Toolkit

Private preparation: During private preparation, the implemented toolkit remains in the secani/oscal repository with private visibility. @secani/oscal is not published to npm, so the installation commands below are future release previews.

@secani/oscal is a storage-independent TypeScript toolkit for parsing, validating, and structurally analyzing OSCAL 1.2.2 documents.

Install preview

These commands reserve the planned package name. They will not work until npm publication is separately approved.

pnpm add @secani/oscal
npm install @secani/oscal
yarn add @secani/oscal
bun add @secani/oscal

Process OSCAL JSON

The implemented API accepts document bytes, detects the OSCAL model from its root key, and validates the parsed JSON against the corresponding official schema.

import { createOscalProcessor } from "@secani/oscal";

const processor = createOscalProcessor();
const bytes = new TextEncoder().encode(jsonSource);
const document = processor.parse(bytes, "json");
const result = processor.validate(document.json);

if (!result.ok) {
  console.error(result.errors);
}

processor.parse returns the detected model type, OSCAL version, and parsed document. processor.validate returns { ok, errors }; schema findings are data-quality results rather than thrown exceptions.

Supported models

The toolkit covers all eight OSCAL 1.2.2 models:

• Catalog
• Profile
• Component Definition
• System Security Plan
• Assessment Plan
• Assessment Results
• Plan of Action and Milestones
• Mapping Collection

Validation boundaries

Validation uses precompiled, eval-free JSON Schema validators derived from the official NIST OSCAL 1.2.2 schemas. It catches structural issues such as missing required properties and invalid types. It does not yet claim complete OSCAL metaschema constraint validation, UUID uniqueness, full reference integrity, or profile resolution.

JSON parsing and serialization are implemented now. The API reserves "xml" and "yaml" format values, but using either currently throws OscalError with code ERR_UNSUPPORTED_FORMAT.

Package surfaces

• @secani/oscal contains the curated stable processor, key conversion, reference extraction, indexing, and measurement APIs.
• @secani/oscal/testing provides schema-valid compact fixtures and a fake processor for downstream tests.
• @secani/oscal/unstable exposes evolving registry, path, and semantic-graph helpers without semantic-versioning guarantees.
• @secani/oscal/schemas/*.json exposes the eight checked-in NIST JSON Schemas.

The toolkit has zero runtime dependencies. Its validators are generated ahead of time and committed as ordinary JavaScript. The current root ESM bundle is approximately 4.5 MB because it includes all eight validators; model-level lazy loading is a future optimization.

Repository status

The future open-source repository is named secani/oscal. It remains private, so there is intentionally no public repository link yet. Public visibility and npm publication require separate reviews after licensing, security, provenance, CI, and package audits are complete.

The separate oscal-cli and secani/oscal-skills projects remain future work and are not included in the current toolkit.