@kya-os/mcp-i-cloudflare 1.6.11 → 1.6.13

package/dist/runtime/oauth-handler.js

@@ -3,7 +3,7 @@
  *
  * Provides reusable OAuth callback handler for agents using delegation flow
  */
-import { STORAGE_KEYS } from '../constants/storage-keys';
+import { STORAGE_KEYS } from "../constants/storage-keys";
 /**
  * Default success page template
  */
@@ -94,7 +94,7 @@ const defaultSuccessTemplate = (data) => `
 
         <div class="info">
           <p>Authorized Scopes:</p>
-          <div class="code">${data.scopes.join(', ')}</div>
+          <div class="code">${data.scopes.join(", ")}</div>
         </div>
 
         <p>You can now close this window and return to Claude Desktop. The authorized tools are ready to use.</p>
@@ -184,39 +184,39 @@ export function createOAuthCallbackHandler(config = {}) {
     return async (c) => {
         const env = c.env;
         // Get configuration with defaults
-        const { agentShieldApiUrl = env.AGENTSHIELD_API_URL || 'https://hobbs.work', delegationStorage, consentService, oauthSecurityService, successTemplate = defaultSuccessTemplate, errorTemplate = defaultErrorTemplate, autoClose = true, autoCloseDelay = 5000, agentName, // MCP Server name for delegation notifications
+        const { agentShieldApiUrl = env.AGENTSHIELD_API_URL || "https://hobbs.work", delegationStorage, consentService, oauthSecurityService, successTemplate = defaultSuccessTemplate, errorTemplate = defaultErrorTemplate, autoClose = true, autoCloseDelay = 5000, agentName, // MCP Server name for delegation notifications
          } = config;
         // Get query parameters
-        const code = c.req.query('code');
-        const stateParam = c.req.query('state');
-        const error = c.req.query('error');
+        const code = c.req.query("code");
+        const stateParam = c.req.query("state");
+        const error = c.req.query("error");
         // Handle OAuth errors
         if (error) {
-            const errorDescription = c.req.query('error_description') || 'Authorization failed';
-            console.error('[OAuth] 🔒 SECURITY EVENT: Error from provider:', {
+            const errorDescription = c.req.query("error_description") || "Authorization failed";
+            console.error("[OAuth] 🔒 SECURITY EVENT: Error from provider:", {
                 error,
                 errorDescription,
                 timestamp: new Date().toISOString(),
-                eventType: 'oauth_provider_error'
+                eventType: "oauth_provider_error",
             });
             const html = errorTemplate({
                 error,
-                description: errorDescription
+                description: errorDescription,
             });
             return c.html(html, 400);
         }
         // Validate required parameters
         if (!code || !stateParam) {
-            console.error('[OAuth] 🔒 SECURITY EVENT: Missing required parameters:', {
+            console.error("[OAuth] 🔒 SECURITY EVENT: Missing required parameters:", {
                 hasCode: !!code,
                 hasState: !!stateParam,
                 timestamp: new Date().toISOString(),
-                eventType: 'oauth_validation_failed',
-                reason: 'missing_parameters'
+                eventType: "oauth_validation_failed",
+                reason: "missing_parameters",
             });
             const html = errorTemplate({
-                error: 'invalid_request',
-                description: 'Missing authorization code or state parameter'
+                error: "invalid_request",
+                description: "Missing authorization code or state parameter",
             });
             return c.html(html, 400);
         }
@@ -228,15 +228,15 @@ export function createOAuthCallbackHandler(config = {}) {
             try {
                 stateData = await oauthSecurityService.getOAuthState(stateParam);
                 if (!stateData) {
-                    console.error('[OAuth] 🔒 SECURITY EVENT: State validation failed - state not found or expired:', {
-                        stateParam: stateParam.substring(0, 20) + '...',
+                    console.error("[OAuth] 🔒 SECURITY EVENT: State validation failed - state not found or expired:", {
+                        stateParam: stateParam.substring(0, 20) + "...",
                         timestamp: new Date().toISOString(),
-                        eventType: 'csrf_protection_failed',
-                        reason: 'state_not_found_or_expired'
+                        eventType: "csrf_protection_failed",
+                        reason: "state_not_found_or_expired",
                     });
                     const html = errorTemplate({
-                        error: 'invalid_state',
-                        description: 'Invalid or expired state parameter. This may be a CSRF attack or the authorization request has expired.'
