@kya-os/mcp-i-cloudflare 1.5.7 → 1.5.8-canary.10

package/dist/services/consent.service.js

@@ -15,17 +15,144 @@ import { validateConsentApprovalRequest, } from "@kya-os/contracts/consent";
 import { AGENTSHIELD_ENDPOINTS, createDelegationAPIResponseSchema, createDelegationResponseSchema, } from "@kya-os/contracts/agentshield-api";
 import { UserDidManager } from "@kya-os/mcp-i-core";
 import { WebCryptoProvider } from "../providers/crypto";
+import { ConsentAuditService } from "./consent-audit.service";
+import { CloudflareProofGenerator } from "../proof-generator";
+import { ProofService } from "./proof.service";
+import { fetchRemoteConfig } from "@kya-os/mcp-i-core/config/remote-config";
 export class ConsentService {
     configService;
     renderer;
     env;
     runtime;
     userDidManager; // Cached instance for consistent DID generation
+    // ✅ Audit service - lazy initialized
+    auditService;
+    auditInitPromise; // Cache promise to prevent race conditions
+    /**
+     * ✅ FIXED: Constructor takes env: CloudflareEnv, not config
+     */
     constructor(env, runtime) {
         this.env = env;
         this.runtime = runtime;
         this.configService = new ConsentConfigService(env);
         this.renderer = new ConsentPageRenderer();
+        // No initialization here - keep constructor synchronous
+    }
+    /**
+     * Get or initialize audit service (lazy initialization)
+     *
+     * Fetches config from remote API when projectId is available.
+     * Uses promise caching to prevent race conditions.
+     *
+     * @param projectId - Project ID from consent request (required for config fetch)
+     */
+    async getAuditService(projectId) {
+        // Already initialized
+        if (this.auditService) {
+            return this.auditService;
+        }
+        // No runtime - audit not available
+        if (!this.runtime) {
+            return undefined;
+        }
+        // Initialization in progress - wait for it
+        if (this.auditInitPromise) {
+            await this.auditInitPromise;
+            return this.auditService;
+        }
+        // Start initialization (with projectId for config fetch)
+        this.auditInitPromise = this.initializeAuditService(projectId);
+        try {
+            await this.auditInitPromise;
+        }
+        catch (error) {
+            console.warn("[ConsentService] Audit service initialization failed:", error);
+            // Don't throw - audit failures shouldn't break consent flow
+        }
+        return this.auditService;
+    }
+    /**
+     * Initialize audit service - fetches config from remote API
+     *
+     * ⚠️ CRITICAL: Fetches config from remote API using fetchRemoteConfig()
+     * This is the ONLY way to get CloudflareRuntimeConfig per requirement.
+     */
+    async initializeAuditService(projectId) {
+        if (!this.runtime) {
+            return;
+        }
+        try {
+            // ✅ CRITICAL: Fetch config from remote API
+            const config = await this.getConfigFromRemoteAPI(projectId);
+            if (!config?.proofing?.enabled) {
+                console.log("[ConsentService] Proofing not enabled in remote config");
+                return; // Proofing not enabled
+            }
+            // Get identity (async - requires runtime to be initialized)
+            const identity = await this.runtime.getIdentity();
+            // ✅ FIXED: CloudflareProofGenerator only takes identity, not providers
+            const proofGenerator = new CloudflareProofGenerator(identity);
+            // Get audit logger
+            const auditLogger = this.runtime.getAuditLogger();
+            if (!auditLogger) {
+                console.warn("[ConsentService] AuditLogger not available");
+                return;
+            }
+            // Create audit service with fetched config
+            this.auditService = new ConsentAuditService(new ProofService(config, this.runtime), auditLogger, proofGenerator, config, // ✅ Config fetched from remote API
+            this.runtime);
+            console.log("[ConsentService] Audit service initialized successfully");
+        }
+        catch (error) {
+            console.error("[ConsentService] Failed to initialize audit service:", error);
+            // Don't throw - audit failures shouldn't break consent flow
+        }
+    }
+    /**
+     * Fetch CloudflareRuntimeConfig from remote API (AgentShield)
+     *
+     * ⚠️ CRITICAL: Config MUST be fetched from remote API, not constructed from env.
+     *
+     * Uses existing `fetchRemoteConfig()` from `@kya-os/mcp-i-core/config/remote-config`
+     * which handles caching, error handling, and API communication.
+     *
+     * @param projectId - Project ID from consent request
+     * @returns Runtime config or undefined if unavailable
+     */
+    async getConfigFromRemoteAPI(projectId) {
+        if (!this.env.AGENTSHIELD_API_KEY) {
+            console.warn("[ConsentService] No API key for runtime config fetch");
+            return undefined;
+        }
+        try {
+            // Create KV cache adapter
+            const cache = this.env.TOOL_PROTECTION_KV
+                ? {
+                    get: async (key) => {
+                        return ((await this.env.TOOL_PROTECTION_KV.get(key, "text")) || null);
+                    },
+                    set: async (key, value, ttl) => {
+                        await this.env.TOOL_PROTECTION_KV.put(key, value, {
+                            expirationTtl: Math.floor(ttl / 1000),
+                        });
+                    },
+                }
+                : undefined;
+            const config = await fetchRemoteConfig({
+                apiUrl: this.env.AGENTSHIELD_API_URL || "https://kya.vouched.id",
+                apiKey: this.env.AGENTSHIELD_API_KEY,
+                projectId, // ✅ Use projectId from consent request
+                cacheTtl: 300000, // 5 minutes
+                fetchProvider: fetch,
+            }, cache);
+            // fetchRemoteConfig returns MCPIConfig | null
+            // CloudflareRuntimeConfig extends MCPIConfig, so cast is safe
+            return config;
+        }
+        catch (error) {
+            console.warn("[ConsentService] Error fetching runtime config:", error);
+            return undefined;
+        }
     }
     /**
      * Get or generate User DID for a session
@@ -38,13 +165,21 @@ export class ConsentService {
      * @returns User DID (did:key format)
      */
     async getUserDidForSession(sessionId, oauthIdentity) {
+        // Handle null explicitly (from JSON parsing)
+        const hasOAuthIdentity = oauthIdentity &&
+            typeof oauthIdentity === "object" &&
+            oauthIdentity.provider &&
+            oauthIdentity.subject;
         // If OAuth identity provided, check for existing mapping first
-        if (oauthIdentity && this.env.DELEGATION_STORAGE) {
+        if (hasOAuthIdentity && this.env.DELEGATION_STORAGE) {
             try {
                 const oauthKey = STORAGE_KEYS.oauthIdentity(oauthIdentity.provider, oauthIdentity.subject);
                 const mappedUserDid = await this.env.DELEGATION_STORAGE.get(oauthKey, "text");
                 if (mappedUserDid) {
-                    console.log("[ConsentService] Found persistent User DID from OAuth mapping");
+                    console.log("[ConsentService] Found persistent User DID from OAuth mapping:", {
+                        provider: oauthIdentity.provider,
+                        userDid: mappedUserDid.substring(0, 20) + "...",
+                    });
                     return mappedUserDid;
                 }
             }
@@ -53,6 +188,10 @@ export class ConsentService {
                 // Continue with ephemeral DID generation
             }
         }
+        else if (oauthIdentity === null) {
+            // Explicitly handle null case (no OAuth)
+            console.log("[ConsentService] No OAuth identity provided (null), generating ephemeral DID");
+        }
         // Continue with existing ephemeral DID generation logic
         if (!this.env.DELEGATION_STORAGE) {
             // No storage - use cached UserDidManager instance for consistent DID generation
@@ -143,8 +282,7 @@ export class ConsentService {
             const configUrl = `${agentShieldUrl}/api/v1/bouncer/projects/${projectId}/config`;
             const response = await fetch(configUrl, {
                 headers: {
-                    "X-API-Key": apiKey,
-                    "X-Project-Id": projectId,
+                    Authorization: `Bearer ${apiKey}`,
                     "Content-Type": "application/json",
                 },
             });
@@ -404,6 +542,29 @@ export class ConsentService {
                 });
                 return Response.redirect(oauthUrl, 302);
             }
+            // ✅ Lazy initialization with projectId
+            const auditService = await this.getAuditService(projectId);
+            // Log page view event (if audit service available)
+            if (auditService) {
+                await auditService
+                    .logConsentPageView({
+                    sessionId,
+                    agentDid,
+                    targetTools: [tool], // Wrap in array
+                    scopes,
+                    projectId,
+                })
+                    .catch((err) => {
+                    // Structured error logging
+                    console.error("[ConsentService] Audit logging failed", {
+                        eventType: "consent:page_viewed",
+                        sessionId,
+                        error: err instanceof Error ? err.message : String(err),
+                        stack: err instanceof Error ? err.stack : undefined,
+                    });
+                    // Don't throw - audit failures shouldn't break consent flow
+                });
+            }
             // Build consent page config
             const pageConfig = {
                 tool,
@@ -441,78 +602,1103 @@ export class ConsentService {
         }
     }
     /**
-     * Handle consent approval
+     * Parse request body from JSON or FormData
      *
-     * Validates request, creates delegation via AgentShield API,
-     * stores token in KV, and returns success response.
