@kya-os/mcp-i-cloudflare 1.5.10-canary.9 → 1.6.0

package/dist/services/consent.service.js

@@ -10,22 +10,174 @@ import { ConsentConfigService } from "./consent-config.service";
 import { ConsentPageRenderer } from "./consent-page-renderer";
 import { DEFAULT_AGENTSHIELD_URL, DEFAULT_SESSION_CACHE_TTL, } from "../constants";
 import { STORAGE_KEYS } from "../constants/storage-keys";
-import { loadDay0Config } from "../utils/day0-config";
+import { loadDay0Config, getDelegationFieldName } from "../utils/day0-config";
 import { validateConsentApprovalRequest, } from "@kya-os/contracts/consent";
 import { AGENTSHIELD_ENDPOINTS, createDelegationAPIResponseSchema, createDelegationResponseSchema, } from "@kya-os/contracts/agentshield-api";
 import { UserDidManager } from "@kya-os/mcp-i-core";
 import { WebCryptoProvider } from "../providers/crypto";
+import { ConsentAuditService } from "./consent-audit.service";
+import { CloudflareProofGenerator } from "../proof-generator";
+import { ProofService } from "./proof.service";
+import { fetchRemoteConfig } from "@kya-os/mcp-i-core";
 export class ConsentService {
     configService;
     renderer;
     env;
     runtime;
     userDidManager; // Cached instance for consistent DID generation
-    constructor(env, runtime) {
+    // ✅ Audit service - lazy initialized
+    auditService;
+    auditInitPromise; // Cache promise to prevent race conditions
+    // Phase 2: Provider resolution services (optional for backward compatibility)
+    providerResolver;
+    providerRegistry;
+    /**
+     * ✅ FIXED: Constructor takes env: CloudflareEnv, not config
+     * Phase 2: Optional providerResolver and providerRegistry for tool-specific providers
+     */
+    constructor(env, runtime, providerResolver, providerRegistry) {
         this.env = env;
         this.runtime = runtime;
         this.configService = new ConsentConfigService(env);
         this.renderer = new ConsentPageRenderer();
+        this.providerResolver = providerResolver;
+        this.providerRegistry = providerRegistry;
+        // No initialization here - keep constructor synchronous
+    }
+    /**
+     * Get or initialize audit service (lazy initialization)
+     *
+     * Fetches config from remote API when projectId is available.
+     * Uses promise caching to prevent race conditions.
+     *
+     * @param projectId - Project ID from consent request (required for config fetch)
+     */
+    async getAuditService(projectId) {
+        // Already initialized
+        if (this.auditService) {
+            return this.auditService;
+        }
+        // No runtime - audit not available
+        if (!this.runtime) {
+            return undefined;
+        }
+        // Initialization in progress - wait for it
+        if (this.auditInitPromise) {
+            await this.auditInitPromise;
+            return this.auditService;
+        }
+        // Start initialization (with projectId for config fetch)
+        this.auditInitPromise = this.initializeAuditService(projectId);
+        try {
+            await this.auditInitPromise;
+        }
+        catch (error) {
+            console.warn("[ConsentService] Audit service initialization failed:", error);
+            // Don't throw - audit failures shouldn't break consent flow
+        }
+        return this.auditService;
+    }
+    /**
+     * Initialize audit service - fetches config from remote API
+     *
+     * ⚠️ CRITICAL: Fetches config from remote API using fetchRemoteConfig()
+     * This is the ONLY way to get CloudflareRuntimeConfig per requirement.
+     */
+    async initializeAuditService(projectId) {
+        if (!this.runtime) {
+            return;
+        }
+        try {
+            // ✅ CRITICAL: Fetch config from remote API
+            const config = await this.getConfigFromRemoteAPI(projectId);
+            if (!config?.proofing?.enabled) {
+                console.log("[ConsentService] Proofing not enabled in remote config");
+                return; // Proofing not enabled
+            }
+            // Get identity (async - requires runtime to be initialized)
+            const identity = await this.runtime.getIdentity();
+            // ✅ FIXED: CloudflareProofGenerator only takes identity, not providers
+            const proofGenerator = new CloudflareProofGenerator(identity);
+            // Get audit logger
+            const auditLogger = this.runtime.getAuditLogger();
+            if (!auditLogger) {
+                console.warn("[ConsentService] AuditLogger not available");
+                return;
+            }
+            // Create audit service with fetched config
+            this.auditService = new ConsentAuditService(new ProofService(config, this.runtime), auditLogger, proofGenerator, config, // ✅ Config fetched from remote API
+            this.runtime);
+            console.log("[ConsentService] Audit service initialized successfully");
+        }
+        catch (error) {
+            console.error("[ConsentService] Failed to initialize audit service:", error);
+            // Don't throw - audit failures shouldn't break consent flow
+        }
+    }
+    /**
+     * Fetch CloudflareRuntimeConfig from remote API (AgentShield)
+     *
+     * ⚠️ CRITICAL: Config MUST be fetched from remote API, not constructed from env.
+     *
+     * Uses existing `fetchRemoteConfig()` from `@kya-os/mcp-i-core/config/remote-config`
+     * which handles caching, error handling, and API communication.
+     *
+     * @param projectId - Project ID from consent request
+     * @returns Runtime config or undefined if unavailable
+     */
+    async getConfigFromRemoteAPI(projectId) {
+        if (!this.env.AGENTSHIELD_API_KEY) {
+            console.warn("[ConsentService] No API key for runtime config fetch");
+            return undefined;
+        }
+        try {
+            // Create KV cache adapter
+            const cache = this.env.TOOL_PROTECTION_KV
+                ? {
+                    get: async (key) => {
+                        return ((await this.env.TOOL_PROTECTION_KV.get(key, "text")) || null);
+                    },
+                    set: async (key, value, ttl) => {
+                        await this.env.TOOL_PROTECTION_KV.put(key, value, {
+                            expirationTtl: Math.floor(ttl / 1000),
+                        });
+                    },
+                }
+                : undefined;
+            const config = await fetchRemoteConfig({
+                apiUrl: this.env.AGENTSHIELD_API_URL || "https://kya.vouched.id",
+                apiKey: this.env.AGENTSHIELD_API_KEY,
+                projectId, // ✅ Use projectId from consent request
+                cacheTtl: 300000, // 5 minutes
+                fetchProvider: fetch,
+            }, cache);
+            // Populate serverDid from runtime identity if missing or empty
+            // This prevents AgentShield validation errors (serverDid must be at least 1 character)
+            // Note: MCPIConfig.identity is RuntimeIdentityConfig (no serverDid), but AgentShield
+            // may return MCPIServerConfig format (has serverDid). We need to handle both.
+            if (config && config.identity) {
+                const identityConfig = config.identity; // Type assertion for serverDid field
+                if (!identityConfig.serverDid || identityConfig.serverDid === "") {
+                    try {
+                        const runtimeIdentity = await this.runtime?.getIdentity();
+                        if (runtimeIdentity?.did) {
+                            identityConfig.serverDid = runtimeIdentity.did;
+                            console.log("[ConsentService] Populated serverDid from runtime identity");
+                        }
+                    }
+                    catch (error) {
+                        console.warn("[ConsentService] Failed to get runtime identity for serverDid:", error);
+                    }
+                }
+            }
+            // fetchRemoteConfig returns MCPIConfig | null
+            // CloudflareRuntimeConfig extends MCPIConfig, so cast is safe
+            return config;
+        }
+        catch (error) {
+            console.warn("[ConsentService] Error fetching runtime config:", error);
+            return undefined;
+        }
     }
     /**
      * Get or generate User DID for a session
@@ -37,14 +189,32 @@ export class ConsentService {
      * @param oauthIdentity - Optional OAuth provider identity
      * @returns User DID (did:key format)
      */
+    /**
+     * Get user DID for a session
+     *
+     * Public method to retrieve user DID from session storage or OAuth identity mapping.
+     * Used by OAuth handler to get userDid when OAuth linking fails.
+     *
+     * @param sessionId - Session ID
+     * @param oauthIdentity - Optional OAuth provider identity
+     * @returns User DID (did:key format)
+     */
     async getUserDidForSession(sessionId, oauthIdentity) {
+        // Handle null explicitly (from JSON parsing)
+        const hasOAuthIdentity = oauthIdentity &&
+            typeof oauthIdentity === "object" &&
+            oauthIdentity.provider &&
+            oauthIdentity.subject;
         // If OAuth identity provided, check for existing mapping first
-        if (oauthIdentity && this.env.DELEGATION_STORAGE) {
+        if (hasOAuthIdentity && this.env.DELEGATION_STORAGE) {
             try {
                 const oauthKey = STORAGE_KEYS.oauthIdentity(oauthIdentity.provider, oauthIdentity.subject);
                 const mappedUserDid = await this.env.DELEGATION_STORAGE.get(oauthKey, "text");
                 if (mappedUserDid) {
-                    console.log("[ConsentService] Found persistent User DID from OAuth mapping");
+                    console.log("[ConsentService] Found persistent User DID from OAuth mapping:", {
+                        provider: oauthIdentity.provider,
+                        userDid: mappedUserDid.substring(0, 20) + "...",
+                    });
                     return mappedUserDid;
                 }
             }
@@ -53,6 +223,10 @@ export class ConsentService {
                 // Continue with ephemeral DID generation
             }
         }
+        else if (oauthIdentity === null) {
+            // Explicitly handle null case (no OAuth)
+            console.log("[ConsentService] No OAuth identity provided (null), generating ephemeral DID");
+        }
         // Continue with existing ephemeral DID generation logic
         if (!this.env.DELEGATION_STORAGE) {
             // No storage - use cached UserDidManager instance for consistent DID generation
@@ -96,10 +270,34 @@ export class ConsentService {
                     delete: async (key) => {
                         await this.env.DELEGATION_STORAGE.delete(`userDid:${key}`);
                     },
+                    // OAuth-based lookup for persistent user DID
+                    getByOAuth: async (provider, subject) => {
+                        try {
+                            const oauthKey = STORAGE_KEYS.oauthIdentity(provider, subject);
+                            const userDid = await this.env.DELEGATION_STORAGE.get(oauthKey, "text");
+                            return userDid || null;
+                        }
+                        catch {
+                            return null;
+                        }
+                    },
+                    // OAuth-based storage for persistent user DID mapping
+                    setByOAuth: async (provider, subject, did, ttl) => {
+                        try {
+                            const oauthKey = STORAGE_KEYS.oauthIdentity(provider, subject);
+                            await this.env.DELEGATION_STORAGE.put(oauthKey, did, {
+                                expirationTtl: ttl || 90 * 24 * 60 * 60, // Default 90 days for persistent mapping
+                            });
+                        }
+                        catch (error) {
+                            console.warn("[ConsentService] Failed to store OAuth mapping:", error);
+                            throw error;
+                        }
+                    },
                 },
             });
         }
-        const userDid = await this.userDidManager.getOrCreateUserDid(sessionId);
+        const userDid = await this.userDidManager.getOrCreateUserDid(sessionId, oauthIdentity);
         // Cache in session storage
         try {
             const existingSession = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
@@ -124,13 +322,45 @@ export class ConsentService {
      *
      * @param projectId - Project ID to check
      * @param oauthIdentity - Optional OAuth identity from cookie
+     * @param toolOAuthProvider - Optional tool-specific OAuth provider (takes precedence)
      * @returns True if OAuth redirect is required
      */
-    async isOAuthRequired(projectId, oauthIdentity) {
+    async isOAuthRequired(projectId, oauthIdentity, toolOAuthProvider, toolProtection) {
         // If OAuth identity is already present, OAuth is not required
         if (oauthIdentity && oauthIdentity.provider && oauthIdentity.subject) {
             return false;
         }
+        // If tool specifically requires an OAuth provider, it's required immediately
+        if (toolOAuthProvider) {
+            return true;
+        }
+        // Phase 2: If toolOAuthProvider is undefined but tool requires delegation,
+        // use ProviderResolver to check if a provider can be resolved
+        if (!toolOAuthProvider &&
+            toolProtection &&
+            toolProtection.requiresDelegation) {
+            if (this.providerResolver) {
+                try {
+                    const resolvedProvider = await this.providerResolver.resolveProvider(toolProtection, projectId);
+                    if (resolvedProvider) {
+                        console.log("[ConsentService] OAuth required: ProviderResolver resolved provider", {
+                            projectId,
+                            provider: resolvedProvider,
+                            toolRequiresDelegation: toolProtection.requiresDelegation,
+                            hasToolOAuthProvider: !!toolOAuthProvider,
+                        });
+                        return true;
+                    }
+                }
+                catch (error) {
+                    // ProviderResolver failed - log but continue to fallback check
+                    console.warn("[ConsentService] ProviderResolver failed to resolve provider, falling back to project config check:", {
+                        projectId,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+        }
         // Check project config to see if OAuth is configured
         try {
             const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
@@ -143,8 +373,7 @@ export class ConsentService {
             const configUrl = `${agentShieldUrl}/api/v1/bouncer/projects/${projectId}/config`;
             const response = await fetch(configUrl, {
                 headers: {
-                    "X-API-Key": apiKey,
-                    "X-Project-Id": projectId,
+                    Authorization: `Bearer ${apiKey}`,
                     "Content-Type": "application/json",
                 },
             });
@@ -170,34 +399,197 @@ export class ConsentService {
      * Creates the OAuth authorization URL with proper state parameter
      * for redirecting to OAuth provider.
