent.
+     * Sign-in is required if:
+     * - Project has a default sign-in provider configured in Checkpoint
      * - No OAuth identity is present in the request
      *
+     * A "credential" default provider (a merchant's own sign-in form) counts as
+     * required too. `true` never forces an OAuth redirect by itself: the consent
+     * page renders the credential form instead whenever the provider has a
+     * credential config.
+     *
      * @param projectId - Project ID to check
      * @param oauthIdentity - Optional OAuth identity from cookie
      * @param toolOAuthProvider - Optional tool-specific OAuth provider (takes precedence)
-     * @returns True if OAuth redirect is required
+     * @returns True if a sign-in step is required
+     * @throws OAuthRequirementUnavailableError when CHECKPOINT_API_KEY is set
+     *   and Checkpoint's config cannot be read (request failed or timed out,
+     *   non-OK status, unparseable body, or no `oauth` field), whatever
+     *   `toolProtection` says
+     *
+     * @example
+     * // Checkpoint answers { success: true, data: { config: { oauth: { provider: "github", type: "oauth2" } } } }
+     * await consentService.isOAuthRequired("proj123", undefined, undefined, {
+     *   requiresDelegation: true,
+     *   requiredScopes: ["cart:write"],
+     * }); // true
      */
     async isOAuthRequired(projectId, oauthIdentity, toolOAuthProvider, toolProtection) {
+        const { required } = await this.resolveSignInRequirement(projectId, oauthIdentity, toolOAuthProvider, toolProtection);
+        return required;
+    }
+    /**
+     * `isOAuthRequired`, plus the project's default provider when Checkpoint's
+     * config is what made sign-in required. The consent page names that
+     * provider so the OAuth callback signs it into the identity assertion,
+     * without asking Checkpoint a second time.
+     *
+     * @throws OAuthRequirementUnavailableError as `isOAuthRequired` does
+     */
+    async resolveSignInRequirement(projectId, oauthIdentity, toolOAuthProvider, toolProtection) {
         // Priority 0: Check for consent-only mode (authorization.type === 'none')
         // Consent-only means delegation is required but NO OAuth provider is needed
         if (toolProtection?.authorization?.type === "none") {
@@ -947,15 +1113,15 @@ export class ConsentService {
                 projectId,
                 requiresDelegation: toolProtection.requiresDelegation,
             });
-            return false;
+            return { required: false };
         }
         // If OAuth identity is already present, OAuth is not required
         if (oauthIdentity && oauthIdentity.provider && oauthIdentity.subject) {
-            return false;
+            return { required: false };
         }
         // If tool specifically requires an OAuth provider, it's required immediately
         if (toolOAuthProvider) {
-            return true;
+            return { required: true };
         }
         // Phase 2: If toolOAuthProvider is undefined but tool requires delegation,
         // use ProviderResolver to check if a provider can be resolved
@@ -972,25 +1138,23 @@ export class ConsentService {
                             toolRequiresDelegation: toolProtection.requiresDelegation,
                             hasToolOAuthProvider: !!toolOAuthProvider,
                         });
-                        return true;
+                        return { required: true };
                     }
                 }
                 catch (error) {
                     // Check if this is ConsentOnlyModeError - not a real error
                     if (error instanceof Error && error.name === "ConsentOnlyModeError") {
                         logger.debug("[ConsentService] Tool is consent-only mode (ConsentOnlyModeError), OAuth NOT required", { projectId });
-                        return false;
+                        return { required: false };
                     }
-                    // Check for CredentialAuthModeError - credential auth does NOT require OAuth
-                    // Use multiple detection methods to handle bundled code where class names may be mangled
-                    const isCredentialAuthError = error instanceof Error &&
-                        (error.name === "CredentialAuthModeError" ||
-                            error.constructor?.name === "CredentialAuthModeError" ||
-                            ("provider" in error &&
-                                typeof error.provider === "string"));
+                    // Check for CredentialAuthModeError - credential auth does NOT require OAuth.
+                    // Match the name the class sets explicitly (it survives bundling), never
+                    // a duck-typed `provider` property: any other resolver error must go on
+                    // to the Checkpoint check below, which fails closed
+                    const isCredentialAuthError = error instanceof Error && error.name === "CredentialAuthModeError";
                     if (isCredentialAuthError) {
                         logger.debug("[ConsentService] Tool uses credential auth (CredentialAuthModeError), OAuth NOT required", { projectId });
-                        return false;
+                        return { required: false };
                     }
                     // ProviderResolver failed - log but continue to fallback check
                     logger.warn("[ConsentService] ProviderResolver failed to resolve provider, falling back to project config check:", {
@@ -1000,37 +1164,92 @@ export class ConsentService {
                 }
             }
         }
-        // Check project config to see if OAuth is configured
+        // Fallback: ask Checkpoint for the project's default sign-in provider
+        const apiKey = this.env.CHECKPOINT_API_KEY;
+        if (!apiKey) {
+            // CHECKPOINT_API_KEY is what turns the Checkpoint integration on: without
+            // it there is no tool protection service or provider resolver, and
+            // createDelegation refuses with api_key_missing. A missing key means
+            // Checkpoint is not in use, so there is no sign-in provider to require.
+            return { required: false };
+        }
         try {
-            const checkpointUrl = this.env.CHECKPOINT_API_URL || DEFAULT_CHECKPOINT_URL;
-            const apiKey = this.env.CHECKPOINT_API_KEY;
-            if (!apiKey) {
-                // No API key - can't check, assume OAuth not required
-                return false;
-            }
-            // Fetch project config to check for OAuth provider
-            const configUrl = `${checkpointUrl}/api/v1/bouncer/projects/${projectId}/config`;
-            const response = await fetch(configUrl, {
+            const defaultProvider = await this.fetchProjectDefaultProvider(projectId, apiKey);
+            // Any default provider is a sign-in step, "credential" included
+            return {
+                required: defaultProvider !== null,
+                defaultProvider: defaultProvider?.provider,
+            };
+        }
+        catch (error) {
+            const unavailable = error instanceof OAuthRequirementUnavailableError
+                ? error
+                : new OAuthRequirementUnavailableError(projectId, "reading the Checkpoint config failed unexpectedly");
+            logger.warn("[ConsentService] Failed to check OAuth requirement:", {
+                projectId,
+                reason: unavailable.reason,
+            });
+            // Fail closed whatever `toolProtection` says: the consent page mints a
+            // delegation for the URL's scopes, not the tool's, so an unprotected or
+            // unknown tool name must not turn an unknown answer into an approvable
+            // consent-only screen
+            throw unavailable;
+        }
+    }
+    /**
+     * Fetch the project's default sign-in provider from Checkpoint's config
+     * (`GET /api/v1/bouncer/projects/{projectId}/config`, `data.config.oauth`).
+     *
+     * @returns The provider, or null when Checkpoint says the project has none
+     * @throws OAuthRequirementUnavailableError when the answer cannot be read
+     */
+    async fetchProjectDefaultProvider(projectId, apiKey) {
+        // The id comes from the consent URL's query string: one that cannot be a
+        // Checkpoint project never reaches Checkpoint
+        if (!isValidCheckpointProjectId(projectId)) {
+            throw new OAuthRequirementUnavailableError(projectId, "the project id is not a valid Checkpoint project id");
+        }
+        const checkpointUrl = this.env.CHECKPOINT_API_URL || DEFAULT_CHECKPOINT_URL;
+        const configUrl = `${checkpointUrl}/api/v1/bouncer/projects/${encodeURIComponent(projectId)}/config`;
+        let response;
+        try {
+            response = await fetch(configUrl, {
                 headers: {
                     Authorization: `Bearer ${apiKey}`,
                     "Content-Type": "application/json",
                 },
+                signal: AbortSignal.timeout(CHECKPOINT_CONFIG_TIMEOUT_MS),
             });
-            if (response.ok) {
-                const config = await response.json();
-                // Check if OAuth provider is configured
-                // OAuth is required if project has OAuth provider but no identity is present
-                const hasOAuthProvider = config?.oauth?.provider || config?.oauth_provider;
-                return !!hasOAuthProvider;
-            }
-            // If API call fails, default to not requiring OAuth (backward compatibility)
-            return false;
         }
         catch (error) {
-            logger.warn("[ConsentService] Failed to check OAuth requirement:", error);
-            // On error, default to not requiring OAuth (backward compatibility)
-            return false;
+            // Only the error's name (TypeError, TimeoutError, ...): its message can
+            // carry the URL or other request detail
+            const errorName = error instanceof Error ? error.name : "unknown";
+            throw new OAuthRequirementUnavailableError(projectId, `the Checkpoint config request failed (${errorName})`);
+        }
+        if (!response.ok) {
+            // Release the connection: an unread subrequest body holds it until GC
+            await response.body?.cancel().catch(() => { });
+            throw new OAuthRequirementUnavailableError(projectId, `Checkpoint answered ${response.status}`);
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            throw new OAuthRequirementUnavailableError(projectId, "the Checkpoint config response is not JSON");
         }
+        const parsed = parseProjectDefaultProvider(body);
+        if (!parsed.ok) {
+            throw new OAuthRequirementUnavailableError(projectId, "the Checkpoint config response has no oauth field");
+        }
+        return parsed.defaultProvider;
+    }
+    oauthRequirementErrorResponse() {
+        return new Response(JSON.stringify({ success: false, ...OAUTH_REQUIREMENT_ERROR }), {
+            status: 500,
+            headers: { "Content-Type": "application/json" },
+        });
     }
     /**
      * Build OAuth authorization URL
@@ -1683,9 +1902,23 @@ export class ConsentService {
                         // Validate it's valid JSON before passing to client
                         try {
                             const parsed = JSON.parse(decodeURIComponent(cookieValue));
-                            // Basic validation - ensure it has required fields
-                            if (parsed && parsed.provider && parsed.subject) {
-                                oauthIdentity = parsed;
+                            if (parsed &&
+                                typeof parsed === "object" &&
+                                !Array.isArray(parsed)) {
+                                const claims = parsed;
+                                const provider = oauthProfileString(claims.provider);
+                                const subject = normalizeOAuthSubject(claims.subject);
+                                // Older GitHub callbacks stored numeric IDs in this display
+                                // cookie. Normalize only scalar subjects before rendering;
+                                // this cookie does not establish a verified delegation.
