@kya-os/mcp-i-cloudflare 1.5.8-canary.7 → 1.5.8-canary.70

package/dist/services/consent.service.js

@@ -15,17 +15,169 @@ import { validateConsentApprovalRequest, } from "@kya-os/contracts/consent";
 import { AGENTSHIELD_ENDPOINTS, createDelegationAPIResponseSchema, createDelegationResponseSchema, } from "@kya-os/contracts/agentshield-api";
 import { UserDidManager } from "@kya-os/mcp-i-core";
 import { WebCryptoProvider } from "../providers/crypto";
+import { ConsentAuditService } from "./consent-audit.service";
+import { CloudflareProofGenerator } from "../proof-generator";
+import { ProofService } from "./proof.service";
+import { fetchRemoteConfig } from "@kya-os/mcp-i-core";
 export class ConsentService {
     configService;
     renderer;
     env;
     runtime;
     userDidManager; // Cached instance for consistent DID generation
-    constructor(env, runtime) {
+    // ✅ Audit service - lazy initialized
+    auditService;
+    auditInitPromise; // Cache promise to prevent race conditions
+    // Phase 2: Provider resolution services (optional for backward compatibility)
+    providerResolver;
+    providerRegistry;
+    /**
+     * ✅ FIXED: Constructor takes env: CloudflareEnv, not config
+     * Phase 2: Optional providerResolver and providerRegistry for tool-specific providers
+     */
+    constructor(env, runtime, providerResolver, providerRegistry) {
         this.env = env;
         this.runtime = runtime;
         this.configService = new ConsentConfigService(env);
         this.renderer = new ConsentPageRenderer();
+        this.providerResolver = providerResolver;
+        this.providerRegistry = providerRegistry;
+        // No initialization here - keep constructor synchronous
+    }
+    /**
+     * Get or initialize audit service (lazy initialization)
+     *
+     * Fetches config from remote API when projectId is available.
+     * Uses promise caching to prevent race conditions.
+     *
+     * @param projectId - Project ID from consent request (required for config fetch)
+     */
+    async getAuditService(projectId) {
+        // Already initialized
+        if (this.auditService) {
+            return this.auditService;
+        }
+        // No runtime - audit not available
+        if (!this.runtime) {
+            return undefined;
+        }
+        // Initialization in progress - wait for it
+        if (this.auditInitPromise) {
+            await this.auditInitPromise;
+            return this.auditService;
+        }
+        // Start initialization (with projectId for config fetch)
+        this.auditInitPromise = this.initializeAuditService(projectId);
+        try {
+            await this.auditInitPromise;
+        }
+        catch (error) {
+            console.warn("[ConsentService] Audit service initialization failed:", error);
+            // Don't throw - audit failures shouldn't break consent flow
+        }
+        return this.auditService;
+    }
+    /**
+     * Initialize audit service - fetches config from remote API
+     *
+     * ⚠️ CRITICAL: Fetches config from remote API using fetchRemoteConfig()
+     * This is the ONLY way to get CloudflareRuntimeConfig per requirement.
+     */
+    async initializeAuditService(projectId) {
+        if (!this.runtime) {
+            return;
+        }
+        try {
+            // ✅ CRITICAL: Fetch config from remote API
+            const config = await this.getConfigFromRemoteAPI(projectId);
+            if (!config?.proofing?.enabled) {
+                console.log("[ConsentService] Proofing not enabled in remote config");
+                return; // Proofing not enabled
+            }
+            // Get identity (async - requires runtime to be initialized)
+            const identity = await this.runtime.getIdentity();
+            // ✅ FIXED: CloudflareProofGenerator only takes identity, not providers
+            const proofGenerator = new CloudflareProofGenerator(identity);
+            // Get audit logger
+            const auditLogger = this.runtime.getAuditLogger();
+            if (!auditLogger) {
+                console.warn("[ConsentService] AuditLogger not available");
+                return;
+            }
+            // Create audit service with fetched config
+            this.auditService = new ConsentAuditService(new ProofService(config, this.runtime), auditLogger, proofGenerator, config, // ✅ Config fetched from remote API
+            this.runtime);
+            console.log("[ConsentService] Audit service initialized successfully");
+        }
+        catch (error) {
+            console.error("[ConsentService] Failed to initialize audit service:", error);
+            // Don't throw - audit failures shouldn't break consent flow
+        }
+    }
+    /**
+     * Fetch CloudflareRuntimeConfig from remote API (AgentShield)
+     *
+     * ⚠️ CRITICAL: Config MUST be fetched from remote API, not constructed from env.
+     *
+     * Uses existing `fetchRemoteConfig()` from `@kya-os/mcp-i-core/config/remote-config`
+     * which handles caching, error handling, and API communication.
+     *
+     * @param projectId - Project ID from consent request
+     * @returns Runtime config or undefined if unavailable
+     */
+    async getConfigFromRemoteAPI(projectId) {
+        if (!this.env.AGENTSHIELD_API_KEY) {
+            console.warn("[ConsentService] No API key for runtime config fetch");
+            return undefined;
+        }
+        try {
+            // Create KV cache adapter
+            const cache = this.env.TOOL_PROTECTION_KV
+                ? {
+                    get: async (key) => {
+                        return ((await this.env.TOOL_PROTECTION_KV.get(key, "text")) || null);
+                    },
+                    set: async (key, value, ttl) => {
+                        await this.env.TOOL_PROTECTION_KV.put(key, value, {
+                            expirationTtl: Math.floor(ttl / 1000),
+                        });
+                    },
+                }
+                : undefined;
+            const config = await fetchRemoteConfig({
+                apiUrl: this.env.AGENTSHIELD_API_URL || "https://kya.vouched.id",
+                apiKey: this.env.AGENTSHIELD_API_KEY,
+                projectId, // ✅ Use projectId from consent request
+                cacheTtl: 300000, // 5 minutes
+                fetchProvider: fetch,
+            }, cache);
+            // Populate serverDid from runtime identity if missing or empty
+            // This prevents AgentShield validation errors (serverDid must be at least 1 character)
+            // Note: MCPIConfig.identity is RuntimeIdentityConfig (no serverDid), but AgentShield
+            // may return MCPIServerConfig format (has serverDid). We need to handle both.
+            if (config && config.identity) {
+                const identityConfig = config.identity; // Type assertion for serverDid field
+                if (!identityConfig.serverDid || identityConfig.serverDid === "") {
+                    try {
+                        const runtimeIdentity = await this.runtime?.getIdentity();
+                        if (runtimeIdentity?.did) {
+                            identityConfig.serverDid = runtimeIdentity.did;
+                            console.log("[ConsentService] Populated serverDid from runtime identity");
+                        }
+                    }
+                    catch (error) {
+                        console.warn("[ConsentService] Failed to get runtime identity for serverDid:", error);
+                    }
+                }
+            }
+            // fetchRemoteConfig returns MCPIConfig | null
+            // CloudflareRuntimeConfig extends MCPIConfig, so cast is safe
+            return config;
+        }
+        catch (error) {
+            console.warn("[ConsentService] Error fetching runtime config:", error);
+            return undefined;
+        }
     }
     /**
      * Get or generate User DID for a session
@@ -37,10 +189,20 @@ export class ConsentService {
      * @param oauthIdentity - Optional OAuth provider identity
      * @returns User DID (did:key format)
      */
+    /**
+     * Get user DID for a session
+     *
+     * Public method to retrieve user DID from session storage or OAuth identity mapping.
+     * Used by OAuth handler to get userDid when OAuth linking fails.