+                        error: "invalid_state",
+                        description: "Invalid or expired state parameter. This may be a CSRF attack or the authorization request has expired.",
                     });
                     return c.html(html, 400);
                 }
@@ -247,46 +247,46 @@ export function createOAuthCallbackHandler(config = {}) {
                     session_id: stateData.session_id,
                     delegation_id: stateData.delegation_id,
                 };
-                console.log('[OAuth] 🔒 SECURITY EVENT: State validated successfully:', {
+                console.log("[OAuth] 🔒 SECURITY EVENT: State validated successfully:", {
                     projectId: state.project_id,
-                    agentDid: state.agent_did.substring(0, 20) + '...',
-                    sessionId: state.session_id?.substring(0, 20) + '...',
+                    agentDid: state.agent_did.substring(0, 20) + "...",
+                    sessionId: state.session_id?.substring(0, 20) + "...",
                     timestamp: new Date().toISOString(),
-                    eventType: 'csrf_protection_success',
-                    stateStoredAt: stateData.storedAt
+                    eventType: "csrf_protection_success",
+                    stateStoredAt: stateData.storedAt,
                 });
             }
             catch (err) {
-                console.error('[OAuth] 🔒 SECURITY EVENT: State validation error:', {
+                console.error("[OAuth] 🔒 SECURITY EVENT: State validation error:", {
                     error: err instanceof Error ? err.message : String(err),
-                    stateParam: stateParam.substring(0, 20) + '...',
+                    stateParam: stateParam.substring(0, 20) + "...",
                     timestamp: new Date().toISOString(),
-                    eventType: 'csrf_protection_error',
-                    reason: 'validation_exception'
+                    eventType: "csrf_protection_error",
+                    reason: "validation_exception",
                 });
                 const html = errorTemplate({
-                    error: 'invalid_state',
-                    description: 'Failed to validate state parameter'
+                    error: "invalid_state",
+                    description: "Failed to validate state parameter",
                 });
                 return c.html(html, 400);
             }
         }
         else {
             // Fallback: Decode state parameter directly (less secure, but backward compatible)
-            console.warn('[OAuth] ⚠️ SECURITY WARNING: OAuthSecurityService not provided, using insecure state decoding');
+            console.warn("[OAuth] ⚠️ SECURITY WARNING: OAuthSecurityService not provided, using insecure state decoding");
             try {
                 state = JSON.parse(atob(stateParam));
             }
             catch (err) {
-                console.error('[OAuth] 🔒 SECURITY EVENT: Failed to decode state:', {
+                console.error("[OAuth] 🔒 SECURITY EVENT: Failed to decode state:", {
                     error: err instanceof Error ? err.message : String(err),
                     timestamp: new Date().toISOString(),
-                    eventType: 'oauth_validation_failed',
-                    reason: 'state_decode_error'
+                    eventType: "oauth_validation_failed",
+                    reason: "state_decode_error",
                 });
                 const html = errorTemplate({
-                    error: 'invalid_state',
-                    description: 'Invalid state parameter'
+                    error: "invalid_state",
+                    description: "Invalid state parameter",
                 });
                 return c.html(html, 400);
             }
@@ -294,77 +294,233 @@ export function createOAuthCallbackHandler(config = {}) {
         const { project_id, agent_did, session_id, delegation_id } = state;
         // Validate session ID
         if (!session_id) {
-            console.error('[OAuth] No session ID in state');
+            console.error("[OAuth] No session ID in state");
             const html = errorTemplate({
-                error: 'missing_session',
-                description: 'No session ID provided in OAuth state'
+                error: "missing_session",
+                description: "No session ID provided in OAuth state",
             });
             return c.html(html, 400);
         }
-        console.log('[OAuth] 🔒 SECURITY EVENT: Processing authorization code exchange:', {
+        // Extract direct PKCE flow data from state
+        const isDirectPKCE = stateData?.direct_pkce === true;
+        const stateProvider = stateData?.provider;
+        const codeVerifier = stateData?.code_verifier;
+        const redirectUri = stateData?.redirect_uri;
+        const requestedScopes = stateData?.scopes || [];
+        console.log("[OAuth] 🔒 SECURITY EVENT: Processing authorization code exchange:", {
             projectId: project_id,
-            agentDid: agent_did.substring(0, 20) + '...',
-            sessionId: session_id?.substring(0, 20) + '...',
+            agentDid: agent_did.substring(0, 20) + "...",
+            sessionId: session_id?.substring(0, 20) + "...",
             delegationId: delegation_id,
