@its-not-rocket-science/ananke 0.1.69 → 0.5.1

package/dist/src/content/types.d.ts

@@ -0,0 +1,56 @@
+export interface ContentPackRegistry {
+    compatRange?: string;
+    [key: string]: unknown;
+}
+export interface WeaponDamageProfile {
+    surfaceFrac: number;
+    internalFrac: number;
+    structuralFrac: number;
+    bleedFactor: number;
+    penetrationBias: number;
+}
+export interface ContentWeapon {
+    id: string;
+    name: string;
+    mass_kg: number;
+    damage: WeaponDamageProfile;
+    [key: string]: unknown;
+}
+export interface ContentArmour {
+    id: string;
+    name: string;
+    mass_kg: number;
+    resist_J: number;
+    protectedDamageMul: number;
+    coverageByRegion: Record<string, number>;
+    [key: string]: unknown;
+}
+export interface ContentArchetype {
+    id: string;
+    base?: string;
+    overrides?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+export interface ContentTerrain {
+    id: string;
+    name: string;
+    tags?: string[];
+    tractionMul?: number;
+    cover?: number;
+    [key: string]: unknown;
+}
+export interface ContentPack {
+    $schema?: string;
+    name: string;
+    version: string;
+    description?: string;
+    registry?: ContentPackRegistry;
+    weapons?: ContentWeapon[];
+    armour?: ContentArmour[];
+    archetypes?: ContentArchetype[];
+    terrain?: ContentTerrain[];
+}
+export interface ContentPackValidationError {
+    path: string;
+    message: string;
+}

package/dist/src/content/types.js

@@ -0,0 +1 @@
+export {};

package/dist/src/content/validator.d.ts

@@ -0,0 +1,6 @@
+import type { ContentPack, ContentPackValidationError } from "./types.js";
+export interface ContentValidationResult {
+    schemaErrors: ContentPackValidationError[];
+    semanticWarnings: ContentPackValidationError[];
+}
+export declare function runContentSemanticChecks(pack: ContentPack): ContentPackValidationError[];

package/dist/src/content/validator.js

@@ -0,0 +1,14 @@
+export function runContentSemanticChecks(pack) {
+    const warnings = [];
+    (pack.weapons ?? []).forEach((weapon, idx) => {
+        const damage = weapon.damage;
+        const roughDamage = (damage.surfaceFrac + damage.internalFrac + damage.structuralFrac) * 1000;
+        if (roughDamage > 1000) {
+            warnings.push({
+                path: `$.weapons[${idx}].damage`,
+                message: `weapon damage > 1000 is likely wrong (score=${roughDamage.toFixed(2)})`,
+            });
+        }
+    });
+    return warnings;
+}

package/dist/src/content-pack.d.ts

@@ -1,6 +1,5 @@
 import type { WorldState } from "./sim/world.js";
-/** Current Ananke engine version — used to evaluate pack compatRange at runtime. */
-export declare const ANANKE_ENGINE_VERSION = "0.1.69";
+export { ANANKE_ENGINE_VERSION } from "./version.js";
 /** A single actionable validation failure from `validatePack`. */
 export interface PackValidationError {
     /** JSONPath-style location, e.g. `"$.weapons[2].mass_kg"`. */
@@ -135,6 +134,8 @@ export declare function semverSatisfies(version: string, range: string): boolean
  * @returns Array of `PackValidationError`.  Empty means valid.
  */
 export declare function validatePack(manifest: unknown): PackValidationError[];
+/** Compute SHA-256 for a manifest's canonical JSON with `registry.checksum` blanked. */
+export declare function computePackChecksum(manifest: AnankePackManifest): string;
 /**
  * Validate and load a pack manifest into the active catalogues.
  *