+     *
+     * @param sessionId - Session ID
+     * @param oauthIdentity - Optional OAuth provider identity
+     * @returns User DID (did:key format)
+     */
     async getUserDidForSession(sessionId, oauthIdentity) {
         // Handle null explicitly (from JSON parsing)
         const hasOAuthIdentity = oauthIdentity &&
-            typeof oauthIdentity === 'object' &&
+            typeof oauthIdentity === "object" &&
             oauthIdentity.provider &&
             oauthIdentity.subject;
         // If OAuth identity provided, check for existing mapping first
@@ -108,10 +270,34 @@ export class ConsentService {
                     delete: async (key) => {
                         await this.env.DELEGATION_STORAGE.delete(`userDid:${key}`);
                     },
+                    // OAuth-based lookup for persistent user DID
+                    getByOAuth: async (provider, subject) => {
+                        try {
+                            const oauthKey = STORAGE_KEYS.oauthIdentity(provider, subject);
+                            const userDid = await this.env.DELEGATION_STORAGE.get(oauthKey, "text");
+                            return userDid || null;
+                        }
+                        catch {
+                            return null;
+                        }
+                    },
+                    // OAuth-based storage for persistent user DID mapping
+                    setByOAuth: async (provider, subject, did, ttl) => {
+                        try {
+                            const oauthKey = STORAGE_KEYS.oauthIdentity(provider, subject);
+                            await this.env.DELEGATION_STORAGE.put(oauthKey, did, {
+                                expirationTtl: ttl || 90 * 24 * 60 * 60, // Default 90 days for persistent mapping
+                            });
+                        }
+                        catch (error) {
+                            console.warn("[ConsentService] Failed to store OAuth mapping:", error);
+                            throw error;
+                        }
+                    },
                 },
             });
         }
-        const userDid = await this.userDidManager.getOrCreateUserDid(sessionId);
+        const userDid = await this.userDidManager.getOrCreateUserDid(sessionId, oauthIdentity);
         // Cache in session storage
         try {
             const existingSession = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
@@ -136,13 +322,45 @@ export class ConsentService {
      *
      * @param projectId - Project ID to check
      * @param oauthIdentity - Optional OAuth identity from cookie
+     * @param toolOAuthProvider - Optional tool-specific OAuth provider (takes precedence)
      * @returns True if OAuth redirect is required
      */
-    async isOAuthRequired(projectId, oauthIdentity) {
+    async isOAuthRequired(projectId, oauthIdentity, toolOAuthProvider, toolProtection) {
         // If OAuth identity is already present, OAuth is not required
         if (oauthIdentity && oauthIdentity.provider && oauthIdentity.subject) {
             return false;
         }
+        // If tool specifically requires an OAuth provider, it's required immediately
+        if (toolOAuthProvider) {
+            return true;
+        }
+        // Phase 2: If toolOAuthProvider is undefined but tool requires delegation,
+        // use ProviderResolver to check if a provider can be resolved
+        if (!toolOAuthProvider &&
+            toolProtection &&
+            toolProtection.requiresDelegation) {
+            if (this.providerResolver) {
+                try {
+                    const resolvedProvider = await this.providerResolver.resolveProvider(toolProtection, projectId);
+                    if (resolvedProvider) {
+                        console.log("[ConsentService] OAuth required: ProviderResolver resolved provider", {
+                            projectId,
+                            provider: resolvedProvider,
+                            toolRequiresDelegation: toolProtection.requiresDelegation,
+                            hasToolOAuthProvider: !!toolOAuthProvider,
+                        });
+                        return true;
+                    }
+                }
+                catch (error) {
+                    // ProviderResolver failed - log but continue to fallback check
+                    console.warn("[ConsentService] ProviderResolver failed to resolve provider, falling back to project config check:", {
+                        projectId,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+        }
         // Check project config to see if OAuth is configured
         try {
             const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
@@ -181,34 +399,197 @@ export class ConsentService {
      * Creates the OAuth authorization URL with proper state parameter
      * for redirecting to OAuth provider.
      *
+     * ✅ CSRF Protection: If oauthSecurityService is provided, state is stored securely
+     * in KV storage and validated on callback. Otherwise, falls back to base64-encoded
+     * state (less secure, but backward compatible).
+     *
      * @param projectId - Project ID
      * @param agentDid - Agent DID
      * @param sessionId - Session ID
      * @param scopes - Requested scopes
      * @param serverUrl - Server URL for callback
+     * @param oauthSecurityService - Optional OAuthSecurityService for CSRF protection
      * @returns OAuth authorization URL
      */
-    buildOAuthUrl(projectId, agentDid, sessionId, scopes, serverUrl) {
+    async buildOAuthUrl(projectId, agentDid, sessionId, scopes, serverUrl, provider, // Phase 2: Optional provider name (resolved if not provided)
+    oauthSecurityService) {
         const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
         // Generate a temporary delegation ID for state (will be created after OAuth)
         const delegationId = `temp-${Date.now()}`;
-        // Build state parameter with required fields
-        const state = {
+        // ✅ Phase 1: Generate PKCE challenge if OAuthSecurityService is available
+        let codeVerifier;
+        let codeChallenge;
+        if (oauthSecurityService) {
+            try {
+                const pkceChallenge = await oauthSecurityService.generatePKCEChallenge();
+                codeVerifier = pkceChallenge.verifier;
+                codeChallenge = pkceChallenge.challenge;
+            }
+            catch (error) {
+                console.warn("[ConsentService] Failed to generate PKCE challenge:", error);
+            }
+        }
+        // Build state data with required fields
+        const stateData = {
             project_id: projectId,
             agent_did: agentDid,
             session_id: sessionId,
             delegation_id: delegationId,
             scopes: scopes,
+            storedAt: Date.now(),
         };
-        // Encode state as base64 (Cloudflare Workers compatible)
-        const stateParam = btoa(JSON.stringify(state));
-        // Build OAuth authorization URL
+        // Store PKCE code_verifier in state for token exchange
+        if (codeVerifier) {
+            stateData.code_verifier = codeVerifier;
+            stateData.code_challenge = codeChallenge;
+            stateData.redirect_uri = `${serverUrl}/oauth/callback`;
+        }
+        let stateParam;
+        if (oauthSecurityService && this.env.DELEGATION_STORAGE) {
+            // ✅ CSRF Protection: Generate secure random state value and store state data securely
+            const randomBytes = crypto.getRandomValues(new Uint8Array(32));
+            const stateValue = btoa(String.fromCharCode(...randomBytes))
+                .replace(/\+/g, "-")
+                .replace(/\//g, "_")
+                .replace(/=/g, "");
+            // Store state data securely in KV (10 minute TTL for OAuth flow)
+            await oauthSecurityService.storeOAuthState(stateValue, stateData, 600);
+            stateParam = stateValue;
+            console.log("[ConsentService] 🔒 SECURITY EVENT: OAuth state stored securely:", {
+                projectId,
+                agentDid: agentDid.substring(0, 20) + "...",
+                sessionId: sessionId.substring(0, 20) + "...",
+                stateValue: stateValue.substring(0, 20) + "...",
+                timestamp: new Date().toISOString(),
+                eventType: "oauth_state_stored",
+                ttl: 600,
+            });
+        }
+        else {
+            // Fallback: Encode state as base64 (less secure, but backward compatible)
+            if (!oauthSecurityService) {
+                console.warn("[ConsentService] ⚠️ SECURITY WARNING: OAuthSecurityService not provided, using insecure state encoding");
+            }
+            stateParam = btoa(JSON.stringify(stateData));
+        }
+        // Phase 3: Resolve provider config and extract custom parameters
+        let providerConfig = null;
+        if (provider && this.providerRegistry) {
+            providerConfig = this.providerRegistry.getProvider(provider);
+        }
+        // Phase 3: Check if we should use direct OAuth URL (bypass AgentShield bouncer)
+        // This is for custom providers that need direct OAuth URLs
+        if (providerConfig &&
+            providerConfig.proxyMode === true &&
+            !providerConfig.supportsPKCE) {
+            // Use providerConfig.clientId for custom providers, not projectId
+            const oauthClientId = providerConfig.clientId || projectId;
+            return this.buildDirectOAuthUrl(providerConfig, oauthClientId, `${serverUrl}/oauth/callback`, scopes, stateParam, codeChallenge);
+        }
+        // Phase 3: Validate custom parameters don't conflict with reserved parameters
+        const RESERVED_PARAMS = [
+            "response_type",
+            "client_id",
+            "redirect_uri",
+            "scope",
+            "state",
+            "code_challenge",
+            "code_challenge_method",
+        ];
+        if (providerConfig?.customParams) {
+            for (const [key, value] of Object.entries(providerConfig.customParams)) {
+                const normalizedKey = key.toLowerCase();
+                if (RESERVED_PARAMS.includes(normalizedKey)) {
+                    throw new Error(`Custom parameter "${key}" conflicts with reserved OAuth parameter. Reserved parameters: ${RESERVED_PARAMS.join(", ")}`);
+                }
+                // Validate value is a string before calling string methods
+                if (typeof value !== "string") {
+                    throw new Error(`Custom parameter "${key}" must be a string, got ${typeof value}`);
+                }
+                if (!value || value.trim().length === 0) {
+                    throw new Error(`Custom parameter "${key}" has empty value`);
+                }
+            }
+        }
+        // Build OAuth authorization URL (AgentShield bouncer endpoint)
         const oauthUrl = new URL(`${agentShieldUrl}/bouncer/oauth/authorize`);
         oauthUrl.searchParams.set("response_type", "code");
         oauthUrl.searchParams.set("client_id", projectId); // Use projectId as client_id
         oauthUrl.searchParams.set("redirect_uri", `${serverUrl}/oauth/callback`);
         oauthUrl.searchParams.set("scope", scopes.join(" "));
         oauthUrl.searchParams.set("state", stateParam);
+        // ✅ Phase 1: Add PKCE challenge to authorization URL if available
+        if (codeChallenge) {
+            oauthUrl.searchParams.set("code_challenge", codeChallenge);
+            oauthUrl.searchParams.set("code_challenge_method", "S256");
+        }
+        // Phase 3: Inject custom parameters (after standard params, before PKCE params)
+        if (providerConfig?.customParams) {
+            for (const [key, value] of Object.entries(providerConfig.customParams)) {
+                oauthUrl.searchParams.set(key, value);
+            }
+        }
+        return oauthUrl.toString();
+    }
+    /**
+     * Build direct OAuth URL (bypasses AgentShield bouncer endpoint)
+     *
+     * Used for custom providers that need direct OAuth URLs (e.g., self-hosted OAuth servers).