+                                if (provider && subject) {
+                                    oauthIdentity = {
+                                        provider,
+                                        subject,
+                                        email: oauthProfileString(claims.email),
+                                        name: oauthProfileString(claims.name),
+                                    };
+                                }
                             }
                         }
                         catch (parseError) {
@@ -1709,7 +1942,19 @@ export class ConsentService {
                 protection = await toolProtectionService.checkToolProtection(tool, agentDidObj.did);
                 toolOAuthProvider = protection?.oauthProvider;
             }
-            const oauthRequired = await this.isOAuthRequired(projectId, oauthIdentity, toolOAuthProvider, protection);
+            let oauthRequired;
+            let defaultProvider;
+            try {
+                ({ required: oauthRequired, defaultProvider } =
+                    await this.resolveSignInRequirement(projectId, oauthIdentity, toolOAuthProvider, protection));
+            }
+            catch (error) {
+                // An unknown sign-in requirement must never render an approvable page
+                if (error instanceof OAuthRequirementUnavailableError) {
+                    return this.oauthRequirementErrorResponse();
+                }
+                throw error;
+            }
             // Phase 2: Resolve provider for tool
             // Priority: 1) URL query param (from buildConsentUrl), 2) providerResolver, 3) toolOAuthProvider
             let provider;
@@ -1784,6 +2029,20 @@ export class ConsentService {
                     tool,
                 });
             }
+            // PRIORITY 4: the project's default provider, when Checkpoint's config
+            // is what made sign-in required and nothing above named one. Checkpoint
+            // would pick the same provider. Naming it lets the OAuth callback sign it
+            // into the identity assertion, which /consent/approve requires for an
+            // OAuth approval. A credential default provider gets the credential
+            // form below.
+            if (!provider && oauthRequired && defaultProvider) {
+                provider = defaultProvider;
+                logger.debug("[ConsentService] Using the project's default provider:", {
+                    provider,
+                    projectId,
+                    tool,
+                });
+            }
             let resolvedOAuthUrl;
             let isOAuthRequired = false;
             // ✅ CONFIG-BASED CREDENTIAL DETECTION (replaces string matching)
@@ -2230,54 +2489,62 @@ export class ConsentService {
      */
     async parseRequestBody(request) {
         const contentType = request.headers.get("content-type") || "";
-        // Helper function to parse form fields into body object
-        const parseFormFields = (entries) => {
-            const body = {};
-            for (const [key, value] of entries) {
-                // Handle special fields that need parsing
-                if (key === "scopes" || key === "scopes[]") {
-                    // Scopes come as JSON string
-                    try {
-                        body["scopes"] = JSON.parse(value);
-                    }
-                    catch {
-                        // If not JSON, treat as single scope or array
-                        body["scopes"] = value.includes(",") ? value.split(",") : [value];
-                    }
+        // Coerce a single form field into the body object, applying the
+        // special-case parsing for scopes / oauth_identity / termsAccepted /
+        // customFields. Single source of truth shared by every form/multipart
+        // parsing path below.
+        // Returns true when a value was actually stored on `body` (false for the
+        // one case that can silently skip: invalid `customFields` JSON), so
+        // callers can tell "field present but dropped" apart from "field set".
+        const coerceFieldInto = (body, key, value) => {
+            // Handle special fields that need parsing
+            if (key === "scopes" || key === "scopes[]") {
+                // Scopes come as JSON string
+                try {
+                    body["scopes"] = JSON.parse(value);
                 }
-                else if (key === "oauth_identity" || key === "oauth_identity_json") {
-                    // OAuth identity comes as JSON string
-                    try {
-                        const parsed = JSON.parse(value);
-                        body["oauth_identity"] = parsed || null;
-                    }
-                    catch {
-                        // Invalid JSON, set to null
-                        body["oauth_identity"] = null;
-                    }
+                catch {
+                    // If not JSON, treat as single scope or array
+                    body["scopes"] = value.includes(",") ? value.split(",") : [value];
                 }
-                else if (key === "termsAccepted") {
-                    // Convert checkbox values to boolean
-                    body[key] =
-                        value === "on" ||
-                            value === "true" ||
-                            value === "1" ||
-                            value === "yes";
+            }
+            else if (key === "oauth_identity" || key === "oauth_identity_json") {
+                // OAuth identity comes as JSON string
+                try {
+                    const parsed = JSON.parse(value);
+                    body["oauth_identity"] = parsed || null;
                 }
-                else if (key === "customFields") {
-                    // Custom fields come as JSON string
-                    try {
-                        body[key] = JSON.parse(value);
-                    }
-                    catch {
-                        // If not JSON, skip
-                    }
+                catch {
+                    // Invalid JSON, set to null
+                    body["oauth_identity"] = null;
                 }
-                else {
-                    // Regular string fields
-                    body[key] = value;
+            }
+            else if (key === "termsAccepted") {
+                // Convert checkbox values to boolean
+                body[key] =
+                    value === "on" ||
+                        value === "true" ||
+                        value === "1" ||
+                        value === "yes";
+            }
+            else if (key === "customFields") {
+                // Custom fields come as JSON string
+                try {
+                    body[key] = JSON.parse(value);
+                }
+                catch {
+                    // If not JSON, skip
+                    return false;
                 }
             }
+            else {
+                // Regular string fields
+                body[key] = value;
+            }
+            return true;
+        };
+        // Apply schema-required defaults (termsAccepted, scopes) to a body.
+        const applyFormDefaults = (body) => {
             // Default termsAccepted to true if not provided (common for checkboxes)
             if (!("termsAccepted" in body)) {
                 body.termsAccepted = true;
@@ -2288,6 +2555,35 @@ export class ConsentService {
             }
             return body;
         };
+        // Helper function to parse form fields into body object
+        const parseFormFields = (entries) => {
+            const body = {};
+            for (const [key, value] of entries) {
+                coerceFieldInto(body, key, value);
+            }
+            return applyFormDefaults(body);
+        };
+        // Parse a raw multipart/form-data body string using the dedicated
+        // boundary-detection parser, then coerce fields via the shared
+        // parseFormFields helper. Returns null when no fields could be extracted,
+        // preserving the original "only return when hasValidFields" semantics.
+        const parseMultipartText = (text) => {
+            const fields = parseMultipartFields(text);
+            if (fields.length === 0) {
+                return null;
+            }
+            const body = {};
+            let hasValidFields = false;
+            for (const f of fields) {
+                if (coerceFieldInto(body, f.name, f.value)) {
+                    hasValidFields = true;
+                }
+            }
+            if (!hasValidFields) {
+                return null;
+            }
+            return applyFormDefaults(body);
+        };
         // Parse URL-encoded form data (application/x-www-form-urlencoded)
         // When Content-Type is URL-encoded but FormData object is passed, try FormData parsing first
         if (contentType.includes("application/x-www-form-urlencoded")) {
@@ -2300,69 +2596,12 @@ export class ConsentService {
                 // Check if FormData parsing returned malformed data (entire multipart body as single entry)
                 // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
                 const entriesArray = Array.from(formData.entries());
-                if (entriesArray.length === 1 &&
-                    typeof entriesArray[0][0] === "string" &&
-                    entriesArray[0][0].includes("Content-Disposition") &&
-                    typeof entriesArray[0][1] === "string" &&
-                    entriesArray[0][1].toString().includes("Content-Disposition")) {
-                    // Manually parse multipart format from the value string
-                    // The key contains the first boundary and Content-Disposition header start
-                    // The value contains the rest of the first field and all subsequent fields
-                    const keyPart = entriesArray[0][0];
-                    const valuePart = entriesArray[0][1];
-                    // Fix: If key ends with "name" and value starts with '"fieldname"', combine them
-                    let multipartBody;
-                    if (keyPart.trim().endsWith("name") &&
-                        valuePart.trim().startsWith('"')) {
-                        // Key ends with "name", value starts with '"fieldname"', combine with = between them
-                        multipartBody = keyPart + "=" + valuePart;
-                    }
-                    else {
-                        multipartBody = keyPart + valuePart;
-                    }
-                    // Match: Content-Disposition header with field name, then capture value until next boundary or end
-                    const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
-                    let match;
-                    while ((match = fieldRegex.exec(multipartBody)) !== null) {
-                        const fieldName = match[1];
-                        const fieldValue = match[2].trim(); // Remove trailing newlines
-                        if (fieldName === "scopes" || fieldName === "scopes[]") {
-                            try {
-                                body["scopes"] = JSON.parse(fieldValue);
-                            }
-                            catch {
-                                body["scopes"] = fieldValue.includes(",")
-                                    ? fieldValue.split(",")
-                                    : [fieldValue];
-                            }
-                        }
-                        else if (fieldName === "oauth_identity" ||
-                            fieldName === "oauth_identity_json") {
-                            try {
-                                body["oauth_identity"] = JSON.parse(fieldValue) || null;
-                            }
-                            catch {
-                                body["oauth_identity"] = null;
-                            }
-                        }
-                        else if (fieldName === "termsAccepted") {
-                            body[fieldName] =
-                                fieldValue === "on" ||
-                                    fieldValue === "true" ||
-                                    fieldValue === "1" ||
-                                    fieldValue === "yes";
-                        }
-                        else if (fieldName === "customFields") {
-                            try {
-                                body[fieldName] = JSON.parse(fieldValue);
-                            }
-                            catch {
-                                // Skip
-                            }
-                        }
-                        else {
-                            body[fieldName] = fieldValue;
-                        }
+                if (isMalformedSingleEntry(entriesArray)) {
+                    // FormData leaked the entire multipart body into a single malformed
+                    // entry. Reconstruct a parseable body and extract the fields.
