@kya-os/mcp-i-cloudflare 1.7.74 → 1.7.76

package/dist/adapter.d.ts

@@ -13,6 +13,8 @@ import type { MCPIRuntimeBase } from "@kya-os/mcp-i-core";
 import { type ClientMessagesConfig } from "@kya-os/mcp-i-core";
 import { KVProofArchive } from "./storage/kv-proof-archive";
 import type { KVNamespace } from "@cloudflare/workers-types";
+import type { DurableObjectNamespace } from "@cloudflare/workers-types";
+import { type DORoutingStrategy } from "./utils/do-routing";
 export interface ToolDefinition {
     name: string;
     description: string;
@@ -95,6 +97,9 @@ declare class CloudflareMCPServer {
     private proofArchive?;
     private requestOrigin?;
     private delegationStorage?;
+    private doNamespace?;
+    private doRoutingStrategy;
+    private doShardCount;
     private initializeContexts;
     private sessionClientIds;
     private environment;
@@ -102,12 +107,31 @@ declare class CloudflareMCPServer {
     constructor(runtime: MCPIRuntimeBase, serverInfo: {
         name: string;
         version: string;
-    }, tools?: ToolDefinition[], proofArchive?: KVProofArchive, delegationStorage?: KVNamespace, environment?: string, clientMessagesConfig?: ClientMessagesConfig);
+    }, tools?: ToolDefinition[], proofArchive?: KVProofArchive, delegationStorage?: KVNamespace, environment?: string, clientMessagesConfig?: ClientMessagesConfig, doNamespace?: DurableObjectNamespace, doRoutingStrategy?: DORoutingStrategy, doShardCount?: number);
     /**
      * Set request origin for consent URL building
      * Called from fetch handler to auto-detect server URL
      */
     setRequestOrigin(origin: string): void;
+    /**
+     * Calculate DO instance ID based on routing strategy.
+     * Delegates to shared utility so adapter, agent, and consent.service
+     * are guaranteed to route identically.
+     */
+    private calculateDOInstanceId;
+    /**
+     * Fetch delegation from Durable Object (strongly consistent storage)
+     *
+     * This provides parity with the Agent pattern by using the same DO-based
+     * storage for delegations. The consent service stores to DO first, and
+     * now the adapter can read from DO first as well.
+     *
+     * @param sessionId - Session ID to lookup
+     * @param userDid - Optional user DID for user+agent scoped lookup
+     * @param agentDid - Agent DID for the lookup
+     * @returns Delegation token if found, undefined otherwise
+     */
+    private getDelegationFromDO;
     /**
      * Handle JSON-RPC request
      */

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,SAAS,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAW7D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,GAAG,CAAC;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CACtC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IACzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED,UAAU,WAAW;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,cAAc;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAYD;;GAEG;AACH,cAAM,mBAAmB;IACvB,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,KAAK,CAA8B;IAC3C,OAAO,CAAC,YAAY,CAAC,CAAiB;IACtC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,iBAAiB,CAAC,CAAc;IACxC,OAAO,CAAC,kBAAkB,CAAiC;IAC3D,OAAO,CAAC,gBAAgB,CAGtB;IACF,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,oBAAoB,CAAC,CAAuB;gBAGlD,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAC7C,KAAK,GAAE,cAAc,EAAO,EAC5B,YAAY,CAAC,EAAE,cAAc,EAC7B,iBAAiB,CAAC,EAAE,WAAW,EAC/B,WAAW,GAAE,MAAqB,EAClC,oBAAoB,CAAC,EAAE,oBAAoB;IAa7C;;;OAGG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC;IAi+B1D,OAAO,CAAC,sBAAsB;IAyC9B,OAAO,CAAC,wBAAwB;IAsBhC,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,uBAAuB;IAmC/B,OAAO,CAAC,gBAAgB;IAuDxB,OAAO,CAAC,mBAAmB;IA2C3B,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,QAAQ;IAIhB;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IAwCvC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB;CAsH9B;AA0BD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,2BAA2B;;;mBAkDZ,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