+     * Handles both JSON and FormData/multipart requests, converting
+     * FormData fields to the correct format for ConsentApprovalRequest.
      *
-     * @param request - Approval request
-     * @returns JSON response
+     * @param request - Request to parse
+     * @returns Parsed body object
      */
-    async handleApproval(request) {
-        try {
-            // Parse request body - handle both JSON and FormData
-            const contentType = request.headers.get("content-type") || "";
-            let body;
-            if (contentType.includes("application/json")) {
-                // JSON request (from JavaScript fetch)
-                body = await request.json();
-            }
-            else if (contentType.includes("application/x-www-form-urlencoded") ||
-                contentType.includes("multipart/form-data")) {
-                // FormData request (fallback if JavaScript doesn't intercept)
-                const formData = await request.formData();
-                body = {
-                    tool: formData.get("tool"),
-                    scopes: formData.get("scopes")
-                        ? JSON.parse(formData.get("scopes"))
-                        : [],
-                    agent_did: formData.get("agent_did"),
-                    session_id: formData.get("session_id"),
-                    project_id: formData.get("project_id"),
-                    termsAccepted: formData.get("termsAccepted") === "on" ||
-                        formData.get("termsAccepted") === "true",
-                    customFields: {},
-                };
-                // Extract OAuth identity if present
-                const oauthIdentityJson = formData.get("oauth_identity_json");
-                if (oauthIdentityJson && typeof oauthIdentityJson === "string") {
+    async parseRequestBody(request) {
+        const contentType = request.headers.get("content-type") || "";
+        // Helper function to parse form fields into body object
+        const parseFormFields = (entries) => {
+            const body = {};
+            for (const [key, value] of entries) {
+                // Handle special fields that need parsing
+                if (key === "scopes" || key === "scopes[]") {
+                    // Scopes come as JSON string
                     try {
-                        const parsed = JSON.parse(oauthIdentityJson);
-                        if (parsed && parsed.provider && parsed.subject) {
-                            body.oauth_identity = parsed;
-                        }
+                        body["scopes"] = JSON.parse(value);
                     }
                     catch {
-                        // Ignore invalid OAuth identity
+                        // If not JSON, treat as single scope or array
+                        body["scopes"] = value.includes(",") ? value.split(",") : [value];
                     }
                 }
-                // Extract custom fields (if any)
-                // Note: Custom fields would need to be extracted from formData if present
-                // For now, we'll use empty object as customFields are optional
+                else if (key === "oauth_identity" || key === "oauth_identity_json") {
+                    // OAuth identity comes as JSON string
+                    try {
+                        const parsed = JSON.parse(value);
+                        body["oauth_identity"] = parsed || null;
+                    }
+                    catch {
+                        // Invalid JSON, set to null
+                        body["oauth_identity"] = null;
+                    }
+                }
+                else if (key === "termsAccepted") {
+                    // Convert checkbox values to boolean
+                    body[key] =
+                        value === "on" ||
+                            value === "true" ||
+                            value === "1" ||
+                            value === "yes";
+                }
+                else if (key === "customFields") {
+                    // Custom fields come as JSON string
+                    try {
+                        body[key] = JSON.parse(value);
+                    }
+                    catch {
+                        // If not JSON, skip
+                    }
+                }
+                else {
+                    // Regular string fields
+                    body[key] = value;
+                }
             }
-            else {
-                // Try JSON first, fallback to form data
+            // Default termsAccepted to true if not provided (common for checkboxes)
+            if (!("termsAccepted" in body)) {
+                body.termsAccepted = true;
+            }
+            // Default scopes to empty array if not provided (required by schema but can be empty)
+            if (!("scopes" in body)) {
+                body.scopes = [];
+            }
+            return body;
+        };
+        // Parse URL-encoded form data (application/x-www-form-urlencoded)
+        // When Content-Type is URL-encoded but FormData object is passed, try FormData parsing first
+        if (contentType.includes("application/x-www-form-urlencoded")) {
+            // Try FormData parsing first (FormData object might have been passed)
+            try {
+                const clonedRequest = request.clone();
+                const formData = await clonedRequest.formData();
+                const body = {};
+                let hasValidFields = false;
+                // Check if FormData parsing returned malformed data (entire multipart body as single entry)
+                // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                const entriesArray = Array.from(formData.entries());
+                if (entriesArray.length === 1 &&
+                    typeof entriesArray[0][0] === "string" &&
+                    entriesArray[0][0].includes("Content-Disposition") &&
+                    typeof entriesArray[0][1] === "string" &&
+                    entriesArray[0][1].toString().includes("Content-Disposition")) {
+                    // Manually parse multipart format from the value string
+                    // The key contains the first boundary and Content-Disposition header start
+                    // The value contains the rest of the first field and all subsequent fields
+                    const keyPart = entriesArray[0][0];
+                    const valuePart = entriesArray[0][1];
+                    // Fix: If key ends with "name" and value starts with '"fieldname"', combine them
+                    let multipartBody;
+                    if (keyPart.trim().endsWith("name") &&
+                        valuePart.trim().startsWith('"')) {
+                        // Key ends with "name", value starts with '"fieldname"', combine with = between them
+                        multipartBody = keyPart + "=" + valuePart;
+                    }
+                    else {
+                        multipartBody = keyPart + valuePart;
+                    }
+                    // Match: Content-Disposition header with field name, then capture value until next boundary or end
+                    const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                    let match;
+                    while ((match = fieldRegex.exec(multipartBody)) !== null) {
+                        const fieldName = match[1];
+                        const fieldValue = match[2].trim(); // Remove trailing newlines
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(fieldValue);
+                            }
+                            catch {
+                                body["scopes"] = fieldValue.includes(",")
+                                    ? fieldValue.split(",")
+                                    : [fieldValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                fieldValue === "on" ||
+                                    fieldValue === "true" ||
+                                    fieldValue === "1" ||
+                                    fieldValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(fieldValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = fieldValue;
+                        }
+                        hasValidFields = true;
+                    }
+                }
+                else {
+                    // Normal FormData parsing