      *
+     * ✅ CSRF Protection: If oauthSecurityService is provided, state is stored securely
+     * in KV storage and validated on callback. Otherwise, falls back to base64-encoded
+     * state (less secure, but backward compatible).
+     *
      * @param projectId - Project ID
      * @param agentDid - Agent DID
      * @param sessionId - Session ID
      * @param scopes - Requested scopes
      * @param serverUrl - Server URL for callback
+     * @param oauthSecurityService - Optional OAuthSecurityService for CSRF protection
      * @returns OAuth authorization URL
      */
-    buildOAuthUrl(projectId, agentDid, sessionId, scopes, serverUrl) {
+    async buildOAuthUrl(projectId, agentDid, sessionId, scopes, serverUrl, provider, // Phase 2: Optional provider name (resolved if not provided)
+    oauthSecurityService) {
         const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
         // Generate a temporary delegation ID for state (will be created after OAuth)
         const delegationId = `temp-${Date.now()}`;
-        // Build state parameter with required fields
-        const state = {
+        // ✅ Phase 1: Generate PKCE challenge if OAuthSecurityService is available
+        let codeVerifier;
+        let codeChallenge;
+        if (oauthSecurityService) {
+            try {
+                const pkceChallenge = await oauthSecurityService.generatePKCEChallenge();
+                codeVerifier = pkceChallenge.verifier;
+                codeChallenge = pkceChallenge.challenge;
+            }
+            catch (error) {
+                console.warn("[ConsentService] Failed to generate PKCE challenge:", error);
+            }
+        }
+        // Build state data with required fields
+        const stateData = {
             project_id: projectId,
             agent_did: agentDid,
             session_id: sessionId,
             delegation_id: delegationId,
             scopes: scopes,
+            storedAt: Date.now(),
         };
-        // Encode state as base64 (Cloudflare Workers compatible)
-        const stateParam = btoa(JSON.stringify(state));
-        // Build OAuth authorization URL
+        // Store PKCE code_verifier in state for token exchange
+        if (codeVerifier) {
+            stateData.code_verifier = codeVerifier;
+            stateData.code_challenge = codeChallenge;
+            stateData.redirect_uri = `${serverUrl}/oauth/callback`;
+        }
+        let stateParam;
+        if (oauthSecurityService && this.env.DELEGATION_STORAGE) {
+            // ✅ CSRF Protection: Generate secure random state value and store state data securely
+            const randomBytes = crypto.getRandomValues(new Uint8Array(32));
+            const stateValue = btoa(String.fromCharCode(...randomBytes))
+                .replace(/\+/g, "-")
+                .replace(/\//g, "_")
+                .replace(/=/g, "");
+            // Store state data securely in KV (10 minute TTL for OAuth flow)
+            await oauthSecurityService.storeOAuthState(stateValue, stateData, 600);
+            stateParam = stateValue;
+            console.log("[ConsentService] 🔒 SECURITY EVENT: OAuth state stored securely:", {
+                projectId,
+                agentDid: agentDid.substring(0, 20) + "...",
+                sessionId: sessionId.substring(0, 20) + "...",
+                stateValue: stateValue.substring(0, 20) + "...",
+                timestamp: new Date().toISOString(),
+                eventType: "oauth_state_stored",
+                ttl: 600,
+            });
+        }
+        else {
+            // Fallback: Encode state as base64 (less secure, but backward compatible)
+            if (!oauthSecurityService) {
+                console.warn("[ConsentService] ⚠️ SECURITY WARNING: OAuthSecurityService not provided, using insecure state encoding");
+            }
+            stateParam = btoa(JSON.stringify(stateData));
+        }
+        // Phase 3: Resolve provider config and extract custom parameters
+        let providerConfig = null;
+        if (provider && this.providerRegistry) {
+            providerConfig = this.providerRegistry.getProvider(provider);
+        }
+        // Phase 3: Check if we should use direct OAuth URL (bypass AgentShield bouncer)
+        // This is for custom providers that need direct OAuth URLs
+        if (providerConfig &&
+            providerConfig.proxyMode === true &&
+            !providerConfig.supportsPKCE) {
+            // Use providerConfig.clientId for custom providers, not projectId
+            const oauthClientId = providerConfig.clientId || projectId;
+            return this.buildDirectOAuthUrl(providerConfig, oauthClientId, `${serverUrl}/oauth/callback`, scopes, stateParam, codeChallenge);
+        }
+        // Phase 3: Validate custom parameters don't conflict with reserved parameters
+        const RESERVED_PARAMS = [
+            "response_type",
+            "client_id",
+            "redirect_uri",
+            "scope",
+            "state",
+            "code_challenge",
+            "code_challenge_method",
+        ];
+        if (providerConfig?.customParams) {
+            for (const [key, value] of Object.entries(providerConfig.customParams)) {
+                const normalizedKey = key.toLowerCase();
+                if (RESERVED_PARAMS.includes(normalizedKey)) {
+                    throw new Error(`Custom parameter "${key}" conflicts with reserved OAuth parameter. Reserved parameters: ${RESERVED_PARAMS.join(", ")}`);
+                }
+                // Validate value is a string before calling string methods
+                if (typeof value !== "string") {
+                    throw new Error(`Custom parameter "${key}" must be a string, got ${typeof value}`);
+                }
+                if (!value || value.trim().length === 0) {
+                    throw new Error(`Custom parameter "${key}" has empty value`);
+                }
+            }
+        }
+        // Build OAuth authorization URL (AgentShield bouncer endpoint)
         const oauthUrl = new URL(`${agentShieldUrl}/bouncer/oauth/authorize`);
         oauthUrl.searchParams.set("response_type", "code");
         oauthUrl.searchParams.set("client_id", projectId); // Use projectId as client_id
         oauthUrl.searchParams.set("redirect_uri", `${serverUrl}/oauth/callback`);
         oauthUrl.searchParams.set("scope", scopes.join(" "));
         oauthUrl.searchParams.set("state", stateParam);
+        // ✅ Phase 1: Add PKCE challenge to authorization URL if available
+        if (codeChallenge) {
+            oauthUrl.searchParams.set("code_challenge", codeChallenge);
+            oauthUrl.searchParams.set("code_challenge_method", "S256");
+        }
+        // Phase 3: Inject custom parameters (after standard params, before PKCE params)
+        if (providerConfig?.customParams) {
+            for (const [key, value] of Object.entries(providerConfig.customParams)) {
+                oauthUrl.searchParams.set(key, value);
+            }
+        }
+        return oauthUrl.toString();
+    }
+    /**
+     * Build direct OAuth URL (bypasses AgentShield bouncer endpoint)
+     *
+     * Used for custom providers that need direct OAuth URLs (e.g., self-hosted OAuth servers).
+     * Triggered when providerConfig.proxyMode === true && !providerConfig.supportsPKCE
+     *
+     * @param providerConfig - Provider configuration
+     * @param clientId - OAuth client ID
+     * @param redirectUri - Redirect URI for OAuth callback
+     * @param scopes - Requested scopes
+     * @param state - OAuth state parameter
+     * @param codeChallenge - Optional PKCE code challenge
+     * @returns Direct OAuth authorization URL
+     */
+    buildDirectOAuthUrl(providerConfig, clientId, redirectUri, scopes, state, codeChallenge) {
+        // Validate custom parameters don't conflict with reserved parameters
+        const RESERVED_PARAMS = [
+            "response_type",
+            "client_id",
+            "redirect_uri",
+            "scope",
+            "state",
+            "code_challenge",
+            "code_challenge_method",
+        ];
+        if (providerConfig.customParams) {
+            for (const [key, value] of Object.entries(providerConfig.customParams)) {
+                const normalizedKey = key.toLowerCase();
+                if (RESERVED_PARAMS.includes(normalizedKey)) {
+                    throw new Error(`Custom parameter "${key}" conflicts with reserved OAuth parameter. Reserved parameters: ${RESERVED_PARAMS.join(", ")}`);
+                }
+                // Validate value is a string before calling string methods
+                if (typeof value !== "string") {
+                    throw new Error(`Custom parameter "${key}" must be a string, got ${typeof value}`);
+                }
+                if (!value || value.trim().length === 0) {
+                    throw new Error(`Custom parameter "${key}" has empty value`);
+                }
+            }
+        }
+        // Build OAuth URL directly to provider's authorization endpoint
+        const oauthUrl = new URL(providerConfig.authorizationUrl);
+        // Include standard OAuth params
+        oauthUrl.searchParams.set("response_type", providerConfig.responseType || "code");
+        oauthUrl.searchParams.set("client_id", clientId);
+        oauthUrl.searchParams.set("redirect_uri", redirectUri);
+        oauthUrl.searchParams.set("scope", scopes.join(" "));
+        oauthUrl.searchParams.set("state", state);
+        // Include PKCE params if supported and challenge provided
+        if (providerConfig.supportsPKCE && codeChallenge) {
+            oauthUrl.searchParams.set("code_challenge", codeChallenge);
+            oauthUrl.searchParams.set("code_challenge_method", "S256");
+        }
+        // Include custom parameters (after standard params, before PKCE params)
+        if (providerConfig.customParams) {
+            for (const [key, value] of Object.entries(providerConfig.customParams)) {
+                oauthUrl.searchParams.set(key, value);
+            }
+        }
         return oauthUrl.toString();
     }
     /**
@@ -312,76 +704,12 @@ export class ConsentService {
             const agentDid = params.get("agent_did");
             const sessionId = params.get("session_id");
             const projectId = params.get("project_id");
-            // Validate required parameters with detailed error messages
-            const missingParams = [];
-            if (!tool)
-                missingParams.push("tool");
-            if (!agentDid)
-                missingParams.push("agent_did");
-            if (!sessionId)
-                missingParams.push("session_id");
-            if (!projectId)
-                missingParams.push("project_id");
-            if (missingParams.length > 0) {
-                console.error("[ConsentService] Missing required parameters:", {
-                    missing: missingParams,
-                    received: {
-                        tool: tool || null,
-                        agent_did: agentDid || null,
-                        session_id: sessionId || null,
-                        project_id: projectId || null,
-                    },
-                    url: request.url,
-                });
+            // Validate required parameters
+            if (!tool || !agentDid || !sessionId || !projectId) {
                 return new Response(JSON.stringify({
                     success: false,
-                    error: `Missing required parameters: ${missingParams.join(", ")}`,
+                    error: "Missing required parameters",
                     error_code: "missing_parameters",
-                    missing_parameters: missingParams,
-                    received_parameters: {
-                        tool: tool || null,
-                        agent_did: agentDid || null,
-                        session_id: sessionId || null,
-                        project_id: projectId || null,
-                    },
-                }), {
-                    status: 400,
-                    headers: { "Content-Type": "application/json" },
-                });
-            }
-            // Validate parameter formats
-            const validationErrors = [];
-            if (agentDid && !agentDid.startsWith("did:")) {
-                validationErrors.push("agent_did must be a valid DID (starting with 'did:')");
-            }
-            if (sessionId && sessionId.length < 10) {
-                validationErrors.push("session_id appears to be invalid (too short)");
-            }
-            if (projectId && projectId.length < 1) {
-                validationErrors.push("project_id appears to be invalid (empty)");
-            }
-            if (validationErrors.length > 0) {
-                console.error("[ConsentService] Parameter validation failed:", {
-                    errors: validationErrors,
-                    received: {
-                        tool,
-                        agent_did: agentDid,
-                        session_id: sessionId,
-                        project_id: projectId,
-                    },
-                    url: request.url,
-                });
-                return new Response(JSON.stringify({
-                    success: false,
-                    error: "Invalid parameter format",
-                    error_code: "validation_error",
-                    validation_errors: validationErrors,
-                    received_parameters: {
-                        tool,
-                        agent_did: agentDid,
-                        session_id: sessionId,
-                        project_id: projectId,
-                    },
                 }), {
                     status: 400,
                     headers: { "Content-Type": "application/json" },
@@ -404,7 +732,6 @@ export class ConsentService {
                 }
             }
             // Get consent config from AgentShield or defaults
-            // Note: projectId is validated above and guaranteed to be non-null at this point
             const consentConfig = await this.configService.getConsentConfig(projectId);
             // Build server URL from request origin
             // Priority: 1) env var, 2) request origin, 3) error if neither available
@@ -447,401 +774,1263 @@ export class ConsentService {
                                 oauthIdentity = parsed;
                             }
                         }
-                        catch (parseError) {
-                            console.warn("[ConsentService] Invalid OAuth cookie format:", parseError);
+                        catch (parseError) {
+                            console.warn("[ConsentService] Invalid OAuth cookie format:", parseError);
+                        }
+                    }
+                }
+            }
+            catch (error) {
+                console.warn("[ConsentService] Failed to extract OAuth cookie:", error);
+                // Non-fatal - continue without OAuth identity
+            }
+            // Check if OAuth is required (after extracting OAuth identity)
+            // Check both project-level config AND tool-specific protection
+            const toolProtectionService = this.runtime?.config
+                ?.toolProtectionService;
+            let toolOAuthProvider;
+            let protection;
+            if (toolProtectionService && this.runtime) {
+                const agentDidObj = await this.runtime.getIdentity();
+                protection = await toolProtectionService.checkToolProtection(tool, agentDidObj.did);
+                toolOAuthProvider = protection?.oauthProvider;
+            }
+            const oauthRequired = await this.isOAuthRequired(projectId, oauthIdentity, toolOAuthProvider, protection);
+            // Phase 2: Resolve provider for tool if providerResolver is available
+            let provider;
+            if (this.providerResolver && this.runtime) {
+                try {
+                    const agentDidObj = await this.runtime.getIdentity();
+                    const toolProtectionService = this.runtime.config
+                        ?.toolProtectionService;
+                    if (toolProtectionService) {
+                        const protection = await toolProtectionService.checkToolProtection(tool, agentDidObj.did);
+                        if (protection) {
+                            provider = await this.providerResolver.resolveProvider(protection, projectId);
+                        }
+                    }
+                }
+                catch (error) {
+                    // Non-fatal - continue without provider info
+                    console.warn("[ConsentService] Failed to resolve provider for consent page:", error);
+                }
+            }
+            let resolvedOAuthUrl;
+            let isOAuthRequired = false;
+            if (oauthRequired) {
+                // OAuth is required - redirect to OAuth provider instead of showing consent page
+                // Note: oauthSecurityService is optional - if not provided, falls back to insecure encoding
+                const oauthSecurityService = this.env.DELEGATION_STORAGE
+                    ? new (await import("./oauth-security.service")).OAuthSecurityService(this.env.DELEGATION_STORAGE, this.env.OAUTH_ENCRYPTION_SECRET)
+                    : undefined;
+                // Build OAuth URL for redirection
+                // Note: We're building it here, but we'll pass it to the renderer
+                // instead of redirecting immediately, so the user sees the consent page first.
