@hazeljs/data 0.2.0-alpha.1

package/dist/data.module.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data.module.test.d.ts.map

package/dist/data.module.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.module.test.d.ts","sourceRoot":"","sources":["../src/data.module.test.ts"],"names":[],"mappings":""}

package/dist/data.module.test.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const data_module_1 = require("./data.module");
+describe('DataModule', () => {
+    describe('forRoot', () => {
+        it('returns dynamic module structure', () => {
+            const result = data_module_1.DataModule.forRoot();
+            expect(result).toHaveProperty('module', data_module_1.DataModule);
+            expect(result).toHaveProperty('providers');
+            expect(result).toHaveProperty('exports');
+            expect(Array.isArray(result.providers)).toBe(true);
+        });
+        it('includes flink config when specified', () => {
+            const result = data_module_1.DataModule.forRoot({
+                flink: { url: 'http://flink:8081', timeout: 5000 },
+            });
+            const flinkConfig = result.providers.find((p) => p && typeof p === 'object' && 'provide' in p);
+            expect(flinkConfig).toBeDefined();
+        });
+    });
+    describe('getOptions', () => {
+        it('returns last forRoot options', () => {
+            data_module_1.DataModule.forRoot({ flink: { url: 'http://custom:8081' } });
+            const opts = data_module_1.DataModule.getOptions();
+            expect(opts.flink?.url).toBe('http://custom:8081');
+        });
+    });
+});

package/dist/data.types.d.ts

@@ -0,0 +1,67 @@
+/**
+ * @hazeljs/data - Type definitions for ETL and streaming
+ */
+export interface RetryConfig {
+    attempts: number;
+    delay?: number;
+    backoff?: 'fixed' | 'exponential';
+}
+export interface DLQConfig {
+    handler: (item: unknown, error: Error, stepName: string) => void | Promise<void>;
+}
+export interface PipelineStepMetadata {
+    step: number;
+    name: string;
+    type: 'transform' | 'validate';
+    schema?: unknown;
+    /** Run step only when predicate returns true */
+    when?: (data: unknown) => boolean;
+    /** Retry configuration for this step */
+    retry?: RetryConfig;
+    /** Per-step timeout in milliseconds */
+    timeoutMs?: number;
+    /** Dead letter queue handler - called instead of throwing on failure */
+    dlq?: DLQConfig;
+}
+export interface StreamMetadata {
+    name: string;
+    source: string;
+    sink: string;
+    parallelism?: number;
+}
+export interface FlinkJobConfig {
+    jobName?: string;
+    parallelism?: number;
+    checkpointInterval?: number;
+    restartStrategy?: {
+        type: string;
+        attempts?: number;
+        delay?: number;
+    };
+    resources?: {
+        taskManagerMemory?: string;
+        jobManagerMemory?: string;
+        cpuCores?: number;
+    };
+    stateBackend?: {
+        type: string;
+        checkpointPath?: string;
+        savepointPath?: string;
+    };
+    highAvailability?: {
+        type: string;
+        zookeeperQuorum?: string;
+        clusterId?: string;
+    };
+    metrics?: {
+        reporters?: string[];
+        interval?: number;
+    };
+}
+export interface FlinkAuthConfig {
+    type: 'basic' | 'token' | 'oauth';
+    username?: string;
+    password?: string;
+    token?: string;
+}
+//# sourceMappingURL=data.types.d.ts.map

package/dist/data.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.types.d.ts","sourceRoot":"","sources":["../src/data.types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC;IAC/B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;IAClC,wCAAwC;IACxC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,gBAAgB,CAAC,EAAE;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/data.types.js

@@ -0,0 +1,5 @@
+"use strict";
+/**
+ * @hazeljs/data - Type definitions for ETL and streaming
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/decorators/index.d.ts

