@reactionary/ucp 0.10.33 → 0.10.34

package/README.md

@@ -145,6 +145,150 @@ REST requests may include:
 - `Request-Id`: echoed in the response header.
 - `Idempotency-Key`: supported for mutating REST endpoints and stored in the UCP session cache. Reusing a key with a different mutation payload returns `409`.
 
+## Identity linking (OAuth 2.0)
+
+Setting the optional `identity` server option turns the UCP server into a small OAuth 2.0 authorization server implementing UCP's `dev.ucp.common.identity_linking`, so an agent can act for a logged-in shopper. The agent never sees credentials; the shopper logs in on the storefront's existing login page, and the resulting Reactionary `Session` is stored behind opaque, hashed bearer tokens.
+
+```ts
+const server = new ReactionaryUCPServer(createClient, {
+  sessionCache: redisCache, // optional enhancer, see below
+  profile: { /* ... */ },
+  identity: {
+    issuer: 'https://shop.example.com',
+    loginUrl: 'https://shop.example.com/account/login',
+    stateSecret: process.env.UCP_OAUTH_STATE_SECRET, // 32+ chars; must be identical on all instances
+    internalApiKey: process.env.UCP_OAUTH_INTERNAL_KEY, // only for split deployments
+    clients: [
+      {
+        clientId: 'openai-shopping',
+        clientSecret: process.env.OPENAI_CLIENT_SECRET, // omit for public clients (PKCE-only)
+        redirectUris: ['https://agents.example-platform.com/oauth/callback'],
+      },
+    ],
+  },
+});
+```
+
+What this serves:
+
+- `GET /.well-known/oauth-authorization-server` (RFC 8414 metadata)
+- `GET {endpoint}/oauth/authorize` — validates client, exact `redirect_uri`, and PKCE S256 (mandatory for all clients), then redirects to `loginUrl` with `?ucp_request_id=...`
+- `GET|POST {endpoint}/oauth/consent` — consent page (override with `renderConsentPage`) that mints the single-use authorization code
+- `POST {endpoint}/oauth/token` — `authorization_code` and `refresh_token` grants
+- `POST {endpoint}/oauth/revoke` — RFC 7009; revoking a refresh token kills its access tokens
+- `POST {endpoint}/oauth/complete` — internal server-to-server completion (requires `internalApiKey`)
+
+All OAuth state (authorization requests, codes, access and refresh tokens) is sealed into self-contained AES-256-GCM blobs encrypted with `stateSecret` — nothing needs to be stored for the flow to be correct, tokens survive restarts, and multiple instances only need the same `stateSecret`. The `sessionCache` is a pure enhancer; when present it adds:
+
+- **single-use enforcement** of authorization codes and consent grants (without it, replay is bounded only by the 60s code TTL plus PKCE and client auth)
+- **instant revocation** (`/oauth/revoke` keeps a deny-list; without a shared durable cache, revocation is best-effort until the token expires)
+- **session freshness** (backend-session changes during bearer requests are written to a cache overlay; without it, requests fall back to the session sealed at link time)
+
+Gated routes (default: `GET /orders/*` requires `dev.ucp.shopping.order:read`, configurable via `scopes`) answer `401` with `WWW-Authenticate: Bearer error="identity_required"` or `403 insufficient_scope`. When the stored backend session has expired, the agent receives `401` and must re-link — there is no silent re-login and no password is ever stored.
+
+The profile at `/.well-known/ucp` automatically advertises `dev.ucp.common.identity_linking` with `config.scopes`.
+
+### Storefront integration
+
+The storefront owns the login UI; the library owns everything else. After its normal login succeeds, the storefront tells the UCP server "this request id belongs to this customer and session" and sends the browser to the returned `continueUrl`. There are two transports for that hand-off:
+
+- **Embedded** (storefront mounts the UCP handler in-process): call `server.identity.completeAuthorization(...)` directly.
+- **Split deployment** (UCP runs as its own Express server): `POST {endpoint}/oauth/complete` with the `x-ucp-internal-key` header, server-to-server. No shared storage is needed — state travels in sealed blobs — and the browser never sees the internal key.
+
+The login page must honour the `ucp_request_id` query parameter: keep it through the login flow and hand it to the continue route below.
+
+#### Next.js (App Router)
+
+`app/ucp/oauth/continue/route.ts` — the storefront's only new code:
+
+```ts
+import { NextRequest, NextResponse } from 'next/server';
+import { getReactionarySession } from '../../../lib/session'; // however the storefront restores its Session
+
+export async function GET(request: NextRequest): Promise<NextResponse> {
+  const requestId = request.nextUrl.searchParams.get('ucp_request_id');
+  const { customerId, session } = await getReactionarySession(request);
+
+  if (!requestId || !customerId) {
+    return NextResponse.redirect(new URL('/account/login', request.url));
+  }
+
+  // Split deployment: hand the session to the standalone UCP server.
+  const response = await fetch(`${process.env.UCP_BASE_URL}/oauth/complete`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'x-ucp-internal-key': process.env.UCP_OAUTH_INTERNAL_KEY ?? '',
+    },
+    body: JSON.stringify({ request_id: requestId, customer_id: customerId, session }),
+  });
+
+  const { continue_url: continueUrl } = (await response.json()) as { continue_url: string };
+  return NextResponse.redirect(continueUrl);
+}
+```
+
+Embedded variant (UCP server mounted in the same Next.js app): replace the `fetch` with
+
+```ts
+const { continueUrl } = await ucpServer.identity.completeAuthorization({
+  requestId,
+  customerId,
+  session,
+});
+return NextResponse.redirect(continueUrl);
+```
+
+And the login page forwards the parameter, e.g. `app/account/login/page.tsx` redirects to `/ucp/oauth/continue?ucp_request_id=...` after a successful sign-in when the parameter is present.
+
+#### SvelteKit
+
+`src/routes/ucp/oauth/continue/+server.ts`:
+
+```ts
+import { redirect } from '@sveltejs/kit';
+import { UCP_BASE_URL, UCP_OAUTH_INTERNAL_KEY } from '$env/static/private';
+import type { RequestHandler } from './$types';
+
+export const GET: RequestHandler = async ({ url, locals }) => {
+  const requestId = url.searchParams.get('ucp_request_id');
+  const { customerId, session } = locals; // however the storefront restores its Session
+
+  if (!requestId || !customerId) {
+    redirect(302, '/account/login');
+  }
+
+  const response = await fetch(`${UCP_BASE_URL}/oauth/complete`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'x-ucp-internal-key': UCP_OAUTH_INTERNAL_KEY,
+    },
+    body: JSON.stringify({ request_id: requestId, customer_id: customerId, session }),
+  });
+
+  const { continue_url: continueUrl } = (await response.json()) as { continue_url: string };
+  redirect(302, continueUrl);
+};
+```
+
+#### Standalone Express UCP server
+
+Redirect hops in a split deployment:
+
+```text
+agent -> UCP /oauth/authorize -> storefront /account/login?ucp_request_id=...
+      -> storefront /ucp/oauth/continue (reads own session, POSTs /oauth/complete with internal key)
+      -> UCP /oauth/consent (approve/deny) -> agent redirect_uri?code=...&iss=...
+```
+
+Requirements:
+
+- No shared storage is required between the storefront and the UCP server: state travels inside sealed blobs. Give the UCP server a Redis-backed `sessionCache` to get single-use code enforcement and instant revocation across instances.
+- All UCP instances must share the same `stateSecret`; rotating it invalidates every outstanding token and link-in-progress.
+- Set `internalApiKey` (e.g. from `UCP_OAUTH_INTERNAL_KEY`) on the UCP server and in the storefront's environment. It is a server-to-server secret; never expose it to the browser.
+- `issuer` is the public origin; `baseUrl` defaults to `{issuer}/ucp` and must match where the UCP endpoint is actually served.
+
 ## Request IDs and idempotency
 
