frameworks-pack

@caisson/frameworks-pack ships a typed, Zod-strict canonical-control model plus three own-authored control packs, SOC 2 Trust Services Criteria, HIPAA Security, and the EU AI Act, with every control crosswalked to the external framework's requirement ids.

Clean-room authorship: crosswalk references are pointers to an external requirement id (CC6.1, 164.312(a)(2)(i), Art. 9), never copied control text. The catalog is hand-authored Caisson prose; the citation is a fact, not a transform of the AICPA/NIST/regulation text.

Install

bun add @caisson/frameworks-pack

What it does

• Canonical control model: defineControl / defineFramework builders validate a control set at author time and fail closed on the first violation (duplicate id, empty statement, malformed crosswalk reference).
• Three framework packs: soc2Tsc, hipaaSecurity, euAiAct: pre-built, validated Framework catalogs, each control mapped to its external requirement id.
• Named-regime crosswalks: soc2Crosswalk, pciDssCrosswalk, gdprCrosswalk (and regimeCrosswalks, all three together): the buyer-facing mapping from a regime's control id to the concrete Caisson package/mechanism that addresses it, with a claim of either "maps-to" (domain overlap) or "implements" (proven by a live test or CI artifact, and only ever used when a proof pointer backs it), and a required buyerResponsibility column naming what Caisson does not cover.

Quickstart

import { soc2Tsc, hipaaSecurity, euAiAct } from "@caisson/frameworks-pack";

// Each pack is a validated Framework: { id, title, version, description, controls[] }.
for (const control of soc2Tsc.controls) {
  console.log(
    control.id,
    control.crosswalk.map((c) => c.reference),
  );
}

Author your own control on top of the same model:

import { defineControl } from "@caisson/frameworks-pack";

const control = defineControl({
  id: "ACCESS-CONTROL.MFA",
  title: "Multi-factor authentication for privileged access",
  family: "Access Control",
  statement: "Privileged accounts require a second authentication factor.",
  crosswalk: [{ framework: "SOC2-TSC", reference: "CC6.1" }],
});

Regime crosswalks

import { soc2Crosswalk, exportRegimeCrosswalk } from "@caisson/frameworks-pack";

// exportRegimeCrosswalk embeds the disclaimer block IN the returned artifact — a cold
// reader opening the export never sees a mapping row without the scope language beside it.
const artifact = exportRegimeCrosswalk(soc2Crosswalk);

Composition

Depends on @caisson/kernel plus @caisson/oscal-spine, the commercial OSCAL boundary it re-exports for source compatibility. The framework catalogs are consumed by @caisson/compliance-core, which assembles the evidence pack; oscal-spine generates the machine-readable OSCAL artifacts against those control ids. All three are members of the Compliance bundle.

License

Commercial module (LicenseRef-Caisson-Commercial), part of the Compliance bundle, also available standalone.