             timestamp: new Date().toISOString(),
-            eventType: 'oauth_code_exchange_start',
-            hasSecureState: !!oauthSecurityService
+            eventType: "oauth_code_exchange_start",
+            hasSecureState: !!oauthSecurityService,
+            isDirectPKCE,
+            provider: stateProvider,
+            hasCodeVerifier: !!codeVerifier,
         });
+        let tokenData;
         try {
-            // Exchange authorization code for delegation token
-            const tokenEndpoint = `${agentShieldApiUrl}/api/v1/bouncer/oauth/token`;
-            const tokenResponse = await fetch(tokenEndpoint, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'Accept': 'application/json'
-                },
-                body: JSON.stringify({
-                    grant_type: 'authorization_code',
-                    code: code,
-                    agent_did: agent_did,
-                    project_id: project_id
-                })
-            });
-            if (!tokenResponse.ok) {
-                const errorText = await tokenResponse.text();
-                console.error('[OAuth] 🔒 SECURITY EVENT: Token exchange failed:', {
-                    status: tokenResponse.status,
-                    error: errorText.substring(0, 200),
+            // Check if this is a direct PKCE flow (exchange with provider directly)
+            if (isDirectPKCE && stateProvider && codeVerifier && redirectUri) {
+                console.log("[OAuth] 🔐 Direct PKCE flow detected, exchanging with provider directly:", {
+                    provider: stateProvider,
+                    redirectUri,
                     projectId: project_id,
-                    agentDid: agent_did.substring(0, 20) + '...',
-                    timestamp: new Date().toISOString(),
-                    eventType: 'oauth_token_exchange_failed'
                 });
-                const html = errorTemplate({
-                    error: 'token_exchange_failed',
-                    description: 'Failed to exchange authorization code for delegation token'
+                // Import services for direct PKCE flow
+                const { OAuthService, OAuthConfigService } = await import("@kya-os/mcp-i-core");
+                const { KVOAuthConfigCache } = await import("../cache/kv-oauth-config-cache.js");
+                // Create fetch provider for OAuth services
+                const fetchProvider = {
+                    fetch: globalThis.fetch.bind(globalThis),
+                    // These methods are not needed for PKCE token exchange, stub them
+                    resolveDID: async () => {
+                        throw new Error("Not implemented");
+                    },
+                    fetchStatusList: async () => {
+                        throw new Error("Not implemented");
+                    },
+                    fetchDelegationChain: async () => {
+                        throw new Error("Not implemented");
+                    },
+                };
+                // Initialize OAuth services
+                const oauthConfigCache = new KVOAuthConfigCache({
+                    kv: delegationStorage,
+                });
+                const apiKey = env.AGENTSHIELD_API_KEY || "";
+                const oauthConfigService = new OAuthConfigService({
+                    baseUrl: env.AGENTSHIELD_API_URL || "https://kya.vouched.id",
+                    apiKey: apiKey,
+                    fetchProvider: fetchProvider,
+                    cache: oauthConfigCache,
+                });
+                const oauthService = new OAuthService({
+                    configService: oauthConfigService,
+                    fetchProvider: fetchProvider,
+                    agentShieldApiUrl: env.AGENTSHIELD_API_URL || "https://kya.vouched.id",
+                    agentShieldApiKey: apiKey,
+                    projectId: project_id,
+                    logger: (msg, data) => console.log(`[OAuthService] ${msg}`, data),
+                });
+                // Step 1: Exchange authorization code with OAuth provider (GitHub) directly
+                const idpTokens = await oauthService.exchangeToken(stateProvider, code, codeVerifier, redirectUri);
+                console.log("[OAuth] ✅ Direct PKCE token exchange successful:", {
+                    provider: stateProvider,
+                    hasAccessToken: !!idpTokens.access_token,
+                    expiresAt: new Date(idpTokens.expires_at).toISOString(),
+                });
+                // Step 2: Get user info from provider (optional but useful for User DID)
+                let userInfo = null;
+                const oauthConfig = await oauthConfigService.getOAuthConfig(project_id);
+                const providerConfig = oauthConfig.providers[stateProvider];
+                if (providerConfig?.userInfoUrl) {
+                    try {
+                        const userInfoResponse = await fetch(providerConfig.userInfoUrl, {
+                            headers: {
+                                Authorization: `Bearer ${idpTokens.access_token}`,
+                                Accept: "application/json",
+                            },
+                        });
+                        if (userInfoResponse.ok) {
+                            userInfo = await userInfoResponse.json();
