Frameworks pack
A canonical control library where an `implements` claim without a linkable proof pointer fails to typecheck.
What it is
frameworks-pack is Caisson's clean-room control library: defineFramework builds three own-authored packs (SOC 2 TSC, HIPAA Security, and the EU AI Act's high-risk obligations) plus four native regime crosswalks. It depends on and re-exports oscal-spine for the NIST SP 800-53 crosswalk, pinned reference catalog, and shared crosswalk contracts, preserving its existing public imports.
What ships in the module
Browser-safe entry points
Import @caisson/frameworks-pack/browser inside a client bundle for the control model, the three packs, the regime crosswalks, the SoA computation, and the browser half of the OSCAL surface together, or ./registry for the model alone. The main entry keeps the complete node-capable surface, and every browser-entry export is also on it.
Fail-closed control registry
defineControl and defineFramework run every control through Zod's parseStrict at author time: canonicalControlId must match the uppercase dotted-segment pattern, crosswalk references must be unique on (framework, reference), and control ids must be unique within a Framework, an authoring mistake throws at module load, not at render time.
Three own-authored framework packs, canonical ids shared across them
soc2Tsc, hipaaSecurity, and euAiAct are separately exported Framework catalogs. Where a control is the same underlying requirement across frameworks (GOVERNANCE.SECURITY-RESPONSIBILITY appears in both soc2Tsc and hipaaSecurity) the pack reuses the exact canonical id verbatim instead of minting a duplicate, so one control can be crosswalked from more than one regime.
Claim honesty enforced by the type, not a lint rule
RegimeCrosswalkRow is a Zod discriminatedUnion on claim: the implementsRow branch requires a proof: ProofPointer field: an implements row with no linkable test/CI/live-verification/oscal-conformance artifact does not typecheck. Every mapsToRow, by contrast, carries no proof field to fabricate.
NIST SP 800-53 rev5, vendored byte-exact and hash-pinned
The re-exported NIST_CATALOG_PIN from oscal-spine records the upstream commit SHA, the catalog's own OSCAL version (1.2.2), and a SHA-256 of the committed JSON bytes. extractControlIds walks base controls plus nested enhancements so every nist80053Crosswalk reference is checked against a real catalog id.
NIST IR 8278A relationship vocabulary, capped at maps-to structurally
nist80053Crosswalk rows carry NIST's own relationship (subset-of/intersects-with/equal/superset-of/not-related-to), rationale, and strength fields (the vocabulary an OLIR mapping actually uses) while defineNist80053Crosswalk throws if any row is missing its required canonicalControlId, and no row on this crosswalk can ever carry a proof field, so it can never promote to implements.
/**
* An assertive row: the mechanism implements a technical control a live repo artifact proves. `proof`
* is REQUIRED (the discriminated union makes an `implements` row without it a type error).
*/
const implementsRow = strictObject({
claim: z.literal("implements"),
...rowBase,
proof: ProofPointer,
});
/** A conservative row: the mechanism maps to (shares a domain with) the requirement. No proof. */
const mapsToRow = strictObject({
claim: z.literal("maps-to"),
...rowBase,
});
/** One crosswalk row — assertive (`implements` + proof) or conservative (`maps-to`), by `claim`. */
export const RegimeCrosswalkRow = z.discriminatedUnion("claim", [
implementsRow,
mapsToRow,
]);
export type RegimeCrosswalkRow = z.infer<typeof RegimeCrosswalkRow>;- implementsRow spreads proof: ProofPointer into the schema itself, an implements claim with no linkable test/CI/live-verification artifact fails validation, it isn't a reviewer's judgment call.
- mapsToRow has no proof field at all, so a conservative row literally cannot carry a fabricated pointer, the two branches of RegimeCrosswalkRow enforce honesty by omission as much as by requirement.
- ...rowBase spreads buyerResponsibility into both branches, so every row (implements or maps-to) is required to state what Caisson does not cover.