@hazeljs/data 0.2.0-beta.68 → 0.2.0-beta.69

package/dist/connectors/http.connector.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpSink = exports.HttpSource = void 0;
+function getNestedValue(obj, path) {
+    return path.split('.').reduce((cur, key) => {
+        if (cur === null || cur === undefined || typeof cur !== 'object')
+            return undefined;
+        return cur[key];
+    }, obj);
+}
+/**
+ * HTTP API data source — reads records from a REST API.
+ * Supports pagination via `nextPagePath`.
+ *
+ * @example
+ * const source = new HttpSource({
+ *   url: 'https://api.example.com/users',
+ *   dataPath: 'data',
+ *   nextPagePath: 'meta.next',
+ * });
+ */
+class HttpSource {
+    constructor(options) {
+        this.name = options.name ?? `http:${options.url}`;
+        this.options = options;
+    }
+    async open() {
+        // Validate connectivity on open
+        const res = await this.fetchPage(this.options.url);
+        if (!res.ok)
+            throw new Error(`HttpSource: Cannot reach ${this.options.url} (${res.status})`);
+    }
+    async close() { }
+    async readAll() {
+        const all = [];
+        for await (const r of this.read())
+            all.push(r);
+        return all;
+    }
+    async *read() {
+        let url = this.options.url;
+        while (url) {
+            const res = await this.fetchPage(url);
+            if (!res.ok)
+                throw new Error(`HttpSource: ${res.status} ${await res.text()}`);
+            const body = await res.json();
+            const items = this.options.dataPath ? getNestedValue(body, this.options.dataPath) : body;
+            if (Array.isArray(items)) {
+                for (const item of items)
+                    yield item;
+            }
+            else {
+                yield body;
+                break;
+            }
+            url = this.options.nextPagePath
+                ? (getNestedValue(body, this.options.nextPagePath) ?? null)
+                : null;
+        }
+    }
+    fetchPage(url) {
+        const controller = new AbortController();
+        if (this.options.timeoutMs) {
+            setTimeout(() => controller.abort(), this.options.timeoutMs);
+        }
+        return fetch(url, {
+            method: this.options.method ?? 'GET',
+            headers: { 'Content-Type': 'application/json', ...this.options.headers },
+            body: this.options.body ? JSON.stringify(this.options.body) : undefined,
+            signal: controller.signal,
+        });
+    }
+}
+exports.HttpSource = HttpSource;
+/**
+ * HTTP API data sink — writes records to a REST API endpoint.
+ *
+ * @example
+ * const sink = new HttpSink({
+ *   url: 'https://api.example.com/ingest',
+ *   method: 'POST',
+ *   batchSize: 100,
+ *   bodyKey: 'records',
+ * });
+ */
+class HttpSink {
+    constructor(options) {
+        this.buffer = [];
+        this.name = options.name ?? `http:${options.url}`;
+        this.options = { batchSize: 1, ...options };
+    }
+    async open() { }
+    async close() {
+        if (this.buffer.length > 0)
+            await this.flush();
+    }
+    async write(record) {
+        this.buffer.push(record);
+        if (this.buffer.length >= (this.options.batchSize ?? 1)) {
+            await this.flush();
+        }
+    }
+    async writeBatch(records) {
+        this.buffer.push(...records);
+        await this.flush();
+    }
+    async flush() {
+        if (this.buffer.length === 0)
+            return;
+        const payload = this.options.bodyKey
+            ? { [this.options.bodyKey]: this.buffer }
+            : this.buffer.length === 1
+                ? this.buffer[0]
+                : this.buffer;
+        const controller = new AbortController();
+        if (this.options.timeoutMs) {
+            setTimeout(() => controller.abort(), this.options.timeoutMs);
+        }
+        const res = await fetch(this.options.url, {
+            method: this.options.method ?? 'POST',
+            headers: { 'Content-Type': 'application/json', ...this.options.headers },
+            body: JSON.stringify(payload),
+            signal: controller.signal,
+        });
+        if (!res.ok) {
+            throw new Error(`HttpSink: ${res.status} ${await res.text()}`);
+        }
+        this.buffer = [];
+    }
+}
+exports.HttpSink = HttpSink;