;EAibnD"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,SAAS,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAU7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,GAAG,CAAC;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CACtC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IACzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED,UAAU,WAAW;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,cAAc;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAYD;;GAEG;AACH,cAAM,mBAAmB;IACvB,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,KAAK,CAA8B;IAC3C,OAAO,CAAC,YAAY,CAAC,CAAiB;IACtC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,iBAAiB,CAAC,CAAc;IACxC,OAAO,CAAC,WAAW,CAAC,CAAyB;IAC7C,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,kBAAkB,CAAiC;IAC3D,OAAO,CAAC,gBAAgB,CAGtB;IACF,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,oBAAoB,CAAC,CAAuB;gBAGlD,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAC7C,KAAK,GAAE,cAAc,EAAO,EAC5B,YAAY,CAAC,EAAE,cAAc,EAC7B,iBAAiB,CAAC,EAAE,WAAW,EAC/B,WAAW,GAAE,MAAqB,EAClC,oBAAoB,CAAC,EAAE,oBAAoB,EAC3C,WAAW,CAAC,EAAE,sBAAsB,EACpC,iBAAiB,GAAE,iBAA+B,EAClD,YAAY,GAAE,MAAW;IAgB3B;;;OAGG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;;;;;;OAWG;YACW,mBAAmB;IAoEjC;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC;IA8/B1D,OAAO,CAAC,sBAAsB;IAyC9B,OAAO,CAAC,wBAAwB;IAsBhC,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,uBAAuB;IAmC/B,OAAO,CAAC,gBAAgB;IAuDxB,OAAO,CAAC,mBAAmB;IA2C3B,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,QAAQ;IAIhB;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IAwCvC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB;CAsH9B;AA0BD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,2BAA2B;;;mBA4DZ,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;EAibnD"}

package/dist/adapter.js

@@ -15,6 +15,7 @@ import { KVProofArchive } from "./storage/kv-proof-archive";
 import { STORAGE_KEYS } from "./constants/storage-keys";
 import { DEFAULT_SESSION_CACHE_TTL, DEFAULT_SESSION_TTL } from "./constants";
 import { normalizeCloudflareEnv } from "./helpers/env-mapper";
+import { calculateDOInstanceId, parseDORoutingStrategy, parseDOShardCount, } from "./utils/do-routing";
 import { AdminService } from "./services/admin.service";
 const INITIALIZE_CONTEXT_TTL_MS = 60_000;
 /**
@@ -27,16 +28,22 @@ class CloudflareMCPServer {
     proofArchive;
     requestOrigin; // Store request origin for consent URL building
     delegationStorage; // KV storage for delegation tokens
+    doNamespace; // DO namespace for strongly consistent storage
+    doRoutingStrategy;
+    doShardCount;
     initializeContexts;
     sessionClientIds; // Persists client IDs for error formatting
     environment; // Runtime environment (development, production)
     clientMessagesConfig; // Client-specific delegation messages
-    constructor(runtime, serverInfo, tools = [], proofArchive, delegationStorage, environment = "production", clientMessagesConfig) {
+    constructor(runtime, serverInfo, tools = [], proofArchive, delegationStorage, environment = "production", clientMessagesConfig, doNamespace, doRoutingStrategy = "singleton", doShardCount = 10) {
         this.runtime = runtime;
         this.serverInfo = serverInfo;
         this.tools = new Map(tools.map((t) => [t.name, t]));
         this.proofArchive = proofArchive;
         this.delegationStorage = delegationStorage;
+        this.doNamespace = doNamespace;
+        this.doRoutingStrategy = doRoutingStrategy;
+        this.doShardCount = doShardCount;
         this.initializeContexts = new Map();
         this.sessionClientIds = new Map(); // Persists client IDs beyond context consumption
         this.environment = environment;
@@ -49,6 +56,67 @@ class CloudflareMCPServer {
     setRequestOrigin(origin) {
         this.requestOrigin = origin;
     }
+    /**
+     * Calculate DO instance ID based on routing strategy.
+     * Delegates to shared utility so adapter, agent, and consent.service
+     * are guaranteed to route identically.
