iso-ucan 0.0.1

package/dist/src/utils.d.ts

@@ -0,0 +1,136 @@
+/**
+ * @import {PayloadSpec} from './types.js'
+ */
+/**
+ * Create the signature payload for a given envelope
+ *
+ * @param {import('./types.js').DecodedEnvelope<PayloadSpec>} envelope
+ * @returns
+ */
+export function signaturePayload(envelope: import("./types.js").DecodedEnvelope<PayloadSpec>): {
+    [x: string]: Uint8Array<ArrayBuffer> | import("./types.js").DelegationPayload<unknown> | import("./types.js").InvocationPayload;
+    h: Uint8Array<ArrayBuffer>;
+};
+export function nowInSeconds(): number;
+/**
+ *
+ * @param {import('./types.js').DecodedEnvelope<PayloadSpec>} envelope
+ */
+export function cid(envelope: import("./types.js").DecodedEnvelope<PayloadSpec>): Promise<CID<any, 113, 18, 1>>;
+/**
+ * Check if a DID and signature type are compatible
+ *
+ * @param {import('iso-did/types').VerifiableDID} did
+ * @param {import('iso-signatures/types').SignatureType} sigType
+ */
+export function isSigAndDidCompatible(did: import("iso-did/types").VerifiableDID, sigType: import("iso-signatures/types").SignatureType): boolean;
+/**
+ * Validate the expiration of a UCAN
+ *
+ * @param {number | null} exp
+ */
+export function assertExpiration(exp: number | null): void;
+/**
+ * Validate the not before time of a UCAN
+ *
+ * @param {number} [nbf]
+ */
+export function assertNotBefore(nbf?: number): void;
+/**
+ * Validate the issuer and signature of a UCAN
+ *
+ * @param {import('./types.js').DecodedEnvelope<PayloadSpec>} envelope
+ * @param {import('iso-did').Resolver} [didResolver]
+ */
+export function validateIssuerAndSignature(envelope: import("./types.js").DecodedEnvelope<PayloadSpec>, didResolver?: import("iso-did").Resolver): Promise<DID>;
+/**
+ * Verify the signature of a UCAN and that issuer is compatible with the signature
+ *
+ * @param {import('./types.js').DecodedEnvelope<PayloadSpec>} envelope
+ * @param {import('iso-signatures/verifiers/resolver.js').Resolver} signatureVerifierResolver
+ * @param {import('iso-did').Resolver} [didResolver]
+ */
+export function verifySignature(envelope: import("./types.js").DecodedEnvelope<PayloadSpec>, signatureVerifierResolver: import("iso-signatures/verifiers/resolver.js").Resolver, didResolver?: import("iso-did").Resolver): Promise<boolean>;
+/**
+ * Asserts that a UCAN command string is syntactically valid.
+ * If the command is invalid, it throws a descriptive error.
+ *
+ * Rules:
+ * - Commands MUST begin with a slash (/).
+ * - Commands MUST be lowercase.
+ * - A trailing slash MUST NOT be present, unless the command is exactly "/".
+ * - Segments MUST be separated by a slash (e.g., no empty segments like "//").
+ *
+ * @param {string} command The command string to validate.
+ * @throws {Error} If the command is syntactically invalid.
+ * @returns {void} Does not return a value on success.
+ */
+export function assertIsValidCommand(command: string): void;
+/**
+ * Assert that the input is a Uint8Array.
+ *
+ * @param {unknown} nonce The value to check.
+ * @throws {Error} If nonce is not a Uint8Array.
+ * @returns {void}
+ *
+ * @example
+ * ```ts twoslash
+ * import { assertNonce } from 'iso-ucan/utils'
+ * assertNonce(new Uint8Array([1,2,3])) // ok
+ * assertNonce('foo') // throws
+ * ```
+ */
+export function assertNonce(nonce: unknown): void;
+/**
+ * Assert that args is a JSON serializable object.
+ *
+ * @param {unknown} args
+ */
+export function assertArgs(args: unknown): void;
+/**
+ * Assert that the input is a Record<PropertyKey, unknown>.
+ *
+ * @param {unknown} meta - The value to check.
+ * @throws {Error} If meta is not a Record<PropertyKey, unknown>.
+ * @returns {void}
+ */
+export function assertMeta(meta: unknown): void;
+/**
+ * Assert that the input is not revoked.
+ *
+ * @param {import('multiformats/cid').CID} cid
+ * @param {(cid: CID) => Promise<boolean>} [isRevokedFn]
+ */
+export function assertNotRevoked(cid: import("multiformats/cid").CID, isRevokedFn?: (cid: CID) => Promise<boolean>): Promise<void>;
+/**
+ * Expiration or TTL (default 300 seconds)
+ *
+ * @param {object} options
+ * @param {number | null} [options.exp]
+ * @param {number} [options.ttl]
+ */
+export function expOrTtl({ exp, ttl }: {
+    exp?: number | null | undefined;
+    ttl?: number | undefined;
+}): number | null;
+/**
+ * @param {unknown} policy
+ */
+export function assertPolicy(policy: unknown): void;
+export const cborValue: z.ZodLazy<z.ZodType<import("./types.js").CborValue, any, z.core.$ZodTypeInternals<import("./types.js").CborValue, any>>>;
+export const cborObject: z.ZodRecord<z.ZodString, z.ZodLazy<z.ZodType<import("./types.js").CborValue, any, z.core.$ZodTypeInternals<import("./types.js").CborValue, any>>>>;
+export const selector: z.ZodUnion<readonly [z.ZodLiteral<".">, z.ZodTemplateLiteral<`.${string}`>]>;
+/**
+ * @typedef {z.infer<typeof selector>} Selector
+ */
+/**
+ * Statement
+ */
+export const statement: z.ZodLazy<z.ZodType<import("./types.js").Statement<unknown>, any, z.core.$ZodTypeInternals<import("./types.js").Statement<unknown>, any>>>;
+export const policySchema: z.ZodArray<z.ZodLazy<z.ZodType<import("./types.js").Statement<unknown>, any, z.core.$ZodTypeInternals<import("./types.js").Statement<unknown>, any>>>>;
+export type Selector = z.infer<typeof selector>;
+import type { PayloadSpec } from './types.js';
+import { CID } from 'multiformats/cid';
+import { DID } from 'iso-did';
+import { z } from 'zod';
+//# sourceMappingURL=utils.d.ts.map