+     * Triggered when providerConfig.proxyMode === true && !providerConfig.supportsPKCE
+     *
+     * @param providerConfig - Provider configuration
+     * @param clientId - OAuth client ID
+     * @param redirectUri - Redirect URI for OAuth callback
+     * @param scopes - Requested scopes
+     * @param state - OAuth state parameter
+     * @param codeChallenge - Optional PKCE code challenge
+     * @returns Direct OAuth authorization URL
+     */
+    buildDirectOAuthUrl(providerConfig, clientId, redirectUri, scopes, state, codeChallenge) {
+        // Validate custom parameters don't conflict with reserved parameters
+        const RESERVED_PARAMS = [
+            "response_type",
+            "client_id",
+            "redirect_uri",
+            "scope",
+            "state",
+            "code_challenge",
+            "code_challenge_method",
+        ];
+        if (providerConfig.customParams) {
+            for (const [key, value] of Object.entries(providerConfig.customParams)) {
+                const normalizedKey = key.toLowerCase();
+                if (RESERVED_PARAMS.includes(normalizedKey)) {
+                    throw new Error(`Custom parameter "${key}" conflicts with reserved OAuth parameter. Reserved parameters: ${RESERVED_PARAMS.join(", ")}`);
+                }
+                // Validate value is a string before calling string methods
+                if (typeof value !== "string") {
+                    throw new Error(`Custom parameter "${key}" must be a string, got ${typeof value}`);
+                }
+                if (!value || value.trim().length === 0) {
+                    throw new Error(`Custom parameter "${key}" has empty value`);
+                }
+            }
+        }
+        // Build OAuth URL directly to provider's authorization endpoint
+        const oauthUrl = new URL(providerConfig.authorizationUrl);
+        // Include standard OAuth params
+        oauthUrl.searchParams.set("response_type", providerConfig.responseType || "code");
+        oauthUrl.searchParams.set("client_id", clientId);
+        oauthUrl.searchParams.set("redirect_uri", redirectUri);
+        oauthUrl.searchParams.set("scope", scopes.join(" "));
+        oauthUrl.searchParams.set("state", state);
+        // Include PKCE params if supported and challenge provided
+        if (providerConfig.supportsPKCE && codeChallenge) {
+            oauthUrl.searchParams.set("code_challenge", codeChallenge);
+            oauthUrl.searchParams.set("code_challenge_method", "S256");
+        }
+        // Include custom parameters (after standard params, before PKCE params)
+        if (providerConfig.customParams) {
+            for (const [key, value] of Object.entries(providerConfig.customParams)) {
+                oauthUrl.searchParams.set(key, value);
+            }
+        }
         return oauthUrl.toString();
     }
     /**
@@ -404,18 +785,85 @@ export class ConsentService {
                 // Non-fatal - continue without OAuth identity
             }
             // Check if OAuth is required (after extracting OAuth identity)
-            const oauthRequired = await this.isOAuthRequired(projectId, oauthIdentity);
+            // Check both project-level config AND tool-specific protection
+            const toolProtectionService = this.runtime?.config
+                ?.toolProtectionService;
+            let toolOAuthProvider;
+            let protection;
+            if (toolProtectionService && this.runtime) {
+                const agentDidObj = await this.runtime.getIdentity();
+                protection = await toolProtectionService.checkToolProtection(tool, agentDidObj.did);
+                toolOAuthProvider = protection?.oauthProvider;
+            }
+            const oauthRequired = await this.isOAuthRequired(projectId, oauthIdentity, toolOAuthProvider, protection);
+            // Phase 2: Resolve provider for tool if providerResolver is available
+            let provider;
+            if (this.providerResolver && this.runtime) {
+                try {
+                    const agentDidObj = await this.runtime.getIdentity();
+                    const toolProtectionService = this.runtime.config
+                        ?.toolProtectionService;
+                    if (toolProtectionService) {
+                        const protection = await toolProtectionService.checkToolProtection(tool, agentDidObj.did);
+                        if (protection) {
+                            provider = await this.providerResolver.resolveProvider(protection, projectId);
+                        }
+                    }
+                }
+                catch (error) {
+                    // Non-fatal - continue without provider info
+                    console.warn("[ConsentService] Failed to resolve provider for consent page:", error);
+                }
+            }
+            let resolvedOAuthUrl;
+            let isOAuthRequired = false;
             if (oauthRequired) {
                 // OAuth is required - redirect to OAuth provider instead of showing consent page
-                const oauthUrl = this.buildOAuthUrl(projectId, agentDid, sessionId, scopes, serverUrl);
-                console.log("[ConsentService] OAuth required, redirecting to OAuth provider:", {
+                // Note: oauthSecurityService is optional - if not provided, falls back to insecure encoding
+                const oauthSecurityService = this.env.DELEGATION_STORAGE
+                    ? new (await import("./oauth-security.service")).OAuthSecurityService(this.env.DELEGATION_STORAGE, this.env.OAUTH_ENCRYPTION_SECRET)
+                    : undefined;
+                // Build OAuth URL for redirection
+                // Note: We're building it here, but we'll pass it to the renderer
+                // instead of redirecting immediately, so the user sees the consent page first.
+                resolvedOAuthUrl = await this.buildOAuthUrl(projectId, agentDid, sessionId, scopes, serverUrl, undefined, // provider - will be resolved by ProviderResolver if available
+                oauthSecurityService);
+                isOAuthRequired = true;
+                console.log("[ConsentService] 🔒 SECURITY EVENT: OAuth required, preparing consent page with redirect:", {
                     projectId,
                     agentDid: agentDid.substring(0, 20) + "...",
-                    oauthUrl: oauthUrl.substring(0, 100) + "...",
+                    oauthUrl: resolvedOAuthUrl.substring(0, 100) + "...",
+                    hasSecureState: !!oauthSecurityService,
+                    timestamp: new Date().toISOString(),
+                    eventType: "oauth_redirect_prepared",
+                });
+            }
+            // ✅ Lazy initialization with projectId
+            const auditService = await this.getAuditService(projectId);
+            // Log page view event (if audit service available)
+            if (auditService) {
+                await auditService
+                    .logConsentPageView({
+                    sessionId,
+                    agentDid,
+                    targetTools: [tool], // Wrap in array
+                    scopes,
+                    projectId,
+                    // oauthProvider: provider, // TODO: Enable logging of resolved provider once type is updated
+                })
+                    .catch((err) => {
+                    // Structured error logging
+                    console.error("[ConsentService] Audit logging failed", {
+                        eventType: "consent:page_viewed",
+                        sessionId,
+                        error: err instanceof Error ? err.message : String(err),
+                        stack: err instanceof Error ? err.stack : undefined,
+                    });
+                    // Don't throw - audit failures shouldn't break consent flow
                 });
-                return Response.redirect(oauthUrl, 302);
             }
             // Build consent page config
+            // Type assertion to handle updated schema before rebuild
             const pageConfig = {
                 tool,
                 toolDescription,
@@ -424,10 +872,14 @@ export class ConsentService {
                 sessionId,
                 projectId,
                 serverUrl,
+                provider, // Phase 2: Include provider if resolved
                 branding: consentConfig.branding,
                 terms: consentConfig.terms,
                 customFields: consentConfig.customFields,
                 autoClose: consentConfig.ui?.autoClose,
+                // Pass OAuth details for client-side handling
+                oauthRequired: isOAuthRequired,
+                oauthUrl: resolvedOAuthUrl,
             };
             // Render page with OAuth identity (if available)
             const html = this.renderer.render(pageConfig, oauthIdentity);
@@ -451,6 +903,1079 @@ export class ConsentService {
             });
         }
     }
+    /**
+     * Parse request body from JSON or FormData
+     *
+     * Handles both JSON and FormData/multipart requests, converting
+     * FormData fields to the correct format for ConsentApprovalRequest.