+                resolvedOAuthUrl = await this.buildOAuthUrl(projectId, agentDid, sessionId, scopes, serverUrl, undefined, // provider - will be resolved by ProviderResolver if available
+                oauthSecurityService);
+                isOAuthRequired = true;
+                console.log("[ConsentService] 🔒 SECURITY EVENT: OAuth required, preparing consent page with redirect:", {
+                    projectId,
+                    agentDid: agentDid.substring(0, 20) + "...",
+                    oauthUrl: resolvedOAuthUrl.substring(0, 100) + "...",
+                    hasSecureState: !!oauthSecurityService,
+                    timestamp: new Date().toISOString(),
+                    eventType: "oauth_redirect_prepared",
+                });
+            }
+            // ✅ Lazy initialization with projectId
+            const auditService = await this.getAuditService(projectId);
+            // Log page view event (if audit service available)
+            if (auditService) {
+                await auditService
+                    .logConsentPageView({
+                    sessionId,
+                    agentDid,
+                    targetTools: [tool], // Wrap in array
+                    scopes,
+                    projectId,
+                    // oauthProvider: provider, // TODO: Enable logging of resolved provider once type is updated
+                })
+                    .catch((err) => {
+                    // Structured error logging
+                    console.error("[ConsentService] Audit logging failed", {
+                        eventType: "consent:page_viewed",
+                        sessionId,
+                        error: err instanceof Error ? err.message : String(err),
+                        stack: err instanceof Error ? err.stack : undefined,
+                    });
+                    // Don't throw - audit failures shouldn't break consent flow
+                });
+            }
+            // Build consent page config
+            // Type assertion to handle updated schema before rebuild
+            const pageConfig = {
+                tool,
+                toolDescription,
+                scopes,
+                agentDid,
+                sessionId,
+                projectId,
+                serverUrl,
+                provider, // Phase 2: Include provider if resolved
+                branding: consentConfig.branding,
+                terms: consentConfig.terms,
+                customFields: consentConfig.customFields,
+                autoClose: consentConfig.ui?.autoClose,
+                // Pass OAuth details for client-side handling
+                oauthRequired: isOAuthRequired,
+                oauthUrl: resolvedOAuthUrl,
+            };
+            // Render page with OAuth identity (if available)
+            const html = this.renderer.render(pageConfig, oauthIdentity);
+            return new Response(html, {
+                status: 200,
+                headers: {
+                    "Content-Type": "text/html; charset=utf-8",
+                    "Cache-Control": "no-cache, no-store, must-revalidate",
+                },
+            });
+        }
+        catch (error) {
+            console.error("[ConsentService] Error rendering consent page:", error);
+            return new Response(JSON.stringify({
+                success: false,
+                error: "Failed to render consent page",
+                error_code: "render_error",
+            }), {
+                status: 500,
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+    }
+    /**
+     * Parse request body from JSON or FormData
+     *
+     * Handles both JSON and FormData/multipart requests, converting
+     * FormData fields to the correct format for ConsentApprovalRequest.
+     *
+     * @param request - Request to parse
+     * @returns Parsed body object
+     */
+    async parseRequestBody(request) {
+        const contentType = request.headers.get("content-type") || "";
+        // Helper function to parse form fields into body object
+        const parseFormFields = (entries) => {
+            const body = {};
+            for (const [key, value] of entries) {
+                // Handle special fields that need parsing
+                if (key === "scopes" || key === "scopes[]") {
+                    // Scopes come as JSON string
+                    try {
+                        body["scopes"] = JSON.parse(value);
+                    }
+                    catch {
+                        // If not JSON, treat as single scope or array
+                        body["scopes"] = value.includes(",") ? value.split(",") : [value];
+                    }
+                }
+                else if (key === "oauth_identity" || key === "oauth_identity_json") {
+                    // OAuth identity comes as JSON string
+                    try {
+                        const parsed = JSON.parse(value);
+                        body["oauth_identity"] = parsed || null;
+                    }
+                    catch {
+                        // Invalid JSON, set to null
+                        body["oauth_identity"] = null;
+                    }
+                }
+                else if (key === "termsAccepted") {
+                    // Convert checkbox values to boolean
+                    body[key] =
+                        value === "on" ||
+                            value === "true" ||
+                            value === "1" ||
+                            value === "yes";
+                }
+                else if (key === "customFields") {
+                    // Custom fields come as JSON string
+                    try {
+                        body[key] = JSON.parse(value);
+                    }
+                    catch {
+                        // If not JSON, skip
+                    }
+                }
+                else {
+                    // Regular string fields
+                    body[key] = value;
+                }
+            }
+            // Default termsAccepted to true if not provided (common for checkboxes)
+            if (!("termsAccepted" in body)) {
+                body.termsAccepted = true;
+            }
+            // Default scopes to empty array if not provided (required by schema but can be empty)
+            if (!("scopes" in body)) {
+                body.scopes = [];
+            }
+            return body;
+        };
+        // Parse URL-encoded form data (application/x-www-form-urlencoded)
+        // When Content-Type is URL-encoded but FormData object is passed, try FormData parsing first
+        if (contentType.includes("application/x-www-form-urlencoded")) {
+            // Try FormData parsing first (FormData object might have been passed)
+            try {
+                const clonedRequest = request.clone();
+                const formData = await clonedRequest.formData();
+                const body = {};
+                let hasValidFields = false;
+                // Check if FormData parsing returned malformed data (entire multipart body as single entry)
+                // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                const entriesArray = Array.from(formData.entries());
+                if (entriesArray.length === 1 &&
+                    typeof entriesArray[0][0] === "string" &&
+                    entriesArray[0][0].includes("Content-Disposition") &&
+                    typeof entriesArray[0][1] === "string" &&
+                    entriesArray[0][1].toString().includes("Content-Disposition")) {
+                    // Manually parse multipart format from the value string
+                    // The key contains the first boundary and Content-Disposition header start
+                    // The value contains the rest of the first field and all subsequent fields
+                    const keyPart = entriesArray[0][0];
+                    const valuePart = entriesArray[0][1];
+                    // Fix: If key ends with "name" and value starts with '"fieldname"', combine them
+                    let multipartBody;
+                    if (keyPart.trim().endsWith("name") &&
+                        valuePart.trim().startsWith('"')) {
+                        // Key ends with "name", value starts with '"fieldname"', combine with = between them
+                        multipartBody = keyPart + "=" + valuePart;
+                    }
+                    else {
+                        multipartBody = keyPart + valuePart;
+                    }
+                    // Match: Content-Disposition header with field name, then capture value until next boundary or end
+                    const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                    let match;
+                    while ((match = fieldRegex.exec(multipartBody)) !== null) {
+                        const fieldName = match[1];
+                        const fieldValue = match[2].trim(); // Remove trailing newlines
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(fieldValue);
+                            }
+                            catch {
+                                body["scopes"] = fieldValue.includes(",")
+                                    ? fieldValue.split(",")
+                                    : [fieldValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                fieldValue === "on" ||
+                                    fieldValue === "true" ||
+                                    fieldValue === "1" ||
+                                    fieldValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(fieldValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = fieldValue;
+                        }
+                        hasValidFields = true;
+                    }
+                }
+                else {
+                    // Normal FormData parsing
+                    // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                    for (const [key, value] of formData.entries()) {
+                        if (value instanceof File) {
+                            continue;
+                        }
+                        // Extract field name from malformed keys (when FormData is passed with wrong Content-Type)
+                        let fieldName = key;
+                        if (key.includes("Content-Disposition") && key.includes('name="')) {
+                            // Extract field name from Content-Disposition header
+                            const nameMatch = key.match(/name="([^"]+)"/);
+                            if (nameMatch && nameMatch[1]) {
+                                fieldName = nameMatch[1];
+                            }
+                            else {
+                                // Skip if we can't extract a valid field name
+                                continue;
+                            }
+                        }
+                        else if (key.includes("------") ||
+                            key.includes("\r\n") ||
+                            key.trim() === "") {
+                            // Skip boundary strings and invalid keys
+                            continue;
+                        }
+                        hasValidFields = true;
+                        const stringValue = value.toString();
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                body["scopes"] = stringValue.includes(",")
+                                    ? stringValue.split(",")
+                                    : [stringValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(stringValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                stringValue === "on" ||
+                                    stringValue === "true" ||
+                                    stringValue === "1" ||
+                                    stringValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = stringValue;
+                        }
+                    }
+                }
+                if (hasValidFields && Object.keys(body).length > 0) {
+                    if (!("termsAccepted" in body)) {
+                        body.termsAccepted = true;
+                    }
+                    // Default scopes to empty array if not provided
+                    if (!("scopes" in body)) {
+                        body.scopes = [];
+                    }
+                    return body;
+                }
+            }
+            catch (formDataError) {
+                // FormData parsing failed, try URL-encoded text parsing
+                console.warn("[ConsentService] FormData parsing failed, trying URL-encoded text:", formDataError);
+            }
+            // Try URL-encoded text parsing as fallback
+            try {
+                const text = await request.clone().text();
+                const params = new URLSearchParams(text);
+                // Type assertion: URLSearchParams.entries() exists at runtime
+                return parseFormFields(params.entries());
+            }
+            catch (urlEncodedError) {
+                // Both failed, fall through to JSON parsing
+                console.warn("[ConsentService] URL-encoded parsing also failed:", urlEncodedError);
+            }
+        }
+        // Parse multipart FormData (multipart/form-data or when FormData object is passed with other Content-Type)
+        // Include text/plain here to handle cases where FormData is passed with mismatched Content-Type
+        if (contentType.includes("multipart/form-data") ||
+            contentType.includes("form") ||
+            contentType === "" ||
+            contentType.includes("text/plain") ||
+            contentType.includes("text")) {
+            // Check if multipart/form-data Content-Type is missing boundary
+            // If so, try to parse as text first (FormData might have been serialized incorrectly)
+            if (contentType.includes("multipart/form-data") &&
+                !contentType.includes("boundary=")) {
+                try {
+                    const textRequest = request.clone();
+                    const text = await textRequest.text();
+                    if (text && text.length > 0) {
+                        // Try to manually parse multipart format from text
+                        const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                        const body = {};
+                        let match;
+                        let hasValidFields = false;
+                        while ((match = fieldRegex.exec(text)) !== null) {
+                            const fieldName = match[1];
+                            const fieldValue = match[2].trim();
+                            if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                try {
+                                    body["scopes"] = JSON.parse(fieldValue);
+                                }
+                                catch {
+                                    body["scopes"] = fieldValue.includes(",")
+                                        ? fieldValue.split(",")
+                                        : [fieldValue];
+                                }
+                            }
+                            else if (fieldName === "oauth_identity" ||
+                                fieldName === "oauth_identity_json") {
+                                try {
+                                    body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                }
+                                catch {
+                                    body["oauth_identity"] = null;
+                                }
+                            }
+                            else if (fieldName === "termsAccepted") {
+                                body[fieldName] =
+                                    fieldValue === "on" ||
+                                        fieldValue === "true" ||
+                                        fieldValue === "1" ||
+                                        fieldValue === "yes";
+                            }
+                            else if (fieldName === "customFields") {
+                                try {
+                                    body[fieldName] = JSON.parse(fieldValue);
+                                }
+                                catch {
+                                    // Skip
+                                }
+                            }
+                            else {
+                                body[fieldName] = fieldValue;
+                            }
+                            hasValidFields = true;
+                        }
+                        if (hasValidFields && Object.keys(body).length > 0) {
+                            if (!("termsAccepted" in body)) {
+                                body.termsAccepted = true;
+                            }
+                            // Default scopes to empty array if not provided
+                            if (!("scopes" in body)) {
+                                body.scopes = [];
+                            }
+                            return body;
+                        }
+                    }
+                }
+                catch {
+                    // If text parsing fails, fall through to FormData parsing
+                }
+            }
+            try {
+                const clonedRequest = request.clone();
+                let formData;
+                try {
+                    formData = await clonedRequest.formData();
+                }
+                catch (formDataError) {
+                    // Handle FormData parsing errors (missing boundary, wrong Content-Type, etc.)
