@kya-os/mcp-i-cloudflare 1.6.44 → 1.6.46

package/dist/services/consent.service.js

@@ -94,7 +94,7 @@ export class ConsentService {
             // ✅ CRITICAL: Fetch config from remote API
             const config = await this.getConfigFromRemoteAPI(projectId);
             if (!config?.proofing?.enabled) {
-                console.log("[ConsentService] Proofing not enabled in remote config");
+                console.error("[ConsentService] Proofing not enabled in remote config");
                 return; // Proofing not enabled
             }
             // Get identity (async - requires runtime to be initialized)
@@ -110,7 +110,7 @@ export class ConsentService {
             // Create audit service with fetched config
             this.auditService = new ConsentAuditService(new ProofService(config, this.runtime), auditLogger, proofGenerator, config, // ✅ Config fetched from remote API
             this.runtime);
-            console.log("[ConsentService] Audit service initialized successfully");
+            console.error("[ConsentService] Audit service initialized successfully");
         }
         catch (error) {
             console.error("[ConsentService] Failed to initialize audit service:", error);
@@ -165,7 +165,7 @@ export class ConsentService {
                         const runtimeIdentity = await this.runtime?.getIdentity();
                         if (runtimeIdentity?.did) {
                             identityConfig.serverDid = runtimeIdentity.did;
-                            console.log("[ConsentService] Populated serverDid from runtime identity");
+                            console.error("[ConsentService] Populated serverDid from runtime identity");
                         }
                     }
                     catch (error) {
@@ -209,7 +209,7 @@ export class ConsentService {
                 const oauthKey = STORAGE_KEYS.oauthIdentity(oauthIdentity.provider, oauthIdentity.subject);
                 const mappedUserDid = await this.env.DELEGATION_STORAGE.get(oauthKey, "text");
                 if (mappedUserDid) {
-                    console.log("[ConsentService] Found persistent User DID from OAuth mapping:", {
+                    console.error("[ConsentService] Found persistent User DID from OAuth mapping:", {
                         provider: oauthIdentity.provider,
                         userDid: mappedUserDid.substring(0, 20) + "...",
                     });
@@ -269,7 +269,7 @@ export class ConsentService {
                 await this.env.DELEGATION_STORAGE.put(userAgentKey, delegationToken, {
                     expirationTtl: delegationTtl,
                 });
-                console.log("[ConsentService] 🔄 DELEGATION UPGRADE: Migrated consent-only delegation to user+agent scoped:", {
+                console.error("[ConsentService] 🔄 DELEGATION UPGRADE: Migrated consent-only delegation to user+agent scoped:", {
                     sessionId: sessionId.substring(0, 8) + "...",
                     userDid: userDid.substring(0, 20) + "...",
                     agentDid: agentDid.substring(0, 20) + "...",
@@ -293,7 +293,7 @@ export class ConsentService {
                 }),
             };
             await this.env.DELEGATION_STORAGE.put(sessionKey, JSON.stringify(sessionData), { expirationTtl: DEFAULT_SESSION_CACHE_TTL });
-            console.log("[ConsentService] Session identity updated:", {
+            console.error("[ConsentService] Session identity updated:", {
                 sessionId: sessionId.substring(0, 8) + "...",
                 userDid: userDid.substring(0, 20) + "...",
                 provider: oauthIdentity?.provider,
@@ -311,7 +311,7 @@ export class ConsentService {
                 await this.env.DELEGATION_STORAGE.put(oauthKey, userDid, {
                     expirationTtl: 90 * 24 * 60 * 60, // 90 days for persistent mapping
                 });
-                console.log("[ConsentService] Created OAuth → DID mapping:", {
+                console.error("[ConsentService] Created OAuth → DID mapping:", {
                     provider: oauthIdentity.provider,
                     userDid: userDid.substring(0, 20) + "...",
                 });
@@ -342,7 +342,7 @@ export class ConsentService {
                 const key = STORAGE_KEYS.userKeyPair(oauthIdentity.provider, oauthIdentity.subject);
                 const stored = (await this.env.DELEGATION_STORAGE.get(key, "json"));
                 if (stored) {
-                    console.log("[ConsentService] Found key pair in KV storage");
