@id-wispera/core 0.1.0

package/dist/locations.js

@@ -0,0 +1,733 @@
+/**
+ * ID Wispera Credential Locations Registry
+ * Defines well-known credential storage paths for various providers
+ */
+import { homedir } from 'os';
+import { join } from 'path';
+// ============================================================================
+// Path Helpers
+// ============================================================================
+/**
+ * Expand path patterns like {home} to actual paths
+ */
+export function expandPath(pattern, vars = {}) {
+    let result = pattern;
+    result = result.replace('{home}', homedir());
+    for (const [key, value] of Object.entries(vars)) {
+        result = result.replace(`{${key}}`, value);
+    }
+    return result;
+}
+/**
+ * Get the home directory
+ */
+export function getHomeDir() {
+    return homedir();
+}
+// ============================================================================
+// OpenClaw Provider
+// ============================================================================
+/**
+ * Parse WhatsApp credentials from creds.json
+ */
+function parseWhatsAppCreds(filePath, content) {
+    try {
+        const data = JSON.parse(content);
+        const credentials = [];
+        // Extract account ID from path or me.id
+        const pathMatch = filePath.match(/whatsapp\/([^/]+)\/creds\.json$/);
+        const accountId = pathMatch?.[1] || data.me?.id?.split(':')[0] || 'unknown';
+        const phoneNumber = data.me?.id?.split(':')[0] || accountId;
+        // The entire creds.json is a sensitive session credential
+        credentials.push({
+            provider: 'openclaw',
+            filePath,
+            classification: {
+                name: `WhatsApp Session (${accountId})`,
+                credentialType: 'session-keys',
+                visaType: 'access',
+                riskLevel: 'high',
+                platforms: ['openclaw', 'whatsapp'],
+                tags: ['openclaw', 'whatsapp', 'session', 'imported'],
+                issuingAuthority: 'OpenClaw (self-managed)',
+            },
+            rawValue: content,
+            metadata: {
+                accountId,
+                phoneNumber,
+                botName: data.me?.name,
+                registrationId: data.registrationId,
+                hasNoiseKey: !!data.noiseKey,
+                hasSignedIdentityKey: !!data.signedIdentityKey,
+                hasSignedPreKey: !!data.signedPreKey,
+            },
+        });
+        return credentials;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Parse channel allowlist files
+ */
+function parseAllowlist(filePath, content) {
+    try {
+        const data = JSON.parse(content);
+        const credentials = [];
+        // Extract channel name from filename
+        const fileMatch = filePath.match(/([^/]+)-allowFrom\.json$/);
+        const channel = fileMatch?.[1] || 'unknown';
+        const pairedCount = Object.keys(data).length;
+        credentials.push({
+            provider: 'openclaw',
+            filePath,
+            classification: {
+                name: `Pairing Allowlist: ${channel} (${pairedCount} users)`,
+                credentialType: 'custom',
+                visaType: 'access',
+                riskLevel: 'low',
+                platforms: ['openclaw', channel],
+                tags: ['openclaw', channel, 'allowlist', 'imported'],
+                issuingAuthority: 'OpenClaw (self-managed)',
+            },
+            rawValue: content,
+            metadata: {
+                channel,
+                pairedUsers: Object.entries(data).map(([id, info]) => ({
+                    id,
+                    name: info.name,
+                    pairedAt: info.pairedAt,
+                })),
+                pairedCount,
+            },
+        });
+        return credentials;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Parse auth-profiles.json for LLM API keys
+ */
+function parseAuthProfiles(filePath, content) {
+    try {
+        const data = JSON.parse(content);
+        const credentials = [];
+        // Extract agent ID from path
+        const pathMatch = filePath.match(/agents\/([^/]+)\/agent\/auth-profiles\.json$/);
+        const agentId = pathMatch?.[1] || 'unknown';
+        for (const [provider, profile] of Object.entries(data)) {
+            if (profile.type === 'api-key' && profile.key) {
+                const keyPreview = profile.key.substring(0, 10) + '...' +
+                    profile.key.substring(profile.key.length - 4);
+                credentials.push({
+                    provider: 'openclaw',
+                    filePath,
+                    classification: {
+                        name: `${capitalizeFirst(provider)} API Key (${keyPreview})`,
+                        credentialType: 'api-key',
+                        visaType: 'privilege',
+                        riskLevel: 'critical',
+                        platforms: ['openclaw', 'mcp', provider],
+                        tags: ['openclaw', provider, 'api-key', 'llm', 'imported'],
+                        issuingAuthority: 'OpenClaw (self-managed)',
+                        context: { agentId, model: profile.model },
+                    },
+                    rawValue: profile.key,
+                    metadata: {
+                        agentId,
+                        provider,