package/dist/src/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/utils.js"],"names":[],"mappings":"AASA;;GAEG;AAEH;;;;;GAKG;AACH,2CAHW,OAAO,YAAY,EAAE,eAAe,CAAC,WAAW,CAAC;;;EAe3D;AAED,uCAEC;AAED;;;GAGG;AACH,8BAFW,OAAO,YAAY,EAAE,eAAe,CAAC,WAAW,CAAC,iCAW3D;AAED;;;;;GAKG;AACH,2CAHW,OAAO,eAAe,EAAE,aAAa,WACrC,OAAO,sBAAsB,EAAE,aAAa,WA+BtD;AAED;;;;GAIG;AACH,sCAFW,MAAM,GAAG,IAAI,QAgBvB;AAED;;;;GAIG;AACH,sCAFW,MAAM,QAMhB;AAED;;;;;GAKG;AACH,qDAHW,OAAO,YAAY,EAAE,eAAe,CAAC,WAAW,CAAC,gBACjD,OAAO,SAAS,EAAE,QAAQ,gBAWpC;AAED;;;;;;GAMG;AACH,0CAJW,OAAO,YAAY,EAAE,eAAe,CAAC,WAAW,CAAC,6BACjD,OAAO,sCAAsC,EAAE,QAAQ,gBACvD,OAAO,SAAS,EAAE,QAAQ,oBAoBpC;AAED;;;;;;;;;;;;;GAaG;AACH,8CAJW,MAAM,GAEJ,IAAI,CAuChB;AAED;;;;;;;;;;;;;GAaG;AACH,mCAXW,OAAO,GAEL,IAAI,CAehB;AACD;;;;GAIG;AACH,iCAFW,OAAO,QASjB;AAED;;;;;;GAMG;AACH,iCAJW,OAAO,GAEL,IAAI,CAWhB;AAED;;;;;GAKG;AACH,sCAHW,OAAO,kBAAkB,EAAE,GAAG,gBAC9B,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,iBAQxC;AAED;;;;;;GAMG;AACH,uCAHG;IAAgC,GAAG;IACV,GAAG;CAAC,iBAU/B;AAgED;;GAEG;AACH,qCAFW,OAAO,QASjB;AAxED,iJAeI;AACJ,4KAAyD;AAEzD,oGAGE;AAEF;;GAEG;AAEH;;GAEG;AACH,mKA4BI;AAEJ,kLAA8C;uBApCjC,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC;iCA5TP,YAAY;oBARtB,kBAAkB;oBADlB,SAAS;kBAGX,KAAK"}