+                    console.error("[ConsentService] Found key pair in KV storage");
                     return stored;
                 }
             }
@@ -383,7 +383,7 @@ export class ConsentService {
         // 1. Try existing lookup first
         const existingKeyPair = await this.getKeyPairForSession(sessionId, oauthIdentity);
         if (existingKeyPair) {
-            console.log("[ConsentService] Found existing key pair for OAuth identity");
+            console.error("[ConsentService] Found existing key pair for OAuth identity");
             return existingKeyPair;
         }
         // 2. Check KV storage directly by OAuth identity
@@ -394,7 +394,7 @@ export class ConsentService {
                 const key = STORAGE_KEYS.userKeyPair(oauthIdentity.provider, oauthIdentity.subject);
                 const stored = (await this.env.DELEGATION_STORAGE.get(key, "json"));
                 if (stored) {
-                    console.log("[ConsentService] Found key pair in KV storage");
+                    console.error("[ConsentService] Found key pair in KV storage");
                     return stored;
                 }
             }
@@ -403,7 +403,7 @@ export class ConsentService {
             }
         }
         // 3. Generate new key pair
-        console.log("[ConsentService] Generating new key pair for OAuth identity");
+        console.error("[ConsentService] Generating new key pair for OAuth identity");
         try {
             const crypto = new WebCryptoProvider();
             const rawKeyPair = await crypto.generateKeyPair();
@@ -426,13 +426,13 @@ export class ConsentService {
                     await this.env.DELEGATION_STORAGE.put(key, JSON.stringify(keyPair), {
                         expirationTtl: KEY_PAIR_TTL_SECONDS,
                     });
-                    console.log("[ConsentService] Key pair persisted to KV storage");
+                    console.error("[ConsentService] Key pair persisted to KV storage");
                 }
                 catch (persistError) {
                     console.warn("[ConsentService] KV key pair persistence failed (non-fatal):", persistError);
                 }
             }
-            console.log("[ConsentService] Key pair generated:", {
+            console.error("[ConsentService] Key pair generated:", {
                 did: did.substring(0, 30) + "...",
                 keyId,
             });
@@ -496,7 +496,7 @@ export class ConsentService {
             const signature = base64urlEncodeFromBytes(signatureBytes);
             // Step 4: Complete the JWT
             const jwt = completeVCJWT(signingInput, signature);
-            console.log("[ConsentService] VC issued successfully:", {
+            console.error("[ConsentService] VC issued successfully:", {
                 issuerDid: keyPair.did.substring(0, 20) + "...",
                 subjectDid: delegation.subjectDid.substring(0, 20) + "...",
                 delegationId: delegation.id,
@@ -590,7 +590,7 @@ export class ConsentService {
                     metrics: { totalMs: Date.now() - startTime },
                 };
             }
-            console.log("[ConsentService] verifyDelegationVC: JWT signature verified successfully");
+            console.error("[ConsentService] verifyDelegationVC: JWT signature verified successfully");
         }
         // Step 4: Run basic VC validation via DelegationCredentialVerifier
         // Skip signature verification since we already verified the JWT signature above
@@ -606,7 +606,7 @@ export class ConsentService {
             result.metrics.totalMs = Date.now() - startTime;
         }
         if (result.valid) {
-            console.log("[ConsentService] verifyDelegationVC: VC verified successfully", {
+            console.error("[ConsentService] verifyDelegationVC: VC verified successfully", {
                 issuer: vc.issuer,
                 subject: vc.credentialSubject?.id,
             });
@@ -633,6 +633,15 @@ export class ConsentService {
      * @returns True if OAuth redirect is required
      */
     async isOAuthRequired(projectId, oauthIdentity, toolOAuthProvider, toolProtection) {
+        // Priority 0: Check for consent-only mode (authorization.type === 'none')
+        // Consent-only means delegation is required but NO OAuth provider is needed
+        if (toolProtection?.authorization?.type === "none") {
+            console.error("[ConsentService] Tool is consent-only mode (authorization.type=none), OAuth NOT required", {
+                projectId,