+                            console.log("[OAuth] ✅ User info retrieved:", {
+                                provider: stateProvider,
+                                hasEmail: !!userInfo?.email,
+                                hasName: !!userInfo?.name,
+                            });
+                        }
+                    }
+                    catch (err) {
+                        console.warn("[OAuth] Failed to get user info (non-fatal):", err);
+                    }
+                }
+                // Step 3: Create delegation on AgentShield
+                const delegationEndpoint = `${agentShieldApiUrl}/api/v1/bouncer/delegations`;
+                // Build user identifier from OAuth user info
+                const userIdentifier = userInfo?.email || userInfo?.login || userInfo?.sub || userInfo?.id;
+                const delegationResponse = await fetch(delegationEndpoint, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        Authorization: `Bearer ${env.AGENTSHIELD_API_KEY}`,
+                        "X-Project-Id": project_id,
+                    },
+                    body: JSON.stringify({
+                        agent_did: agent_did,
+                        scopes: requestedScopes,
+                        session_id: session_id,
+                        provider: stateProvider,
+                        user_identifier: userIdentifier,
+                        // Include OAuth metadata for audit trail
+                        metadata: {
+                            oauth_provider: stateProvider,
+                            oauth_flow: "direct_pkce",
+                            oauth_user_id: userInfo?.sub || userInfo?.id || userInfo?.login,
+                        },
+                    }),
+                });
+                if (!delegationResponse.ok) {
+                    const errorText = await delegationResponse.text();
+                    console.error("[OAuth] 🔒 SECURITY EVENT: Delegation creation failed:", {
+                        status: delegationResponse.status,
+                        error: errorText.substring(0, 200),
+                        projectId: project_id,
+                        agentDid: agent_did.substring(0, 20) + "...",
+                        timestamp: new Date().toISOString(),
+                        eventType: "delegation_creation_failed",
+                    });
+                    const html = errorTemplate({
+                        error: "delegation_failed",
+                        description: "Failed to create delegation after OAuth authorization",
+                    });
+                    return c.html(html, delegationResponse.status);
+                }
+                const delegationData = await delegationResponse.json();
+                // Map delegation response to TokenExchangeResponse format
+                tokenData = {
+                    delegation_token: delegationData.data?.delegation_token ||
+                        delegationData.delegation_token,
+                    token_type: "Bearer",
+                    expires_in: delegationData.data?.expires_in ||
+                        delegationData.expires_in ||
+                        3600,
+                    delegation_id: delegationData.data?.delegation_id ||
+                        delegationData.delegation_id ||
+                        `del_${Date.now()}`,
+                    scopes: requestedScopes,
+                    session_id: session_id,
+                };
+                // Attach provider and IDP tokens for downstream processing
+                tokenData.provider = stateProvider;
+                tokenData.idp_tokens = idpTokens;
+                tokenData.user_info = userInfo;
+                console.log("[OAuth] ✅ Direct PKCE flow complete:", {
+                    delegationId: tokenData.delegation_id,
+                    provider: stateProvider,
+                    hasIdpTokens: true,
+                    hasUserInfo: !!userInfo,
                 });
-                return c.html(html, tokenResponse.status);
             }
-            const tokenData = await tokenResponse.json();
+            else {
+                // Bouncer flow: Exchange via AgentShield's OAuth token endpoint
+                // This is the legacy flow for proxy mode or when PKCE is not available
+                console.log("[OAuth] 📡 Using bouncer flow for token exchange");
+                const tokenEndpoint = `${agentShieldApiUrl}/api/v1/bouncer/oauth/token`;
+                const tokenResponse = await fetch(tokenEndpoint, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        Accept: "application/json",
+                    },
+                    body: JSON.stringify({
+                        grant_type: "authorization_code",
+                        code: code,
+                        agent_did: agent_did,
+                        project_id: project_id,
+                    }),
+                });
+                if (!tokenResponse.ok) {
+                    const errorText = await tokenResponse.text();
+                    console.error("[OAuth] 🔒 SECURITY EVENT: Token exchange failed:", {
+                        status: tokenResponse.status,
+                        error: errorText.substring(0, 200),
+                        projectId: project_id,