package/dist/src/content-pack.js

@@ -13,19 +13,19 @@ import { registerWeapon, registerArmour, registerArchetype } from "./catalog.js"
 import { validateScenario, loadScenario } from "./scenario.js";
 import { hashMod } from "./modding.js";
 import { registerWorldArchetype, registerWorldItem } from "./world-factory.js";
-// ── Version constant ──────────────────────────────────────────────────────────
-// Must be kept in sync with package.json "version" field.
-/** Current Ananke engine version — used to evaluate pack compatRange at runtime. */
-export const ANANKE_ENGINE_VERSION = "0.1.69";
+// ── Runtime version constant ─────────────────────────────────────────────────────
+export { ANANKE_ENGINE_VERSION } from "./version.js";
+import { ANANKE_ENGINE_VERSION } from "./version.js";
 // ── Semver utilities ──────────────────────────────────────────────────────────
 // Lightweight range evaluator — no external dependencies.
 // Supports: >=X.Y.Z  >X.Y.Z  <=X.Y.Z  <X.Y.Z  =X.Y.Z  ^X.Y.Z  ~X.Y.Z
 // Short forms X.Y and X treated as X.Y.0 and X.0.0 respectively.
 // Compound ranges (space-separated) require all constraints to match.
 function parseSemverTuple(v) {
-    const parts = v.replace(/^v/, "").split(".").map(Number);
-    if (parts.some(isNaN))
+    const raw = v.trim().replace(/^v/, "");
+    if (!/^\d+(\.\d+){0,2}$/.test(raw))
         return null;
+    const parts = raw.split(".").map(Number);
     const [major = 0, minor = 0, patch = 0] = parts;
     return [major, minor, patch];
 }
@@ -44,13 +44,46 @@ export function semverSatisfies(version, range) {
     const ver = parseSemverTuple(version);
     if (!ver)
         return false;
-    const constraints = range.trim().split(/\s+/);
+    const trimmed = range.trim();
+    if (trimmed.length === 0)
+        return false;
+    const constraints = trimmed.split(/\s+/);
     for (const constraint of constraints) {
+        if (constraint.length === 0)
+            return false;
         if (!evalConstraint(ver, constraint.trim()))
             return false;
     }
     return true;
 }
+function isSemverRange(range) {
+    const trimmed = range.trim();
+    if (trimmed.length === 0)
+        return false;
+    const constraints = trimmed.split(/\s+/);
+    for (const constraint of constraints) {
+        if (constraint.length === 0)
+            return false;
+        if (constraint.startsWith("^") || constraint.startsWith("~")) {
+            if (parseSemverTuple(constraint.slice(1)) === null)
+                return false;
+            continue;
+        }
+        if (constraint.startsWith(">=") ||
+            constraint.startsWith("<=") ||
+            constraint.startsWith(">") ||
+            constraint.startsWith("<") ||
+            constraint.startsWith("=")) {
+            const offset = constraint.startsWith(">=") || constraint.startsWith("<=") ? 2 : 1;
+            if (parseSemverTuple(constraint.slice(offset)) === null)
+                return false;
+            continue;
+        }
+        if (parseSemverTuple(constraint) === null)
+            return false;
+    }
+    return true;
+}
 function evalConstraint(ver, c) {
     // Caret: ^X.Y.Z — compatible within the leftmost non-zero component.
     // ^1.2.3 → >=1.2.3 <2.0.0 (major locked when major > 0)
@@ -125,9 +158,23 @@ export function validatePack(manifest) {
     }
     // Required: version (semver-ish)
     if (typeof m["version"] !== "string" ||
-        !/^\d+\.\d+(\.\d+)?$/.test(m["version"])) {
+        parseSemverTuple(m["version"]) === null) {
         errors.push({ path: "$.version", message: 'must be a semver string like "1.0.0" or "1.0"' });
     }
+    if (m["anankeVersion"] !== undefined) {
+        if (typeof m["anankeVersion"] !== "string") {
+            errors.push({ path: "$.anankeVersion", message: "must be a semver range string" });
+        }
+        else if (!isSemverRange(m["anankeVersion"])) {
+            errors.push({ path: "$.anankeVersion", message: "must be a valid semver range expression" });
+        }
+        else if (!semverSatisfies(ANANKE_ENGINE_VERSION, m["anankeVersion"])) {
+            errors.push({
+                path: "$.anankeVersion",
+                message: `engine version ${ANANKE_ENGINE_VERSION} does not satisfy range "${m["anankeVersion"]}"`,
+            });
+        }
+    }
     // Optional: registry block
     if (m["registry"] !== undefined) {
         if (typeof m["registry"] !== "object" || m["registry"] === null || Array.isArray(m["registry"])) {