+                requiresDelegation: toolProtection.requiresDelegation,
+            });
+            return false;
+        }
         // If OAuth identity is already present, OAuth is not required
         if (oauthIdentity && oauthIdentity.provider && oauthIdentity.subject) {
             return false;
@@ -650,7 +659,7 @@ export class ConsentService {
                 try {
                     const resolvedProvider = await this.providerResolver.resolveProvider(toolProtection, projectId);
                     if (resolvedProvider) {
-                        console.log("[ConsentService] OAuth required: ProviderResolver resolved provider", {
+                        console.error("[ConsentService] OAuth required: ProviderResolver resolved provider", {
                             projectId,
                             provider: resolvedProvider,
                             toolRequiresDelegation: toolProtection.requiresDelegation,
@@ -660,6 +669,11 @@ export class ConsentService {
                     }
                 }
                 catch (error) {
+                    // Check if this is ConsentOnlyModeError - not a real error
+                    if (error instanceof Error && error.name === "ConsentOnlyModeError") {
+                        console.error("[ConsentService] Tool is consent-only mode (ConsentOnlyModeError), OAuth NOT required", { projectId });
+                        return false;
+                    }
                     // ProviderResolver failed - log but continue to fallback check
                     console.warn("[ConsentService] ProviderResolver failed to resolve provider, falling back to project config check:", {
                         projectId,
@@ -771,7 +785,7 @@ export class ConsentService {
             // Store state data securely in KV (10 minute TTL for OAuth flow)
             await oauthSecurityService.storeOAuthState(stateValue, stateData, 600);
             stateParam = stateValue;
-            console.log("[ConsentService] 🔒 SECURITY EVENT: OAuth state stored securely:", {
+            console.error("[ConsentService] 🔒 SECURITY EVENT: OAuth state stored securely:", {
                 projectId,
                 agentDid: agentDid.substring(0, 20) + "...",
                 sessionId: sessionId.substring(0, 20) + "...",
@@ -794,13 +808,13 @@ export class ConsentService {
         if (provider && this.providerRegistry) {
             // Lazy load providers if registry is empty (first request for this project)
             if (this.providerRegistry.getProviderNames().length === 0) {
-                console.log("[ConsentService] Loading providers from AgentShield", {
+                console.error("[ConsentService] Loading providers from AgentShield", {
                     projectId,
                     provider,
                 });
                 try {
                     await this.providerRegistry.loadFromAgentShield(projectId);
-                    console.log("[ConsentService] Providers loaded successfully", {
+                    console.error("[ConsentService] Providers loaded successfully", {
                         projectId,
                         providers: this.providerRegistry.getProviderNames(),
                         configuredProvider: this.providerRegistry.getConfiguredProvider(),
@@ -819,7 +833,7 @@ export class ConsentService {
             providerConfig = this.providerRegistry.getProvider(provider);
         }
         // Diagnostic logging to track race condition and OAuth mode selection
-        console.log("[ConsentService] OAuth mode decision:", {
+        console.error("[ConsentService] OAuth mode decision:", {
             provider: provider || "none",
             hasProviderRegistry: !!this.providerRegistry,
             hasProviderConfig: !!providerConfig,
@@ -858,7 +872,7 @@ export class ConsentService {
             !providerConfig.proxyMode) {
             // Use providerConfig.clientId from AgentShield dashboard config
             const oauthClientId = providerConfig.clientId || projectId;
-            console.log("[ConsentService] Using direct OAuth mode (PKCE)", {
+            console.error("[ConsentService] Using direct OAuth mode (PKCE)", {
                 provider: provider || "unknown",
                 authorizationUrl: providerConfig.authorizationUrl,
                 supportsPKCE: providerConfig.supportsPKCE,
@@ -1009,7 +1023,7 @@ export class ConsentService {
         try {
             const existingUserDid = await this.env.DELEGATION_STORAGE.get(oauthKey, "text");