 `Request-Id` is optional and echoed in the response header so agents can correlate calls and responses.

package/index.js

@@ -1 +1,2 @@
 export * from "./lib/reactionary-ucp-server.js";
+export * from "./lib/reactionary-ucp-identity.js";

package/lib/reactionary-ucp-identity-state.js

@@ -0,0 +1,152 @@
+import { SessionSchema } from "@reactionary/core";
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { deflateRawSync, inflateRawSync } from "node:zlib";
+import * as z from "zod";
+const USED_STATE_CACHE_KEY_PREFIX = "reactionary:ucp:identity:used";
+const REVOKED_TOKEN_CACHE_KEY_PREFIX = "reactionary:ucp:identity:revoked";
+const SESSION_OVERLAY_CACHE_KEY_PREFIX = "reactionary:ucp:identity:session";
+const UCPAuthorizationRequestStateSchema = z.looseObject({
+  clientId: z.string(),
+  redirectUri: z.string(),
+  scope: z.string(),
+  state: z.string().optional(),
+  codeChallenge: z.string()
+});
+const UCPConsentStateSchema = UCPAuthorizationRequestStateSchema.extend({
+  customerId: z.string(),
+  session: SessionSchema
+});
+const UCPAuthorizationCodeStateSchema = UCPConsentStateSchema;
+const UCPTokenStateSchema = z.looseObject({
+  kind: z.enum(["access", "refresh"]),
+  clientId: z.string(),
+  customerId: z.string(),
+  scope: z.string(),
+  session: SessionSchema,
+  refreshTokenHash: z.string().optional()
+});
+const SealedEnvelopeSchema = z.object({
+  kind: z.string(),
+  expiresAt: z.number(),
+  payload: z.unknown()
+});
+function hashIdentityToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+class ReactionaryUCPIdentityState {
+  constructor(stateSecret, cache) {
+    this.cache = cache;
+    this.key = createHash("sha256").update(stateSecret).digest();
+  }
+  cache;
+  key;
+  seal(kind, payload, ttlSeconds) {
+    const envelope = JSON.stringify({
+      kind,
+      expiresAt: Date.now() + ttlSeconds * 1e3,
+      payload
+    });
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", this.key, iv);
+    const ciphertext = Buffer.concat([
+      cipher.update(deflateRawSync(Buffer.from(envelope, "utf-8"))),
+      cipher.final()
+    ]);
+    return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString("base64url");
+  }
+  open(kind, sealed, schema) {
+    try {
+      const raw = Buffer.from(sealed, "base64url");
+      const decipher = createDecipheriv("aes-256-gcm", this.key, raw.subarray(0, 12));
+      decipher.setAuthTag(raw.subarray(12, 28));
+      const plaintext = inflateRawSync(
+        Buffer.concat([decipher.update(raw.subarray(28)), decipher.final()])
+      ).toString("utf-8");
+      const envelope = SealedEnvelopeSchema.parse(JSON.parse(plaintext));
+      if (envelope.kind !== kind || envelope.expiresAt <= Date.now()) {
+        return void 0;
+      }
+      return {
+        state: schema.parse(envelope.payload),
+        expiresAt: envelope.expiresAt
+      };
+    } catch {
+      return void 0;
+    }
+  }
+  async markUsed(sealed, ttlSeconds) {
+    if (!this.cache) {
+      return true;
+    }
+    const key = `${USED_STATE_CACHE_KEY_PREFIX}:${hashIdentityToken(sealed)}`;
+    const existing = await this.cache.get(key, UsedMarkerSchema);
+    if (existing) {
+      return false;
+    }
+    await this.cache.put(key, { usedAt: Date.now() }, {
+      ttlSeconds,
+      dependencyIds: [key]
+    });
+    return true;
+  }
+  async revokeToken(token, ttlSeconds) {
+    if (!this.cache) {
+      return;
+    }
+    const key = `${REVOKED_TOKEN_CACHE_KEY_PREFIX}:${hashIdentityToken(token)}`;
+    await this.cache.invalidate([key]);
+    await this.cache.put(key, { revokedAt: Date.now() }, {
+      ttlSeconds,
+      dependencyIds: [key]
+    });
+  }
+  async isTokenRevoked(tokenHashes) {
+    if (!this.cache) {
+      return false;
+    }
+    for (const tokenHash of tokenHashes) {
+      const revoked = await this.cache.get(
+        `${REVOKED_TOKEN_CACHE_KEY_PREFIX}:${tokenHash}`,
+        RevokedMarkerSchema
+      );
+      if (revoked) {
+        return true;
+      }
+    }
+    return false;
+  }
+  async putSessionOverlay(tokenHash, session, ttlSeconds) {
+    if (!this.cache) {
+      return;
+    }
+    const key = `${SESSION_OVERLAY_CACHE_KEY_PREFIX}:${tokenHash}`;
+    await this.cache.invalidate([key]);
+    await this.cache.put(key, session, {
+      ttlSeconds,
+      dependencyIds: [key]
+    });
+  }
+  async getSessionOverlay(tokenHash) {
+    if (!this.cache) {
+      return void 0;
+    }
+    return await this.cache.get(
+      `${SESSION_OVERLAY_CACHE_KEY_PREFIX}:${tokenHash}`,
+      SessionSchema
+    ) ?? void 0;
+  }
+}
+const UsedMarkerSchema = z.looseObject({
+  usedAt: z.number()
+});
+const RevokedMarkerSchema = z.looseObject({
+  revokedAt: z.number()
+});
+export {
+  ReactionaryUCPIdentityState,
+  UCPAuthorizationCodeStateSchema,
+  UCPAuthorizationRequestStateSchema,
+  UCPConsentStateSchema,
+  UCPTokenStateSchema,
+  hashIdentityToken
+};