@@ -140,6 +187,9 @@ export function validatePack(manifest) {
                 if (typeof reg["compatRange"] !== "string") {
                     errors.push({ path: "$.registry.compatRange", message: "must be a string" });
                 }
+                else if (!isSemverRange(reg["compatRange"])) {
+                    errors.push({ path: "$.registry.compatRange", message: "must be a valid semver range expression" });
+                }
                 else if (!semverSatisfies(ANANKE_ENGINE_VERSION, reg["compatRange"])) {
                     errors.push({
                         path: "$.registry.compatRange",
@@ -205,20 +255,39 @@ export function validatePack(manifest) {
     }
     // Validate weapon entries
     if (Array.isArray(m["weapons"])) {
+        const ids = new Set();
         for (let i = 0; i < m["weapons"].length; i++) {
             const w = m["weapons"][i];
             errors.push(...validateWeaponEntry(w, i));
+            if (typeof w === "object" && w !== null) {
+                const id = w["id"];
+                if (typeof id === "string") {
+                    if (ids.has(id))
+                        errors.push({ path: `$.weapons[${i}].id`, message: `duplicate weapon id "${id}"` });
+                    ids.add(id);
+                }
+            }
         }
     }
     // Validate armour entries
     if (Array.isArray(m["armour"])) {
+        const ids = new Set();
         for (let i = 0; i < m["armour"].length; i++) {
             const a = m["armour"][i];
             errors.push(...validateArmourEntry(a, i));
+            if (typeof a === "object" && a !== null) {
+                const id = a["id"];
+                if (typeof id === "string") {
+                    if (ids.has(id))
+                        errors.push({ path: `$.armour[${i}].id`, message: `duplicate armour id "${id}"` });
+                    ids.add(id);
+                }
+            }
         }
     }
     // Validate archetype entries (minimal — full validation is in registerArchetype)
     if (Array.isArray(m["archetypes"])) {
+        const ids = new Set();
         for (let i = 0; i < m["archetypes"].length; i++) {
             const arch = m["archetypes"][i];
             if (typeof arch !== "object" || arch === null) {
@@ -229,19 +298,130 @@ export function validatePack(manifest) {
             if (typeof o["id"] !== "string" || o["id"].trim() === "") {
                 errors.push({ path: `$.archetypes[${i}].id`, message: "must be a non-empty string" });
             }
+            else {
+                if (ids.has(o["id"]))
+                    errors.push({ path: `$.archetypes[${i}].id`, message: `duplicate archetype id "${o["id"]}"` });
+                ids.add(o["id"]);
+            }
         }
     }
     // Validate scenario entries via existing validateScenario
     if (Array.isArray(m["scenarios"])) {
+        const ids = new Set();
         for (let i = 0; i < m["scenarios"].length; i++) {
-            const scenErrors = validateScenario(m["scenarios"][i]);
+            const scenario = m["scenarios"][i];
+            if (typeof scenario === "object" && scenario !== null) {
+                const id = scenario["id"];
+                if (typeof id === "string") {
+                    if (ids.has(id))
+                        errors.push({ path: `$.scenarios[${i}].id`, message: `duplicate scenario id "${id}"` });
+                    ids.add(id);
+                }
+            }
+            const scenErrors = validateScenario(scenario);
             for (const msg of scenErrors) {
                 errors.push({ path: `$.scenarios[${i}]`, message: msg });
             }
         }
     }
+    const checksum = m["registry"]?.["checksum"];
+    if (typeof checksum === "string" && /^[0-9a-f]{64}$/.test(checksum)) {
+        const computed = computePackChecksum(m);
+        if (computed !== checksum) {
+            errors.push({
+                path: "$.registry.checksum",
+                message: `checksum mismatch: expected "${checksum}" but computed "${computed}"`,
+            });
+        }
+    }
     return errors;
 }
+/** Compute SHA-256 for a manifest's canonical JSON with `registry.checksum` blanked. */
+export function computePackChecksum(manifest) {
+    const clone = JSON.parse(JSON.stringify(manifest));
+    const registry = clone["registry"];
+    if (typeof registry === "object" && registry !== null && !Array.isArray(registry)) {
+        registry["checksum"] = "";
+    }
