@grc-claw/integration-marketplace 0.8.0

package/dist/connectors/SalesforceConnector.js

@@ -0,0 +1,91 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "sf-user-permissions",
+        name: "User Permissions",
+        description: "Fetch Salesforce user permission sets and profiles",
+        evidenceCategories: ["access_control", "authorization"],
+    },
+    {
+        id: "sf-field-security",
+        name: "Field-Level Security",
+        description: "Fetch field-level security configurations on sensitive objects",
+        evidenceCategories: ["data_protection", "access_control"],
+    },
+];
+export class SalesforceConnector {
+    id = "salesforce";
+    name = "Salesforce";
+    category = "hr";
+    authType = "oauth2";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "HIPAA"];
+    async getAccessToken(config) {
+        const resp = await fetch(`${config.baseUrl || "https://login.salesforce.com"}/services/oauth2/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "client_credentials",
+                client_id: config.clientId || "",
+                client_secret: config.clientSecret || "",
+            }),
+        });
+        if (!resp.ok)
+            throw new Error(`Salesforce token ${resp.status}`);
+        const data = (await resp.json());
+        return data.access_token;
+    }
+    async testConnection(config) {
+        try {
+            const token = await this.getAccessToken(config);
+            const instanceUrl = config.extra?.instanceUrl || "https://your-instance.salesforce.com";
+            const resp = await fetch(`${instanceUrl}/services/data/v59.0/limits`, {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            return resp.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const token = await this.getAccessToken(config);
+        const instanceUrl = config.extra?.instanceUrl || "https://your-instance.salesforce.com";
+        const headers = { Authorization: `Bearer ${token}` };
+        const users = await fetch(`${instanceUrl}/services/data/v59.0/query?q=SELECT+Id,Username,ProfileId,IsActive+FROM+User+WHERE+IsActive=TRUE+LIMIT+200`, { headers }).then((r) => r.json());
+        const userList = (users.records || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "sf-user-permissions",
+            timestamp: now,
+            hash: hashEvidence({ userCount: userList.length }),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "salesforce/users",
+            status: "unknown",
+            data: { activeUserCount: userList.length },
+            metadata: { instanceUrl },
+        });
+        const fieldPerms = await fetch(`${instanceUrl}/services/data/v59.0/query?q=SELECT+ParentId,Field,Editable+FROM+FieldPermission+WHERE+Parent.Profile.Name='Standard+User'+LIMIT+100`, { headers }).then((r) => r.json());
+        const permRecords = (fieldPerms.records || []);
+        const editableSensitive = permRecords.filter((p) => p.Editable === true &&
+            (p.Field || "").includes("Email"));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "sf-field-security",
+            timestamp: now,
+            hash: hashEvidence({ permissionCount: permRecords.length }),
+            framework: "ISO27001",
+            controlId: "A.9.4.1",
+            source: "salesforce/fieldPermissions",
+            status: editableSensitive.length === 0 ? "compliant" : "partial",
+            data: { fieldPermissionCount: permRecords.length, editableSensitiveFields: editableSensitive.length },
+            metadata: { instanceUrl },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/SendGridConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class SendGridConnector implements IntegrationConnector {
+    readonly id = "sendgrid";
+    readonly name = "SendGrid";
+    readonly category: "communication";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/SendGridConnector.js

@@ -0,0 +1,69 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "sendgrid-stats",
+        name: "Email Statistics",
+        description: "Fetch SendGrid email delivery statistics, bounce rates, and spam reports",
+        evidenceCategories: ["monitoring", "configuration"],
+    },
+    {
+        id: "sendgrid-security",
+        name: "Security Settings",
+        description: "Fetch SendGrid API key permissions, IP whitelisting, and authentication settings",
+        evidenceCategories: ["access_control", "secret_management"],
+    },
+    {
+        id: "sendgrid-templates",
+        name: "Email Templates",
+        description: "Fetch SendGrid email template versions and approval workflows",
+        evidenceCategories: ["change_management", "configuration"],
+    },
+];
+export class SendGridConnector {
+    id = "sendgrid";
+    name = "SendGrid";
+    category = "communication";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001"];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://api.sendgrid.com/v3";
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`SendGrid API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/user/profile");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const profile = await this.fetchApi(config, "/user/profile").catch(() => ({}));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "sendgrid-stats",
+            timestamp: now,
+            hash: hashEvidence(profile),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "sendgrid/profile",
+            status: "unknown",
+            data: { connected: true },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/SentinelOneConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class SentinelOneConnector implements IntegrationConnector {
+    readonly id = "sentinelone";
+    readonly name = "SentinelOne";
+    readonly category: "endpoint";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/SentinelOneConnector.js

