@kya-os/mcp-i-cloudflare 1.7.13 → 1.7.16

package/dist/services/consent.service.js

@@ -13,7 +13,7 @@ import { STORAGE_KEYS } from "../constants/storage-keys";
 import { loadDay0Config, getDelegationFieldName } from "../utils/day0-config";
 import { validateConsentApprovalRequest, } from "@kya-os/contracts/consent";
 import { AGENTSHIELD_ENDPOINTS, createDelegationAPIResponseSchema, createDelegationResponseSchema, } from "@kya-os/contracts/agentshield-api";
-import { fetchRemoteConfig, createUnsignedVCJWT, completeVCJWT, parseVCJWT, base64urlEncodeFromBytes, base64urlDecodeToBytes, bytesToBase64, generateDidKeyFromBase64, createDelegationVerifier, createDidKeyResolver, } from "@kya-os/mcp-i-core";
+import { fetchRemoteConfig, createUnsignedVCJWT, completeVCJWT, parseVCJWT, base64urlEncodeFromBytes, base64urlDecodeToBytes, bytesToBase64, generateDidKeyFromBase64, createDelegationVerifier, createDidKeyResolver, logger, } from "@kya-os/mcp-i-core";
 import { wrapDelegationAsVC } from "@kya-os/contracts";
 import { WebCryptoProvider } from "../providers/crypto";
 import { ConsentAuditService } from "./consent-audit.service";
@@ -76,11 +76,31 @@ export class ConsentService {
             await this.auditInitPromise;
         }
         catch (error) {
-            console.warn("[ConsentService] Audit service initialization failed:", error);
+            logger.warn("[ConsentService] Audit service initialization failed:", error);
             // Don't throw - audit failures shouldn't break consent flow
         }
         return this.auditService;
     }
+    /**
+     * Public audit helpers for OAuth callback handler
+     *
+     * The OAuth callback handler lives in `src/runtime/oauth-handler.ts` and only
+     * has access to a `ConsentService` instance (not the full runtime wiring needed
+     * to construct `ConsentAuditService`). These helpers bridge that gap and ensure
+     * OAuth auth events generate proofs when proofing is enabled.
+     */
+    async logOAuthAuthSuccess(event) {
+        const auditService = await this.getAuditService(event.projectId);
+        if (!auditService)
+            return;
+        await auditService.logOAuthSuccess(event);
+    }
+    async logOAuthAuthFailed(event) {
+        const auditService = await this.getAuditService(event.projectId);
+        if (!auditService)
+            return;
+        await auditService.logOAuthFailed(event);
+    }
     /**
      * Initialize audit service - fetches config from remote API
      *
@@ -95,7 +115,7 @@ export class ConsentService {
             // ✅ CRITICAL: Fetch config from remote API
             const config = await this.getConfigFromRemoteAPI(projectId);
             if (!config?.proofing?.enabled) {
-                console.error("[ConsentService] Proofing not enabled in remote config");
+                logger.debug("[ConsentService] Proofing not enabled in remote config");
                 return; // Proofing not enabled
             }
             // Get identity (async - requires runtime to be initialized)
@@ -105,16 +125,16 @@ export class ConsentService {
             // Get audit logger
             const auditLogger = this.runtime.getAuditLogger();
             if (!auditLogger) {
-                console.warn("[ConsentService] AuditLogger not available");
+                logger.warn("[ConsentService] AuditLogger not available");
                 return;
             }
             // Create audit service with fetched config
             this.auditService = new ConsentAuditService(new ProofService(config, this.runtime), auditLogger, proofGenerator, config, // ✅ Config fetched from remote API
             this.runtime);
-            console.error("[ConsentService] Audit service initialized successfully");
+            logger.debug("[ConsentService] Audit service initialized successfully");
         }
         catch (error) {
-            console.error("[ConsentService] Failed to initialize audit service:", error);
+            logger.debug("[ConsentService] Failed to initialize audit service:", error);
             // Don't throw - audit failures shouldn't break consent flow
         }
     }
@@ -131,7 +151,7 @@ export class ConsentService {
      */
     async getConfigFromRemoteAPI(projectId) {
         if (!this.env.AGENTSHIELD_API_KEY) {
-            console.warn("[ConsentService] No API key for runtime config fetch");
+            logger.warn("[ConsentService] No API key for runtime config fetch");
             return undefined;
         }
         try {
@@ -166,11 +186,11 @@ export class ConsentService {
                         const runtimeIdentity = await this.runtime?.getIdentity();
                         if (runtimeIdentity?.did) {
                             identityConfig.serverDid = runtimeIdentity.did;
-                            console.error("[ConsentService] Populated serverDid from runtime identity");
+                            logger.debug("[ConsentService] Populated serverDid from runtime identity");
                         }
                     }
                     catch (error) {
-                        console.warn("[ConsentService] Failed to get runtime identity for serverDid:", error);
+                        logger.warn("[ConsentService] Failed to get runtime identity for serverDid:", error);
                     }
                 }
             }
@@ -179,7 +199,7 @@ export class ConsentService {
             return config;
         }
         catch (error) {
-            console.warn("[ConsentService] Error fetching runtime config:", error);
+            logger.warn("[ConsentService] Error fetching runtime config:", error);
             return undefined;
         }
     }
@@ -210,7 +230,7 @@ export class ConsentService {
                 const oauthKey = STORAGE_KEYS.oauthIdentity(oauthIdentity.provider, oauthIdentity.subject);
                 const mappedUserDid = await this.env.DELEGATION_STORAGE.get(oauthKey, "text");
                 if (mappedUserDid) {
-                    console.error("[ConsentService] Found persistent User DID from OAuth mapping:", {
+                    logger.debug("[ConsentService] Found persistent User DID from OAuth mapping:", {
                         provider: oauthIdentity.provider,
                         userDid: mappedUserDid.substring(0, 20) + "...",
                     });
@@ -218,7 +238,7 @@ export class ConsentService {
                 }
             }
             catch (error) {
-                console.warn("[ConsentService] Failed to check OAuth mapping:", error);
+                logger.warn("[ConsentService] Failed to check OAuth mapping:", error);
             }
         }
         // Priority 2: Check session storage for existing DID
@@ -231,7 +251,7 @@ export class ConsentService {
                 }
             }
             catch (error) {
-                console.warn("[ConsentService] Failed to read session cache:", error);
+                logger.warn("[ConsentService] Failed to read session cache:", error);
             }
         }
         // Phase 5: No ephemeral DID generation - session stays anonymous
@@ -250,7 +270,7 @@ export class ConsentService {
      */
     async updateSessionWithIdentity(sessionId, userDid, oauthIdentity) {
         if (!this.env.DELEGATION_STORAGE) {
-            console.warn("[ConsentService] No DELEGATION_STORAGE - cannot persist session identity");
+            logger.warn("[ConsentService] No DELEGATION_STORAGE - cannot persist session identity");
             return;
         }
         const sessionKey = STORAGE_KEYS.session(sessionId);
@@ -270,7 +290,7 @@ export class ConsentService {
                 await this.env.DELEGATION_STORAGE.put(userAgentKey, delegationToken, {
                     expirationTtl: delegationTtl,
                 });
-                console.error("[ConsentService] 🔄 DELEGATION UPGRADE: Migrated consent-only delegation to user+agent scoped:", {
+                logger.debug("[ConsentService] 🔄 DELEGATION UPGRADE: Migrated consent-only delegation to user+agent scoped:", {
                     sessionId: sessionId.substring(0, 8) + "...",
                     userDid: userDid.substring(0, 20) + "...",
                     agentDid: agentDid.substring(0, 20) + "...",
@@ -294,7 +314,7 @@ export class ConsentService {
                 }),
             };
             await this.env.DELEGATION_STORAGE.put(sessionKey, JSON.stringify(sessionData), { expirationTtl: DEFAULT_SESSION_CACHE_TTL });
-            console.error("[ConsentService] Session identity updated:", {
+            logger.debug("[ConsentService] Session identity updated:", {
                 sessionId: sessionId.substring(0, 8) + "...",
                 userDid: userDid.substring(0, 20) + "...",
                 provider: oauthIdentity?.provider,
@@ -302,7 +322,7 @@ export class ConsentService {
             });
         }
         catch (error) {
-            console.warn("[ConsentService] Failed to update session with identity:", error);
+            logger.warn("[ConsentService] Failed to update session with identity:", error);
             throw error;
         }
         // Create OAuth → DID mapping for future lookups
@@ -312,13 +332,13 @@ export class ConsentService {
                 await this.env.DELEGATION_STORAGE.put(oauthKey, userDid, {
                     expirationTtl: 90 * 24 * 60 * 60, // 90 days for persistent mapping
                 });
-                console.error("[ConsentService] Created OAuth → DID mapping:", {
+                logger.debug("[ConsentService] Created OAuth → DID mapping:", {
                     provider: oauthIdentity.provider,
                     userDid: userDid.substring(0, 20) + "...",
                 });
             }
             catch (error) {
-                console.warn("[ConsentService] Failed to create OAuth mapping:", error);
+                logger.warn("[ConsentService] Failed to create OAuth mapping:", error);
                 // Non-fatal - session was updated successfully
             }
         }
@@ -343,12 +363,12 @@ export class ConsentService {
                 const key = STORAGE_KEYS.userKeyPair(oauthIdentity.provider, oauthIdentity.subject);
                 const stored = (await this.env.DELEGATION_STORAGE.get(key, "json"));
                 if (stored) {
-                    console.error("[ConsentService] Found key pair in OAuth KV storage");
+                    logger.debug("[ConsentService] Found key pair in OAuth KV storage");
                     return stored;
                 }
             }
             catch (error) {
-                console.warn("[ConsentService] KV key pair lookup failed:", error);
+                logger.warn("[ConsentService] KV key pair lookup failed:", error);
             }
         }
         // Priority 2: Check session storage for ephemeral key pair (consent-only flow)
@@ -358,12 +378,12 @@ export class ConsentService {
                 const sessionKey = STORAGE_KEYS.session(sessionId);
                 const sessionData = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
                 if (sessionData?.keyPair) {
-                    console.error("[ConsentService] Found ephemeral key pair in session storage (consent-only VC signing)");
+                    logger.debug("[ConsentService] Found ephemeral key pair in session storage (consent-only VC signing)");
                     return sessionData.keyPair;
                 }
             }
             catch (error) {
-                console.warn("[ConsentService] Session key pair lookup failed:", error);
+                logger.warn("[ConsentService] Session key pair lookup failed:", error);
             }
         }
         // Priority 3: Try UserDidManager (legacy path, may not be initialized)
@@ -378,7 +398,7 @@ export class ConsentService {