+    return sha256Hex(JSON.stringify(clone));
+}
+/** Portable SHA-256 (sync) used by pack checksum validation in both Node and browser/worker runtimes. */
+function sha256Hex(input) {
+    const bytes = new TextEncoder().encode(input);
+    const K = [
+        0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+        0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+        0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+        0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+        0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+        0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+    ];
+    const H = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19];
+    const paddedLength = (((bytes.length + 9 + 63) >> 6) << 6);
+    const data = new Uint8Array(paddedLength);
+    data.set(bytes);
+    data[bytes.length] = 0x80;
+    const bitLenHi = Math.floor((bytes.length * 8) / 0x100000000);
+    const bitLenLo = (bytes.length * 8) >>> 0;
+    data[paddedLength - 8] = (bitLenHi >>> 24) & 0xff;
+    data[paddedLength - 7] = (bitLenHi >>> 16) & 0xff;
+    data[paddedLength - 6] = (bitLenHi >>> 8) & 0xff;
+    data[paddedLength - 5] = bitLenHi & 0xff;
+    data[paddedLength - 4] = (bitLenLo >>> 24) & 0xff;
+    data[paddedLength - 3] = (bitLenLo >>> 16) & 0xff;
+    data[paddedLength - 2] = (bitLenLo >>> 8) & 0xff;
+    data[paddedLength - 1] = bitLenLo & 0xff;
+    const w = new Uint32Array(64);
+    for (let i = 0; i < data.length; i += 64) {
+        for (let t = 0; t < 16; t += 1) {
+            const j = i + (t << 2);
+            w[t] = ((data[j] << 24) | (data[j + 1] << 16) | (data[j + 2] << 8) | data[j + 3]) >>> 0;
+        }
+        for (let t = 16; t < 64; t += 1) {
+            const s0 = (rotR(w[t - 15], 7) ^ rotR(w[t - 15], 18) ^ (w[t - 15] >>> 3)) >>> 0;
+            const s1 = (rotR(w[t - 2], 17) ^ rotR(w[t - 2], 19) ^ (w[t - 2] >>> 10)) >>> 0;
+            w[t] = (w[t - 16] + s0 + w[t - 7] + s1) >>> 0;
+        }
+        let a = H[0];
+        let b = H[1];
+        let c = H[2];
+        let d = H[3];
+        let e = H[4];
+        let f = H[5];
+        let g = H[6];
+        let h = H[7];
+        for (let t = 0; t < 64; t += 1) {
+            const S1 = (rotR(e, 6) ^ rotR(e, 11) ^ rotR(e, 25)) >>> 0;
+            const ch = ((e & f) ^ (~e & g)) >>> 0;
+            const temp1 = (h + S1 + ch + K[t] + w[t]) >>> 0;
+            const S0 = (rotR(a, 2) ^ rotR(a, 13) ^ rotR(a, 22)) >>> 0;
+            const maj = ((a & b) ^ (a & c) ^ (b & c)) >>> 0;
+            const temp2 = (S0 + maj) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + temp1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (temp1 + temp2) >>> 0;
+        }
+        H[0] = (H[0] + a) >>> 0;
+        H[1] = (H[1] + b) >>> 0;
+        H[2] = (H[2] + c) >>> 0;
+        H[3] = (H[3] + d) >>> 0;
+        H[4] = (H[4] + e) >>> 0;
+        H[5] = (H[5] + f) >>> 0;
+        H[6] = (H[6] + g) >>> 0;
+        H[7] = (H[7] + h) >>> 0;
+    }
+    return H.map((n) => n.toString(16).padStart(8, "0")).join("");
+}
+function rotR(x, n) {
+    return (x >>> n) | (x << (32 - n));
+}
 function validateWeaponEntry(w, i) {
     const errors = [];
     if (typeof w !== "object" || w === null) {
@@ -297,9 +477,22 @@ function validateArmourEntry(a, i) {
  */
 export function loadPack(manifest) {
     const packId = `${manifest.name}@${manifest.version}`;
+    const fingerprint = hashMod(manifest);
     // Already loaded — return stored summary
     const existing = _packs.get(packId);
     if (existing !== undefined) {
+        if (existing.fingerprint !== fingerprint) {
+            return {
+                packId,
+                registeredIds: [],
+                scenarioIds: [],
+                fingerprint: existing.fingerprint,
+                errors: [{
+                        path: "$",
+                        message: `pack "${packId}" already loaded with different content fingerprint (${existing.fingerprint} != ${fingerprint})`,
+                    }],
+            };
+        }
         return {
             packId,
             registeredIds: existing.registeredIds,
@@ -359,7 +552,9 @@ export function loadPack(manifest) {
         scenarioMap.set(id, scen);
         scenarioIds.push(id);
     }
-    const fingerprint = hashMod(manifest);
+    if (loadErrors.length > 0) {
+        return { packId, registeredIds, scenarioIds: [], fingerprint, errors: loadErrors };
+    }
     _packs.set(packId, {
         manifest,
         registeredIds,

