@grc-claw/integration-marketplace 1.0.0

package/dist/connectors/AzureSentinelConnector.js

@@ -0,0 +1,88 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "sentinel-incidents",
+        name: "Sentinel Incidents",
+        description: "Fetch Microsoft Sentinel security incidents",
+        evidenceCategories: ["incident_management", "siem"],
+    },
+    {
+        id: "sentinel-alerts",
+        name: "Sentinel Alerts",
+        description: "Fetch Sentinel alert rules and recent alerts",
+        evidenceCategories: ["monitoring", "detection"],
+    },
+];
+export class AzureSentinelConnector {
+    id = "azure-sentinel";
+    name = "Microsoft Sentinel";
+    category = "siem";
+    authType = "oauth2";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF"];
+    async getAccessToken(config) {
+        const resp = await fetch(`https://login.microsoftonline.com/${config.tenantId}/oauth2/v2.0/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "client_credentials",
+                client_id: config.clientId || "",
+                client_secret: config.clientSecret || "",
+                scope: "https://management.azure.com/.default",
+            }),
+        });
+        if (!resp.ok)
+            throw new Error(`Azure token ${resp.status}`);
+        const data = (await resp.json());
+        return data.access_token;
+    }
+    async testConnection(config) {
+        try {
+            const token = await this.getAccessToken(config);
+            const workspace = config.extra?.workspace || "default";
+            const resp = await fetch(`https://management.azure.com/subscriptions/${config.accountId}/resourceGroups/${config.extra?.resourceGroup || "default"}/providers/Microsoft.OperationalInsights/workspaces/${workspace}?api-version=2023-09-01`, { headers: { Authorization: `Bearer ${token}` } });
+            return resp.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const token = await this.getAccessToken(config);
+        const headers = { Authorization: `Bearer ${token}` };
+        const workspace = config.extra?.workspace || "default";
+        const rg = config.extra?.resourceGroup || "default";
+        const base = `https://management.azure.com/subscriptions/${config.accountId}/resourceGroups/${rg}/providers/Microsoft.OperationalInsights/workspaces/${workspace}`;
+        const incidents = await fetch(`${base}/providers/Microsoft.SecurityInsights/incidents?api-version=2024-01-01&$top=100`, { headers }).then((r) => r.json());
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "sentinel-incidents",
+            timestamp: now,
+            hash: hashEvidence(incidents),
+            framework: "SOC2",
+            controlId: "CC7.3",
+            source: "azure-sentinel/incidents",
+            status: "unknown",
+            data: { incidentCount: (incidents.value || []).length, incidents: incidents.value },
+            metadata: { workspace },
+        });
+        const alerts = await fetch(`${base}/providers/Microsoft.SecurityInsights/alertRules?api-version=2024-01-01`, { headers }).then((r) => r.json());
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "sentinel-alerts",
+            timestamp: now,
+            hash: hashEvidence(alerts),
+            framework: "SOC2",
+            controlId: "CC7.2",
+            source: "azure-sentinel/alertRules",
+            status: (alerts.value || []).length > 0 ? "compliant" : "non_compliant",
+            data: { alertRuleCount: (alerts.value || []).length },
+            metadata: { workspace },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/BambooHRConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class BambooHRConnector implements IntegrationConnector {
+    readonly id = "bamboohr";
+    readonly name = "BambooHR";
+    readonly category: "hr";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/BambooHRConnector.js