+                    // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                    for (const [key, value] of formData.entries()) {
+                        if (value instanceof File) {
+                            continue;
+                        }
+                        // Extract field name from malformed keys (when FormData is passed with wrong Content-Type)
+                        let fieldName = key;
+                        if (key.includes("Content-Disposition") && key.includes('name="')) {
+                            // Extract field name from Content-Disposition header
+                            const nameMatch = key.match(/name="([^"]+)"/);
+                            if (nameMatch && nameMatch[1]) {
+                                fieldName = nameMatch[1];
+                            }
+                            else {
+                                // Skip if we can't extract a valid field name
+                                continue;
+                            }
+                        }
+                        else if (key.includes("------") ||
+                            key.includes("\r\n") ||
+                            key.trim() === "") {
+                            // Skip boundary strings and invalid keys
+                            continue;
+                        }
+                        hasValidFields = true;
+                        const stringValue = value.toString();
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                body["scopes"] = stringValue.includes(",")
+                                    ? stringValue.split(",")
+                                    : [stringValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(stringValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                stringValue === "on" ||
+                                    stringValue === "true" ||
+                                    stringValue === "1" ||
+                                    stringValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = stringValue;
+                        }
+                    }
+                }
+                if (hasValidFields && Object.keys(body).length > 0) {
+                    if (!("termsAccepted" in body)) {
+                        body.termsAccepted = true;
+                    }
+                    // Default scopes to empty array if not provided
+                    if (!("scopes" in body)) {
+                        body.scopes = [];
+                    }
+                    return body;
+                }
+            }
+            catch (formDataError) {
+                // FormData parsing failed, try URL-encoded text parsing
+                console.warn("[ConsentService] FormData parsing failed, trying URL-encoded text:", formDataError);
+            }
+            // Try URL-encoded text parsing as fallback
+            try {
+                const text = await request.clone().text();
+                const params = new URLSearchParams(text);
+                // Type assertion: URLSearchParams.entries() exists at runtime
+                return parseFormFields(params.entries());
+            }
+            catch (urlEncodedError) {
+                // Both failed, fall through to JSON parsing
+                console.warn("[ConsentService] URL-encoded parsing also failed:", urlEncodedError);
+            }
+        }
+        // Parse multipart FormData (multipart/form-data or when FormData object is passed with other Content-Type)
+        // Include text/plain here to handle cases where FormData is passed with mismatched Content-Type
+        if (contentType.includes("multipart/form-data") ||
+            contentType.includes("form") ||
+            contentType === "" ||
+            contentType.includes("text/plain") ||
+            contentType.includes("text")) {
+            // Check if multipart/form-data Content-Type is missing boundary
+            // If so, try to parse as text first (FormData might have been serialized incorrectly)
+            if (contentType.includes("multipart/form-data") &&
+                !contentType.includes("boundary=")) {
                 try {
-                    body = await request.json();
+                    const textRequest = request.clone();
+                    const text = await textRequest.text();
+                    if (text && text.length > 0) {
+                        // Try to manually parse multipart format from text
+                        const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                        const body = {};
+                        let match;
+                        let hasValidFields = false;
+                        while ((match = fieldRegex.exec(text)) !== null) {
+                            const fieldName = match[1];
+                            const fieldValue = match[2].trim();
+                            if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                try {
+                                    body["scopes"] = JSON.parse(fieldValue);
+                                }
+                                catch {
+                                    body["scopes"] = fieldValue.includes(",")
+                                        ? fieldValue.split(",")
+                                        : [fieldValue];
+                                }
+                            }
+                            else if (fieldName === "oauth_identity" ||
+                                fieldName === "oauth_identity_json") {
+                                try {
+                                    body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                }
+                                catch {
+                                    body["oauth_identity"] = null;
+                                }
+                            }
+                            else if (fieldName === "termsAccepted") {
+                                body[fieldName] =
+                                    fieldValue === "on" ||
+                                        fieldValue === "true" ||
+                                        fieldValue === "1" ||
+                                        fieldValue === "yes";
+                            }
+                            else if (fieldName === "customFields") {
+                                try {
+                                    body[fieldName] = JSON.parse(fieldValue);
+                                }
+                                catch {
+                                    // Skip
+                                }
+                            }
+                            else {
+                                body[fieldName] = fieldValue;
+                            }
+                            hasValidFields = true;
+                        }
+                        if (hasValidFields && Object.keys(body).length > 0) {
+                            if (!("termsAccepted" in body)) {
+                                body.termsAccepted = true;
+                            }
+                            // Default scopes to empty array if not provided
+                            if (!("scopes" in body)) {
+                                body.scopes = [];
+                            }
+                            return body;
+                        }
+                    }
                 }
                 catch {
-                    const formData = await request.formData();
-                    body = {
-                        tool: formData.get("tool"),
-                        scopes: formData.get("scopes")
-                            ? JSON.parse(formData.get("scopes"))
-                            : [],
-                        agent_did: formData.get("agent_did"),
-                        session_id: formData.get("session_id"),
-                        project_id: formData.get("project_id"),
-                        termsAccepted: formData.get("termsAccepted") === "on",
-                        customFields: {},
-                    };
+                    // If text parsing fails, fall through to FormData parsing
                 }
             }
+            try {
+                const clonedRequest = request.clone();
+                let formData;
+                try {
+                    formData = await clonedRequest.formData();
+                }
+                catch (formDataError) {
+                    // Handle FormData parsing errors (missing boundary, wrong Content-Type, etc.)