package/lib/reactionary-ucp-identity.js

@@ -0,0 +1,466 @@
+import { SessionSchema } from "@reactionary/core";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import * as z from "zod";
+import { jsonResponse } from "./reactionary-ucp-http.js";
+import {
+  hashIdentityToken,
+  ReactionaryUCPIdentityState,
+  UCPAuthorizationCodeStateSchema,
+  UCPAuthorizationRequestStateSchema,
+  UCPConsentStateSchema,
+  UCPTokenStateSchema
+} from "./reactionary-ucp-identity-state.js";
+const DEFAULT_UCP_IDENTITY_SCOPES = [
+  {
+    scope: "dev.ucp.shopping.order:read",
+    description: "Read your orders",
+    gates: [{ method: "GET", pathPattern: /^\/orders\// }]
+  }
+];
+const PENDING_TTL_SECONDS = 10 * 60;
+const CODE_TTL_SECONDS = 60;
+const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
+const DEFAULT_REFRESH_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30;
+const MIN_STATE_SECRET_LENGTH = 32;
+class ReactionaryUCPIdentity {
+  constructor(options, cache) {
+    this.options = options;
+    if (options.stateSecret.length < MIN_STATE_SECRET_LENGTH) {
+      throw new Error(`identity.stateSecret must be at least ${MIN_STATE_SECRET_LENGTH} characters long.`);
+    }
+    this.state = new ReactionaryUCPIdentityState(options.stateSecret, cache);
+    this.scopes = options.scopes ?? DEFAULT_UCP_IDENTITY_SCOPES;
+    this.baseUrl = (options.baseUrl ?? `${options.issuer}/ucp`).replace(/\/$/, "");
+    this.accessTokenTtlSeconds = options.accessTokenTtlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
+    this.refreshTokenTtlSeconds = options.refreshTokenTtlSeconds ?? DEFAULT_REFRESH_TOKEN_TTL_SECONDS;
+  }
+  options;
+  state;
+  scopes;
+  baseUrl;
+  accessTokenTtlSeconds;
+  refreshTokenTtlSeconds;
+  getScopeNames() {
+    return this.scopes.map((scope) => scope.scope);
+  }
+  async handleHttp(request, path) {
+    const rawPathname = new URL(request.url).pathname;
+    if (rawPathname === "/.well-known/oauth-authorization-server" && request.method === "GET") {
+      return jsonResponse(this.getMetadata());
+    }
+    if (path === "/oauth/authorize" && request.method === "GET") {
+      return this.handleAuthorize(request);
+    }
+    if (path === "/oauth/complete" && request.method === "POST") {
+      return this.handleComplete(request);
+    }
+    if (path === "/oauth/consent" && request.method === "GET") {
+      return this.handleConsentPage(request);
+    }
+    if (path === "/oauth/consent" && request.method === "POST") {
+      return this.handleConsentDecision(request);
+    }
+    if (path === "/oauth/token" && request.method === "POST") {
+      return this.handleToken(request);
+    }
+    if (path === "/oauth/revoke" && request.method === "POST") {
+      return this.handleRevoke(request);
+    }
+    return void 0;
+  }
+  async completeAuthorization(payload) {
+    const opened = this.state.open(
+      "authorization_request",
+      payload.requestId,
+      UCPAuthorizationRequestStateSchema
+    );
+    if (!opened) {
+      throw new Error("Unknown or expired authorization request.");
+    }
+    const grant = this.state.seal(
+      "consent",
+      {
+        ...opened.state,
+        customerId: payload.customerId,
+        session: payload.session
+      },
+      PENDING_TTL_SECONDS
+    );
+    const continueUrl = new URL(`${this.baseUrl}/oauth/consent`);
+    continueUrl.searchParams.set("grant", grant);
+    return { continueUrl: continueUrl.toString() };
+  }
+  async resolveBearer(request) {
+    const authorization = request.headers.get("authorization");
+    if (!authorization?.toLowerCase().startsWith("bearer ")) {
+      return void 0;
+    }
+    const token = authorization.slice("bearer ".length).trim();
+    const opened = this.state.open("token", token, UCPTokenStateSchema);
+    if (!opened || opened.state.kind !== "access") {
+      return bearerChallengeResponse(401, "invalid_token", "The access token is invalid or expired.");
+    }
+    const tokenHash = hashIdentityToken(token);
+    const revokedHashes = [tokenHash];
+    if (opened.state.refreshTokenHash) {
+      revokedHashes.push(opened.state.refreshTokenHash);
+    }
+    if (await this.state.isTokenRevoked(revokedHashes)) {
+      return bearerChallengeResponse(401, "invalid_token", "The access token has been revoked.");
+    }
+    const overlaySession = await this.state.getSessionOverlay(tokenHash);
+    return {
+      tokenHash,
+      expiresAt: opened.expiresAt,
+      scope: opened.state.scope,
+      session: overlaySession ?? opened.state.session
+    };
+  }
+  checkAccess(method, path, bearer) {
+    const requiredScopes = this.scopes.filter(
+      (scope) => scope.gates?.some(
+        (gate) => (!gate.method || gate.method === method) && gate.pathPattern.test(path)
+      )
+    );
+    if (requiredScopes.length === 0) {
+      return void 0;
+    }
+    const scopeNames = requiredScopes.map((scope) => scope.scope);
+    if (!bearer) {
+      return bearerChallengeResponse(
+        401,
+        "identity_required",
+        "This operation requires a linked user identity.",
+        scopeNames
+      );
+    }
+    const grantedScopes = bearer.scope.split(" ");
+    const missing = scopeNames.filter((scope) => !grantedScopes.includes(scope));
+    if (missing.length > 0) {
+      return bearerChallengeResponse(
+        403,
+        "insufficient_scope",
+        "The access token does not grant the required scope.",
+        missing
+      );
+    }
+    return void 0;
+  }
+  async persistBearerSession(bearer, session) {
+    const remainingTtlSeconds = Math.max(1, Math.ceil((bearer.expiresAt - Date.now()) / 1e3));
+    await this.state.putSessionOverlay(bearer.tokenHash, session, remainingTtlSeconds);
+  }
+  getMetadata() {
+    return {
+      issuer: this.options.issuer,
+      authorization_endpoint: `${this.baseUrl}/oauth/authorize`,
+      token_endpoint: `${this.baseUrl}/oauth/token`,
+      revocation_endpoint: `${this.baseUrl}/oauth/revoke`,
+      response_types_supported: ["code"],
+      grant_types_supported: ["authorization_code", "refresh_token"],
+      code_challenge_methods_supported: ["S256"],
+      scopes_supported: this.getScopeNames(),
+      token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post", "none"]
