@grc-claw/integration-marketplace 0.8.0

package/dist/connectors/ConfluenceConnector.js

@@ -0,0 +1,101 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "confluence-spaces",
+        name: "Spaces",
+        description: "Fetch Confluence spaces and their configurations",
+        evidenceCategories: ["documentation", "configuration"],
+    },
+    {
+        id: "confluence-pages",
+        name: "Pages",
+        description: "Fetch recently updated pages for policy and procedure documentation evidence",
+        evidenceCategories: ["documentation", "policy_management"],
+    },
+    {
+        id: "confluence-permissions",
+        name: "Space Permissions",
+        description: "Fetch space-level permission and access configurations",
+        evidenceCategories: ["access_control", "data_protection"],
+    },
+];
+export class ConfluenceConnector {
+    id = "confluence";
+    name = "Confluence";
+    category = "documentation";
+    authType = "bearer_token";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF"];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://api.atlassian.com/ex/confluence";
+        const cloudId = config.extra?.cloudId || "";
+        const resp = await fetch(`${base}/wiki/api/v2${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                Accept: "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Confluence API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/space?limit=1");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const spaces = await this.fetchApi(config, "/space?limit=50").catch(() => ({ results: [] }));
+        const spaceList = (spaces.results || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "confluence-spaces",
+            timestamp: now,
+            hash: hashEvidence({ spaceCount: spaceList.length }),
+            framework: "ISO27001",
+            controlId: "A.7.2.2",
+            source: "confluence/space",
+            status: spaceList.length > 0 ? "compliant" : "non_compliant",
+            data: { spaceCount: spaceList.length },
+            metadata: { cloudId: config.extra?.cloudId || "" },
+        });
+        const pages = await this.fetchApi(config, "/pages?limit=50&sort=-modified_date").catch(() => ({ results: [] }));
+        const pageList = (pages.results || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "confluence-pages",
+            timestamp: now,
+            hash: hashEvidence({ pageCount: pageList.length }),
+            framework: "SOC2",
+            controlId: "CC7.1",
+            source: "confluence/pages",
+            status: "unknown",
+            data: { pageCount: pageList.length },
+            metadata: { cloudId: config.extra?.cloudId || "" },
+        });
+        const permissions = await this.fetchApi(config, "/space?limit=50").catch(() => ({ results: [] }));
+        const permList = (permissions.results || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "confluence-permissions",
+            timestamp: now,
+            hash: hashEvidence({ spaceCount: permList.length }),
+            framework: "ISO27001",
+            controlId: "A.9.1.2",
+            source: "confluence/permissions",
+            status: "unknown",
+            data: { spaceCount: permList.length },
+            metadata: { cloudId: config.extra?.cloudId || "" },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/ConstantContactConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class ConstantContactConnector implements IntegrationConnector {
+    readonly id = "constantcontact";
+    readonly name = "Constant Contact";
+    readonly category: "communication";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/ConstantContactConnector.js

@@ -0,0 +1,70 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "constantcontact-contacts",
+        name: "Contact Lists",
+        description: "Fetch Constant Contact contact lists and segmentation data",
+        evidenceCategories: ["data_protection", "configuration"],
+    },
+    {
+        id: "constantcontact-security",
+        name: "Account Security",
+        description: "Fetch Constant Contact API key permissions and user access controls",
+        evidenceCategories: ["access_control", "audit"],
+    },
+    {
+        id: "constantcontact-campaigns",
+        name: "Campaign Performance",
+        description: "Fetch email campaign delivery and engagement metrics",
+        evidenceCategories: ["monitoring", "configuration"],
+    },
+];
+export class ConstantContactConnector {
+    id = "constantcontact";
+    name = "Constant Contact";
+    category = "communication";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001"];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://api.constantcontact.com/v2";
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Constant Contact API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/accounts?limit=1");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const lists = await this.fetchApi(config, "/lists?limit=100").catch(() => ({ lists: [] }));
+        const listList = (lists.lists || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "constantcontact-contacts",
+            timestamp: now,
+            hash: hashEvidence({ listCount: listList.length }),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "constantcontact/lists",
+            status: "unknown",
+            data: { contactListCount: listList.length },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/CouchDBConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class CouchDBConnector implements IntegrationConnector {
+    readonly id = "couchdb";
+    readonly name = "Apache CouchDB";
+    readonly category: "data_warehouse";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/CouchDBConnector.js