+                    const multipartBody = reconstructMalformedMultipart(entriesArray[0][0], entriesArray[0][1]);
+                    for (const field of parseMultipartFields(multipartBody)) {
+                        coerceFieldInto(body, field.name, field.value);
                         hasValidFields = true;
                     }
                 }
@@ -2374,63 +2613,13 @@ export class ConsentService {
                             continue;
                         }
                         // Extract field name from malformed keys (when FormData is passed with wrong Content-Type)
-                        let fieldName = key;
-                        if (key.includes("Content-Disposition") && key.includes('name="')) {
-                            // Extract field name from Content-Disposition header
-                            const nameMatch = key.match(/name="([^"]+)"/);
-                            if (nameMatch && nameMatch[1]) {
-                                fieldName = nameMatch[1];
-                            }
-                            else {
-                                // Skip if we can't extract a valid field name
-                                continue;
-                            }
-                        }
-                        else if (key.includes("------") ||
-                            key.includes("\r\n") ||
-                            key.trim() === "") {
+                        const fieldName = extractFieldNameFromKey(key);
+                        if (fieldName === null) {
                             // Skip boundary strings and invalid keys
                             continue;
                         }
                         hasValidFields = true;
-                        const stringValue = value.toString();
-                        if (fieldName === "scopes" || fieldName === "scopes[]") {
-                            try {
-                                body["scopes"] = JSON.parse(stringValue);
-                            }
-                            catch {
-                                body["scopes"] = stringValue.includes(",")
-                                    ? stringValue.split(",")
-                                    : [stringValue];
-                            }
-                        }
-                        else if (fieldName === "oauth_identity" ||
-                            fieldName === "oauth_identity_json") {
-                            try {
-                                body["oauth_identity"] = JSON.parse(stringValue) || null;
-                            }
-                            catch {
-                                body["oauth_identity"] = null;
-                            }
-                        }
-                        else if (fieldName === "termsAccepted") {
-                            body[fieldName] =
-                                stringValue === "on" ||
-                                    stringValue === "true" ||
-                                    stringValue === "1" ||
-                                    stringValue === "yes";
-                        }
-                        else if (fieldName === "customFields") {
-                            try {
-                                body[fieldName] = JSON.parse(stringValue);
-                            }
-                            catch {
-                                // Skip
-                            }
-                        }
-                        else {
-                            body[fieldName] = stringValue;
-                        }
+                        coerceFieldInto(body, fieldName, value.toString());
                     }
                 }
                 if (hasValidFields && Object.keys(body).length > 0) {
@@ -2476,61 +2665,9 @@ export class ConsentService {
                     const text = await textRequest.text();
                     if (text && text.length > 0) {
                         // Try to manually parse multipart format from text
-                        const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
-                        const body = {};
-                        let match;
-                        let hasValidFields = false;
-                        while ((match = fieldRegex.exec(text)) !== null) {
-                            const fieldName = match[1];
-                            const fieldValue = match[2].trim();
-                            if (fieldName === "scopes" || fieldName === "scopes[]") {
-                                try {
-                                    body["scopes"] = JSON.parse(fieldValue);
-                                }
-                                catch {
-                                    body["scopes"] = fieldValue.includes(",")
-                                        ? fieldValue.split(",")
-                                        : [fieldValue];
-                                }
-                            }
-                            else if (fieldName === "oauth_identity" ||
-                                fieldName === "oauth_identity_json") {
-                                try {
-                                    body["oauth_identity"] = JSON.parse(fieldValue) || null;
-                                }
-                                catch {
-                                    body["oauth_identity"] = null;
-                                }
-                            }
-                            else if (fieldName === "termsAccepted") {
-                                body[fieldName] =
-                                    fieldValue === "on" ||
-                                        fieldValue === "true" ||
-                                        fieldValue === "1" ||
-                                        fieldValue === "yes";
-                            }
-                            else if (fieldName === "customFields") {
-                                try {
-                                    body[fieldName] = JSON.parse(fieldValue);
-                                }
-                                catch {
-                                    // Skip
-                                }
-                            }
-                            else {
-                                body[fieldName] = fieldValue;
-                            }
-                            hasValidFields = true;
-                        }
-                        if (hasValidFields && Object.keys(body).length > 0) {
-                            if (!("termsAccepted" in body)) {
-                                body.termsAccepted = true;
-                            }
-                            // Default scopes to empty array if not provided
-                            if (!("scopes" in body)) {
-                                body.scopes = [];
-                            }
-                            return body;
+                        const parsed = parseMultipartText(text);
+                        if (parsed) {
+                            return parsed;
                         }
                     }
                 }
@@ -2559,77 +2696,25 @@ export class ConsentService {
                         errorMessage.includes("Content-Type was not one of") ||
                         errorCause.includes("missing boundary") ||
                         errorCause.includes("boundary")) {
-                        // When boundary is missing, try to parse as URL-encoded form data instead
-                        // This handles the case where FormData was passed but Content-Type doesn't include boundary
+                        // When boundary is missing, parse the text itself. This handles
+                        // the case where FormData was passed but Content-Type doesn't
+                        // include boundary. A body with multipart parts is parsed only as
+                        // multipart: read as URL-encoded it would become one garbage
+                        // field plus the form defaults, and URLSearchParams never throws.
                         try {
                             const textRequest = request.clone();
                             const text = await textRequest.text();
-                            // If text parsing succeeds, try URL-encoded parsing
                             if (text && text.length > 0) {
-                                try {
+                                if (text.includes("Content-Disposition")) {
+                                    const parsed = parseMultipartText(text);
+                                    if (parsed) {
+                                        return parsed;
+                                    }
+                                }
+                                else {
                                     const params = new URLSearchParams(text);
                                     return parseFormFields(params.entries());
                                 }
-                                catch {
-                                    // If URL-encoded parsing fails, the text might be multipart format
-                                    // Try to manually parse multipart format from text
-                                    const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
-                                    const body = {};
-                                    let match;
-                                    let hasValidFields = false;
-                                    while ((match = fieldRegex.exec(text)) !== null) {
-                                        const fieldName = match[1];
-                                        const fieldValue = match[2].trim();
-                                        if (fieldName === "scopes" || fieldName === "scopes[]") {
-                                            try {
-                                                body["scopes"] = JSON.parse(fieldValue);
-                                            }
-                                            catch {
-                                                body["scopes"] = fieldValue.includes(",")
-                                                    ? fieldValue.split(",")
-                                                    : [fieldValue];
-                                            }
-                                        }
-                                        else if (fieldName === "oauth_identity" ||
-                                            fieldName === "oauth_identity_json") {
-                                            try {
-                                                body["oauth_identity"] = JSON.parse(fieldValue) || null;
-                                            }
-                                            catch {
-                                                body["oauth_identity"] = null;
-                                            }
-                                        }
-                                        else if (fieldName === "termsAccepted") {
-                                            body[fieldName] =
-                                                fieldValue === "on" ||
-                                                    fieldValue === "true" ||
-                                                    fieldValue === "1" ||
-                                                    fieldValue === "yes";
-                                        }
-                                        else if (fieldName === "customFields") {
-                                            try {
-                                                body[fieldName] = JSON.parse(fieldValue);
-                                            }
-                                            catch {
-                                                // Skip
-                                            }
-                                        }
-                                        else {
-                                            body[fieldName] = fieldValue;
-                                        }
-                                        hasValidFields = true;
-                                    }
-                                    if (hasValidFields && Object.keys(body).length > 0) {
-                                        if (!("termsAccepted" in body)) {
-                                            body.termsAccepted = true;
-                                        }
-                                        // Default scopes to empty array if not provided
-                                        if (!("scopes" in body)) {
-                                            body.scopes = [];
-                                        }
-                                        return body;
-                                    }
-                                }
                             }
                         }
                         catch {
@@ -2643,66 +2728,12 @@ export class ConsentService {
                 // Check if FormData parsing returned malformed data (entire multipart body as single entry)
                 // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
                 const entriesArray = Array.from(formData.entries());
-                if (entriesArray.length === 1 &&
-                    typeof entriesArray[0][0] === "string" &&
-                    entriesArray[0][0].includes("Content-Disposition") &&
-                    typeof entriesArray[0][1] === "string" &&
-                    entriesArray[0][1].toString().includes("Content-Disposition")) {
-                    // Manually parse multipart format from the value string
-                    const keyPart = entriesArray[0][0];
-                    const valuePart = entriesArray[0][1];
-                    // Fix: If key ends with "name" and value starts with '"fieldname"', combine them
-                    let multipartBody;
-                    if (keyPart.trim().endsWith("name") &&
-                        valuePart.trim().startsWith('"')) {
-                        multipartBody = keyPart + "=" + valuePart;
-                    }
-                    else {
-                        multipartBody = keyPart + valuePart;
-                    }
-                    // Match: Content-Disposition header with field name, then capture value until next boundary or end
-                    const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
-                    let match;
-                    while ((match = fieldRegex.exec(multipartBody)) !== null) {
-                        const fieldName = match[1];
-                        const fieldValue = match[2].trim();
-                        if (fieldName === "scopes" || fieldName === "scopes[]") {
-                            try {
-                                body["scopes"] = JSON.parse(fieldValue);
-                            }
-                            catch {
-                                body["scopes"] = fieldValue.includes(",")
-                                    ? fieldValue.split(",")
-                                    : [fieldValue];
-                            }
-                        }
-                        else if (fieldName === "oauth_identity" ||
-                            fieldName === "oauth_identity_json") {
-                            try {
-                                body["oauth_identity"] = JSON.parse(fieldValue) || null;
-                            }
-                            catch {
-                                body["oauth_identity"] = null;
-                            }
-                        }
-                        else if (fieldName === "termsAccepted") {
-                            body[fieldName] =
-                                fieldValue === "on" ||
-                                    fieldValue === "true" ||
-                                    fieldValue === "1" ||
-                                    fieldValue === "yes";
-                        }
-                        else if (fieldName === "customFields") {
-                            try {
-                                body[fieldName] = JSON.parse(fieldValue);
-                            }
-                            catch {
-                                // Skip
-                            }
-                        }
-                        else {
-                            body[fieldName] = fieldValue;
-                        }
+                if (isMalformedSingleEntry(entriesArray)) {
+                    // FormData leaked the entire multipart body into a single malformed
+                    // entry. Reconstruct a parseable body and extract the fields.