@@ -0,0 +1,89 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "sentinelone-agents",
+        name: "Agent Fleet",
+        description: "Fetch SentinelOne agent status and health across endpoints",
+        evidenceCategories: ["endpoint", "monitoring"],
+    },
+    {
+        id: "sentinelone-detections",
+        name: "Threat Detections",
+        description: "Fetch threat detection events and incident counts",
+        evidenceCategories: ["vulnerability_management", "monitoring"],
+    },
+    {
+        id: "sentinelone-policies",
+        name: "Deep Visibility",
+        description: "Fetch detection policy configurations and exclusions",
+        evidenceCategories: ["access_control", "configuration"],
+    },
+    {
+        id: "sentinelone-response",
+        name: "Response Actions",
+        description: "Fetch remote shell, isolate, and response action logs",
+        evidenceCategories: ["monitoring", "change_management"],
+    },
+];
+export class SentinelOneConnector {
+    id = "sentinelone";
+    name = "SentinelOne";
+    category = "endpoint";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF", "HIPAA", "PCI_DSS"];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://usea1.sentinelone.com";
+        const resp = await fetch(`${base}/web/api/v2.1${endpoint}`, {
+            headers: {
+                Authorization: `ApiToken ${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`SentinelOne API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/agents");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const agents = await this.fetchApi(config, "/agents").catch(() => ({ data: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "sentinelone-agents",
+            timestamp: now,
+            hash: hashEvidence(agents),
+            framework: "SOC2",
+            controlId: "CC6.8",
+            source: "sentinelone/agents",
+            status: agents.data?.length > 0 ? "compliant" : "unknown",
+            data: { agentCount: agents.data?.length || 0 },
+            metadata: {},
+        });
+        const threats = await this.fetchApi(config, "/threats?limit=10").catch(() => ({ data: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "sentinelone-detections",
+            timestamp: now,
+            hash: hashEvidence(threats),
+            framework: "ISO27001",
+            controlId: "A.12.2.1",
+            source: "sentinelone/threats",
+            status: threats.data?.length === 0 ? "compliant" : "non_compliant",
+            data: { openThreats: threats.data?.length || 0 },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/ServiceNowConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class ServiceNowConnector implements IntegrationConnector {
+    readonly id = "servicenow";
+    readonly name = "ServiceNow";
+    readonly category: "incident_management";
+    readonly authType: "oauth2";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/ServiceNowConnector.js