+                    const errorMessage = formDataError instanceof Error
+                        ? formDataError.message
+                        : String(formDataError);
+                    const errorCause = formDataError instanceof Error && "cause" in formDataError
+                        ? formDataError.cause instanceof Error
+                            ? formDataError.cause.message
+                            : String(formDataError.cause)
+                        : "";
+                    if (errorMessage.includes("missing boundary") ||
+                        errorMessage.includes("boundary") ||
+                        errorMessage.includes("Content-Type was not one of") ||
+                        errorCause.includes("missing boundary") ||
+                        errorCause.includes("boundary")) {
+                        // When boundary is missing, try to parse as URL-encoded form data instead
+                        // This handles the case where FormData was passed but Content-Type doesn't include boundary
+                        try {
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            // If text parsing succeeds, try URL-encoded parsing
+                            if (text && text.length > 0) {
+                                try {
+                                    const params = new URLSearchParams(text);
+                                    return parseFormFields(params.entries());
+                                }
+                                catch {
+                                    // If URL-encoded parsing fails, the text might be multipart format
+                                    // Try to manually parse multipart format from text
+                                    const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                    const body = {};
+                                    let match;
+                                    let hasValidFields = false;
+                                    while ((match = fieldRegex.exec(text)) !== null) {
+                                        const fieldName = match[1];
+                                        const fieldValue = match[2].trim();
+                                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                            try {
+                                                body["scopes"] = JSON.parse(fieldValue);
+                                            }
+                                            catch {
+                                                body["scopes"] = fieldValue.includes(",")
+                                                    ? fieldValue.split(",")
+                                                    : [fieldValue];
+                                            }
+                                        }
+                                        else if (fieldName === "oauth_identity" ||
+                                            fieldName === "oauth_identity_json") {
+                                            try {
+                                                body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                            }
+                                            catch {
+                                                body["oauth_identity"] = null;
+                                            }
+                                        }
+                                        else if (fieldName === "termsAccepted") {
+                                            body[fieldName] =
+                                                fieldValue === "on" ||
+                                                    fieldValue === "true" ||
+                                                    fieldValue === "1" ||
+                                                    fieldValue === "yes";
+                                        }
+                                        else if (fieldName === "customFields") {
+                                            try {
+                                                body[fieldName] = JSON.parse(fieldValue);
+                                            }
+                                            catch {
+                                                // Skip
+                                            }
+                                        }
+                                        else {
+                                            body[fieldName] = fieldValue;
+                                        }
+                                        hasValidFields = true;
+                                    }
+                                    if (hasValidFields && Object.keys(body).length > 0) {
+                                        if (!("termsAccepted" in body)) {
+                                            body.termsAccepted = true;
+                                        }
+                                        // Default scopes to empty array if not provided
+                                        if (!("scopes" in body)) {
+                                            body.scopes = [];
+                                        }
+                                        return body;
+                                    }
+                                }
+                            }
+                        }
+                        catch {
+                            // If all parsing attempts fail, rethrow the original error
+                        }
+                    }
+                    throw formDataError;
+                }
+                const body = {};
+                let hasValidFields = false;
+                // Check if FormData parsing returned malformed data (entire multipart body as single entry)
+                // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                const entriesArray = Array.from(formData.entries());
+                if (entriesArray.length === 1 &&
+                    typeof entriesArray[0][0] === "string" &&
+                    entriesArray[0][0].includes("Content-Disposition") &&
+                    typeof entriesArray[0][1] === "string" &&
+                    entriesArray[0][1].toString().includes("Content-Disposition")) {
+                    // Manually parse multipart format from the value string
+                    const keyPart = entriesArray[0][0];
+                    const valuePart = entriesArray[0][1];
+                    // Fix: If key ends with "name" and value starts with '"fieldname"', combine them
+                    let multipartBody;
+                    if (keyPart.trim().endsWith("name") &&
+                        valuePart.trim().startsWith('"')) {
+                        multipartBody = keyPart + "=" + valuePart;
+                    }
+                    else {
+                        multipartBody = keyPart + valuePart;
+                    }
+                    // Match: Content-Disposition header with field name, then capture value until next boundary or end
+                    const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                    let match;
+                    while ((match = fieldRegex.exec(multipartBody)) !== null) {
+                        const fieldName = match[1];
+                        const fieldValue = match[2].trim();
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(fieldValue);
+                            }
+                            catch {
+                                body["scopes"] = fieldValue.includes(",")
+                                    ? fieldValue.split(",")
+                                    : [fieldValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                fieldValue === "on" ||
+                                    fieldValue === "true" ||
+                                    fieldValue === "1" ||
+                                    fieldValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(fieldValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = fieldValue;
+                        }
+                        hasValidFields = true;
+                    }
+                }
+                else {
+                    // Normal FormData parsing
+                    // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                    for (const [key, value] of formData.entries()) {
+                        if (value instanceof File) {
+                            continue;
+                        }
+                        // Extract field name from malformed keys (when FormData is passed with wrong Content-Type)
+                        let fieldName = key;
+                        if (key.includes("Content-Disposition") && key.includes('name="')) {
+                            // Extract field name from Content-Disposition header
+                            const nameMatch = key.match(/name="([^"]+)"/);
+                            if (nameMatch && nameMatch[1]) {
+                                fieldName = nameMatch[1];
+                            }
+                            else {
+                                // Skip if we can't extract a valid field name
+                                continue;
+                            }
+                        }
+                        else if (key.includes("------") ||
+                            key.includes("\r\n") ||
+                            key.trim() === "") {
+                            // Skip boundary strings and invalid keys
+                            continue;
+                        }
+                        hasValidFields = true;
+                        const stringValue = value.toString();
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                body["scopes"] = stringValue.includes(",")
+                                    ? stringValue.split(",")
+                                    : [stringValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(stringValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                stringValue === "on" ||
+                                    stringValue === "true" ||
+                                    stringValue === "1" ||
+                                    stringValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = stringValue;
+                        }
+                    }
+                }
+                if (hasValidFields && Object.keys(body).length > 0) {
+                    if (!("termsAccepted" in body)) {
+                        body.termsAccepted = true;
+                    }
+                    // Default scopes to empty array if not provided
+                    if (!("scopes" in body)) {
+                        body.scopes = [];
+                    }
+                    return body;
+                }
+            }
+            catch (formDataError) {
+                console.warn("[ConsentService] FormData parsing failed:", formDataError);
+                // Fall through to JSON parsing
+            }
+        }
+        // Default to JSON parsing
+        try {
+            return await request.json();
+        }
+        catch (error) {
+            // If JSON parsing fails and content-type suggests form data, try FormData parsing as fallback
+            // Special handling for text/plain with FormData body - try text parsing first
+            if (contentType === "text/plain") {
+                try {
+                    const textRequest = request.clone();
+                    const text = await textRequest.text();
+                    if (text && text.length > 0) {
+                        // Try URL-encoded parsing first
+                        try {
+                            const params = new URLSearchParams(text);
+                            const body = parseFormFields(params.entries());
+                            if (Object.keys(body).length > 0) {
+                                return body;
+                            }
+                        }
+                        catch {
+                            // URL-encoded parsing failed, try multipart format
+                        }
+                        // Try multipart format parsing (FormData serializes to multipart)
+                        const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                        const body = {};
+                        let match;