+     *
+     * @param request - Request to parse
+     * @returns Parsed body object
+     */
+    async parseRequestBody(request) {
+        const contentType = request.headers.get("content-type") || "";
+        // Helper function to parse form fields into body object
+        const parseFormFields = (entries) => {
+            const body = {};
+            for (const [key, value] of entries) {
+                // Handle special fields that need parsing
+                if (key === "scopes" || key === "scopes[]") {
+                    // Scopes come as JSON string
+                    try {
+                        body["scopes"] = JSON.parse(value);
+                    }
+                    catch {
+                        // If not JSON, treat as single scope or array
+                        body["scopes"] = value.includes(",") ? value.split(",") : [value];
+                    }
+                }
+                else if (key === "oauth_identity" || key === "oauth_identity_json") {
+                    // OAuth identity comes as JSON string
+                    try {
+                        const parsed = JSON.parse(value);
+                        body["oauth_identity"] = parsed || null;
+                    }
+                    catch {
+                        // Invalid JSON, set to null
+                        body["oauth_identity"] = null;
+                    }
+                }
+                else if (key === "termsAccepted") {
+                    // Convert checkbox values to boolean
+                    body[key] =
+                        value === "on" ||
+                            value === "true" ||
+                            value === "1" ||
+                            value === "yes";
+                }
+                else if (key === "customFields") {
+                    // Custom fields come as JSON string
+                    try {
+                        body[key] = JSON.parse(value);
+                    }
+                    catch {
+                        // If not JSON, skip
+                    }
+                }
+                else {
+                    // Regular string fields
+                    body[key] = value;
+                }
+            }
+            // Default termsAccepted to true if not provided (common for checkboxes)
+            if (!("termsAccepted" in body)) {
+                body.termsAccepted = true;
+            }
+            // Default scopes to empty array if not provided (required by schema but can be empty)
+            if (!("scopes" in body)) {
+                body.scopes = [];
+            }
+            return body;
+        };
+        // Parse URL-encoded form data (application/x-www-form-urlencoded)
+        // When Content-Type is URL-encoded but FormData object is passed, try FormData parsing first
+        if (contentType.includes("application/x-www-form-urlencoded")) {
+            // Try FormData parsing first (FormData object might have been passed)
+            try {
+                const clonedRequest = request.clone();
+                const formData = await clonedRequest.formData();
+                const body = {};
+                let hasValidFields = false;
+                // Check if FormData parsing returned malformed data (entire multipart body as single entry)
+                // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                const entriesArray = Array.from(formData.entries());
+                if (entriesArray.length === 1 &&
+                    typeof entriesArray[0][0] === "string" &&
+                    entriesArray[0][0].includes("Content-Disposition") &&
+                    typeof entriesArray[0][1] === "string" &&
+                    entriesArray[0][1].toString().includes("Content-Disposition")) {
+                    // Manually parse multipart format from the value string
+                    // The key contains the first boundary and Content-Disposition header start
+                    // The value contains the rest of the first field and all subsequent fields
+                    const keyPart = entriesArray[0][0];
+                    const valuePart = entriesArray[0][1];
+                    // Fix: If key ends with "name" and value starts with '"fieldname"', combine them
+                    let multipartBody;
+                    if (keyPart.trim().endsWith("name") &&
+                        valuePart.trim().startsWith('"')) {
+                        // Key ends with "name", value starts with '"fieldname"', combine with = between them
+                        multipartBody = keyPart + "=" + valuePart;
+                    }
+                    else {
+                        multipartBody = keyPart + valuePart;
+                    }
+                    // Match: Content-Disposition header with field name, then capture value until next boundary or end
+                    const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                    let match;
+                    while ((match = fieldRegex.exec(multipartBody)) !== null) {
+                        const fieldName = match[1];
+                        const fieldValue = match[2].trim(); // Remove trailing newlines
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(fieldValue);
+                            }
+                            catch {
+                                body["scopes"] = fieldValue.includes(",")
+                                    ? fieldValue.split(",")
+                                    : [fieldValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                fieldValue === "on" ||
+                                    fieldValue === "true" ||
+                                    fieldValue === "1" ||
+                                    fieldValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(fieldValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = fieldValue;
+                        }
+                        hasValidFields = true;
+                    }
+                }
+                else {
+                    // Normal FormData parsing
+                    // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                    for (const [key, value] of formData.entries()) {
+                        if (value instanceof File) {
+                            continue;
+                        }
+                        // Extract field name from malformed keys (when FormData is passed with wrong Content-Type)
+                        let fieldName = key;
+                        if (key.includes("Content-Disposition") && key.includes('name="')) {
+                            // Extract field name from Content-Disposition header
+                            const nameMatch = key.match(/name="([^"]+)"/);
+                            if (nameMatch && nameMatch[1]) {
+                                fieldName = nameMatch[1];
+                            }
+                            else {
+                                // Skip if we can't extract a valid field name
+                                continue;
+                            }
+                        }
+                        else if (key.includes("------") ||
+                            key.includes("\r\n") ||
+                            key.trim() === "") {
+                            // Skip boundary strings and invalid keys
+                            continue;
+                        }
+                        hasValidFields = true;
+                        const stringValue = value.toString();
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                body["scopes"] = stringValue.includes(",")
+                                    ? stringValue.split(",")
+                                    : [stringValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(stringValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                stringValue === "on" ||
+                                    stringValue === "true" ||
+                                    stringValue === "1" ||
+                                    stringValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = stringValue;
+                        }
+                    }
+                }
+                if (hasValidFields && Object.keys(body).length > 0) {
+                    if (!("termsAccepted" in body)) {
+                        body.termsAccepted = true;
+                    }
+                    // Default scopes to empty array if not provided
+                    if (!("scopes" in body)) {
+                        body.scopes = [];
+                    }
+                    return body;
+                }
+            }
+            catch (formDataError) {
+                // FormData parsing failed, try URL-encoded text parsing
+                console.warn("[ConsentService] FormData parsing failed, trying URL-encoded text:", formDataError);
+            }
+            // Try URL-encoded text parsing as fallback
+            try {
+                const text = await request.clone().text();
+                const params = new URLSearchParams(text);
+                // Type assertion: URLSearchParams.entries() exists at runtime
+                return parseFormFields(params.entries());
+            }
+            catch (urlEncodedError) {
+                // Both failed, fall through to JSON parsing
+                console.warn("[ConsentService] URL-encoded parsing also failed:", urlEncodedError);
+            }
+        }
+        // Parse multipart FormData (multipart/form-data or when FormData object is passed with other Content-Type)
+        // Include text/plain here to handle cases where FormData is passed with mismatched Content-Type
+        if (contentType.includes("multipart/form-data") ||
+            contentType.includes("form") ||
+            contentType === "" ||
+            contentType.includes("text/plain") ||
+            contentType.includes("text")) {
+            // Check if multipart/form-data Content-Type is missing boundary
+            // If so, try to parse as text first (FormData might have been serialized incorrectly)
+            if (contentType.includes("multipart/form-data") &&
+                !contentType.includes("boundary=")) {
+                try {
+                    const textRequest = request.clone();
+                    const text = await textRequest.text();
+                    if (text && text.length > 0) {
+                        // Try to manually parse multipart format from text
+                        const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                        const body = {};
+                        let match;
+                        let hasValidFields = false;
+                        while ((match = fieldRegex.exec(text)) !== null) {
+                            const fieldName = match[1];
+                            const fieldValue = match[2].trim();
+                            if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                try {
+                                    body["scopes"] = JSON.parse(fieldValue);
+                                }
+                                catch {
+                                    body["scopes"] = fieldValue.includes(",")
+                                        ? fieldValue.split(",")
+                                        : [fieldValue];
+                                }
+                            }
+                            else if (fieldName === "oauth_identity" ||
+                                fieldName === "oauth_identity_json") {
+                                try {
+                                    body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                }
+                                catch {
+                                    body["oauth_identity"] = null;
+                                }
+                            }
+                            else if (fieldName === "termsAccepted") {
+                                body[fieldName] =
+                                    fieldValue === "on" ||
+                                        fieldValue === "true" ||
+                                        fieldValue === "1" ||
+                                        fieldValue === "yes";
+                            }
+                            else if (fieldName === "customFields") {
+                                try {
+                                    body[fieldName] = JSON.parse(fieldValue);
+                                }
+                                catch {
+                                    // Skip
+                                }
+                            }
+                            else {
+                                body[fieldName] = fieldValue;
+                            }
+                            hasValidFields = true;
+                        }
+                        if (hasValidFields && Object.keys(body).length > 0) {
+                            if (!("termsAccepted" in body)) {
+                                body.termsAccepted = true;
+                            }
+                            // Default scopes to empty array if not provided
+                            if (!("scopes" in body)) {
+                                body.scopes = [];
+                            }
+                            return body;
+                        }
+                    }
+                }
+                catch {
+                    // If text parsing fails, fall through to FormData parsing
+                }
+            }
+            try {
+                const clonedRequest = request.clone();
+                let formData;
+                try {
+                    formData = await clonedRequest.formData();
+                }
+                catch (formDataError) {
+                    // Handle FormData parsing errors (missing boundary, wrong Content-Type, etc.)