             if (existingUserDid) {
-                console.log("[ConsentService] OAuth identity already mapped:", {
+                console.error("[ConsentService] OAuth identity already mapped:", {
                     provider: oauthIdentity.provider,
                     subject: oauthIdentity.subject.substring(0, 20) + "...",
                     userDid: existingUserDid.substring(0, 20) + "...",
@@ -1037,7 +1051,7 @@ export class ConsentService {
             await this.env.DELEGATION_STORAGE.put(oauthIdentityKey, JSON.stringify(oauthIdentity), {
                 expirationTtl: 90 * 24 * 60 * 60, // 90 days
             });
-            console.log("[ConsentService] OAuth identity linked to User DID:", {
+            console.error("[ConsentService] OAuth identity linked to User DID:", {
                 provider: oauthIdentity.provider,
                 subject: oauthIdentity.subject.substring(0, 20) + "...",
                 userDid: userDid.substring(0, 20) + "...",
@@ -1097,7 +1111,7 @@ export class ConsentService {
             await this.env.DELEGATION_STORAGE.put(oauthIdentityKey, JSON.stringify(oauthIdentity), {
                 expirationTtl: 90 * 24 * 60 * 60, // 90 days
             });
-            console.log("[ConsentService] Cached external User DID from AgentShield:", {
+            console.error("[ConsentService] Cached external User DID from AgentShield:", {
                 provider: oauthIdentity.provider,
                 subject: oauthIdentity.subject.substring(0, 20) + "...",
                 userDid: userDid.substring(0, 30) + "...",
@@ -1264,7 +1278,7 @@ export class ConsentService {
             // This is the most explicit - passed from buildConsentUrl when tool has oauthProvider configured
             if (urlProvider) {
                 provider = urlProvider;
-                console.log("[ConsentService] Using provider from URL query param:", {
+                console.error("[ConsentService] Using provider from URL query param:", {
                     provider,
                     projectId,
                     tool,
@@ -1281,7 +1295,7 @@ export class ConsentService {
                         if (protection) {
                             provider = await this.providerResolver.resolveProvider(protection, projectId);
                             if (provider) {
-                                console.log("[ConsentService] Using provider from resolver:", {
+                                console.error("[ConsentService] Using provider from resolver:", {
                                     provider,
                                     projectId,
                                     tool,
@@ -1291,15 +1305,22 @@ export class ConsentService {
                     }
                 }
                 catch (error) {
-                    // Non-fatal - continue without provider info
-                    console.warn("[ConsentService] Failed to resolve provider for consent page:", error);
+                    // Check if this is ConsentOnlyModeError - expected behavior, not an error
+                    if (error instanceof Error && error.name === "ConsentOnlyModeError") {
+                        console.error("[ConsentService] Tool is consent-only mode, no provider needed for consent page", { projectId, tool });
+                        // Continue without provider - consent-only mode just needs clickwrap
+                    }
+                    else {
+                        // Non-fatal - continue without provider info
+                        console.warn("[ConsentService] Failed to resolve provider for consent page:", error);
+                    }
                 }
             }
             // PRIORITY 3: Fallback to toolOAuthProvider if still undefined
             // This is a SEPARATE check (not else-if) to handle when providerResolver exists but returns undefined
             if (!provider && toolOAuthProvider) {
                 provider = toolOAuthProvider;
-                console.log("[ConsentService] Using provider from tool protection (fallback):", {
+                console.error("[ConsentService] Using provider from tool protection (fallback):", {
                     provider,
                     projectId,
                     tool,
@@ -1320,7 +1341,7 @@ export class ConsentService {
                 oauthSecurityService, agentName || undefined // Human-readable agent name for AgentShield dashboard
                 );
                 isOAuthRequired = true;