+                    const multipartBody = reconstructMalformedMultipart(entriesArray[0][0], entriesArray[0][1]);
+                    for (const field of parseMultipartFields(multipartBody)) {
+                        coerceFieldInto(body, field.name, field.value);
                         hasValidFields = true;
                     }
                 }
@@ -2714,63 +2745,13 @@ export class ConsentService {
                             continue;
                         }
                         // Extract field name from malformed keys (when FormData is passed with wrong Content-Type)
-                        let fieldName = key;
-                        if (key.includes("Content-Disposition") && key.includes('name="')) {
-                            // Extract field name from Content-Disposition header
-                            const nameMatch = key.match(/name="([^"]+)"/);
-                            if (nameMatch && nameMatch[1]) {
-                                fieldName = nameMatch[1];
-                            }
-                            else {
-                                // Skip if we can't extract a valid field name
-                                continue;
-                            }
-                        }
-                        else if (key.includes("------") ||
-                            key.includes("\r\n") ||
-                            key.trim() === "") {
+                        const fieldName = extractFieldNameFromKey(key);
+                        if (fieldName === null) {
                             // Skip boundary strings and invalid keys
                             continue;
                         }
                         hasValidFields = true;
-                        const stringValue = value.toString();
-                        if (fieldName === "scopes" || fieldName === "scopes[]") {
-                            try {
-                                body["scopes"] = JSON.parse(stringValue);
-                            }
-                            catch {
-                                body["scopes"] = stringValue.includes(",")
-                                    ? stringValue.split(",")
-                                    : [stringValue];
-                            }
-                        }
-                        else if (fieldName === "oauth_identity" ||
-                            fieldName === "oauth_identity_json") {
-                            try {
-                                body["oauth_identity"] = JSON.parse(stringValue) || null;
-                            }
-                            catch {
-                                body["oauth_identity"] = null;
-                            }
-                        }
-                        else if (fieldName === "termsAccepted") {
-                            body[fieldName] =
-                                stringValue === "on" ||
-                                    stringValue === "true" ||
-                                    stringValue === "1" ||
-                                    stringValue === "yes";
-                        }
-                        else if (fieldName === "customFields") {
-                            try {
-                                body[fieldName] = JSON.parse(stringValue);
-                            }
-                            catch {
-                                // Skip
-                            }
-                        }
-                        else {
-                            body[fieldName] = stringValue;
-                        }
+                        coerceFieldInto(body, fieldName, value.toString());
                     }
                 }
                 if (hasValidFields && Object.keys(body).length > 0) {
@@ -2813,61 +2794,9 @@ export class ConsentService {
                             // URL-encoded parsing failed, try multipart format
                         }
                         // Try multipart format parsing (FormData serializes to multipart)
-                        const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
-                        const body = {};
-                        let match;
-                        let hasValidFields = false;
-                        while ((match = fieldRegex.exec(text)) !== null) {
-                            const fieldName = match[1];
-                            const fieldValue = match[2].trim();
-                            if (fieldName === "scopes" || fieldName === "scopes[]") {
-                                try {
-                                    body["scopes"] = JSON.parse(fieldValue);
-                                }
-                                catch {
-                                    body["scopes"] = fieldValue.includes(",")
-                                        ? fieldValue.split(",")
-                                        : [fieldValue];
-                                }
-                            }
-                            else if (fieldName === "oauth_identity" ||
-                                fieldName === "oauth_identity_json") {
-                                try {
-                                    body["oauth_identity"] = JSON.parse(fieldValue) || null;
-                                }
-                                catch {
-                                    body["oauth_identity"] = null;
-                                }
-                            }
-                            else if (fieldName === "termsAccepted") {
-                                body[fieldName] =
-                                    fieldValue === "on" ||
-                                        fieldValue === "true" ||
-                                        fieldValue === "1" ||
-                                        fieldValue === "yes";
-                            }
-                            else if (fieldName === "customFields") {
-                                try {
-                                    body[fieldName] = JSON.parse(fieldValue);
-                                }
-                                catch {
-                                    // Skip
-                                }
-                            }
-                            else {
-                                body[fieldName] = fieldValue;
-                            }
-                            hasValidFields = true;
-                        }
-                        if (hasValidFields && Object.keys(body).length > 0) {
-                            if (!("termsAccepted" in body)) {
-                                body.termsAccepted = true;
-                            }
-                            // Default scopes to empty array if not provided
-                            if (!("scopes" in body)) {
-                                body.scopes = [];
-                            }
-                            return body;
+                        const parsed = parseMultipartText(text);
+                        if (parsed) {
+                            return parsed;
                         }
                     }
                 }
@@ -2907,61 +2836,9 @@ export class ConsentService {
                                     // URL-encoded parsing failed, try multipart format
                                 }
                                 // Try to manually parse multipart format from text
-                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
-                                const body = {};
-                                let match;
-                                let hasValidFields = false;
-                                while ((match = fieldRegex.exec(text)) !== null) {
-                                    const fieldName = match[1];
-                                    const fieldValue = match[2].trim();
-                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
-                                        try {
-                                            body["scopes"] = JSON.parse(fieldValue);
-                                        }
-                                        catch {
-                                            body["scopes"] = fieldValue.includes(",")
-                                                ? fieldValue.split(",")
-                                                : [fieldValue];
-                                        }
-                                    }
-                                    else if (fieldName === "oauth_identity" ||
-                                        fieldName === "oauth_identity_json") {
-                                        try {
-                                            body["oauth_identity"] = JSON.parse(fieldValue) || null;
-                                        }
-                                        catch {
-                                            body["oauth_identity"] = null;
-                                        }
-                                    }
-                                    else if (fieldName === "termsAccepted") {
-                                        body[fieldName] =
-                                            fieldValue === "on" ||
-                                                fieldValue === "true" ||
-                                                fieldValue === "1" ||
-                                                fieldValue === "yes";
-                                    }
-                                    else if (fieldName === "customFields") {
-                                        try {
-                                            body[fieldName] = JSON.parse(fieldValue);
-                                        }
-                                        catch {
-                                            // Skip
-                                        }
-                                    }
-                                    else {
-                                        body[fieldName] = fieldValue;
-                                    }
-                                    hasValidFields = true;
-                                }
-                                if (hasValidFields && Object.keys(body).length > 0) {
-                                    if (!("termsAccepted" in body)) {
-                                        body.termsAccepted = true;
-                                    }
-                                    // Default scopes to empty array if not provided
-                                    if (!("scopes" in body)) {
-                                        body.scopes = [];
-                                    }
-                                    return body;
+                                const parsed = parseMultipartText(text);
+                                if (parsed) {
+                                    return parsed;
                                 }
                             }
                         }
@@ -2991,61 +2868,9 @@ export class ConsentService {
                                     // URL-encoded parsing failed, try multipart format
                                 }
                                 // Try multipart format parsing
-                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
-                                const body = {};
-                                let match;
-                                let hasValidFields = false;
-                                while ((match = fieldRegex.exec(text)) !== null) {
-                                    const fieldName = match[1];
-                                    const fieldValue = match[2].trim();
-                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
-                                        try {
-                                            body["scopes"] = JSON.parse(fieldValue);
-                                        }
-                                        catch {
-                                            body["scopes"] = fieldValue.includes(",")
-                                                ? fieldValue.split(",")
-                                                : [fieldValue];
-                                        }
-                                    }
-                                    else if (fieldName === "oauth_identity" ||
-                                        fieldName === "oauth_identity_json") {
-                                        try {
-                                            body["oauth_identity"] = JSON.parse(fieldValue) || null;
-                                        }
-                                        catch {
-                                            body["oauth_identity"] = null;
-                                        }
-                                    }
-                                    else if (fieldName === "termsAccepted") {
-                                        body[fieldName] =
-                                            fieldValue === "on" ||
-                                                fieldValue === "true" ||
-                                                fieldValue === "1" ||
-                                                fieldValue === "yes";
-                                    }
-                                    else if (fieldName === "customFields") {
-                                        try {
-                                            body[fieldName] = JSON.parse(fieldValue);
-                                        }
-                                        catch {
-                                            // Skip
-                                        }
-                                    }
-                                    else {
-                                        body[fieldName] = fieldValue;
-                                    }
-                                    hasValidFields = true;
-                                }
-                                if (hasValidFields && Object.keys(body).length > 0) {
-                                    if (!("termsAccepted" in body)) {
-                                        body.termsAccepted = true;
-                                    }
-                                    // Default scopes to empty array if not provided
-                                    if (!("scopes" in body)) {
-                                        body.scopes = [];
-                                    }
-                                    return body;
+                                const parsed = parseMultipartText(text);
+                                if (parsed) {
+                                    return parsed;
                                 }
                             }
                             // If text parsing failed or found no valid fields, throw error to trigger fallback
@@ -3063,74 +2888,15 @@ export class ConsentService {