@@ -0,0 +1,69 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "couchdb-databases",
+        name: "CouchDB Databases",
+        description: "Fetch CouchDB database configurations and replication status",
+        evidenceCategories: ["data_protection", "cloud_configuration"],
+    },
+    {
+        id: "couchdb-security",
+        name: "Security Configurations",
+        description: "Fetch CouchDB authentication, CORS settings, and admin accounts",
+        evidenceCategories: ["access_control", "configuration"],
+    },
+    {
+        id: "couchdb-replication",
+        name: "Replication Status",
+        description: "Fetch CouchDB replication jobs and cluster synchronization health",
+        evidenceCategories: ["data_protection", "availability"],
+    },
+];
+export class CouchDBConnector {
+    id = "couchdb";
+    name = "Apache CouchDB";
+    category = "data_warehouse";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF"];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://api.couchdb.example.com";
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`CouchDB API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/_membership");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const membership = await this.fetchApi(config, "/_membership").catch(() => ({}));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "couchdb-databases",
+            timestamp: now,
+            hash: hashEvidence(membership),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "couchdb/membership",
+            status: "unknown",
+            data: { connected: true },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/CrowdStrikeConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class CrowdStrikeConnector implements IntegrationConnector {
+    readonly id = "crowdstrike";
+    readonly name = "CrowdStrike Falcon";
+    readonly category: "endpoint";
+    readonly authType: "oauth2";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private getAccessToken;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/CrowdStrikeConnector.js

@@ -0,0 +1,86 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "cs-device-posture",
+        name: "Device Posture",
+        description: "Fetch CrowdStrike device posture assessments and compliance",
+        evidenceCategories: ["endpoint_security", "device_management"],
+    },
+    {
+        id: "cs-threat-detections",
+        name: "Threat Detections",
+        description: "Fetch CrowdStrike Falcon threat detections",
+        evidenceCategories: ["threat_detection", "incident_management"],
+    },
+];
+export class CrowdStrikeConnector {
+    id = "crowdstrike";
+    name = "CrowdStrike Falcon";
+    category = "endpoint";
+    authType = "oauth2";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF"];
+    async getAccessToken(config) {
+        const resp = await fetch("https://api.crowdstrike.com/oauth2/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                client_id: config.clientId || "",
+                client_secret: config.clientSecret || "",
+            }),
+        });
+        if (!resp.ok)
+            throw new Error(`CrowdStrike token ${resp.status}`);
+        const data = (await resp.json());
+        return data.access_token;
+    }
+    async testConnection(config) {
+        try {
+            const token = await this.getAccessToken(config);
+            const resp = await fetch("https://api.crowdstrike.com/devices/queries/devices/v1?limit=1", {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            return resp.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const token = await this.getAccessToken(config);
+        const headers = { Authorization: `Bearer ${token}` };
+        const devices = await fetch("https://api.crowdstrike.com/devices/queries/devices/v1?limit=100", { headers }).then((r) => r.json());
+        const deviceIds = (devices.resources || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "cs-device-posture",
+            timestamp: now,
+            hash: hashEvidence({ deviceCount: deviceIds.length }),
+            framework: "SOC2",
+            controlId: "CC6.8",
+            source: "crowdstrike/devices",
+            status: deviceIds.length > 0 ? "compliant" : "non_compliant",
+            data: { deviceCount: deviceIds.length },
+            metadata: {},
+        });
+        const detections = await fetch("https://api.crowdstrike.com/detects/queries/detects/v1?limit=100&sort=created_timestamp|desc", { headers }).then((r) => r.json());
+        const detectionIds = (detections.resources || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "cs-threat-detections",
+            timestamp: now,
+            hash: hashEvidence({ detectionCount: detectionIds.length }),
+            framework: "SOC2",
+            controlId: "CC7.2",
+            source: "crowdstrike/detects",
+            status: "unknown",
+            data: { detectionCount: detectionIds.length },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/CrowdStrikeFalconConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class CrowdStrikeFalconConnector implements IntegrationConnector {
+    readonly id = "crowdstrike-falcon";
+    readonly name = "CrowdStrike Falcon";
+    readonly category: "endpoint";
+    readonly authType: "oauth2";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private getAccessToken;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/CrowdStrikeFalconConnector.js