package/dist/src/data-governance.d.ts

@@ -0,0 +1,73 @@
+export type RegionId = string;
+export type TenantId = string;
+export interface RetentionPolicy {
+    /**
+     * Default time-to-live in milliseconds for records.
+     */
+    defaultTtlMs: number;
+}
+export interface DataEnvelope {
+    id: string;
+    tenantId: TenantId;
+    regionId: RegionId;
+    createdAtMs: number;
+    expiresAtMs: number;
+    legalHold: boolean;
+    piiDetected: boolean;
+    piiFindings: PIIFinding[];
+    payload: unknown;
+}
+export interface PIIFinding {
+    path: string;
+    kind: "email" | "phone" | "ssn" | "creditCard" | "sensitiveKey";
+}
+export interface AccessEvent {
+    timestampMs: number;
+    actor: string;
+    action: "write" | "read" | "list" | "legal_hold_set" | "legal_hold_released" | "purge";
+    tenantId: TenantId;
+    regionId: RegionId;
+    recordId?: string;
+    details?: string;
+}
+export interface IngestOptions {
+    nowMs?: number;
+    ttlMs?: number;
+    redactSensitiveFields?: boolean;
+    actor?: string;
+}
+export interface ReadOptions {
+    nowMs?: number;
+    actor?: string;
+}
+export interface ListOptions {
+    nowMs?: number;
+    actor?: string;
+}
+export interface LegalHoldOptions {
+    actor?: string;
+    nowMs?: number;
+}
+export interface TenancyModel {
+    isolation: "tenant-region-partition";
+    partitionKey: "regionId/tenantId";
+    replication: "none_cross_region";
+    accessAudit: "immutable_append_only";
+}
+export declare function buildTenancyModel(): TenancyModel;
+export declare class DataGovernanceStore {
+    private readonly retention;
+    private readonly records;
+    private readonly byPartition;
+    private readonly accessLog;
+    constructor(retention: RetentionPolicy);
+    ingest(tenantId: TenantId, regionId: RegionId, recordId: string, payload: unknown, options?: IngestOptions): DataEnvelope;
+    get(tenantId: TenantId, regionId: RegionId, recordId: string, options?: ReadOptions): DataEnvelope | undefined;
+    listByPartition(tenantId: TenantId, regionId: RegionId, options?: ListOptions): DataEnvelope[];
+    setLegalHold(tenantId: TenantId, regionId: RegionId, recordId: string, options?: LegalHoldOptions): boolean;
+    releaseLegalHold(tenantId: TenantId, regionId: RegionId, recordId: string, options?: LegalHoldOptions): boolean;
+    purgeExpired(nowMs: number, actor?: string): number;
+    getAccessLog(): readonly AccessEvent[];
+    private updateLegalHold;
+    private log;
+}