@@ -0,0 +1,6 @@
+export { Pipeline, getPipelineMetadata, hasPipelineMetadata, type PipelineOptions, } from './pipeline.decorator';
+export { Transform, getTransformMetadata, type TransformOptions } from './transform.decorator';
+export { Validate, getValidateMetadata, type ValidateOptions } from './validate.decorator';
+export { Stream, getStreamMetadata, hasStreamMetadata, type StreamOptions, } from './stream.decorator';
+export { Mask, Redact, Encrypt, Decrypt, getMaskMetadata, getRedactMetadata, type MaskOptions, type RedactOptions, type EncryptOptions, type DecryptOptions, } from './pii.decorator';
+//# sourceMappingURL=index.d.ts.map

package/dist/decorators/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EACL,MAAM,EACN,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,IAAI,EACJ,MAAM,EACN,OAAO,EACP,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC"}

package/dist/decorators/index.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRedactMetadata = exports.getMaskMetadata = exports.Decrypt = exports.Encrypt = exports.Redact = exports.Mask = exports.hasStreamMetadata = exports.getStreamMetadata = exports.Stream = exports.getValidateMetadata = exports.Validate = exports.getTransformMetadata = exports.Transform = exports.hasPipelineMetadata = exports.getPipelineMetadata = exports.Pipeline = void 0;
+var pipeline_decorator_1 = require("./pipeline.decorator");
+Object.defineProperty(exports, "Pipeline", { enumerable: true, get: function () { return pipeline_decorator_1.Pipeline; } });
+Object.defineProperty(exports, "getPipelineMetadata", { enumerable: true, get: function () { return pipeline_decorator_1.getPipelineMetadata; } });
+Object.defineProperty(exports, "hasPipelineMetadata", { enumerable: true, get: function () { return pipeline_decorator_1.hasPipelineMetadata; } });
+var transform_decorator_1 = require("./transform.decorator");
+Object.defineProperty(exports, "Transform", { enumerable: true, get: function () { return transform_decorator_1.Transform; } });
+Object.defineProperty(exports, "getTransformMetadata", { enumerable: true, get: function () { return transform_decorator_1.getTransformMetadata; } });
+var validate_decorator_1 = require("./validate.decorator");
+Object.defineProperty(exports, "Validate", { enumerable: true, get: function () { return validate_decorator_1.Validate; } });
+Object.defineProperty(exports, "getValidateMetadata", { enumerable: true, get: function () { return validate_decorator_1.getValidateMetadata; } });
+var stream_decorator_1 = require("./stream.decorator");
+Object.defineProperty(exports, "Stream", { enumerable: true, get: function () { return stream_decorator_1.Stream; } });
+Object.defineProperty(exports, "getStreamMetadata", { enumerable: true, get: function () { return stream_decorator_1.getStreamMetadata; } });
+Object.defineProperty(exports, "hasStreamMetadata", { enumerable: true, get: function () { return stream_decorator_1.hasStreamMetadata; } });
+var pii_decorator_1 = require("./pii.decorator");
+Object.defineProperty(exports, "Mask", { enumerable: true, get: function () { return pii_decorator_1.Mask; } });
+Object.defineProperty(exports, "Redact", { enumerable: true, get: function () { return pii_decorator_1.Redact; } });
+Object.defineProperty(exports, "Encrypt", { enumerable: true, get: function () { return pii_decorator_1.Encrypt; } });
+Object.defineProperty(exports, "Decrypt", { enumerable: true, get: function () { return pii_decorator_1.Decrypt; } });
+Object.defineProperty(exports, "getMaskMetadata", { enumerable: true, get: function () { return pii_decorator_1.getMaskMetadata; } });
+Object.defineProperty(exports, "getRedactMetadata", { enumerable: true, get: function () { return pii_decorator_1.getRedactMetadata; } });