             }
         }
         // No key pair found
-        console.warn("[ConsentService] No key pair found for session - user cannot sign VCs");
+        logger.warn("[ConsentService] No key pair found for session - user cannot sign VCs");
         return null;
     }
     /**
@@ -400,7 +420,7 @@ export class ConsentService {
         // 1. Try existing lookup first
         const existingKeyPair = await this.getKeyPairForSession(sessionId, oauthIdentity);
         if (existingKeyPair) {
-            console.error("[ConsentService] Found existing key pair for OAuth identity");
+            logger.debug("[ConsentService] Found existing key pair for OAuth identity");
             return existingKeyPair;
         }
         // 2. Check KV storage directly by OAuth identity
@@ -411,16 +431,16 @@ export class ConsentService {
                 const key = STORAGE_KEYS.userKeyPair(oauthIdentity.provider, oauthIdentity.subject);
                 const stored = (await this.env.DELEGATION_STORAGE.get(key, "json"));
                 if (stored) {
-                    console.error("[ConsentService] Found key pair in KV storage");
+                    logger.debug("[ConsentService] Found key pair in KV storage");
                     return stored;
                 }
             }
             catch (error) {
-                console.warn("[ConsentService] KV key pair lookup failed:", error);
+                logger.warn("[ConsentService] KV key pair lookup failed:", error);
             }
         }
         // 3. Generate new key pair
-        console.error("[ConsentService] Generating new key pair for OAuth identity");
+        logger.debug("[ConsentService] Generating new key pair for OAuth identity");
         try {
             const crypto = new WebCryptoProvider();
             const rawKeyPair = await crypto.generateKeyPair();
@@ -443,20 +463,20 @@ export class ConsentService {
                     await this.env.DELEGATION_STORAGE.put(key, JSON.stringify(keyPair), {
                         expirationTtl: KEY_PAIR_TTL_SECONDS,
                     });
-                    console.error("[ConsentService] Key pair persisted to KV storage");
+                    logger.debug("[ConsentService] Key pair persisted to KV storage");
                 }
                 catch (persistError) {
-                    console.warn("[ConsentService] KV key pair persistence failed (non-fatal):", persistError);
+                    logger.warn("[ConsentService] KV key pair persistence failed (non-fatal):", persistError);
                 }
             }
-            console.error("[ConsentService] Key pair generated:", {
+            logger.debug("[ConsentService] Key pair generated:", {
                 did: did.substring(0, 30) + "...",
                 keyId,
             });
             return keyPair;
         }
         catch (error) {
-            console.error("[ConsentService] Key pair generation failed:", error);
+            logger.error("[ConsentService] Key pair generation failed:", error);
             return null;
         }
     }
@@ -489,7 +509,7 @@ export class ConsentService {
                 const sessionKey = STORAGE_KEYS.session(sessionId);
                 const existingSession = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
                 if (existingSession?.userDid) {
-                    console.error("[ConsentService] Session already has userDid, reusing:", {
+                    logger.debug("[ConsentService] Session already has userDid, reusing:", {
                         sessionId: sessionId.substring(0, 20) + "...",
                         userDid: existingSession.userDid.substring(0, 20) + "...",
                         hasKeyPair: !!existingSession.keyPair,
@@ -498,11 +518,11 @@ export class ConsentService {
                 }
             }
             catch (error) {
-                console.warn("[ConsentService] Failed to check existing session userDid:", error);
+                logger.warn("[ConsentService] Failed to check existing session userDid:", error);
             }
         }
         // Generate new ephemeral keypair - THIS TIME WE STORE IT!
-        console.error("[ConsentService] Generating ephemeral key pair for consent-only VC signing");
+        logger.debug("[ConsentService] Generating ephemeral key pair for consent-only VC signing");
         try {
             const crypto = new WebCryptoProvider();
             const rawKeyPair = await crypto.generateKeyPair();
@@ -528,13 +548,13 @@ export class ConsentService {
                         keyPair, // Store the full key pair for VC signing!
                         identityState: "ephemeral",
                     }), { expirationTtl: DEFAULT_SESSION_CACHE_TTL });
-                    console.error("[ConsentService] ✅ Ephemeral key pair stored in session for VC signing");
+                    logger.debug("[ConsentService] ✅ Ephemeral key pair stored in session for VC signing");
                 }
                 catch (storeError) {
-                    console.warn("[ConsentService] Failed to store ephemeral key pair (VC signing may fail):", storeError);
+                    logger.warn("[ConsentService] Failed to store ephemeral key pair (VC signing may fail):", storeError);
                 }
             }
-            console.error("[ConsentService] ✅ Ephemeral key pair generated:", {
+            logger.info("[ConsentService] ✅ Ephemeral key pair generated:", {
                 sessionId: sessionId.substring(0, 20) + "...",
                 userDid: ephemeralUserDid.substring(0, 30) + "...",
                 hasPrivateKey: true,
@@ -543,7 +563,7 @@ export class ConsentService {
             return ephemeralUserDid;
         }
         catch (error) {
-            console.error("[ConsentService] Failed to generate ephemeral key pair:", error);
+            logger.debug("[ConsentService] Failed to generate ephemeral key pair:", error);
             return null;
         }
     }
@@ -567,7 +587,7 @@ export class ConsentService {
         const keyPair = providedKeyPair ??
             (await this.getKeyPairForSession(sessionId, oauthIdentity));
         if (!keyPair) {
-            console.warn("[ConsentService] Cannot issue VC: no key pair available for session");
+            logger.warn("[ConsentService] Cannot issue VC: no key pair available for session");
             return null;
         }
         try {
@@ -592,7 +612,7 @@ export class ConsentService {
             const signature = base64urlEncodeFromBytes(signatureBytes);
             // Step 4: Complete the JWT
             const jwt = completeVCJWT(signingInput, signature);
-            console.error("[ConsentService] VC issued successfully:", {
+            logger.debug("[ConsentService] VC issued successfully:", {
                 issuerDid: keyPair.did.substring(0, 20) + "...",
                 subjectDid: delegation.subjectDid.substring(0, 20) + "...",
                 delegationId: delegation.id,
@@ -601,7 +621,7 @@ export class ConsentService {
             return jwt;
         }
         catch (error) {
-            console.error("[ConsentService] Failed to issue VC:", error);
+            logger.error("[ConsentService] Failed to issue VC:", error);
             return null;
         }
     }
@@ -627,7 +647,7 @@ export class ConsentService {
         // Step 1: Parse JWT
         const parsed = parseVCJWT(vcJwt);
         if (!parsed) {
-            console.warn("[ConsentService] verifyDelegationVC: Invalid JWT format");
+            logger.warn("[ConsentService] verifyDelegationVC: Invalid JWT format");
             return {
                 valid: false,
                 reason: "Invalid JWT format",
@@ -638,7 +658,7 @@ export class ConsentService {
         // Step 2: Extract VC from payload
         const vc = parsed.payload.vc;
         if (!vc) {
-            console.warn("[ConsentService] verifyDelegationVC: No VC in JWT payload");
+            logger.warn("[ConsentService] verifyDelegationVC: No VC in JWT payload");
             return {
                 valid: false,
                 reason: "No VC in JWT payload",
@@ -678,7 +698,7 @@ export class ConsentService {
             const crypto = new WebCryptoProvider();
             const isValid = await crypto.verify(signingInputBytes, signatureBytes, publicKeyBase64);
             if (!isValid) {
-                console.warn("[ConsentService] verifyDelegationVC: JWT signature verification failed");
+                logger.warn("[ConsentService] verifyDelegationVC: JWT signature verification failed");
                 return {
                     valid: false,
                     reason: "JWT signature verification failed",
@@ -686,7 +706,7 @@ export class ConsentService {
                     metrics: { totalMs: Date.now() - startTime },
                 };
             }
-            console.error("[ConsentService] verifyDelegationVC: JWT signature verified successfully");
+            logger.debug("[ConsentService] verifyDelegationVC: JWT signature verified successfully");
         }
         // Step 4: Run basic VC validation via DelegationCredentialVerifier
         // Skip signature verification since we already verified the JWT signature above
@@ -702,13 +722,13 @@ export class ConsentService {
             result.metrics.totalMs = Date.now() - startTime;
         }
         if (result.valid) {
-            console.error("[ConsentService] verifyDelegationVC: VC verified successfully", {
+            logger.debug("[ConsentService] verifyDelegationVC: VC verified successfully", {
                 issuer: vc.issuer,
                 subject: vc.credentialSubject?.id,
             });
         }
         else {
-            console.warn("[ConsentService] verifyDelegationVC: VC validation failed", {
+            logger.warn("[ConsentService] verifyDelegationVC: VC validation failed", {
                 reason: result.reason,
                 stage: result.stage,
             });
@@ -732,7 +752,7 @@ export class ConsentService {
         // Priority 0: Check for consent-only mode (authorization.type === 'none')
         // Consent-only means delegation is required but NO OAuth provider is needed
         if (toolProtection?.authorization?.type === "none") {
-            console.error("[ConsentService] Tool is consent-only mode (authorization.type=none), OAuth NOT required", {
+            logger.debug("[ConsentService] Tool is consent-only mode (authorization.type=none), OAuth NOT required", {
                 projectId,
                 requiresDelegation: toolProtection.requiresDelegation,
             });
@@ -755,7 +775,7 @@ export class ConsentService {
                 try {
                     const resolvedProvider = await this.providerResolver.resolveProvider(toolProtection, projectId);
                     if (resolvedProvider) {
-                        console.error("[ConsentService] OAuth required: ProviderResolver resolved provider", {
+                        logger.debug("[ConsentService] OAuth required: ProviderResolver resolved provider", {
                             projectId,
                             provider: resolvedProvider,
                             toolRequiresDelegation: toolProtection.requiresDelegation,
@@ -767,11 +787,22 @@ export class ConsentService {
                 catch (error) {
                     // Check if this is ConsentOnlyModeError - not a real error
                     if (error instanceof Error && error.name === "ConsentOnlyModeError") {
-                        console.error("[ConsentService] Tool is consent-only mode (ConsentOnlyModeError), OAuth NOT required", { projectId });
+                        logger.debug("[ConsentService] Tool is consent-only mode (ConsentOnlyModeError), OAuth NOT required", { projectId });