+    };
+  }
+  async handleAuthorize(request) {
+    const url = new URL(request.url);
+    const clientId = url.searchParams.get("client_id") ?? "";
+    const redirectUri = url.searchParams.get("redirect_uri") ?? "";
+    const client = this.options.clients.find((candidate) => candidate.clientId === clientId);
+    if (!client || !client.redirectUris.includes(redirectUri)) {
+      return jsonResponse(
+        { error: "invalid_request", error_description: "Unknown client_id or unregistered redirect_uri." },
+        { status: 400 }
+      );
+    }
+    const state = url.searchParams.get("state") ?? void 0;
+    const responseType = url.searchParams.get("response_type");
+    const scope = url.searchParams.get("scope") ?? "";
+    const codeChallenge = url.searchParams.get("code_challenge");
+    const codeChallengeMethod = url.searchParams.get("code_challenge_method");
+    if (responseType !== "code") {
+      return authorizeErrorRedirect(redirectUri, "unsupported_response_type", state);
+    }
+    if (!codeChallenge || codeChallengeMethod !== "S256") {
+      return authorizeErrorRedirect(redirectUri, "invalid_request", state, "PKCE with S256 is required.");
+    }
+    const knownScopes = this.getScopeNames();
+    const requestedScopes = scope.split(" ").filter((entry) => entry.length > 0);
+    if (requestedScopes.some((entry) => !knownScopes.includes(entry))) {
+      return authorizeErrorRedirect(redirectUri, "invalid_scope", state);
+    }
+    const requestId = this.state.seal(
+      "authorization_request",
+      {
+        clientId,
+        redirectUri,
+        scope: requestedScopes.join(" "),
+        ...state !== void 0 ? { state } : {},
+        codeChallenge
+      },
+      PENDING_TTL_SECONDS
+    );
+    const loginUrl = new URL(this.options.loginUrl);
+    loginUrl.searchParams.set("ucp_request_id", requestId);
+    return redirectResponse(loginUrl.toString());
+  }
+  async handleComplete(request) {
+    if (!this.options.internalApiKey) {
+      return jsonResponse(
+        { error: "invalid_request", error_description: "The completion endpoint is not enabled; configure internalApiKey." },
+        { status: 404 }
+      );
+    }
+    const providedKey = request.headers.get("x-ucp-internal-key") ?? "";
+    if (!secureEquals(providedKey, this.options.internalApiKey)) {
+      return jsonResponse({ error: "invalid_client" }, { status: 401 });
+    }
+    const body = await request.json().catch(() => void 0);
+    const parsed = CompleteAuthorizationBodySchema.safeParse(body);
+    if (!parsed.success) {
+      return jsonResponse(
+        { error: "invalid_request", error_description: "Body must contain request_id, customer_id and session." },
+        { status: 400 }
+      );
+    }
+    try {
+      const { continueUrl } = await this.completeAuthorization({
+        requestId: parsed.data.request_id,
+        customerId: parsed.data.customer_id,
+        session: parsed.data.session
+      });
+      return jsonResponse({ continue_url: continueUrl });
+    } catch {
+      return jsonResponse(
+        { error: "invalid_request", error_description: "Unknown or expired authorization request." },
+        { status: 400 }
+      );
+    }
+  }
+  async handleConsentPage(request) {
+    const grant = new URL(request.url).searchParams.get("grant") ?? "";
+    const opened = this.state.open("consent", grant, UCPConsentStateSchema);
+    if (!opened) {
+      return htmlResponse("<p>This authorization request is unknown or has expired.</p>", 400);
+    }
+    const context = {
+      clientId: opened.state.clientId,
+      customerId: opened.state.customerId,
+      scopes: opened.state.scope.split(" ").filter((entry) => entry.length > 0),
+      approveUrl: `${this.baseUrl}/oauth/consent`,
+      grant
+    };
+    const render = this.options.renderConsentPage ?? renderDefaultConsentPage;
+    return htmlResponse(render(context));
+  }
+  async handleConsentDecision(request) {
+    const form = await request.formData().catch(() => void 0);
+    const grant = readFormValue(form, "grant");
+    const decision = readFormValue(form, "decision");
+    const opened = this.state.open("consent", grant, UCPConsentStateSchema);
+    if (!opened || !await this.state.markUsed(grant, PENDING_TTL_SECONDS)) {
+      return htmlResponse("<p>This authorization request is unknown or has expired.</p>", 400);
+    }
+    if (decision !== "approve") {
+      return authorizeErrorRedirect(opened.state.redirectUri, "access_denied", opened.state.state);
+    }
+    const code = this.state.seal("code", opened.state, CODE_TTL_SECONDS);
+    const redirectUrl = new URL(opened.state.redirectUri);
+    redirectUrl.searchParams.set("code", code);
+    redirectUrl.searchParams.set("iss", this.options.issuer);
+    if (opened.state.state !== void 0) {
+      redirectUrl.searchParams.set("state", opened.state.state);
+    }
+    return redirectResponse(redirectUrl.toString());
+  }
+  async handleToken(request) {
+    const form = await request.formData().catch(() => void 0);
+    const client = this.authenticateClient(request, form);
+    if (!client) {
+      return jsonResponse({ error: "invalid_client" }, {
+        status: 401,
+        headers: { "www-authenticate": 'Basic realm="ucp"' }
+      });
+    }
+    const grantType = readFormValue(form, "grant_type");
+    if (grantType === "authorization_code") {
+      return this.handleAuthorizationCodeGrant(client, form);
+    }
+    if (grantType === "refresh_token") {
+      return this.handleRefreshTokenGrant(client, form);
+    }
+    return jsonResponse({ error: "unsupported_grant_type" }, { status: 400 });
+  }
+  async handleAuthorizationCodeGrant(client, form) {
+    const code = readFormValue(form, "code");
+    const codeVerifier = readFormValue(form, "code_verifier");
+    const redirectUri = readFormValue(form, "redirect_uri");
+    const opened = code ? this.state.open("code", code, UCPAuthorizationCodeStateSchema) : void 0;
+    if (!opened || !await this.state.markUsed(code, CODE_TTL_SECONDS) || opened.state.clientId !== client.clientId || opened.state.redirectUri !== redirectUri || !verifyPkce(codeVerifier, opened.state.codeChallenge)) {
+      return jsonResponse({ error: "invalid_grant" }, { status: 400 });
