Agent Secrets Vault

// Minimal Passport signing + Vault get (Node)
import crypto from "node:crypto";

const BASE58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
function decodeBase58(str: string): Buffer {
  const bytes: number[] = [];
  for (const char of str) {
    const index = BASE58.indexOf(char);
    if (index === -1) throw new Error('Invalid base58 char: ' + char);

    let carry = index;
    for (let i = 0; i < bytes.length; i++) {
      carry += bytes[i] * 58;
      bytes[i] = carry & 0xff;
      carry >>= 8;
    }
    while (carry > 0) {
      bytes.push(carry & 0xff);
      carry >>= 8;
    }
  }

  for (const char of str) {
    if (char !== "1") break;
    bytes.push(0);
  }
  return Buffer.from(bytes.reverse());
}

function signEd25519(privateKeyBase58: string, payload: unknown): string {
  const keyStr = privateKeyBase58.replace(/^ed25519:/, "");
  const privateKeyBytes = decodeBase58(keyStr);
  const seed = privateKeyBytes.subarray(0, 32);
  const pkcs8Header = Buffer.from("302e020100300506032b657004220420", "hex");
  const keyObject = crypto.createPrivateKey({
    key: Buffer.concat([pkcs8Header, seed]),
    format: "der",
    type: "pkcs8",
  });
  const msg = JSON.stringify(payload);
  const sig = crypto.sign(null, Buffer.from(msg), keyObject);
  return sig.toString("base64");
}

function authHeaders({ did, privateKey, method, path, bodyJson }: any) {
  const nonce = crypto.randomUUID();
  const timestamp = new Date().toISOString();
  const bodyHash = bodyJson
    ? crypto.createHash("sha256").update(JSON.stringify(bodyJson)).digest("hex")
    : null;

  const payload = {
    method: method.toUpperCase(),
    path,
    query: null,
    body: bodyHash,
    nonce,
    timestamp,
    agent_did: did,
  };

  return {
    "Agent-DID": did,
    "X-Agent-Signature": signEd25519(privateKey, payload),
    "X-Agent-Nonce": nonce,
    "X-Signature-Timestamp": timestamp,
  };
}

async function vaultGetSecret({ apiUrl, did, privateKey, name }: any) {
  const path = "/v1/vault/secrets/" + encodeURIComponent(name);
  const headers = authHeaders({ did, privateKey, method: "GET", path });
  const res = await fetch(apiUrl + path, { method: "GET", headers });
  if (!res.ok) throw new Error(await res.text());
  return res.json();
}

# pip install pynacl requests
import base64
import hashlib
import json
import time
import uuid
import requests
from nacl.signing import SigningKey

BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def b58decode(s: str) -> bytes:
    n = 0
    for ch in s:
        n *= 58
        n += BASE58_ALPHABET.index(ch)
    h = n.to_bytes((n.bit_length() + 7) // 8, "big")
    pad = 0
    for ch in s:
        if ch == "1":
            pad += 1
        else:
            break
    return b"" * pad + h


def nervepay_headers(did: str, private_key_b58: str, method: str, path: str, body_json: dict | None):
    nonce = str(uuid.uuid4())
    timestamp = time.strftime("%Y-%m-%dT%H:%M:%S.000Z", time.gmtime())

    body_hash = None
    if body_json is not None:
        body_hash = hashlib.sha256(json.dumps(body_json).encode("utf-8")).hexdigest()

    payload = {
        "method": method.upper(),
        "path": path,
        "query": None,
        "body": body_hash,
        "nonce": nonce,
        "timestamp": timestamp,
        "agent_did": did,
    }

    key_str = private_key_b58.replace("ed25519:", "")
    seed = b58decode(key_str)[:32]
    signing_key = SigningKey(seed)

    msg = json.dumps(payload).encode("utf-8")
    sig = signing_key.sign(msg).signature

    return {
        "Agent-DID": did,
        "X-Agent-Signature": base64.b64encode(sig).decode("utf-8"),
        "X-Agent-Nonce": nonce,
        "X-Signature-Timestamp": timestamp,
    }


def vault_get(api_url: str, did: str, private_key: str, name: str):
    path = f"/v1/vault/secrets/{name}"
    headers = nervepay_headers(did, private_key, "GET", path, None)
    r = requests.get(api_url + path, headers=headers, timeout=30)
    r.raise_for_status()
    return r.json()