package/dist/src/varsig.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @param {import('./types.js').VarsigOptions} options
+ */
+export function encode(options: import("./types.js").VarsigOptions): Uint8Array<ArrayBuffer>;
+/**
+/**
+ * Decode varsig header
+ *
+ * @param {Uint8Array} buf
+ * @returns {import('./types.js').DecodeOutput}
+ */
+export function decode(buf: Uint8Array): import("./types.js").DecodeOutput;
+export const VARSIG: 52;
+export const VERSION: 1;
+export const EIP191_ENCODING: 57745;
+/**
+ * @type {Record<number, import('./types.js').VarsigEncoding>}
+ */
+export const CODE_ENCODING: Record<number, import("./types.js").VarsigEncoding>;
+/**
+ * @type {Record<number, string>}
+ */
+export const SIG_PREFIX: Record<number, string>;
+//# sourceMappingURL=varsig.d.ts.map

package/dist/src/varsig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"varsig.d.ts","sourceRoot":"","sources":["../../src/varsig.js"],"names":[],"mappings":"AAuDA;;GAEG;AACH,gCAFW,OAAO,YAAY,EAAE,aAAa,2BAc5C;AA2BD;;;;;;GAMG;AACH,4BAHW,UAAU,GACR,OAAO,YAAY,EAAE,YAAY,CAsD7C;AAvJD,qBAAsB,EAAI,CAAA;AAC1B,sBAAuB,CAAI,CAAA;AAC3B,8BAA+B,KAAM,CAAA;AAErC;;GAEG;AACH,4BAFU,MAAM,CAAC,MAAM,EAAE,OAAO,YAAY,EAAE,cAAc,CAAC,CAK5D;AAED;;GAEG;AACH,yBAFU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM9B"}

package/package.json

@@ -0,0 +1,140 @@
+{
+  "name": "iso-ucan",
+  "type": "module",
+  "version": "0.0.1",
+  "description": "Isomorphic UCAN",
+  "author": "Hugo Dias <hugomrdias@gmail.com> (hugodias.me)",
+  "license": "MIT",
+  "repository": {
+    "url": "hugomrdias/iso-repo",
+    "directory": "packages/iso-ucan"
+  },
+  "keywords": [
+    "ucan",
+    "varsig",
+    "crypto",
+    "isomorphic"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./src/index.js"
+    },
+    "./capability": {
+      "types": "./dist/src/capability.d.ts",
+      "default": "./src/capability.js"
+    },
+    "./delegation": {
+      "types": "./dist/src/delegation.d.ts",
+      "default": "./src/delegation.js"
+    },
+    "./invocation": {
+      "types": "./dist/src/invocation.d.ts",
+      "default": "./src/invocation.js"
+    },
+    "./envelope": {
+      "types": "./dist/src/envelope.d.ts",
+      "default": "./src/envelope.js"
+    },
+    "./store": {
+      "types": "./dist/src/store.d.ts",
+      "default": "./src/store.js"
+    },
+    "./varsig": {
+      "types": "./dist/src/varsig.d.ts",
+      "default": "./src/varsig.js"
+    },
+    "./server": {
+      "types": "./dist/src/server.d.ts",
+      "default": "./src/server.js"
+    },
+    "./policy": {
+      "types": "./dist/src/policy.d.ts",
+      "default": "./src/policy.js"
+    },
+    "./client": {
+      "types": "./dist/src/client.d.ts",
+      "default": "./src/client.js"
+    },
+    "./types": {
+      "types": "./dist/src/types.d.ts"
+    }
+  },
+  "main": "src/index.js",
+  "types": "dist/src/index.d.ts",
+  "typesVersions": {
+    "*": {
+      "capability": [
+        "dist/src/capability"
+      ],
+      "delegation": [
+        "dist/src/delegation"
+      ],
+      "varsig": [
+        "dist/src/varsig"
+      ],
+      "invocation": [
+        "dist/src/invocation"
+      ],
+      "envelope": [
+        "dist/src/envelope"
+      ],
+      "store": [
+        "dist/src/store"
+      ],
+      "server": [
+        "dist/src/server"
+      ],
+      "policy": [
+        "dist/src/policy"
+      ],
+      "client": [
+        "dist/src/client"
+      ],
+      "types": [
+        "dist/src/types"
+      ]
+    }
+  },
+  "files": [
+    "src",
+    "dist/src/*.d.ts",
+    "dist/src/*.d.ts.map"
+  ],
+  "dependencies": {
+    "@ipld/dag-cbor": "^9.2.4",
+    "@standard-schema/spec": "^1.0.0",
+    "@standard-schema/utils": "^0.3.0",
+    "iobuffer": "^6.0.0",
+    "iso-kv": "^3.0.3",
+    "iso-web": "^1.1.1",
+    "it-merge": "^3.0.12",
+    "multiformats": "^13.3.7",
+    "iso-base": "^4.0.2",
+    "iso-did": "^1.8.0",
+    "iso-signatures": "^0.3.2"
+  },
+  "devDependencies": {
+    "@types/node": "^24.1.0",
+    "playwright-test": "^14.1.11",
+    "typescript": "5.8.3",
+    "zod": "^4.0.5"
+  },
+  "publishConfig": {
+    "provenance": true
+  },
+  "depcheck": {
+    "specials": [
+      "bin"
+    ],
+    "ignores": [
+      "@types/*"
+    ]
+  },
+  "scripts": {
+    "lint": "tsc --build && biome check --no-errors-on-unmatched --files-ignore-unknown=true .",
+    "test": "tsc --build && pnpm run test:node && pnpm run test:browser",
+    "test:node": "playwright-test 'test/**/!(*.browser).test.{js,ts}' --mode node",
+    "test:browser": "playwright-test 'test/**/!(*.node).test.{js,ts}'"
+  }
+}