@@ -0,0 +1,123 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "snow-incidents",
+        name: "Incident Records",
+        description: "Fetch ServiceNow ITSM incident records and resolution metrics",
+        evidenceCategories: ["incident_management", "change_management"],
+    },
+    {
+        id: "snow-change-requests",
+        name: "Change Requests",
+        description: "Fetch change request records including approval workflows",
+        evidenceCategories: ["change_management"],
+    },
+    {
+        id: "snow-problems",
+        name: "Problem Records",
+        description: "Fetch problem management records and root cause analysis",
+        evidenceCategories: ["incident_management", "risk_management"],
+    },
+    {
+        id: "snow-configuration",
+        name: "CMDB Configuration",
+        description: "Fetch CMDB configuration items and relationships",
+        evidenceCategories: ["configuration", "asset_management"],
+    },
+];
+export class ServiceNowConnector {
+    id = "servicenow";
+    name = "ServiceNow";
+    category = "incident_management";
+    authType = "oauth2";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF", "HIPAA", "PCI_DSS"];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || `https://${config.extra?.instance || "instance"}.service-now.com/api/now`;
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Accept: "application/json",
+                Authorization: `Bearer ${config.apiToken}`,
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`ServiceNow API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/table/sys_user?sysparm_limit=1");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const incidents = await this.fetchApi(config, "/table/incident?sysparm_limit=100&sysparm_fields=number,state,severity,assigned_to,opened_at,resolved_at").catch(() => ({ result: [] }));
+        const incidentList = (incidents.result || []);
+        const resolved = incidentList.filter((i) => i.state === "6" || i.state === "7");
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "snow-incidents",
+            timestamp: now,
+            hash: hashEvidence({ total: incidentList.length, resolved: resolved.length }),
+            framework: "SOC2",
+            controlId: "CC7.3",
+            source: "servicenow/incident",
+            status: "unknown",
+            data: { incidentCount: incidentList.length, resolvedCount: resolved.length },
+            metadata: { instance: config.extra?.instance || "" },
+        });
+        const changes = await this.fetchApi(config, "/table/change_request?sysparm_limit=100&sysparm_fields=number,state,risk,approval").catch(() => ({ result: [] }));
+        const changeList = (changes.result || []);
+        const approved = changeList.filter((c) => c.approval === "approved");
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "snow-change-requests",
+            timestamp: now,
+            hash: hashEvidence({ total: changeList.length, approved: approved.length }),
+            framework: "ISO27001",
+            controlId: "A.12.1.4",
+            source: "servicenow/change_request",
+            status: "unknown",
+            data: { changeCount: changeList.length, approvedCount: approved.length },
+            metadata: { instance: config.extra?.instance || "" },
+        });
+        const problems = await this.fetchApi(config, "/table/problem?sysparm_limit=100&sysparm_fields=number,state,priority,known_error").catch(() => ({ result: [] }));
+        const problemList = (problems.result || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "snow-problems",
+            timestamp: now,
+            hash: hashEvidence({ total: problemList.length }),
+            framework: "ISO27001",
+            controlId: "A.12.1.4",
+            source: "servicenow/problem",
+            status: "unknown",
+            data: { problemCount: problemList.length },
+            metadata: { instance: config.extra?.instance || "" },
+        });
+        const cmdb = await this.fetchApi(config, "/table/cmdb_ci?sysparm_limit=100&sysparm_fields=name,sys_class_name,operational_status").catch(() => ({ result: [] }));
+        const cmdbList = (cmdb.result || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "snow-configuration",
+            timestamp: now,
+            hash: hashEvidence({ total: cmdbList.length }),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "servicenow/cmdb_ci",
+            status: "unknown",
+            data: { ciCount: cmdbList.length },
+            metadata: { instance: config.extra?.instance || "" },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/SlackConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class SlackConnector implements IntegrationConnector {
+    readonly id = "slack";
+    readonly name = "Slack";
+    readonly category: "communication";
+    readonly authType: "bearer_token";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/SlackConnector.js

@@ -0,0 +1,109 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "slack-workspace",
+        name: "Workspace Settings",
+        description: "Fetch Slack workspace security and compliance settings",
+        evidenceCategories: ["configuration", "access_control"],
+    },
+    {
+        id: "slack-apps",
+        name: "App Installations",
+        description: "Fetch installed apps and their permissions",
+        evidenceCategories: ["access_control", "third_party_management"],
+    },
+    {
+        id: "slack-channels",
+        name: "Channel Access",
+        description: "Fetch channel privacy and access controls",
+        evidenceCategories: ["access_control", "data_protection"],
+    },
+];
+export class SlackConnector {
+    id = "slack";
+    name = "Slack";
+    category = "communication";
+    authType = "bearer_token";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001"];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://slack.com/api";
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: { Authorization: `Bearer ${config.apiToken}` },
+        });
+        if (!resp.ok)
+            throw new Error(`Slack API ${resp.status}: ${resp.statusText}`);
+        const data = (await resp.json());
+        if (data.ok === false)
+            throw new Error(`Slack error: ${data.error}`);
+        return data;
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/auth.test");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const team = await this.fetchApi(config, "/team.info");
+        const teamData = (team.team || {});
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "slack-workspace",
+            timestamp: now,
+            hash: hashEvidence(team),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "slack/team.info",
+            status: "compliant",
+            data: {
+                teamId: teamData.id,
+                teamName: teamData.name,
+                domain: teamData.domain,
+                emailDomain: teamData.email_domain,
+            },
+            metadata: { workspace: String(teamData.domain || "") },
+        });
+        const apps = await this.fetchApi(config, "/apps.permissions.list").catch(() => ({
+            scopes: [],
+        }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "slack-apps",
+            timestamp: now,
+            hash: hashEvidence(apps),
+            framework: "ISO27001",
+            controlId: "A.14.2.5",
+            source: "slack/apps.permissions.list",
+            status: "unknown",
+            data: { appScopes: apps.scopes },
+            metadata: { workspace: String(teamData.domain || "") },
+        });
+        const channels = await this.fetchApi(config, "/conversations.list?types=public_channel,private_channel&limit=200").catch(() => ({
+            channels: [],
+        }));
+        const channelList = (channels.channels || []);
+        const privateChannels = channelList.filter((c) => c.is_private === true);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "slack-channels",
+            timestamp: now,
+            hash: hashEvidence({ total: channelList.length, private: privateChannels.length }),
+            framework: "SOC2",
+            controlId: "CC6.4",
+            source: "slack/conversations.list",
+            status: "unknown",
+            data: { totalChannels: channelList.length, privateChannels: privateChannels.length },
+            metadata: { workspace: String(teamData.domain || "") },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/SnowflakeConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class SnowflakeConnector implements IntegrationConnector {
+    readonly id = "snowflake";
+    readonly name = "Snowflake";
+    readonly category: "data_warehouse";
+    readonly authType: "basic_auth";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private querySnowflake;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/SnowflakeConnector.js

