@grc-claw/integration-marketplace 0.8.0

package/dist/connectors/AzureReposConnector.js

@@ -0,0 +1,96 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "azure-repos-policies",
+        name: "Repository Policies",
+        description: "Fetch branch policies and merge strategies",
+        evidenceCategories: ["access_control", "change_management"],
+    },
+    {
+        id: "azure-repos-builds",
+        name: "Build Definitions",
+        description: "Fetch CI/CD build pipeline configurations",
+        evidenceCategories: ["change_management", "configuration"],
+    },
+    {
+        id: "azure-repos-pr",
+        name: "Pull Request Policies",
+        description: "Fetch PR approval requirements and work item linking",
+        evidenceCategories: ["change_management", "access_control"],
+    },
+    {
+        id: "azure-repos-audit",
+        name: "Audit Events",
+        description: "Fetch repository audit log events",
+        evidenceCategories: ["monitoring", "access_control"],
+    },
+];
+export class AzureReposConnector {
+    id = "azure-repos";
+    name = "Azure Repos";
+    category = "version_control";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = [
+        "SOC2",
+        "ISO27001",
+        "NIST_CSF",
+        "PCI_DSS",
+    ];
+    async fetchApi(config, endpoint) {
+        const org = config.extra?.org || "default";
+        const base = config.baseUrl || `https://dev.azure.com/${org}`;
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Basic ${Buffer.from(`:${config.apiToken}`).toString("base64")}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Azure Repos API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/_apis/projects?api-version=7.0");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const project = config.extra?.project || "default";
+        const repos = await this.fetchApi(config, `/${project}/_apis/git/repositories?api-version=7.0`).catch(() => ({ value: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "azure-repos-policies",
+            timestamp: now,
+            hash: hashEvidence(repos),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: `dev.azure.com/${project}/repositories`,
+            status: repos.value?.length > 0 ? "compliant" : "unknown",
+            data: { repositoryCount: repos.value?.length || 0 },
+            metadata: { project },
+        });
+        const builds = await this.fetchApi(config, `/${project}/_apis/build/builds?top=10&api-version=7.0`).catch(() => ({ value: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "azure-repos-builds",
+            timestamp: now,
+            hash: hashEvidence(builds),
+            framework: "SOC2",
+            controlId: "CC8.1",
+            source: `dev.azure.com/${project}/builds`,
+            status: "partial",
+            data: { recentBuilds: builds.value?.length || 0 },
+            metadata: { project },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/AzureSentinelConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class AzureSentinelConnector implements IntegrationConnector {
+    readonly id = "azure-sentinel";
+    readonly name = "Microsoft Sentinel";
+    readonly category: "siem";
+    readonly authType: "oauth2";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private getAccessToken;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/AzureSentinelConnector.js

@@ -0,0 +1,88 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "sentinel-incidents",
+        name: "Sentinel Incidents",
+        description: "Fetch Microsoft Sentinel security incidents",
+        evidenceCategories: ["incident_management", "siem"],
+    },
+    {
+        id: "sentinel-alerts",
+        name: "Sentinel Alerts",
+        description: "Fetch Sentinel alert rules and recent alerts",
+        evidenceCategories: ["monitoring", "detection"],
+    },
+];
+export class AzureSentinelConnector {
+    id = "azure-sentinel";
+    name = "Microsoft Sentinel";
+    category = "siem";
+    authType = "oauth2";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF"];
+    async getAccessToken(config) {
+        const resp = await fetch(`https://login.microsoftonline.com/${config.tenantId}/oauth2/v2.0/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "client_credentials",
+                client_id: config.clientId || "",
+                client_secret: config.clientSecret || "",
+                scope: "https://management.azure.com/.default",
+            }),
+        });
+        if (!resp.ok)
+            throw new Error(`Azure token ${resp.status}`);
+        const data = (await resp.json());
+        return data.access_token;
+    }
+    async testConnection(config) {
+        try {
+            const token = await this.getAccessToken(config);
+            const workspace = config.extra?.workspace || "default";
+            const resp = await fetch(`https://management.azure.com/subscriptions/${config.accountId}/resourceGroups/${config.extra?.resourceGroup || "default"}/providers/Microsoft.OperationalInsights/workspaces/${workspace}?api-version=2023-09-01`, { headers: { Authorization: `Bearer ${token}` } });
+            return resp.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const token = await this.getAccessToken(config);
+        const headers = { Authorization: `Bearer ${token}` };
+        const workspace = config.extra?.workspace || "default";
+        const rg = config.extra?.resourceGroup || "default";
+        const base = `https://management.azure.com/subscriptions/${config.accountId}/resourceGroups/${rg}/providers/Microsoft.OperationalInsights/workspaces/${workspace}`;
+        const incidents = await fetch(`${base}/providers/Microsoft.SecurityInsights/incidents?api-version=2024-01-01&$top=100`, { headers }).then((r) => r.json());
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "sentinel-incidents",
+            timestamp: now,
+            hash: hashEvidence(incidents),
+            framework: "SOC2",
+            controlId: "CC7.3",
+            source: "azure-sentinel/incidents",
+            status: "unknown",
+            data: { incidentCount: (incidents.value || []).length, incidents: incidents.value },
+            metadata: { workspace },
+        });
+        const alerts = await fetch(`${base}/providers/Microsoft.SecurityInsights/alertRules?api-version=2024-01-01`, { headers }).then((r) => r.json());
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "sentinel-alerts",
+            timestamp: now,
+            hash: hashEvidence(alerts),
+            framework: "SOC2",
+            controlId: "CC7.2",
+            source: "azure-sentinel/alertRules",
+            status: (alerts.value || []).length > 0 ? "compliant" : "non_compliant",
+            data: { alertRuleCount: (alerts.value || []).length },
+            metadata: { workspace },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/BambooCICDConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class BambooCICDConnector implements IntegrationConnector {
+    readonly id = "bamboo-cicd";
+    readonly name = "Atlassian Bamboo";
+    readonly category: "ci_cd";
+    readonly authType: "basic_auth";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/BambooCICDConnector.js

