@x12i/memorix-format 1.0.0

package/docs/memorix-format-for-dummies-association-corrections.md

@@ -0,0 +1,113 @@
+# Corrections To Association Guidance In Memorix Format For Dummies
+
+This document records required fixes to association guidance in `ebooks/memorix-format-for-dummies.pdf`. The PDF's **Chapter 5** (vulnerability discovery/decisions case file) teaches a **direct content join** model that is incorrect.
+
+---
+
+## Core correction
+
+Association is always **snapshot-first**, then **content by matched snapshot `recordId`**:
+
+```text
+source snapshot (join value from data / identifier / identity)
+  → match target *-snapshots collection
+  → take matched snapshot recordId
+  → fetch discovery / analysis / decisions by record-id link field
+  → copy flat content.data into associated<ObjectType><ContentType>
+```
+
+**Never** join a source snapshot directly to a non-snapshot collection by business keys such as `data.assetIp`.
+
+---
+
+## Chapter-by-chapter fixes
+
+### Cover / Chapter 0 — Vulnerability patch framing
+
+**Incorrect:** The vulnerability patch wires `vulnerabilities-snapshots` directly to `vulnerabilities-discovery` / `vulnerabilities-decisions` by `data.assetIp`.
+
+**Correct:** The patch enriches `vulnerabilities-snapshots` using snapshot-mediated resolution: match snapshots first (including same-object `vulnerabilities-snapshots`), then fetch discovery/decisions content linked to the matched snapshot `recordId`.
+
+### Chapter 4 — Core association rules
+
+**Add before naming and payload rules:**
+
+> Record-to-record association always resolves through snapshots. Non-snapshot collections (`discovery`, `analysis`, `decisions`, …) are fetched only after a snapshot match yields a target `recordId`. Associated content is never the source of truth for the link.
+
+### Chapter 5 — Vulnerability discovery/decisions case file (full rewrite)
+
+Replace the direct-join walkthrough with:
+
+1. Read source `vulnerabilities-snapshots.data.assetIp`.
+2. Match target `vulnerabilities-snapshots` by snapshot paths such as `data.assetIp`, `concept.identifier`, or `identity`.
+3. Take matched target snapshot `recordId`.
+4. Fetch `vulnerabilities-discovery` / `vulnerabilities-decisions` by a record-id link field such as `data.sourceRecordId`, `concept.identifier.recordId`, or root `recordId`.
+5. Copy flat `content.data` into `associatedVulnerabilitiesDiscovery` / `associatedVulnerabilitiesDecisions`.
+
+Payload rules for this pilot:
+
+- Flat copied `data` only
+- No nested `data` wrapper
+- No inline `recordId` on items
+- No `_system.association` metadata
+
+### Chapter 9 — Checklist and glossary
+
+**Checklist additions:**
+
+- [ ] Snapshot match collection is `*-snapshots`
+- [ ] Content fetch uses `recordId` link paths, not business-key joins on content
+- [ ] `_system.association.toProperty` refers to the snapshot match path
+
+**Glossary correction:**
+
+| Term | Incorrect PDF usage | Correct definition |
+|------|---------------------|-------------------|
+| Association key | Business field on content collection | Join path on source snapshot used to match target snapshots |
+| Linked collection | Content collection joined directly | Snapshot match collection + optional content collection fetched by `recordId` |
+
+---
+
+## Replacement example (vulnerability discovery/decisions)
+
+```markdown
+1. Read source `vulnerabilities-snapshots.data.assetIp`.
+2. Match target `vulnerabilities-snapshots` by snapshot paths such as `data.assetIp`, `concept.identifier`, or `identity`.
+3. Take matched target snapshot `recordId`.
+4. Fetch `vulnerabilities-discovery` / `vulnerabilities-decisions` by a record-id link field such as `data.sourceRecordId`, `concept.identifier.recordId`, or root `recordId`.
+5. Copy flat `content.data` into `associatedVulnerabilitiesDiscovery` / `associatedVulnerabilitiesDecisions`.