+                        agentDid: agent_did.substring(0, 20) + "...",
+                        timestamp: new Date().toISOString(),
+                        eventType: "oauth_token_exchange_failed",
+                    });
+                    const html = errorTemplate({
+                        error: "token_exchange_failed",
+                        description: "Failed to exchange authorization code for delegation token",
+                    });
+                    return c.html(html, tokenResponse.status);
+                }
+                tokenData = await tokenResponse.json();
+            }
             // Validate token response
             if (!tokenData.delegation_token) {
-                console.error('[OAuth] 🔒 SECURITY EVENT: Invalid token response:', {
+                console.error("[OAuth] 🔒 SECURITY EVENT: Invalid token response:", {
                     hasDelegationToken: !!tokenData.delegation_token,
                     responseKeys: Object.keys(tokenData),
                     projectId: project_id,
                     timestamp: new Date().toISOString(),
-                    eventType: 'oauth_invalid_token_response'
+                    eventType: "oauth_invalid_token_response",
                 });
                 const html = errorTemplate({
-                    error: 'invalid_response',
-                    description: 'Invalid token response from authorization server'
+                    error: "invalid_response",
+                    description: "Invalid token response from authorization server",
                 });
                 return c.html(html, 500);
             }
-            console.log('[OAuth] 🔒 SECURITY EVENT: Token exchange successful:', {
+            console.log("[OAuth] 🔒 SECURITY EVENT: Token exchange successful:", {
                 delegationId: tokenData.delegation_id,
                 sessionId: tokenData.session_id || session_id,
                 expiresIn: tokenData.expires_in,
                 scopes: tokenData.scopes,
                 timestamp: new Date().toISOString(),
-                eventType: 'oauth_token_exchange_success'
+                eventType: "oauth_token_exchange_success",
             });
             // Phase 4 PR #3: Extract OAuth user info and link to User DID
             let oauthIdentity = null;
@@ -380,13 +536,15 @@ export function createOAuthCallbackHandler(config = {}) {
                         // 2. State parameter (if stored during OAuth initiation)
                         // 3. Environment variable (if configured)
                         // 4. Default fallback ('google')
-                        const provider = tokenData.provider
-                            || state.provider
-                            || env.DEFAULT_OAUTH_PROVIDER
-                            || 'google';
+                        const provider = tokenData.provider ||
+                            state.provider ||
+                            env.DEFAULT_OAUTH_PROVIDER ||
+                            "google";
                         oauthIdentity = {
                             provider: provider,
-                            subject: userInfoFromToken.sub || userInfoFromToken.id || userInfoFromToken.email,
+                            subject: userInfoFromToken.sub ||
+                                userInfoFromToken.id ||
+                                userInfoFromToken.email,
                             email: userInfoFromToken.email,
                             name: userInfoFromToken.name || userInfoFromToken.display_name,
                         };
@@ -396,8 +554,8 @@ export function createOAuthCallbackHandler(config = {}) {
                         // This requires an access_token from the token exchange
                         // For now, we'll log a warning and skip OAuth linking
                         // TODO: Implement userinfo endpoint call if access_token is available
-                        console.warn('[OAuth] User info not available in token response. OAuth linking skipped.');
-                        console.warn('[OAuth] To enable OAuth linking, ensure AgentShield returns user info or access_token in token response.');
+                        console.warn("[OAuth] User info not available in token response. OAuth linking skipped.");
+                        console.warn("[OAuth] To enable OAuth linking, ensure AgentShield returns user info or access_token in token response.");
                     }
                     // Link OAuth identity to User DID if we have it
                     if (oauthIdentity && oauthIdentity.subject) {
@@ -405,25 +563,25 @@ export function createOAuthCallbackHandler(config = {}) {
                         // Set OAuth identity cookie for consent page
                         const cookieValue = encodeURIComponent(JSON.stringify(oauthIdentity));
                         c.header("Set-Cookie", `oauth_identity=${cookieValue}; HttpOnly; Secure; SameSite=Lax; Max-Age=604800; Path=/`);
-                        console.log('[OAuth] 🔒 SECURITY EVENT: OAuth identity linked and cookie set:', {
+                        console.log("[OAuth] 🔒 SECURITY EVENT: OAuth identity linked and cookie set:", {
                             provider: oauthIdentity.provider,
-                            subject: oauthIdentity.subject.substring(0, 20) + '...',