@@ -0,0 +1,72 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "bamboo-plans",
+        name: "Build Plans",
+        description: "Fetch Bamboo build plan configurations and execution history",
+        evidenceCategories: ["ci_cd", "change_management"],
+    },
+    {
+        id: "bamboo-deployments",
+        name: "Deployment Projects",
+        description: "Fetch Bamboo deployment project configurations and release history",
+        evidenceCategories: ["ci_cd", "change_management"],
+    },
+    {
+        id: "bamboo-permissions",
+        name: "Plan Permissions",
+        description: "Fetch Bamboo build plan access controls and agent authorizations",
+        evidenceCategories: ["access_control", "configuration"],
+    },
+];
+export class BambooCICDConnector {
+    id = "bamboo-cicd";
+    name = "Atlassian Bamboo";
+    category = "ci_cd";
+    authType = "basic_auth";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF"];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://bamboo.example.com/rest/api/latest";
+        const auth = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Basic ${auth}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Bamboo API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/plan.json?maxResults=1");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const plans = await this.fetchApi(config, "/plan.json?maxResults=100").catch(() => ({ plans: { plan: [] } }));
+        const planData = plans.plans;
+        const planList = (planData?.plan || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "bamboo-plans",
+            timestamp: now,
+            hash: hashEvidence({ planCount: planList.length }),
+            framework: "SOC2",
+            controlId: "CC8.1",
+            source: "bamboo/plans",
+            status: "unknown",
+            data: { planCount: planList.length },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/BambooHRConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class BambooHRConnector implements IntegrationConnector {
+    readonly id = "bamboohr";
+    readonly name = "BambooHR";
+    readonly category: "hr";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/BambooHRConnector.js

@@ -0,0 +1,84 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "bhr-onboarding",
+        name: "Employee Onboarding",
+        description: "Fetch recent employee onboarding records and access provisioning",
+        evidenceCategories: ["hr", "access_provisioning"],
+    },
+    {
+        id: "bhr-offboarding",
+        name: "Employee Offboarding",
+        description: "Fetch employee offboarding records and access revocations",
+        evidenceCategories: ["hr", "access_revocation"],
+    },
+];
+export class BambooHRConnector {
+    id = "bamboohr";
+    name = "BambooHR";
+    category = "hr";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001"];
+    async fetchApi(config, endpoint) {
+        const domain = config.extra?.domain || "yourcompany";
+        const base = config.baseUrl || `https://api.bamboohr.com/api/gate.php/${domain}`;
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Basic ${Buffer.from(`${config.apiToken}:x`).toString("base64")}`,
+                Accept: "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`BambooHR API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/v1/meta/fields");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const thirtyDaysAgo = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000)
+            .toISOString()
+            .split("T")[0];
+        const employees = await this.fetchApi(config, `/v1/employees/directory?fields=id,employmentEndDate,employmentStatus,hireDate`).catch(() => ({ employees: [] }));
+        const empList = (employees.employees || []);
+        const terminated = empList.filter((e) => e.employmentStatus === "Terminated" &&
+            e.employmentEndDate >= thirtyDaysAgo);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "bhr-offboarding",
+            timestamp: now,
+            hash: hashEvidence({ totalEmployees: empList.length, recentTerminations: terminated.length }),
+            framework: "SOC2",
+            controlId: "CC6.2",
+            source: "bamboohr/directory",
+            status: "unknown",
+            data: { totalEmployees: empList.length, recentTerminations: terminated.length },
+            metadata: { domain: config.extra?.domain || "" },
+        });
+        const newHires = empList.filter((e) => e.hireDate >= thirtyDaysAgo);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "bhr-onboarding",
+            timestamp: now,
+            hash: hashEvidence({ newHires: newHires.length }),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "bamboohr/directory",
+            status: "unknown",
+            data: { newHiresLast30Days: newHires.length },
+            metadata: { domain: config.extra?.domain || "" },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/BeyondTrustConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class BeyondTrustConnector implements IntegrationConnector {
+    readonly id = "beyondtrust";
+    readonly name = "BeyondTrust";
+    readonly category: "identity";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/BeyondTrustConnector.js