+                    const errorMessage = formDataError instanceof Error
+                        ? formDataError.message
+                        : String(formDataError);
+                    const errorCause = formDataError instanceof Error && "cause" in formDataError
+                        ? formDataError.cause instanceof Error
+                            ? formDataError.cause.message
+                            : String(formDataError.cause)
+                        : "";
+                    if (errorMessage.includes("missing boundary") ||
+                        errorMessage.includes("boundary") ||
+                        errorMessage.includes("Content-Type was not one of") ||
+                        errorCause.includes("missing boundary") ||
+                        errorCause.includes("boundary")) {
+                        // When boundary is missing, try to parse as URL-encoded form data instead
+                        // This handles the case where FormData was passed but Content-Type doesn't include boundary
+                        try {
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            // If text parsing succeeds, try URL-encoded parsing
+                            if (text && text.length > 0) {
+                                try {
+                                    const params = new URLSearchParams(text);
+                                    return parseFormFields(params.entries());
+                                }
+                                catch {
+                                    // If URL-encoded parsing fails, the text might be multipart format
+                                    // Try to manually parse multipart format from text
+                                    const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                    const body = {};
+                                    let match;
+                                    let hasValidFields = false;
+                                    while ((match = fieldRegex.exec(text)) !== null) {
+                                        const fieldName = match[1];
+                                        const fieldValue = match[2].trim();
+                                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                            try {
+                                                body["scopes"] = JSON.parse(fieldValue);
+                                            }
+                                            catch {
+                                                body["scopes"] = fieldValue.includes(",")
+                                                    ? fieldValue.split(",")
+                                                    : [fieldValue];
+                                            }
+                                        }
+                                        else if (fieldName === "oauth_identity" ||
+                                            fieldName === "oauth_identity_json") {
+                                            try {
+                                                body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                            }
+                                            catch {
+                                                body["oauth_identity"] = null;
+                                            }
+                                        }
+                                        else if (fieldName === "termsAccepted") {
+                                            body[fieldName] =
+                                                fieldValue === "on" ||
+                                                    fieldValue === "true" ||
+                                                    fieldValue === "1" ||
+                                                    fieldValue === "yes";
+                                        }
+                                        else if (fieldName === "customFields") {
+                                            try {
+                                                body[fieldName] = JSON.parse(fieldValue);
+                                            }
+                                            catch {
+                                                // Skip
+                                            }
+                                        }
+                                        else {
+                                            body[fieldName] = fieldValue;
+                                        }
+                                        hasValidFields = true;
+                                    }
+                                    if (hasValidFields && Object.keys(body).length > 0) {
+                                        if (!("termsAccepted" in body)) {
+                                            body.termsAccepted = true;
+                                        }
+                                        // Default scopes to empty array if not provided
+                                        if (!("scopes" in body)) {
+                                            body.scopes = [];
+                                        }
+                                        return body;
+                                    }
+                                }
+                            }
+                        }
+                        catch {
+                            // If all parsing attempts fail, rethrow the original error
+                        }
+                    }
+                    throw formDataError;
+                }
+                const body = {};
+                let hasValidFields = false;
+                // Check if FormData parsing returned malformed data (entire multipart body as single entry)
+                // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                const entriesArray = Array.from(formData.entries());
+                if (entriesArray.length === 1 &&
+                    typeof entriesArray[0][0] === "string" &&
+                    entriesArray[0][0].includes("Content-Disposition") &&
+                    typeof entriesArray[0][1] === "string" &&
+                    entriesArray[0][1].toString().includes("Content-Disposition")) {
+                    // Manually parse multipart format from the value string
+                    const keyPart = entriesArray[0][0];
+                    const valuePart = entriesArray[0][1];
+                    // Fix: If key ends with "name" and value starts with '"fieldname"', combine them
+                    let multipartBody;
+                    if (keyPart.trim().endsWith("name") &&
+                        valuePart.trim().startsWith('"')) {
+                        multipartBody = keyPart + "=" + valuePart;
+                    }
+                    else {
+                        multipartBody = keyPart + valuePart;
+                    }
+                    // Match: Content-Disposition header with field name, then capture value until next boundary or end
+                    const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                    let match;
+                    while ((match = fieldRegex.exec(multipartBody)) !== null) {
+                        const fieldName = match[1];
+                        const fieldValue = match[2].trim();
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(fieldValue);
+                            }
+                            catch {
+                                body["scopes"] = fieldValue.includes(",")
+                                    ? fieldValue.split(",")
+                                    : [fieldValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                fieldValue === "on" ||
+                                    fieldValue === "true" ||
+                                    fieldValue === "1" ||
+                                    fieldValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(fieldValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = fieldValue;
+                        }
+                        hasValidFields = true;
+                    }
+                }
+                else {
+                    // Normal FormData parsing
+                    // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                    for (const [key, value] of formData.entries()) {
+                        if (value instanceof File) {
+                            continue;
+                        }
+                        // Extract field name from malformed keys (when FormData is passed with wrong Content-Type)
+                        let fieldName = key;
+                        if (key.includes("Content-Disposition") && key.includes('name="')) {
+                            // Extract field name from Content-Disposition header
+                            const nameMatch = key.match(/name="([^"]+)"/);
+                            if (nameMatch && nameMatch[1]) {
+                                fieldName = nameMatch[1];
+                            }
+                            else {
+                                // Skip if we can't extract a valid field name
+                                continue;
+                            }
+                        }
+                        else if (key.includes("------") ||
+                            key.includes("\r\n") ||
+                            key.trim() === "") {
+                            // Skip boundary strings and invalid keys
+                            continue;
+                        }
+                        hasValidFields = true;
+                        const stringValue = value.toString();
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                body["scopes"] = stringValue.includes(",")
+                                    ? stringValue.split(",")
+                                    : [stringValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(stringValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                stringValue === "on" ||
+                                    stringValue === "true" ||
+                                    stringValue === "1" ||
+                                    stringValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = stringValue;
+                        }
+                    }
+                }
+                if (hasValidFields && Object.keys(body).length > 0) {
+                    if (!("termsAccepted" in body)) {
+                        body.termsAccepted = true;
+                    }
+                    // Default scopes to empty array if not provided
+                    if (!("scopes" in body)) {
+                        body.scopes = [];
+                    }
+                    return body;
+                }
+            }
+            catch (formDataError) {
+                console.warn("[ConsentService] FormData parsing failed:", formDataError);
+                // Fall through to JSON parsing
+            }
+        }
+        // Default to JSON parsing
+        try {
+            return await request.json();
+        }
+        catch (error) {
+            // If JSON parsing fails and content-type suggests form data, try FormData parsing as fallback
+            // Special handling for text/plain with FormData body - try text parsing first
+            if (contentType === "text/plain") {
+                try {
+                    const textRequest = request.clone();
+                    const text = await textRequest.text();
+                    if (text && text.length > 0) {
+                        // Try URL-encoded parsing first
+                        try {
+                            const params = new URLSearchParams(text);
+                            const body = parseFormFields(params.entries());
+                            if (Object.keys(body).length > 0) {
+                                return body;
+                            }
+                        }
+                        catch {
+                            // URL-encoded parsing failed, try multipart format
+                        }
+                        // Try multipart format parsing (FormData serializes to multipart)
+                        const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                        const body = {};
+                        let match;
+                        let hasValidFields = false;
+                        while ((match = fieldRegex.exec(text)) !== null) {
+                            const fieldName = match[1];
+                            const fieldValue = match[2].trim();
+                            if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                try {
+                                    body["scopes"] = JSON.parse(fieldValue);