package/dist/src/data-governance.js

@@ -0,0 +1,188 @@
+export function buildTenancyModel() {
+    return {
+        isolation: "tenant-region-partition",
+        partitionKey: "regionId/tenantId",
+        replication: "none_cross_region",
+        accessAudit: "immutable_append_only",
+    };
+}
+const SENSITIVE_KEY_PATTERN = /(email|phone|ssn|social|taxid|credit|card|password|secret|token|passport)/i;
+const EMAIL_PATTERN = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i;
+const PHONE_PATTERN = /\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/;
+const SSN_PATTERN = /\b\d{3}-\d{2}-\d{4}\b/;
+const CREDIT_CARD_PATTERN = /\b(?:\d[ -]*?){13,19}\b/;
+function detectFindingsFromString(path, value) {
+    const findings = [];
+    if (EMAIL_PATTERN.test(value))
+        findings.push({ path, kind: "email" });
+    if (PHONE_PATTERN.test(value))
+        findings.push({ path, kind: "phone" });
+    if (SSN_PATTERN.test(value))
+        findings.push({ path, kind: "ssn" });
+    if (CREDIT_CARD_PATTERN.test(value))
+        findings.push({ path, kind: "creditCard" });
+    return findings;
+}
+function scanValue(path, value, redactSensitiveFields) {
+    if (typeof value === "string") {
+        const findings = detectFindingsFromString(path, value);
+        return {
+            findings,
+            redactedValue: redactSensitiveFields && findings.length > 0 ? "[REDACTED]" : value,
+        };
+    }
+    if (Array.isArray(value)) {
+        const findings = [];
+        const redacted = value.map((entry, idx) => {
+            const child = scanValue(`${path}[${idx}]`, entry, redactSensitiveFields);
+            findings.push(...child.findings);
+            return child.redactedValue;
+        });
+        return { findings, redactedValue: redacted };
+    }
+    if (value !== null && typeof value === "object") {
+        const findings = [];
+        const out = {};
+        for (const [key, childValue] of Object.entries(value)) {
+            const childPath = path ? `${path}.${key}` : key;
+            const keyIsSensitive = SENSITIVE_KEY_PATTERN.test(key);
+            if (keyIsSensitive) {
+                findings.push({ path: childPath, kind: "sensitiveKey" });
+            }
+            if (keyIsSensitive && redactSensitiveFields) {
+                out[key] = "[REDACTED]";
+                continue;
+            }
+            const child = scanValue(childPath, childValue, redactSensitiveFields);
+            findings.push(...child.findings);
+            out[key] = child.redactedValue;
+        }
+        return { findings, redactedValue: out };
+    }
+    return { findings: [], redactedValue: value };
+}
+function makeRecordKey(tenantId, regionId, id) {
+    return `${regionId}::${tenantId}::${id}`;
+}
+export class DataGovernanceStore {
+    retention;
+    records = new Map();
+    byPartition = new Map();
+    accessLog = [];
+    constructor(retention) {
+        if (retention.defaultTtlMs <= 0) {
+            throw new Error("defaultTtlMs must be > 0");
+        }
+        this.retention = retention;
+    }
+    ingest(tenantId, regionId, recordId, payload, options = {}) {
+        const nowMs = options.nowMs ?? Date.now();
+        const ttlMs = options.ttlMs ?? this.retention.defaultTtlMs;
+        const redactSensitiveFields = options.redactSensitiveFields ?? true;
+        const actor = options.actor ?? "system";
+        const scanned = scanValue("", payload, redactSensitiveFields);
+        const envelope = {
+            id: recordId,
+            tenantId,
+            regionId,
+            createdAtMs: nowMs,
+            expiresAtMs: nowMs + ttlMs,
+            legalHold: false,