+     */
+    calculateDOInstanceId(sessionId) {
+        return calculateDOInstanceId(sessionId, this.doRoutingStrategy, this.doShardCount);
+    }
+    /**
+     * Fetch delegation from Durable Object (strongly consistent storage)
+     *
+     * This provides parity with the Agent pattern by using the same DO-based
+     * storage for delegations. The consent service stores to DO first, and
+     * now the adapter can read from DO first as well.
+     *
+     * @param sessionId - Session ID to lookup
+     * @param userDid - Optional user DID for user+agent scoped lookup
+     * @param agentDid - Agent DID for the lookup
+     * @returns Delegation token if found, undefined otherwise
+     */
+    async getDelegationFromDO(sessionId, userDid, agentDid) {
+        if (!this.doNamespace) {
+            return undefined;
+        }
+        try {
+            // Use the same routing strategy as consent service
+            const doInstanceId = this.calculateDOInstanceId(sessionId);
+            const doId = this.doNamespace.idFromName(doInstanceId);
+            const doStub = this.doNamespace.get(doId);
+            // Build request URL - use the origin or a placeholder
+            const origin = this.requestOrigin || "https://localhost";
+            const url = new URL("/_internal/delegation/get", origin);
+            const response = await doStub.fetch(url.toString(), {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    sessionId,
+                    userDid,
+                    agentDid,
+                }),
+            });
+            if (!response.ok) {
+                console.error("[CloudflareMCPServer] DO delegation lookup failed:", { status: response.status, sessionId: sessionId.slice(0, 20) + "..." });
+                return undefined;
+            }
+            const data = (await response.json());
+            if (data.success && data.data?.delegationToken) {
+                console.error("[CloudflareMCPServer] ✅ Delegation token retrieved from DO:", {
+                    sessionId: sessionId.slice(0, 20) + "...",
+                    userDid: userDid ? userDid.slice(0, 20) + "..." : "none",
+                    tokenLength: data.data.delegationToken.length,
+                });
+                return data.data.delegationToken;
+            }
+            return undefined;
+        }
+        catch (error) {
+            console.error("[CloudflareMCPServer] DO delegation lookup error:", error);
+            return undefined;
+        }
+    }
     /**
      * Handle JSON-RPC request
      */
@@ -104,7 +172,7 @@ class CloudflareMCPServer {
                     session = await this.runtime.getCurrentSession();
                     console.error("[CloudflareMCPServer] Session check:", {
                         hasSession: !!session,
-                        sessionId: session?.id?.slice(0, 20) + "..." || "none",
+                        sessionId: session?.id ? session.id.slice(0, 20) + "..." : "none",
                         hasDelegationToken: !!session?.delegationToken,
                         hasDelegationStorage: !!this.delegationStorage,
                         method: "tools/call",
@@ -169,7 +237,7 @@ class CloudflareMCPServer {
                     }
                     // Check KV storage for stored delegation token if not provided in params
                     let delegationToken = params.delegationToken;
-                    if (!delegationToken && this.delegationStorage) {
+                    if (!delegationToken && (this.delegationStorage || this.doNamespace)) {
                         try {
                             // Get userDID from params first
                             let userDid = params.clientDid || params.userDid;
@@ -192,7 +260,7 @@ class CloudflareMCPServer {
                                 }
                             }
                             // ✅ PRIORITY 2: If userDid not in params or OAuth mapping, try to retrieve from session cache
-                            if (!userDid && sessionId) {
+                            if (!userDid && sessionId && this.delegationStorage) {
                                 try {
                                     const sessionKey = STORAGE_KEYS.session(sessionId);
                                     const sessionData = (await this.delegationStorage.get(sessionKey, "json"));
@@ -209,15 +277,26 @@ class CloudflareMCPServer {
                                     // Non-fatal - continue without userDid
                                 }
                             }
-                            console.error("[CloudflareMCPServer] 🔍 Starting delegation token lookup from KV:", {
+                            console.error("[CloudflareMCPServer] 🔍 Starting delegation token lookup:", {
                                 agentDid: agentDid.slice(0, 20) + "...",
-                                userDid: userDid?.slice(0, 20) + "..." || "none",
-                                sessionId: sessionId?.slice(0, 20) + "..." || "none",
+                                userDid: userDid ? userDid.slice(0, 20) + "..." : "none",
+                                sessionId: sessionId ? sessionId.slice(0, 20) + "..." : "none",
                                 hasDelegationStorage: !!this.delegationStorage,
+                                hasDONamespace: !!this.doNamespace,
                             });
+                            // ✅ PRIORITY 0: Try Durable Object (strongly consistent, parity with Agent pattern)