-                            userDid: userDid.substring(0, 20) + '...',
-                            sessionId: session_id?.substring(0, 20) + '...',
+                            subject: oauthIdentity.subject.substring(0, 20) + "...",
+                            userDid: userDid.substring(0, 20) + "...",
+                            sessionId: session_id?.substring(0, 20) + "...",
                             timestamp: new Date().toISOString(),
-                            eventType: 'oauth_identity_linked',
-                            cookieSet: true
+                            eventType: "oauth_identity_linked",
+                            cookieSet: true,
                         });
                     }
                 }
                 catch (error) {
                     // OAuth linking errors are non-fatal - log but continue
-                    console.error('[OAuth] 🔒 SECURITY EVENT: Failed to link OAuth identity (non-fatal):', {
+                    console.error("[OAuth] 🔒 SECURITY EVENT: Failed to link OAuth identity (non-fatal):", {
                         error: error instanceof Error ? error.message : String(error),
-                        sessionId: session_id?.substring(0, 20) + '...',
+                        sessionId: session_id?.substring(0, 20) + "...",
                         timestamp: new Date().toISOString(),
-                        eventType: 'oauth_identity_linking_failed',
-                        severity: 'warning'
+                        eventType: "oauth_identity_linking_failed",
+                        severity: "warning",
                     });
                 }
             }
@@ -431,7 +589,9 @@ export function createOAuthCallbackHandler(config = {}) {
             // After receiving delegation token, retrieve OAuth tokens separately
             // Note: userDid may not be available if OAuth linking failed, but we still need to store tokens
             // For PKCE flows, we can use session-based userDid lookup if needed
-            if (delegationStorage && oauthSecurityService && tokenData.delegation_id) {
+            if (delegationStorage &&
+                oauthSecurityService &&
+                tokenData.delegation_id) {
                 try {
                     // Extract provider from state or token response
                     const provider = tokenData.provider ||
@@ -451,7 +611,8 @@ export function createOAuthCallbackHandler(config = {}) {
                     let effectiveUserDid = userDid;
                     if (!effectiveUserDid && session_id && consentService) {
                         try {
-                            effectiveUserDid = await consentService.getUserDidForSession(session_id);
+                            effectiveUserDid =
+                                await consentService.getUserDidForSession(session_id);
                         }
                         catch (error) {
                             console.warn("[OAuth] Failed to get userDid from session, skipping token storage:", {
@@ -566,47 +727,49 @@ export function createOAuthCallbackHandler(config = {}) {
             if (delegationStorage) {
                 // Use != null to properly handle expires_in: 0 (immediate expiration)
                 // Truthiness check would incorrectly treat 0 as missing
-                const ttl = tokenData.expires_in != null ? tokenData.expires_in : (7 * 24 * 60 * 60); // Default 7 days
+                const ttl = tokenData.expires_in != null
+                    ? tokenData.expires_in
+                    : 7 * 24 * 60 * 60; // Default 7 days
                 try {
                     // Get userDID from session if available (Phase 4)
                     // Use linked userDid if available, otherwise check session
                     let sessionUserDid = userDid;
                     const sessionKey = STORAGE_KEYS.session(session_id);
                     if (!sessionUserDid) {
-                        const sessionData = await delegationStorage.get(sessionKey, "json");
+                        const sessionData = (await delegationStorage.get(sessionKey, "json"));
                         sessionUserDid = sessionData?.userDid;
                     }
                     // Primary: User+Agent scoped (no conflicts) - Phase 4
                     if (sessionUserDid) {
                         const userAgentKey = STORAGE_KEYS.delegation(sessionUserDid, agent_did);
                         await delegationStorage.put(userAgentKey, tokenData.delegation_token, {
-                            expirationTtl: ttl
+                            expirationTtl: ttl,
                         });
-                        console.log('[OAuth] 🔒 SECURITY EVENT: Delegation token stored with user+agent DID:', {
-                            key: userAgentKey.substring(0, 50) + '...',
+                        console.log("[OAuth] 🔒 SECURITY EVENT: Delegation token stored with user+agent DID:", {
+                            key: userAgentKey.substring(0, 50) + "...",
                             ttl,
-                            agentDid: agent_did.substring(0, 20) + '...',
-                            userDid: sessionUserDid.substring(0, 20) + '...',
+                            agentDid: agent_did.substring(0, 20) + "...",
