@kashscript/identity-core

Zero-dependency cryptographic primitives + did:kash DID Document formatter + Kash-Event sign/verify.

Pure deterministic logic — no network calls, no storage, no platform APIs. Runs in Node 20+, Bun, Deno, browsers, edge runtimes, and Web Workers.

bun add @kashscript/identity-core
# or
npm install @kashscript/identity-core

What's in the box

| Subpath | Purpose | |------------------------------------|---------------------------------------------------| | @kashscript/identity-core | Default export — re-exports everything below | | @kashscript/identity-core/keys | Ed25519 keypair generation + serialization | | @kashscript/identity-core/did | did:kash:<base58btc> formatting / parsing | | @kashscript/identity-core/document | W3C-compatible DID Document builder | | @kashscript/identity-core/canonical | RFC 8785 JSON Canonicalization (JCS) | | @kashscript/identity-core/signatures | Detached signatures over JCS bytes | | @kashscript/identity-core/signer | High-level KashSigner — sign + verify in one | | @kashscript/identity-core/base58 | base58btc encode/decode (no deps) | | @kashscript/identity-core/hex | hex encode/decode |

Quickstart

import { KashSigner } from "@kashscript/identity-core/signer";

// Generate a fresh identity
const signer = await KashSigner.generate();
console.log(signer.did);                          // did:kash:zQ3sh...

// Sign anything JSON-serialisable
const sig = await signer.sign({ msg: "hello", t: Date.now() });

// Verify on the other side
const ok = await KashSigner.verify(sig);          // true

The DID is derived deterministically from the public key — no registrar, no chain, no fee. The signature is computed over the RFC 8785 canonical JSON of the payload, so two semantically-equal objects always produce the same signature target.

Why a separate identity-core?

The Kash Identity Platform is split so that the trust-free core (this package) can be embedded anywhere — including environments where Web APIs, storage, or networking would be unsafe or unavailable. Higher layers (@kashscript/identity-sdk, @kashscript/identity-zkp) bring in WebAuthn, storage, ZK primitives.

• No window, no localStorage, no fetch here.
• No third-party dependencies. Audited line-by-line.
• Deterministic. Same inputs → same outputs, every time.

License

Apache-2.0. Also covered by SSLA v1.0 Schedule A (Permissive). See LICENSE.