package/dist/connectors/index.d.ts

@@ -0,0 +1,7 @@
+export type { DataSource, DataSink, ConnectorOptions } from './connector.interface';
+export { CsvSource, CsvSink } from './csv.connector';
+export type { CsvSourceOptions, CsvSinkOptions } from './csv.connector';
+export { HttpSource, HttpSink } from './http.connector';
+export type { HttpSourceOptions, HttpSinkOptions } from './http.connector';
+export { MemorySource, MemorySink } from './memory.connector';
+//# sourceMappingURL=index.d.ts.map

package/dist/connectors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connectors/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACrD,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxD,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/connectors/index.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemorySink = exports.MemorySource = exports.HttpSink = exports.HttpSource = exports.CsvSink = exports.CsvSource = void 0;
+var csv_connector_1 = require("./csv.connector");
+Object.defineProperty(exports, "CsvSource", { enumerable: true, get: function () { return csv_connector_1.CsvSource; } });
+Object.defineProperty(exports, "CsvSink", { enumerable: true, get: function () { return csv_connector_1.CsvSink; } });
+var http_connector_1 = require("./http.connector");
+Object.defineProperty(exports, "HttpSource", { enumerable: true, get: function () { return http_connector_1.HttpSource; } });
+Object.defineProperty(exports, "HttpSink", { enumerable: true, get: function () { return http_connector_1.HttpSink; } });
+var memory_connector_1 = require("./memory.connector");
+Object.defineProperty(exports, "MemorySource", { enumerable: true, get: function () { return memory_connector_1.MemorySource; } });
+Object.defineProperty(exports, "MemorySink", { enumerable: true, get: function () { return memory_connector_1.MemorySink; } });

package/dist/connectors/memory.connector.d.ts

@@ -0,0 +1,38 @@
+import type { DataSource, DataSink } from './connector.interface';
+/**
+ * In-memory data source — wraps an array for use in pipelines and tests.
+ *
+ * @example
+ * const source = new MemorySource([{ id: 1 }, { id: 2 }]);
+ * const records = await source.readAll();
+ */
+export declare class MemorySource<T = unknown> implements DataSource<T> {
+    readonly name: string;
+    private readonly records;
+    constructor(records: T[], name?: string);
+    open(): Promise<void>;
+    close(): Promise<void>;
+    readAll(): Promise<T[]>;
+    read(): AsyncGenerator<T>;
+}
+/**
+ * In-memory data sink — captures written records for inspection.
+ * Useful in tests and pipeline prototyping.
+ *
+ * @example
+ * const sink = new MemorySink<User>();
+ * await pipeline.run(source, sink);
+ * console.log(sink.records);
+ */
+export declare class MemorySink<T = unknown> implements DataSink<T> {
+    readonly name: string;
+    private _records;
+    constructor(name?: string);
+    open(): Promise<void>;
+    close(): Promise<void>;
+    write(record: T): Promise<void>;
+    writeBatch(records: T[]): Promise<void>;
+    get records(): readonly T[];
+    clear(): void;
+}
+//# sourceMappingURL=memory.connector.d.ts.map

package/dist/connectors/memory.connector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.connector.d.ts","sourceRoot":"","sources":["../../src/connectors/memory.connector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAElE;;;;;;GAMG;AACH,qBAAa,YAAY,CAAC,CAAC,GAAG,OAAO,CAAE,YAAW,UAAU,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAM;gBAElB,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,SAAkB;IAK1C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAEtB,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAItB,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC;CAGjC;AAED;;;;;;;;GAQG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,OAAO,CAAE,YAAW,QAAQ,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAW;gBAEf,IAAI,SAAgB;IAI1B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAEtB,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/B,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7C,IAAI,OAAO,IAAI,SAAS,CAAC,EAAE,CAE1B;IAED,KAAK,IAAI,IAAI;CAGd"}