                     for (const [key, value] of formData.entries()) {
                         if (value instanceof File)
                             continue;
-                        // Extract field name from malformed keys
-                        let fieldName = key;
-                        if (key.includes("Content-Disposition") && key.includes('name="')) {
-                            const nameMatch = key.match(/name="([^"]+)"/);
-                            if (nameMatch && nameMatch[1]) {
-                                fieldName = nameMatch[1];
-                            }
-                            else {
-                                continue;
-                            }
-                        }
-                        else if (key.includes("------") ||
-                            key.includes("\r\n") ||
-                            key.trim() === "" ||
-                            key.includes("formdata-undici")) {
-                            // Malformed key - likely from text/plain Content-Type mismatch
-                            // Skip this entry and fall back to text parsing
+                        // Extract field name from malformed keys (likely from a text/plain
+                        // Content-Type mismatch); boundary noise is skipped so text
+                        // parsing can take over
+                        const fieldName = extractFieldNameFromKey(key);
+                        if (fieldName === null) {
                             continue;
                         }
-                        // If we have a valid field name, mark as having valid entries
-                        if (fieldName && fieldName !== key) {
-                            hasValidEntries = true;
-                        }
-                        else if (fieldName &&
-                            !key.includes("Content-Disposition") &&
-                            !key.includes("------") &&
-                            !key.includes("\r\n")) {
-                            hasValidEntries = true;
-                        }
-                        // Process the field value
-                        const stringValue = value.toString();
-                        if (fieldName === "scopes" || fieldName === "scopes[]") {
-                            try {
-                                body["scopes"] = JSON.parse(stringValue);
-                            }
-                            catch {
-                                body["scopes"] = stringValue.includes(",")
-                                    ? stringValue.split(",")
-                                    : [stringValue];
-                            }
-                        }
-                        else if (fieldName === "oauth_identity" ||
-                            fieldName === "oauth_identity_json") {
-                            try {
-                                body["oauth_identity"] = JSON.parse(stringValue) || null;
-                            }
-                            catch {
-                                body["oauth_identity"] = null;
-                            }
-                        }
-                        else if (fieldName === "termsAccepted") {
-                            body[fieldName] =
-                                stringValue === "on" ||
-                                    stringValue === "true" ||
-                                    stringValue === "1" ||
-                                    stringValue === "yes";
-                        }
-                        else if (fieldName === "customFields") {
-                            try {
-                                body[fieldName] = JSON.parse(stringValue);
-                            }
-                            catch {
-                                // Skip
-                            }
-                        }
-                        else {
-                            body[fieldName] = stringValue;
-                        }
+                        hasValidEntries = true;
+                        coerceFieldInto(body, fieldName, value.toString());
                     }
                     // If we didn't get any valid entries (all keys were malformed), try text parsing
                     if (!hasValidEntries || Object.keys(body).length === 0) {
@@ -3140,61 +2906,9 @@ export class ConsentService {
                             const text = await textRequest.text();
                             if (text && text.length > 0) {
                                 // Try multipart format parsing from text
-                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
-                                const textBody = {};
-                                let match;
-                                let hasValidFields = false;
-                                while ((match = fieldRegex.exec(text)) !== null) {
-                                    const fieldName = match[1];
-                                    const fieldValue = match[2].trim();
-                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
-                                        try {
-                                            textBody["scopes"] = JSON.parse(fieldValue);
-                                        }
-                                        catch {
-                                            textBody["scopes"] = fieldValue.includes(",")
-                                                ? fieldValue.split(",")
-                                                : [fieldValue];
-                                        }
-                                    }
-                                    else if (fieldName === "oauth_identity" ||
-                                        fieldName === "oauth_identity_json") {
-                                        try {
-                                            textBody["oauth_identity"] =
-                                                JSON.parse(fieldValue) || null;
-                                        }
-                                        catch {
-                                            textBody["oauth_identity"] = null;
-                                        }
-                                    }
-                                    else if (fieldName === "termsAccepted") {
-                                        textBody[fieldName] =
-                                            fieldValue === "on" ||
-                                                fieldValue === "true" ||
-                                                fieldValue === "1" ||
-                                                fieldValue === "yes";
-                                    }
-                                    else if (fieldName === "customFields") {
-                                        try {
-                                            textBody[fieldName] = JSON.parse(fieldValue);
-                                        }
-                                        catch {
-                                            // Skip
-                                        }
-                                    }
-                                    else {
-                                        textBody[fieldName] = fieldValue;
-                                    }
-                                    hasValidFields = true;
-                                }
-                                if (hasValidFields && Object.keys(textBody).length > 0) {
-                                    if (!("termsAccepted" in textBody)) {
-                                        textBody.termsAccepted = true;
-                                    }
-                                    if (!("scopes" in textBody)) {
-                                        textBody.scopes = [];
-                                    }
-                                    return textBody;
+                                const parsed = parseMultipartText(text);
+                                if (parsed) {
+                                    return parsed;
                                 }
                             }
                         }
@@ -3224,61 +2938,9 @@ export class ConsentService {
                             const text = await textRequest.text();
                             if (text && text.length > 0) {
                                 // Try multipart format parsing
-                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
-                                const body = {};
-                                let match;
-                                let hasValidFields = false;
-                                while ((match = fieldRegex.exec(text)) !== null) {
-                                    const fieldName = match[1];
-                                    const fieldValue = match[2].trim();
-                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
-                                        try {
-                                            body["scopes"] = JSON.parse(fieldValue);
-                                        }
-                                        catch {
-                                            body["scopes"] = fieldValue.includes(",")
-                                                ? fieldValue.split(",")
-                                                : [fieldValue];
-                                        }
-                                    }
-                                    else if (fieldName === "oauth_identity" ||
-                                        fieldName === "oauth_identity_json") {
-                                        try {
-                                            body["oauth_identity"] = JSON.parse(fieldValue) || null;
-                                        }
-                                        catch {
-                                            body["oauth_identity"] = null;
-                                        }
-                                    }
-                                    else if (fieldName === "termsAccepted") {
-                                        body[fieldName] =
-                                            fieldValue === "on" ||
-                                                fieldValue === "true" ||
-                                                fieldValue === "1" ||
-                                                fieldValue === "yes";
-                                    }
-                                    else if (fieldName === "customFields") {
-                                        try {
-                                            body[fieldName] = JSON.parse(fieldValue);
-                                        }
-                                        catch {
-                                            // Skip
-                                        }
-                                    }
-                                    else {
-                                        body[fieldName] = fieldValue;
-                                    }
-                                    hasValidFields = true;
-                                }
-                                if (hasValidFields && Object.keys(body).length > 0) {
-                                    if (!("termsAccepted" in body)) {
-                                        body.termsAccepted = true;
-                                    }
-                                    // Default scopes to empty array if not provided
-                                    if (!("scopes" in body)) {
-                                        body.scopes = [];
-                                    }
-                                    return body;
+                                const parsed = parseMultipartText(text);
+                                if (parsed) {
+                                    return parsed;
                                 }
                             }
                         }
@@ -3322,6 +2984,113 @@ export class ConsentService {
             headers: { "Content-Type": "application/json" },
         });
     }
+    /**
+     * 400 returned by `handleApproval` when `provider_type` is missing or not
+     * one of the routes in approval-route.ts. Nothing is minted.
+     */
+    unsupportedProviderTypeResponse() {
+        return new Response(JSON.stringify({
+            success: false,
+            error: "Unsupported provider_type",
+            error_code: "unsupported_provider_type",
+        }), {
+            status: 400,
+            headers: { "Content-Type": "application/json" },
+        });
+    }
+    /**
+     * 503 returned by `handleApproval` when a consent-only approval has a
+     * session but no throwaway DID could be made or reused (key generation or a
+     * session read failed). Nothing is minted; the user can retry.
+     */
+    identityUnavailableResponse() {
+        return new Response(JSON.stringify({
+            success: false,
+            error: "Could not set up an identity for this approval. Please try again.",
+            error_code: "identity_unavailable",
+        }), {
+            status: 503,
+            headers: { "Content-Type": "application/json" },
+        });
+    }
+    /** A non-empty string, or undefined. */
+    optionalString(value) {
+        return typeof value === "string" && value.trim().length > 0
+            ? value
+            : undefined;
+    }
+    /**
+     * The provider signed into an identity assertion. Call ONLY after
+     * `verifyIdentityAssertion` accepted the same token: this decodes the
+     * payload and does not check the signature again.
+     */
+    readAssertionProvider(verifiedToken) {
+        try {
+            const payloadB64 = verifiedToken.substring(verifiedToken.indexOf(".") + 1);
+            const payload = JSON.parse(this.base64UrlDecodeString(payloadB64));
+            return this.optionalString(payload.provider);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Keep a credential sign-in's display fields server-side for the clickwrap
+     * that follows. Expires with the identity assertion. Best effort: without
+     * it the delegation falls back to showing the user DID.
+     */
+    async storeCredentialClickwrapUser(sessionId, userDid, userEmail, userId) {
+        if (!this.env.DELEGATION_STORAGE || (!userEmail && !userId))
+            return;
+        try {
+            await this.env.DELEGATION_STORAGE.put(STORAGE_KEYS.credentialClickwrapUser(sessionId), JSON.stringify({ userDid, userEmail, userId }), { expirationTtl: CREDENTIAL_CLICKWRAP_USER_TTL_SECONDS });
+        }
+        catch (error) {
+            logger.warn("[ConsentService] Failed to store credential sign-in display fields:", error);
+        }
+    }
+    /**
+     * The display fields `storeCredentialClickwrapUser` kept for this session,
+     * only when they belong to `userDid` (the asserted user).