-                console.log("[ConsentService] 🔒 SECURITY EVENT: OAuth required, preparing consent page with redirect:", {
+                console.error("[ConsentService] 🔒 SECURITY EVENT: OAuth required, preparing consent page with redirect:", {
                     projectId,
                     agentDid: agentDid.substring(0, 20) + "...",
                     oauthUrl: resolvedOAuthUrl.substring(0, 100) + "...",
@@ -1377,7 +1398,7 @@ export class ConsentService {
                 try {
                     const credentialProviderConfig = await this.getCredentialProviderConfig(projectId, provider);
                     if (credentialProviderConfig) {
-                        console.log("[ConsentService] Credential provider detected, rendering credential page", {
+                        console.error("[ConsentService] Credential provider detected, rendering credential page", {
                             projectId,
                             provider,
                             providerType: credentialProviderConfig.type,
@@ -2506,11 +2527,11 @@ export class ConsentService {
      * @returns JSON response
      */
     async handleApproval(request) {
-        console.log("[ConsentService] Approval request received");
+        console.error("[ConsentService] Approval request received");
         try {
             // Parse and validate request body (supports both JSON and FormData)
             const body = await this.parseRequestBody(request);
-            console.log("[ConsentService] Request body parsed:", {
+            console.error("[ConsentService] Request body parsed:", {
                 hasBody: !!body,
                 bodyKeys: Object.keys(body || {}),
                 hasOAuthIdentity: !!body?.oauth_identity,
@@ -2524,14 +2545,14 @@ export class ConsentService {
             // CRED-003: Check for credential provider submission
             // Credential submissions include `provider_type: 'credential'` and are handled separately
             if (providerType === "credential") {
-                console.log("[ConsentService] Credential submission detected");
+                console.error("[ConsentService] Credential submission detected");
                 return this.handleCredentialApproval(bodyObj);
             }
             // ✅ Consent-only mode (provider_type: 'none')
             // User consents without authentication - clickwrap only
             // Delegation is created without user_did (anonymous consent)
             if (providerType === "none") {
-                console.log("[ConsentService] Consent-only mode detected (clickwrap)");
+                console.error("[ConsentService] Consent-only mode detected (clickwrap)");
                 // Continue to normal delegation flow - user_did will be null/undefined
                 // This is intentional for consent-only scenarios where user identity isn't required
             }
@@ -2564,7 +2585,7 @@ export class ConsentService {
                 });
             }
             const approvalRequest = validation.data;
-            console.log("[ConsentService] Approval request validated:", {
+            console.error("[ConsentService] Approval request validated:", {
                 agentDid: approvalRequest.agent_did?.substring(0, 20) + "...",
                 sessionId: approvalRequest.session_id?.substring(0, 20) + "...",
                 scopes: approvalRequest.scopes,
@@ -2614,7 +2635,7 @@ export class ConsentService {
                 // The credential_required event is just for audit tracking
             }
             // Create delegation via AgentShield API
-            console.log("[ConsentService] Creating delegation...");
+            console.error("[ConsentService] Creating delegation...");
             const delegationResult = await this.createDelegation(approvalRequest);
             if (!delegationResult.success) {
                 console.error("[ConsentService] Delegation creation failed:", {
@@ -2630,7 +2651,7 @@ export class ConsentService {
                     headers: { "Content-Type": "application/json" },
                 });
             }
-            console.log("[ConsentService] ✅ Delegation created successfully:", {
+            console.error("[ConsentService] ✅ Delegation created successfully:", {
                 delegationId: delegationResult.delegation_id?.substring(0, 20) + "...",
             });
             // Store delegation token in KV
@@ -2736,7 +2757,7 @@ export class ConsentService {
             // Only fetch from storage if not already provided in request