package/readme.md

@@ -0,0 +1,81 @@
+# iso-ucan [![NPM Version](https://img.shields.io/npm/v/iso-ucan.svg)](https://www.npmjs.com/package/iso-ucan) [![License](https://img.shields.io/npm/l/iso-ucan.svg)](https://github.com/hugomrdias/iso-repo/blob/main/license) [![iso-ucan](https://github.com/hugomrdias/iso-repo/actions/workflows/iso-ucan.yml/badge.svg)](https://github.com/hugomrdias/iso-repo/actions/workflows/iso-ucan.yml)
+
+> Isomorphic UCAN
+
+## Install
+
+```bash
+pnpm install iso-ucan
+```
+
+## Usage
+
+```ts
+import { Capability } from 'iso-ucan/capability'
+import { Store } from 'iso-ucan/store'
+import { MemoryDriver } from 'iso-kv/drivers/memory'
+import { EdDSASigner } from 'iso-signatures/signers/eddsa.js'
+import { z } from 'zod'
+
+const store = new Store(new MemoryDriver())
+
+const AccountCreateCap = Capability.from({
+  schema: z.object({
+    type: z.string(),
+    properties: z
+      .object({
+        name: z.string(),
+      })
+      .strict(),
+  }),
+  cmd: '/account/create',
+})
+
+const AccountCap = Capability.from({
+  schema: z.never(),
+  cmd: '/account',
+})
+
+const owner = await EdDSASigner.generate()
+const bob = await EdDSASigner.generate()
+const invoker = await EdDSASigner.generate()
+
+const nowInSeconds = Math.floor(Date.now() / 1000)
+
+const ownerDelegation = await AccountCap.delegate({
+iss: owner,
+aud: bob,
+sub: owner,
+pol: [],
+exp: nowInSeconds + 1000,
+})
+
+await store.set(ownerDelegation)
+
+const bobDelegation = await AccountCap.delegate({
+iss: bob,
+aud: invoker,
+sub: owner,
+pol: [],
+exp: nowInSeconds + 1000,
+})
+
+await store.set(bobDelegation)
+
+const invocation = await AccountCreateCap.invoke({
+iss: invoker,
+sub: owner,
+args: {
+    type: 'account',
+    properties: {
+    name: 'John Doe',
+    },
+},
+store,
+exp: nowInSeconds + 1000,
+})
+```
+
+## License
+
+MIT © [Hugo Dias](http://hugodias.me)