@@ -0,0 +1,84 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "bhr-onboarding",
+        name: "Employee Onboarding",
+        description: "Fetch recent employee onboarding records and access provisioning",
+        evidenceCategories: ["hr", "access_provisioning"],
+    },
+    {
+        id: "bhr-offboarding",
+        name: "Employee Offboarding",
+        description: "Fetch employee offboarding records and access revocations",
+        evidenceCategories: ["hr", "access_revocation"],
+    },
+];
+export class BambooHRConnector {
+    id = "bamboohr";
+    name = "BambooHR";
+    category = "hr";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001"];
+    async fetchApi(config, endpoint) {
+        const domain = config.extra?.domain || "yourcompany";
+        const base = config.baseUrl || `https://api.bamboohr.com/api/gate.php/${domain}`;
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Basic ${Buffer.from(`${config.apiToken}:x`).toString("base64")}`,
+                Accept: "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`BambooHR API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/v1/meta/fields");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const thirtyDaysAgo = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000)
+            .toISOString()
+            .split("T")[0];
+        const employees = await this.fetchApi(config, `/v1/employees/directory?fields=id,employmentEndDate,employmentStatus,hireDate`).catch(() => ({ employees: [] }));
+        const empList = (employees.employees || []);
+        const terminated = empList.filter((e) => e.employmentStatus === "Terminated" &&
+            e.employmentEndDate >= thirtyDaysAgo);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "bhr-offboarding",
+            timestamp: now,
+            hash: hashEvidence({ totalEmployees: empList.length, recentTerminations: terminated.length }),
+            framework: "SOC2",
+            controlId: "CC6.2",
+            source: "bamboohr/directory",
+            status: "unknown",
+            data: { totalEmployees: empList.length, recentTerminations: terminated.length },
+            metadata: { domain: config.extra?.domain || "" },
+        });
+        const newHires = empList.filter((e) => e.hireDate >= thirtyDaysAgo);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "bhr-onboarding",
+            timestamp: now,
+            hash: hashEvidence({ newHires: newHires.length }),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "bamboohr/directory",
+            status: "unknown",
+            data: { newHiresLast30Days: newHires.length },
+            metadata: { domain: config.extra?.domain || "" },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/CrowdStrikeConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class CrowdStrikeConnector implements IntegrationConnector {
+    readonly id = "crowdstrike";
+    readonly name = "CrowdStrike Falcon";
+    readonly category: "endpoint";
+    readonly authType: "oauth2";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private getAccessToken;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/CrowdStrikeConnector.js

@@ -0,0 +1,86 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "cs-device-posture",
+        name: "Device Posture",
+        description: "Fetch CrowdStrike device posture assessments and compliance",
+        evidenceCategories: ["endpoint_security", "device_management"],
+    },
+    {
+        id: "cs-threat-detections",
+        name: "Threat Detections",
+        description: "Fetch CrowdStrike Falcon threat detections",
+        evidenceCategories: ["threat_detection", "incident_management"],
+    },
+];
+export class CrowdStrikeConnector {
+    id = "crowdstrike";
+    name = "CrowdStrike Falcon";
+    category = "endpoint";
+    authType = "oauth2";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF"];
+    async getAccessToken(config) {
+        const resp = await fetch("https://api.crowdstrike.com/oauth2/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                client_id: config.clientId || "",
+                client_secret: config.clientSecret || "",
+            }),
+        });
+        if (!resp.ok)
+            throw new Error(`CrowdStrike token ${resp.status}`);
+        const data = (await resp.json());
+        return data.access_token;
+    }
+    async testConnection(config) {
+        try {
+            const token = await this.getAccessToken(config);
+            const resp = await fetch("https://api.crowdstrike.com/devices/queries/devices/v1?limit=1", {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            return resp.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const token = await this.getAccessToken(config);
+        const headers = { Authorization: `Bearer ${token}` };
+        const devices = await fetch("https://api.crowdstrike.com/devices/queries/devices/v1?limit=100", { headers }).then((r) => r.json());
+        const deviceIds = (devices.resources || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "cs-device-posture",
+            timestamp: now,
+            hash: hashEvidence({ deviceCount: deviceIds.length }),
+            framework: "SOC2",
+            controlId: "CC6.8",
+            source: "crowdstrike/devices",
+            status: deviceIds.length > 0 ? "compliant" : "non_compliant",
+            data: { deviceCount: deviceIds.length },
+            metadata: {},
+        });
+        const detections = await fetch("https://api.crowdstrike.com/detects/queries/detects/v1?limit=100&sort=created_timestamp|desc", { headers }).then((r) => r.json());
+        const detectionIds = (detections.resources || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "cs-threat-detections",
+            timestamp: now,
+            hash: hashEvidence({ detectionCount: detectionIds.length }),
+            framework: "SOC2",
+            controlId: "CC7.2",
+            source: "crowdstrike/detects",
+            status: "unknown",
+            data: { detectionCount: detectionIds.length },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/DatadogConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class DatadogConnector implements IntegrationConnector {
+    readonly id = "datadog";
+    readonly name = "Datadog";
+    readonly category: "monitoring";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/DatadogConnector.js