+                        return false;
+                    }
+                    // Check for CredentialAuthModeError - credential auth does NOT require OAuth
+                    // Use multiple detection methods to handle bundled code where class names may be mangled
+                    const isCredentialAuthError = error instanceof Error &&
+                        (error.name === "CredentialAuthModeError" ||
+                            error.constructor?.name === "CredentialAuthModeError" ||
+                            ("provider" in error &&
+                                typeof error.provider === "string"));
+                    if (isCredentialAuthError) {
+                        logger.debug("[ConsentService] Tool uses credential auth (CredentialAuthModeError), OAuth NOT required", { projectId });
                         return false;
                     }
                     // ProviderResolver failed - log but continue to fallback check
-                    console.warn("[ConsentService] ProviderResolver failed to resolve provider, falling back to project config check:", {
+                    logger.warn("[ConsentService] ProviderResolver failed to resolve provider, falling back to project config check:", {
                         projectId,
                         error: error instanceof Error ? error.message : String(error),
                     });
@@ -805,7 +836,7 @@ export class ConsentService {
             return false;
         }
         catch (error) {
-            console.warn("[ConsentService] Failed to check OAuth requirement:", error);
+            logger.warn("[ConsentService] Failed to check OAuth requirement:", error);
             // On error, default to not requiring OAuth (backward compatibility)
             return false;
         }
@@ -846,7 +877,7 @@ export class ConsentService {
                 codeChallenge = pkceChallenge.challenge;
             }
             catch (error) {
-                console.warn("[ConsentService] Failed to generate PKCE challenge:", error);
+                logger.warn("[ConsentService] Failed to generate PKCE challenge:", error);
             }
         }
         // Build state data with required fields
@@ -881,7 +912,7 @@ export class ConsentService {
             // Store state data securely in KV (10 minute TTL for OAuth flow)
             await oauthSecurityService.storeOAuthState(stateValue, stateData, 600);
             stateParam = stateValue;
-            console.error("[ConsentService] 🔒 SECURITY EVENT: OAuth state stored securely:", {
+            logger.debug("[ConsentService] 🔒 SECURITY EVENT: OAuth state stored securely:", {
                 projectId,
                 agentDid: agentDid.substring(0, 20) + "...",
                 sessionId: sessionId.substring(0, 20) + "...",
@@ -894,7 +925,7 @@ export class ConsentService {
         else {
             // Fallback: Encode state as base64 (less secure, but backward compatible)
             if (!oauthSecurityService) {
-                console.warn("[ConsentService] ⚠️ SECURITY WARNING: OAuthSecurityService not provided, using insecure state encoding");
+                logger.warn("[ConsentService] ⚠️ SECURITY WARNING: OAuthSecurityService not provided, using insecure state encoding");
             }
             stateParam = btoa(JSON.stringify(stateData));
         }
@@ -904,20 +935,20 @@ export class ConsentService {
         if (provider && this.providerRegistry) {
             // Lazy load providers if registry is empty (first request for this project)
             if (this.providerRegistry.getProviderNames().length === 0) {
-                console.error("[ConsentService] Loading providers from AgentShield", {
+                logger.debug("[ConsentService] Loading providers from AgentShield", {
                     projectId,
                     provider,
                 });
                 try {
                     await this.providerRegistry.loadFromAgentShield(projectId);
-                    console.error("[ConsentService] Providers loaded successfully", {
+                    logger.debug("[ConsentService] Providers loaded successfully", {
                         projectId,
                         providers: this.providerRegistry.getProviderNames(),
                         configuredProvider: this.providerRegistry.getConfiguredProvider(),
                     });
                 }
                 catch (loadError) {
-                    console.warn("[ConsentService] Failed to load providers from AgentShield", {
+                    logger.warn("[ConsentService] Failed to load providers from AgentShield", {
                         projectId,
                         error: loadError instanceof Error
                             ? loadError.message
@@ -929,7 +960,7 @@ export class ConsentService {
             providerConfig = this.providerRegistry.getProvider(provider);
         }
         // Diagnostic logging to track race condition and OAuth mode selection
-        console.error("[ConsentService] OAuth mode decision:", {
+        logger.debug("[ConsentService] OAuth mode decision:", {
             provider: provider || "none",
             hasProviderRegistry: !!this.providerRegistry,
             hasProviderConfig: !!providerConfig,
@@ -968,7 +999,7 @@ export class ConsentService {
             !providerConfig.proxyMode) {
             // Use providerConfig.clientId from AgentShield dashboard config
             const oauthClientId = providerConfig.clientId || projectId;
-            console.error("[ConsentService] Using direct OAuth mode (PKCE)", {
+            logger.debug("[ConsentService] Using direct OAuth mode (PKCE)", {
                 provider: provider || "unknown",
                 authorizationUrl: providerConfig.authorizationUrl,
                 supportsPKCE: providerConfig.supportsPKCE,
@@ -1119,7 +1150,7 @@ export class ConsentService {
         try {
             const existingUserDid = await this.env.DELEGATION_STORAGE.get(oauthKey, "text");
             if (existingUserDid) {
-                console.error("[ConsentService] OAuth identity already mapped:", {
+                logger.debug("[ConsentService] OAuth identity already mapped:", {
                     provider: oauthIdentity.provider,
                     subject: oauthIdentity.subject.substring(0, 20) + "...",
                     userDid: existingUserDid.substring(0, 20) + "...",
@@ -1128,7 +1159,7 @@ export class ConsentService {
             }
         }
         catch (error) {
-            console.warn("[ConsentService] Failed to check OAuth mapping:", error);
+            logger.warn("[ConsentService] Failed to check OAuth mapping:", error);
             // Continue to check session
         }
         // Phase 5: Check for existing user DID in session
@@ -1147,14 +1178,14 @@ export class ConsentService {
             await this.env.DELEGATION_STORAGE.put(oauthIdentityKey, JSON.stringify(oauthIdentity), {
                 expirationTtl: 90 * 24 * 60 * 60, // 90 days
             });
-            console.error("[ConsentService] OAuth identity linked to User DID:", {
+            logger.debug("[ConsentService] OAuth identity linked to User DID:", {
                 provider: oauthIdentity.provider,
                 subject: oauthIdentity.subject.substring(0, 20) + "...",
                 userDid: userDid.substring(0, 20) + "...",
             });
         }
         catch (error) {
-            console.error("[ConsentService] Failed to store OAuth mapping:", error);
+            logger.error("[ConsentService] Failed to store OAuth mapping:", error);
             // Non-fatal - continue with User DID
         }
         return userDid;
@@ -1172,7 +1203,7 @@ export class ConsentService {
      */
     async cacheExternalUserDid(oauthIdentity, userDid) {
         if (!this.env.DELEGATION_STORAGE) {
-            console.warn("[ConsentService] No storage available for caching external User DID");
+            logger.warn("[ConsentService] No storage available for caching external User DID");
             return;
         }
         const oauthKey = STORAGE_KEYS.oauthIdentity(oauthIdentity.provider, oauthIdentity.subject);
@@ -1182,7 +1213,7 @@ export class ConsentService {
             if (existingUserDid) {
                 // Mapping already exists - verify it matches
                 if (existingUserDid !== userDid) {
-                    console.warn("[ConsentService] OAuth identity already mapped to different User DID:", {
+                    logger.warn("[ConsentService] OAuth identity already mapped to different User DID:", {
                         provider: oauthIdentity.provider,
                         subject: oauthIdentity.subject.substring(0, 20) + "...",
                         existingUserDid: existingUserDid.substring(0, 30) + "...",
@@ -1194,7 +1225,7 @@ export class ConsentService {
             }
         }
         catch (error) {
-            console.warn("[ConsentService] Failed to check existing OAuth mapping:", error);
+            logger.warn("[ConsentService] Failed to check existing OAuth mapping:", error);
             // Continue to store new mapping
         }
         // Store OAuth identity → userDid mapping (persistent - 90 days)
@@ -1207,7 +1238,7 @@ export class ConsentService {
             await this.env.DELEGATION_STORAGE.put(oauthIdentityKey, JSON.stringify(oauthIdentity), {
                 expirationTtl: 90 * 24 * 60 * 60, // 90 days
             });
-            console.error("[ConsentService] Cached external User DID from AgentShield:", {
+            logger.debug("[ConsentService] Cached external User DID from AgentShield:", {
                 provider: oauthIdentity.provider,
                 subject: oauthIdentity.subject.substring(0, 20) + "...",
                 userDid: userDid.substring(0, 30) + "...",
@@ -1215,7 +1246,7 @@ export class ConsentService {
             });
         }
         catch (error) {
-            console.error("[ConsentService] Failed to cache external User DID:", error);
+            logger.debug("[ConsentService] Failed to cache external User DID:", error);
             // Non-fatal - the persistent user_did will still be used
         }
     }
@@ -1301,6 +1332,21 @@ export class ConsentService {
             // ✅ Extract agent_name from URL query param (passed from buildConsentUrl)
             // Human-readable name for AgentShield dashboard display
             const agentName = params.get("agent_name");
+            // ✅ Extract credential auth params for 3-screen flow (Auth → Clickwrap → Success)
+            // These are set when credential auth completes and redirects to clickwrap page
+            // They ensure the delegation is created with 'password' type instead of 'none'
+            const credentialProviderType = params.get("credential_provider_type");
+            const credentialProvider = params.get("credential_provider");
+            // ✅ Extract mode param for post-credential clickwrap detection
+            // When credential auth completes, user is redirected to /consent?mode=consent-only&credential_provider_type=password
+            const mode = params.get("mode");
+            // ✅ LOOP FIX: Detect post-credential clickwrap state to prevent re-rendering credential form
+            // Both conditions must be true to identify post-credential clickwrap:
+            // 1. mode === "consent-only" (indicates we're past auth phase)
+            // 2. credential_provider_type === "password" (confirms this was a credential auth flow)
+            // IMPORTANT: credential_provider_type is a clickwrap-only signal. It is only set by the
+            // credential-auth redirect to clickwrap; it is NOT used for pure consent-only or oauth flows.