+                        model: profile.model,
+                        keyType: profile.type,
+                    },
+                });
+            }
+        }
+        return credentials;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Parse oauth.json for OAuth tokens
+ */
+function parseOAuthTokens(filePath, content) {
+    try {
+        const data = JSON.parse(content);
+        const credentials = [];
+        for (const [provider, tokens] of Object.entries(data)) {
+            if (tokens.access_token) {
+                const tokenPreview = tokens.access_token.substring(0, 10) + '...';
+                const expiresAt = tokens.expires_at ? new Date(tokens.expires_at * 1000) : undefined;
+                const isExpired = expiresAt && expiresAt < new Date();
+                credentials.push({
+                    provider: 'openclaw',
+                    filePath,
+                    classification: {
+                        name: `${capitalizeFirst(provider)} OAuth Token (${tokenPreview})`,
+                        credentialType: 'oauth-token',
+                        visaType: 'access',
+                        riskLevel: 'medium',
+                        platforms: ['openclaw', provider],
+                        tags: ['openclaw', provider, 'oauth', 'imported', ...(isExpired ? ['expired'] : [])],
+                        issuingAuthority: 'OpenClaw (self-managed)',
+                    },
+                    rawValue: tokens.access_token,
+                    metadata: {
+                        provider,
+                        hasRefreshToken: !!tokens.refresh_token,
+                        tokenType: tokens.token_type,
+                        expiresAt: expiresAt?.toISOString(),
+                        isExpired,
+                    },
+                    expiresAt,
+                });
+            }
+        }
+        return credentials;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Parse openclaw.json for channel tokens and gateway config
+ */
+function parseOpenClawConfig(filePath, content) {
+    try {
+        const data = JSON.parse(content);
+        const credentials = [];
+        // Parse channel tokens
+        if (data.channels) {
+            for (const [channel, config] of Object.entries(data.channels)) {
+                // Telegram bot token
+                if (channel === 'telegram' && config.token) {
+                    const tokenPreview = config.token.substring(0, 7) + '...' +
+                        config.token.substring(config.token.length - 4);
+                    credentials.push({
+                        provider: 'openclaw',
+                        filePath,
+                        classification: {
+                            name: `Telegram Bot Token (${tokenPreview})`,
+                            credentialType: 'api-key',
+                            visaType: 'access',
+                            riskLevel: 'high',
+                            platforms: ['openclaw', 'telegram'],
+                            tags: ['openclaw', 'telegram', 'bot-token', 'imported'],
+                            issuingAuthority: 'OpenClaw (self-managed)',
+                        },
+                        rawValue: config.token,
+                        metadata: { channel: 'telegram' },
+                    });
+                }
+                // Slack tokens
+                if (channel === 'slack') {
+                    if (config.botToken) {
+                        const tokenPreview = config.botToken.substring(0, 10) + '...' +
+                            config.botToken.substring(config.botToken.length - 4);
+                        credentials.push({
+                            provider: 'openclaw',
+                            filePath,
+                            classification: {
+                                name: `Slack Bot Token (${tokenPreview})`,
+                                credentialType: 'api-key',
+                                visaType: 'access',
+                                riskLevel: 'high',
+                                platforms: ['openclaw', 'slack'],
+                                tags: ['openclaw', 'slack', 'bot-token', 'imported'],
+                                issuingAuthority: 'OpenClaw (self-managed)',
+                            },
+                            rawValue: config.botToken,
+                            metadata: { channel: 'slack', tokenType: 'bot' },
+                        });
+                    }
+                    if (config.appToken) {
+                        const tokenPreview = config.appToken.substring(0, 10) + '...' +
+                            config.appToken.substring(config.appToken.length - 4);
+                        credentials.push({
+                            provider: 'openclaw',
+                            filePath,
+                            classification: {
+                                name: `Slack App Token (${tokenPreview})`,
+                                credentialType: 'api-key',
+                                visaType: 'access',
+                                riskLevel: 'high',
+                                platforms: ['openclaw', 'slack'],
+                                tags: ['openclaw', 'slack', 'app-token', 'imported'],
+                                issuingAuthority: 'OpenClaw (self-managed)',
+                            },