             if (!userDid && request.session_id) {
                 try {
-                    console.log("[ConsentService] Getting User DID for session:", {
+                    console.error("[ConsentService] Getting User DID for session:", {
                         sessionId: request.session_id.substring(0, 20) + "...",
                         hasOAuthIdentity: !!request.oauth_identity,
                         oauthProvider: request.oauth_identity?.provider,
@@ -2748,7 +2769,7 @@ export class ConsentService {
                     userDid =
                         (await this.getUserDidForSession(request.session_id, request.oauth_identity || undefined // Explicitly handle null as undefined
                         )) ?? undefined;
-                    console.log("[ConsentService] User DID retrieved from storage:", {
+                    console.error("[ConsentService] User DID retrieved from storage:", {
                         userDid: userDid?.substring(0, 20) + "...",
                         hasUserDid: !!userDid,
                     });
@@ -2762,13 +2783,13 @@ export class ConsentService {
             }
             else if (userDid) {
                 // userDid was provided in request (e.g., from credential auth flow)
-                console.log("[ConsentService] Using provided user_did from request:", {
+                console.error("[ConsentService] Using provided user_did from request:", {
                     userDid: userDid.substring(0, 20) + "...",
                     source: "request.user_did",
                 });
             }
             else {
-                console.log("[ConsentService] No session_id provided - skipping User DID generation");
+                console.error("[ConsentService] No session_id provided - skipping User DID generation");
             }
             const expiresInDays = 7; // Default to 7 days
             // Phase 2 VC-Only: Issue Delegation VC if we have a session and userDid
@@ -2799,7 +2820,7 @@ export class ConsentService {
                     const vcResult = await this.issueDelegationVC(localDelegation, request.session_id, request.oauth_identity || undefined);
                     credentialJwt = vcResult ?? undefined;
                     if (credentialJwt) {
-                        console.log("[ConsentService] VC issued for delegation:", {
+                        console.error("[ConsentService] VC issued for delegation:", {
                             delegationId,
                             jwtLength: credentialJwt.length,
                         });
@@ -2813,7 +2834,7 @@ export class ConsentService {
             // Build delegation request with error-based format detection
             // Try full format first, fallback to simplified format on error
             const delegationRequest = await this.buildDelegationRequest(request, userDid, expiresInDays, fieldName, credentialJwt);
-            console.log("[ConsentService] Creating delegation:", {
+            console.error("[ConsentService] Creating delegation:", {
                 url: `${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`,
                 agentDid: request.agent_did.substring(0, 20) + "...",
                 scopes: request.scopes,
@@ -2844,7 +2865,7 @@ export class ConsentService {
                 // AgentShield now returns delegation_token for stateless verification
                 const responseDataObj = wrappedResponse.data;
                 const delegationToken = responseDataObj.delegation_token;
-                console.log("[ConsentService] ✅ Delegation created successfully:", {
+                console.error("[ConsentService] ✅ Delegation created successfully:", {
                     delegationId,
                     agentDid: wrappedResponse.data.agent_did.substring(0, 20) + "...",
                     scopes: wrappedResponse.data.scopes,
@@ -2867,7 +2888,7 @@ export class ConsentService {
                 // Extract delegation_token (JWT) if present in response
                 const unwrappedDataObj = unwrappedResponse;
                 const delegationToken = unwrappedDataObj.delegation_token;
-                console.log("[ConsentService] ✅ Delegation created successfully:", {
+                console.error("[ConsentService] ✅ Delegation created successfully:", {
                     delegationId,
                     agentDid: unwrappedResponse.agent_did.substring(0, 20) + "...",
                     scopes: unwrappedResponse.scopes,
@@ -2953,7 +2974,7 @@ export class ConsentService {