+                                }
+                                catch {
+                                    body["scopes"] = fieldValue.includes(",")
+                                        ? fieldValue.split(",")
+                                        : [fieldValue];
+                                }
+                            }
+                            else if (fieldName === "oauth_identity" ||
+                                fieldName === "oauth_identity_json") {
+                                try {
+                                    body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                }
+                                catch {
+                                    body["oauth_identity"] = null;
+                                }
+                            }
+                            else if (fieldName === "termsAccepted") {
+                                body[fieldName] =
+                                    fieldValue === "on" ||
+                                        fieldValue === "true" ||
+                                        fieldValue === "1" ||
+                                        fieldValue === "yes";
+                            }
+                            else if (fieldName === "customFields") {
+                                try {
+                                    body[fieldName] = JSON.parse(fieldValue);
+                                }
+                                catch {
+                                    // Skip
+                                }
+                            }
+                            else {
+                                body[fieldName] = fieldValue;
+                            }
+                            hasValidFields = true;
+                        }
+                        if (hasValidFields && Object.keys(body).length > 0) {
+                            if (!("termsAccepted" in body)) {
+                                body.termsAccepted = true;
+                            }
+                            // Default scopes to empty array if not provided
+                            if (!("scopes" in body)) {
+                                body.scopes = [];
+                            }
+                            return body;
+                        }
+                    }
+                }
+                catch {
+                    // Text parsing failed, fall through to FormData parsing
+                }
+            }
+            if (!contentType.includes("application/json") &&
+                (contentType.includes("form") ||
+                    contentType === "" ||
+                    contentType.includes("text"))) {
+                try {
+                    // Clone request ONCE before trying any parsing, so we can reuse it if FormData parsing fails
+                    const fallbackRequest = request.clone();
+                    // Try FormData parsing as fallback (even if Content-Type doesn't match)
+                    let formData;
+                    try {
+                        formData = await fallbackRequest.formData();
+                    }
+                    catch (formDataParseError) {
+                        // If FormData parsing fails, try reading as text and parsing manually
+                        // This handles cases where Content-Type doesn't match (e.g., text/plain with FormData body)
+                        try {
+                            // Use a fresh clone for text parsing (body might be consumed by failed FormData attempt)
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            if (text && text.length > 0) {
+                                // First try URL-encoded parsing (simpler format)
+                                try {
+                                    const params = new URLSearchParams(text);
+                                    const body = parseFormFields(params.entries());
+                                    if (Object.keys(body).length > 0) {
+                                        return body;
+                                    }
+                                }
+                                catch {
+                                    // URL-encoded parsing failed, try multipart format
+                                }
+                                // Try to manually parse multipart format from text
+                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                const body = {};
+                                let match;
+                                let hasValidFields = false;
+                                while ((match = fieldRegex.exec(text)) !== null) {
+                                    const fieldName = match[1];
+                                    const fieldValue = match[2].trim();
+                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                        try {
+                                            body["scopes"] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            body["scopes"] = fieldValue.includes(",")
+                                                ? fieldValue.split(",")
+                                                : [fieldValue];
+                                        }
+                                    }
+                                    else if (fieldName === "oauth_identity" ||
+                                        fieldName === "oauth_identity_json") {
+                                        try {
+                                            body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                        }
+                                        catch {
+                                            body["oauth_identity"] = null;
+                                        }
+                                    }
+                                    else if (fieldName === "termsAccepted") {
+                                        body[fieldName] =
+                                            fieldValue === "on" ||
+                                                fieldValue === "true" ||
+                                                fieldValue === "1" ||
+                                                fieldValue === "yes";
+                                    }
+                                    else if (fieldName === "customFields") {
+                                        try {
+                                            body[fieldName] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            // Skip
+                                        }
+                                    }
+                                    else {
+                                        body[fieldName] = fieldValue;
+                                    }
+                                    hasValidFields = true;
+                                }
+                                if (hasValidFields && Object.keys(body).length > 0) {
+                                    if (!("termsAccepted" in body)) {
+                                        body.termsAccepted = true;
+                                    }
+                                    // Default scopes to empty array if not provided
+                                    if (!("scopes" in body)) {
+                                        body.scopes = [];
+                                    }
+                                    return body;
+                                }
+                            }
+                        }
+                        catch {
+                            // If text parsing also fails, rethrow original FormData error
+                        }
+                        throw formDataParseError;
+                    }
+                    // Check if FormData has valid entries (might be empty if Content-Type mismatch)
+                    const entriesArray = Array.from(formData.entries());
+                    if (entriesArray.length === 0) {
+                        // FormData parsing succeeded but returned no entries - try text parsing
+                        // This handles cases where Content-Type doesn't match (e.g., text/plain with FormData body)
+                        try {
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            if (text && text.length > 0) {
+                                // Try URL-encoded parsing first
+                                try {
+                                    const params = new URLSearchParams(text);
+                                    const body = parseFormFields(params.entries());
+                                    if (Object.keys(body).length > 0) {
+                                        return body;
+                                    }
+                                }
+                                catch {
+                                    // URL-encoded parsing failed, try multipart format
+                                }
+                                // Try multipart format parsing
+                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                const body = {};
+                                let match;
+                                let hasValidFields = false;
+                                while ((match = fieldRegex.exec(text)) !== null) {
+                                    const fieldName = match[1];
+                                    const fieldValue = match[2].trim();
+                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                        try {
+                                            body["scopes"] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            body["scopes"] = fieldValue.includes(",")
+                                                ? fieldValue.split(",")
+                                                : [fieldValue];
+                                        }
+                                    }
+                                    else if (fieldName === "oauth_identity" ||
+                                        fieldName === "oauth_identity_json") {
+                                        try {
+                                            body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                        }
+                                        catch {
+                                            body["oauth_identity"] = null;
+                                        }
+                                    }
+                                    else if (fieldName === "termsAccepted") {
+                                        body[fieldName] =
+                                            fieldValue === "on" ||
+                                                fieldValue === "true" ||
+                                                fieldValue === "1" ||
+                                                fieldValue === "yes";
+                                    }
+                                    else if (fieldName === "customFields") {
+                                        try {
+                                            body[fieldName] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            // Skip
+                                        }
+                                    }
+                                    else {
+                                        body[fieldName] = fieldValue;
+                                    }
+                                    hasValidFields = true;
+                                }
+                                if (hasValidFields && Object.keys(body).length > 0) {
+                                    if (!("termsAccepted" in body)) {
+                                        body.termsAccepted = true;
+                                    }
+                                    // Default scopes to empty array if not provided
+                                    if (!("scopes" in body)) {
+                                        body.scopes = [];
+                                    }
+                                    return body;
+                                }
+                            }
+                            // If text parsing failed or found no valid fields, throw error to trigger fallback
+                            throw new Error("FormData parsing returned empty entries and text parsing found no valid fields");
+                        }
+                        catch (textParseError) {
+                            // Text parsing failed or found no valid fields - throw error to trigger JSON fallback
+                            // This ensures we don't continue with empty FormData entries
+                            throw new Error(`Failed to parse FormData: ${textParseError instanceof Error ? textParseError.message : "Unknown error"}`);