@@ -0,0 +1,92 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "crowdstrike-falcon-endpoints",
+        name: "Falcon Endpoint Protection",
+        description: "Fetch CrowdStrike Falcon endpoint detection and prevention status",
+        evidenceCategories: ["endpoint_security", "posture_assessment"],
+    },
+    {
+        id: "crowdstrike-falcon-incidents",
+        name: "Falcon Incidents",
+        description: "Fetch CrowdStrike Falcon incident detections and response actions",
+        evidenceCategories: ["vulnerability_management", "incident_management"],
+    },
+    {
+        id: "crowdstrike-falcon-policies",
+        name: "Falcon Detection Policies",
+        description: "Fetch CrowdStrike Falcon detection policy configurations and tuning",
+        evidenceCategories: ["policy_compliance", "configuration"],
+    },
+];
+export class CrowdStrikeFalconConnector {
+    id = "crowdstrike-falcon";
+    name = "CrowdStrike Falcon";
+    category = "endpoint";
+    authType = "oauth2";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF", "HIPAA", "PCI_DSS"];
+    async getAccessToken(config) {
+        const resp = await fetch("https://api.crowdstrike.com/oauth2/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                client_id: config.clientId || "",
+                client_secret: config.clientSecret || "",
+            }),
+        });
+        if (!resp.ok)
+            throw new Error(`CrowdStrike Falcon token ${resp.status}`);
+        const data = (await resp.json());
+        return data.access_token;
+    }
+    async testConnection(config) {
+        try {
+            const token = await this.getAccessToken(config);
+            const resp = await fetch("https://api.crowdstrike.com/devices/queries/devices/v1?limit=1", {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            return resp.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const token = await this.getAccessToken(config);
+        const headers = { Authorization: `Bearer ${token}` };
+        const devices = await fetch("https://api.crowdstrike.com/devices/queries/devices/v1?limit=100", { headers }).then((r) => r.json());
+        const deviceIds = (devices.resources || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "crowdstrike-falcon-endpoints",
+            timestamp: now,
+            hash: hashEvidence({ deviceCount: deviceIds.length }),
+            framework: "SOC2",
+            controlId: "CC6.8",
+            source: "crowdstrike-falcon/devices",
+            status: deviceIds.length > 0 ? "compliant" : "non_compliant",
+            data: { deviceCount: deviceIds.length },
+            metadata: {},
+        });
+        const detections = await fetch("https://api.crowdstrike.com/detects/queries/detects/v1?limit=100", { headers }).then((r) => r.json()).catch(() => ({ resources: [] }));
+        const detectIds = (detections.resources || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "crowdstrike-falcon-incidents",
+            timestamp: now,
+            hash: hashEvidence({ detectionCount: detectIds.length }),
+            framework: "ISO27001",
+            controlId: "A.12.2.1",
+            source: "crowdstrike-falcon/detections",
+            status: detectIds.length === 0 ? "compliant" : "non_compliant",
+            data: { openDetections: detectIds.length },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/CrowdStrikeSpotlightConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class CrowdStrikeSpotlightConnector implements IntegrationConnector {
+    readonly id = "crowdstrike_spotlight";
+    readonly name = "CrowdStrike Spotlight";
+    readonly category: "endpoint";
+    readonly authType: "oauth2";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private getToken;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/CrowdStrikeSpotlightConnector.js