@@ -0,0 +1,110 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "dd-monitors",
+        name: "Monitors",
+        description: "Fetch Datadog monitor configurations and alert states",
+        evidenceCategories: ["monitoring", "configuration"],
+    },
+    {
+        id: "dd-alerts",
+        name: "Alerts",
+        description: "Fetch triggered alerts and alert rule configurations",
+        evidenceCategories: ["monitoring", "incident_detection"],
+    },
+    {
+        id: "dd-apm",
+        name: "APM Configurations",
+        description: "Fetch APM service configurations and security tracking",
+        evidenceCategories: ["application_security", "monitoring"],
+    },
+];
+export class DatadogConnector {
+    id = "datadog";
+    name = "Datadog";
+    category = "monitoring";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001"];
+    async fetchApi(config, endpoint, method = "GET") {
+        const site = config.extra?.site || "datadoghq.com";
+        const base = `https://api.${site}`;
+        const resp = await fetch(`${base}${endpoint}`, {
+            method,
+            headers: {
+                "DD-API-KEY": config.apiToken || "",
+                "DD-APPLICATION-KEY": config.extra?.appKey || "",
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Datadog API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/api/v1/validate");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const monitors = await this.fetchApi(config, "/api/v1/monitor");
+        const monitorList = Array.isArray(monitors) ? monitors : [];
+        const activeMonitors = monitorList.filter((m) => m.overall_state === "OK");
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "dd-monitors",
+            timestamp: now,
+            hash: hashEvidence({ monitorCount: monitorList.length }),
+            framework: "SOC2",
+            controlId: "CC7.1",
+            source: "datadog/monitors",
+            status: monitorList.length > 0 ? "compliant" : "non_compliant",
+            data: {
+                totalMonitors: monitorList.length,
+                activeMonitors: activeMonitors.length,
+                alertMonitors: monitorList.length - activeMonitors.length,
+            },
+            metadata: { site: config.extra?.site || "datadoghq.com" },
+        });
+        const alerts = await this.fetchApi(config, "/api/v1/alerts").catch(() => []);
+        const alertList = Array.isArray(alerts) ? alerts : [];
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "dd-alerts",
+            timestamp: now,
+            hash: hashEvidence({ alertCount: alertList.length }),
+            framework: "SOC2",
+            controlId: "CC7.2",
+            source: "datadog/alerts",
+            status: "unknown",
+            data: { alertRuleCount: alertList.length },
+            metadata: { site: config.extra?.site || "datadoghq.com" },
+        });
+        const services = await this.fetchApi(config, "/api/v1/services").catch(() => ({
+            services: [],
+        }));
+        const serviceList = (services.services || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "dd-apm",
+            timestamp: now,
+            hash: hashEvidence({ serviceCount: serviceList.length }),
+            framework: "ISO27001",
+            controlId: "A.12.4.1",
+            source: "datadog/services",
+            status: "unknown",
+            data: { serviceCount: serviceList.length },
+            metadata: { site: config.extra?.site || "datadoghq.com" },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/DockerHubConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class DockerHubConnector implements IntegrationConnector {
+    readonly id = "docker-hub";
+    readonly name = "Docker Hub";
+    readonly category: "container";
+    readonly authType: "bearer_token";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/DockerHubConnector.js

@@ -0,0 +1,80 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "docker-image-scans",
+        name: "Image Scans",
+        description: "Fetch Docker Hub image vulnerability scan results",
+        evidenceCategories: ["container_security", "vulnerability_management"],
+    },
+    {
+        id: "docker-vuln-reports",
+        name: "Vulnerability Reports",
+        description: "Fetch detailed vulnerability reports per image tag",
+        evidenceCategories: ["vulnerability_management", "supply_chain"],
+    },
+];
+export class DockerHubConnector {
+    id = "docker-hub";
+    name = "Docker Hub";
+    category = "container";
+    authType = "bearer_token";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF"];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://hub.docker.com/v2";
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: { Authorization: `Bearer ${config.apiToken}` },
+        });
+        if (!resp.ok)
+            throw new Error(`Docker Hub API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/user/");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const namespace = config.extra?.namespace || "library";
+        const repo = config.extra?.repo || "nginx";
+        const images = await this.fetchApi(config, `/repositories/${namespace}/${repo}/tags?page_size=50`).catch(() => ({ results: [] }));
+        const tagList = (images.results || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "docker-image-scans",
+            timestamp: now,
+            hash: hashEvidence({ tagCount: tagList.length }),
+            framework: "SOC2",
+            controlId: "CC6.8",
+            source: `dockerhub/${namespace}/${repo}/tags`,
+            status: tagList.length > 0 ? "compliant" : "non_compliant",
+            data: { tagCount: tagList.length, tags: tagList.map((t) => t.name) },
+            metadata: { namespace, repo },
+        });
+        const vulnReport = tagList.length > 0
+            ? await this.fetchApi(config, `/repositories/${namespace}/${repo}/tags/${tagList[0].name}/vulnerabilities`).catch(() => ({ vulnerabilities: [] }))
+            : { vulnerabilities: [] };
+        const vulns = (vulnReport.vulnerabilities || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "docker-vuln-reports",
+            timestamp: now,
+            hash: hashEvidence({ vulnCount: vulns.length }),
+            framework: "ISO27001",
+            controlId: "A.12.6.1",
+            source: `dockerhub/${namespace}/${repo}/vulnerabilities`,
+            status: vulns.length === 0 ? "compliant" : "non_compliant",
+            data: { totalVulnerabilities: vulns.length },
+            metadata: { namespace, repo },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/GCPIAMConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class GCPIAMConnector implements IntegrationConnector {
+    readonly id = "gcp-iam";
+    readonly name = "GCP IAM";
+    readonly category: "cloud_provider";
+    readonly authType: "service_account";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private getAccessToken;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/GCPIAMConnector.js