+                        }
+                    }
+                    const body = {};
+                    // Type assertion: FormData.entries() exists at runtime in Cloudflare Workers
+                    let hasValidEntries = false;
+                    for (const [key, value] of formData.entries()) {
+                        if (value instanceof File)
+                            continue;
+                        // Extract field name from malformed keys
+                        let fieldName = key;
+                        if (key.includes("Content-Disposition") && key.includes('name="')) {
+                            const nameMatch = key.match(/name="([^"]+)"/);
+                            if (nameMatch && nameMatch[1]) {
+                                fieldName = nameMatch[1];
+                            }
+                            else {
+                                continue;
+                            }
+                        }
+                        else if (key.includes("------") ||
+                            key.includes("\r\n") ||
+                            key.trim() === "" ||
+                            key.includes("formdata-undici")) {
+                            // Malformed key - likely from text/plain Content-Type mismatch
+                            // Skip this entry and fall back to text parsing
+                            continue;
+                        }
+                        // If we have a valid field name, mark as having valid entries
+                        if (fieldName && fieldName !== key) {
+                            hasValidEntries = true;
+                        }
+                        else if (fieldName &&
+                            !key.includes("Content-Disposition") &&
+                            !key.includes("------") &&
+                            !key.includes("\r\n")) {
+                            hasValidEntries = true;
+                        }
+                        // Process the field value
+                        const stringValue = value.toString();
+                        if (fieldName === "scopes" || fieldName === "scopes[]") {
+                            try {
+                                body["scopes"] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                body["scopes"] = stringValue.includes(",")
+                                    ? stringValue.split(",")
+                                    : [stringValue];
+                            }
+                        }
+                        else if (fieldName === "oauth_identity" ||
+                            fieldName === "oauth_identity_json") {
+                            try {
+                                body["oauth_identity"] = JSON.parse(stringValue) || null;
+                            }
+                            catch {
+                                body["oauth_identity"] = null;
+                            }
+                        }
+                        else if (fieldName === "termsAccepted") {
+                            body[fieldName] =
+                                stringValue === "on" ||
+                                    stringValue === "true" ||
+                                    stringValue === "1" ||
+                                    stringValue === "yes";
+                        }
+                        else if (fieldName === "customFields") {
+                            try {
+                                body[fieldName] = JSON.parse(stringValue);
+                            }
+                            catch {
+                                // Skip
+                            }
+                        }
+                        else {
+                            body[fieldName] = stringValue;
+                        }
+                    }
+                    // If we didn't get any valid entries (all keys were malformed), try text parsing
+                    if (!hasValidEntries || Object.keys(body).length === 0) {
+                        // Try text parsing as fallback when FormData parsing returns no valid entries
+                        try {
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            if (text && text.length > 0) {
+                                // Try multipart format parsing from text
+                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                const textBody = {};
+                                let match;
+                                let hasValidFields = false;
+                                while ((match = fieldRegex.exec(text)) !== null) {
+                                    const fieldName = match[1];
+                                    const fieldValue = match[2].trim();
+                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                        try {
+                                            textBody["scopes"] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            textBody["scopes"] = fieldValue.includes(",")
+                                                ? fieldValue.split(",")
+                                                : [fieldValue];
+                                        }
+                                    }
+                                    else if (fieldName === "oauth_identity" ||
+                                        fieldName === "oauth_identity_json") {
+                                        try {
+                                            textBody["oauth_identity"] =
+                                                JSON.parse(fieldValue) || null;
+                                        }
+                                        catch {
+                                            textBody["oauth_identity"] = null;
+                                        }
+                                    }
+                                    else if (fieldName === "termsAccepted") {
+                                        textBody[fieldName] =
+                                            fieldValue === "on" ||
+                                                fieldValue === "true" ||
+                                                fieldValue === "1" ||
+                                                fieldValue === "yes";
+                                    }
+                                    else if (fieldName === "customFields") {
+                                        try {
+                                            textBody[fieldName] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            // Skip
+                                        }
+                                    }
+                                    else {
+                                        textBody[fieldName] = fieldValue;
+                                    }
+                                    hasValidFields = true;
+                                }
+                                if (hasValidFields && Object.keys(textBody).length > 0) {
+                                    if (!("termsAccepted" in textBody)) {
+                                        textBody.termsAccepted = true;
+                                    }
+                                    if (!("scopes" in textBody)) {
+                                        textBody.scopes = [];
+                                    }
+                                    return textBody;
+                                }
+                            }
+                        }
+                        catch {
+                            // Text parsing also failed, fall through to throw error
+                        }
+                        throw new Error("FormData parsing returned only malformed entries - falling back to text parsing");
+                    }
+                    if (!("termsAccepted" in body)) {
+                        body.termsAccepted = true;
+                    }
+                    // Default scopes to empty array if not provided
+                    if (!("scopes" in body)) {
+                        body.scopes = [];
+                    }
+                    return body;
+                }
+                catch (formError) {
+                    // FormData parsing failed - if it was due to malformed entries, try text parsing
+                    const errorMessage = formError instanceof Error ? formError.message : String(formError);
+                    if (errorMessage.includes("malformed entries") ||
+                        errorMessage.includes("empty entries") ||
+                        errorMessage.includes("falling back to text parsing")) {
+                        // Try text parsing as last resort
+                        try {
+                            const textRequest = request.clone();
+                            const text = await textRequest.text();
+                            if (text && text.length > 0) {
+                                // Try multipart format parsing
+                                const fieldRegex = /Content-Disposition:\s*form-data;\s*name="([^"]+)"\r?\n\r?\n([\s\S]*?)(?=\r?\n------|$)/g;
+                                const body = {};
+                                let match;
+                                let hasValidFields = false;
+                                while ((match = fieldRegex.exec(text)) !== null) {
+                                    const fieldName = match[1];
+                                    const fieldValue = match[2].trim();
+                                    if (fieldName === "scopes" || fieldName === "scopes[]") {
+                                        try {
+                                            body["scopes"] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            body["scopes"] = fieldValue.includes(",")
+                                                ? fieldValue.split(",")
+                                                : [fieldValue];
+                                        }
+                                    }
+                                    else if (fieldName === "oauth_identity" ||
+                                        fieldName === "oauth_identity_json") {
+                                        try {
+                                            body["oauth_identity"] = JSON.parse(fieldValue) || null;
+                                        }
+                                        catch {
+                                            body["oauth_identity"] = null;
+                                        }
+                                    }
+                                    else if (fieldName === "termsAccepted") {
+                                        body[fieldName] =
+                                            fieldValue === "on" ||
+                                                fieldValue === "true" ||
+                                                fieldValue === "1" ||
+                                                fieldValue === "yes";
+                                    }
+                                    else if (fieldName === "customFields") {
+                                        try {
+                                            body[fieldName] = JSON.parse(fieldValue);
+                                        }
+                                        catch {
+                                            // Skip
+                                        }
+                                    }
+                                    else {
+                                        body[fieldName] = fieldValue;
+                                    }
+                                    hasValidFields = true;
+                                }
+                                if (hasValidFields && Object.keys(body).length > 0) {
+                                    if (!("termsAccepted" in body)) {
+                                        body.termsAccepted = true;
+                                    }
+                                    // Default scopes to empty array if not provided
+                                    if (!("scopes" in body)) {
+                                        body.scopes = [];
+                                    }
+                                    return body;
+                                }
+                            }
+                        }
+                        catch {
+                            // Text parsing also failed
+                        }
+                    }
+                    // Both failed, throw original error
+                }
+            }
+            throw new Error(`Failed to parse request body: ${error instanceof Error ? error.message : "Unknown error"}`);
+        }
+    }
     /**
      * Handle consent approval