                 await delegationStorage.put(userAgentKey, token, {
                     expirationTtl: ttl,
                 });
-                console.log("[ConsentService] ✅ Token stored with user+agent DID:", {
+                console.error("[ConsentService] ✅ Token stored with user+agent DID:", {
                     key: userAgentKey,
                     ttl,
                     delegationId,
@@ -2976,14 +2997,14 @@ export class ConsentService {
             await delegationStorage.put(sessionKey, JSON.stringify(sessionDataToStore), {
                 expirationTtl: ttl, // Use full TTL - this is the primary storage for session
             });
-            console.log("[ConsentService] ✅ Token stored for session:", {
+            console.error("[ConsentService] ✅ Token stored for session:", {
                 key: sessionKey,
                 ttl,
                 sessionId: sessionId.substring(0, 20) + "...",
                 hasUserDid: !!userDid,
             });
             // Metrics: Log delegation key type for monitoring
-            console.log("[ConsentService] 📊 Delegation storage metrics:", {
+            console.error("[ConsentService] 📊 Delegation storage metrics:", {
                 delegationKeyType: userDid ? "user_agent_scoped" : "session_scoped",
                 hasUserDid: !!userDid,
                 userDidPrefix: userDid
@@ -3098,7 +3119,7 @@ export class ConsentService {
      * @returns JSON response
      */
     async handleCredentialApproval(body) {
-        console.log("[ConsentService] Processing credential approval");
+        console.error("[ConsentService] Processing credential approval");
         // Extract standard fields
         const { tool, scopes: rawScopes, agent_did, session_id, project_id, provider, provider_type, csrf_token, ...credentials } = body;
         // Parse scopes - handles double JSON encoding from form submission
@@ -3160,7 +3181,7 @@ export class ConsentService {
             // See: https://developers.cloudflare.com/workers/observability/errors/#illegal-invocation-errors
             const credentialHandler = createCredentialAuthHandler({
                 fetch: (...args) => globalThis.fetch(...args),
-                logger: (msg, data) => console.log(msg, data),
+                logger: (msg, data) => console.error(msg, data),
             });
             const authResult = await credentialHandler.authenticate(providerConfig, credentials);
             if (!authResult.success) {
@@ -3173,7 +3194,7 @@ export class ConsentService {
                     error_code: "auth_failed",
                 }), { status: 401, headers: { "Content-Type": "application/json" } });
             }
-            console.log("[ConsentService] ✅ Credential authentication successful");
+            console.error("[ConsentService] ✅ Credential authentication successful");
             // 3. Resolve identity via AgentShield
             const identityResult = await this.resolveCredentialIdentity({
                 projectId: project_id,
@@ -3189,7 +3210,7 @@ export class ConsentService {
                     error_code: "identity_resolution_failed",
                 }), { status: 500, headers: { "Content-Type": "application/json" } });
             }
-            console.log("[ConsentService] ✅ Identity resolved", {
+            console.error("[ConsentService] ✅ Identity resolved", {
                 userDid: identityResult.userDid.substring(0, 30) + "...",
             });
             // NEW: Update session cache with userDid for proper delegation scoping
@@ -3197,7 +3218,7 @@ export class ConsentService {
             // instead of falling back to legacy agent-only keys
             await this.updateSessionWithIdentity(session_id, identityResult.userDid, null // No OAuth identity for credential auth
             );
-            console.log("[ConsentService] ✅ Session updated with identity");
+            console.error("[ConsentService] ✅ Session updated with identity");
             // 4. Store token in IdpTokenStorage with usage metadata
             // Include userId from authResult for ToolExecutionContext.userId
             await this.storeCredentialToken({
@@ -3209,7 +3230,7 @@ export class ConsentService {
                 scopes,
                 userId: authResult.userId, // Pass extracted userId from credential provider response
             });
-            console.log("[ConsentService] ✅ Token stored");
+            console.error("[ConsentService] ✅ Token stored");