package/dist/decorators/pii.decorator.d.ts

@@ -0,0 +1,59 @@
+import 'reflect-metadata';
+export interface MaskOptions {
+    /** Fields to mask */
+    fields: string[];
+    /** Replacement string (default: "****") */
+    replacement?: string;
+    /** Show last N characters of the value (default: 0) */
+    showLast?: number;
+}
+/**
+ * Mask specified fields before the method runs.
+ *
+ * @example
+ * @Transform({ step: 1, name: 'sanitize' })
+ * @Mask({ fields: ['email', 'ssn'] })
+ * sanitize(data: User) { return data; }
+ */
+export declare function Mask(fieldsOrOptions: string[] | MaskOptions): MethodDecorator;
+export declare function getMaskMetadata(target: object, key: string | symbol): MaskOptions | undefined;
+export interface RedactOptions {
+    fields: string[];
+}
+/**
+ * Remove specified fields entirely before the method runs.
+ *
+ * @example
+ * @Transform({ step: 2, name: 'redact' })
+ * @Redact({ fields: ['password', 'secretToken'] })
+ * redactSecrets(data: User) { return data; }
+ */
+export declare function Redact(fieldsOrOptions: string[] | RedactOptions): MethodDecorator;
+export declare function getRedactMetadata(target: object, key: string | symbol): RedactOptions | undefined;
+export interface EncryptOptions {
+    fields: string[];
+    /** 32-byte AES-256-GCM key (hex string or Buffer) */
+    key: string | Buffer;
+    /** Optional AAD (additional authenticated data) for GCM */
+    aad?: string;
+}
+export interface DecryptOptions {
+    fields: string[];
+    key: string | Buffer;
+    aad?: string;
+}
+/**
+ * AES-256-GCM encrypt specified fields before the method runs.
+ * Encrypted values are stored as "iv:authTag:ciphertext" (all hex-encoded).
+ *
+ * @example
+ * @Transform({ step: 3, name: 'encrypt-pii' })
+ * @Encrypt({ fields: ['ssn', 'dob'], key: process.env.FIELD_ENCRYPTION_KEY! })
+ * encryptPii(data: User) { return data; }
+ */
+export declare function Encrypt(options: EncryptOptions): MethodDecorator;
+/**
+ * Decrypt fields that were encrypted with @Encrypt.
+ */
+export declare function Decrypt(options: DecryptOptions): MethodDecorator;
+//# sourceMappingURL=pii.decorator.d.ts.map

package/dist/decorators/pii.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/pii.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAoB1B,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,WAAW,GAAG,eAAe,CAc7E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CAE7F;AAqCD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,aAAa,GAAG,eAAe,CAcjF;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,GAAG,SAAS,CAEjG;AAaD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qDAAqD;IACrD,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe,CAUhE;AA4BD;;GAEG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe,CAQhE"}