+                    const errorMessage = formDataError instanceof Error
+                        ? formDataError.message
+                        : String(formDataError);
+                    const errorCause = formDataError instanceof Error && "cause" in formDataError
+                        ? formDataError.cause instanceof Error
+                            ? formDataError.cause.message
+                            : String(formDataError.cause)
+                        : "";
+                    if (errorMessage.includes("missing boundary") ||
+                        errorMessage.includes("boundary") ||
+                        errorMessage.includes("Content-Type was not one of") ||
+                        errorCause.includes("missing boundary") ||
+                        errorCause.includes("boundary")) {
+                        // When boundary is missing, try to parse as URL-encoded form data instead
+                        // This handles the case where FormData was passed but Content-Type doesn't include boundary
+                        try {
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            // If text parsing succeeds, try URL-encoded parsing
+                            if (text && text.length > 0) {
+                                try {
+                                    const params = new URLSearchParams(text);
+                                    return parseFormFields(params.entries());
+                                }
+                                catch {
+                                    // If URL-encoded parsing fails, the text might be multipart format
+                                    // Try to manually parse multipart format from text
+                                    const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                    const body = {};
+                                    let match;
+                                    let hasValidFields = false;
+                                    while ((match = fieldRegex.exec(text)) !== null) {
+                                        const fieldName = match[1];
+                                        const fieldValue = match[2].trim();
+                                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                            try {
+                                                body["scopes"] = JSON.parse(fieldValue);
+                                            }
+                                            catch {
+                                                body["scopes"] = fieldValue.includes(",")
+                                                    ? fieldValue.split(",")
+                                                    : [fieldValue];
+                                            }
+                                        }
+                                        else if (fieldName === "oauth_identity" ||
+                                            fieldName === "oauth_identity_json") {
+                                            try {
+                                                body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                            }
+                                            catch {
+                                                body["oauth_identity"] = null;
+                                            }
+                                        }
+                                        else if (fieldName === "termsAccepted") {
+                                            body[fieldName] =
+                                                fieldValue === "on" ||
+                                                    fieldValue === "true" ||
+                                                    fieldValue === "1" ||
+                                                    fieldValue === "yes";
+                                        }
+                                        else if (fieldName === "customFields") {
+                                            try {
+                                                body[fieldName] = JSON.parse(fieldValue);
+                                            }
+                                            catch {
+                                                // Skip
+                                            }
+                                        }
+                                        else {
+                                            body[fieldName] = fieldValue;
+                                        }
+                                        hasValidFields = true;
+                                    }
+                                    if (hasValidFields && Object.keys(body).length > 0) {
+                                        if (!("termsAccepted" in body)) {
+                                            body.termsAccepted = true;
+                                        }
+                                        // Default scopes to empty array if not provided
+                                        if (!("scopes" in body)) {
+                                            body.scopes = [];
+                                        }
+                                        return body;
+                                    }
+                                }
+                            }
+                        }
+                        catch {
+                            // If all parsing attempts fail, rethrow the original error
+                        }
+                    }
+                    throw formDataError;
+                }
+                const body = {};
+                let hasValidFields = false;
+                // Check if FormData parsing returned malformed data (entire multipart body as single entry)
+                // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                const entriesArray = Array.from(formData.entries());
+                if (entriesArray.length === 1 &&
+                    typeof entriesArray[0][0] === "string" &&
+                    entriesArray[0][0].includes("Content-Disposition") &&
+                    typeof entriesArray[0][1] === "string" &&
+                    entriesArray[0][1].toString().includes("Content-Disposition")) {
+                    // Manually parse multipart format from the value string
+                    const keyPart = entriesArray[0][0];
+                    const valuePart = entriesArray[0][1];
+                    // Fix: If key ends with "name" and value starts with '"fieldname"', combine them
+                    let multipartBody;
+                    if (keyPart.trim().endsWith("name") &&
+                        valuePart.trim().startsWith('"')) {
+                        multipartBody = keyPart + "=" + valuePart;
+                    }
+                    else {
+                        multipartBody = keyPart + valuePart;
+                    }
+                    // Match: Content-Disposition header with field name, then capture value until next boundary or end
+                    const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                    let match;
+                    while ((match = fieldRegex.exec(multipartBody)) !== null) {
+                        const fieldName = match[1];
+                        const fieldValue = match[2].trim();
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(fieldValue);
+                            }
+                            catch {
+                                body["scopes"] = fieldValue.includes(",")
+                                    ? fieldValue.split(",")
+                                    : [fieldValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                fieldValue === "on" ||
+                                    fieldValue === "true" ||
+                                    fieldValue === "1" ||
+                                    fieldValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(fieldValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = fieldValue;
+                        }
+                        hasValidFields = true;
+                    }
+                }
+                else {
+                    // Normal FormData parsing
+                    // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                    for (const [key, value] of formData.entries()) {
+                        if (value instanceof File) {
+                            continue;
+                        }
+                        // Extract field name from malformed keys (when FormData is passed with wrong Content-Type)
+                        let fieldName = key;
+                        if (key.includes("Content-Disposition") && key.includes('name="')) {
+                            // Extract field name from Content-Disposition header
+                            const nameMatch = key.match(/name="([^"]+)"/);
+                            if (nameMatch && nameMatch[1]) {
+                                fieldName = nameMatch[1];
+                            }
+                            else {
+                                // Skip if we can't extract a valid field name
+                                continue;
+                            }
+                        }
+                        else if (key.includes("------") ||
+                            key.includes("\r\n") ||
+                            key.trim() === "") {
+                            // Skip boundary strings and invalid keys
+                            continue;
+                        }
+                        hasValidFields = true;
+                        const stringValue = value.toString();
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                body["scopes"] = stringValue.includes(",")
+                                    ? stringValue.split(",")
+                                    : [stringValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(stringValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                stringValue === "on" ||
+                                    stringValue === "true" ||
+                                    stringValue === "1" ||
+                                    stringValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = stringValue;
+                        }
+                    }
+                }
+                if (hasValidFields && Object.keys(body).length > 0) {
+                    if (!("termsAccepted" in body)) {
+                        body.termsAccepted = true;
+                    }
+                    // Default scopes to empty array if not provided
+                    if (!("scopes" in body)) {
+                        body.scopes = [];
+                    }
+                    return body;
+                }
+            }
+            catch (formDataError) {
+                console.warn("[ConsentService] FormData parsing failed:", formDataError);
+                // Fall through to JSON parsing
+            }
+        }
+        // Default to JSON parsing
+        try {
+            return await request.json();
+        }
+        catch (error) {
+            // If JSON parsing fails and content-type suggests form data, try FormData parsing as fallback
+            // Special handling for text/plain with FormData body - try text parsing first
+            if (contentType === "text/plain") {
+                try {
+                    const textRequest = request.clone();
+                    const text = await textRequest.text();
+                    if (text && text.length > 0) {
+                        // Try URL-encoded parsing first
+                        try {
+                            const params = new URLSearchParams(text);
+                            const body = parseFormFields(params.entries());
+                            if (Object.keys(body).length > 0) {
+                                return body;
+                            }
+                        }
+                        catch {
+                            // URL-encoded parsing failed, try multipart format
+                        }
+                        // Try multipart format parsing (FormData serializes to multipart)
+                        const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                        const body = {};
+                        let match;
+                        let hasValidFields = false;
+                        while ((match = fieldRegex.exec(text)) !== null) {
+                            const fieldName = match[1];
+                            const fieldValue = match[2].trim();
+                            if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                try {
+                                    body["scopes"] = JSON.parse(fieldValue);
+                                }
+                                catch {
+                                    body["scopes"] = fieldValue.includes(",")
+                                        ? fieldValue.split(",")
+                                        : [fieldValue];
+                                }
+                            }
+                            else if (fieldName === "oauth_identity" ||
+                                fieldName === "oauth_identity_json") {
+                                try {
+                                    body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                }
+                                catch {
+                                    body["oauth_identity"] = null;
+                                }
+                            }
+                            else if (fieldName === "termsAccepted") {
+                                body[fieldName] =
+                                    fieldValue === "on" ||
+                                        fieldValue === "true" ||
+                                        fieldValue === "1" ||
+                                        fieldValue === "yes";
+                            }
+                            else if (fieldName === "customFields") {
+                                try {
+                                    body[fieldName] = JSON.parse(fieldValue);
+                                }
+                                catch {
+                                    // Skip
+                                }
+                            }
+                            else {
+                                body[fieldName] = fieldValue;
+                            }
+                            hasValidFields = true;
+                        }
+                        if (hasValidFields && Object.keys(body).length > 0) {
+                            if (!("termsAccepted" in body)) {
+                                body.termsAccepted = true;
+                            }
+                            // Default scopes to empty array if not provided
+                            if (!("scopes" in body)) {
+                                body.scopes = [];
+                            }
+                            return body;
                         }
                     }
                 }
+                catch {
+                    // Text parsing failed, fall through to FormData parsing
+                }
             }
-            catch (error) {
-                console.warn("[ConsentService] Failed to extract OAuth cookie:", error);
-                // Non-fatal - continue without OAuth identity
-            }
-            // At this point, all required parameters are validated and non-null
-            // TypeScript doesn't know this, so we assert non-null
-            const validatedProjectId = projectId;
-            const validatedAgentDid = agentDid;
-            const validatedSessionId = sessionId;
-            // Check if OAuth is required (after extracting OAuth identity)
-            const oauthRequired = await this.isOAuthRequired(validatedProjectId, oauthIdentity);
-            if (oauthRequired) {
-                // OAuth is required - redirect to OAuth provider instead of showing consent page
-                const oauthUrl = this.buildOAuthUrl(validatedProjectId, validatedAgentDid, validatedSessionId, scopes, serverUrl);
-                console.log("[ConsentService] OAuth required, redirecting to OAuth provider:", {
-                    projectId: validatedProjectId,
-                    agentDid: validatedAgentDid.substring(0, 20) + "...",
-                    oauthUrl: oauthUrl.substring(0, 100) + "...",
-                });
-                return Response.redirect(oauthUrl, 302);
-            }
-            // Build consent page config
-            const pageConfig = {
-                tool: tool,
-                toolDescription,
-                scopes,
-                agentDid: validatedAgentDid,
-                sessionId: validatedSessionId,
-                projectId: validatedProjectId,
-                serverUrl,
-                branding: consentConfig.branding,
-                terms: consentConfig.terms,
-                customFields: consentConfig.customFields,
-                autoClose: consentConfig.ui?.autoClose,
-            };
-            // Render page with OAuth identity (if available)
-            const html = this.renderer.render(pageConfig, oauthIdentity);
-            return new Response(html, {
-                status: 200,
-                headers: {
-                    "Content-Type": "text/html; charset=utf-8",
-                    "Cache-Control": "no-cache, no-store, must-revalidate",
-                },
-            });
-        }
-        catch (error) {
-            console.error("[ConsentService] Error rendering consent page:", error);
-            return new Response(JSON.stringify({
-                success: false,
-                error: "Failed to render consent page",
-                error_code: "render_error",
-            }), {
-                status: 500,
-                headers: { "Content-Type": "application/json" },
-            });
-        }
-    }
-    /**
-     * Handle consent approval
-     *
-     * Validates request, creates delegation via AgentShield API,
-     * stores token in KV, and returns success response.