             // 5. Create delegation using standard flow
             // Include provider_type and provider in customFields for AgentShield dashboard display
             const approvalRequest = {
@@ -3233,7 +3254,7 @@ export class ConsentService {
                     error_code: delegationResult.error_code || "delegation_failed",
                 }), { status: 500, headers: { "Content-Type": "application/json" } });
             }
-            console.log("[ConsentService] ✅ Credential approval complete", {
+            console.error("[ConsentService] ✅ Credential approval complete", {
                 delegationId: delegationResult.delegation_id?.substring(0, 20) + "...",
             });
             // Store delegation token
@@ -3348,7 +3369,7 @@ export class ConsentService {
                         });
                         return null;
                     }
-                    console.log("[ConsentService] Found credential provider:", {
+                    console.error("[ConsentService] Found credential provider:", {
                         providerName,
                         hasAuthEndpoint: !!provider.authEndpoint,
                         hasResponseFields: !!provider.responseFields,
@@ -3586,7 +3607,7 @@ export class ConsentService {
             const csrfKey = STORAGE_KEYS.credentialCsrf(sessionId);
             // 10 minute TTL matches OAuth state TTL
             await delegationStorage.put(csrfKey, token, { expirationTtl: 600 });
-            console.log("[ConsentService] CSRF token stored for credential form");
+            console.error("[ConsentService] CSRF token stored for credential form");
         }
         catch (error) {
             console.error("[ConsentService] CSRF token storage error:", error);
@@ -3671,17 +3692,17 @@ export class ConsentService {
         // CRITICAL: user_identifier is optional - delegation works without it
         if (userDid) {
             simplifiedRequest.user_identifier = userDid;
-            console.log("[ConsentService] Including user_identifier in delegation request:", {
+            console.error("[ConsentService] Including user_identifier in delegation request:", {
                 userDid: userDid.substring(0, 20) + "...",
             });
         }
         else {
-            console.log("[ConsentService] No user_identifier (session is anonymous) - delegation will proceed without it");
+            console.error("[ConsentService] No user_identifier (session is anonymous) - delegation will proceed without it");
         }
         // Phase 2 VC-Only: Include credential_jwt if available
         if (credentialJwt) {
             simplifiedRequest.credential_jwt = credentialJwt;
-            console.log("[ConsentService] Including credential_jwt in delegation request");
+            console.error("[ConsentService] Including credential_jwt in delegation request");
         }
         // AgentShield API only accepts "custom_fields", not "metadata"
         // Always use "custom_fields" regardless of Day0 config
@@ -3703,7 +3724,7 @@ export class ConsentService {
                 ...customFieldsFromRequest,
             };
             if (hasProviderInfo) {
-                console.log("[ConsentService] Including provider info in custom_fields:", {
+                console.error("[ConsentService] Including provider info in custom_fields:", {
                     provider_type: customFieldsFromRequest.provider_type,
                     provider: customFieldsFromRequest.provider,
                 });
@@ -3736,7 +3757,7 @@ export class ConsentService {
                 return fullResponse;
             }
             // Full format failed with validation error, try simplified
-            console.log("[ConsentService] Full format failed, trying simplified format...");
+            console.error("[ConsentService] Full format failed, trying simplified format...");
             const simplifiedResponse = await this.makeAPICall(agentShieldUrl, apiKey, request.simplifiedFormat);
             if (simplifiedResponse.success) {
                 await this.cacheFormatPreference("simplified");
@@ -3838,7 +3859,7 @@ export class ConsentService {
             }), {
                 expirationTtl: 3600, // 1 hour
             });
-            console.log(`[ConsentService] Cached format preference: ${format}`);
+            console.error(`[ConsentService] Cached format preference: ${format}`);
         }
         catch (error) {
             console.warn("[ConsentService] Failed to cache format preference:", error);