package/dist/connectors/memory.connector.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemorySink = exports.MemorySource = void 0;
+/**
+ * In-memory data source — wraps an array for use in pipelines and tests.
+ *
+ * @example
+ * const source = new MemorySource([{ id: 1 }, { id: 2 }]);
+ * const records = await source.readAll();
+ */
+class MemorySource {
+    constructor(records, name = 'memory:source') {
+        this.name = name;
+        this.records = [...records];
+    }
+    async open() { }
+    async close() { }
+    async readAll() {
+        return [...this.records];
+    }
+    async *read() {
+        for (const r of this.records)
+            yield r;
+    }
+}
+exports.MemorySource = MemorySource;
+/**
+ * In-memory data sink — captures written records for inspection.
+ * Useful in tests and pipeline prototyping.
+ *
+ * @example
+ * const sink = new MemorySink<User>();
+ * await pipeline.run(source, sink);
+ * console.log(sink.records);
+ */
+class MemorySink {
+    constructor(name = 'memory:sink') {
+        this._records = [];
+        this.name = name;
+    }
+    async open() { }
+    async close() { }
+    async write(record) {
+        this._records.push(record);
+    }
+    async writeBatch(records) {
+        this._records.push(...records);
+    }
+    get records() {
+        return this._records;
+    }
+    clear() {
+        this._records = [];
+    }
+}
+exports.MemorySink = MemorySink;

package/dist/connectors/memory.connector.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=memory.connector.test.d.ts.map

package/dist/connectors/memory.connector.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.connector.test.d.ts","sourceRoot":"","sources":["../../src/connectors/memory.connector.test.ts"],"names":[],"mappings":""}

package/dist/connectors/memory.connector.test.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const memory_connector_1 = require("./memory.connector");
+describe('MemorySource', () => {
+    it('readAll returns all records', async () => {
+        const source = new memory_connector_1.MemorySource([{ id: 1 }, { id: 2 }]);
+        await source.open();
+        const records = await source.readAll();
+        expect(records).toHaveLength(2);
+        expect(records[0]).toEqual({ id: 1 });
+        await source.close();
+    });
+    it('read yields records', async () => {
+        const source = new memory_connector_1.MemorySource([1, 2, 3]);
+        const out = [];
+        for await (const r of source.read())
+            out.push(r);
+        expect(out).toEqual([1, 2, 3]);
+    });
+});
+describe('MemorySink', () => {
+    it('captures written records', async () => {
+        const sink = new memory_connector_1.MemorySink();
+        await sink.open();
+        await sink.write({ x: 1 });
+        await sink.write({ x: 2 });
+        await sink.close();
+        expect(sink.records).toHaveLength(2);
+        expect(sink.records[0]).toEqual({ x: 1 });
+    });
+    it('writeBatch captures batch', async () => {
+        const sink = new memory_connector_1.MemorySink();
+        await sink.open();
+        await sink.writeBatch([1, 2, 3]);
+        expect(sink.records).toEqual([1, 2, 3]);
+    });
+    it('clear resets records', async () => {
+        const sink = new memory_connector_1.MemorySink();
+        await sink.write(1);
+        sink.clear();
+        expect(sink.records).toHaveLength(0);
+    });
+});

package/dist/data.types.d.ts

@@ -1,11 +1,27 @@
 /**
  * @hazeljs/data - Type definitions for ETL and streaming
  */
+export interface RetryConfig {
+    attempts: number;
+    delay?: number;
+    backoff?: 'fixed' | 'exponential';
+}
+export interface DLQConfig {
+    handler: (item: unknown, error: Error, stepName: string) => void | Promise<void>;
+}
 export interface PipelineStepMetadata {
     step: number;
     name: string;
     type: 'transform' | 'validate';
     schema?: unknown;
+    /** Run step only when predicate returns true */
+    when?: (data: unknown) => boolean;
+    /** Retry configuration for this step */
+    retry?: RetryConfig;
+    /** Per-step timeout in milliseconds */
+    timeoutMs?: number;
+    /** Dead letter queue handler - called instead of throwing on failure */
+    dlq?: DLQConfig;
 }
 export interface StreamMetadata {
     name: string;

package/dist/data.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data.types.d.ts","sourceRoot":"","sources":["../src/data.types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC;IAC/B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,gBAAgB,CAAC,EAAE;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"data.types.d.ts","sourceRoot":"","sources":["../src/data.types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC;IAC/B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;IAClC,wCAAwC;IACxC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,gBAAgB,CAAC,EAAE;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/decorators/index.d.ts