@@ -0,0 +1,94 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "beyondtrust-privilege",
+        name: "Privilege Management",
+        description: "Fetch privileged account policies and session recordings",
+        evidenceCategories: ["access_control", "monitoring"],
+    },
+    {
+        id: "beyondtrust-endpoint",
+        name: "Endpoint Security",
+        description: "Fetch endpoint privilege delegation and application control",
+        evidenceCategories: ["endpoint", "access_control"],
+    },
+    {
+        id: "beyondtrust-password",
+        name: "Password Safe",
+        description: "Fetch password vault configurations and checkout policies",
+        evidenceCategories: ["data_protection", "access_control"],
+    },
+    {
+        id: "beyondtrust-audit",
+        name: "Audit Reports",
+        description: "Fetch privileged access audit trails and compliance reports",
+        evidenceCategories: ["monitoring", "compliance"],
+    },
+];
+export class BeyondTrustConnector {
+    id = "beyondtrust";
+    name = "BeyondTrust";
+    category = "identity";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = [
+        "SOC2",
+        "ISO27001",
+        "NIST_CSF",
+        "PCI_DSS",
+    ];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://beyondtrust.example.com";
+        const resp = await fetch(`${base}/api${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`BeyondTrust API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/configuration/system");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const systems = await this.fetchApi(config, "/managed-systems").catch(() => ({ items: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "beyondtrust-privilege",
+            timestamp: now,
+            hash: hashEvidence(systems),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "beyondtrust/managed-systems",
+            status: systems.items?.length > 0 ? "compliant" : "unknown",
+            data: { managedSystems: systems.items?.length || 0 },
+            metadata: {},
+        });
+        const accounts = await this.fetchApi(config, "/accounts").catch(() => ({ items: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "beyondtrust-password",
+            timestamp: now,
+            hash: hashEvidence(accounts),
+            framework: "ISO27001",
+            controlId: "A.9.2.6",
+            source: "beyondtrust/accounts",
+            status: accounts.items?.length > 0 ? "compliant" : "non_compliant",
+            data: { privilegedAccounts: accounts.items?.length || 0 },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/BitbucketConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class BitbucketConnector implements IntegrationConnector {
+    readonly id = "bitbucket";
+    readonly name = "Bitbucket";
+    readonly category: "version_control";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/BitbucketConnector.js

@@ -0,0 +1,100 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "bitbucket-repos",
+        name: "Repository Settings",
+        description: "Fetch repo access controls and branch permissions",
+        evidenceCategories: ["access_control", "configuration"],
+    },
+    {
+        id: "bitbucket-pipelines",
+        name: "Pipelines",
+        description: "Fetch CI/CD pipeline configurations and run history",
+        evidenceCategories: ["change_management", "configuration"],
+    },
+    {
+        id: "bitbucket-code-insight",
+        name: "Code Insights",
+        description: "Fetch code quality and security scan results",
+        evidenceCategories: ["vulnerability_management", "change_management"],
+    },
+    {
+        id: "bitbucket-ip-allow",
+        name: "IP Allowlisting",
+        description: "Fetch IP allowlist configurations for workspace",
+        evidenceCategories: ["access_control", "configuration"],
+    },
+];
+export class BitbucketConnector {
+    id = "bitbucket";
+    name = "Bitbucket";
+    category = "version_control";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = [
+        "SOC2",
+        "ISO27001",
+        "NIST_CSF",
+        "PCI_DSS",
+    ];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://api.bitbucket.org/2.0";
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Bitbucket API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/user");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const workspace = config.extra?.workspace || "default";
+        const repoSlug = config.extra?.repo || "main-repo";
+        const repo = await this.fetchApi(config, `/repositories/${workspace}/${repoSlug}`).catch(() => ({}));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "bitbucket-repos",
+            timestamp: now,
+            hash: hashEvidence(repo),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: `bitbucket.org/${workspace}/${repoSlug}`,
+            status: repo.is_private === true ? "compliant" : "partial",
+            data: {
+                isPrivate: repo.is_private,
+                defaultBranch: repo.default_branch,
+                hasIssues: repo.has_issues,
+            },
+            metadata: { workspace, repoSlug },
+        });
+        const pipelines = await this.fetchApi(config, `/repositories/${workspace}/${repoSlug}/pipelines/?max_length=10`).catch(() => ({ values: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "bitbucket-pipelines",
+            timestamp: now,
+            hash: hashEvidence(pipelines),
+            framework: "SOC2",
+            controlId: "CC8.1",
+            source: `bitbucket.org/${workspace}/${repoSlug}/pipelines`,
+            status: "partial",
+            data: { recentPipelines: pipelines.values?.length || 0 },
+            metadata: { workspace, repoSlug },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/BitbucketPipelinesConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class BitbucketPipelinesConnector implements IntegrationConnector {
+    readonly id = "bitbucket-pipelines";
+    readonly name = "Bitbucket Pipelines";
+    readonly category: "ci_cd";
+    readonly authType: "bearer_token";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}