package/dist/decorators/pii.decorator.js

@@ -0,0 +1,197 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Mask = Mask;
+exports.getMaskMetadata = getMaskMetadata;
+exports.Redact = Redact;
+exports.getRedactMetadata = getRedactMetadata;
+exports.Encrypt = Encrypt;
+exports.Decrypt = Decrypt;
+require("reflect-metadata");
+/**
+ * PII-safety decorators for pipeline methods.
+ *
+ * These decorators run **before** the decorated method executes,
+ * modifying the data according to the specified operation.
+ *
+ * @Mask  — replaces field values with "****"
+ * @Redact — removes fields entirely
+ * @Encrypt — AES-256-GCM encrypts field values (Node.js crypto required)
+ * @Decrypt — decrypts previously encrypted values
+ */
+const MASK_METADATA_KEY = 'hazel:data:pii:mask';
+const REDACT_METADATA_KEY = 'hazel:data:pii:redact';
+const ENCRYPT_METADATA_KEY = 'hazel:data:pii:encrypt';
+/**
+ * Mask specified fields before the method runs.
+ *
+ * @example
+ * @Transform({ step: 1, name: 'sanitize' })
+ * @Mask({ fields: ['email', 'ssn'] })
+ * sanitize(data: User) { return data; }
+ */
+function Mask(fieldsOrOptions) {
+    const options = Array.isArray(fieldsOrOptions)
+        ? { fields: fieldsOrOptions }
+        : fieldsOrOptions;
+    return (target, propertyKey, descriptor) => {
+        Reflect.defineMetadata(MASK_METADATA_KEY, options, target, propertyKey);
+        const original = descriptor.value;
+        descriptor.value = function (data, ...rest) {
+            return original.call(this, applyMask(data, options), ...rest);
+        };
+        return descriptor;
+    };
+}
+function getMaskMetadata(target, key) {
+    return Reflect.getMetadata(MASK_METADATA_KEY, target, key);
+}
+function applyMask(data, options) {
+    const { fields, replacement = '****', showLast = 0 } = options;
+    if (!data || typeof data !== 'object')
+        return data;
+    const result = { ...data };
+    for (const field of fields) {
+        const parts = field.split('.');
+        maskNested(result, parts, replacement, showLast);
+    }
+    return result;
+}
+function maskNested(obj, path, replacement, showLast) {
+    if (path.length === 1) {
+        const val = obj[path[0]];
+        if (typeof val === 'string' && showLast > 0) {
+            obj[path[0]] = replacement + val.slice(-showLast);
+        }
+        else if (val !== undefined && val !== null) {
+            obj[path[0]] = replacement;
+        }
+        return;
+    }
+    const nested = obj[path[0]];
+    if (nested && typeof nested === 'object' && !Array.isArray(nested)) {
+        maskNested(nested, path.slice(1), replacement, showLast);
+    }
+}
+/**
+ * Remove specified fields entirely before the method runs.
+ *
+ * @example
+ * @Transform({ step: 2, name: 'redact' })
+ * @Redact({ fields: ['password', 'secretToken'] })
+ * redactSecrets(data: User) { return data; }
+ */
+function Redact(fieldsOrOptions) {
+    const options = Array.isArray(fieldsOrOptions)
+        ? { fields: fieldsOrOptions }
+        : fieldsOrOptions;
+    return (target, propertyKey, descriptor) => {
+        Reflect.defineMetadata(REDACT_METADATA_KEY, options, target, propertyKey);
+        const original = descriptor.value;
+        descriptor.value = function (data, ...rest) {
+            return original.call(this, applyRedact(data, options), ...rest);
+        };
+        return descriptor;
+    };
+}
+function getRedactMetadata(target, key) {
+    return Reflect.getMetadata(REDACT_METADATA_KEY, target, key);
+}
+function applyRedact(data, options) {
+    if (!data || typeof data !== 'object')
+        return data;