+                            userDid: sessionUserDid.substring(0, 20) + "...",
                             delegationId: tokenData.delegation_id,
                             timestamp: new Date().toISOString(),
-                            eventType: 'delegation_token_stored',
-                            storageType: 'user_agent_scoped'
+                            eventType: "delegation_token_stored",
+                            storageType: "user_agent_scoped",
                         });
                     }
                     // Backward compatibility: Agent-only key (24 hour TTL)
                     const legacyKey = STORAGE_KEYS.legacyDelegation(agent_did);
                     await delegationStorage.put(legacyKey, tokenData.delegation_token, {
-                        expirationTtl: 24 * 60 * 60 // 24 hours only
+                        expirationTtl: 24 * 60 * 60, // 24 hours only
                     });
-                    console.log('[OAuth] 🔒 SECURITY EVENT: Delegation token stored with legacy agent key:', {
-                        key: legacyKey.substring(0, 50) + '...',
+                    console.log("[OAuth] 🔒 SECURITY EVENT: Delegation token stored with legacy agent key:", {
+                        key: legacyKey.substring(0, 50) + "...",
                         ttl: 24 * 60 * 60,
-                        agentDid: agent_did.substring(0, 20) + '...',
+                        agentDid: agent_did.substring(0, 20) + "...",
                         delegationId: tokenData.delegation_id,
                         timestamp: new Date().toISOString(),
-                        eventType: 'delegation_token_stored',
-                        storageType: 'legacy_agent_scoped',
-                        warning: 'Legacy format - migrate to user+agent scoped tokens'
+                        eventType: "delegation_token_stored",
+                        storageType: "legacy_agent_scoped",
+                        warning: "Legacy format - migrate to user+agent scoped tokens",
                     });
                     // Session cache for fast lookup (shorter TTL for performance)
                     await delegationStorage.put(sessionKey, JSON.stringify({
@@ -615,16 +778,16 @@ export function createOAuthCallbackHandler(config = {}) {
                         delegationToken: tokenData.delegation_token,
                         cachedAt: Date.now(),
                     }), {
-                        expirationTtl: Math.min(ttl, 1800) // 30 minutes or token TTL, whichever is shorter
+                        expirationTtl: Math.min(ttl, 1800), // 30 minutes or token TTL, whichever is shorter
                     });
-                    console.log('[OAuth] 🔒 SECURITY EVENT: Delegation token cached for session:', {
-                        key: sessionKey.substring(0, 50) + '...',
+                    console.log("[OAuth] 🔒 SECURITY EVENT: Delegation token cached for session:", {
+                        key: sessionKey.substring(0, 50) + "...",
                         ttl: Math.min(ttl, 1800),
-                        sessionId: session_id?.substring(0, 20) + '...',
-                        userDid: sessionUserDid?.substring(0, 20) + '...',
+                        sessionId: session_id?.substring(0, 20) + "...",
+                        userDid: sessionUserDid?.substring(0, 20) + "...",
                         timestamp: new Date().toISOString(),
-                        eventType: 'delegation_token_cached',
-                        storageType: 'session_cache'
+                        eventType: "delegation_token_cached",
+                        storageType: "session_cache",
                     });
                     // Fire-and-forget notification to AgentShield for audit trail
                     // This enables dashboard visibility into delegations created via direct OAuth flow
@@ -634,13 +797,13 @@ export function createOAuthCallbackHandler(config = {}) {
                     // Use != null to properly handle expires_in: 0 (immediate expiration)
                     // Truthiness check would incorrectly treat 0 as missing
                     const expiresAt = tokenData.expires_in != null
-                        ? new Date(Date.now() + (tokenData.expires_in * 1000)).toISOString()
+                        ? new Date(Date.now() + tokenData.expires_in * 1000).toISOString()
                         : null;
                     fetch(delegationNotifyUrl, {
-                        method: 'POST',
+                        method: "POST",
                         headers: {
-                            'Content-Type': 'application/json',
-                            'X-AgentShield-Key': env.AGENTSHIELD_API_KEY || '',
+                            "Content-Type": "application/json",
+                            "X-AgentShield-Key": env.AGENTSHIELD_API_KEY || "",
                         },
                         // AgentShield notifyDelegationSchema uses snake_case
                         body: JSON.stringify({
@@ -660,28 +823,30 @@ export function createOAuthCallbackHandler(config = {}) {
                             expires_at: expiresAt || undefined,
                             // Metadata for audit trail and debugging
                             metadata: {
-                                source: 'mcp-i-direct-oauth',