+                        let hasValidFields = false;
+                        while ((match = fieldRegex.exec(text)) !== null) {
+                            const fieldName = match[1];
+                            const fieldValue = match[2].trim();
+                            if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                try {
+                                    body["scopes"] = JSON.parse(fieldValue);
+                                }
+                                catch {
+                                    body["scopes"] = fieldValue.includes(",")
+                                        ? fieldValue.split(",")
+                                        : [fieldValue];
+                                }
+                            }
+                            else if (fieldName === "oauth_identity" ||
+                                fieldName === "oauth_identity_json") {
+                                try {
+                                    body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                }
+                                catch {
+                                    body["oauth_identity"] = null;
+                                }
+                            }
+                            else if (fieldName === "termsAccepted") {
+                                body[fieldName] =
+                                    fieldValue === "on" ||
+                                        fieldValue === "true" ||
+                                        fieldValue === "1" ||
+                                        fieldValue === "yes";
+                            }
+                            else if (fieldName === "customFields") {
+                                try {
+                                    body[fieldName] = JSON.parse(fieldValue);
+                                }
+                                catch {
+                                    // Skip
+                                }
+                            }
+                            else {
+                                body[fieldName] = fieldValue;
+                            }
+                            hasValidFields = true;
+                        }
+                        if (hasValidFields && Object.keys(body).length > 0) {
+                            if (!("termsAccepted" in body)) {
+                                body.termsAccepted = true;
+                            }
+                            // Default scopes to empty array if not provided
+                            if (!("scopes" in body)) {
+                                body.scopes = [];
+                            }
+                            return body;
+                        }
+                    }
+                }
+                catch {
+                    // Text parsing failed, fall through to FormData parsing
+                }
+            }
+            if (!contentType.includes("application/json") &&
+                (contentType.includes("form") ||
+                    contentType === "" ||
+                    contentType.includes("text"))) {
+                try {
+                    // Clone request ONCE before trying any parsing, so we can reuse it if FormData parsing fails
+                    const fallbackRequest = request.clone();
+                    // Try FormData parsing as fallback (even if Content-Type doesn't match)
+                    let formData;
+                    try {
+                        formData = await fallbackRequest.formData();
+                    }
+                    catch (formDataParseError) {
+                        // If FormData parsing fails, try reading as text and parsing manually
+                        // This handles cases where Content-Type doesn't match (e.g., text/plain with FormData body)
+                        try {
+                            // Use a fresh clone for text parsing (body might be consumed by failed FormData attempt)
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            if (text && text.length > 0) {
+                                // First try URL-encoded parsing (simpler format)
+                                try {
+                                    const params = new URLSearchParams(text);
+                                    const body = parseFormFields(params.entries());
+                                    if (Object.keys(body).length > 0) {
+                                        return body;
+                                    }
+                                }
+                                catch {
+                                    // URL-encoded parsing failed, try multipart format
+                                }
+                                // Try to manually parse multipart format from text
+                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                const body = {};
+                                let match;
+                                let hasValidFields = false;
+                                while ((match = fieldRegex.exec(text)) !== null) {
+                                    const fieldName = match[1];
+                                    const fieldValue = match[2].trim();
+                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                        try {
+                                            body["scopes"] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            body["scopes"] = fieldValue.includes(",")
+                                                ? fieldValue.split(",")
+                                                : [fieldValue];
+                                        }
+                                    }
+                                    else if (fieldName === "oauth_identity" ||
+                                        fieldName === "oauth_identity_json") {
+                                        try {
+                                            body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                        }
+                                        catch {
+                                            body["oauth_identity"] = null;
+                                        }
+                                    }
+                                    else if (fieldName === "termsAccepted") {
+                                        body[fieldName] =
+                                            fieldValue === "on" ||
+                                                fieldValue === "true" ||
+                                                fieldValue === "1" ||
+                                                fieldValue === "yes";
+                                    }
+                                    else if (fieldName === "customFields") {
+                                        try {
+                                            body[fieldName] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            // Skip
+                                        }
+                                    }
+                                    else {
+                                        body[fieldName] = fieldValue;
+                                    }
+                                    hasValidFields = true;
+                                }
+                                if (hasValidFields && Object.keys(body).length > 0) {
+                                    if (!("termsAccepted" in body)) {
+                                        body.termsAccepted = true;
+                                    }
+                                    // Default scopes to empty array if not provided
+                                    if (!("scopes" in body)) {
+                                        body.scopes = [];
+                                    }
+                                    return body;
+                                }
+                            }
+                        }
+                        catch {
+                            // If text parsing also fails, rethrow original FormData error
+                        }
+                        throw formDataParseError;
+                    }
+                    // Check if FormData has valid entries (might be empty if Content-Type mismatch)
+                    const entriesArray = Array.from(formData.entries());
+                    if (entriesArray.length === 0) {
+                        // FormData parsing succeeded but returned no entries - try text parsing
+                        // This handles cases where Content-Type doesn't match (e.g., text/plain with FormData body)
+                        try {
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            if (text && text.length > 0) {
+                                // Try URL-encoded parsing first
+                                try {
+                                    const params = new URLSearchParams(text);
+                                    const body = parseFormFields(params.entries());
+                                    if (Object.keys(body).length > 0) {
+                                        return body;
+                                    }
+                                }
+                                catch {
+                                    // URL-encoded parsing failed, try multipart format
+                                }
+                                // Try multipart format parsing
+                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                const body = {};
+                                let match;
+                                let hasValidFields = false;
+                                while ((match = fieldRegex.exec(text)) !== null) {
+                                    const fieldName = match[1];
+                                    const fieldValue = match[2].trim();
+                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                        try {
+                                            body["scopes"] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            body["scopes"] = fieldValue.includes(",")
+                                                ? fieldValue.split(",")
+                                                : [fieldValue];
+                                        }
+                                    }
+                                    else if (fieldName === "oauth_identity" ||
+                                        fieldName === "oauth_identity_json") {
+                                        try {
+                                            body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                        }
+                                        catch {
+                                            body["oauth_identity"] = null;
+                                        }
+                                    }
+                                    else if (fieldName === "termsAccepted") {
+                                        body[fieldName] =
+                                            fieldValue === "on" ||
+                                                fieldValue === "true" ||
+                                                fieldValue === "1" ||
+                                                fieldValue === "yes";
+                                    }
+                                    else if (fieldName === "customFields") {
+                                        try {
+                                            body[fieldName] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            // Skip
+                                        }
+                                    }
+                                    else {
+                                        body[fieldName] = fieldValue;
+                                    }
+                                    hasValidFields = true;
+                                }
+                                if (hasValidFields && Object.keys(body).length > 0) {
+                                    if (!("termsAccepted" in body)) {
+                                        body.termsAccepted = true;
+                                    }
+                                    // Default scopes to empty array if not provided
+                                    if (!("scopes" in body)) {