package/src/capability.js

@@ -0,0 +1,77 @@
+import { SchemaError } from '@standard-schema/utils'
+import { Delegation } from './delegation.js'
+import { Invocation } from './invocation.js'
+
+/**
+ * @import {StandardSchemaV1} from '@standard-schema/spec'
+ */
+
+/**
+ * @template {StandardSchemaV1} Schema
+ * @template {string} [Cmd=string]
+ * @typedef {Object} CapabilityOptions
+ * @prop {Schema} schema
+ * @prop {Cmd} cmd
+ */
+
+/**
+ * @template {StandardSchemaV1} Schema
+ * @template {string} [Cmd=string]
+ */
+export class Capability {
+  /**
+   * @param {CapabilityOptions<Schema, Cmd>} options
+   */
+  constructor(options) {
+    this.schema = options.schema
+    this.cmd = options.cmd
+  }
+
+  /**
+   * @template {StandardSchemaV1} Schema
+   * @template {string} [Cmd=string]
+   * @param {CapabilityOptions<Schema, Cmd>} options
+   */
+  static from(options) {
+    return new Capability(options)
+  }
+
+  /**
+   * @param {StandardSchemaV1.InferInput<Schema>} args
+   */
+  async validate(args) {
+    const result = await this.schema['~standard'].validate(args)
+    return result
+  }
+
+  /**
+   * @param {import("./types.js").CapabilityInvokeOptions<Schema>} options
+   */
+  async invoke(options) {
+    const result = await this.schema['~standard'].validate(options.args)
+    if (result.issues) {
+      throw new SchemaError(result.issues)
+    }
+
+    const proofs = await options.store.chain({
+      cmd: this.cmd,
+      sub: options.sub,
+      aud: options.iss.did,
+    })
+
+    return await Invocation.create({
+      ...options,
+      args: result.value,
+      cmd: this.cmd,
+      prf: proofs,
+    })
+  }
+
+  /**
+   *
+   * @param {import("./types.js").CapabilityDelegateOptions} options
+   */
+  delegate(options) {
+    return Delegation.create({ ...options, cmd: this.cmd })
+  }
+}

package/src/client.js

@@ -0,0 +1,52 @@
+/**
+ * @import {InferProtocol, RouteOutput, StandardSchemaV1, ClientOptions, RouterClient} from './types'
+ * @import {Capability} from './capability'
+ */
+
+/**
+ * Workaround to make imports types work
+ * @template {{ cmd: string; in: unknown; out: unknown; }} T
+ * @typedef {Object} DELETE_ME
+ * @prop {string} url
+ * @prop {Capability<StandardSchemaV1, string>[]} capabilities
+ * @prop {InferProtocol<Record<string, RouteOutput<Capability<StandardSchemaV1>, unknown>>>} router
+ * @prop {ClientOptions} options
+ * @prop {RouterClient<T>} routerClient
+ */
+
+/**
+ * @template {InferProtocol<Record<string, RouteOutput<Capability<StandardSchemaV1>, unknown>>>} T
+ * @param {ClientOptions} options
+ * @returns {RouterClient<T>}
+ */
+export function createClient(options) {
+  const { url, capabilities } = options
+
+  // Create a map of capabilities by their `cmd` property
+  const capabilityMap = Object.fromEntries(
+    capabilities.map((cap) => [cap.cmd, cap])
+  )
+  return {
+    request: async (/** @type {string} */ cmd, /** @type {any} */ args) => {
+      const capability = capabilityMap[cmd]
+
+      if (!capability) {
+        throw new Error(`Capability not found: ${cmd}`)
+      }
+
+      const inv = await capability.invoke({
+        args,
+        iss: options.issuer,
+        sub: options.audience.did,
+        store: options.store,
+        exp: null,
+      })
+
+      const response = await fetch(url, {
+        method: 'POST',
+        body: inv.bytes,
+      })
+      return response.json()
+    },
+  }
+}