+    }
+    const refreshToken = this.state.seal(
+      "token",
+      {
+        kind: "refresh",
+        clientId: opened.state.clientId,
+        customerId: opened.state.customerId,
+        scope: opened.state.scope,
+        session: opened.state.session
+      },
+      this.refreshTokenTtlSeconds
+    );
+    const accessToken = this.mintAccessToken({
+      kind: "access",
+      clientId: opened.state.clientId,
+      customerId: opened.state.customerId,
+      scope: opened.state.scope,
+      session: opened.state.session,
+      refreshTokenHash: hashIdentityToken(refreshToken)
+    });
+    return jsonResponse({
+      access_token: accessToken,
+      token_type: "Bearer",
+      expires_in: this.accessTokenTtlSeconds,
+      refresh_token: refreshToken,
+      scope: opened.state.scope
+    });
+  }
+  async handleRefreshTokenGrant(client, form) {
+    const refreshToken = readFormValue(form, "refresh_token");
+    const opened = refreshToken ? this.state.open("token", refreshToken, UCPTokenStateSchema) : void 0;
+    const refreshTokenHash = hashIdentityToken(refreshToken);
+    if (!opened || opened.state.kind !== "refresh" || opened.state.clientId !== client.clientId || await this.state.isTokenRevoked([refreshTokenHash])) {
+      return jsonResponse({ error: "invalid_grant" }, { status: 400 });
+    }
+    const accessToken = this.mintAccessToken({
+      kind: "access",
+      clientId: opened.state.clientId,
+      customerId: opened.state.customerId,
+      scope: opened.state.scope,
+      session: opened.state.session,
+      refreshTokenHash
+    });
+    return jsonResponse({
+      access_token: accessToken,
+      token_type: "Bearer",
+      expires_in: this.accessTokenTtlSeconds,
+      scope: opened.state.scope
+    });
+  }
+  mintAccessToken(state) {
+    return this.state.seal("token", state, this.accessTokenTtlSeconds);
+  }
+  async handleRevoke(request) {
+    const form = await request.formData().catch(() => void 0);
+    const client = this.authenticateClient(request, form);
+    if (!client) {
+      return jsonResponse({ error: "invalid_client" }, { status: 401 });
+    }
+    const token = readFormValue(form, "token");
+    const opened = token ? this.state.open("token", token, UCPTokenStateSchema) : void 0;
+    if (opened && opened.state.clientId === client.clientId) {
+      const remainingTtlSeconds = Math.max(1, Math.ceil((opened.expiresAt - Date.now()) / 1e3));
+      await this.state.revokeToken(token, remainingTtlSeconds);
+    }
+    return new Response(null, { status: 200 });
+  }
+  authenticateClient(request, form) {
+    const authorization = request.headers.get("authorization");
+    let clientId = readFormValue(form, "client_id");
+    let clientSecret = readFormValue(form, "client_secret");
+    if (authorization?.toLowerCase().startsWith("basic ")) {
+      const decoded = Buffer.from(authorization.slice("basic ".length), "base64").toString("utf-8");
+      const separatorIndex = decoded.indexOf(":");
+      if (separatorIndex >= 0) {
+        clientId = decodeURIComponent(decoded.slice(0, separatorIndex));
+        clientSecret = decodeURIComponent(decoded.slice(separatorIndex + 1));
+      }
+    }
+    const client = this.options.clients.find((candidate) => candidate.clientId === clientId);
+    if (!client) {
+      return void 0;
+    }
+    if (client.clientSecret) {
+      return clientSecret && secureEquals(clientSecret, client.clientSecret) ? client : void 0;
+    }
+    return client;
+  }
+}
+const CompleteAuthorizationBodySchema = z.object({
+  request_id: z.string(),
+  customer_id: z.string(),
+  session: SessionSchema
+});
+function readFormValue(form, key) {
+  const value = form?.get(key);
+  return typeof value === "string" ? value : "";
+}
+function verifyPkce(codeVerifier, codeChallenge) {
+  if (!codeVerifier) {
+    return false;
+  }
+  const computed = createHash("sha256").update(codeVerifier).digest("base64url");
+  return secureEquals(computed, codeChallenge);
+}
+function secureEquals(left, right) {
+  const leftDigest = createHash("sha256").update(left).digest();
+  const rightDigest = createHash("sha256").update(right).digest();
+  return timingSafeEqual(leftDigest, rightDigest);
+}
+function redirectResponse(location) {
+  return new Response(null, {
+    status: 302,
+    headers: { location }
+  });
+}
+function authorizeErrorRedirect(redirectUri, error, state, description) {
+  const url = new URL(redirectUri);
+  url.searchParams.set("error", error);
+  if (description) {
+    url.searchParams.set("error_description", description);
+  }
+  if (state !== void 0) {
+    url.searchParams.set("state", state);
+  }
+  return redirectResponse(url.toString());
+}
+function bearerChallengeResponse(status, error, description, scopes) {
+  const scopePart = scopes && scopes.length > 0 ? `, scope="${scopes.join(" ")}"` : "";
+  return jsonResponse(
+    { error, error_description: description },
+    {
+      status,
+      headers: {
+        "www-authenticate": `Bearer realm="ucp", error="${error}", error_description="${description}"${scopePart}`
+      }
+    }
+  );
+}
+function htmlResponse(body, status = 200) {
+  return new Response(`<!doctype html><html><body>${body}</body></html>`, {
+    status,
+    headers: { "content-type": "text/html; charset=utf-8" }
+  });
+}
+function renderDefaultConsentPage(context) {
+  const scopeList = context.scopes.length > 0 ? `<ul>${context.scopes.map((scope) => `<li>${escapeHtml(scope)}</li>`).join("")}</ul>` : "<p>No additional permissions requested.</p>";
+  return [
+    `<h1>Authorize ${escapeHtml(context.clientId)}</h1>`,
+    `<p>The agent <strong>${escapeHtml(context.clientId)}</strong> wants to act on your behalf with these permissions:</p>`,
+    scopeList,
+    `<form method="post" action="${escapeHtml(context.approveUrl)}">`,
+    `<input type="hidden" name="grant" value="${escapeHtml(context.grant)}">`,
+    '<button name="decision" value="approve" type="submit">Approve</button>',
+    '<button name="decision" value="deny" type="submit">Deny</button>',
+    "</form>"
+  ].join("\n");
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+export {
+  DEFAULT_UCP_IDENTITY_SCOPES,
+  ReactionaryUCPIdentity
+};