+            const isPostCredentialClickwrap = mode === "consent-only" && credentialProviderType === "password";
             // Validate required parameters
             if (!tool || !agentDid || !sessionId || !projectId) {
                 return new Response(JSON.stringify({
@@ -1372,13 +1418,13 @@ export class ConsentService {
                             }
                         }
                         catch (parseError) {
-                            console.warn("[ConsentService] Invalid OAuth cookie format:", parseError);
+                            logger.warn("[ConsentService] Invalid OAuth cookie format:", parseError);
                         }
                     }
                 }
             }
             catch (error) {
-                console.warn("[ConsentService] Failed to extract OAuth cookie:", error);
+                logger.warn("[ConsentService] Failed to extract OAuth cookie:", error);
                 // Non-fatal - continue without OAuth identity
             }
             // Check if OAuth is required (after extracting OAuth identity)
@@ -1400,7 +1446,7 @@ export class ConsentService {
             // This is the most explicit - passed from buildConsentUrl when tool has oauthProvider configured
             if (urlProvider) {
                 provider = urlProvider;
-                console.error("[ConsentService] Using provider from URL query param:", {
+                logger.debug("[ConsentService] Using provider from URL query param:", {
                     provider,
                     projectId,
                     tool,
@@ -1417,7 +1463,7 @@ export class ConsentService {
                         if (protection) {
                             provider = await this.providerResolver.resolveProvider(protection, projectId);
                             if (provider) {
-                                console.error("[ConsentService] Using provider from resolver:", {
+                                logger.debug("[ConsentService] Using provider from resolver:", {
                                     provider,
                                     projectId,
                                     tool,
@@ -1428,13 +1474,32 @@ export class ConsentService {
                 }
                 catch (error) {
                     // Check if this is ConsentOnlyModeError - expected behavior, not an error
-                    if (error instanceof Error && error.name === "ConsentOnlyModeError") {
-                        console.error("[ConsentService] Tool is consent-only mode, no provider needed for consent page", { projectId, tool });
+                    // Use multiple detection methods to handle bundled code where class names may be mangled
+                    const isConsentOnlyError = error instanceof Error &&
+                        (error.name === "ConsentOnlyModeError" ||
+                            error.constructor?.name === "ConsentOnlyModeError");
+                    // Check for CredentialAuthModeError - expected behavior for password-based auth
+                    // Also check for 'provider' property as fallback detection
+                    const isCredentialAuthError = error instanceof Error &&
+                        (error.name === "CredentialAuthModeError" ||
+                            error.constructor?.name === "CredentialAuthModeError" ||
+                            // Fallback: check for provider property (unique to CredentialAuthModeError)
+                            ("provider" in error &&
+                                typeof error.provider === "string"));
+                    if (isConsentOnlyError) {
+                        logger.debug("[ConsentService] Tool is consent-only mode, no provider needed for consent page", { projectId, tool });
                         // Continue without provider - consent-only mode just needs clickwrap
                     }
+                    else if (isCredentialAuthError) {
+                        // CredentialAuthModeError is expected behavior for password-based auth
+                        // Extract provider from the error for credential form rendering
+                        const credError = error;
+                        provider = credError.provider;
+                        logger.debug("[ConsentService] Tool uses credential auth, setting provider for credential form", { projectId, tool, provider });
+                    }
                     else {
                         // Non-fatal - continue without provider info
-                        console.warn("[ConsentService] Failed to resolve provider for consent page:", error);
+                        logger.warn("[ConsentService] Failed to resolve provider for consent page:", error);
                     }
                 }
             }
@@ -1442,7 +1507,7 @@ export class ConsentService {
             // This is a SEPARATE check (not else-if) to handle when providerResolver exists but returns undefined
             if (!provider && toolOAuthProvider) {
                 provider = toolOAuthProvider;
-                console.error("[ConsentService] Using provider from tool protection (fallback):", {
+                logger.debug("[ConsentService] Using provider from tool protection (fallback):", {
                     provider,
                     projectId,
                     tool,
@@ -1450,10 +1515,29 @@ export class ConsentService {
             }
             let resolvedOAuthUrl;
             let isOAuthRequired = false;
-            // Skip OAuth flow for credentials provider - credentials uses form-based auth, not OAuth
-            const isCredentialsProvider = provider?.toLowerCase() === "credentials";
+            // ✅ CONFIG-BASED CREDENTIAL DETECTION (replaces string matching)
+            // Fetch credential provider config ONCE and reuse throughout the method
+            // Only fetch when: provider exists AND we're not in post-credential clickwrap state
+            // This avoids unnecessary network calls for pure consent-only tools and post-auth clickwrap
+            let credentialProviderConfig = null;
+            if (provider && projectId && !isPostCredentialClickwrap) {
+                try {
+                    credentialProviderConfig = await this.getCredentialProviderConfig(projectId, provider);
+                }
+                catch (err) {
+                    // Non-fatal: log and continue - will fall back to OAuth flow
+                    logger.warn("[ConsentService] Failed to fetch credential provider config:", err);
+                }
+            }
+            // Determine if this is a credentials provider based on config existence (not string matching)
+            const isCredentialsProvider = !!credentialProviderConfig;
             if (isCredentialsProvider && oauthRequired) {
-                console.error("[ConsentService] Credentials provider detected - skipping OAuth flow, will render credential form", { provider, projectId, tool });
+                logger.debug("[ConsentService] Credential provider detected via config - skipping OAuth flow, will render credential form", {
+                    provider,
+                    projectId,
+                    tool,
+                    providerType: credentialProviderConfig?.type,
+                });
             }
             if (oauthRequired && !isCredentialsProvider) {
                 // OAuth is required - redirect to OAuth provider instead of showing consent page
@@ -1468,7 +1552,7 @@ export class ConsentService {
                 oauthSecurityService, agentName || undefined // Human-readable agent name for AgentShield dashboard
                 );
                 isOAuthRequired = true;
-                console.error("[ConsentService] 🔒 SECURITY EVENT: OAuth required, preparing consent page with redirect:", {
+                logger.debug("[ConsentService] 🔒 SECURITY EVENT: OAuth required, preparing consent page with redirect:", {
                     projectId,
                     agentDid: agentDid.substring(0, 20) + "...",
                     oauthUrl: resolvedOAuthUrl.substring(0, 100) + "...",
@@ -1492,7 +1576,7 @@ export class ConsentService {
                 })
                     .catch((err) => {
                     // Structured error logging
-                    console.error("[ConsentService] Audit logging failed", {
+                    logger.debug("[ConsentService] Audit logging failed", {
                         eventType: "consent:page_viewed",
                         sessionId,
                         error: err instanceof Error ? err.message : String(err),
@@ -1515,10 +1599,12 @@ export class ConsentService {
                 provider, // Phase 2: Include provider if resolved
                 branding: consentConfig.branding,
                 // ✅ Ensure terms.required has a default value (contracts requires boolean, not boolean | undefined)
-                terms: consentConfig.terms ? {
-                    ...consentConfig.terms,
-                    required: consentConfig.terms.required ?? true,
-                } : undefined,
+                terms: consentConfig.terms
+                    ? {
+                        ...consentConfig.terms,
+                        required: consentConfig.terms.required ?? true,
+                    }
+                    : undefined,
                 customFields: consentConfig.customFields,
                 autoClose: consentConfig.ui?.autoClose ?? false,
                 // ✅ FIX: Pass full UI config (title, description, button text, etc.)
@@ -1530,35 +1616,34 @@ export class ConsentService {
                 // Pass OAuth details for client-side handling
                 oauthRequired: isOAuthRequired,
                 oauthUrl: resolvedOAuthUrl,
+                // ✅ Pass credential auth params for 3-screen flow (Auth → Clickwrap → Success)
+                // These are set when user is redirected from credential auth page to clickwrap
+                // They ensure the delegation is created with 'password' type instead of 'none'
+                credentialProviderType: credentialProviderType || undefined,
+                credentialProvider: credentialProvider || undefined,
             };
-            // CRED-003: Check if this is a credential provider and render credential form
-            if (provider && projectId) {
-                try {
-                    const credentialProviderConfig = await this.getCredentialProviderConfig(projectId, provider);
-                    if (credentialProviderConfig) {
-                        console.error("[ConsentService] Credential provider detected, rendering credential page", {
-                            projectId,
-                            provider,
-                            providerType: credentialProviderConfig.type,
-                            displayName: credentialProviderConfig.displayName,
-                        });
-                        // Generate and store CSRF token for form security
-                        const csrfToken = await this.storeCredentialCsrfToken(sessionId);
-                        // Render credential login page instead of OAuth consent
-                        const html = this.renderer.renderCredentialPage(pageConfig, credentialProviderConfig, provider, csrfToken);
-                        return new Response(html, {
-                            status: 200,
-                            headers: {
-                                "Content-Type": "text/html; charset=utf-8",
-                                "Cache-Control": "no-cache, no-store, must-revalidate",
-                            },
-                        });
-                    }
-                }
-                catch (credError) {
-                    // Non-fatal: If credential provider check fails, fall through to OAuth
-                    console.warn("[ConsentService] Credential provider check failed, falling back to OAuth:", credError);
-                }
+            // CRED-003: Render credential form if this is a credential provider
+            // Guard conditions:
+            // 1. credentialProviderConfig must exist (already fetched above)
+            // 2. Must NOT be in post-credential clickwrap mode (would cause infinite loop)
+            if (credentialProviderConfig && !isPostCredentialClickwrap) {
+                logger.debug("[ConsentService] Credential provider detected, rendering credential page", {
+                    projectId,
+                    provider,
+                    providerType: credentialProviderConfig.type,
+                    displayName: credentialProviderConfig.displayName,
+                });
+                // Generate and store CSRF token for form security
+                const csrfToken = await this.storeCredentialCsrfToken(sessionId);
+                // Render credential login page instead of OAuth consent
+                const html = this.renderer.renderCredentialPage(pageConfig, credentialProviderConfig, provider, csrfToken);
+                return new Response(html, {
+                    status: 200,
+                    headers: {
+                        "Content-Type": "text/html; charset=utf-8",
+                        "Cache-Control": "no-cache, no-store, must-revalidate",
+                    },
+                });
             }
             // Standard OAuth flow: Render page with OAuth identity (if available)
             const html = this.renderer.render(pageConfig, oauthIdentity);
@@ -1571,7 +1656,7 @@ export class ConsentService {
             });
         }
         catch (error) {
-            console.error("[ConsentService] Error rendering consent page:", error);
+            logger.error("[ConsentService] Error rendering consent page:", error);
             return new Response(JSON.stringify({
                 success: false,
                 error: "Failed to render consent page",
@@ -1809,7 +1894,7 @@ export class ConsentService {
             }
             catch (formDataError) {
                 // FormData parsing failed, try URL-encoded text parsing