+            piiDetected: scanned.findings.length > 0,
+            piiFindings: scanned.findings,
+            payload: scanned.redactedValue,
+        };
+        const key = makeRecordKey(tenantId, regionId, recordId);
+        this.records.set(key, envelope);
+        const partition = `${regionId}/${tenantId}`;
+        let set = this.byPartition.get(partition);
+        if (!set) {
+            set = new Set();
+            this.byPartition.set(partition, set);
+        }
+        set.add(key);
+        this.log({ timestampMs: nowMs, actor, action: "write", tenantId, regionId, recordId });
+        return envelope;
+    }
+    get(tenantId, regionId, recordId, options = {}) {
+        const nowMs = options.nowMs ?? Date.now();
+        const actor = options.actor ?? "system";
+        const key = makeRecordKey(tenantId, regionId, recordId);
+        const record = this.records.get(key);
+        this.log({ timestampMs: nowMs, actor, action: "read", tenantId, regionId, recordId });
+        if (!record)
+            return undefined;
+        if (!record.legalHold && record.expiresAtMs <= nowMs)
+            return undefined;
+        return record;
+    }
+    listByPartition(tenantId, regionId, options = {}) {
+        const nowMs = options.nowMs ?? Date.now();
+        const actor = options.actor ?? "system";
+        this.log({ timestampMs: nowMs, actor, action: "list", tenantId, regionId });
+        const partition = `${regionId}/${tenantId}`;
+        const keys = this.byPartition.get(partition);
+        if (!keys)
+            return [];
+        const out = [];
+        for (const key of keys) {
+            const rec = this.records.get(key);
+            if (!rec)
+                continue;
+            if (!rec.legalHold && rec.expiresAtMs <= nowMs)
+                continue;
+            out.push(rec);
+        }
+        return out;
+    }
+    setLegalHold(tenantId, regionId, recordId, options = {}) {
+        return this.updateLegalHold(tenantId, regionId, recordId, true, options);
+    }
+    releaseLegalHold(tenantId, regionId, recordId, options = {}) {
+        return this.updateLegalHold(tenantId, regionId, recordId, false, options);
+    }
+    purgeExpired(nowMs, actor = "system") {
+        let purged = 0;
+        for (const [key, record] of this.records.entries()) {
+            if (record.legalHold || record.expiresAtMs > nowMs)
+                continue;
+            this.records.delete(key);
+            const partition = `${record.regionId}/${record.tenantId}`;
+            this.byPartition.get(partition)?.delete(key);
+            this.log({
+                timestampMs: nowMs,
+                actor,
+                action: "purge",
+                tenantId: record.tenantId,
+                regionId: record.regionId,
+                recordId: record.id,
+            });
+            purged += 1;
+        }
+        return purged;
+    }
+    getAccessLog() {
+        return this.accessLog;
+    }
+    updateLegalHold(tenantId, regionId, recordId, state, options) {
+        const nowMs = options.nowMs ?? Date.now();
+        const actor = options.actor ?? "system";
+        const key = makeRecordKey(tenantId, regionId, recordId);
+        const rec = this.records.get(key);
+        if (!rec)
+            return false;
+        rec.legalHold = state;
+        this.log({
+            timestampMs: nowMs,
+            actor,
+            action: state ? "legal_hold_set" : "legal_hold_released",
+            tenantId,
+            regionId,
+            recordId,
+        });
+        return true;
+    }
+    log(event) {
+        this.accessLog.push(event);
+    }
+}