@@ -0,0 +1,98 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "gcp-iam-bindings",
+        name: "IAM Bindings",
+        description: "Fetch GCP project IAM policy bindings",
+        evidenceCategories: ["access_control"],
+    },
+    {
+        id: "gcp-iam-audit",
+        name: "IAM Audit Logs",
+        description: "Fetch admin activity and data access audit logs",
+        evidenceCategories: ["logging", "audit"],
+    },
+];
+export class GCPIAMConnector {
+    id = "gcp-iam";
+    name = "GCP IAM";
+    category = "cloud_provider";
+    authType = "service_account";
+    capabilities = capabilities;
+    frameworks = [
+        "SOC2",
+        "ISO27001",
+        "NIST_CSF",
+        "HIPAA",
+    ];
+    async getAccessToken(config) {
+        const now = Math.floor(Date.now() / 1000);
+        const header = Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT" })).toString("base64url");
+        const payload = Buffer.from(JSON.stringify({
+            iss: config.clientId,
+            scope: "https://www.googleapis.com/auth/cloud-platform",
+            aud: "https://oauth2.googleapis.com/token",
+            exp: now + 3600,
+            iat: now,
+        })).toString("base64url");
+        const jwt = `${header}.${payload}.signature`;
+        const resp = await fetch("https://oauth2.googleapis.com/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+                assertion: jwt,
+            }),
+        });
+        if (!resp.ok)
+            throw new Error(`GCP token ${resp.status}`);
+        const data = (await resp.json());
+        return data.access_token;
+    }
+    async testConnection(config) {
+        try {
+            const token = await this.getAccessToken(config);
+            const resp = await fetch(`https://cloudresourcemanager.googleapis.com/v1/projects/${config.accountId}`, { headers: { Authorization: `Bearer ${token}` } });
+            return resp.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const token = await this.getAccessToken(config);
+        const headers = { Authorization: `Bearer ${token}` };
+        const iam = await fetch(`https://cloudresourcemanager.googleapis.com/v1/projects/${config.accountId}:getIamPolicy`, { method: "POST", headers: { ...headers, "Content-Type": "application/json" }, body: "{}" }).then((r) => r.json());
+        const bindings = (iam.bindings || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "gcp-iam-bindings",
+            timestamp: now,
+            hash: hashEvidence(iam),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: `gcp/${config.accountId}/getIamPolicy`,
+            status: bindings.length > 0 ? "compliant" : "non_compliant",
+            data: { bindingCount: bindings.length, bindings },
+            metadata: { projectId: config.accountId || "" },
+        });
+        const auditLogs = await fetch(`https://logging.googleapis.com/v2/entries:list?filter=logName%3D%22projects%2F${config.accountId}%2Flogs%2Fcloudaudit.googleapis.com%252Factivity%22&pageSize=50`, { headers }).then((r) => r.json());
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "gcp-iam-audit",
+            timestamp: now,
+            hash: hashEvidence(auditLogs),
+            framework: "SOC2",
+            controlId: "CC7.1",
+            source: `gcp/${config.accountId}/auditLogs`,
+            status: (auditLogs.entries || []).length > 0 ? "compliant" : "non_compliant",
+            data: { logCount: (auditLogs.entries || []).length },
+            metadata: { projectId: config.accountId || "" },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/GCPSCCConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class GCPSCCConnector implements IntegrationConnector {
+    readonly id = "gcp-scc";
+    readonly name = "GCP Security Command Center";
+    readonly category: "cloud_provider";
+    readonly authType: "service_account";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private getAccessToken;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}