-                console.warn("[ConsentService] FormData parsing failed, trying URL-encoded text:", formDataError);
+                logger.warn("[ConsentService] FormData parsing failed, trying URL-encoded text:", formDataError);
             }
             // Try URL-encoded text parsing as fallback
             try {
@@ -1820,7 +1905,7 @@ export class ConsentService {
             }
             catch (urlEncodedError) {
                 // Both failed, fall through to JSON parsing
-                console.warn("[ConsentService] URL-encoded parsing also failed:", urlEncodedError);
+                logger.warn("[ConsentService] URL-encoded parsing also failed:", urlEncodedError);
             }
         }
         // Parse multipart FormData (multipart/form-data or when FormData object is passed with other Content-Type)
@@ -2148,7 +2233,7 @@ export class ConsentService {
                 }
             }
             catch (formDataError) {
-                console.warn("[ConsentService] FormData parsing failed:", formDataError);
+                logger.warn("[ConsentService] FormData parsing failed:", formDataError);
                 // Fall through to JSON parsing
             }
         }
@@ -2665,58 +2750,115 @@ export class ConsentService {
      * @returns JSON response
      */
     async handleApproval(request) {
-        console.error("[ConsentService] Approval request received");
+        logger.debug("[ConsentService] Approval request received");
         try {
             // Parse and validate request body (supports both JSON and FormData)
             const body = await this.parseRequestBody(request);
-            console.error("[ConsentService] Request body parsed:", {
+            logger.debug("[ConsentService] Request body parsed:", {
                 hasBody: !!body,
                 bodyKeys: Object.keys(body || {}),
                 hasOAuthIdentity: !!body?.oauth_identity,
             });
             // Handle provider_type routing:
-            // - 'credential': User authenticated via credential form (email/password)
+            // - 'credential' or 'password': User authenticated via credential form (email/password)
             // - 'oauth2': User authenticated via OAuth provider (handled below)
             // - 'none': Consent-only mode (clickwrap) - user agrees without authentication
             const bodyObj = body;
             const providerType = bodyObj?.provider_type;
             // CRED-003: Check for credential provider submission
-            // Credential submissions include `provider_type: 'credential'` and are handled separately
-            if (providerType === CONSENT_PROVIDER_TYPES.CREDENTIAL) {
-                console.error("[ConsentService] Credential submission detected");
+            // Credential submissions include `provider_type: 'credential'` or 'password' and are handled separately
+            // IMPORTANT: AgentShield tool protection uses 'password' for credential-based auth validation,
+            // but we also accept 'credential' for backward compatibility
+            if (providerType === CONSENT_PROVIDER_TYPES.CREDENTIAL ||
+                providerType === CONSENT_PROVIDER_TYPES.PASSWORD) {
+                logger.debug("[ConsentService] Credential submission detected", {
+                    provider_type: providerType,
+                });
                 return this.handleCredentialApproval(bodyObj);
             }
             // ✅ Consent-only mode (provider_type: 'none')
-            // User consents without authentication - clickwrap only
-            // Generate an ephemeral userDid to enable reliable delegation storage & lookup
+            // This can be:
+            // 1. Pure consent-only: User consents without authentication (clickwrap only)
+            // 2. Post-credential clickwrap: User already authenticated via credentials, this is the clickwrap step
+            // 3. Post-OAuth clickwrap: User already authenticated via OAuth, this is the clickwrap step
             if (providerType === CONSENT_PROVIDER_TYPES.NONE) {
-                console.error("[ConsentService] Consent-only mode detected (clickwrap)");
-                // Extract session_id for ephemeral userDid generation
-                const sessionId = body
-                    .session_id;
-                if (sessionId) {
-                    // Generate ephemeral userDid for this consent-only session
-                    // This enables PRIORITY 1 delegation key (user+agent scoped) for reliable lookup
-                    const ephemeralUserDid = await this.generateEphemeralUserDidForSession(sessionId);
-                    if (ephemeralUserDid) {
-                        // Store ephemeral userDid in session cache
-                        // This ensures storeDelegationToken can find it and use PRIORITY 1 key
-                        await this.updateSessionWithIdentity(sessionId, ephemeralUserDid, null // No OAuth identity for consent-only
-                        );
-                        // Also inject the user_did into the request body so createDelegation receives it
-                        body.user_did = ephemeralUserDid;
-                        console.error("[ConsentService] ✅ Ephemeral userDid stored in session for consent-only flow:", {
-                            sessionId: sessionId.substring(0, 20) + "...",
-                            userDid: ephemeralUserDid.substring(0, 30) + "...",
-                            note: "Enables reliable delegation lookup via PRIORITY 1 key",
-                        });
-                    }
-                    else {
-                        console.warn("[ConsentService] ⚠️ Failed to generate ephemeral userDid - delegation will use session-scoped storage only");
+                const bodyObj = body;
+                const sessionId = bodyObj.session_id;
+                // Check for credential auth parameters passed from handleCredentialApproval
+                // These indicate this is the clickwrap step AFTER credential authentication
+                const credentialProviderType = bodyObj.credential_provider_type;
+                const credentialProvider = bodyObj.credential_provider;
+                if (credentialProviderType &&
+                    credentialProviderType === CONSENT_PROVIDER_TYPES.PASSWORD) {
+                    // This is the clickwrap step after credential auth
+                    // The session already has userDid from credential auth
+                    logger.debug("[ConsentService] Consent-only mode (post-credential clickwrap)");
+                    // Override provider_type to 'password' so delegation is created with correct authorization
+                    // This ensures authorization.type matches tool protection expectation
+                    bodyObj.provider_type = CONSENT_PROVIDER_TYPES.PASSWORD;
+                    if (credentialProvider) {
+                        bodyObj.customFields = {
+                            ...(bodyObj.customFields || {}),
+                            provider: credentialProvider,
+                            provider_type: CONSENT_PROVIDER_TYPES.PASSWORD,
+                        };
                     }
+                    logger.debug("[ConsentService] ✅ Using credential auth provider_type for delegation:", {
+                        sessionId: sessionId?.substring(0, 20) + "...",
+                        providerType: CONSENT_PROVIDER_TYPES.PASSWORD,
+                        provider: credentialProvider,
+                        note: "Delegation will have authorization.type='password' to match tool protection",
+                    });
+                    // The userDid should already be in the session from credential auth
+                    // We don't need to generate ephemeral one
                 }
                 else {
-                    console.warn("[ConsentService] ⚠️ No session_id for consent-only flow - delegation will use session-scoped storage only");
+                    // Pure consent-only mode - no prior authentication
+                    logger.debug("[ConsentService] Consent-only mode detected (pure clickwrap)");
+                    if (sessionId && this.env.DELEGATION_STORAGE) {
+                        // Check if session already has userDid (from credential auth or OAuth)
+                        let existingUserDid;
+                        try {
+                            const sessionKey = STORAGE_KEYS.session(sessionId);
+                            const existingSession = (await this.env.DELEGATION_STORAGE.get(sessionKey, "json"));
+                            existingUserDid = existingSession?.userDid;
+                        }
+                        catch (error) {
+                            logger.warn("[ConsentService] Failed to read session for userDid:", error);
+                        }
+                        if (existingUserDid) {
+                            // Session has userDid from prior auth step - use it
+                            logger.debug("[ConsentService] Session already has userDid, reusing:", {
+                                sessionId: sessionId.substring(0, 20) + "...",
+                                userDid: existingUserDid.substring(0, 30) + "...",
+                            });
+                            bodyObj.user_did = existingUserDid;
+                        }
+                        else {
+                            // Generate ephemeral userDid for pure consent-only
+                            // This enables PRIORITY 1 delegation key (user+agent scoped) for reliable lookup
+                            const ephemeralUserDid = await this.generateEphemeralUserDidForSession(sessionId);
+                            if (ephemeralUserDid) {
+                                // Store ephemeral userDid in session cache
+                                // This ensures storeDelegationToken can find it and use PRIORITY 1 key
+                                await this.updateSessionWithIdentity(sessionId, ephemeralUserDid, null // No OAuth identity for consent-only
+                                );
+                                // Also inject the user_did into the request body so createDelegation receives it
+                                bodyObj.user_did = ephemeralUserDid;
+                                logger.debug("[ConsentService] ✅ Ephemeral userDid stored in session for consent-only flow:", {
+                                    sessionId: sessionId.substring(0, 20) + "...",
+                                    userDid: ephemeralUserDid.substring(0, 30) + "...",
+                                    note: "Enables reliable delegation lookup via PRIORITY 1 key",
+                                });
+                            }
+                            else {
+                                logger.warn("[ConsentService] ⚠️ Failed to generate ephemeral userDid - delegation will use session-scoped storage only");
+                            }
+                        }
+                    }
+                    else {
+                        logger.warn("[ConsentService] ⚠️ No session_id for consent-only flow - delegation will use session-scoped storage only");
+                    }
                 }
             }
             // Convert null oauth_identity to undefined for proper schema validation
@@ -2733,7 +2875,7 @@ export class ConsentService {
             }
             const validation = validateConsentApprovalRequest(body);
             if (!validation.success) {
-                console.error("[ConsentService] Approval request validation failed:", {
+                logger.error("[ConsentService] Approval request validation failed:", {
                     errors: validation.error.errors,
                     receivedBody: body,
                 });
@@ -2748,7 +2890,7 @@ export class ConsentService {
                 });
             }
             const approvalRequest = validation.data;
-            console.error("[ConsentService] Approval request validated:", {
+            logger.debug("[ConsentService] Approval request validated:", {
                 agentDid: approvalRequest.agent_did?.substring(0, 20) + "...",
                 sessionId: approvalRequest.session_id?.substring(0, 20) + "...",
                 scopes: approvalRequest.scopes,
@@ -2788,7 +2930,7 @@ export class ConsentService {
                     oauthProvider: approvalRequest.oauth_identity?.provider,
                 })
                     .catch((err) => {
-                    console.error("[ConsentService] Failed to log credential required", {
+                    logger.debug("[ConsentService] Failed to log credential required", {
                         eventType: "consent:credential_required",
                         sessionId: approvalRequest.session_id,
                         error: err instanceof Error ? err.message : String(err),
@@ -2798,10 +2940,10 @@ export class ConsentService {
                 // The credential_required event is just for audit tracking
             }
             // Create delegation via AgentShield API
-            console.error("[ConsentService] Creating delegation...");
+            logger.debug("[ConsentService] Creating delegation...");
             const delegationResult = await this.createDelegation(approvalRequest);
             if (!delegationResult.success) {
-                console.error("[ConsentService] Delegation creation failed:", {
+                logger.error("[ConsentService] Delegation creation failed:", {
                     error: delegationResult.error,
                     error_code: delegationResult.error_code,
                 });
@@ -2814,7 +2956,7 @@ export class ConsentService {
                     headers: { "Content-Type": "application/json" },
                 });
             }
-            console.error("[ConsentService] ✅ Delegation created successfully:", {
+            logger.info("[ConsentService] ✅ Delegation created successfully:", {
                 delegationId: delegationResult.delegation_id?.substring(0, 20) + "...",
             });
             // Store delegation token in KV