+                                        body.scopes = [];
+                                    }
+                                    return body;
+                                }
+                            }
+                            // If text parsing failed or found no valid fields, throw error to trigger fallback
+                            throw new Error("FormData parsing returned empty entries and text parsing found no valid fields");
+                        }
+                        catch (textParseError) {
+                            // Text parsing failed or found no valid fields - throw error to trigger JSON fallback
+                            // This ensures we don't continue with empty FormData entries
+                            throw new Error(`Failed to parse FormData: ${textParseError instanceof Error ? textParseError.message : "Unknown error"}`);
+                        }
+                    }
+                    const body = {};
+                    // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                    let hasValidEntries = false;
+                    for (const [key, value] of formData.entries()) {
+                        if (value instanceof File)
+                            continue;
+                        // Extract field name from malformed keys
+                        let fieldName = key;
+                        if (key.includes("Content-Disposition") && key.includes('name="')) {
+                            const nameMatch = key.match(/name="([^"]+)"/);
+                            if (nameMatch && nameMatch[1]) {
+                                fieldName = nameMatch[1];
+                            }
+                            else {
+                                continue;
+                            }
+                        }
+                        else if (key.includes("------") ||
+                            key.includes("\r\n") ||
+                            key.trim() === "" ||
+                            key.includes("formdata-undici")) {
+                            // Malformed key - likely from text/plain Content-Type mismatch
+                            // Skip this entry and fall back to text parsing
+                            continue;
+                        }
+                        // If we have a valid field name, mark as having valid entries
+                        if (fieldName && fieldName !== key) {
+                            hasValidEntries = true;
+                        }
+                        else if (fieldName &&
+                            !key.includes("Content-Disposition") &&
+                            !key.includes("------") &&
+                            !key.includes("\r\n")) {
+                            hasValidEntries = true;
+                        }
+                        // Process the field value
+                        const stringValue = value.toString();
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                body["scopes"] = stringValue.includes(",")
+                                    ? stringValue.split(",")
+                                    : [stringValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(stringValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                stringValue === "on" ||
+                                    stringValue === "true" ||
+                                    stringValue === "1" ||
+                                    stringValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = stringValue;
+                        }
+                    }
+                    // If we didn't get any valid entries (all keys were malformed), try text parsing
+                    if (!hasValidEntries || Object.keys(body).length === 0) {
+                        // Try text parsing as fallback when FormData parsing returns no valid entries
+                        try {
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            if (text && text.length > 0) {
+                                // Try multipart format parsing from text
+                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                const textBody = {};
+                                let match;
+                                let hasValidFields = false;
+                                while ((match = fieldRegex.exec(text)) !== null) {
+                                    const fieldName = match[1];
+                                    const fieldValue = match[2].trim();
+                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                        try {
+                                            textBody["scopes"] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            textBody["scopes"] = fieldValue.includes(",")
+                                                ? fieldValue.split(",")
+                                                : [fieldValue];
+                                        }
+                                    }
+                                    else if (fieldName === "oauth_identity" ||
+                                        fieldName === "oauth_identity_json") {
+                                        try {
+                                            textBody["oauth_identity"] =
+                                                JSON.parse(fieldValue) || null;
+                                        }
+                                        catch {
+                                            textBody["oauth_identity"] = null;
+                                        }
+                                    }
+                                    else if (fieldName === "termsAccepted") {
+                                        textBody[fieldName] =
+                                            fieldValue === "on" ||
+                                                fieldValue === "true" ||
+                                                fieldValue === "1" ||
+                                                fieldValue === "yes";
+                                    }
+                                    else if (fieldName === "customFields") {
+                                        try {
+                                            textBody[fieldName] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            // Skip
+                                        }
+                                    }
+                                    else {
+                                        textBody[fieldName] = fieldValue;
+                                    }
+                                    hasValidFields = true;
+                                }
+                                if (hasValidFields && Object.keys(textBody).length > 0) {
+                                    if (!("termsAccepted" in textBody)) {
+                                        textBody.termsAccepted = true;
+                                    }
+                                    if (!("scopes" in textBody)) {
+                                        textBody.scopes = [];
+                                    }
+                                    return textBody;
+                                }
+                            }
+                        }
+                        catch {
+                            // Text parsing also failed, fall through to throw error
+                        }
+                        throw new Error("FormData parsing returned only malformed entries - falling back to text parsing");
+                    }
+                    if (!("termsAccepted" in body)) {
+                        body.termsAccepted = true;
+                    }
+                    // Default scopes to empty array if not provided
+                    if (!("scopes" in body)) {
+                        body.scopes = [];
+                    }
+                    return body;
+                }
+                catch (formError) {
+                    // FormData parsing failed - if it was due to malformed entries, try text parsing
+                    const errorMessage = formError instanceof Error ? formError.message : String(formError);
+                    if (errorMessage.includes("malformed entries") ||
+                        errorMessage.includes("empty entries") ||
+                        errorMessage.includes("falling back to text parsing")) {
+                        // Try text parsing as last resort
+                        try {
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            if (text && text.length > 0) {
+                                // Try multipart format parsing
+                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                const body = {};
+                                let match;
+                                let hasValidFields = false;
+                                while ((match = fieldRegex.exec(text)) !== null) {
+                                    const fieldName = match[1];
+                                    const fieldValue = match[2].trim();
+                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                        try {
+                                            body["scopes"] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            body["scopes"] = fieldValue.includes(",")
+                                                ? fieldValue.split(",")
+                                                : [fieldValue];
+                                        }
+                                    }
+                                    else if (fieldName === "oauth_identity" ||
+                                        fieldName === "oauth_identity_json") {
+                                        try {
+                                            body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                        }
+                                        catch {
+                                            body["oauth_identity"] = null;
+                                        }
+                                    }
+                                    else if (fieldName === "termsAccepted") {
+                                        body[fieldName] =
+                                            fieldValue === "on" ||
+                                                fieldValue === "true" ||
+                                                fieldValue === "1" ||
+                                                fieldValue === "yes";
+                                    }
+                                    else if (fieldName === "customFields") {
+                                        try {
+                                            body[fieldName] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            // Skip
+                                        }
+                                    }
+                                    else {
+                                        body[fieldName] = fieldValue;
+                                    }
+                                    hasValidFields = true;
+                                }
+                                if (hasValidFields && Object.keys(body).length > 0) {
+                                    if (!("termsAccepted" in body)) {
+                                        body.termsAccepted = true;
+                                    }
+                                    // Default scopes to empty array if not provided
+                                    if (!("scopes" in body)) {
+                                        body.scopes = [];
+                                    }
+                                    return body;
+                                }
+                            }
+                        }
+                        catch {
+                            // Text parsing also failed
+                        }
+                    }
+                    // Both failed, throw original error
+                }
+            }
+            throw new Error(`Failed to parse request body: ${error instanceof Error ? error.message : "Unknown error"}`);
+        }
+    }
+    /**
+     * Handle consent approval
+     *
+     * Validates request, creates delegation via AgentShield API,
+     * stores token in KV, and returns success response.