+     */
+    async readCredentialClickwrapUser(sessionId, userDid) {
+        if (!this.env.DELEGATION_STORAGE || !sessionId || !userDid)
+            return undefined;
+        try {
+            const stored = (await this.env.DELEGATION_STORAGE.get(STORAGE_KEYS.credentialClickwrapUser(sessionId), "json"));
+            if (!stored || stored.userDid !== userDid)
+                return undefined;
+            return {
+                userEmail: this.optionalString(stored.userEmail),
+                userId: this.optionalString(stored.userId),
+            };
+        }
+        catch (error) {
+            logger.warn("[ConsentService] Failed to read credential sign-in display fields:", error);
+            return undefined;
+        }
+    }
+    /**
+     * The OAuth identity the callback recorded on this session, only when the
+     * session's user is `userDid` (the asserted user). Used for display fields.
+     */
+    async readSessionOAuthUser(sessionId, userDid) {
+        if (!this.env.DELEGATION_STORAGE || !sessionId || !userDid)
+            return undefined;
+        try {
+            const session = (await this.env.DELEGATION_STORAGE.get(STORAGE_KEYS.session(sessionId), "json"));
+            if (!session || session.userDid !== userDid)
+                return undefined;
+            return {
+                email: this.optionalString(session.oauthIdentity?.email),
+                subject: this.optionalString(session.oauthIdentity?.subject),
+            };
+        }
+        catch (error) {
+            logger.warn("[ConsentService] Failed to read the session's OAuth identity:", error);
+            return undefined;
+        }
+    }
     /**
      * Handle consent approval
      *
@@ -3341,12 +3110,18 @@ export class ConsentService {
                 bodyKeys: Object.keys(body || {}),
                 hasOAuthIdentity: !!body?.oauth_identity,
             });
-            // Handle provider_type routing:
+            // Handle provider_type routing (see approval-route.ts):
             // - 'credential' or 'password': User authenticated via credential form (email/password)
-            // - 'oauth2': User authenticated via OAuth provider (handled below)
+            // - 'oauth' or 'oauth2': clickwrap after OAuth, needs a signed identity assertion
             // - 'none': Consent-only mode (clickwrap) - user agrees without authentication
+            // SECURITY: anything else is refused. Unknown values used to fall
+            // through to an unchecked path that minted under a DID looked up from
+            // the caller's own `oauth_identity`.
             const bodyObj = body;
-            const providerType = bodyObj?.provider_type;
+            const route = resolveApprovalRoute(bodyObj?.provider_type);
+            if (!route) {
+                return this.unsupportedProviderTypeResponse();
+            }
             // SECURITY (A3, spec §3.1/§3.2, defect #2): the identity a delegation is
             // minted under is authoritative ONLY from a trusted source resolved below
             // — a server-signed identity assertion (credential/OAuth clickwrap) or the
@@ -3357,44 +3132,41 @@ export class ConsentService {
             // forged one. `undefined` for the plain authenticated (non-clickwrap)
             // shapes, which fall back to server-side session resolution.
             let trustedUserDid;
+            // Set only when a consent-only approval in a signed-in session mints
+            // under a fresh throwaway DID: the key that signs its VC, and whether the
+            // session record must keep the signed-in DID.
+            let consentOnlySigningKey;
+            let keepSessionUserDid = false;
             // CRED-003: Check for credential provider submission
             // Credential submissions include `provider_type: 'credential'` or 'password' and are handled separately
             // IMPORTANT: Checkpoint tool protection uses 'password' for credential-based auth validation,
             // but we also accept 'credential' for backward compatibility
-            if (providerType === CONSENT_PROVIDER_TYPES.CREDENTIAL ||
-                providerType === CONSENT_PROVIDER_TYPES.PASSWORD) {
-                logger.debug("[ConsentService] Credential submission detected", {
-                    provider_type: providerType,
-                });
+            if (route === "credential") {
+                logger.debug("[ConsentService] Credential submission detected");
                 return this.handleCredentialApproval(bodyObj, request);
             }
-            // ✅ Consent-only mode (provider_type: 'none')
-            // This can be:
+            // SECURITY: the caller never says who signed in, or how. Drop the
+            // body's OAuth identity, user display fields and server-owned
+            // customFields keys before anything reads them; the branches below set
+            // the server's own values from the verified sign-in.
+            delete bodyObj.oauth_identity;
+            delete bodyObj.oauth_identity_json;
+            delete bodyObj.credential_user_email;
+            delete bodyObj.credential_provider_user_id;
+            bodyObj.customFields = stripServerOwnedFields(bodyObj.customFields);
+            const isPostOAuthClickwrap = route === "oauth" || isPostOAuthMarker(bodyObj.oauth_provider_type);
+            const isPostCredentialClickwrap = route === "clickwrap" &&
+                isPostCredentialMarker(bodyObj.credential_provider_type);
+            // ✅ Clickwrap approval. This can be:
             // 1. Pure consent-only: User consents without authentication (clickwrap only)
             // 2. Post-credential clickwrap: User already authenticated via credentials, this is the clickwrap step
             // 3. Post-OAuth clickwrap: User already authenticated via OAuth, this is the clickwrap step
-            if (providerType === CONSENT_PROVIDER_TYPES.NONE) {
-                const bodyObj = body;
+            if (route === "clickwrap" || route === "oauth") {
                 const sessionId = bodyObj.session_id;
-                // Check for credential auth parameters passed from handleCredentialApproval
-                // These indicate this is the clickwrap step AFTER credential authentication
-                const credentialProviderType = bodyObj.credential_provider_type;
-                const credentialProvider = bodyObj.credential_provider;
-                if (credentialProviderType &&
-                    credentialProviderType === CONSENT_PROVIDER_TYPES.PASSWORD) {
+                if (isPostCredentialClickwrap) {
                     // This is the clickwrap step after credential auth
                     // The session already has userDid from credential auth
                     logger.debug("[ConsentService] Consent-only mode (post-credential clickwrap)");
-                    // Override provider_type to 'password' so delegation is created with correct authorization
-                    // This ensures authorization.type matches tool protection expectation
-                    bodyObj.provider_type = CONSENT_PROVIDER_TYPES.PASSWORD;
-                    if (credentialProvider) {
-                        bodyObj.customFields = {
-                            ...(bodyObj.customFields || {}),
-                            provider: credentialProvider,
-                            provider_type: CONSENT_PROVIDER_TYPES.PASSWORD,
-                        };
-                    }
                     // SECURITY (A3, spec §3.2): the userDid for a post-credential
                     // clickwrap mint comes ONLY from the server-signed identity assertion
                     // minted by handleCredentialApproval after it authenticated against
@@ -3402,12 +3174,14 @@ export class ConsentService {
                     // project). The bare `user_did` redirect param that used to be trusted
                     // here is gone: it was caller-forgeable (subject/issuer forgery). A
                     // missing/invalid/expired/mismatched assertion → 403, no mint.
+                    let signedProvider;
                     if (this.isDevConsentTestMode()) {
                         // Dev/test escape hatch (BOTH MCPI_TEST_CONSENT and a development
                         // env), mirroring consent-anchor-bridge's call-site CSRF relaxation:
                         // no signed assertion is required, so local/miniflare runs work
                         // without OAUTH_ENCRYPTION_SECRET. Never on prod/staging/unset.
                         trustedUserDid = bodyObj.user_did;
+                        signedProvider = this.optionalString(bodyObj.credential_provider);
                     }
                     else {
                         const assertion = bodyObj.identity_assertion;
@@ -3425,68 +3199,70 @@ export class ConsentService {
                             return this.identityAssertionRequiredResponse();
                         }
                         trustedUserDid = verifiedUserDid;
+                        signedProvider = this.readAssertionProvider(assertion);
                     }
-                    // Read user info from redirect URL params
+                    // Override provider_type to 'password' so delegation is created with correct authorization
+                    // This ensures authorization.type matches tool protection expectation.
+                    // The provider label is the one the credential handler signed, not
+                    // the body's `credential_provider`.
+                    bodyObj.provider_type = CONSENT_PROVIDER_TYPES.PASSWORD;
+                    bodyObj.customFields = {
+                        ...bodyObj.customFields,
+                        ...(signedProvider ? { provider: signedProvider } : {}),
+                        provider_type: CONSENT_PROVIDER_TYPES.PASSWORD,
+                    };
                     // Field mapping (clear naming):
                     //   credential_user_email → user_identifier (human-readable for display)
                     //   credential_provider_user_id → user_id (provider's internal ID)
-                    const credentialUserEmailFromRedirect = bodyObj.credential_user_email;
-                    const credentialProviderUserIdFromRedirect = bodyObj.credential_provider_user_id;
-                    if (credentialUserEmailFromRedirect ||
-                        credentialProviderUserIdFromRedirect) {
-                        logger.debug("[ConsentService] ✅ Using credential user info from redirect:", {
-                            sessionId: sessionId?.substring(0, 20) + "...",
-                            credential_user_email: credentialUserEmailFromRedirect
-                                ? credentialUserEmailFromRedirect.substring(0, 20) + "..."
-                                : undefined,
-                            credential_provider_user_id: credentialProviderUserIdFromRedirect
-                                ? credentialProviderUserIdFromRedirect.substring(0, 20) +
-                                    "..."
-                                : undefined,
-                            source: "redirect-param",
-                        });
+                    // Both come from the credential handler's stored sign-in, never from
+                    // the redirect params the page posts back.