+```
+
+---
+
+## Incorrect vs correct
+
+| Aspect | Incorrect (PDF Chapter 5) | Correct |
+|--------|---------------------------|---------|
+| Join path | `vulnerabilities-snapshots.data.assetIp` → `vulnerabilities-discovery.data.assetIp` | `vulnerabilities-snapshots.data.assetIp` → `vulnerabilities-snapshots` (snapshot match) → `recordId` → `vulnerabilities-discovery` (by `concept.identifier.recordId`) |
+| Phase count | One-phase direct content join | Two-phase: snapshot match, then content fetch |
+| Same-object rule | Exception allowing direct snapshot→content | Same-object still matches snapshots first |
+| Bridge pattern | Implicit direct join | Explicit `match` + `content` in associator rules |
+
+---
+
+## Associator rule shape (reference)
+
+```json
+{
+  "sourceJoinPaths": ["data.assetIp"],
+  "match": {
+    "collection": "vulnerabilities-snapshots",
+    "joinPaths": ["data.assetIp", "concept.identifier.assetIp", "identity", "recordId"]
+  },
+  "content": {
+    "collection": "vulnerabilities-discovery",
+    "contentType": "discovery",
+    "linkPaths": ["concept.identifier.recordId", "data.sourceRecordId", "recordId"]
+  },
+  "associatedProperty": "associatedVulnerabilitiesDiscovery",
+  "payload": { "format": "v2", "source": "target.data", "includeRecordId": false }
+}
+```
+
+See also: [memorix-pipeline/docs/association-format.md](../memorix-pipeline/docs/association-format.md)

package/docs/memorix-format.md

@@ -0,0 +1,282 @@
+# Memorix Record Format
+
+> Packaged as **`@x12i/memorix-format`** (types, validator, CLI).
+
+## Purpose
+
+A Memorix record is a structured memory object: a stable envelope around domain payload, with clear separation between business data, derived analytics, external enrichment, AI insights, and cross-entity references.
+
+The clean format removes the legacy 2.0 `identity` block, root-level `lifecycle`, `sourceFacts`, and redundant `concept.name`. Every field belongs in exactly one place.
+
+---
+
+## Record envelope
+
+```ts
+type MemorixRecord = {
+  _id?: string;              // MongoDB document id (storage only)
+  recordId: string;          // stable logical record id
+  concept: MemorixConcept;
+  data: JsonObject;           // required — see data bucket rules
+
+  analytics?: JsonObject;
+  enrichment?: JsonObject;
+  insights?: JsonObject;
+  associatedData?: JsonObject[];
+  associatedDiscovery?: JsonObject[];
+  associatedAnalysis?: JsonObject[];
+  associatedSiblings?: JsonObject[];
+  associatedChildren?: JsonObject[];
+  // associated<CustomName>?: JsonObject[];
+
+  _system?: MemorixSystemBlock;
+};
+```
+
+Associated properties use the reserved `associated` prefix. **Legacy** names (`associatedData`, `associatedDiscovery`, …) remain on existing data. **v2** names follow `associated<ObjectType><ContentType>` — see [memorix-pipeline/docs/association-format.md](../memorix-pipeline/docs/association-format.md).
+
+The root holds only `_id`, `recordId`, `concept`, the data buckets, associated properties, and `_system`. No other top-level keys.
+
+### Removed from 2.0
+
+| Legacy field | Fate |
+|---|---|
+| `identity` (`target`, `targetId`, `objectType`, `contentType`, `version`) | Dropped; `recordId` is root-level |
+| Root `lifecycle` (`createdAt`, `modifiedAt`, `capturedAt`, `status`) | Replaced by `_system.lifecycle` event array |
+| `sourceFacts` | Promoted into `data` or `associatedData` |
+| `concept.name` | Dropped; use `concept.identifier` + `concept.title` |
+| Root `_graphRuns` / `_jobTypeRuns` | Moved to `_system` |
+
+`objectType` is implied by collection name. `contentType` and `version` were constant across all records and are not carried forward.