+     *
+     * @param request - Approval request
+     * @returns JSON response
+     */
+    async handleApproval(request) {
+        console.log("[ConsentService] Approval request received");
+        try {
+            // Parse and validate request body (supports both JSON and FormData)
+            const body = await this.parseRequestBody(request);
+            console.log("[ConsentService] Request body parsed:", {
+                hasBody: !!body,
+                bodyKeys: Object.keys(body || {}),
+                hasOAuthIdentity: !!body?.oauth_identity,
+            });
             const validation = validateConsentApprovalRequest(body);
             if (!validation.success) {
+                console.error("[ConsentService] Approval request validation failed:", {
+                    errors: validation.error.errors,
+                    receivedBody: body,
+                });
                 return new Response(JSON.stringify({
                     success: false,
                     error: "Invalid request",
@@ -524,6 +1710,13 @@ export class ConsentService {
                 });
             }
             const approvalRequest = validation.data;
+            console.log("[ConsentService] Approval request validated:", {
+                agentDid: approvalRequest.agent_did?.substring(0, 20) + "...",
+                sessionId: approvalRequest.session_id?.substring(0, 20) + "...",
+                scopes: approvalRequest.scopes,
+                hasOAuthIdentity: !!approvalRequest.oauth_identity,
+                oauthProvider: approvalRequest.oauth_identity?.provider,
+            });
             // Validate terms acceptance if required
             const consentConfig = await this.configService.getConsentConfig(approvalRequest.project_id);
             if (consentConfig.terms?.required && !approvalRequest.termsAccepted) {
@@ -536,9 +1729,40 @@ export class ConsentService {
                     headers: { "Content-Type": "application/json" },
                 });
             }
+            // ✅ Extract projectId from approval request
+            const projectId = approvalRequest.project_id;
+            // ✅ Lazy initialization with projectId
+            const auditService = await this.getAuditService(projectId);
+            // Check if user needs credentials before delegation
+            const needsCredentials = !approvalRequest.user_did && !approvalRequest.oauth_identity;
+            if (needsCredentials && auditService) {
+                await auditService
+                    .logCredentialRequired({
+                    sessionId: approvalRequest.session_id,
+                    agentDid: approvalRequest.agent_did,
+                    targetTools: [approvalRequest.tool], // Array
+                    scopes: approvalRequest.scopes,
+                    projectId,
+                    oauthProvider: approvalRequest.oauth_identity?.provider,
+                })
+                    .catch((err) => {
+                    console.error("[ConsentService] Failed to log credential required", {
+                        eventType: "consent:credential_required",
+                        sessionId: approvalRequest.session_id,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                });
+                // Note: We don't redirect here - the consent flow continues
+                // The credential_required event is just for audit tracking
+            }
             // Create delegation via AgentShield API
+            console.log("[ConsentService] Creating delegation...");
             const delegationResult = await this.createDelegation(approvalRequest);
             if (!delegationResult.success) {
+                console.error("[ConsentService] Delegation creation failed:", {
+                    error: delegationResult.error,
+                    error_code: delegationResult.error_code,
+                });
                 return new Response(JSON.stringify({
                     success: false,
                     error: delegationResult.error || "Failed to create delegation",
@@ -548,8 +1772,57 @@ export class ConsentService {
                     headers: { "Content-Type": "application/json" },
                 });
             }
+            console.log("[ConsentService] ✅ Delegation created successfully:", {
+                delegationId: delegationResult.delegation_id?.substring(0, 20) + "...",
+            });
             // Store delegation token in KV
             await this.storeDelegationToken(approvalRequest.session_id, approvalRequest.agent_did, delegationResult.delegation_token, delegationResult.delegation_id);
+            // ✅ After successful delegation creation - log audit events
+            if (auditService && delegationResult.success) {
+                try {
+                    // Get userDid (may have been generated during delegation creation)
+                    let userDid;
+                    if (this.env.DELEGATION_STORAGE && approvalRequest.session_id) {
+                        try {
+                            userDid = await this.getUserDidForSession(approvalRequest.session_id, approvalRequest.oauth_identity || undefined);
+                        }
+                        catch (error) {
+                            console.warn("[ConsentService] Failed to get userDid for audit logging:", error);
+                            // Continue without userDid - audit events can still be logged
+                        }
+                    }
+                    await auditService.logConsentApproval({
+                        sessionId: approvalRequest.session_id,
+                        userDid,
+                        agentDid: approvalRequest.agent_did,
+                        targetTools: [approvalRequest.tool], // Array
+                        scopes: approvalRequest.scopes,
+                        delegationId: delegationResult.delegation_id,
+                        projectId,
+                        termsAccepted: approvalRequest.termsAccepted || false,
+                        oauthIdentity: approvalRequest.oauth_identity ? {
+                            provider: approvalRequest.oauth_identity.provider,
+                            identifier: approvalRequest.oauth_identity.subject
+                        } : undefined,
+                    });
+                    await auditService.logDelegationCreated({
+                        sessionId: approvalRequest.session_id,
+                        delegationId: delegationResult.delegation_id,
+                        agentDid: approvalRequest.agent_did,
+                        userDid,
+                        targetTools: [approvalRequest.tool], // Array
+                        scopes: approvalRequest.scopes,
+                        projectId,
+                    });
+                }
+                catch (error) {
+                    console.error("[ConsentService] Audit failed but continuing", {
+                        sessionId: approvalRequest.session_id,
+                        error: error instanceof Error ? error.message : String(error),
+                        eventTypes: ["consent:approved", "consent:delegation_created"],
+                    });
+                }
+            }
             // Return success response
             const response = {
                 success: true,
@@ -563,16 +1836,10 @@ export class ConsentService {
         }
         catch (error) {
             console.error("[ConsentService] Error handling approval:", error);
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            const errorStack = error instanceof Error ? error.stack : undefined;
-            console.error("[ConsentService] Error details:", {
-                message: errorMessage,
-                stack: errorStack,
-            });
             return new Response(JSON.stringify({
                 success: false,
-                error: errorMessage || "An internal error occurred",
-                error_code: "INTERNAL_SERVER_ERROR",
+                error: "Internal server error",
+                error_code: "internal_error",
             }), {
                 status: 500,
                 headers: { "Content-Type": "application/json" },
@@ -602,17 +1869,35 @@ export class ConsentService {
             const fieldName = await getDelegationFieldName(this.env.DELEGATION_STORAGE);
             // Get userDID from session or generate new ephemeral DID
             // Phase 4 PR #3: Use OAuth identity if provided in approval request
+            // CRITICAL: Must work with or without OAuth identity
             let userDid;
             if (this.env.DELEGATION_STORAGE && request.session_id) {
                 try {
-                    // Pass OAuth identity if available in approval request
-                    userDid = await this.getUserDidForSession(request.session_id, request.oauth_identity);
+                    console.log("[ConsentService] Getting User DID for session:", {
+                        sessionId: request.session_id.substring(0, 20) + "...",
+                        hasOAuthIdentity: !!request.oauth_identity,
+                        oauthProvider: request.oauth_identity?.provider,
+                    });
+                    // Pass OAuth identity if available in approval request (can be null/undefined)
+                    userDid = await this.getUserDidForSession(request.session_id, request.oauth_identity || undefined // Explicitly handle null as undefined
+                    );
+                    console.log("[ConsentService] User DID retrieved:", {
+                        userDid: userDid?.substring(0, 20) + "...",
+                        hasUserDid: !!userDid,
+                    });
                 }
                 catch (error) {
-                    console.warn("[ConsentService] Failed to get/generate userDid:", error);
-                    // Continue without userDid - delegation will use ephemeral placeholder
+                    console.error("[ConsentService] Failed to get/generate userDid:", error);
+                    // Continue without userDid - delegation will work without user_identifier
+                    // This is valid for non-OAuth scenarios
                 }
             }
+            else {
+                console.log("[ConsentService] Skipping User DID retrieval:", {
+                    hasStorage: !!this.env.DELEGATION_STORAGE,
+                    hasSessionId: !!request.session_id,
+                });
+            }
             const expiresInDays = 7; // Default to 7 days
             // Build delegation request with error-based format detection
             // Try full format first, fallback to simplified format on error
@@ -629,10 +1914,6 @@ export class ConsentService {
             // Error-based format detection: try request format, fallback on error
             const response = await this.tryAPICall(agentShieldUrl, apiKey, delegationRequest);
             if (!response.success) {
-                console.error("[ConsentService] Delegation creation failed:", {
-                    error: response.error,
-                    error_code: response.error_code,
-                });
                 return response;
             }
             const responseData = response.data;
@@ -825,10 +2106,14 @@ export class ConsentService {
             scopes: request.scopes,
             expires_in_days: expiresInDays,
         };
-        // Note: session_id and project_id are NOT in createDelegationSchema
-        // - project_id is extracted from API key context by AgentShield middleware
-        // - session_id is not needed for delegation creation
-        // These fields are removed to match AgentShield API schema exactly
+        // Include session_id if provided
+        if (request.session_id) {
+            baseRequest.session_id = request.session_id;
+        }
+        // Include project_id if provided
+        if (request.project_id) {
+            baseRequest.project_id = request.project_id;
+        }
         // Check cached format preference
         const cacheKey = STORAGE_KEYS.formatPreference();
         let cachedFormat = null;
@@ -864,13 +2149,15 @@ export class ConsentService {
      */
     async buildFullFormatRequest(request, userDid, expiresInDays) {
         const notAfter = Date.now() + expiresInDays * 24 * 60 * 60 * 1000;
+        // Defensive check: ensure scopes is always defined (should be guaranteed by validation)
+        const scopes = request.scopes ?? [];
         return {
             delegation: {
                 id: crypto.randomUUID(),
                 issuerDid: userDid || "did:key:z6MkEphemeral", // Use ephemeral if no userDid
                 subjectDid: request.agent_did,
                 constraints: {
-                    scopes: request.scopes,
+                    scopes,
                     notAfter,
                     notBefore: Date.now(),
                 },
@@ -895,33 +2182,56 @@ export class ConsentService {
     }
     /**
      * Build simplified format request with proper field name
+     *
+     * CRITICAL: This method MUST NOT include session_id or project_id in the request body.