package/src/delegation.js

@@ -0,0 +1,183 @@
+import { base64pad } from 'iso-base/rfc4648'
+import { parse as didParse } from 'iso-did'
+import { randomBytes } from 'iso-web/crypto'
+import * as Envelope from './envelope.js'
+import {
+  assertExpiration,
+  assertIsValidCommand,
+  assertMeta,
+  assertNonce,
+  assertNotBefore,
+  assertNotRevoked,
+  cid,
+  expOrTtl,
+  verifySignature,
+} from './utils.js'
+
+/**
+ * @import {DelegationValidateOptions, Policy, DelegationOptions, DelegationPayload, DID, DIDURL} from './types.js'
+ * @import {CID} from 'multiformats'
+ */
+
+/**
+ * UCAN Delegation
+ */
+export class Delegation {
+  /** @type {DIDURL} */
+  iss
+  /** @type {DID} */
+  aud
+  /** @type {DID | null} */
+  sub
+  /** @type {string} */
+  cmd
+  /** @type {Policy} */
+  pol
+  /** @type {number | undefined} */
+  nbf
+  /** @type {Uint8Array} */
+  nonce
+  /** @type {Record<string, unknown> | undefined} */
+  meta
+  /** @type {number | null} */
+  exp
+
+  /**
+   *
+   * @param {import("./types.js").DecodedEnvelope<'dlg'>} envelope
+   * @param {Uint8Array} bytes
+   * @param {CID} cid
+   */
+  constructor(envelope, bytes, cid) {
+    this.envelope = envelope
+    this.bytes = bytes
+    this.cid = cid
+
+    this.iss = envelope.payload.iss
+    this.aud = envelope.payload.aud
+    this.sub = envelope.payload.sub ? envelope.payload.sub : null
+    this.cmd = envelope.payload.cmd
+    this.pol = envelope.payload.pol
+    this.exp = envelope.payload.exp
+    this.nbf = envelope.payload.nbf
+    this.nonce = envelope.payload.nonce
+    this.meta = envelope.payload.meta
+  }
+
+  /**
+   *
+   * @param {import("./types.js").DelegationFromOptions} options
+   */
+  static async from(options) {
+    const { bytes, didResolver: didResolveOptions, verifierResolver } = options
+
+    const envelope = /** @type {typeof Envelope.decode<"dlg">} */ (
+      Envelope.decode
+    )({ envelope: bytes })
+
+    if (envelope.spec !== 'dlg') {
+      throw new Error(
+        `Invalid envelope type. Expected: Delegation but got: ${envelope.spec}`
+      )
+    }
+
+    assertStructure(envelope.payload)
+
+    await verifySignature(envelope, verifierResolver, didResolveOptions)
+
+    const _cid = await cid(envelope)
+    await assertNotRevoked(_cid, options.isRevoked)
+
+    return new Delegation(envelope, bytes, _cid)
+  }
+
+  /**
+   *
+   * @param {DelegationOptions & { cmd: string }} options
+   */
+  static async create(options) {
+    const nonce = options.nonce || randomBytes(12)
+
+    /** @type {DelegationPayload} */
+    const payload = {
+      iss: options.iss.toString(),
+      aud: options.aud,
+      sub: options.sub ? options.sub : null,
+      pol: options.pol,
+      cmd: options.cmd,
+      nonce,
+      exp: expOrTtl(options),
+    }
+
+    if (options.nbf) {
+      payload.nbf = options.nbf
+    }
+
+    if (options.meta) {
+      payload.meta = options.meta
+    }
+
+    assertStructure(payload)
+
+    const { signature, signaturePayload } = await Envelope.sign({
+      spec: 'dlg',
+      signer: options.iss,
+      payload,
+    })
+
+    const bytes = Envelope.encode({ signature, signaturePayload })
+
+    /** @type {import("./types.js").DecodedEnvelope<'dlg'>} */
+    const envelope = {
+      alg: options.iss.signatureType,
+      enc: 'DAG-CBOR',
+      signature,
+      payload,
+      spec: 'dlg',
+      version: Envelope.VERSION,
+    }
+
+    return new Delegation(envelope, bytes, await cid(envelope))
+  }
+
+  /**
+   * @param {DelegationValidateOptions} options
+   */
+  async validate(options) {
+    assertStructure(this.envelope.payload)
+    assertNotBefore(this.envelope.payload.nbf)
+    await verifySignature(
+      this.envelope,
+      options.verifierResolver,
+      options.didResolver
+    )
+    await assertNotRevoked(this.cid, options.isRevoked)
+
+    return true
+  }
+
+  toString() {
+    return base64pad.encode(this.bytes)
+  }
+}
+
+/**
+ *
+ * @param {import('./types.js').DelegationPayload} payload
+ */
+function assertStructure(payload) {
+  didParse(payload.iss)
+  didParse(payload.aud)
+
+  if (payload.sub !== null) {
+    didParse(payload.sub)
+  }
+
+  assertIsValidCommand(payload.cmd)
+  assertExpiration(payload.exp)
+  assertNonce(payload.nonce)
+
+  // assertPolicy(payload.pol)
+
+  assertMeta(payload.meta)
+}