      *
@@ -463,13 +1988,25 @@ export class ConsentService {
     async handleApproval(request) {
         console.log("[ConsentService] Approval request received");
         try {
-            // Parse and validate request body
-            const body = await request.json();
+            // Parse and validate request body (supports both JSON and FormData)
+            const body = await this.parseRequestBody(request);
             console.log("[ConsentService] Request body parsed:", {
                 hasBody: !!body,
                 bodyKeys: Object.keys(body || {}),
                 hasOAuthIdentity: !!body?.oauth_identity,
             });
+            // Convert null oauth_identity to undefined for proper schema validation
+            // Zod's .nullish() should handle null, but converting to undefined is more explicit
+            // and avoids potential edge cases with FormData parsing
+            if (body &&
+                typeof body === "object" &&
+                body !== null &&
+                "oauth_identity" in body) {
+                const bodyObj = body;
+                if (bodyObj.oauth_identity === null) {
+                    bodyObj.oauth_identity = undefined;
+                }
+            }
             const validation = validateConsentApprovalRequest(body);
             if (!validation.success) {
                 console.error("[ConsentService] Approval request validation failed:", {
@@ -506,6 +2043,32 @@ export class ConsentService {
                     headers: { "Content-Type": "application/json" },
                 });
             }
+            // ✅ Extract projectId from approval request
+            const projectId = approvalRequest.project_id;
+            // ✅ Lazy initialization with projectId
+            const auditService = await this.getAuditService(projectId);
+            // Check if user needs credentials before delegation
+            const needsCredentials = !approvalRequest.user_did && !approvalRequest.oauth_identity;
+            if (needsCredentials && auditService) {
+                await auditService
+                    .logCredentialRequired({
+                    sessionId: approvalRequest.session_id,
+                    agentDid: approvalRequest.agent_did,
+                    targetTools: [approvalRequest.tool], // Array
+                    scopes: approvalRequest.scopes,
+                    projectId,
+                    oauthProvider: approvalRequest.oauth_identity?.provider,
+                })
+                    .catch((err) => {
+                    console.error("[ConsentService] Failed to log credential required", {
+                        eventType: "consent:credential_required",
+                        sessionId: approvalRequest.session_id,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                });
+                // Note: We don't redirect here - the consent flow continues
+                // The credential_required event is just for audit tracking
+            }
             // Create delegation via AgentShield API
             console.log("[ConsentService] Creating delegation...");
             const delegationResult = await this.createDelegation(approvalRequest);
@@ -528,6 +2091,55 @@ export class ConsentService {
             });
             // Store delegation token in KV
             await this.storeDelegationToken(approvalRequest.session_id, approvalRequest.agent_did, delegationResult.delegation_token, delegationResult.delegation_id);
+            // ✅ After successful delegation creation - log audit events
+            if (auditService && delegationResult.success) {
+                try {
+                    // Get userDid (may have been generated during delegation creation)
+                    // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
+                    let userDid;
+                    if (approvalRequest.session_id) {
+                        try {
+                            userDid = await this.getUserDidForSession(approvalRequest.session_id, approvalRequest.oauth_identity || undefined);
+                        }
+                        catch (error) {
+                            console.warn("[ConsentService] Failed to get userDid for audit logging:", error);
+                            // Continue without userDid - audit events can still be logged
+                        }
+                    }
+                    await auditService.logConsentApproval({
+                        sessionId: approvalRequest.session_id,
+                        userDid,
+                        agentDid: approvalRequest.agent_did,
+                        targetTools: [approvalRequest.tool], // Array
+                        scopes: approvalRequest.scopes,
+                        delegationId: delegationResult.delegation_id,
+                        projectId,
+                        termsAccepted: approvalRequest.termsAccepted || false,
+                        oauthIdentity: approvalRequest.oauth_identity
+                            ? {
+                                provider: approvalRequest.oauth_identity.provider,
+                                identifier: approvalRequest.oauth_identity.subject,
+                            }
+                            : undefined,
+                    });
+                    await auditService.logDelegationCreated({
+                        sessionId: approvalRequest.session_id,
+                        delegationId: delegationResult.delegation_id,
+                        agentDid: approvalRequest.agent_did,
+                        userDid,
+                        targetTools: [approvalRequest.tool], // Array
+                        scopes: approvalRequest.scopes,
+                        projectId,
+                    });
+                }
+                catch (error) {
+                    console.error("[ConsentService] Audit failed but continuing", {
+                        sessionId: approvalRequest.session_id,
+                        error: error instanceof Error ? error.message : String(error),
+                        eventTypes: ["consent:approved", "consent:delegation_created"],
+                    });
+                }
+            }
             // Return success response
             const response = {
                 success: true,
@@ -575,15 +2187,18 @@ export class ConsentService {
             // Get userDID from session or generate new ephemeral DID
             // Phase 4 PR #3: Use OAuth identity if provided in approval request
             // CRITICAL: Must work with or without OAuth identity
+            // CRITICAL: Always generate ephemeral DID if session_id is available, even without DELEGATION_STORAGE
             let userDid;
-            if (this.env.DELEGATION_STORAGE && request.session_id) {
+            if (request.session_id) {
                 try {
                     console.log("[ConsentService] Getting User DID for session:", {
                         sessionId: request.session_id.substring(0, 20) + "...",
                         hasOAuthIdentity: !!request.oauth_identity,
                         oauthProvider: request.oauth_identity?.provider,
+                        hasStorage: !!this.env.DELEGATION_STORAGE,
                     });
                     // Pass OAuth identity if available in approval request (can be null/undefined)
+                    // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
                     userDid = await this.getUserDidForSession(request.session_id, request.oauth_identity || undefined // Explicitly handle null as undefined
                     );
                     console.log("[ConsentService] User DID retrieved:", {
@@ -594,14 +2209,12 @@ export class ConsentService {
                 catch (error) {
                     console.error("[ConsentService] Failed to get/generate userDid:", error);
                     // Continue without userDid - delegation will work without user_identifier
-                    // This is valid for non-OAuth scenarios
+                    // This is valid for non-OAuth scenarios, but we should log this as a warning
+                    console.warn("[ConsentService] Delegation will be created without user_identifier - this may affect user tracking");
                 }
             }
             else {
-                console.log("[ConsentService] Skipping User DID retrieval:", {
-                    hasStorage: !!this.env.DELEGATION_STORAGE,
-                    hasSessionId: !!request.session_id,
-                });
+                console.log("[ConsentService] No session_id provided - skipping User DID generation");
             }
             const expiresInDays = 7; // Default to 7 days
             // Build delegation request with error-based format detection
@@ -854,13 +2467,15 @@ export class ConsentService {
      */
     async buildFullFormatRequest(request, userDid, expiresInDays) {
         const notAfter = Date.now() + expiresInDays * 24 * 60 * 60 * 1000;
+        // Defensive check: ensure scopes is always defined (should be guaranteed by validation)
+        const scopes = request.scopes ?? [];
         return {
             delegation: {
                 id: crypto.randomUUID(),
                 issuerDid: userDid || "did:key:z6MkEphemeral", // Use ephemeral if no userDid
                 subjectDid: request.agent_did,
                 constraints: {
-                    scopes: request.scopes,
+                    scopes,
                     notAfter,
                     notBefore: Date.now(),
                 },
@@ -895,9 +2510,11 @@ export class ConsentService {
      */
     buildSimplifiedFormatRequest(request, userDid, expiresInDays, fieldName) {
         // Build request with ONLY fields that are in AgentShield's schema
+        // Defensive check: ensure scopes is always defined (should be guaranteed by validation)
+        const scopes = request.scopes ?? [];
         const simplifiedRequest = {
             agent_did: request.agent_did,
-            scopes: request.scopes,
+            scopes,
             expires_in_days: expiresInDays,
         };
         // Include user_identifier if we have userDid (matches AgentShield schema)
@@ -912,7 +2529,7 @@ export class ConsentService {
             console.log("[ConsentService] No user_identifier (no OAuth or ephemeral DID) - delegation will proceed without it");
         }
         // AgentShield API only accepts "custom_fields", not "metadata"
-        // Always use "custom_fields" regardless of Day0 config  
+        // Always use "custom_fields" regardless of Day0 config
         if (userDid) {
             // Include issuer_did and subject_did in custom_fields when we have userDid
             simplifiedRequest.custom_fields = {
@@ -971,11 +2588,11 @@ export class ConsentService {
             // FINAL SAFEGUARD: Remove session_id and project_id if they somehow got added
             // This provides defense-in-depth protection
             const sanitizedBody = { ...requestBody };
-            if ('session_id' in sanitizedBody) {
+            if ("session_id" in sanitizedBody) {
                 console.warn("[ConsentService] ⚠️ session_id detected in request body - removing (not in schema)");
                 delete sanitizedBody.session_id;
             }
-            if ('project_id' in sanitizedBody) {
+            if ("project_id" in sanitizedBody) {
                 console.warn("[ConsentService] ⚠️ project_id detected in request body - removing (not in schema)");
                 delete sanitizedBody.project_id;
             }
@@ -998,13 +2615,15 @@ export class ConsentService {
             }
             // Check for validation error specifically
             if (response.status === 400) {
-                const errorMessage = responseData
-                    ?.error?.message ||
-                    responseData?.message ||
-                    "Validation failed";
-                if (errorMessage.includes("format") ||
+                const errorData = responseData;
+                const errorMessage = errorData.error?.message || errorData.message || "Validation failed";
+                const errorCode = errorData.error_code || errorData.error?.code;
+                // Check if error_code is explicitly set to "validation_error" OR error message suggests validation error
+                if (errorCode === "validation_error" ||
+                    errorMessage.includes("format") ||
                     errorMessage.includes("schema") ||
-                    errorMessage.includes("invalid")) {
+                    errorMessage.includes("invalid") ||
+                    errorMessage.includes("Validation")) {
                     return {
                         success: false,
                         error: errorMessage,