package/lib/reactionary-ucp-profile.js

@@ -12,8 +12,21 @@ function getRequestRoute(request, profile) {
     path: url.pathname
   };
 }
-function createUCPProfile(client, profile) {
+function createUCPProfile(client, profile, identityScopes) {
   const endpoint = profile?.endpoint ?? "http://localhost/ucp";
+  const capabilities = profile?.capabilities ?? createUcpCapabilities(client);
+  if (identityScopes) {
+    capabilities["dev.ucp.common.identity_linking"] = [
+      {
+        version: "2026-08-25",
+        spec: `${UCP_DOCS_BASE_URL}/specification/common/identity-linking/`,
+        schema: `${UCP_DOCS_BASE_URL}/schemas/common/identity_linking.json`,
+        config: {
+          scopes: identityScopes
+        }
+      }
+    ];
+  }
   return {
     ucp: {
       version: "2026-08-25",
@@ -28,7 +41,7 @@ function createUCPProfile(client, profile) {
           }
         ]
       },
-      capabilities: profile?.capabilities ?? createUcpCapabilities(client),
+      capabilities,
       ...profile?.paymentHandlers ? { payment_handlers: profile.paymentHandlers } : {}
     },
     keys: profile?.keys ?? [],

package/lib/reactionary-ucp-server.js

@@ -5,6 +5,7 @@ import {
 import {
 } from "./reactionary-ucp-common.js";
 import { getOrCreateSessionId, jsonResponse, sendWebResponse, toWebRequest, UCP_SESSION_ID_HEADER } from "./reactionary-ucp-http.js";
+import { ReactionaryUCPIdentity } from "./reactionary-ucp-identity.js";
 import { createUCPProfile, getRequestRoute } from "./reactionary-ucp-profile.js";
 import { handleRestRequest, UCPHttpError } from "./reactionary-ucp-rest.js";
 import { ReactionaryUCPSessionStore } from "./reactionary-ucp-session-store.js";
@@ -12,20 +13,36 @@ class ReactionaryUCPServer {
   constructor(clientFactory, options = {}) {
     this.clientFactory = clientFactory;
     this.options = options;
+    const cache = this.options.sessionCache ?? new MemoryCache();
     this.sessionStore = new ReactionaryUCPSessionStore(
-      this.options.sessionCache ?? new MemoryCache(),
+      cache,
       this.options.sessionTtlSeconds ?? 60 * 60 * 24
     );
+    if (this.options.identity) {
+      this.identity = new ReactionaryUCPIdentity(this.options.identity, cache);
+    }
   }
   clientFactory;
   options;
   sessionStore;
+  identity;
   async fetch(request) {
+    return this.handleFetch(request);
+  }
+  async handleFetch(request) {
     const sessionId = getOrCreateSessionId(request);
-    const requestContext = await this.createRequestContext(sessionId);
+    const bearerResolution = await this.identity?.resolveBearer(request);
+    if (bearerResolution instanceof Response) {
+      return bearerResolution;
+    }
+    const requestContext = await this.createRequestContext(sessionId, bearerResolution);
     const client = this.clientFactory(requestContext);
-    const response = await this.handleRequest(request, client, sessionId);
-    await this.sessionStore.put(sessionId, requestContext.session);
+    const response = await this.handleRequest(request, client, sessionId, bearerResolution);
+    if (bearerResolution) {
+      await this.identity?.persistBearerSession(bearerResolution, requestContext.session);
+    } else {
+      await this.sessionStore.put(sessionId, requestContext.session);
+    }
     response.headers.set(UCP_SESSION_ID_HEADER, sessionId);
     const requestId = request.headers.get("Request-Id");
     if (requestId) {
@@ -48,15 +65,19 @@ class ReactionaryUCPServer {
   close() {
     return Promise.resolve();
   }
-  async createRequestContext(sessionId) {
-    const restoredSession = await this.sessionStore.get(sessionId);
+  async createRequestContext(sessionId, bearerResolution) {
     const requestContext = createInitialRequestContext();
+    if (bearerResolution) {
+      requestContext.session = bearerResolution.session;
+      return requestContext;
+    }
+    const restoredSession = await this.sessionStore.get(sessionId);
     if (restoredSession) {
       requestContext.session = restoredSession;
     }
     return requestContext;
   }
-  async handleRequest(request, client, sessionId) {
+  async handleRequest(request, client, sessionId, bearerResolution) {
     const route = getRequestRoute(request, this.options.profile);
     if (request.method === "OPTIONS") {
       return new Response(null, {
@@ -67,7 +88,17 @@ class ReactionaryUCPServer {
       });
     }
     if (route.path === "/.well-known/ucp" && request.method === "GET") {
-      return jsonResponse(createUCPProfile(client, this.options.profile));
+      return jsonResponse(createUCPProfile(client, this.options.profile, this.identity?.getScopeNames()));
+    }
+    if (this.identity) {
+      const identityResponse = await this.identity.handleHttp(request, route.path);
+      if (identityResponse) {
+        return identityResponse;
+      }
+      const accessResponse = this.identity.checkAccess(request.method, route.path, bearerResolution);
+      if (accessResponse) {
+        return accessResponse;
+      }
     }
     try {
       const restResponse = await handleRestRequest(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reactionary/ucp",
-  "version": "0.10.33",
+  "version": "0.10.34",
   "type": "module",
   "main": "./index.js",
   "types": "./src/index.d.ts",
@@ -9,7 +9,7 @@
     "url": "git+https://github.com/Solteq/reactionary.git"
   },
   "dependencies": {
-    "@reactionary/core": "0.10.33",
+    "@reactionary/core": "0.10.34",
     "zod": "4.1.9"
   },
   "devDependencies": {