+                            rawValue: config.appToken,
+                            metadata: { channel: 'slack', tokenType: 'app' },
+                        });
+                    }
+                }
+                // Discord token
+                if (channel === 'discord' && config.token) {
+                    const tokenPreview = config.token.substring(0, 10) + '...' +
+                        config.token.substring(config.token.length - 4);
+                    credentials.push({
+                        provider: 'openclaw',
+                        filePath,
+                        classification: {
+                            name: `Discord Bot Token (${tokenPreview})`,
+                            credentialType: 'api-key',
+                            visaType: 'access',
+                            riskLevel: 'high',
+                            platforms: ['openclaw', 'discord'],
+                            tags: ['openclaw', 'discord', 'bot-token', 'imported'],
+                            issuingAuthority: 'OpenClaw (self-managed)',
+                        },
+                        rawValue: config.token,
+                        metadata: { channel: 'discord' },
+                    });
+                }
+            }
+        }
+        // Parse gateway token
+        if (data.gateway?.token) {
+            const tokenPreview = data.gateway.token.substring(0, 6) + '...' +
+                data.gateway.token.substring(data.gateway.token.length - 4);
+            credentials.push({
+                provider: 'openclaw',
+                filePath,
+                classification: {
+                    name: `Gateway Token (${tokenPreview})`,
+                    credentialType: 'api-key',
+                    visaType: 'privilege',
+                    riskLevel: 'high',
+                    platforms: ['openclaw'],
+                    tags: ['openclaw', 'gateway', 'admin', 'imported'],
+                    issuingAuthority: 'OpenClaw (self-managed)',
+                },
+                rawValue: data.gateway.token,
+                metadata: {
+                    gatewayPort: data.gateway.port,
+                },
+            });
+        }
+        return credentials;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Helper to capitalize first letter
+ */
+function capitalizeFirst(str) {
+    return str.charAt(0).toUpperCase() + str.slice(1);
+}
+/**
+ * OpenClaw provider definition
+ */
+export const openclawProvider = {
+    id: 'openclaw',
+    name: 'OpenClaw',
+    description: 'OpenClaw AI agent framework credentials',
+    detect: async () => {
+        const fs = await import('fs/promises');
+        const openclawPath = join(homedir(), '.openclaw');
+        try {
+            await fs.access(openclawPath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    locations: [
+        {
+            id: 'whatsapp-creds',
+            name: 'WhatsApp Credentials',
+            pathPattern: '{home}/.openclaw/credentials/whatsapp',
+            filePattern: '**/creds.json',
+            parse: parseWhatsAppCreds,
+        },
+        {
+            id: 'channel-allowlists',
+            name: 'Channel Allowlists',
+            pathPattern: '{home}/.openclaw/credentials',
+            filePattern: '*-allowFrom.json',
+            parse: parseAllowlist,
+        },
+        {
+            id: 'auth-profiles',
+            name: 'LLM Auth Profiles',
+            pathPattern: '{home}/.openclaw/agents',
+            filePattern: '**/agent/auth-profiles.json',
+            parse: parseAuthProfiles,
+        },
+        {
+            id: 'oauth-tokens',
+            name: 'OAuth Tokens',
+            pathPattern: '{home}/.openclaw/credentials',
+            filePattern: 'oauth.json',
+            parse: parseOAuthTokens,
+        },
+        {
+            id: 'config',
+            name: 'OpenClaw Config',
+            pathPattern: '{home}/.openclaw',
+            filePattern: 'openclaw.json',
+            parse: parseOpenClawConfig,
+        },
+    ],
+};
+// ============================================================================
+// Other Common Providers
+// ============================================================================
+/**
+ * AWS provider definition
+ */
+export const awsProvider = {
+    id: 'aws',
+    name: 'AWS',
+    description: 'Amazon Web Services credentials',
+    detect: async () => {
+        const fs = await import('fs/promises');
+        try {
+            await fs.access(join(homedir(), '.aws'));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    locations: [
+        {
+            id: 'credentials',
+            name: 'AWS Credentials',
+            pathPattern: '{home}/.aws',
+            filePattern: 'credentials',
+            parse: (filePath, content) => {
+                const credentials = [];
+                const profileRegex = /\[([^\]]+)\]\s*\n((?:[^[]*(?:\n|$))*)/g;
+                let match;
+                while ((match = profileRegex.exec(content)) !== null) {
+                    const profileName = match[1] ?? 'default';
+                    const profileContent = match[2] ?? '';
+                    const accessKeyMatch = profileContent.match(/aws_access_key_id\s*=\s*(\S+)/);
+                    const secretKeyMatch = profileContent.match(/aws_secret_access_key\s*=\s*(\S+)/);
+                    if (accessKeyMatch?.[1] && secretKeyMatch?.[1]) {
