@kashscript/identity-core

Zero-dependency cryptographic primitives + did:kash DID Document formatter + Kash-Event sign/verify.

Pure deterministic logic — no network calls, no storage, no platform APIs. Runs in Node 20+, Bun, Deno, browsers, edge runtimes, and Web Workers.

bun add @kashscript/identity-core
# or
npm install @kashscript/identity-core

What's in the box

| Subpath | Purpose | |------------------------------------|---------------------------------------------------| | @kashscript/identity-core | Default export — re-exports everything below | | @kashscript/identity-core/keys | Ed25519 keypair generation + serialization | | @kashscript/identity-core/did | did:kash:<base58btc> formatting / parsing | | @kashscript/identity-core/document | W3C-compatible DID Document builder | | @kashscript/identity-core/canonical | RFC 8785 JSON Canonicalization (JCS) | | @kashscript/identity-core/signatures | Detached signatures over JCS bytes | | @kashscript/identity-core/signer | High-level Signer — keypair + DID + sign/verify | | @kashscript/identity-core/base58 | base58btc encode/decode (no deps) | | @kashscript/identity-core/base64url | base64url encode/decode | | @kashscript/identity-core/hex | hex encode/decode | | @kashscript/identity-core/errors | KashCryptoError + stable KashCryptoErrorCode | | @kashscript/identity-core/types | DID/document types + resolver/registrar/PDS SPIs | | @kashscript/identity-core/license | Runtime license-token verifier (subpath only) |

Quickstart

import { Signer } from "@kashscript/identity-core/signer";

// Generate a fresh identity — no registrar, no chain, no fee.
const signer = await Signer.generate();
console.log(signer.did);                          // did:kash:z6Mk...

// Sign a Kash-Event: sign(header, body). `kid` defaults to `${signer.did}#sig-1`.
const header = { did: signer.did, lexicon: "[email protected]", iat: new Date().toISOString() };
const body = { msg: "hello", n: 42 };
const signature = await signer.sign(header, body);
const event = { header, body, signature };

// Verify on the other side (instance method, takes the whole event).
const ok = await signer.verify(event);            // true

The DID is derived deterministically from the public key — no registrar, no chain, no fee. The signature is computed over the RFC 8785 canonical JSON of { header, body } (with a domain-separation tag), so two semantically-equal events always produce the same signature target.

Why a separate identity-core?

The Kash Identity Platform is split so that the trust-free core (this package) can be embedded anywhere — including environments where Web APIs, storage, or networking would be unsafe or unavailable. Higher layers (@kashscript/identity-sdk, @kashscript/identity-zkp) bring in WebAuthn, storage, ZK primitives.

• No window, no localStorage, no fetch here.
• No third-party dependencies. Audited line-by-line.
• Deterministic. Same inputs → same outputs, every time.

License

Apache-2.0. Also covered by SSLA v1.0 Schedule A (Permissive). See LICENSE.