+
+---
+
+## Data And Associated Buckets
+
+Every piece of business data lives in **exactly one** of these buckets (plus the envelope fields above):
+
+| Bucket | Contents |
+|---|---|
+| **`data`** | Raw facts about the entity itself — IP, severity, session timeout, zone name |
+| **`analytics`** | Rollups and counts computed from other records — vulnerability totals, affected-asset counts |
+| **`enrichment`** | External, sourced values joined from feeds or prior systems — CVSS, EPSS, KEV, VPR |
+| **`insights`** | AI-generated judgments — exploitability, potential impact, classification, risk narratives |
+| **`associatedData`** | Linked snapshot/data content copied from associated records' `data` payloads |
+| **`associatedDiscovery`** | Linked discovery content copied from associated records' `data` payloads |
+| **`associatedAnalysis`** | Linked analysis content copied from associated records' `data` payloads |
+| **`associatedSiblings`** | Self-association: other snapshot `data` payloads sharing the same join key (e.g. assets by shared `data.subnetCidr` in `data.subnetCidrs[]`); each item includes linked `recordId`. Default cap: 99 items. |
+| **`associatedChildren`** | Parent-to-child association (subnets only today): asset `data` payloads whose `data.subnetCidrs` contains the subnet `data.cidr`; each item includes linked `recordId`. Default cap: 99 items. |
+
+Do not duplicate a value across buckets. When reshaping legacy records, promote `sourceFacts` values into the correct bucket rather than wrapping them.
+
+Associated properties are always arrays and are omitted when no linked data was resolved. Do not write empty arrays, and do not switch between object and array shape. Custom associated content uses the same root-level pattern: `associatedCompliance`, `associatedBusinessContext`, `associatedExposure`, and so on.
+
+**Ranked top associations** use `associatedTop<ObjectType><ContentType>` (e.g. `associatedTopVulnerabilitiesAnalysis`). Candidates are sorted by the linked object type’s `importanceIndicator` (or rule `rankBy`) and capped (default 5). See [association-format.md](../memorix-pipeline/docs/association-format.md).
+
+**Enrichment associations** use `associated<ObjectType>Enrichment` (e.g. `associatedVulnerabilitiesGroupsEnrichment`). They copy the linked snapshot’s root `enrichment` bucket (external feed values: CVSS, EPSS, KEV, compositeScore) as a flat object array — not a separate `*-enrichment` content collection. See [association-format.md](../memorix-pipeline/docs/association-format.md).
+
+Associated items contain the linked record's `data` payload (or `enrichment` / `concept` / root property for the specialized forms). Legacy associations may also include inline `recordId` and `contentType`; v2 associations store traceability in optional item-level `_system.association` metadata. Do not wrap associated items with redundant envelope keys; failure and diagnostic details belong in `<objectType>-failed` collections instead.
+
+**Associated property metadata:** Consumers should prefer Memorix associated-property metadata when available (`@x12i/memorix-associator`). Associated snapshot properties are exposed through managed descriptors plus discovery. Until metadata is available, or when reading older/custom records, fall back to the prefix rule: root-level fields on snapshots whose names start with `associated`. The well-known names `associatedData`, `associatedDiscovery`, and `associatedAnalysis` are conventions only — the complete set comes from metadata plus the `associated*` fallback rule.
+
+When a field can naturally have more than one value, processing contracts use array shape even if the current record has only one value. For assets, `data.assetIps`, `data.subnets[]`, and `data.subnetCidrs[]` are the normalized join fields. Each `data.subnets[]` entry is a structured subnet object `{ cidr, networkAddress, prefixLength, mask }` — one resolved subnet per asset IP, chosen by longest-prefix match. Multiple entries exist only when multiple asset IPs resolve to different canonical subnets. `data.subnetCidrs[]` is the derived flat join index used by association rules.
+
+For subnets, `data.cidr` is the canonical join key. Subnet records also carry structured `data.subnet` plus flattened `data.networkAddress`, `data.prefixLength`, and `data.mask`, all derived deterministically from `data.cidr`.