+                        const keyPreview = accessKeyMatch[1].substring(0, 8) + '...';
+                        credentials.push({
+                            provider: 'aws',
+                            filePath,
+                            classification: {
+                                name: `AWS Access Key [${profileName}] (${keyPreview})`,
+                                credentialType: 'api-key',
+                                visaType: 'privilege',
+                                riskLevel: 'critical',
+                                platforms: ['aws'],
+                                tags: ['aws', profileName, 'imported'],
+                                issuingAuthority: 'AWS IAM',
+                            },
+                            rawValue: `${accessKeyMatch[1]}:${secretKeyMatch[1]}`,
+                            metadata: {
+                                profile: profileName,
+                                accessKeyId: accessKeyMatch[1],
+                            },
+                        });
+                    }
+                }
+                return credentials;
+            },
+        },
+    ],
+};
+/**
+ * SSH provider definition
+ */
+export const sshProvider = {
+    id: 'ssh',
+    name: 'SSH',
+    description: 'SSH private keys',
+    detect: async () => {
+        const fs = await import('fs/promises');
+        try {
+            await fs.access(join(homedir(), '.ssh'));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    locations: [
+        {
+            id: 'private-keys',
+            name: 'SSH Private Keys',
+            pathPattern: '{home}/.ssh',
+            filePattern: 'id_*',
+            parse: (filePath, content) => {
+                const credentials = [];
+                // Only process private keys (not .pub files)
+                if (filePath.endsWith('.pub'))
+                    return credentials;
+                // Check if it's a private key
+                if (content.includes('PRIVATE KEY')) {
+                    const keyType = content.includes('RSA') ? 'RSA' :
+                        content.includes('EC') ? 'EC' :
+                            content.includes('OPENSSH') ? 'OpenSSH' : 'Unknown';
+                    const fileName = filePath.split('/').pop() || 'unknown';
+                    credentials.push({
+                        provider: 'ssh',
+                        filePath,
+                        classification: {
+                            name: `SSH Private Key (${fileName})`,
+                            credentialType: 'private-key',
+                            visaType: 'access',
+                            riskLevel: 'high',
+                            platforms: ['ssh'],
+                            tags: ['ssh', keyType.toLowerCase(), 'imported'],
+                            issuingAuthority: 'Self-generated',
+                        },
+                        rawValue: content,
+                        metadata: {
+                            keyType,
+                            fileName,
+                        },
+                    });
+                }
+                return credentials;
+            },
+        },
+    ],
+};
+/**
+ * Docker provider definition
+ */
+export const dockerProvider = {
+    id: 'docker',
+    name: 'Docker',
+    description: 'Docker registry credentials',
+    detect: async () => {
+        const fs = await import('fs/promises');
+        try {
+            await fs.access(join(homedir(), '.docker', 'config.json'));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    locations: [
+        {
+            id: 'config',
+            name: 'Docker Config',
+            pathPattern: '{home}/.docker',
+            filePattern: 'config.json',
+            parse: (filePath, content) => {
+                const credentials = [];
+                try {
+                    const data = JSON.parse(content);
+                    if (data.auths) {
+                        for (const [registry, auth] of Object.entries(data.auths)) {
+                            if (auth.auth) {
+                                credentials.push({
+                                    provider: 'docker',
+                                    filePath,
+                                    classification: {
+                                        name: `Docker Registry (${registry})`,
+                                        credentialType: 'api-key',
+                                        visaType: 'access',
+                                        riskLevel: 'medium',
+                                        platforms: ['docker'],
+                                        tags: ['docker', 'registry', 'imported'],
+                                        issuingAuthority: registry,
+                                    },
+                                    rawValue: auth.auth,
+                                    metadata: {
+                                        registry,
+                                    },
+                                });
+                            }
+                        }
+                    }
+                }
+                catch {
+                    // Invalid JSON
+                }
+                return credentials;
+            },
+        },
+    ],
+};
+/**
+ * npm provider definition
+ */