@@ -2831,7 +2973,7 @@ export class ConsentService {
                                 (await this.getUserDidForSession(approvalRequest.session_id, approvalRequest.oauth_identity || undefined)) ?? undefined; // Phase 5: Convert null to undefined
                         }
                         catch (error) {
-                            console.warn("[ConsentService] Failed to get userDid for audit logging:", error);
+                            logger.warn("[ConsentService] Failed to get userDid for audit logging:", error);
                             // Continue without userDid - audit events can still be logged
                         }
                     }
@@ -2862,7 +3004,7 @@ export class ConsentService {
                     });
                 }
                 catch (error) {
-                    console.error("[ConsentService] Audit failed but continuing", {
+                    logger.debug("[ConsentService] Audit failed but continuing", {
                         sessionId: approvalRequest.session_id,
                         error: error instanceof Error ? error.message : String(error),
                         eventTypes: ["consent:approved", "consent:delegation_created"],
@@ -2881,7 +3023,7 @@ export class ConsentService {
             });
         }
         catch (error) {
-            console.error("[ConsentService] Error handling approval:", error);
+            logger.error("[ConsentService] Error handling approval:", error);
             return new Response(JSON.stringify({
                 success: false,
                 error: "Internal server error",
@@ -2902,7 +3044,7 @@ export class ConsentService {
         const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
         const apiKey = this.env.AGENTSHIELD_API_KEY;
         if (!apiKey) {
-            console.warn("[ConsentService] No API key configured, cannot create delegation");
+            logger.warn("[ConsentService] No API key configured, cannot create delegation");
             return {
                 success: false,
                 error: "API key not configured",
@@ -2920,7 +3062,7 @@ export class ConsentService {
             // Only fetch from storage if not already provided in request
             if (!userDid && request.session_id) {
                 try {
-                    console.error("[ConsentService] Getting User DID for session:", {
+                    logger.debug("[ConsentService] Getting User DID for session:", {
                         sessionId: request.session_id.substring(0, 20) + "...",
                         hasOAuthIdentity: !!request.oauth_identity,
                         oauthProvider: request.oauth_identity?.provider,
@@ -2932,27 +3074,27 @@ export class ConsentService {
                     userDid =
                         (await this.getUserDidForSession(request.session_id, request.oauth_identity || undefined // Explicitly handle null as undefined
                         )) ?? undefined;
-                    console.error("[ConsentService] User DID retrieved from storage:", {
+                    logger.debug("[ConsentService] User DID retrieved from storage:", {
                         userDid: userDid?.substring(0, 20) + "...",
                         hasUserDid: !!userDid,
                     });
                 }
                 catch (error) {
-                    console.error("[ConsentService] Failed to get/generate userDid:", error);
+                    logger.debug("[ConsentService] Failed to get/generate userDid:", error);
                     // Continue without userDid - delegation will work without user_identifier
                     // This is valid for non-OAuth scenarios, but we should log this as a warning
-                    console.warn("[ConsentService] Delegation will be created without user_identifier - this may affect user tracking");
+                    logger.warn("[ConsentService] Delegation will be created without user_identifier - this may affect user tracking");
                 }
             }
             else if (userDid) {
                 // userDid was provided in request (e.g., from credential auth flow)
-                console.error("[ConsentService] Using provided user_did from request:", {
+                logger.debug("[ConsentService] Using provided user_did from request:", {
                     userDid: userDid.substring(0, 20) + "...",
                     source: "request.user_did",
                 });
             }
             else {
-                console.error("[ConsentService] No session_id provided - skipping User DID generation");
+                logger.debug("[ConsentService] No session_id provided - skipping User DID generation");
             }
             const expiresInDays = 7; // Default to 7 days
             // Phase 2 VC-Only: Issue Delegation VC if we have a session and userDid
@@ -2983,21 +3125,21 @@ export class ConsentService {
                     const vcResult = await this.issueDelegationVC(localDelegation, request.session_id, request.oauth_identity || undefined);
                     credentialJwt = vcResult ?? undefined;
                     if (credentialJwt) {
-                        console.error("[ConsentService] VC issued for delegation:", {
+                        logger.debug("[ConsentService] VC issued for delegation:", {
                             delegationId,
                             jwtLength: credentialJwt.length,
                         });
                     }
                 }
                 catch (error) {
-                    console.warn("[ConsentService] Failed to issue VC, continuing without it:", error);
+                    logger.warn("[ConsentService] Failed to issue VC, continuing without it:", error);
                     // Non-fatal - delegation will work without VC
                 }
             }
             // Build delegation request with error-based format detection
             // Try full format first, fallback to simplified format on error
             const delegationRequest = await this.buildDelegationRequest(request, userDid, expiresInDays, fieldName, credentialJwt);
-            console.error("[ConsentService] Creating delegation:", {
+            logger.debug("[ConsentService] Creating delegation:", {
                 url: `${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`,
                 agentDid: request.agent_did.substring(0, 20) + "...",
                 scopes: request.scopes,
@@ -3028,7 +3170,7 @@ export class ConsentService {
                 // AgentShield now returns delegation_token for stateless verification
                 const responseDataObj = wrappedResponse.data;
                 const delegationToken = responseDataObj.delegation_token;
-                console.error("[ConsentService] ✅ Delegation created successfully:", {
+                logger.info("[ConsentService] ✅ Delegation created successfully:", {
                     delegationId,
                     agentDid: wrappedResponse.data.agent_did.substring(0, 20) + "...",
                     scopes: wrappedResponse.data.scopes,
@@ -3051,7 +3193,7 @@ export class ConsentService {
                 // Extract delegation_token (JWT) if present in response
                 const unwrappedDataObj = unwrappedResponse;
                 const delegationToken = unwrappedDataObj.delegation_token;
-                console.error("[ConsentService] ✅ Delegation created successfully:", {
+                logger.info("[ConsentService] ✅ Delegation created successfully:", {
                     delegationId,
                     agentDid: unwrappedResponse.agent_did.substring(0, 20) + "...",
                     scopes: unwrappedResponse.scopes,
@@ -3074,7 +3216,7 @@ export class ConsentService {
                 data?.id ||
                 delegationObj?.id;
             if (!delegationId) {
-                console.error("[ConsentService] Invalid response format - missing delegation_id:", responseData);
+                logger.debug("[ConsentService] Invalid response format - missing delegation_id:", responseData);
                 return {
                     success: false,
                     error: "Invalid API response format - missing delegation_id",
@@ -3084,7 +3226,7 @@ export class ConsentService {
             // Extract delegation_token from fallback parsing
             const delegationToken = data?.delegation_token ||
                 delegationObj?.delegation_token;
-            console.warn("[ConsentService] ⚠️ Response format not fully validated, using fallback parsing:", {
+            logger.warn("[ConsentService] ⚠️ Response format not fully validated, using fallback parsing:", {
                 delegationId,
                 hasDelegationToken: !!delegationToken,
                 tokenLength: delegationToken?.length,
@@ -3097,7 +3239,7 @@ export class ConsentService {
             };
         }
         catch (error) {
-            console.error("[ConsentService] Error creating delegation:", error);
+            logger.error("[ConsentService] Error creating delegation:", error);
             return {
                 success: false,
                 error: error instanceof Error ? error.message : "Unknown error",
@@ -3118,7 +3260,7 @@ export class ConsentService {
     async storeDelegationToken(sessionId, agentDid, token, delegationId) {
         const delegationStorage = this.env.DELEGATION_STORAGE;
         if (!delegationStorage) {
-            console.warn("[ConsentService] No delegation storage configured, token not stored");
+            logger.warn("[ConsentService] No delegation storage configured, token not stored");
             return;
         }
         try {
@@ -3137,7 +3279,7 @@ export class ConsentService {
                 await delegationStorage.put(userAgentKey, token, {
                     expirationTtl: ttl,
                 });
-                console.error("[ConsentService] ✅ Token stored with user+agent DID:", {
+                logger.info("[ConsentService] ✅ Token stored with user+agent DID:", {
                     key: userAgentKey,
                     ttl,
                     delegationId,
@@ -3162,7 +3304,7 @@ export class ConsentService {
             await delegationStorage.put(sessionKey, JSON.stringify(sessionDataToStore), {
                 expirationTtl: ttl, // Use full TTL - this is the primary storage for session
             });
-            console.error("[ConsentService] ✅ Token stored for session:", {
+            logger.info("[ConsentService] ✅ Token stored for session:", {
                 key: sessionKey,
                 ttl,
                 sessionId: sessionId.substring(0, 20) + "...",
@@ -3170,7 +3312,7 @@ export class ConsentService {
                 preservedIdentityState: sessionData?.identityState || "none",
             });
             // Metrics: Log delegation key type for monitoring
-            console.error("[ConsentService] 📊 Delegation storage metrics:", {
+            logger.debug("[ConsentService] 📊 Delegation storage metrics:", {
                 delegationKeyType: userDid ? "user_agent_scoped" : "session_scoped",
                 hasUserDid: !!userDid,
                 userDidPrefix: userDid
@@ -3186,7 +3328,7 @@ export class ConsentService {
         }
         catch (error) {
             // Storage errors are non-fatal - log but don't fail the request
-            console.error("[ConsentService] Storage error (non-fatal):", error);
+            logger.debug("[ConsentService] Storage error (non-fatal):", error);
         }
     }
     /**
@@ -3208,7 +3350,7 @@ export class ConsentService {
             }
             catch (error) {
                 // Ignore errors, use default (autoClose = false)
-                console.warn("[ConsentService] Failed to fetch config for autoClose:", error);
+                logger.warn("[ConsentService] Failed to fetch config for autoClose:", error);
             }
         }
         const html = this.renderer.renderSuccess({
@@ -3285,9 +3427,24 @@ export class ConsentService {
      * @returns JSON response
      */
     async handleCredentialApproval(body) {
-        console.error("[ConsentService] Processing credential approval");
+        logger.debug("[ConsentService] Processing credential approval");
         // Extract standard fields
         const { tool, scopes: rawScopes, agent_did, session_id, project_id, provider, provider_type, csrf_token, ...credentials } = body;
+        // DEBUG: Log credentials to diagnose password encoding issues
+        // SECURITY: Mask password, but show length and first/last char for debugging
+        const pwd = credentials.password || "";
+        logger.debug("[ConsentService] DEBUG: Credential values received", {
+            hasUsername: !!credentials.username,
+            usernameLength: (credentials.username || "").length,
+            usernameValue: credentials.username, // Safe to log email
+            hasPassword: !!credentials.password,
+            passwordLength: pwd.length,
+            passwordFirstChar: pwd.length > 0 ? pwd[0] : "",
+            passwordLastChar: pwd.length > 0 ? pwd[pwd.length - 1] : "",
+            // Check for special chars that might be escaped
+            passwordContainsDollar: pwd.includes("$"),
+            passwordContainsDoubleD: pwd.includes("$$"),
+        });
         // Parse scopes - handles double JSON encoding from form submission
         // The form stores scopes as JSON string, then JS submits it as JSON again
         const scopes = this.parseScopes(rawScopes);
@@ -3308,7 +3465,7 @@ export class ConsentService {
         }
         // Validate CSRF token
         if (!csrf_token || typeof csrf_token !== "string") {
-            console.warn("[ConsentService] Missing or invalid CSRF token");
+            logger.warn("[ConsentService] Missing or invalid CSRF token");
             return new Response(JSON.stringify({
                 success: false,
                 error: "Invalid or missing CSRF token",
@@ -3318,7 +3475,7 @@ export class ConsentService {
         // Validate CSRF token against stored value