+     * These fields are NOT part of AgentShield's createDelegationSchema:
+     * - project_id is extracted from API key context by AgentShield middleware
+     * - session_id is not needed for delegation creation
+     *
+     * Including these fields will cause validation errors (400 Bad Request).
      */
     buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName) {
+        // Build request with ONLY fields that are in AgentShield's schema
+        // Defensive check: ensure scopes is always defined (should be guaranteed by validation)
+        const scopes = request.scopes ?? [];
         const simplifiedRequest = {
             agent_did: request.agent_did,
-            scopes: request.scopes,
+            scopes,
             expires_in_days: expiresInDays,
         };
         // Include user_identifier if we have userDid (matches AgentShield schema)
-        // Note: session_id and project_id are NOT in createDelegationSchema
-        // - project_id is extracted from API key context by AgentShield
-        // - session_id is not needed for delegation creation
+        // CRITICAL: user_identifier is optional - delegation works without it
         if (userDid) {
             simplifiedRequest.user_identifier = userDid;
-            // Use the correct field name (metadata or custom_fields) from Day0 config
-            simplifiedRequest[fieldName] = {
+            console.log("[ConsentService] Including user_identifier in delegation request:", {
+                userDid: userDid.substring(0, 20) + "...",
+            });
+        }
+        else {
+            console.log("[ConsentService] No user_identifier (no OAuth or ephemeral DID) - delegation will proceed without it");
+        }
+        // AgentShield API only accepts "custom_fields", not "metadata"
+        // Always use "custom_fields" regardless of Day0 config
+        if (userDid) {
+            // Include issuer_did and subject_did in custom_fields when we have userDid
+            simplifiedRequest.custom_fields = {
                 issuer_did: userDid,
                 subject_did: request.agent_did,
                 format_version: "simplified_v1",
+                // Merge with any existing custom_fields from request
+                ...(request.customFields || {}),
             };
         }
-        // Include custom_fields from request if provided
-        if (request.customFields && Object.keys(request.customFields).length > 0) {
-            simplifiedRequest.custom_fields = {
-                ...(simplifiedRequest.custom_fields || {}),
-                ...request.customFields,
-            };
+        else if (request.customFields &&
+            Object.keys(request.customFields).length > 0) {
+            // Include custom_fields from request even if no userDid
+            simplifiedRequest.custom_fields = request.customFields;
         }
+        // If no userDid and no customFields, custom_fields is omitted (valid)
+        // EXPLICIT SAFEGUARD: Remove session_id and project_id if they somehow got added
+        // This should never happen, but provides defense-in-depth
+        delete simplifiedRequest.session_id;
+        delete simplifiedRequest.project_id;
         return simplifiedRequest;
     }
     /**
@@ -951,25 +2261,31 @@ export class ConsentService {
     }
     /**
      * Make API call and parse response
+     *
+     * CRITICAL: This method ensures session_id and project_id are never sent to AgentShield.
+     * These fields are NOT part of the createDelegationSchema and will cause validation errors.
      */
     async makeAPICall(agentShieldUrl, apiKey, requestBody) {
         try {
-            const url = `${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`;
-            const requestId = crypto.randomUUID();
-            console.log("[ConsentService] Making API call:", {
-                url,
-                method: "POST",
-                requestId,
-                bodyKeys: Object.keys(requestBody),
-            });
-            const response = await fetch(url, {
+            // FINAL SAFEGUARD: Remove session_id and project_id if they somehow got added
+            // This provides defense-in-depth protection
+            const sanitizedBody = { ...requestBody };
+            if ("session_id" in sanitizedBody) {
+                console.warn("[ConsentService] ⚠️ session_id detected in request body - removing (not in schema)");
+                delete sanitizedBody.session_id;
+            }
+            if ("project_id" in sanitizedBody) {
+                console.warn("[ConsentService] ⚠️ project_id detected in request body - removing (not in schema)");
+                delete sanitizedBody.project_id;
+            }
+            const response = await fetch(`${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`, {
                 method: "POST",
                 headers: {
-                    "X-API-Key": apiKey,
+                    Authorization: `Bearer ${apiKey}`,
                     "Content-Type": "application/json",
-                    "X-Request-ID": requestId,
+                    "X-Request-ID": crypto.randomUUID(),
                 },
-                body: JSON.stringify(requestBody),
+                body: JSON.stringify(sanitizedBody),
             });
             const responseText = await response.text();
             let responseData;
@@ -979,22 +2295,17 @@ export class ConsentService {
             catch {
                 responseData = responseText;
             }
-            console.log("[ConsentService] API response:", {
-                status: response.status,
-                statusText: response.statusText,
-                responseData: typeof responseData === "string"
-                    ? responseData.substring(0, 200)
-                    : JSON.stringify(responseData).substring(0, 200),
-            });
             // Check for validation error specifically
             if (response.status === 400) {
-                const errorMessage = responseData
-                    ?.error?.message ||
-                    responseData?.message ||
-                    "Validation failed";
-                if (errorMessage.includes("format") ||
+                const errorData = responseData;
+                const errorMessage = errorData.error?.message || errorData.message || "Validation failed";
+                const errorCode = errorData.error_code || errorData.error?.code;
+                // Check if error_code is explicitly set to "validation_error" OR error message suggests validation error
+                if (errorCode === "validation_error" ||
+                    errorMessage.includes("format") ||
                     errorMessage.includes("schema") ||
-                    errorMessage.includes("invalid")) {
+                    errorMessage.includes("invalid") ||
+                    errorMessage.includes("Validation")) {
                     return {
                         success: false,
                         error: errorMessage,