+
+Assets also carry `data.assetIpClassifications[]` when topology resolution runs. Each item records `{ ip, scope, confidence, reason, reasoning, matchedSubnetCidr?, matchedSubnetIp? }`, where `scope` is `inside`, `outside`, or `unknown`. Convenience arrays `data.insideAssetIps`, `data.outsideAssetIps`, and `data.unknownAssetIps` may be populated from those classifications. `inside` means the IP either matched canonical topology with high confidence, or is RFC1918 private space without a matching topology CIDR with medium confidence. `outside` means public/non-RFC1918 with no topology match. `unknown` covers invalid, loopback, and link-local addresses.
+
+---
+
+## Concept
+
+```ts
+type MemorixConcept = {
+  identifier: {
+    kind: string;
+    /** Primary value — property name matches `kind`. */
+    [kind: string]: string;
+    /**
+     * Deterministic join key: `kind` first, then the kind-named value,
+     * then any other scalar fields in sorted key order, joined by `:`.
+     * See `.operational/fr/2026-07-09-memorix-format-identifier-key.md`.
+     */
+    identifierKey: string;
+  };
+  title: string;
+};
+```
+
+`identifier` is a discriminated object: `kind` names the id type, and a same-named property holds the value. `identifierKey` is required on every identifier (root and nested concepts).
+
+```json
+"concept": {
+  "identifier": {
+    "kind": "ipAddress",
+    "ipAddress": "10.150.68.31",
+    "identifierKey": "ipAddress:10.150.68.31"
+  },
+  "title": "BGAK105-002"
+}
+```
+
+`concept.name` is not used. `title` is the human-readable display name; it may differ from the identifier value (e.g. hostname vs IP).
+
+### Identifier `kind` by object type
+
+| Object type | `kind` | Example identifier |
+|---|---|---|
+| Assets | `ipAddress` | `{"kind":"ipAddress","ipAddress":"10.150.68.31","identifierKey":"ipAddress:10.150.68.31"}` |
+| Vulnerability groups | `pluginId` (preferred) or `cveId` | `{"kind":"pluginId","pluginId":"142594","identifierKey":"pluginId:142594"}` |
+| Vulnerability instances (host findings) | `hostVulnerability` | `{"kind":"hostVulnerability","hostVulnerability":"10.100.18.64::pluginId:160208","assetIp":"10.100.18.64","vulnerabilityGroupIdentifierKey":"pluginId:160208","identifierKey":"hostVulnerability:10.100.18.64::pluginId:160208:10.100.18.64:pluginId:160208"}` |
+| Subnets | `cidr` (canonical) or `subnetIp` (legacy, quarantined) | `{"kind":"cidr","cidr":"1.1.1.5/32","identifierKey":"cidr:1.1.1.5/32"}` |
+| Topology zones | `zoneName` | `{"kind":"zoneName","zoneName":"LAN","identifierKey":"zoneName:LAN"}` |
+| Topology VRs | `vrName` | `{"kind":"vrName","vrName":"VR-UPB-MED","identifierKey":"vrName:VR-UPB-MED"}` |
+| Users | `sessionKey` | `{"kind":"sessionKey","sessionKey":"med\\cap\|10.39.44.205\|UIA","identifierKey":"sessionKey:med\\cap\|10.39.44.205\|UIA"}` |
+
+Vulnerability groups are **plugin-scoped**: prefer `pluginId` whenever present. Use `cveId` only when there is no plugin id — the same CVE can appear on multiple plugins, so CVE is not a unique group key. Keep `data.cveId` for display/filter. Vulnerability **instances** also denormalize `vulnerabilityGroupIdentifierKey` at the record root for queries.
+
+---
+
+## `_system`
+
+System metadata — provenance, processing history, graph-run stamps — never belongs in `data` or the other business buckets.