+    const result = { ...data };
+    for (const field of options.fields) {
+        delete result[field];
+    }
+    return result;
+}
+/**
+ * AES-256-GCM encrypt specified fields before the method runs.
+ * Encrypted values are stored as "iv:authTag:ciphertext" (all hex-encoded).
+ *
+ * @example
+ * @Transform({ step: 3, name: 'encrypt-pii' })
+ * @Encrypt({ fields: ['ssn', 'dob'], key: process.env.FIELD_ENCRYPTION_KEY! })
+ * encryptPii(data: User) { return data; }
+ */
+function Encrypt(options) {
+    return (target, propertyKey, descriptor) => {
+        Reflect.defineMetadata(ENCRYPT_METADATA_KEY, options, target, propertyKey);
+        const original = descriptor.value;
+        descriptor.value = function (data, ...rest) {
+            return original.call(this, applyEncrypt(data, options), ...rest);
+        };
+        return descriptor;
+    };
+}
+function applyEncrypt(data, options) {
+    if (!data || typeof data !== 'object')
+        return data;
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const crypto = require('crypto');
+    const keyBuf = typeof options.key === 'string' ? Buffer.from(options.key, 'hex') : options.key;
+    const result = { ...data };
+    for (const field of options.fields) {
+        const val = result[field];
+        if (val === undefined || val === null)
+            continue;
+        const iv = crypto.randomBytes(12);
+        const cipher = crypto.createCipheriv('aes-256-gcm', keyBuf, iv);
+        if (options.aad)
+            cipher.setAAD(Buffer.from(options.aad));
+        const plaintext = typeof val === 'string' ? val : JSON.stringify(val);
+        const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+        const authTag = cipher.getAuthTag();
+        result[field] = `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted.toString('hex')}`;
+    }
+    return result;
+}
+/**
+ * Decrypt fields that were encrypted with @Encrypt.
+ */
+function Decrypt(options) {
+    return (_target, _propertyKey, descriptor) => {
+        const original = descriptor.value;
+        descriptor.value = function (data, ...rest) {
+            return original.call(this, applyDecrypt(data, options), ...rest);
+        };
+        return descriptor;
+    };
+}
+function applyDecrypt(data, options) {
+    if (!data || typeof data !== 'object')
+        return data;
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const crypto = require('crypto');
+    const keyBuf = typeof options.key === 'string' ? Buffer.from(options.key, 'hex') : options.key;
+    const result = { ...data };
+    for (const field of options.fields) {
+        const val = result[field];
+        if (typeof val !== 'string')
+            continue;
+        const parts = val.split(':');
+        if (parts.length !== 3)
+            continue;
+        try {
+            const [ivHex, authTagHex, ciphertextHex] = parts;
+            const iv = Buffer.from(ivHex, 'hex');
+            const authTag = Buffer.from(authTagHex, 'hex');
+            const ciphertext = Buffer.from(ciphertextHex, 'hex');
+            const decipher = crypto.createDecipheriv('aes-256-gcm', keyBuf, iv);
+            decipher.setAuthTag(authTag);
+            if (options.aad)
+                decipher.setAAD(Buffer.from(options.aad));
+            const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+            try {
+                result[field] = JSON.parse(decrypted);
+            }
+            catch {
+                result[field] = decrypted;
+            }
+        }
+        catch {
+            // Leave as-is if decryption fails
+        }
+    }
+    return result;
+}