-     *
-     * @param request - Approval request
-     * @returns JSON response
-     */
-    async handleApproval(request) {
-        try {
-            // Parse request body - handle both JSON and FormData
-            const contentType = request.headers.get("content-type") || "";
-            let body;
-            if (contentType.includes("application/json")) {
-                // JSON request (from JavaScript fetch)
-                body = await request.json();
-            }
-            else if (contentType.includes("application/x-www-form-urlencoded") ||
-                contentType.includes("multipart/form-data")) {
-                // Try FormData first (works for both multipart and url-encoded when FormData object is used)
+            if (!contentType.includes("application/json") &&
+                (contentType.includes("form") ||
+                    contentType === "" ||
+                    contentType.includes("text"))) {
                 try {
-                    // Don't clone - read FormData directly (cloning might consume the body)
-                    const formData = await request.formData();
-                    // Check if FormData actually has values (if Content-Type mismatch, formData might be empty or malformed)
-                    // Try to get a value and also check entries iterator
-                    const toolValue = formData.get("tool");
-                    // FormData.entries() exists but TypeScript may not recognize it - use type assertion
-                    const formDataEntries = formData.entries ? Array.from(formData.entries()) : [];
-                    // Check if FormData is properly parsed (not malformed)
-                    // Malformed FormData happens when Content-Type says url-encoded but body is multipart
-                    // In that case, entries might exist but contain raw multipart data instead of key-value pairs
-                    const isMalformed = formDataEntries.length > 0 && formDataEntries.some(([key]) => key.includes("Content-Disposition") || key.includes("formdata-"));
-                    const hasFormDataValues = toolValue !== null && !isMalformed;
-                    if (hasFormDataValues) {
-                        // Parse scopes safely
-                        let scopes = [];
-                        const scopesValue = formData.get("scopes");
-                        if (scopesValue) {
-                            try {
-                                if (typeof scopesValue === "string") {
-                                    scopes = JSON.parse(scopesValue);
+                    // Clone request ONCE before trying any parsing, so we can reuse it if FormData parsing fails
+                    const fallbackRequest = request.clone();
+                    // Try FormData parsing as fallback (even if Content-Type doesn't match)
+                    let formData;
+                    try {
+                        formData = await fallbackRequest.formData();
+                    }
+                    catch (formDataParseError) {
+                        // If FormData parsing fails, try reading as text and parsing manually
+                        // This handles cases where Content-Type doesn't match (e.g., text/plain with FormData body)
+                        try {
+                            // Use a fresh clone for text parsing (body might be consumed by failed FormData attempt)
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            if (text && text.length > 0) {
+                                // First try URL-encoded parsing (simpler format)
+                                try {
+                                    const params = new URLSearchParams(text);
+                                    const body = parseFormFields(params.entries());
+                                    if (Object.keys(body).length > 0) {
+                                        return body;
+                                    }
+                                }
+                                catch {
+                                    // URL-encoded parsing failed, try multipart format
+                                }
+                                // Try to manually parse multipart format from text
+                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                const body = {};
+                                let match;
+                                let hasValidFields = false;
+                                while ((match = fieldRegex.exec(text)) !== null) {
+                                    const fieldName = match[1];
+                                    const fieldValue = match[2].trim();
+                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                        try {
+                                            body["scopes"] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            body["scopes"] = fieldValue.includes(",")
+                                                ? fieldValue.split(",")
+                                                : [fieldValue];
+                                        }
+                                    }
+                                    else if (fieldName === "oauth_identity" ||
+                                        fieldName === "oauth_identity_json") {
+                                        try {
+                                            body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                        }
+                                        catch {
+                                            body["oauth_identity"] = null;
+                                        }
+                                    }
+                                    else if (fieldName === "termsAccepted") {
+                                        body[fieldName] =
+                                            fieldValue === "on" ||
+                                                fieldValue === "true" ||
+                                                fieldValue === "1" ||
+                                                fieldValue === "yes";
+                                    }
+                                    else if (fieldName === "customFields") {
+                                        try {
+                                            body[fieldName] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            // Skip
+                                        }
+                                    }
+                                    else {
+                                        body[fieldName] = fieldValue;
+                                    }
+                                    hasValidFields = true;
                                 }
-                                else {
-                                    scopes = Array.isArray(scopesValue) ? scopesValue : [];
+                                if (hasValidFields && Object.keys(body).length > 0) {
+                                    if (!("termsAccepted" in body)) {
+                                        body.termsAccepted = true;
+                                    }
+                                    // Default scopes to empty array if not provided
+                                    if (!("scopes" in body)) {
+                                        body.scopes = [];
+                                    }
+                                    return body;
                                 }
                             }
-                            catch {
-                                if (typeof scopesValue === "string") {
-                                    scopes = scopesValue
-                                        .split(",")
-                                        .map((s) => s.trim())
-                                        .filter((s) => s.length > 0);
+                        }
+                        catch {
+                            // If text parsing also fails, rethrow original FormData error
+                        }
+                        throw formDataParseError;
+                    }
+                    // Check if FormData has valid entries (might be empty if Content-Type mismatch)
+                    const entriesArray = Array.from(formData.entries());
+                    if (entriesArray.length === 0) {
+                        // FormData parsing succeeded but returned no entries - try text parsing
+                        // This handles cases where Content-Type doesn't match (e.g., text/plain with FormData body)
+                        try {
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            if (text && text.length > 0) {
+                                // Try URL-encoded parsing first
+                                try {
+                                    const params = new URLSearchParams(text);
+                                    const body = parseFormFields(params.entries());
+                                    if (Object.keys(body).length > 0) {
+                                        return body;
+                                    }
+                                }
+                                catch {
+                                    // URL-encoded parsing failed, try multipart format
+                                }
+                                // Try multipart format parsing
+                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                const body = {};
+                                let match;
+                                let hasValidFields = false;
+                                while ((match = fieldRegex.exec(text)) !== null) {
+                                    const fieldName = match[1];
+                                    const fieldValue = match[2].trim();
+                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                        try {
+                                            body["scopes"] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            body["scopes"] = fieldValue.includes(",")
+                                                ? fieldValue.split(",")
+                                                : [fieldValue];
+                                        }
+                                    }
+                                    else if (fieldName === "oauth_identity" ||
+                                        fieldName === "oauth_identity_json") {
+                                        try {
+                                            body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                        }
+                                        catch {
+                                            body["oauth_identity"] = null;
+                                        }
+                                    }
+                                    else if (fieldName === "termsAccepted") {
+                                        body[fieldName] =
+                                            fieldValue === "on" ||
+                                                fieldValue === "true" ||
+                                                fieldValue === "1" ||
+                                                fieldValue === "yes";
+                                    }
+                                    else if (fieldName === "customFields") {
+                                        try {
+                                            body[fieldName] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            // Skip
+                                        }
+                                    }
+                                    else {
+                                        body[fieldName] = fieldValue;
+                                    }
+                                    hasValidFields = true;
+                                }
+                                if (hasValidFields && Object.keys(body).length > 0) {
+                                    if (!("termsAccepted" in body)) {
+                                        body.termsAccepted = true;
+                                    }
+                                    // Default scopes to empty array if not provided
+                                    if (!("scopes" in body)) {
+                                        body.scopes = [];
+                                    }
+                                    return body;
                                 }
                             }
+                            // If text parsing failed or found no valid fields, throw error to trigger fallback
+                            throw new Error("FormData parsing returned empty entries and text parsing found no valid fields");
+                        }
+                        catch (textParseError) {
+                            // Text parsing failed or found no valid fields - throw error to trigger JSON fallback
+                            // This ensures we don't continue with empty FormData entries
+                            throw new Error(`Failed to parse FormData: ${textParseError instanceof Error ? textParseError.message : "Unknown error"}`);
+                        }
+                    }
+                    const body = {};
+                    // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                    let hasValidEntries = false;
+                    for (const [key, value] of formData.entries()) {
+                        if (value instanceof File)
+                            continue;
+                        // Extract field name from malformed keys
+                        let fieldName = key;
+                        if (key.includes("Content-Disposition") && key.includes('name="')) {
+                            const nameMatch = key.match(/name="([^"]+)"/);
+                            if (nameMatch && nameMatch[1]) {
+                                fieldName = nameMatch[1];
+                            }
+                            else {
+                                continue;
+                            }
+                        }
+                        else if (key.includes("------") ||
+                            key.includes("\r\n") ||
+                            key.trim() === "" ||
+                            key.includes("formdata-undici")) {
+                            // Malformed key - likely from text/plain Content-Type mismatch
+                            // Skip this entry and fall back to text parsing
+                            continue;
                         }
-                        // Extract FormData values
-                        const agentDidValue = formData.get("agent_did");
-                        const sessionIdValue = formData.get("session_id");
-                        const projectIdValue = formData.get("project_id");
-                        const tool = toolValue && typeof toolValue === "string"
-                            ? toolValue
-                            : toolValue
-                                ? String(toolValue)
-                                : "";
-                        const agentDid = agentDidValue && typeof agentDidValue === "string"
-                            ? agentDidValue
-                            : agentDidValue
-                                ? String(agentDidValue)
-                                : "";
-                        const sessionId = sessionIdValue && typeof sessionIdValue === "string"
-                            ? sessionIdValue
-                            : sessionIdValue
-                                ? String(sessionIdValue)
-                                : "";
-                        const projectId = projectIdValue && typeof projectIdValue === "string"
-                            ? projectIdValue
-                            : projectIdValue
-                                ? String(projectIdValue)
-                                : "";
-                        const termsAcceptedValue = formData.get("termsAccepted");
-                        const termsAccepted = formData.has("termsAccepted")
-                            ? termsAcceptedValue === "on" || termsAcceptedValue === "true"
-                            : true;
-                        body = {
-                            tool,
-                            scopes,
-                            agent_did: agentDid,
-                            session_id: sessionId,
-                            project_id: projectId,
-                            termsAccepted,
-                            customFields: {},
-                        };
-                        // Extract OAuth identity if present
-                        const oauthIdentityJson = formData.get("oauth_identity_json");
-                        if (oauthIdentityJson && typeof oauthIdentityJson === "string") {
+                        // If we have a valid field name, mark as having valid entries
+                        if (fieldName && fieldName !== key) {
+                            hasValidEntries = true;
+                        }
+                        else if (fieldName &&
+                            !key.includes("Content-Disposition") &&
+                            !key.includes("------") &&
+                            !key.includes("\r\n")) {
+                            hasValidEntries = true;
+                        }
+                        // Process the field value
+                        const stringValue = value.toString();
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
                             try {
-                                const parsed = JSON.parse(oauthIdentityJson);
-                                if (parsed && parsed.provider && parsed.subject) {
-                                    body.oauth_identity = parsed;
-                                }
+                                body["scopes"] = JSON.parse(stringValue);
                             }
                             catch {
-                                // Ignore invalid OAuth identity
+                                body["scopes"] = stringValue.includes(",")
+                                    ? stringValue.split(",")
+                                    : [stringValue];
                             }
                         }
-                    }
-                    else {
-                        // FormData is empty or malformed - this happens when Content-Type says url-encoded but body is FormData
-                        // Try to parse the raw body text as multipart form data manually