         const csrfValid = await this.validateCredentialCsrfToken(csrf_token, session_id);
         if (!csrfValid) {
-            console.warn("[ConsentService] CSRF token validation failed", {
+            logger.warn("[ConsentService] CSRF token validation failed", {
                 sessionId: session_id.substring(0, 20) + "...",
             });
             return new Response(JSON.stringify({
@@ -3331,7 +3488,7 @@ export class ConsentService {
             // 1. Fetch credential provider config from AgentShield
             const providerConfig = await this.getCredentialProviderConfig(project_id, provider);
             if (!providerConfig) {
-                console.error("[ConsentService] Credential provider config not found", {
+                logger.debug("[ConsentService] Credential provider config not found", {
                     projectId: project_id,
                     provider,
                 });
@@ -3347,20 +3504,37 @@ export class ConsentService {
             // See: https://developers.cloudflare.com/workers/observability/errors/#illegal-invocation-errors
             const credentialHandler = createCredentialAuthHandler({
                 fetch: (...args) => globalThis.fetch(...args),
-                logger: (msg, data) => console.error(msg, data),
+                logger: (msg, data) => logger.debug(msg, data),
             });
             const authResult = await credentialHandler.authenticate(providerConfig, credentials);
             if (!authResult.success) {
-                console.error("[ConsentService] Credential authentication failed", {
+                logger.error("[ConsentService] Credential authentication failed", {
                     error: authResult.error,
                 });
+                // Log credential auth failure for audit trail
+                const auditService = await this.getAuditService(project_id);
+                if (auditService) {
+                    await auditService
+                        .logCredentialAuthFailed({
+                        sessionId: session_id,
+                        agentDid: agent_did,
+                        targetTools: [tool],
+                        scopes: scopes,
+                        projectId: project_id,
+                        provider: provider,
+                        errorMessage: authResult.error,
+                    })
+                        .catch((err) => {
+                        logger.warn("[ConsentService] Failed to log credential auth failure:", err);
+                    });
+                }
                 return new Response(JSON.stringify({
                     success: false,
                     error: authResult.error || "Authentication failed",
                     error_code: "auth_failed",
                 }), { status: 401, headers: { "Content-Type": "application/json" } });
             }
-            console.error("[ConsentService] ✅ Credential authentication successful");
+            logger.info("[ConsentService] ✅ Credential authentication successful");
             // 3. Resolve identity via AgentShield
             const identityResult = await this.resolveCredentialIdentity({
                 projectId: project_id,
@@ -3376,15 +3550,32 @@ export class ConsentService {
                     error_code: "identity_resolution_failed",
                 }), { status: 500, headers: { "Content-Type": "application/json" } });
             }
-            console.error("[ConsentService] ✅ Identity resolved", {
+            logger.info("[ConsentService] ✅ Identity resolved", {
                 userDid: identityResult.userDid.substring(0, 30) + "...",
             });
+            // Log credential auth success for audit trail (now that we have userDid)
+            const auditService = await this.getAuditService(project_id);
+            if (auditService) {
+                await auditService
+                    .logCredentialAuthSuccess({
+                    sessionId: session_id,
+                    userDid: identityResult.userDid,
+                    agentDid: agent_did,
+                    targetTools: [tool],
+                    scopes: scopes,
+                    projectId: project_id,
+                    provider: provider,
+                })
+                    .catch((err) => {
+                    logger.warn("[ConsentService] Failed to log credential auth success:", err);
+                });
+            }
             // NEW: Update session cache with userDid for proper delegation scoping
             // This ensures storeDelegationToken() can create user+agent scoped keys
             // instead of falling back to legacy agent-only keys
             await this.updateSessionWithIdentity(session_id, identityResult.userDid, null // No OAuth identity for credential auth
             );
-            console.error("[ConsentService] ✅ Session updated with identity");
+            logger.info("[ConsentService] ✅ Session updated with identity");
             // 4. Store token in IdpTokenStorage with usage metadata
             // Include userId from authResult for ToolExecutionContext.userId
             await this.storeCredentialToken({
@@ -3396,48 +3587,59 @@ export class ConsentService {
                 scopes,
                 userId: authResult.userId, // Pass extracted userId from credential provider response
             });
-            console.error("[ConsentService] ✅ Token stored");
-            // 5. Create delegation using standard flow
-            // Include provider_type and provider in customFields for AgentShield dashboard display
-            const approvalRequest = {
-                tool: tool,
-                scopes,
-                agent_did: agent_did,
-                session_id: session_id,
-                project_id: project_id,
-                auth_mode: "credentials",
-                provider_type: CONSENT_PROVIDER_TYPES.CREDENTIAL,
-                termsAccepted: true,
-                user_did: identityResult.userDid,
-                customFields: {
-                    provider: provider,
-                },
-            };
-            const delegationResult = await this.createDelegation(approvalRequest);
-            if (!delegationResult.success) {
-                return new Response(JSON.stringify({
-                    success: false,
-                    error: delegationResult.error || "Delegation creation failed",
-                    error_code: delegationResult.error_code || "delegation_failed",
-                }), { status: 500, headers: { "Content-Type": "application/json" } });
+            logger.info("[ConsentService] ✅ Token stored");
+            // ================================================================================
+            // 5. REDIRECT TO CLICKWRAP PAGE (3-screen flow)
+            // ================================================================================
+            // Flow: Credential Auth → Clickwrap (consent-only UI) → Success
+            //
+            // Instead of creating the delegation here, redirect to the clickwrap page
+            // where the user can see their identity and approve the permission request.
+            // The clickwrap approval will then create the delegation with the stored
+            // credential auth info.
+            //
+            // This matches the OAuth flow pattern for consistency.
+            // ================================================================================
+            const serverUrl = this.env.MCP_SERVER_URL || "";
+            // Build clickwrap URL with all necessary parameters
+            const clickwrapUrl = new URL(`${serverUrl}/consent`);
+            // Mode is consent-only since credential auth is complete
+            clickwrapUrl.searchParams.set("mode", "consent-only");
+            // CRITICAL: Pass provider_type so delegation is created with 'password' not 'none'
+            // This ensures authorization.type matches tool protection expectation
+            clickwrapUrl.searchParams.set("credential_provider_type", CONSENT_PROVIDER_TYPES.PASSWORD);
+            clickwrapUrl.searchParams.set("credential_provider", provider);
+            // Preserve important state from credential flow
+            clickwrapUrl.searchParams.set("project_id", project_id);
+            clickwrapUrl.searchParams.set("agent_did", agent_did);
+            clickwrapUrl.searchParams.set("session_id", session_id);
+            // Include tool and scopes for display
+            clickwrapUrl.searchParams.set("tool", tool);
+            if (Array.isArray(scopes) && scopes.length > 0) {
+                clickwrapUrl.searchParams.set("scopes", scopes.join(","));
             }
-            console.error("[ConsentService] ✅ Credential approval complete", {
-                delegationId: delegationResult.delegation_id?.substring(0, 20) + "...",
+            // Include user info for display on clickwrap page
+            if (authResult.userEmail) {
+                clickwrapUrl.searchParams.set("credential_user_email", authResult.userEmail);
+            }
+            if (authResult.userId) {
+                clickwrapUrl.searchParams.set("credential_user_id", authResult.userId);
+            }
+            logger.debug("[ConsentService] ✅ Credential auth complete, redirecting to clickwrap", {
+                sessionId: session_id.substring(0, 20) + "...",
+                userDid: identityResult.userDid.substring(0, 30) + "...",
+                provider: provider,
+                clickwrapUrl: clickwrapUrl.toString().substring(0, 100) + "...",
             });
-            // Store delegation token
-            await this.storeDelegationToken(session_id, agent_did, delegationResult.delegation_token, delegationResult.delegation_id);
-            // Return success with redirect URL
-            const serverUrl = this.env.MCP_SERVER_URL || "";
-            const redirectUrl = `${serverUrl}/consent/success?delegation_id=${encodeURIComponent(delegationResult.delegation_id)}&project_id=${encodeURIComponent(project_id)}`;
+            // Return success with redirect to clickwrap page
             return new Response(JSON.stringify({
                 success: true,
-                delegation_id: delegationResult.delegation_id,
-                delegation_token: delegationResult.delegation_token,
-                redirectUrl,
+                redirectUrl: clickwrapUrl.toString(),
+                // Note: delegation_id is NOT returned here - it will be created on clickwrap approval
             }), { status: 200, headers: { "Content-Type": "application/json" } });
         }
         catch (error) {
-            console.error("[ConsentService] Credential approval error:", error);
+            logger.error("[ConsentService] Credential approval error:", error);
             return new Response(JSON.stringify({
                 success: false,
                 error: error instanceof Error ? error.message : "Internal error",
@@ -3469,7 +3671,7 @@ export class ConsentService {
                 }
             }
             catch {
-                console.warn("[ConsentService] Failed to parse scopes JSON:", rawScopes);
+                logger.warn("[ConsentService] Failed to parse scopes JSON:", rawScopes);
             }
         }
         // Single string scope - wrap in array
@@ -3491,7 +3693,7 @@ export class ConsentService {
         const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
         const apiKey = this.env.AGENTSHIELD_API_KEY;
         if (!apiKey) {
-            console.warn("[ConsentService] No AgentShield API key configured");
+            logger.warn("[ConsentService] No AgentShield API key configured");
             return null;
         }
         try {
@@ -3505,7 +3707,7 @@ export class ConsentService {
                 },
             });
             if (!response.ok) {
-                console.warn("[ConsentService] Providers API returned error:", {
+                logger.warn("[ConsentService] Providers API returned error:", {
                     status: response.status,
                     statusText: response.statusText,
                 });
@@ -3515,7 +3717,7 @@ export class ConsentService {
             // { success: true, data: { providers: { ... }, configuredProvider: "..." } }
             const result = (await response.json());
             if (!result.success || !result.data?.providers) {
-                console.warn("[ConsentService] Invalid providers response:", {
+                logger.warn("[ConsentService] Invalid providers response:", {
                     hasSuccess: result.success,
                     hasData: !!result.data,
                     hasProviders: !!result.data?.providers,
@@ -3530,13 +3732,13 @@ export class ConsentService {
                     // AgentShield API may return snake_case fields from database
                     const provider = this.mapCredentialProviderFields(rawProvider, providerName);
                     if (!provider) {
-                        console.error("[ConsentService] Credential provider validation failed:", {
+                        logger.debug("[ConsentService] Credential provider validation failed:", {
                             projectId,
                             providerName,
                         });
                         return null;
                     }
-                    console.error("[ConsentService] Found credential provider:", {
+                    logger.debug("[ConsentService] Found credential provider:", {
                         providerName,
                         hasAuthEndpoint: !!provider.authEndpoint,
                         hasResponseFields: !!provider.responseFields,
@@ -3547,7 +3749,7 @@ export class ConsentService {
             return null;
         }
         catch (error) {
-            console.error("[ConsentService] Failed to fetch provider config:", error);
+            logger.error("[ConsentService] Failed to fetch provider config:", error);
             return null;
         }
     }
@@ -3619,7 +3821,7 @@ export class ConsentService {
             raw.auth_endpoint ??