@@ -0,0 +1,139 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "cs-spotlight-vulns",
+        name: "Spotlight Vulnerabilities",
+        description: "Fetch CrowdSpotlight vulnerability findings with risk scores",
+        evidenceCategories: ["vulnerability_management", "threat_detection"],
+    },
+    {
+        id: "cs-spotlight-cves",
+        name: "CVE Intelligence",
+        description: "Fetch CVE-based vulnerability intelligence and exploit status",
+        evidenceCategories: ["vulnerability_management", "threat_intelligence"],
+    },
+    {
+        id: "cs-spotlight-remediations",
+        name: "Remediation Recommendations",
+        description: "Fetch CrowdStrike remediation guidance and prioritized fixes",
+        evidenceCategories: ["vulnerability_management", "change_management"],
+    },
+    {
+        id: "cs-spotlight-hosts",
+        name: "Affected Hosts",
+        description: "Fetch hosts affected by Spotlight vulnerabilities",
+        evidenceCategories: ["asset_management", "vulnerability_management"],
+    },
+];
+export class CrowdStrikeSpotlightConnector {
+    id = "crowdstrike_spotlight";
+    name = "CrowdStrike Spotlight";
+    category = "endpoint";
+    authType = "oauth2";
+    capabilities = capabilities;
+    frameworks = [
+        "SOC2",
+        "ISO27001",
+        "NIST_CSF",
+        "PCI_DSS",
+    ];
+    async getToken(config) {
+        const base = config.baseUrl || "https://api.crowdstrike.com";
+        const resp = await fetch(`${base}/oauth2/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                client_id: config.clientId || "",
+                client_secret: config.clientSecret || "",
+            }),
+        });
+        const data = (await resp.json());
+        return data.access_token;
+    }
+    async testConnection(config) {
+        try {
+            const token = await this.getToken(config);
+            const base = config.baseUrl || "https://api.crowdstrike.com";
+            const resp = await fetch(`${base}/spotlight/queries/vulnerabilities/v1?limit=1`, {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            return resp.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const token = await this.getToken(config);
+        const base = config.baseUrl || "https://api.crowdstrike.com";
+        const headers = { Authorization: `Bearer ${token}` };
+        const vulnQuery = await fetch(`${base}/spotlight/queries/vulnerabilities/v1?limit=100&filter=severity:%27Critical%27+OR+severity:%27High%27`, { headers })
+            .then((r) => r.json())
+            .catch(() => ({ resources: [] }));
+        const vulnResources = Array.isArray(vulnQuery.resources) ? vulnQuery.resources : [];
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "cs-spotlight-vulns",
+            timestamp: now,
+            hash: hashEvidence(vulnQuery),
+            framework: "SOC2",
+            controlId: "CC6.6",
+            source: "crowdstrike/spotlight/vulnerabilities",
+            status: vulnResources.length === 0 ? "compliant" : "non_compliant",
+            data: { criticalHighVulns: vulnResources.length },
+            metadata: {},
+        });
+        const cveIntel = await fetch(`${base}/spotlight/queries/vulnerabilities/v1?limit=20&filter=cve.id:!%27%27`, { headers })
+            .then((r) => r.json())
+            .catch(() => ({ resources: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "cs-spotlight-cves",
+            timestamp: now,
+            hash: hashEvidence(cveIntel),
+            framework: "NIST_CSF",
+            controlId: "ID.RA",
+            source: "crowdstrike/spotlight/cve-intel",
+            status: "compliant",
+            data: { cveFindings: Array.isArray(cveIntel.resources) ? cveIntel.resources.length : 0 },
+            metadata: {},
+        });
+        const remediations = await fetch(`${base}/spotlight/queries/vulnerabilities/v1?limit=50&filter=remediation.guidance:!%27%27`, { headers })
+            .then((r) => r.json())
+            .catch(() => ({ resources: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "cs-spotlight-remediations",
+            timestamp: now,
+            hash: hashEvidence(remediations),
+            framework: "ISO27001",
+            controlId: "A.12.6.1",
+            source: "crowdstrike/spotlight/remediations",
+            status: "compliant",
+            data: { remediationsAvailable: Array.isArray(remediations.resources) ? remediations.resources.length : 0 },
+            metadata: {},
+        });
+        const affectedHosts = await fetch(`${base}/spotlight/queries/vulnerabilities/v1?limit=1&filter=host_info.hostname:!%27%27`, { headers })
+            .then((r) => r.json())
+            .catch(() => ({ resources: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "cs-spotlight-hosts",
+            timestamp: now,
+            hash: hashEvidence(affectedHosts),
+            framework: "PCI_DSS",
+            controlId: "2.2.1",
+            source: "crowdstrike/spotlight/affected-hosts",
+            status: "compliant",
+            data: { hostsWithVulns: Array.isArray(affectedHosts.resources) ? affectedHosts.resources.length : 0 },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/CyberArkConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class CyberArkConnector implements IntegrationConnector {
+    readonly id = "cyberark";
+    readonly name = "CyberArk";
+    readonly category: "identity";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}