+
+```ts
+type MemorixLifecycleEvent = { process: string; processedAt: string };
+
+type MemorixSystemBlock = {
+  lifecycle?: MemorixLifecycleEvent[];
+  _graphRuns?: Record<string, GraphRunEntry>;
+  _jobTypeRuns?: Record<string, GraphRunEntry>;
+  provenance?: JsonObject;
+  // other system keys as needed (memorix, scoping, …)
+};
+```
+
+### Lifecycle
+
+Root-level `lifecycle` is gone. Processing events live at `_system.lifecycle`:
+
+```json
+"lifecycle": [
+  { "process": "enriched", "processedAt": "2026-04-05T08:01:15.511Z" }
+]
+```
+
+- Each entry is `{ process, processedAt }`.
+- When `createdAt`, `modifiedAt`, and `capturedAt` are identical (the common snapshot case), emit a single `"enriched"` event rather than three duplicate timestamps.
+- Distinct events (e.g. a future re-enrichment) append as additional array entries.
+- `status` is not stored; it was uniformly `"active"` across all records.
+- Omit `lifecycle` entirely when no timestamp is known (e.g. Users records with no source dates) — do not emit an empty array.
+
+`_system.provenance.enrichedAt` (when present) is separate provenance metadata about a prior enrichment step, not a substitute for `lifecycle`.
+
+### Graph and job-type runs
+
+`_graphRuns` and `_jobTypeRuns` are stored under `_system`, keyed by graph id and sanitized job-type id respectively. Each entry tracks execution status, timestamps, and result metadata. These fields are written by Memorix writer during graph execution and are not part of the domain payload.
+
+Dot-path references: `_system._graphRuns.<graphId>`, `_system._jobTypeRuns.<jobTypeId>`.
+
+---
+
+## Complete example
+
+Vulnerability group record showing all envelope fields and every bucket:
+
+```json
+{
+  "_id": "6914a132880706529ece3da1",
+  "recordId": "69d216ed358778e93215787e",
+  "concept": {
+    "identifier": {
+      "kind": "pluginId",
+      "pluginId": "142594",
+      "identifierKey": "pluginId:142594"
+    },
+    "title": "Oracle WebLogic Server RCE (CVE-2020-14882)"
+  },
+  "data": {
+    "name": "Oracle WebLogic Server RCE (CVE-2020-14882)",
+    "vulnerability_family": "Web Servers",
+    "vulnerability_type": "cve",
+    "cveId": "CVE-2020-14882",
+    "severity": "critical",
+    "pluginId": 142594
+  },
+  "associatedData": [
+    { "assetIp": "10.100.24.31", "hostname": "BGAK105-002" },
+    { "assetIp": "10.100.24.41", "hostname": "BGAK105-003" }
+  ],
+  "analytics": {
+    "affectedAssets": { "total": 2 }
+  },
+  "enrichment": {
+    "cvss": {
+      "baseScore": 9.8,
+      "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    "epss": { "epss": 0.94454, "percentile": 0.99992 },
+    "kev": { "isKnownExploited": true },
+    "compositeScore": 0.974,
+    "riskLevel": "CRITICAL",
+    "vprScore": "9.2"
+  },
+  "insights": {
+    "exploitability": { "level": "HIGH", "confidence": 0.92 },
+    "potentialImpact": { "level": "CRITICAL", "confidence": 0.88 }
+  },
+  "_system": {
+    "provenance": {
+      "sourceId": "6914a132880706529ece3da1",
+      "snapshotRecordId": "69d216ed358778e93215787e",
+      "source": {
+        "database": "poc-data-mapping",
+        "collection": "vulnerabilities-groups-rawdata",
+        "server": "default"
+      }
+    },
+    "lifecycle": [
+      { "process": "enriched", "processedAt": "2026-04-05T08:01:15.511Z" }
+    ],
+    "_graphRuns": {
+      "graph-t92669z": {
+        "status": "done",
+        "startedAt": "2026-07-01T23:41:23.233Z",
+        "completedAt": "2026-07-01T23:42:05.604Z",
+        "lastJobRunId": "f7af7f7a-0c5c-4825-9282-d39bea836682",
+        "attempts": 1,
+        "result": {
+          "target": "entity",
+          "entityName": "vulnerabilities-groups",
+          "contentType": "inferences",
+          "recordId": "75de9244-8d44-43b8-8698-7e22621b1087"
+        }
+      }
+    }
+  }
+}
+```
+
+Not every record populates every bucket. Assets typically have `data`, `analytics`, and optionally `insights` and `associatedData`; only vulnerability groups carry `enrichment` today.