@@ -0,0 +1,105 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "sf-access-policies",
+        name: "Access Policies",
+        description: "Fetch Snowflake access policies and role hierarchy",
+        evidenceCategories: ["access_control"],
+    },
+    {
+        id: "sf-query-history",
+        name: "Query History",
+        description: "Fetch query history for data access auditing",
+        evidenceCategories: ["audit", "data_access"],
+    },
+    {
+        id: "sf-data-access",
+        name: "Data Access Logs",
+        description: "Fetch COPY history and data loading access logs",
+        evidenceCategories: ["data_protection", "logging"],
+    },
+];
+export class SnowflakeConnector {
+    id = "snowflake";
+    name = "Snowflake";
+    category = "data_warehouse";
+    authType = "basic_auth";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "HIPAA"];
+    async querySnowflake(config, sql) {
+        const account = config.extra?.account || "your-account";
+        const resp = await fetch(`https://${account}.snowflakecomputing.com/api/v2/statements`, {
+            method: "POST",
+            headers: {
+                Authorization: `Basic ${Buffer.from(`${config.clientId}:${config.apiToken}`).toString("base64")}`,
+                "Content-Type": "application/json",
+                "X-Snowflake-Database": config.extra?.database || "MAIN",
+                "X-Snowflake-Schema": config.extra?.schema || "PUBLIC",
+                "X-Snowflake-Role": config.extra?.role || "ACCOUNTADMIN",
+            },
+            body: JSON.stringify({ statement: sql, timeout: 30 }),
+        });
+        if (!resp.ok)
+            throw new Error(`Snowflake ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.querySnowflake(config, "SELECT CURRENT_VERSION()");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const policies = await this.querySnowflake(config, "SELECT * FROM information_schema.policy_references WHERE POLICY_KIND = 'ROW_ACCESS_POLICY'").catch(() => ({ result: { rowset: [] } }));
+        const policyRowset = (policies.result?.rowset || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "sf-access-policies",
+            timestamp: now,
+            hash: hashEvidence({ policyCount: policyRowset.length }),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "snowflake/policy_references",
+            status: "unknown",
+            data: { policies: policyRowset },
+            metadata: { account: config.extra?.account || "" },
+        });
+        const queries = await this.querySnowflake(config, "SELECT query_text, user_name, start_time FROM table(information_schema.query_history(limit => 100)) ORDER BY start_time DESC").catch(() => ({ result: { rowset: [] } }));
+        const queryRowset = (queries.result?.rowset || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "sf-query-history",
+            timestamp: now,
+            hash: hashEvidence({ queryCount: queryRowset.length }),
+            framework: "SOC2",
+            controlId: "CC7.1",
+            source: "snowflake/query_history",
+            status: "unknown",
+            data: { queryCount: queryRowset.length },
+            metadata: { account: config.extra?.account || "" },
+        });
+        const copyHistory = await this.querySnowflake(config, "SELECT * FROM table(information_schema.copy_history(table_name => '%%', start_time => dateadd(day, -7, current_timestamp())))").catch(() => ({ result: { rowset: [] } }));
+        const copyRowset = (copyHistory.result?.rowset || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "sf-data-access",
+            timestamp: now,
+            hash: hashEvidence({ copyOperations: copyRowset.length }),
+            framework: "ISO27001",
+            controlId: "A.12.4.1",
+            source: "snowflake/copy_history",
+            status: "unknown",
+            data: { copyOperations: copyRowset.length },
+            metadata: { account: config.extra?.account || "" },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/SnykConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class SnykConnector implements IntegrationConnector {
+    readonly id = "snyk";
+    readonly name = "Snyk";
+    readonly category: "vulnerability";
+    readonly authType: "bearer_token";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}