package/src/index.d.ts

@@ -1 +1,2 @@
 export * from './lib/reactionary-ucp-server.js';
+export * from './lib/reactionary-ucp-identity.js';

package/src/lib/reactionary-ucp-common.d.ts

@@ -1,6 +1,7 @@
 import type { Cache, Cart, Checkout, Client, FacetValueIdentifier, Order, Product, ProductSearchResult, RequestContext, Result } from '@reactionary/core';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { components } from './ucp-shopping.openapi.js';
+import type { ReactionaryUCPIdentityOptions } from './reactionary-ucp-identity.js';
 type UCPService = components['schemas']['base'];
 type UCPCapability = components['schemas']['$defs-base'];
 export type UCPPaymentHandler = components['schemas']['entity'] & {
@@ -57,6 +58,7 @@ export interface ReactionaryUCPServerOptions {
     sessionCache?: Cache;
     sessionTtlSeconds?: number;
     profile?: ReactionaryUCPProfileOptions;
+    identity?: ReactionaryUCPIdentityOptions;
 }
 export interface ReactionaryUCPProfileOptions {
     endpoint: string;

package/src/lib/reactionary-ucp-identity-state.d.ts

@@ -0,0 +1,136 @@
+import { type Cache } from '@reactionary/core';
+import * as z from 'zod';
+export declare const UCPAuthorizationRequestStateSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    redirectUri: z.ZodString;
+    scope: z.ZodString;
+    state: z.ZodOptional<z.ZodString>;
+    codeChallenge: z.ZodString;
+}, z.core.$loose>;
+export declare const UCPConsentStateSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    redirectUri: z.ZodString;
+    scope: z.ZodString;
+    state: z.ZodOptional<z.ZodString>;
+    codeChallenge: z.ZodString;
+    customerId: z.ZodString;
+    session: z.ZodObject<{
+        identityContext: z.ZodObject<{
+            identity: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"Anonymous">;
+            }, z.core.$loose>, z.ZodObject<{
+                id: z.ZodObject<{
+                    userId: z.ZodString;
+                }, z.core.$loose>;
+                type: z.ZodLiteral<"Guest">;
+            }, z.core.$loose>, z.ZodObject<{
+                id: z.ZodObject<{
+                    userId: z.ZodString;
+                }, z.core.$loose>;
+                type: z.ZodLiteral<"Registered">;
+            }, z.core.$loose>], "type">;
+            lastUpdated: z.ZodCoercedDate<unknown>;
+        }, z.core.$loose>;
+        marketingContext: z.ZodDefault<z.ZodObject<{
+            identifier: z.ZodObject<{
+                key: z.ZodString;
+            }, z.core.$loose>;
+            segments: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            blurb: z.ZodDefault<z.ZodString>;
+        }, z.core.$loose>>;
+    }, z.core.$loose>;
+}, z.core.$loose>;
+export declare const UCPAuthorizationCodeStateSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    redirectUri: z.ZodString;
+    scope: z.ZodString;
+    state: z.ZodOptional<z.ZodString>;
+    codeChallenge: z.ZodString;
+    customerId: z.ZodString;
+    session: z.ZodObject<{
+        identityContext: z.ZodObject<{
+            identity: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"Anonymous">;
+            }, z.core.$loose>, z.ZodObject<{
+                id: z.ZodObject<{
+                    userId: z.ZodString;
+                }, z.core.$loose>;
+                type: z.ZodLiteral<"Guest">;
+            }, z.core.$loose>, z.ZodObject<{
+                id: z.ZodObject<{
+                    userId: z.ZodString;
+                }, z.core.$loose>;
+                type: z.ZodLiteral<"Registered">;
+            }, z.core.$loose>], "type">;
+            lastUpdated: z.ZodCoercedDate<unknown>;
+        }, z.core.$loose>;
+        marketingContext: z.ZodDefault<z.ZodObject<{
+            identifier: z.ZodObject<{
+                key: z.ZodString;
+            }, z.core.$loose>;
+            segments: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            blurb: z.ZodDefault<z.ZodString>;
+        }, z.core.$loose>>;
+    }, z.core.$loose>;
+}, z.core.$loose>;
+export declare const UCPTokenStateSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        access: "access";
+        refresh: "refresh";
+    }>;
+    clientId: z.ZodString;
+    customerId: z.ZodString;
+    scope: z.ZodString;
+    session: z.ZodObject<{
+        identityContext: z.ZodObject<{
+            identity: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"Anonymous">;
+            }, z.core.$loose>, z.ZodObject<{
+                id: z.ZodObject<{
+                    userId: z.ZodString;
+                }, z.core.$loose>;
+                type: z.ZodLiteral<"Guest">;
+            }, z.core.$loose>, z.ZodObject<{
+                id: z.ZodObject<{
+                    userId: z.ZodString;
+                }, z.core.$loose>;
+                type: z.ZodLiteral<"Registered">;
+            }, z.core.$loose>], "type">;
+            lastUpdated: z.ZodCoercedDate<unknown>;
+        }, z.core.$loose>;
+        marketingContext: z.ZodDefault<z.ZodObject<{
+            identifier: z.ZodObject<{
+                key: z.ZodString;
+            }, z.core.$loose>;
+            segments: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            blurb: z.ZodDefault<z.ZodString>;
+        }, z.core.$loose>>;
+    }, z.core.$loose>;
+    refreshTokenHash: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type UCPAuthorizationRequestState = z.infer<typeof UCPAuthorizationRequestStateSchema>;
+export type UCPConsentState = z.infer<typeof UCPConsentStateSchema>;
+export type UCPAuthorizationCodeState = z.infer<typeof UCPAuthorizationCodeStateSchema>;
+export type UCPTokenState = z.infer<typeof UCPTokenStateSchema>;
+export type UCPSealedStateKind = 'authorization_request' | 'consent' | 'code' | 'token';
+export declare function hashIdentityToken(token: string): string;
+/**
+ * Seals identity state into self-contained AES-256-GCM blobs so no shared
+ * storage is required for correctness. The optional cache only enhances the
+ * flow: single-use enforcement, instant revocation, and session freshness.
+ */
+export declare class ReactionaryUCPIdentityState {
+    private readonly cache;
+    private readonly key;
+    constructor(stateSecret: string, cache: Cache | undefined);
+    seal(kind: UCPSealedStateKind, payload: unknown, ttlSeconds: number): string;
+    open<TState>(kind: UCPSealedStateKind, sealed: string, schema: z.ZodType<TState>): {
+        state: TState;
+        expiresAt: number;
+    } | undefined;
+    markUsed(sealed: string, ttlSeconds: number): Promise<boolean>;
+    revokeToken(token: string, ttlSeconds: number): Promise<void>;
+    isTokenRevoked(tokenHashes: string[]): Promise<boolean>;
+    putSessionOverlay(tokenHash: string, session: UCPTokenState['session'], ttlSeconds: number): Promise<void>;
+    getSessionOverlay(tokenHash: string): Promise<UCPTokenState['session'] | undefined>;
+}