+                    const signInUser = await this.readCredentialClickwrapUser(sessionId, trustedUserDid);
+                    if (signInUser?.userEmail) {
+                        bodyObj.credential_user_email = signInUser.userEmail;
+                    }
+                    if (signInUser?.userId) {
+                        bodyObj.credential_provider_user_id = signInUser.userId;
                     }
                     logger.debug("[ConsentService] ✅ Using credential auth provider_type for delegation:", {
                         sessionId: sessionId?.substring(0, 20) + "...",
                         providerType: CONSENT_PROVIDER_TYPES.PASSWORD,
-                        provider: credentialProvider,
+                        provider: signedProvider,
                         hasUserDid: !!trustedUserDid,
-                        hasCredentialUserEmail: !!credentialUserEmailFromRedirect,
-                        hasProviderUserId: !!credentialProviderUserIdFromRedirect,
+                        hasCredentialUserEmail: !!signInUser?.userEmail,
+                        hasProviderUserId: !!signInUser?.userId,
                         note: "Delegation will have authorization.type='password' to match tool protection",
                     });
-                    // The userDid is passed via redirect URL - no need to read from KV
                 }
-                // ✅ Check for OAuth auth parameters passed from OAuth callback
-                // These indicate this is the clickwrap step AFTER OAuth authentication
-                const oauthProviderType = bodyObj.oauth_provider_type;
-                const oauthProvider = bodyObj.oauth_provider;
-                if (oauthProviderType === "oauth") {
+                // ✅ Clickwrap step AFTER OAuth authentication: provider_type 'oauth'
+                // or 'oauth2', or the older 'none' plus oauth_provider_type='oauth'
+                if (isPostOAuthClickwrap) {
+                    // The callback signs the provider along with the grant. Refuse
+                    // missing, malformed, or conflicting labels before recording auth
+                    // metadata; no caller-supplied label may change the signed provider.
+                    const oauthProvider = oauthProfileString(bodyObj.oauth_provider) ??
+                        oauthProfileString(bodyObj.provider);
+                    if (!oauthProvider ||
+                        (bodyObj.oauth_provider !== undefined &&
+                            bodyObj.oauth_provider !== oauthProvider) ||
+                        (bodyObj.provider !== undefined &&
+                            bodyObj.provider !== oauthProvider)) {
+                        return this.identityAssertionRequiredResponse();
+                    }
                     // This is the clickwrap step after OAuth auth
                     // The session already has userDid from OAuth callback
                     logger.debug("[ConsentService] Consent-only mode (post-OAuth clickwrap)");
-                    // Override provider_type to 'oauth' so delegation is created with correct authorization
-                    // This ensures authorization.type matches tool protection expectation
-                    bodyObj.provider_type = "oauth";
-                    bodyObj.customFields = {
-                        ...(bodyObj.customFields || {}),
-                        provider: oauthProvider || bodyObj.provider,
-                        provider_type: "oauth",
-                    };
-                    logger.debug("[ConsentService] ✅ Using OAuth auth provider_type for delegation:", {
-                        sessionId: sessionId?.substring(0, 20) + "...",
-                        providerType: "oauth",
-                        provider: oauthProvider || bodyObj.provider,
-                        note: "Delegation will have authorization.type='oauth' to match tool protection",
-                    });
                     // SECURITY (A3, spec §3.2): as with the credential clickwrap, the
                     // userDid for a post-OAuth clickwrap mint comes ONLY from the
                     // server-signed identity assertion minted by the OAuth callback
                     // (oauth-handler.ts) after it linked the OAuth identity to the user
                     // DID — bound to this sid AND grant. No valid assertion → 403, no
                     // mint. The bare `user_did` redirect param is no longer trusted here.
+                    let signedProvider;
                     if (this.isDevConsentTestMode()) {
                         trustedUserDid = bodyObj.user_did;
+                        signedProvider =
+                            this.optionalString(bodyObj.oauth_provider) ??
+                                this.optionalString(bodyObj.provider);
                     }
                     else {
                         const assertion = bodyObj.identity_assertion;
@@ -3497,6 +3273,7 @@ export class ConsentService {
                                 tool: bodyObj.tool ?? "",
                                 scopes: this.parseScopes(bodyObj.scopes),
                                 projectId: bodyObj.project_id ?? "",
+                                provider: oauthProvider,
                             })
                             : null;
                         if (!verifiedUserDid) {
@@ -3504,11 +3281,39 @@ export class ConsentService {
                             return this.identityAssertionRequiredResponse();
                         }
                         trustedUserDid = verifiedUserDid;
+                        signedProvider = this.readAssertionProvider(assertion);
                     }
+                    // Override provider_type to 'oauth' so delegation is created with correct authorization
+                    // This ensures authorization.type matches tool protection expectation.
+                    // The provider label is the one the OAuth callback signed.
+                    bodyObj.provider_type = "oauth";
+                    bodyObj.customFields = {
+                        ...bodyObj.customFields,
+                        // Checkpoint prioritizes oauth_provider over provider. Both
+                        // reserved labels must describe the verified assertion.
+                        ...(signedProvider
+                            ? { provider: signedProvider, oauth_provider: signedProvider }
+                            : {}),
+                        provider_type: "oauth",
+                    };
+                    // Display fields come from the session record the OAuth callback
+                    // wrote for this same user, never from the page.
+                    const oauthUser = await this.readSessionOAuthUser(sessionId, trustedUserDid);
+                    if (oauthUser?.email) {
+                        bodyObj.credential_user_email = oauthUser.email;
+                    }
+                    if (oauthUser?.subject) {
+                        bodyObj.credential_provider_user_id = oauthUser.subject;
+                    }
+                    logger.debug("[ConsentService] ✅ Using OAuth auth provider_type for delegation:", {
+                        sessionId: sessionId?.substring(0, 20) + "...",
+                        providerType: "oauth",
+                        provider: signedProvider,
+                        note: "Delegation will have authorization.type='oauth' to match tool protection",
+                    });
                 }
                 // If neither credential nor OAuth, this is pure consent-only
-                if (!(credentialProviderType === CONSENT_PROVIDER_TYPES.PASSWORD ||
-                    oauthProviderType === "oauth")) {
+                if (!(isPostCredentialClickwrap || isPostOAuthClickwrap)) {
                     // Pure consent-only mode - no prior authentication
                     logger.debug("[ConsentService] Consent-only mode detected (pure clickwrap)");
                     // SECURITY (A3, spec §3.2, review #5): a pure consent-only mint is
@@ -3520,25 +3325,36 @@ export class ConsentService {
                     // body value intact — can carry a forged DID into the mint.
                     trustedUserDid = undefined;
                     if (sessionId && this.env.DELEGATION_STORAGE) {
-                        // Check if session already has userDid (from credential auth or OAuth)
-                        let existingUserDid;
+                        let existingSession = null;
                         try {
                             const sessionKey = STORAGE_KEYS.session(sessionId);
-                            const existingSession = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
-                            existingUserDid = existingSession?.userDid;
+                            existingSession = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
                         }
                         catch (error) {
                             logger.warn("[ConsentService] Failed to read session for userDid:", error);
                         }
-                        if (existingUserDid) {
-                            // Session has userDid from prior auth step - use it
-                            logger.debug("[ConsentService] Session already has userDid, reusing:", {
+                        const throwawayDid = this.sessionThrowawayDid(existingSession);
+                        if (throwawayDid) {
+                            // The session's own throwaway identity from an earlier
+                            // consent-only step: reuse it so the agent's lookups stay on it.
+                            logger.debug("[ConsentService] Session already has a throwaway userDid, reusing:", {
                                 sessionId: sessionId.substring(0, 20) + "...",
-                                userDid: existingUserDid.substring(0, 30) + "...",
+                                userDid: throwawayDid.substring(0, 30) + "...",
                             });
-                            // Server-side session identity (set by a prior auth step), not a
-                            // caller-supplied body value — safe to trust.
-                            trustedUserDid = existingUserDid;
+                            trustedUserDid = throwawayDid;
+                        }
+                        else if (existingSession?.userDid) {
+                            // SECURITY: the session holds a signed-in user's DID (written
+                            // by the OAuth callback or the credential handler). A
+                            // consent-only approval proves no sign-in, so it must never be
+                            // minted under that DID. Use a fresh throwaway identity for this
+                            // grant only and leave the session's identity alone.
+                            const fresh = await this.createThrowawayIdentity();
+                            if (fresh) {
+                                trustedUserDid = fresh.did;
+                                consentOnlySigningKey = fresh;
+                                keepSessionUserDid = true;
+                            }
                         }
                         else {
                             // Generate ephemeral userDid for pure consent-only
@@ -3559,9 +3375,16 @@ export class ConsentService {
                                 });
                             }
                             else {
-                                logger.warn("[ConsentService] ⚠️ Failed to generate ephemeral userDid - delegation will use session-scoped storage only");
+                                logger.warn("[ConsentService] ⚠️ Failed to generate ephemeral userDid");
                             }
                         }
+                        // SECURITY: fail closed. With no DID here, storeDelegationToken
+                        // resolves one from the session record, which can be a signed-in
+                        // user's DID, and the consent-only grant would replace their own
+                        // grant under it.
+                        if (!trustedUserDid) {
+                            return this.identityUnavailableResponse();
+                        }
                     }
                     else {
                         logger.warn("[ConsentService] ⚠️ No session_id for consent-only flow - delegation will use session-scoped storage only");
@@ -3578,18 +3401,14 @@ export class ConsentService {
             // point that guarantees no downstream consumer (validation,
             // createDelegation, storeDelegationToken) ever reads a caller-forged DID.
             bodyObj.user_did = trustedUserDid;
-            // Convert null oauth_identity to undefined for proper schema validation
-            // Zod's .nullish() should handle null, but converting to undefined is more explicit
-            // and avoids potential edge cases with FormData parsing
-            if (body &&
-                typeof body === "object" &&
-                body !== null &&
-                "oauth_identity" in body) {
-                const bodyObj = body;
-                if (bodyObj.oauth_identity === null) {
-                    bodyObj.oauth_identity = undefined;
-                }
-            }
+            // SECURITY: the delegation's authorization type is the check the server
+            // actually ran, never the caller's label. Checkpoint and the stored
+            // auth-type sidecar both read it from here.