+                            // This is the preferred approach for consistent delegation storage across all deployment types
+                            if (this.doNamespace && sessionId) {
+                                const doToken = await this.getDelegationFromDO(sessionId, userDid, agentDid);
+                                if (doToken) {
+                                    delegationToken = doToken;
+                                    console.error("[CloudflareMCPServer] ✅ PRIORITY 0: Delegation token from DO (strongly consistent)");
+                                }
+                            }
                             // PRIORITY 1: Try user+agent scoped token (user-specific, most secure)
                             // This is the preferred approach for multi-user scenarios with proper user isolation
-                            if (userDid) {
+                            // Skip if we already have a token from DO (PRIORITY 0)
+                            if (!delegationToken && userDid && this.delegationStorage) {
                                 const userAgentKey = STORAGE_KEYS.delegation(userDid, agentDid);
                                 console.error("[CloudflareMCPServer] 🔍 PRIORITY 1: Checking user+agent scoped key:", {
                                     key: userAgentKey,
@@ -262,7 +341,7 @@ class CloudflareMCPServer {
                             // PRIORITY 2: Try session-scoped token (if session ID was persisted)
                             // Note: Sessions are ephemeral in Cloudflare Workers, so this is mainly
                             // useful for caching tokens within a single request chain
-                            if (!delegationToken && sessionId) {
+                            if (!delegationToken && sessionId && this.delegationStorage) {
                                 const sessionKey = STORAGE_KEYS.session(sessionId);
                                 console.error("[CloudflareMCPServer] 🔍 PRIORITY 2: Checking session-scoped key:", {
                                     key: sessionKey,
@@ -301,8 +380,8 @@ class CloudflareMCPServer {
                                 }
                                 console.error("[CloudflareMCPServer] ⚠️ No delegation token found - user must complete consent flow:", {
                                     agentDid: agentDid.slice(0, 20) + "...",
-                                    userDid: userDid?.slice(0, 20) + "..." || "none (consent-only)",
-                                    sessionId: sessionId?.slice(0, 20) + "..." || "none",
+                                    userDid: userDid ? userDid.slice(0, 20) + "..." : "none (consent-only)",
+                                    sessionId: sessionId ? sessionId.slice(0, 20) + "..." : "none",
                                     checkedKeys,
                                     hint: "Delegation tokens are session-scoped or user+agent scoped. Complete consent flow for this session.",
                                 });
@@ -347,10 +426,10 @@ class CloudflareMCPServer {
                         hasSession: !!session,
                         hasDelegationToken: !!session?.delegationToken,
                         hasDelegationStorage: !!this.delegationStorage,
-                        sessionId: session?.id?.slice(0, 20) + "...",
+                        sessionId: session?.id ? session.id.slice(0, 20) + "..." : "none",
                         sessionKeys: Object.keys(session || {}),
                     });
-                    if (!session.delegationToken && this.delegationStorage) {
+                    if (!session.delegationToken && (this.delegationStorage || this.doNamespace)) {
                         console.error("[CloudflareMCPServer] ⚠️ Session has no delegationToken, attempting KV lookup...");
                         try {
                             const agentDid = (await this.runtime.getIdentity()).did;
@@ -381,16 +460,27 @@ class CloudflareMCPServer {
                                 }
                             }
                             console.error("[CloudflareMCPServer] 🔍 Looking up delegation token for existing session:", {
-                                sessionId: sessionId?.slice(0, 20) + "...",
-                                userDid: userDid?.slice(0, 20) + "...",
-                                agentDid: agentDid?.slice(0, 20) + "...",
+                                sessionId: sessionId ? sessionId.slice(0, 20) + "..." : "none",
+                                userDid: userDid ? userDid.slice(0, 20) + "..." : "none",
+                                agentDid: agentDid ? agentDid.slice(0, 20) + "..." : "none",
                             });
+                            let delegationToken = undefined;
+                            // PRIORITY 0: Try Durable Object (strongly consistent, parity with Agent pattern)
+                            if (this.doNamespace && sessionId) {
+                                const doToken = await this.getDelegationFromDO(sessionId, userDid, agentDid);
+                                if (doToken) {
+                                    delegationToken = doToken;
+                                    console.error("[CloudflareMCPServer] ✅ PRIORITY 0: Delegation token from DO (existing session)");
+                                }
+                            }
                             // PRIORITY 1: Try user+agent scoped token (user-specific, most secure)