-                        if (contentType.includes("application/x-www-form-urlencoded")) {
-                            // FormData with wrong content-type - parse raw body
-                            throw new Error("FormData malformed, parse raw body");
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(stringValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                stringValue === "on" ||
+                                    stringValue === "true" ||
+                                    stringValue === "1" ||
+                                    stringValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                // Skip
+                            }
                         }
                         else {
-                            // For multipart/form-data, FormData should work - if it's empty, that's an error
-                            throw new Error("FormData empty for multipart/form-data");
+                            body[fieldName] = stringValue;
                         }
                     }
-                }
-                catch (formDataError) {
-                    // Fallback: Try to parse raw body text
-                    // This handles cases where FormData is malformed due to Content-Type mismatch
-                    if (contentType.includes("application/x-www-form-urlencoded")) {
+                    // If we didn't get any valid entries (all keys were malformed), try text parsing
+                    if (!hasValidEntries || Object.keys(body).length === 0) {
+                        // Try text parsing as fallback when FormData parsing returns no valid entries
                         try {
-                            // Try URLSearchParams first (for true url-encoded data)
-                            const formText = await request.clone().text();
-                            // Check if it's actually multipart data (FormData with wrong content-type)
-                            const isMultipart = formText.includes("Content-Disposition: form-data");
-                            if (isMultipart) {
-                                // Parse multipart form data manually using regex
-                                // Match pattern: Content-Disposition: form-data; name="fieldname"\r\n\r\nvalue
-                                const data = {};
-                                const fieldPattern = /Content-Disposition:\s*form-data;\s*name="([^"]+)"[\r\n]+(?:Content-Type:[^\r\n]+[\r\n]+)?[\r\n]+([^\r\n]+(?:[\r\n]+(?!Content-Disposition|--)[^\r\n]+)*)/gi;
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            if (text && text.length > 0) {
+                                // Try multipart format parsing from text
+                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                const textBody = {};
                                 let match;
-                                while ((match = fieldPattern.exec(formText)) !== null) {
+                                let hasValidFields = false;
+                                while ((match = fieldRegex.exec(text)) !== null) {
                                     const fieldName = match[1];
-                                    let value = match[2];
-                                    // Clean up value - remove trailing boundary markers and extra whitespace
-                                    value = value.replace(/\r?\n--[-]+.*$/g, "").trim();
-                                    if (value) {
-                                        data[fieldName] = value;
+                                    const fieldValue = match[2].trim();
+                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                        try {
+                                            textBody["scopes"] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            textBody["scopes"] = fieldValue.includes(",")
+                                                ? fieldValue.split(",")
+                                                : [fieldValue];
+                                        }
                                     }
-                                }
-                                // Fallback: if regex didn't work, try simpler pattern
-                                if (Object.keys(data).length === 0) {
-                                    // Try simpler pattern: name="field" followed by value on next line
-                                    const simplePattern = /name="([^"]+)"[\r\n]+[\r\n]+([^\r\n]+)/g;
-                                    let simpleMatch;
-                                    while ((simpleMatch = simplePattern.exec(formText)) !== null) {
-                                        const fieldName = simpleMatch[1];
-                                        let value = simpleMatch[2].trim();
-                                        // Skip if it looks like a boundary
-                                        if (!value.startsWith("--")) {
-                                            data[fieldName] = value;
+                                    else if (fieldName === "oauth_identity" ||
+                                        fieldName === "oauth_identity_json") {
+                                        try {
+                                            textBody["oauth_identity"] =
+                                                JSON.parse(fieldValue) || null;
+                                        }
+                                        catch {
+                                            textBody["oauth_identity"] = null;
                                         }
                                     }
-                                }
-                                let scopes = [];
-                                if (data.scopes) {
-                                    try {
-                                        scopes = JSON.parse(data.scopes);
+                                    else if (fieldName === "termsAccepted") {
+                                        textBody[fieldName] =
+                                            fieldValue === "on" ||
+                                                fieldValue === "true" ||
+                                                fieldValue === "1" ||
+                                                fieldValue === "yes";
+                                    }
+                                    else if (fieldName === "customFields") {
+                                        try {
+                                            textBody[fieldName] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            // Skip
+                                        }
                                     }
-                                    catch {
-                                        scopes = data.scopes.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+                                    else {
+                                        textBody[fieldName] = fieldValue;
                                     }
+                                    hasValidFields = true;
                                 }
-                                body = {
-                                    tool: data.tool || "",
-                                    scopes,
-                                    agent_did: data.agent_did || "",
-                                    session_id: data.session_id || "",
-                                    project_id: data.project_id || "",
-                                    termsAccepted: data.termsAccepted === "on" || data.termsAccepted === "true" || !("termsAccepted" in data),
-                                    customFields: {},
-                                };
-                            }
-                            else {
-                                // True URL-encoded data
-                                const params = new URLSearchParams(formText);
-                                let scopes = [];
-                                const scopesValue = params.get("scopes");
-                                if (scopesValue) {
-                                    try {
-                                        scopes = JSON.parse(scopesValue);
+                                if (hasValidFields && Object.keys(textBody).length > 0) {
+                                    if (!("termsAccepted" in textBody)) {
+                                        textBody.termsAccepted = true;
                                     }
-                                    catch {
-                                        scopes = scopesValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+                                    if (!("scopes" in textBody)) {
+                                        textBody.scopes = [];
                                     }
+                                    return textBody;
                                 }
-                                body = {
-                                    tool: params.get("tool") || "",
-                                    scopes,
-                                    agent_did: params.get("agent_did") || "",
-                                    session_id: params.get("session_id") || "",
-                                    project_id: params.get("project_id") || "",
-                                    termsAccepted: params.get("termsAccepted") === "on" ||
-                                        params.get("termsAccepted") === "true" ||
-                                        !params.has("termsAccepted"),
-                                    customFields: {},
-                                };
                             }
                         }
-                        catch (textError) {
-                            // If text parsing also fails, throw validation error
-                            throw new Error("Failed to parse form data");
+                        catch {
+                            // Text parsing also failed, fall through to throw error
                         }
+                        throw new Error("FormData parsing returned only malformed entries - falling back to text parsing");
                     }
-                    else {
-                        // For multipart/form-data, if FormData failed completely, we can't parse it
-                        throw new Error("Failed to parse FormData");
+                    if (!("termsAccepted" in body)) {
+                        body.termsAccepted = true;
                     }
+                    // Default scopes to empty array if not provided
+                    if (!("scopes" in body)) {
+                        body.scopes = [];
+                    }
+                    return body;
                 }
-            }
-            else {
-                // Try JSON first, fallback to form data
-                try {
-                    body = await request.json();
-                }
-                catch {
-                    const formData = await request.formData();
-                    // Parse scopes safely - handle JSON parse errors
-                    let scopes = [];
-                    const scopesValue = formData.get("scopes");
-                    if (scopesValue) {
+                catch (formError) {
+                    // FormData parsing failed - if it was due to malformed entries, try text parsing
+                    const errorMessage = formError instanceof Error ? formError.message : String(formError);
+                    if (errorMessage.includes("malformed entries") ||
+                        errorMessage.includes("empty entries") ||
+                        errorMessage.includes("falling back to text parsing")) {
+                        // Try text parsing as last resort
                         try {
-                            if (typeof scopesValue === "string") {
-                                scopes = JSON.parse(scopesValue);
-                            }
-                            else {
-                                scopes = Array.isArray(scopesValue) ? scopesValue : [];
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            if (text && text.length > 0) {
+                                // Try multipart format parsing
+                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                const body = {};
+                                let match;
+                                let hasValidFields = false;
+                                while ((match = fieldRegex.exec(text)) !== null) {
+                                    const fieldName = match[1];
+                                    const fieldValue = match[2].trim();
+                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                        try {
+                                            body["scopes"] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            body["scopes"] = fieldValue.includes(",")
+                                                ? fieldValue.split(",")
+                                                : [fieldValue];
+                                        }
+                                    }
+                                    else if (fieldName === "oauth_identity" ||
+                                        fieldName === "oauth_identity_json") {
+                                        try {
+                                            body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                        }
+                                        catch {
+                                            body["oauth_identity"] = null;
+                                        }
+                                    }
+                                    else if (fieldName === "termsAccepted") {
+                                        body[fieldName] =
+                                            fieldValue === "on" ||
+                                                fieldValue === "true" ||
+                                                fieldValue === "1" ||
+                                                fieldValue === "yes";
+                                    }
+                                    else if (fieldName === "customFields") {
+                                        try {
+                                            body[fieldName] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            // Skip
+                                        }
+                                    }
+                                    else {
+                                        body[fieldName] = fieldValue;
+                                    }
+                                    hasValidFields = true;
+                                }
+                                if (hasValidFields && Object.keys(body).length > 0) {
+                                    if (!("termsAccepted" in body)) {
+                                        body.termsAccepted = true;
+                                    }
+                                    // Default scopes to empty array if not provided
+                                    if (!("scopes" in body)) {
+                                        body.scopes = [];
+                                    }
+                                    return body;
+                                }
                             }
                         }
                         catch {
-                            // If JSON parse fails, try parsing as comma-separated string
-                            if (typeof scopesValue === "string") {
-                                scopes = scopesValue
-                                    .split(",")
-                                    .map((s) => s.trim())
-                                    .filter((s) => s.length > 0);
-                            }
+                            // Text parsing also failed
                         }
                     }
-                    // Extract FormData values and ensure correct types for validation
-                    // FormData.get() returns FormDataEntryValue | null (FormDataEntryValue = string | File)
-                    const toolValue = formData.get("tool");
-                    const agentDidValue = formData.get("agent_did");
-                    const sessionIdValue = formData.get("session_id");
-                    const projectIdValue = formData.get("project_id");
-                    // Convert to strings, handling null and File cases
-                    const tool = toolValue && typeof toolValue === "string"
-                        ? toolValue
-                        : toolValue
-                            ? String(toolValue)
-                            : "";
-                    const agentDid = agentDidValue && typeof agentDidValue === "string"
-                        ? agentDidValue
-                        : agentDidValue
-                            ? String(agentDidValue)
-                            : "";
-                    const sessionId = sessionIdValue && typeof sessionIdValue === "string"
-                        ? sessionIdValue
-                        : sessionIdValue
-                            ? String(sessionIdValue)
-                            : "";
-                    const projectId = projectIdValue && typeof projectIdValue === "string"
-                        ? projectIdValue
-                        : projectIdValue
-                            ? String(projectIdValue)
-                            : "";
-                    body = {
-                        tool,
-                        scopes: Array.isArray(scopes) ? scopes : [],
-                        agent_did: agentDid,
-                        session_id: sessionId,
-                        project_id: projectId,
-                        // termsAccepted: default to true if checkbox not present (no terms configured)
-                        termsAccepted: formData.has("termsAccepted")
-                            ? formData.get("termsAccepted") === "on" ||
-                                formData.get("termsAccepted") === "true"
-                            : true, // Default to true if no checkbox (no terms configured)
-                        customFields: {},
-                    };
+                    // Both failed, throw original error
+                }
+            }
+            throw new Error(`Failed to parse request body: ${error instanceof Error ? error.message : "Unknown error"}`);
+        }
+    }
+    /**
+     * Handle consent approval
+     *
+     * Validates request, creates delegation via AgentShield API,
+     * stores token in KV, and returns success response.