+
+---
+
+## Migration notes
+
+- Reshape scripts (`scripts/memorix-neo-reshape/transform-20-to-clean.mjs`) convert 2.0 envelopes to this format.
+- Fixed POC reference data lives in `temp/data-and-format-fixes/` with per-collection change notes in `CHANGES.md`.
+- Type definitions: `memorix-descriptors/src/record/envelope.ts`.
+
+### Subnets / topology subnets merge (2026-07-05)
+
+`topology-subnets` was merged into `subnets`. Canonical `subnets` records are topology
+CIDR segments (`concept.identifier.kind: "cidr"`), spread across content types
+`snapshots` / `core` / `inferences` / `scoped`. A subset of the old, pre-merge `subnets`
+records (subnetIp-only, no CIDR) had zero overlap with any canonical CIDR and were
+quarantined rather than dropped — they live in the `legacy` content type
+(`subnets-legacy`), keyed by `concept.identifier.kind: "subnetIp"`, with an explicit
+`_system.quarantine` block (`legacy: true`, `status`, `reason`) marking them as not
+eligible for `assets -> subnets` joins. `assets.data.subnetCidr` (precomputed via CIDR
+containment against canonical `subnets-snapshots`) is the join key used for that
+relation — see `scripts/memorix-subnets-merge/` for the migration and backfill scripts,
+and `temp/part-b-implementation-design-2026-07-05T06-20-00Z.md` for the full design.

package/docs/memorix-workflow-format.md

@@ -0,0 +1,114 @@
+# Memorix Workflow Format (`memorix-workflow/1`)
+
+## Purpose
+
+Versioned JSON for **product workflow state** attached to a subject object via the
+content type `workflow` (collection `{objectType}-workflow`).
+
+This is **not** inventory (snapshots), **not** AI analysis/decision, and **not**
+vendor audit telemetry. It stores human/product work state: assignee, status,
+append-only audit of UI mutations, and close-via tasks.
+
+Catalog `memorix-workflow-field-schemas` defines which scalar/enum fields may
+appear under `data` (beyond reserved `audit` / `tasks`).
+
+## Collection postfix
+
+| Descriptor content-type key | Postfix | Collection | Cardinality |
+|---|---|---|---|
+| `workflow` | `workflow` | `{objectType}-workflow` | `1:1` |
+
+Join key: same `recordId` as the subject entity’s canonical snapshot.
+
+## Canonical document
+
+```ts
+type MemorixWorkflowDocument = {
+  format: "memorix-workflow/1";
+  recordId: string;
+  objectType: string;
+  data: {
+    /** Catalog-driven properties (validated against field schema). */
+    [fieldKey: string]: unknown;
+    /** Format-reserved — API-managed only. */
+    audit: WorkflowAuditEntry[];
+    tasks: WorkflowTask[];
+  };
+  modifiedAt: string;
+  modifiedBy?: string;
+};
+
+type WorkflowAuditEntry = {
+  id: string;
+  at: string;
+  actor: string;
+  action: string;
+  field?: string;
+  previous?: unknown;
+  next?: unknown;
+};
+
+type WorkflowTask = {
+  id: string;
+  dk: string;
+  title: string;
+  via?: string;
+  status: "open" | "done" | "cancelled";
+  createdAt: string;
+  createdBy: string;
+  completedAt?: string;
+};
+```
+
+## Rules
+
+1. Custom fields under `data` **must** be declared in `memorix-workflow-field-schemas`
+   for that `objectType` (when `rejectUnknownFields` is true, default).
+2. `audit` and `tasks` are **never** writable via generic field PATCH — dedicated
+   API endpoints only.
+3. Enum values are stored as English **keys**; UI maps display labels.
+4. Do not put workflow state on snapshots, analysis, or decision documents.