package/dist/decorators/pii.decorator.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pii.decorator.test.d.ts.map

package/dist/decorators/pii.decorator.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii.decorator.test.d.ts","sourceRoot":"","sources":["../../src/decorators/pii.decorator.test.ts"],"names":[],"mappings":""}

package/dist/decorators/pii.decorator.test.js

@@ -0,0 +1,150 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const pipeline_decorator_1 = require("./pipeline.decorator");
+const transform_decorator_1 = require("./transform.decorator");
+const pii_decorator_1 = require("./pii.decorator");
+const etl_service_1 = require("../pipelines/etl.service");
+const schema_validator_1 = require("../validators/schema.validator");
+let MaskPipeline = class MaskPipeline {
+    mask(data) {
+        return data;
+    }
+};
+__decorate([
+    (0, transform_decorator_1.Transform)({ step: 1, name: 'mask' }),
+    (0, pii_decorator_1.Mask)({ fields: ['email', 'ssn'] }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], MaskPipeline.prototype, "mask", null);
+MaskPipeline = __decorate([
+    (0, pipeline_decorator_1.Pipeline)('mask-pipeline')
+], MaskPipeline);
+let MaskShowLastPipeline = class MaskShowLastPipeline {
+    mask(data) {
+        return data;
+    }
+};
+__decorate([
+    (0, transform_decorator_1.Transform)({ step: 1, name: 'mask' }),
+    (0, pii_decorator_1.Mask)({ fields: ['phone'], replacement: '***', showLast: 4 }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], MaskShowLastPipeline.prototype, "mask", null);
+MaskShowLastPipeline = __decorate([
+    (0, pipeline_decorator_1.Pipeline)('mask-showlast')
+], MaskShowLastPipeline);
+let RedactPipeline = class RedactPipeline {
+    redact(data) {
+        return data;
+    }
+};
+__decorate([
+    (0, transform_decorator_1.Transform)({ step: 1, name: 'redact' }),
+    (0, pii_decorator_1.Redact)({ fields: ['password', 'secret'] }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], RedactPipeline.prototype, "redact", null);
+RedactPipeline = __decorate([
+    (0, pipeline_decorator_1.Pipeline)('redact-pipeline')
+], RedactPipeline);
+describe('@Mask decorator', () => {
+    it('masks specified fields', async () => {
+        const etl = new etl_service_1.ETLService(new schema_validator_1.SchemaValidator());
+        const pipeline = new MaskPipeline();
+        const result = await etl.execute(pipeline, {
+            email: 'user@example.com',
+            ssn: '123-45-6789',
+            name: 'John',
+        });
+        expect(result.email).toBe('****');
+        expect(result.ssn).toBe('****');
+        expect(result.name).toBe('John');
+    });
+    it('showLast shows last N chars', async () => {
+        const etl = new etl_service_1.ETLService(new schema_validator_1.SchemaValidator());
+        const pipeline = new MaskShowLastPipeline();
+        const result = await etl.execute(pipeline, {
+            phone: '1234567890',
+        });
+        expect(result.phone).toBe('***7890');
+    });
+    it('getMaskMetadata returns options', () => {
+        const meta = (0, pii_decorator_1.getMaskMetadata)(MaskPipeline.prototype, 'mask');
+        expect(meta?.fields).toContain('email');
+        expect(meta?.fields).toContain('ssn');
+    });
+});
+describe('@Redact decorator', () => {
+    it('removes specified fields', async () => {
+        const etl = new etl_service_1.ETLService(new schema_validator_1.SchemaValidator());
+        const pipeline = new RedactPipeline();
+        const result = await etl.execute(pipeline, {
+            password: 'secret123',
+            secret: 'key',
+            name: 'John',
+        });
+        expect(result.password).toBeUndefined();
+        expect(result.secret).toBeUndefined();
+        expect(result.name).toBe('John');
+    });
+    it('getRedactMetadata returns options', () => {
+        const meta = (0, pii_decorator_1.getRedactMetadata)(RedactPipeline.prototype, 'redact');
+        expect(meta?.fields).toContain('password');
+    });
+    it('Mask with array shorthand', async () => {
+        let MaskArrayPipeline = class MaskArrayPipeline {
+            mask(data) {
+                return data;
+            }
+        };
+        __decorate([
+            (0, transform_decorator_1.Transform)({ step: 1, name: 'mask' }),
+            (0, pii_decorator_1.Mask)(['secret']),
+            __metadata("design:type", Function),
+            __metadata("design:paramtypes", [Object]),
+            __metadata("design:returntype", void 0)
+        ], MaskArrayPipeline.prototype, "mask", null);
+        MaskArrayPipeline = __decorate([
+            (0, pipeline_decorator_1.Pipeline)('mask-array')
+        ], MaskArrayPipeline);
+        const etl = new etl_service_1.ETLService(new schema_validator_1.SchemaValidator());
+        const result = await etl.execute(new MaskArrayPipeline(), {
+            secret: 'x',
+            ok: 1,
+        });
+        expect(result.secret).toBe('****');
+        expect(result.ok).toBe(1);
+    });
+    it('Mask leaves non-object unchanged', async () => {
+        let MaskNonObjPipeline = class MaskNonObjPipeline {
+            mask(data) {
+                return data;
+            }
+        };
+        __decorate([
+            (0, transform_decorator_1.Transform)({ step: 1, name: 'mask' }),
+            (0, pii_decorator_1.Mask)(['x']),
+            __metadata("design:type", Function),
+            __metadata("design:paramtypes", [Object]),
+            __metadata("design:returntype", void 0)
+        ], MaskNonObjPipeline.prototype, "mask", null);
+        MaskNonObjPipeline = __decorate([
+            (0, pipeline_decorator_1.Pipeline)('mask-nonobj')
+        ], MaskNonObjPipeline);
+        const etl = new etl_service_1.ETLService(new schema_validator_1.SchemaValidator());
+        const result = await etl.execute(new MaskNonObjPipeline(), 'string');
+        expect(result).toBe('string');
+    });
+});