+     *
+     * @param request - Approval request
+     * @returns JSON response
+     */
+    async handleApproval(request) {
+        console.log("[ConsentService] Approval request received");
+        try {
+            // Parse and validate request body (supports both JSON and FormData)
+            const body = await this.parseRequestBody(request);
+            console.log("[ConsentService] Request body parsed:", {
+                hasBody: !!body,
+                bodyKeys: Object.keys(body || {}),
+                hasOAuthIdentity: !!body?.oauth_identity,
+            });
+            // Convert null oauth_identity to undefined for proper schema validation
+            // Zod's .nullish() should handle null, but converting to undefined is more explicit
+            // and avoids potential edge cases with FormData parsing
+            if (body &&
+                typeof body === "object" &&
+                body !== null &&
+                "oauth_identity" in body) {
+                const bodyObj = body;
+                if (bodyObj.oauth_identity === null) {
+                    bodyObj.oauth_identity = undefined;
                 }
             }
             const validation = validateConsentApprovalRequest(body);
             if (!validation.success) {
-                // Always log validation errors for debugging (critical for troubleshooting)
-                const bodyObj = body;
                 console.error("[ConsentService] Approval request validation failed:", {
                     errors: validation.error.errors,
-                    receivedBody: {
-                        tool: typeof bodyObj.tool,
-                        scopes: Array.isArray(bodyObj.scopes)
-                            ? `array[${bodyObj.scopes.length}]`
-                            : typeof bodyObj.scopes,
-                        agent_did: typeof bodyObj.agent_did,
-                        session_id: typeof bodyObj.session_id,
-                        project_id: typeof bodyObj.project_id,
-                        termsAccepted: typeof bodyObj.termsAccepted,
-                        customFields: typeof bodyObj.customFields,
-                        oauth_identity: typeof bodyObj.oauth_identity,
-                    },
-                    rawBody: JSON.stringify(bodyObj).substring(0, 500), // First 500 chars for debugging
+                    receivedBody: body,
                 });
-                // Format validation errors for better readability
-                const formattedErrors = validation.error.errors.map((err) => ({
-                    field: err.path.join("."),
-                    message: err.message,
-                    code: err.code,
-                }));
                 return new Response(JSON.stringify({
                     success: false,
-                    error: "Invalid request format",
+                    error: "Invalid request",
                     error_code: "validation_error",
-                    details: formattedErrors,
-                    received_types: {
-                        tool: typeof bodyObj.tool,
-                        scopes: Array.isArray(bodyObj.scopes)
-                            ? `array[${bodyObj.scopes.length}]`
-                            : typeof bodyObj.scopes,
-                        agent_did: typeof bodyObj.agent_did,
-                        session_id: typeof bodyObj.session_id,
-                        project_id: typeof bodyObj.project_id,
-                        termsAccepted: typeof bodyObj.termsAccepted,
-                    },
+                    details: validation.error.errors,
                 }), {
                     status: 400,
                     headers: { "Content-Type": "application/json" },
                 });
             }
             const approvalRequest = validation.data;
+            console.log("[ConsentService] Approval request validated:", {
+                agentDid: approvalRequest.agent_did?.substring(0, 20) + "...",
+                sessionId: approvalRequest.session_id?.substring(0, 20) + "...",
+                scopes: approvalRequest.scopes,
+                hasOAuthIdentity: !!approvalRequest.oauth_identity,
+                oauthProvider: approvalRequest.oauth_identity?.provider,
+            });
             // Validate terms acceptance if required
             const consentConfig = await this.configService.getConsentConfig(approvalRequest.project_id);
             if (consentConfig.terms?.required && !approvalRequest.termsAccepted) {
@@ -854,27 +2043,103 @@ export class ConsentService {
                     headers: { "Content-Type": "application/json" },
                 });
             }
+            // ✅ Extract projectId from approval request
+            const projectId = approvalRequest.project_id;
+            // ✅ Lazy initialization with projectId
+            const auditService = await this.getAuditService(projectId);
+            // Check if user needs credentials before delegation
+            const needsCredentials = !approvalRequest.user_did && !approvalRequest.oauth_identity;
+            if (needsCredentials && auditService) {
+                await auditService
+                    .logCredentialRequired({
+                    sessionId: approvalRequest.session_id,
+                    agentDid: approvalRequest.agent_did,
+                    targetTools: [approvalRequest.tool], // Array
+                    scopes: approvalRequest.scopes,
+                    projectId,
+                    oauthProvider: approvalRequest.oauth_identity?.provider,
+                })
+                    .catch((err) => {
+                    console.error("[ConsentService] Failed to log credential required", {
+                        eventType: "consent:credential_required",
+                        sessionId: approvalRequest.session_id,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                });
+                // Note: We don't redirect here - the consent flow continues
+                // The credential_required event is just for audit tracking
+            }
             // Create delegation via AgentShield API
+            console.log("[ConsentService] Creating delegation...");
             const delegationResult = await this.createDelegation(approvalRequest);
             if (!delegationResult.success) {
-                // Map API error codes to delegation_creation_failed for consistency
-                // Tests expect delegation_creation_failed when delegation creation fails
-                const errorCode = delegationResult.error_code === "validation_error" ||
-                    delegationResult.error_code === "api_error" ||
-                    delegationResult.error_code === "INTERNAL_SERVER_ERROR"
-                    ? "delegation_creation_failed"
-                    : delegationResult.error_code || "delegation_creation_failed";
+                console.error("[ConsentService] Delegation creation failed:", {
+                    error: delegationResult.error,
+                    error_code: delegationResult.error_code,
+                });
                 return new Response(JSON.stringify({
                     success: false,
                     error: delegationResult.error || "Failed to create delegation",
-                    error_code: errorCode,
+                    error_code: delegationResult.error_code || "delegation_creation_failed",
                 }), {
                     status: 500,
                     headers: { "Content-Type": "application/json" },
                 });
             }
+            console.log("[ConsentService] ✅ Delegation created successfully:", {
+                delegationId: delegationResult.delegation_id?.substring(0, 20) + "...",
+            });
             // Store delegation token in KV
             await this.storeDelegationToken(approvalRequest.session_id, approvalRequest.agent_did, delegationResult.delegation_token, delegationResult.delegation_id);
+            // ✅ After successful delegation creation - log audit events
+            if (auditService && delegationResult.success) {
+                try {
+                    // Get userDid (may have been generated during delegation creation)
+                    // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
+                    let userDid;
+                    if (approvalRequest.session_id) {
+                        try {
+                            userDid = await this.getUserDidForSession(approvalRequest.session_id, approvalRequest.oauth_identity || undefined);
+                        }
+                        catch (error) {
+                            console.warn("[ConsentService] Failed to get userDid for audit logging:", error);
+                            // Continue without userDid - audit events can still be logged
+                        }
+                    }
+                    await auditService.logConsentApproval({
+                        sessionId: approvalRequest.session_id,
+                        userDid,
+                        agentDid: approvalRequest.agent_did,
+                        targetTools: [approvalRequest.tool], // Array
+                        scopes: approvalRequest.scopes,
+                        delegationId: delegationResult.delegation_id,
+                        projectId,
+                        termsAccepted: approvalRequest.termsAccepted || false,
+                        oauthIdentity: approvalRequest.oauth_identity
+                            ? {
+                                provider: approvalRequest.oauth_identity.provider,
+                                identifier: approvalRequest.oauth_identity.subject,
+                            }
+                            : undefined,
+                    });
+                    await auditService.logDelegationCreated({
+                        sessionId: approvalRequest.session_id,
+                        delegationId: delegationResult.delegation_id,
+                        agentDid: approvalRequest.agent_did,
+                        userDid,
+                        targetTools: [approvalRequest.tool], // Array
+                        scopes: approvalRequest.scopes,
+                        projectId,
+                    });
+                }
+                catch (error) {
+                    console.error("[ConsentService] Audit failed but continuing", {
+                        sessionId: approvalRequest.session_id,
+                        error: error instanceof Error ? error.message : String(error),
+                        eventTypes: ["consent:approved", "consent:delegation_created"],
+                    });
+                }
+            }
             // Return success response
             const response = {
                 success: true,
@@ -887,26 +2152,11 @@ export class ConsentService {
             });
         }
         catch (error) {
-            // Enhanced error logging for debugging
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            const errorStack = error instanceof Error ? error.stack : undefined;
-            const errorName = error instanceof Error ? error.name : typeof error;
-            console.error("[ConsentService] Error handling approval:", {
-                name: errorName,
-                message: errorMessage,
-                stack: errorStack,
-                error: error instanceof Error
-                    ? {
-                        name: error.name,
-                        message: error.message,
-                        stack: error.stack,
-                    }
-                    : error,
-            });
+            console.error("[ConsentService] Error handling approval:", error);
             return new Response(JSON.stringify({
                 success: false,
-                error: errorMessage || "An internal error occurred",
-                error_code: "INTERNAL_SERVER_ERROR",
+                error: "Internal server error",
+                error_code: "internal_error",
             }), {
                 status: 500,
                 headers: { "Content-Type": "application/json" },
@@ -933,23 +2183,39 @@ export class ConsentService {
         try {
             // Load Day0 configuration to determine field name and API capabilities
             await loadDay0Config(this.env.DELEGATION_STORAGE);
-            // AgentShield API only accepts "custom_fields", not "metadata"
-            // See: packages/contracts/src/agentshield-api/schemas.ts - createDelegationRequestSchema
-            // Day0 config might return "metadata" for backward compatibility, but we must use "custom_fields" for AgentShield
-            const fieldName = "custom_fields";
+            const fieldName = await getDelegationFieldName(this.env.DELEGATION_STORAGE);
             // Get userDID from session or generate new ephemeral DID
             // Phase 4 PR #3: Use OAuth identity if provided in approval request
+            // CRITICAL: Must work with or without OAuth identity
+            // CRITICAL: Always generate ephemeral DID if session_id is available, even without DELEGATION_STORAGE
             let userDid;
-            if (this.env.DELEGATION_STORAGE && request.session_id) {
+            if (request.session_id) {
                 try {
-                    // Pass OAuth identity if available in approval request (convert null to undefined)
-                    userDid = await this.getUserDidForSession(request.session_id, request.oauth_identity ?? undefined);
+                    console.log("[ConsentService] Getting User DID for session:", {
+                        sessionId: request.session_id.substring(0, 20) + "...",
+                        hasOAuthIdentity: !!request.oauth_identity,
+                        oauthProvider: request.oauth_identity?.provider,
+                        hasStorage: !!this.env.DELEGATION_STORAGE,
+                    });
+                    // Pass OAuth identity if available in approval request (can be null/undefined)
+                    // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
+                    userDid = await this.getUserDidForSession(request.session_id, request.oauth_identity || undefined // Explicitly handle null as undefined
+                    );
+                    console.log("[ConsentService] User DID retrieved:", {
+                        userDid: userDid?.substring(0, 20) + "...",
+                        hasUserDid: !!userDid,
+                    });
                 }
                 catch (error) {
-                    console.warn("[ConsentService] Failed to get/generate userDid:", error);
-                    // Continue without userDid - delegation will use ephemeral placeholder
+                    console.error("[ConsentService] Failed to get/generate userDid:", error);
+                    // Continue without userDid - delegation will work without user_identifier
+                    // This is valid for non-OAuth scenarios, but we should log this as a warning
+                    console.warn("[ConsentService] Delegation will be created without user_identifier - this may affect user tracking");
                 }
             }
+            else {
+                console.log("[ConsentService] No session_id provided - skipping User DID generation");
+            }
             const expiresInDays = 7; // Default to 7 days
             // Build delegation request with error-based format detection
             // Try full format first, fallback to simplified format on error