+export const npmProvider = {
+    id: 'npm',
+    name: 'npm',
+    description: 'npm registry tokens',
+    detect: async () => {
+        const fs = await import('fs/promises');
+        try {
+            await fs.access(join(homedir(), '.npmrc'));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    locations: [
+        {
+            id: 'npmrc',
+            name: 'npm Config',
+            pathPattern: '{home}',
+            filePattern: '.npmrc',
+            parse: (filePath, content) => {
+                const credentials = [];
+                // Match auth tokens
+                const tokenMatch = content.match(/_authToken=([^\s\n]+)/);
+                if (tokenMatch?.[1]) {
+                    const tokenPreview = tokenMatch[1].substring(0, 8) + '...';
+                    credentials.push({
+                        provider: 'npm',
+                        filePath,
+                        classification: {
+                            name: `npm Auth Token (${tokenPreview})`,
+                            credentialType: 'api-key',
+                            visaType: 'access',
+                            riskLevel: 'medium',
+                            platforms: ['npm'],
+                            tags: ['npm', 'registry', 'imported'],
+                            issuingAuthority: 'npm Registry',
+                        },
+                        rawValue: tokenMatch[1],
+                        metadata: {},
+                    });
+                }
+                return credentials;
+            },
+        },
+    ],
+};
+/**
+ * Kubernetes provider definition
+ */
+export const kubernetesProvider = {
+    id: 'kubernetes',
+    name: 'Kubernetes',
+    description: 'Kubernetes cluster credentials',
+    detect: async () => {
+        const fs = await import('fs/promises');
+        try {
+            await fs.access(join(homedir(), '.kube', 'config'));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    locations: [
+        {
+            id: 'kubeconfig',
+            name: 'Kubeconfig',
+            pathPattern: '{home}/.kube',
+            filePattern: 'config',
+            parse: (filePath, content) => {
+                const credentials = [];
+                // Simple YAML parsing for kubeconfig
+                const clusterMatches = content.match(/- name:\s*([^\n]+)/g);
+                if (clusterMatches) {
+                    for (const match of clusterMatches) {
+                        const name = match.replace('- name:', '').trim();
+                        credentials.push({
+                            provider: 'kubernetes',
+                            filePath,
+                            classification: {
+                                name: `Kubernetes Cluster (${name})`,
+                                credentialType: 'custom',
+                                visaType: 'privilege',
+                                riskLevel: 'high',
+                                platforms: ['kubernetes'],
+                                tags: ['kubernetes', 'cluster', 'imported'],
+                                issuingAuthority: 'Kubernetes',
+                            },
+                            rawValue: content,
+                            metadata: {
+                                clusterName: name,
+                            },
+                        });
+                        break; // Just capture the first cluster as the main credential
+                    }
+                }
+                return credentials;
+            },
+        },
+    ],
+};
+// ============================================================================
+// Provider Registry
+// ============================================================================
+/**
+ * All registered providers
+ */
+export const providers = [
+    openclawProvider,
+    awsProvider,
+    sshProvider,
+    dockerProvider,
+    npmProvider,
+    kubernetesProvider,
+];
+/**
+ * Get provider by ID
+ */
+export function getProvider(id) {
+    return providers.find(p => p.id === id);
+}
+/**
+ * Get all provider IDs
+ */
+export function getProviderIds() {
+    return providers.map(p => p.id);
+}
+/**
+ * Detect which providers are installed
+ */
+export async function detectInstalledProviders() {
+    const installed = [];
+    for (const provider of providers) {
+        if (await provider.detect()) {
+            installed.push(provider);
+        }
+    }
+    return installed;
+}
+// ============================================================================
+// Risk Level Helpers
+// ============================================================================
+/**
+ * Get risk level emoji
+ */
+export function getRiskEmoji(level) {
+    switch (level) {
+        case 'critical': return '🔴';
+        case 'high': return '⚠️ ';
+        case 'medium': return '⚠️ ';
+        case 'low': return 'ℹ️ ';
+    }
+}
+/**
+ * Get risk level label
+ */
+export function getRiskLabel(level) {
+    return level.toUpperCase();
+}
+/**
+ * Sort credentials by risk level (critical first)
+ */
+export function sortByRisk(credentials) {
+    const order = {
+        critical: 0,
+        high: 1,
+        medium: 2,
+        low: 3,
+    };
+    return [...credentials].sort((a, b) => order[a.classification.riskLevel] - order[b.classification.riskLevel]);
+}
+//# sourceMappingURL=locations.js.map