-                                oauth_flow: 'pkce',
+                                source: "mcp-i-direct-oauth",
+                                oauth_flow: "pkce",
                                 mcp_server_name: agentName || undefined,
                                 session_id: session_id || undefined,
                             },
                         }),
-                    }).then(response => {
+                    })
+                        .then((response) => {
                         if (response.ok) {
-                            console.log('[OAuth] Delegation notification sent to AgentShield:', {
+                            console.log("[OAuth] Delegation notification sent to AgentShield:", {
                                 delegation_id: tokenData.delegation_id,
                                 project_id: project_id,
                                 agent_name: agentName,
                             });
                         }
                         else {
-                            console.warn('[OAuth] Delegation notification failed (non-blocking):', {
+                            console.warn("[OAuth] Delegation notification failed (non-blocking):", {
                                 status: response.status,
                                 delegation_id: tokenData.delegation_id,
                             });
                         }
-                    }).catch(err => {
-                        console.warn('[OAuth] Delegation notification failed (non-blocking):', {
+                    })
+                        .catch((err) => {
+                        console.warn("[OAuth] Delegation notification failed (non-blocking):", {
                             error: err instanceof Error ? err.message : String(err),
                             delegation_id: tokenData.delegation_id,
                         });
@@ -689,12 +854,14 @@ export function createOAuthCallbackHandler(config = {}) {
                 }
                 catch (storageError) {
                     // Storage errors are non-fatal - log but continue
-                    console.error('[OAuth] 🔒 SECURITY EVENT: Storage error (non-fatal):', {
-                        error: storageError instanceof Error ? storageError.message : String(storageError),
-                        sessionId: session_id?.substring(0, 20) + '...',
+                    console.error("[OAuth] 🔒 SECURITY EVENT: Storage error (non-fatal):", {
+                        error: storageError instanceof Error
+                            ? storageError.message
+                            : String(storageError),
+                        sessionId: session_id?.substring(0, 20) + "...",
                         timestamp: new Date().toISOString(),
-                        eventType: 'delegation_storage_error',
-                        severity: 'warning'
+                        eventType: "delegation_storage_error",
+                        severity: "warning",
                     });
                 }
             }
@@ -703,21 +870,23 @@ export function createOAuthCallbackHandler(config = {}) {
                 delegationId: tokenData.delegation_id || delegation_id,
                 sessionId: session_id,
                 scopes: tokenData.scopes || [],
-                expiresIn: autoClose ? autoCloseDelay : 0
+                expiresIn: autoClose ? autoCloseDelay : 0,
             });
             return c.html(html);
         }
         catch (error) {
-            console.error('[OAuth] 🔒 SECURITY EVENT: Unexpected error:', {
+            console.error("[OAuth] 🔒 SECURITY EVENT: Unexpected error:", {
                 error: error instanceof Error ? error.message : String(error),
                 stack: error instanceof Error ? error.stack : undefined,
                 timestamp: new Date().toISOString(),
-                eventType: 'oauth_unexpected_error',
-                severity: 'error'
+                eventType: "oauth_unexpected_error",
+                severity: "error",
             });
             const html = errorTemplate({
-                error: 'internal_error',
-                description: error instanceof Error ? error.message : 'An unexpected error occurred'
+                error: "internal_error",
+                description: error instanceof Error
+                    ? error.message
+                    : "An unexpected error occurred",
             });
             return c.html(html, 500);
         }
@@ -736,17 +905,17 @@ export function createOAuthCallbackHandler(config = {}) {
  */
 export function extractDelegationToken(c) {
     // Check Authorization header
-    const authHeader = c.req.header('Authorization');
-    if (authHeader?.startsWith('Bearer ')) {
+    const authHeader = c.req.header("Authorization");
+    if (authHeader?.startsWith("Bearer ")) {
         return authHeader.substring(7);
     }
     // Check custom header
-    const customHeader = c.req.header('x-delegation-token');
+    const customHeader = c.req.header("x-delegation-token");
     if (customHeader) {
         return customHeader;
     }
     // Check query parameter
-    const queryParam = c.req.query('delegation_token');
+    const queryParam = c.req.query("delegation_token");
     if (queryParam) {
         return queryParam;
     }