                             // This is the preferred approach for multi-user scenarios with proper user isolation
-                            let delegationToken = undefined;
                             // Track which source the token was found in for accurate logging
                             let tokenSource;
-                            if (userDid) {
+                            if (delegationToken) {
+                                tokenSource = "do";
+                            }
+                            else if (userDid && this.delegationStorage) {
                                 const userAgentKey = STORAGE_KEYS.delegation(userDid, agentDid);
                                 console.error("[CloudflareMCPServer] 🔍 PRIORITY 1: Checking user+agent scoped key (existing session):", {
                                     key: userAgentKey,
@@ -409,7 +499,7 @@ class CloudflareMCPServer {
                                 }
                             }
                             // PRIORITY 2: Try session-scoped token (if session ID was persisted)
-                            if (!delegationToken && sessionId) {
+                            if (!delegationToken && sessionId && this.delegationStorage) {
                                 const sessionKey = STORAGE_KEYS.session(sessionId);
                                 console.error("[CloudflareMCPServer] 🔍 PRIORITY 2: Checking session-scoped key (existing session):", {
                                     key: sessionKey,
@@ -436,7 +526,7 @@ class CloudflareMCPServer {
                                     delegationToken,
                                 };
                                 console.error("[CloudflareMCPServer] ✅ Delegation token set on existing session:", {
-                                    sessionId: sessionId?.slice(0, 20) + "..." || "none",
+                                    sessionId: sessionId ? sessionId.slice(0, 20) + "..." : "none",
                                     tokenLength: delegationToken.length,
                                     sessionHasToken: !!session.delegationToken,
                                     source: tokenSource,
@@ -453,7 +543,7 @@ class CloudflareMCPServer {
                                     checkedKeys.push(STORAGE_KEYS.session(sessionId));
                                 }
                                 console.error("[CloudflareMCPServer] ⚠️ No delegation token found - user must complete consent flow:", {
-                                    sessionId: sessionId?.slice(0, 20) + "..." || "none",
+                                    sessionId: sessionId ? sessionId.slice(0, 20) + "..." : "none",
                                     checkedKeys,
                                     hint: "Complete consent flow for this session to get a delegation token.",
                                 });
@@ -497,49 +587,52 @@ class CloudflareMCPServer {
                 session.toolParams = params.arguments || {};
                 session.scopeId = scopeId; // ✅ ADDED: Pass scopeId for tool auto-discovery
                 // ✅ CRITICAL: Verify delegation token is set on session before processToolCall
-                // Also do a final KV lookup if token is still missing (defensive check)
-                // Use same 3-priority lookup: user+agent scoped, then session-scoped, then agent-scoped (last resort)
-                if (!session?.delegationToken && this.delegationStorage) {
+                // Final defensive lookup: DO first, then KV fallback
+                if (!session?.delegationToken && (this.doNamespace || this.delegationStorage)) {
                     try {
                         const agentDid = (await this.runtime.getIdentity()).did;
                         const userDid = session.userDid || params.clientDid || params.userDid;
                         let finalToken = undefined;
+                        // PRIORITY 0: Durable Object (strongly consistent)
+                        if (this.doNamespace && session.id) {
+                            const doToken = await this.getDelegationFromDO(session.id, userDid, agentDid);
+                            if (doToken) {
+                                finalToken = doToken;
+                            }
+                        }
                         // PRIORITY 1: User+agent scoped token
-                        if (userDid) {
+                        if (!finalToken && userDid && this.delegationStorage) {
                             const userAgentKey = STORAGE_KEYS.delegation(userDid, agentDid);
                             const token = await this.delegationStorage.get(userAgentKey, "text");
                             finalToken = token || undefined; // Convert null to undefined
                         }
                         // PRIORITY 2: Session-scoped token
-                        if (!finalToken && session.id) {
+                        if (!finalToken && session.id && this.delegationStorage) {
                             const sessionKey = STORAGE_KEYS.session(session.id);
                             const sessionData = (await this.delegationStorage.get(sessionKey, "json"));
                             finalToken = sessionData?.delegationToken;
                         }
-                        // ❌ REMOVED: Legacy agent-scoped fallback (PRIORITY 3)
-                        // This was a security vulnerability that allowed cross-user delegation sharing.
