@khoralabs/did-key-identity

Local did:key (Ed25519) identity files with optional on-disk encryption, plus a small hex-encoded signing adapter.

Generate, load, and save did:key signers as JSON. Writes are atomic with mode 0600. Encryption is optional — omit a secret for plaintext (CLI-friendly); pass a wrap key or passphrase to seal the private key with AES-256-GCM.

Install

npm install @khoralabs/did-key-identity

Requires Node 18+.

Usage

Plaintext (no password)

import { loadOrCreateIdentity, createHexSigner } from "@khoralabs/did-key-identity";

const signer = await loadOrCreateIdentity("./identity.json");
await signer.sign(new TextEncoder().encode("hello"));

const hexSigner = await createHexSigner(signer);

Wrap key (32-byte AES key — daemons / agents)

import { randomBytes } from "node:crypto";
import { loadOrCreateIdentity, WRAP_KEY_BYTES } from "@khoralabs/did-key-identity";

const secret = { type: "wrapKey" as const, key: new Uint8Array(randomBytes(WRAP_KEY_BYTES)) };
const signer = await loadOrCreateIdentity("./identity.json", { secret });

Passphrase (scrypt → AES-GCM)

import { loadOrCreateIdentity } from "@khoralabs/did-key-identity";

const secret = { type: "passphrase" as const, passphrase: "…" };
const signer = await loadOrCreateIdentity("./identity.json", { secret });

Blob helpers (SQLite / other stores)

import { randomBytes } from "node:crypto";
import {
  encryptIdentityBlob,
  decryptIdentityBlob,
  WRAP_KEY_BYTES,
} from "@khoralabs/did-key-identity";

const wrapKey = new Uint8Array(randomBytes(WRAP_KEY_BYTES));
const blob = encryptIdentityBlob({ did: signer.did, encoded: signer.export() }, wrapKey);
const identity = decryptIdentityBlob(blob, wrapKey);

defaultIdentityPath() resolves DID_KEY_IDENTITY_PATH, else ~/.did-key-identity/identity.json.

Development

bun install
bun test
bun run typecheck
bun run build

Publishing

Manual workflow: release @khoralabs/did-key-identity. Set version, prefer a dry run first. Requires the NPM_TOKEN repository secret. Build emits dist/ (NodeNext) for npm consumers.