package/src/lib/reactionary-ucp-identity.d.ts

@@ -0,0 +1,73 @@
+import { type Cache, type Session } from '@reactionary/core';
+export interface ReactionaryUCPIdentityClient {
+    clientId: string;
+    redirectUris: string[];
+    clientSecret?: string;
+}
+export interface ReactionaryUCPIdentityScope {
+    scope: string;
+    description?: string;
+    gates?: Array<{
+        method?: string;
+        pathPattern: RegExp;
+    }>;
+}
+export interface ReactionaryUCPIdentityConsentContext {
+    clientId: string;
+    customerId: string;
+    scopes: string[];
+    approveUrl: string;
+    grant: string;
+}
+export interface ReactionaryUCPIdentityOptions {
+    issuer: string;
+    loginUrl: string;
+    stateSecret: string;
+    clients: ReactionaryUCPIdentityClient[];
+    scopes?: ReactionaryUCPIdentityScope[];
+    baseUrl?: string;
+    internalApiKey?: string;
+    accessTokenTtlSeconds?: number;
+    refreshTokenTtlSeconds?: number;
+    renderConsentPage?: (context: ReactionaryUCPIdentityConsentContext) => string;
+}
+export interface UCPCompleteAuthorizationPayload {
+    requestId: string;
+    customerId: string;
+    session: Session;
+}
+export interface UCPBearerResolution {
+    tokenHash: string;
+    expiresAt: number;
+    scope: string;
+    session: Session;
+}
+export declare const DEFAULT_UCP_IDENTITY_SCOPES: ReactionaryUCPIdentityScope[];
+export declare class ReactionaryUCPIdentity {
+    private readonly options;
+    private readonly state;
+    private readonly scopes;
+    private readonly baseUrl;
+    private readonly accessTokenTtlSeconds;
+    private readonly refreshTokenTtlSeconds;
+    constructor(options: ReactionaryUCPIdentityOptions, cache?: Cache);
+    getScopeNames(): string[];
+    handleHttp(request: Request, path: string): Promise<Response | undefined>;
+    completeAuthorization(payload: UCPCompleteAuthorizationPayload): Promise<{
+        continueUrl: string;
+    }>;
+    resolveBearer(request: Request): Promise<UCPBearerResolution | Response | undefined>;
+    checkAccess(method: string, path: string, bearer: UCPBearerResolution | undefined): Response | undefined;
+    persistBearerSession(bearer: UCPBearerResolution, session: Session): Promise<void>;
+    private getMetadata;
+    private handleAuthorize;
+    private handleComplete;
+    private handleConsentPage;
+    private handleConsentDecision;
+    private handleToken;
+    private handleAuthorizationCodeGrant;
+    private handleRefreshTokenGrant;
+    private mintAccessToken;
+    private handleRevoke;
+    private authenticateClient;
+}

package/src/lib/reactionary-ucp-profile.d.ts

@@ -2,4 +2,4 @@ import type { ReactionaryUCPClient, ReactionaryUCPProfile, ReactionaryUCPProfile
 export declare function getRequestRoute(request: Request, profile: ReactionaryUCPProfileOptions | undefined): {
     path: string;
 };
-export declare function createUCPProfile(client: ReactionaryUCPClient, profile: ReactionaryUCPProfileOptions | undefined): ReactionaryUCPProfile;
+export declare function createUCPProfile(client: ReactionaryUCPClient, profile: ReactionaryUCPProfileOptions | undefined, identityScopes?: string[]): ReactionaryUCPProfile;

package/src/lib/reactionary-ucp-server.d.ts

@@ -1,11 +1,14 @@
 import { type ReactionaryUCPClient, type ReactionaryUCPClientFactory, type ReactionaryUCPHttpHandler, type ReactionaryUCPNodeRequestHandler, type ReactionaryUCPProfile, type ReactionaryUCPProfileOptions, type ReactionaryUCPServerOptions } from './reactionary-ucp-common.js';
+import { ReactionaryUCPIdentity } from './reactionary-ucp-identity.js';
 export type { ReactionaryUCPClient, ReactionaryUCPClientFactory, ReactionaryUCPHttpHandler, ReactionaryUCPNodeRequestHandler, ReactionaryUCPProfile, ReactionaryUCPProfileOptions, ReactionaryUCPServerOptions, };
 export declare class ReactionaryUCPServer<TClient extends ReactionaryUCPClient = ReactionaryUCPClient> {
     private readonly clientFactory;
     private readonly options;
     private readonly sessionStore;
+    readonly identity?: ReactionaryUCPIdentity;
     constructor(clientFactory: ReactionaryUCPClientFactory<TClient>, options?: ReactionaryUCPServerOptions);
     fetch(request: Request): Promise<Response>;
+    private handleFetch;
     getHandler(): ReactionaryUCPHttpHandler;
     toNodeHandler(): ReactionaryUCPNodeRequestHandler;
     close(): Promise<void>;