                         if (finalToken) {
                             session.delegationToken = finalToken;
-                            console.error("[CloudflareMCPServer] ✅ Final KV lookup succeeded, token set on session:", {
+                            console.error("[CloudflareMCPServer] ✅ Final lookup succeeded, token set on session:", {
                                 toolName,
                                 agentDid: agentDid.slice(0, 20) + "...",
-                                userDid: userDid?.slice(0, 20) + "..." || "none (consent-only)",
+                                userDid: userDid ? userDid.slice(0, 20) + "..." : "none",
                                 tokenLength: finalToken.length,
-                                source: userDid ? "user+agent-scoped" : "session-scoped",
                             });
                         }
                     }
                     catch (error) {
-                        console.error("[CloudflareMCPServer] Final KV lookup failed:", error);
+                        console.error("[CloudflareMCPServer] Final delegation lookup failed:", error);
                     }
                 }
                 console.error("[CloudflareMCPServer] ✅ About to call processToolCall with session:", {
                     toolName,
-                    sessionId: session?.id?.slice(0, 20) + "..." || "none",
+                    sessionId: session?.id ? session.id.slice(0, 20) + "..." : "none",
                     hasDelegationToken: !!session?.delegationToken,
                     delegationTokenLength: session?.delegationToken?.length || 0,
                     hasConsentProof: !!session?.consentProof,
-                    agentDid: session?.agentDid?.slice(0, 20) + "..." || "none",
+                    agentDid: session?.agentDid ? session.agentDid.slice(0, 20) + "..." : "none",
                 });
                 // ✅ Use processToolCall which handles delegation checks AND proof generation
                 // This ensures delegation is checked BEFORE tool execution
@@ -1166,14 +1259,19 @@ export function createMCPICloudflareAdapter(config) {
         : undefined;
     // Get delegation storage from normalized env if available
     const delegationStorage = mappedEnv.DELEGATION_STORAGE;
+    // Get DO namespace for strongly consistent delegation storage (parity with Agent pattern)
+    const doNamespace = mappedEnv.MCP_OBJECT;
     // Initialize AdminService (if API key is present)
     // This enables cache clearing and other admin operations
     let adminService;
     if (mappedEnv.AGENTSHIELD_API_KEY) {
         adminService = new AdminService(mappedEnv);
     }
+    // Get DO routing configuration from environment (shared utility ensures parity)
+    const doRoutingStrategy = parseDORoutingStrategy(mappedEnv.DO_ROUTING_STRATEGY);
+    const doShardCount = parseDOShardCount(mappedEnv.DO_SHARD_COUNT);
     // Create lightweight MCP server
-    const server = new CloudflareMCPServer(runtime, serverInfo, config.tools || [], proofArchive, delegationStorage, config.environment || "production", config.clientMessagesConfig);
+    const server = new CloudflareMCPServer(runtime, serverInfo, config.tools || [], proofArchive, delegationStorage, config.environment || "production", config.clientMessagesConfig, doNamespace, doRoutingStrategy, doShardCount);
     // Return fetch handler
     // Note: mappedEnv is captured in closure for admin endpoints
     return {