# @ucanto/validator

> UCAN RPC validators

Latest version **10.0.1** (published 2025-10-24) · (Apache-2.0 AND MIT) license · 0 weekly downloads

## Install

```sh
npm install @ucanto/validator
pnpm add @ucanto/validator
yarn add @ucanto/validator
bun add @ucanto/validator
```

## Health

**Score 60/100 (C)** — status: stable.

Positive: has types; esm support; no vulnerabilities; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 10.0.1 |
| Published | 2025-10-24 |
| First published | 2022-06-20 |
| Weekly downloads | 0 |
| License | (Apache-2.0 AND MIT) |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 5 |
| Unpacked size | 74.2 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 62 |
| Maintainers | gozala, it-dag-house, hugomrdias |
| Keywords | UCAN, ed25519, did, issuer, audience |

## Links

- npm: https://www.npmjs.com/package/@ucanto/validator
- Repository: https://github.com/storacha/ucanto
- Issues: https://github.com/storacha/ucanto/issues
- npm.io page: https://npm.io/package/@ucanto/validator

## Dependencies (5)

- [@ipld/car](https://npm.io/package/@ipld/car.md) ^5.4.0
- [@ucanto/core](https://npm.io/package/@ucanto/core.md) ^10.4.5
- [multiformats](https://npm.io/package/multiformats.md) ^13.3.1
- [@ipld/dag-cbor](https://npm.io/package/@ipld/dag-cbor.md) ^9.2.2
- [@ucanto/interface](https://npm.io/package/@ucanto/interface.md) ^11.0.1

## Alternatives

- [@sindresorhus/slugify](https://npm.io/package/@sindresorhus/slugify.md) — 3.7M weekly downloads
- [solid-js](https://npm.io/package/solid-js.md) — 2.7M weekly downloads
- [expo-glass-effect](https://npm.io/package/expo-glass-effect.md) — 2.5M weekly downloads
- [nanoassert](https://npm.io/package/nanoassert.md) — 780.8K weekly downloads
- [@ffmpeg/ffmpeg](https://npm.io/package/@ffmpeg/ffmpeg.md) — 529.5K weekly downloads

## Recent versions

- 10.0.1 (latest) — 2025-10-24
- 10.0.0 — 2025-06-02
- 9.1.0 — 2025-02-13
- 9.0.3 — 2025-01-22
- 9.0.2 — 2024-04-04
- 9.0.1 — 2023-11-16
- 9.0.0 — 2023-10-05
- 8.0.0 — 2023-05-22
- 7.0.0 — 2023-04-11
- 0.7.0 — 2023-04-11
- 6.1.0 — 2023-03-14
- 6.0.0 — 2023-03-07
- 5.0.0 — 2023-03-01
- 4.4.0 — 2023-02-28
- 4.3.4 — 2023-02-28
- … 24 more at https://npm.io/package/@ucanto/validator/versions

## README

# @ucanto/validator

`@ucanto/validator` provides validation mechanisms for UCAN-based capabilities, ensuring that invocations comply with defined rules and security policies.

## What It Provides
- **Capability Validation**: Ensures UCANs are properly formatted and authorized.
- **Invocation Verification**: Checks that invocations conform to defined constraints.
- **Security Enforcement**: Applies validation policies to prevent unauthorized actions.

## How It Fits with Other Modules
- [`@ucanto/core`](../core/README.md): Uses validation mechanisms to enforce capability constraints.
- [`@ucanto/server`](../server/README.md): Ensures only valid UCANs are processed by services.
- [`@ucanto/interface`](../interface/README.md): Defines standard validation-related types.
- [`@ucanto/principal`](../principal/README.md): Verifies cryptographic signatures for UCAN validation.

For an overview and detailed usage information, refer to the [main `ucanto` README](../../Readme.md).

## Installation
```sh
npm install @ucanto/validator
```

## Example Usage
```ts
import { access, DID, capability, fail, Link, Schema } from '@ucanto/validator'
import { Verifier, ed25519 } from '@ucanto/principal'

// Sample identities
const alice = await ed25519.generate()
const bob = await ed25519.generate()

// Define a known capability
const storeAdd = capability({
  can: 'store/add',
  with: DID,
  nb: Schema.struct({
    link: Link,
    size: Schema.integer().optional(),
  }),
  derives: (claim, proof) => {
    if (claim.with !== proof.with) {
      return fail('with field does not match')
    }
    return { ok: {} }
  }
})

// Alice delegates the capability to Bob
const proof = await storeAdd.delegate({
  issuer: alice,
  audience: bob,
  capabilities: [
    {
      with: alice.did(),
      can: 'store/add',
      nb: {
        link: Link.parse('bafkqaaa')
      }
    }
  ]
})

// Bob tries to invoke the capability
const invocation = storeAdd.invoke({
  issuer: bob,
  audience: alice,
  with: alice.did(),
  nb: {
    link: Link.parse('bafkqaaa')
  },
  proofs: [proof]
})

// Validate the invocation
const result = await access(await invocation.delegate(), {
  authority: alice,
  capability: storeAdd,
  principal: Verifier,
  validateAuthorization: () => ({ ok: {} }),
})

// Check result: ensure the capability is known and valid
if (result.error) {
  console.error('Capability validation failed:', result.error)
} else {
  console.log('Capability is known and valid!')
}
```

For more details, see the [`ucanto` documentation](https://github.com/storacha/ucanto).

---
_Source: https://npm.io/package/@ucanto/validator · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._