package/dist/decorators/pipeline.decorator.d.ts

@@ -0,0 +1,22 @@
+import 'reflect-metadata';
+export interface PipelineOptions {
+    name?: string;
+}
+/**
+ * @Pipeline decorator - Mark a class as an ETL pipeline with sequential step execution
+ *
+ * @example
+ * ```typescript
+ * @Pipeline('user-enrichment')
+ * @Injectable()
+ * export class UserEnrichmentPipeline {
+ *   @Transform({ step: 1, name: 'normalize' }) async normalize(data) { ... }
+ *   @Validate({ step: 2, name: 'validate', schema: Schema.object({...}) }) async validate(data) { ... }
+ *   @Transform({ step: 3, name: 'enrich' }) async enrich(data) { ... }
+ * }
+ * ```
+ */
+export declare function Pipeline(nameOrOptions?: string | PipelineOptions): ClassDecorator;
+export declare function getPipelineMetadata(target: object): PipelineOptions | undefined;
+export declare function hasPipelineMetadata(target: object): boolean;
+//# sourceMappingURL=pipeline.decorator.d.ts.map

package/dist/decorators/pipeline.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/pipeline.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,cAAc,CAWjF;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAE/E;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE3D"}

package/dist/decorators/pipeline.decorator.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Pipeline = Pipeline;
+exports.getPipelineMetadata = getPipelineMetadata;
+exports.hasPipelineMetadata = hasPipelineMetadata;
+require("reflect-metadata");
+const core_1 = __importDefault(require("@hazeljs/core"));
+const PIPELINE_METADATA_KEY = 'hazel:data:pipeline';
+/**
+ * @Pipeline decorator - Mark a class as an ETL pipeline with sequential step execution
+ *
+ * @example
+ * ```typescript
+ * @Pipeline('user-enrichment')
+ * @Injectable()
+ * export class UserEnrichmentPipeline {
+ *   @Transform({ step: 1, name: 'normalize' }) async normalize(data) { ... }
+ *   @Validate({ step: 2, name: 'validate', schema: Schema.object({...}) }) async validate(data) { ... }
+ *   @Transform({ step: 3, name: 'enrich' }) async enrich(data) { ... }
+ * }
+ * ```
+ */
+function Pipeline(nameOrOptions) {
+    return (target) => {
+        const options = typeof nameOrOptions === 'string' ? { name: nameOrOptions } : nameOrOptions || {};
+        const metadata = {
+            name: options.name ?? target.name ?? 'unknown',
+            ...options,
+        };
+        Reflect.defineMetadata(PIPELINE_METADATA_KEY, metadata, target);
+        core_1.default.debug(`Pipeline decorator applied: ${metadata.name}`);
+    };
+}
+function getPipelineMetadata(target) {
+    return Reflect.getMetadata(PIPELINE_METADATA_KEY, target);
+}
+function hasPipelineMetadata(target) {
+    return Reflect.hasMetadata(PIPELINE_METADATA_KEY, target);
+}

package/dist/decorators/pipeline.decorator.test.d.ts

@@ -0,0 +1,2 @@
+import 'reflect-metadata';
+//# sourceMappingURL=pipeline.decorator.test.d.ts.map

package/dist/decorators/pipeline.decorator.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.decorator.test.d.ts","sourceRoot":"","sources":["../../src/decorators/pipeline.decorator.test.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC"}