+            bodyObj.provider_type = isPostOAuthClickwrap
+                ? "oauth"
+                : isPostCredentialClickwrap
+                    ? CONSENT_PROVIDER_TYPES.PASSWORD
+                    : CONSENT_PROVIDER_TYPES.NONE;
             const validation = validateConsentApprovalRequest(body);
             if (!validation.success) {
                 logger.error("[ConsentService] Approval request validation failed:", {
@@ -3645,10 +3464,17 @@ export class ConsentService {
             // session lookup). The resolved value is threaded into createDelegation so
             // it is never resolved a second time.
             let resolvedUserDid = approvalRequest.user_did;
-            if (!resolvedUserDid && approvalRequest.session_id) {
+            // Never for consent-only: the session lookup can return a signed-in
+            // user's DID, and a consent-only approval proves no sign-in. One with a
+            // stored session has a throwaway DID by now or was refused above.
+            if (!resolvedUserDid &&
+                approvalRequest.session_id &&
+                !isConsentOnlyMode) {
                 try {
+                    // No OAuth identity: a caller-supplied one would select another
+                    // user's stored DID (see getUserDidForSession's first lookup).
                     resolvedUserDid =
-                        (await this.getUserDidForSession(approvalRequest.session_id, approvalRequest.oauth_identity || undefined)) ?? undefined;
+                        (await this.getUserDidForSession(approvalRequest.session_id, undefined)) ?? undefined;
                 }
                 catch (error) {
                     logger.debug("[ConsentService] Failed to resolve userDid ahead of identity gate:", error);
@@ -3690,7 +3516,7 @@ export class ConsentService {
             }
             // Create delegation via Checkpoint API
             logger.debug("[ConsentService] Creating delegation...");
-            const delegationResult = await this.createDelegation(approvalRequest, resolveExpirationDays(consentConfig.expirationDays), resolvedUserDid ?? null);
+            const delegationResult = await this.createDelegation(approvalRequest, resolveExpirationDays(consentConfig.expirationDays), resolvedUserDid ?? null, consentOnlySigningKey);
             if (!delegationResult.success) {
                 logger.error("[ConsentService] Delegation creation failed:", {
                     error: delegationResult.error,
@@ -3723,7 +3549,7 @@ export class ConsentService {
             // match the tool's authorization.type; 'credential'/'password' form
             // submissions were routed to handleCredentialApproval earlier), so it
             // maps cleanly through normalizeAuthType — no 'credential' mis-fold here.
-            effectiveProviderType);
+            effectiveProviderType, keepSessionUserDid);
             // ✅ After successful delegation creation - log audit events
             if (auditService && delegationResult.success) {
                 try {
@@ -3791,9 +3617,12 @@ export class ConsentService {
      * Create delegation via Checkpoint API
      *
      * @param request - Approval request
+     * @param signingKeyPair - Key that signs the delegation VC when the user DID
+     *   is a throwaway identity not stored on the session (consent-only in a
+     *   signed-in session). Otherwise the session's own key is used.
      * @returns Delegation creation result
      */
-    async createDelegation(request, expirationDaysOverride, resolvedUserDid) {
+    async createDelegation(request, expirationDaysOverride, resolvedUserDid, signingKeyPair) {
         // Resolve the mandate from the APPROVED scopes first: nothing (no VC, no
         // POST) may happen when a configured provider cannot answer.
         const mandateResolution = await this.resolveMandate(request.scopes ?? [], request.project_id);
@@ -3840,12 +3669,13 @@ export class ConsentService {
                             oauthProvider: request.oauth_identity?.provider,
                             hasStorage: !!this.env.DELEGATION_STORAGE,
                         });
-                        // Pass OAuth identity if available in approval request (can be null/undefined)
+                        // SECURITY: never the request's oauth_identity. It is caller
+                        // input, and getUserDidForSession would return the DID stored for
+                        // whichever OAuth identity it names.
                         // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
                         // Phase 5: Returns null if no identity found (session stays anonymous)
                         userDid =
-                            (await this.getUserDidForSession(request.session_id, request.oauth_identity || undefined // Explicitly handle null as undefined
-                            )) ?? undefined;
+                            (await this.getUserDidForSession(request.session_id, undefined)) ?? undefined;
                         logger.debug("[ConsentService] User DID retrieved from storage:", {
                             userDid: userDid?.substring(0, 20) + "...",
                             hasUserDid: !!userDid,
@@ -3901,7 +3731,10 @@ export class ConsentService {
                         status: "active",
                         createdAt: Date.now(), // milliseconds per schema
                     };
-                    const vcResult = await this.issueDelegationVC(localDelegation, request.session_id, request.oauth_identity || undefined);
+                    // SECURITY: no OAuth identity from the request. It would pick the
+                    // signing key stored for that identity, i.e. sign as another user.
+                    // The key comes from this session's own server-side record.
+                    const vcResult = await this.issueDelegationVC(localDelegation, request.session_id, undefined, signingKeyPair);
                     credentialJwt = vcResult ?? undefined;
                     if (credentialJwt) {
                         logger.debug("[ConsentService] VC issued for delegation:", {
@@ -3944,7 +3777,7 @@ export class ConsentService {
             //
             // IMPORTANT: delegation_token is NOT returned by POST /api/v1/bouncer/delegations.
             // delegation_token is only available via OAuth callback flow and is passed as a URL parameter.
-            // See: docs/agentshield/API_RESPONSE_FORMATS.md for canonical format documentation.
+            // See: docs/checkpoint/API_RESPONSE_FORMATS.md for canonical format documentation.
             // Try wrapped format first (canonical)
             const wrappedParse = createDelegationAPIResponseSchema.safeParse(responseData);
             if (wrappedParse.success) {
@@ -4114,8 +3947,12 @@ export class ConsentService {
      *   persisting so the call-time enforcement gate (Task B2/B3) reads a
      *   consistent value ("password" | "oauth2" | "none" | …). Undefined → the
      *   field is omitted and the gate fails safe (never satisfies a typed tool).
+     * @param keepSessionUserDid - Keep the session record's existing userDid
+     *   instead of overwriting it with this delegation's: set when a
+     *   consent-only grant in a signed-in session was minted under a fresh
+     *   throwaway DID, so the session keeps its signed-in identity.
      */
-    async storeDelegationToken(sessionId, agentDid, token, delegationId, providedUserDid, serverOrigin, authorizationType) {
+    async storeDelegationToken(sessionId, agentDid, token, delegationId, providedUserDid, serverOrigin, authorizationType, keepSessionUserDid = false) {
         const delegationStorage = this.env.DELEGATION_STORAGE;
         // Task B2: normalize once (folds deprecated aliases: oauth→oauth2) so every
         // stored record and every read compares in the same vocabulary.
@@ -4217,7 +4054,9 @@ export class ConsentService {
                 const existingData = (await delegationStorage.get(sessionKey, "json"));
                 await delegationStorage.put(sessionKey, JSON.stringify({
                     ...existingData,
-                    userDid,
+                    userDid: keepSessionUserDid
+                        ? (existingData?.userDid ?? userDid)
+                        : userDid,
                     agentDid,
                     delegationToken: token,
                     delegationId,
@@ -4646,6 +4485,9 @@ export class ConsentService {
             if (Array.isArray(scopes) && scopes.length > 0) {
                 clickwrapUrl.searchParams.set("scopes", scopes.join(","));
             }
+            // The clickwrap approval reads these display fields from server storage;
+            // the copies in the URL below are for the page only.
+            await this.storeCredentialClickwrapUser(session_id, identityResult.userDid, authResult.userEmail, authResult.userId);
             // Include user info for delegation request
             // Field mapping (clear naming):
             //   credential_user_email → user_identifier (human-readable for display)
@@ -5416,6 +5258,8 @@ export class ConsentService {
         const customFieldsFromRequest = request.customFields || {};
         if (userDid || fullFormatUserEmail || providerType !== "none") {
             result.custom_fields = {
+                // Caller fields first, so every server-set field below wins
+                ...customFieldsFromRequest,
                 ...(userDid
                     ? {
                         issuer_did: userDid,
@@ -5432,8 +5276,6 @@ export class ConsentService {
                 ...(fullFormatProviderUserId
                     ? { user_id: fullFormatProviderUserId }
                     : {}),
-                // Merge with any existing custom_fields from request
-                ...customFieldsFromRequest,
             };
             if (fullFormatUserEmail || fullFormatProviderUserId) {
                 logger.debug("[ConsentService] Full format: Including user info in custom_fields for Checkpoint compatibility:", {
@@ -5571,6 +5413,8 @@ export class ConsentService {
             // - oauth_provider present → authorization.type = 'oauth'
             // NOTE: Tool protection expects 'password' for credential flows, NOT 'credential'
             simplifiedRequest.custom_fields = {
+                // Caller fields first, so every server-set field below wins
+                ...customFieldsFromRequest,
                 ...(userDid
                     ? {
                         issuer_did: userDid,
@@ -5586,8 +5430,6 @@ export class ConsentService {
                 // user_id = provider's internal ID (for business reference, e.g., customer ID 696395)
                 ...(userEmail ? { user_email: userEmail } : {}),
                 ...(providerUserId ? { user_id: providerUserId } : {}),
-                // Merge with any existing custom_fields from request
-                ...customFieldsFromRequest,
             };
             if (hasProviderInfo) {
                 logger.debug("[ConsentService] Including provider info in custom_fields:", {