@@ -966,10 +2232,6 @@ export class ConsentService {
             // Error-based format detection: try request format, fallback on error
             const response = await this.tryAPICall(agentShieldUrl, apiKey, delegationRequest);
             if (!response.success) {
-                console.error("[ConsentService] Delegation creation failed:", {
-                    error: response.error,
-                    error_code: response.error_code,
-                });
                 return response;
             }
             const responseData = response.data;
@@ -999,15 +2261,6 @@ export class ConsentService {
                     delegation_token: delegationId, // Use delegation_id as token for direct API calls
                 };
             }
-            // Log validation errors for debugging
-            if (wrappedParse.success === false) {
-                console.warn("[ConsentService] Wrapped format validation failed:", {
-                    errors: wrappedParse.error.errors,
-                    responseData: typeof responseData === "object"
-                        ? JSON.stringify(responseData).substring(0, 500)
-                        : String(responseData).substring(0, 500),
-                });
-            }
             // Try unwrapped format (also valid per contracts)
             const unwrappedParse = createDelegationResponseSchema.safeParse(responseData);
             if (unwrappedParse.success) {
@@ -1024,15 +2277,6 @@ export class ConsentService {
                     delegation_token: delegationId, // Use delegation_id as token for direct API calls
                 };
             }
-            // Log validation errors for debugging
-            if (unwrappedParse.success === false) {
-                console.warn("[ConsentService] Unwrapped format validation failed:", {
-                    errors: unwrappedParse.error.errors,
-                    responseData: typeof responseData === "object"
-                        ? JSON.stringify(responseData).substring(0, 500)
-                        : String(responseData).substring(0, 500),
-                });
-            }
             // Fallback: Try to extract delegation_id from common alternative formats
             // (for backward compatibility during API transitions)
             const data = responseData.data || responseData;
@@ -1042,17 +2286,7 @@ export class ConsentService {
                 data?.id ||
                 delegationObj?.id;
             if (!delegationId) {
-                console.error("[ConsentService] Invalid response format - missing delegation_id:", {
-                    responseData: typeof responseData === "object"
-                        ? JSON.stringify(responseData)
-                        : String(responseData),
-                    wrappedParseErrors: wrappedParse.success === false
-                        ? wrappedParse.error.errors
-                        : undefined,
-                    unwrappedParseErrors: unwrappedParse.success === false
-                        ? unwrappedParse.error.errors
-                        : undefined,
-                });
+                console.error("[ConsentService] Invalid response format - missing delegation_id:", responseData);
                 return {
                     success: false,
                     error: "Invalid API response format - missing delegation_id",
@@ -1190,10 +2424,14 @@ export class ConsentService {
             scopes: request.scopes,
             expires_in_days: expiresInDays,
         };
-        // Note: session_id and project_id are NOT in createDelegationSchema
-        // - project_id is extracted from API key context by AgentShield middleware
-        // - session_id is not needed for delegation creation
-        // These fields are removed to match AgentShield API schema exactly
+        // Include session_id if provided
+        if (request.session_id) {
+            baseRequest.session_id = request.session_id;
+        }
+        // Include project_id if provided
+        if (request.project_id) {
+            baseRequest.project_id = request.project_id;
+        }
         // Check cached format preference
         const cacheKey = STORAGE_KEYS.formatPreference();
         let cachedFormat = null;
@@ -1210,26 +2448,34 @@ export class ConsentService {
                 // Ignore cache errors
             }
         }
-        // AgentShield API only accepts simplified format
-        // The full DelegationRecord format is not supported by the API
-        // See: packages/contracts/src/agentshield-api/schemas.ts - createDelegationRequestSchema
-        // Note: "full" format cache entries are ignored - always use simplified format
-        // Note: fieldName parameter is ignored - always use "custom_fields" for AgentShield API
-        return this.buildSimplifiedFormatRequest(request, userDid, expiresInDays, "custom_fields" // Always use custom_fields for AgentShield API
-        );
+        // If we have a cached preference, use it directly
+        if (cachedFormat === "full") {
+            return this.buildFullFormatRequest(request, userDid, expiresInDays);
+        }
+        else if (cachedFormat === "simplified") {
+            return this.buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName);
+        }
+        // No cache - return request that will be tried with error-based detection
+        return {
+            _tryFormats: true,
+            fullFormat: await this.buildFullFormatRequest(request, userDid, expiresInDays),
+            simplifiedFormat: this.buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName),
+        };
     }
     /**
      * Build full DelegationRecord format request (future format)
      */
     async buildFullFormatRequest(request, userDid, expiresInDays) {
         const notAfter = Date.now() + expiresInDays * 24 * 60 * 60 * 1000;
+        // Defensive check: ensure scopes is always defined (should be guaranteed by validation)
+        const scopes = request.scopes ?? [];
         return {
             delegation: {
                 id: crypto.randomUUID(),
                 issuerDid: userDid || "did:key:z6MkEphemeral", // Use ephemeral if no userDid
                 subjectDid: request.agent_did,
                 constraints: {
-                    scopes: request.scopes,
+                    scopes,
                     notAfter,
                     notBefore: Date.now(),
                 },
@@ -1254,21 +2500,38 @@ export class ConsentService {
     }
     /**
      * Build simplified format request with proper field name
+     *
+     * CRITICAL: This method MUST NOT include session_id or project_id in the request body.
+     * These fields are NOT part of AgentShield's createDelegationSchema:
+     * - project_id is extracted from API key context by AgentShield middleware
+     * - session_id is not needed for delegation creation
+     *
+     * Including these fields will cause validation errors (400 Bad Request).
      */
     buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName) {
+        // Build request with ONLY fields that are in AgentShield's schema
+        // Defensive check: ensure scopes is always defined (should be guaranteed by validation)
+        const scopes = request.scopes ?? [];
         const simplifiedRequest = {
             agent_did: request.agent_did,
-            scopes: request.scopes,
+            scopes,
             expires_in_days: expiresInDays,
         };
         // Include user_identifier if we have userDid (matches AgentShield schema)
-        // Note: session_id and project_id are NOT in createDelegationSchema
-        // - project_id is extracted from API key context by AgentShield
-        // - session_id is not needed for delegation creation
+        // CRITICAL: user_identifier is optional - delegation works without it
         if (userDid) {
             simplifiedRequest.user_identifier = userDid;
-            // AgentShield API only accepts "custom_fields", not "metadata"
-            // Always use "custom_fields" regardless of Day0 config
+            console.log("[ConsentService] Including user_identifier in delegation request:", {
+                userDid: userDid.substring(0, 20) + "...",
+            });
+        }
+        else {
+            console.log("[ConsentService] No user_identifier (no OAuth or ephemeral DID) - delegation will proceed without it");
+        }
+        // AgentShield API only accepts "custom_fields", not "metadata"
+        // Always use "custom_fields" regardless of Day0 config
+        if (userDid) {
+            // Include issuer_did and subject_did in custom_fields when we have userDid
             simplifiedRequest.custom_fields = {
                 issuer_did: userDid,
                 subject_did: request.agent_did,
@@ -1282,40 +2545,65 @@ export class ConsentService {
             // Include custom_fields from request even if no userDid
             simplifiedRequest.custom_fields = request.customFields;
         }
+        // If no userDid and no customFields, custom_fields is omitted (valid)
+        // EXPLICIT SAFEGUARD: Remove session_id and project_id if they somehow got added
+        // This should never happen, but provides defense-in-depth
+        delete simplifiedRequest.session_id;
+        delete simplifiedRequest.project_id;
         return simplifiedRequest;
     }
     /**
-     * Make API call (simplified format only)
-     *
-     * Note: AgentShield API only accepts simplified format.
-     * The full DelegationRecord format is not supported.
+     * Try API call with error-based format detection
      */
     async tryAPICall(agentShieldUrl, apiKey, request) {
-        // AgentShield API only accepts simplified format
-        // No format detection needed - always use simplified format
+        // Handle format detection
+        if (request._tryFormats && request.fullFormat && request.simplifiedFormat) {
+            // Try full format first
+            const fullResponse = await this.makeAPICall(agentShieldUrl, apiKey, request.fullFormat);
+            if (fullResponse.success ||
+                fullResponse.error_code !== "validation_error") {
+                // Full format worked or failed for non-format reasons
+                await this.cacheFormatPreference("full");
+                return fullResponse;
+            }
+            // Full format failed with validation error, try simplified
+            console.log("[ConsentService] Full format failed, trying simplified format...");
+            const simplifiedResponse = await this.makeAPICall(agentShieldUrl, apiKey, request.simplifiedFormat);
+            if (simplifiedResponse.success) {
+                await this.cacheFormatPreference("simplified");
+            }
+            return simplifiedResponse;
+        }
+        // Direct call (format already determined)
         return this.makeAPICall(agentShieldUrl, apiKey, request);
     }
     /**
      * Make API call and parse response
+     *
+     * CRITICAL: This method ensures session_id and project_id are never sent to AgentShield.
+     * These fields are NOT part of the createDelegationSchema and will cause validation errors.
      */
     async makeAPICall(agentShieldUrl, apiKey, requestBody) {
         try {
-            const url = `${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`;
-            const requestId = crypto.randomUUID();
-            console.log("[ConsentService] Making API call:", {
-                url,
-                method: "POST",
-                requestId,
-                bodyKeys: Object.keys(requestBody),
-            });
-            const response = await fetch(url, {
+            // FINAL SAFEGUARD: Remove session_id and project_id if they somehow got added
+            // This provides defense-in-depth protection
+            const sanitizedBody = { ...requestBody };
+            if ("session_id" in sanitizedBody) {
+                console.warn("[ConsentService] ⚠️ session_id detected in request body - removing (not in schema)");
+                delete sanitizedBody.session_id;
+            }
+            if ("project_id" in sanitizedBody) {
+                console.warn("[ConsentService] ⚠️ project_id detected in request body - removing (not in schema)");
+                delete sanitizedBody.project_id;
+            }
+            const response = await fetch(`${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`, {
                 method: "POST",
                 headers: {
-                    "X-API-Key": apiKey,
+                    Authorization: `Bearer ${apiKey}`,
                     "Content-Type": "application/json",
-                    "X-Request-ID": requestId,
+                    "X-Request-ID": crypto.randomUUID(),
                 },
-                body: JSON.stringify(requestBody),
+                body: JSON.stringify(sanitizedBody),
             });
             const responseText = await response.text();
             let responseData;
@@ -1325,41 +2613,17 @@ export class ConsentService {
             catch {
                 responseData = responseText;
             }
-            console.log("[ConsentService] API response:", {
-                status: response.status,
-                statusText: response.statusText,
-                responseData: typeof responseData === "string"
-                    ? responseData.substring(0, 200)
-                    : JSON.stringify(responseData).substring(0, 200),
-            });
-            // Check if response has success: false (even with 200 status)
-            if (typeof responseData === "object" &&
-                responseData !== null &&
-                "success" in responseData &&
-                responseData.success === false) {
-                const errorData = responseData;
-                const errorMessage = errorData.error?.message || errorData.message || "API request failed";
-                const errorCode = errorData.error?.code || "api_error";
-                console.error("[ConsentService] API returned success: false:", {
-                    errorMessage,
-                    errorCode,
-                    details: errorData.error?.details,
-                });
-                return {
-                    success: false,
-                    error: errorMessage,
-                    error_code: errorCode,
-                };
-            }
             // Check for validation error specifically
             if (response.status === 400) {
-                const errorMessage = responseData
-                    ?.error?.message ||
-                    responseData?.message ||
-                    "Validation failed";
-                if (errorMessage.includes("format") ||
+                const errorData = responseData;
+                const errorMessage = errorData.error?.message || errorData.message || "Validation failed";
+                const errorCode = errorData.error_code || errorData.error?.code;
+                // Check if error_code is explicitly set to "validation_error" OR error message suggests validation error
+                if (errorCode === "validation_error" ||
+                    errorMessage.includes("format") ||
                     errorMessage.includes("schema") ||
-                    errorMessage.includes("invalid")) {
+                    errorMessage.includes("invalid") ||
+                    errorMessage.includes("Validation")) {
                     return {
                         success: false,
                         error: errorMessage,