             "");
         if (!authEndpoint) {
-            console.error("[ConsentService] Credential provider missing required authEndpoint", { providerName: providerName ?? "unknown" });
+            logger.debug("[ConsentService] Credential provider missing required authEndpoint", { providerName: providerName ?? "unknown" });
             return null;
         }
         return {
@@ -3646,7 +3848,7 @@ export class ConsentService {
         const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
         const apiKey = this.env.AGENTSHIELD_API_KEY;
         if (!apiKey) {
-            console.warn("[ConsentService] No AgentShield API key for identity resolution");
+            logger.warn("[ConsentService] No AgentShield API key for identity resolution");
             return { success: false };
         }
         try {
@@ -3676,7 +3878,7 @@ export class ConsentService {
             };
         }
         catch (error) {
-            console.error("[ConsentService] Identity resolution failed:", error);
+            logger.error("[ConsentService] Identity resolution failed:", error);
             return { success: false };
         }
     }
@@ -3686,7 +3888,7 @@ export class ConsentService {
     async storeCredentialToken(params) {
         const delegationStorage = this.env.DELEGATION_STORAGE;
         if (!delegationStorage) {
-            console.warn("[ConsentService] No DELEGATION_STORAGE for credential tokens");
+            logger.warn("[ConsentService] No DELEGATION_STORAGE for credential tokens");
             return;
         }
         const oauthSecurityService = new OAuthSecurityService(delegationStorage, this.env.OAUTH_ENCRYPTION_SECRET);
@@ -3724,7 +3926,7 @@ export class ConsentService {
     async validateCredentialCsrfToken(token, sessionId) {
         const delegationStorage = this.env.DELEGATION_STORAGE;
         if (!delegationStorage) {
-            console.warn("[ConsentService] No DELEGATION_STORAGE for CSRF validation, skipping");
+            logger.warn("[ConsentService] No DELEGATION_STORAGE for CSRF validation, skipping");
             // Return true to allow flow to continue (graceful degradation)
             // This matches OAuth behavior when storage is unavailable
             return true;
@@ -3733,7 +3935,7 @@ export class ConsentService {
             const csrfKey = STORAGE_KEYS.credentialCsrf(sessionId);
             const storedToken = await delegationStorage.get(csrfKey);
             if (!storedToken) {
-                console.warn("[ConsentService] No stored CSRF token found");
+                logger.warn("[ConsentService] No stored CSRF token found");
                 return false;
             }
             // Constant-time comparison to prevent timing attacks
@@ -3745,7 +3947,7 @@ export class ConsentService {
             return isValid;
         }
         catch (error) {
-            console.error("[ConsentService] CSRF validation error:", error);
+            logger.error("[ConsentService] CSRF validation error:", error);
             return false;
         }
     }
@@ -3766,7 +3968,7 @@ export class ConsentService {
             .replace(/\//g, "_")
             .replace(/=/g, "");
         if (!delegationStorage) {
-            console.warn("[ConsentService] No DELEGATION_STORAGE for CSRF storage");
+            logger.warn("[ConsentService] No DELEGATION_STORAGE for CSRF storage");
             // Return token anyway - form will submit but validation will skip
             return token;
         }
@@ -3774,10 +3976,10 @@ export class ConsentService {
             const csrfKey = STORAGE_KEYS.credentialCsrf(sessionId);
             // 10 minute TTL matches OAuth state TTL
             await delegationStorage.put(csrfKey, token, { expirationTtl: 600 });
-            console.error("[ConsentService] CSRF token stored for credential form");
+            logger.debug("[ConsentService] CSRF token stored for credential form");
         }
         catch (error) {
-            console.error("[ConsentService] CSRF token storage error:", error);
+            logger.error("[ConsentService] CSRF token storage error:", error);
         }
         return token;
     }
@@ -3864,26 +4066,40 @@ export class ConsentService {
             // user_identifier can be the same as user_did or a human-readable version
             // If we have a human-readable identifier from OAuth, use it; otherwise use DID
             simplifiedRequest.user_identifier = userDid;
-            console.error("[ConsentService] Including user_did in delegation request:", {
+            logger.debug("[ConsentService] Including user_did in delegation request:", {
                 user_did: userDid.substring(0, 20) + "...",
             });
         }
         else {
-            console.error("[ConsentService] No user_did (session is anonymous) - delegation will proceed without it");
+            logger.debug("[ConsentService] No user_did (session is anonymous) - delegation will proceed without it");
         }
         // Phase 2 VC-Only: Include credential_jwt if available
         if (credentialJwt) {
             simplifiedRequest.credential_jwt = credentialJwt;
-            console.error("[ConsentService] Including credential_jwt in delegation request");
+            logger.debug("[ConsentService] Including credential_jwt in delegation request");
         }
         // AgentShield API only accepts "custom_fields", not "metadata"
         // Always use "custom_fields" regardless of Day0 config
         // Include provider_type and provider for dashboard authorization display
+        //
+        // CRITICAL FIX: request.provider_type is at the TOP LEVEL of ConsentApprovalRequest,
+        // NOT inside customFields. We need to read from both locations:
+        // - request.provider_type (set by handleCredentialApproval, handleApproval, etc.)
+        // - customFieldsFromRequest.provider (set in customFields for backward compat)
         const customFieldsFromRequest = request.customFields || {};
-        const hasProviderInfo = customFieldsFromRequest.provider_type || customFieldsFromRequest.provider;
+        // FIX: Read provider_type from request root (where handleCredentialApproval sets it)
+        // Fall back to customFields for backward compatibility
+        const providerType = request.provider_type || customFieldsFromRequest.provider_type;
+        const provider = customFieldsFromRequest.provider;
+        const hasProviderInfo = providerType || provider;
         if (userDid || hasProviderInfo) {
             // Include issuer_did and subject_did in custom_fields when we have userDid
             // Also include provider_type and provider for AgentShield dashboard
+            // CRITICAL: AgentShield derives authorization from metadata.provider_type:
+            // - provider_type === 'password' → authorization.type = 'password' (credential auth)
+            // - provider_type === 'none' → authorization.type = 'none' (consent-only)
+            // - oauth_provider present → authorization.type = 'oauth'
+            // NOTE: Tool protection expects 'password' for credential flows, NOT 'credential'
             simplifiedRequest.custom_fields = {
                 ...(userDid
                     ? {
@@ -3892,13 +4108,18 @@ export class ConsentService {
                     }
                     : {}),
                 format_version: "simplified_v1",
-                // Merge with any existing custom_fields from request (includes provider_type, provider)
+                // Include provider_type at the custom_fields level (where AgentShield reads it)
+                ...(providerType ? { provider_type: providerType } : {}),
+                // Merge with any existing custom_fields from request
                 ...customFieldsFromRequest,
             };
             if (hasProviderInfo) {
-                console.error("[ConsentService] Including provider info in custom_fields:", {
-                    provider_type: customFieldsFromRequest.provider_type,
-                    provider: customFieldsFromRequest.provider,
+                logger.debug("[ConsentService] Including provider info in custom_fields:", {
+                    provider_type: providerType,
+                    provider: provider,
+                    source: request.provider_type
+                        ? "request.provider_type"
+                        : "customFields",
                 });
             }
         }
@@ -3929,7 +4150,7 @@ export class ConsentService {
                 return fullResponse;
             }
             // Full format failed with validation error, try simplified
-            console.error("[ConsentService] Full format failed, trying simplified format...");
+            logger.debug("[ConsentService] Full format failed, trying simplified format...");
             const simplifiedResponse = await this.makeAPICall(agentShieldUrl, apiKey, request.simplifiedFormat);
             if (simplifiedResponse.success) {
                 await this.cacheFormatPreference("simplified");
@@ -3951,11 +4172,11 @@ export class ConsentService {
             // This provides defense-in-depth protection
             const sanitizedBody = { ...requestBody };
             if ("session_id" in sanitizedBody) {
-                console.warn("[ConsentService] ⚠️ session_id detected in request body - removing (not in schema)");
+                logger.warn("[ConsentService] ⚠️ session_id detected in request body - removing (not in schema)");
                 delete sanitizedBody.session_id;
             }
             if ("project_id" in sanitizedBody) {
-                console.warn("[ConsentService] ⚠️ project_id detected in request body - removing (not in schema)");
+                logger.warn("[ConsentService] ⚠️ project_id detected in request body - removing (not in schema)");
                 delete sanitizedBody.project_id;
             }
             const response = await fetch(`${agentShieldUrl}${AGENTSHIELD_ENDPOINTS.DELEGATIONS_CREATE}`, {
@@ -4009,7 +4230,7 @@ export class ConsentService {
             };
         }
         catch (error) {
-            console.error("[ConsentService] API call failed:", error);
+            logger.error("[ConsentService] API call failed:", error);
             return {
                 success: false,
                 error: error instanceof Error ? error.message : "Network request failed",
@@ -4031,10 +4252,10 @@ export class ConsentService {
             }), {
                 expirationTtl: 3600, // 1 hour
             });
-            console.error(`[ConsentService] Cached format preference: ${format}`);
+            logger.debug(`[ConsentService] Cached format preference: ${format}`);
         }
         catch (error) {
-            console.warn("[ConsentService] Failed to cache format preference:", error);
+            logger.warn("[ConsentService] Failed to cache format preference:", error);
         }
     }
 }