+
+## Field schema catalog
+
+Catalog id: `memorix-workflow-field-schemas`
+
+One item per object type (natural id e.g. `assets-workflow-fields`):
+
+```ts
+type WorkflowFieldSchemaItem = {
+  id: string;
+  objectType: string;
+  contentType: "workflow";
+  rejectUnknownFields: boolean;
+  fields: WorkflowFieldDef[];
+};
+
+type WorkflowFieldDef = {
+  key: string;
+  label: string;
+  description?: string;
+  valueType: "string" | "number" | "boolean" | "datetime" | "enum";
+  enumValues?: string[];
+  required?: boolean;
+  writable?: boolean;
+  defaultValue?: unknown;
+  list?: boolean;
+  item?: boolean;
+  section?: string;
+  order?: number;
+};
+```
+
+## API
+
+See `@x12i/memorix-workflow-api` — catalog-driven HTTP for schema list/get/upsert,
+overview aggregation, document list/get/ensure, field PATCH, audit list, and
+tasks CRUD. UI: `@x12i/memorix-workflow-ui`.
+
+List/overview notes:
+
+- `GET /api/workflow/schemas` — discover object types with field schemas
+- `GET /api/workflow/:objectType` — list existing workflow overlays (slim `list:true` projection)
+- `GET /api/workflow/overview` — totals and recent audit activity
+- `GET .../audit` and `GET .../tasks` are read-only (404 when the document is missing; they do not create)

package/examples/invalid-record.json

@@ -0,0 +1,11 @@
+{
+  "recordId": "",
+  "concept": {
+    "name": "legacy-name-only"
+  },
+  "data": "not-an-object",
+  "identity": {
+    "version": "memorix-record.2.0"
+  },
+  "analytics": []
+}

package/examples/valid-snapshot.json

@@ -0,0 +1,38 @@
+{
+  "_id": "6914a132880706529ece3da1",
+  "recordId": "69d216ed358778e93215787e",
+  "concept": {
+    "identifier": {
+      "kind": "pluginId",
+      "pluginId": "142594",
+      "identifierKey": "pluginId:142594"
+    },
+    "title": "Oracle WebLogic Server RCE (CVE-2020-14882)"
+  },
+  "data": {
+    "name": "Oracle WebLogic Server RCE (CVE-2020-14882)",
+    "cveId": "CVE-2020-14882",
+    "severity": "critical",
+    "pluginId": 142594
+  },
+  "associatedData": [
+    { "assetIp": "10.100.24.31", "hostname": "BGAK105-002" },
+    { "assetIp": "10.100.24.41", "hostname": "BGAK105-003" }
+  ],
+  "analytics": {
+    "affectedAssets": { "total": 2 }
+  },
+  "enrichment": {
+    "cvss": { "baseScore": 9.8 },
+    "epss": { "epss": 0.94454 },
+    "kev": { "isKnownExploited": true }
+  },
+  "insights": {
+    "exploitability": { "level": "HIGH", "confidence": 0.92 }
+  },
+  "_system": {
+    "lifecycle": [
+      { "process": "enriched", "processedAt": "2026-04-05T08:01:15.511Z" }
+    ]
+  }
+}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@x12i/memorix-format",
+  "version": "1.0.0",
+  "description": "Memorix record format: types, validator, CLI, and specification docs.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "memorix-format": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./validate": {
+      "types": "./dist/validate.d.ts",
+      "import": "./dist/validate.js"
+    },
+    "./types": {
+      "types": "./dist/types.d.ts",
+      "import": "./dist/types.js"
+    }
+  },
+  "files": [
+    "dist",
+    "docs",
+    "examples",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "prebuild": "rm -rf dist",
+    "build": "tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "typescript": "^5.6.0",
+    "vitest": "^2.1.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/x12i/memorix-mono-repo.git",
+    "directory": "memorix-format"
+  },
+  "keywords": [
+    "memorix",
+    "format",
+    "validator",
+    "record",
+    "exellix"
+  ],
+  "license": "exellix-license"
+}