@@ -2,4 +2,5 @@ export { Pipeline, getPipelineMetadata, hasPipelineMetadata, type PipelineOption
 export { Transform, getTransformMetadata, type TransformOptions } from './transform.decorator';
 export { Validate, getValidateMetadata, type ValidateOptions } from './validate.decorator';
 export { Stream, getStreamMetadata, hasStreamMetadata, type StreamOptions, } from './stream.decorator';
+export { Mask, Redact, Encrypt, Decrypt, getMaskMetadata, getRedactMetadata, type MaskOptions, type RedactOptions, type EncryptOptions, type DecryptOptions, } from './pii.decorator';
 //# sourceMappingURL=index.d.ts.map

package/dist/decorators/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EACL,MAAM,EACN,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EACL,MAAM,EACN,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,IAAI,EACJ,MAAM,EACN,OAAO,EACP,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC"}

package/dist/decorators/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasStreamMetadata = exports.getStreamMetadata = exports.Stream = exports.getValidateMetadata = exports.Validate = exports.getTransformMetadata = exports.Transform = exports.hasPipelineMetadata = exports.getPipelineMetadata = exports.Pipeline = void 0;
+exports.getRedactMetadata = exports.getMaskMetadata = exports.Decrypt = exports.Encrypt = exports.Redact = exports.Mask = exports.hasStreamMetadata = exports.getStreamMetadata = exports.Stream = exports.getValidateMetadata = exports.Validate = exports.getTransformMetadata = exports.Transform = exports.hasPipelineMetadata = exports.getPipelineMetadata = exports.Pipeline = void 0;
 var pipeline_decorator_1 = require("./pipeline.decorator");
 Object.defineProperty(exports, "Pipeline", { enumerable: true, get: function () { return pipeline_decorator_1.Pipeline; } });
 Object.defineProperty(exports, "getPipelineMetadata", { enumerable: true, get: function () { return pipeline_decorator_1.getPipelineMetadata; } });
@@ -15,3 +15,10 @@ var stream_decorator_1 = require("./stream.decorator");
 Object.defineProperty(exports, "Stream", { enumerable: true, get: function () { return stream_decorator_1.Stream; } });
 Object.defineProperty(exports, "getStreamMetadata", { enumerable: true, get: function () { return stream_decorator_1.getStreamMetadata; } });
 Object.defineProperty(exports, "hasStreamMetadata", { enumerable: true, get: function () { return stream_decorator_1.hasStreamMetadata; } });
+var pii_decorator_1 = require("./pii.decorator");
+Object.defineProperty(exports, "Mask", { enumerable: true, get: function () { return pii_decorator_1.Mask; } });
+Object.defineProperty(exports, "Redact", { enumerable: true, get: function () { return pii_decorator_1.Redact; } });
+Object.defineProperty(exports, "Encrypt", { enumerable: true, get: function () { return pii_decorator_1.Encrypt; } });
+Object.defineProperty(exports, "Decrypt", { enumerable: true, get: function () { return pii_decorator_1.Decrypt; } });
+Object.defineProperty(exports, "getMaskMetadata", { enumerable: true, get: function () { return pii_decorator_1.getMaskMetadata; } });
+Object.defineProperty(exports, "getRedactMetadata", { enumerable: true, get: function () { return pii_decorator_1.getRedactMetadata; } });

package/dist/decorators/pii.decorator.d.ts

@@ -0,0 +1,59 @@
+import 'reflect-metadata';
+export interface MaskOptions {
+    /** Fields to mask */
+    fields: string[];
+    /** Replacement string (default: "****") */
+    replacement?: string;
+    /** Show last N characters of the value (default: 0) */
+    showLast?: number;
+}
+/**
+ * Mask specified fields before the method runs.
+ *
+ * @example
+ * @Transform({ step: 1, name: 'sanitize' })
+ * @Mask({ fields: ['email', 'ssn'] })
+ * sanitize(data: User) { return data; }
+ */
+export declare function Mask(fieldsOrOptions: string[] | MaskOptions): MethodDecorator;
+export declare function getMaskMetadata(target: object, key: string | symbol): MaskOptions | undefined;
+export interface RedactOptions {
+    fields: string[];
+}
+/**
+ * Remove specified fields entirely before the method runs.
+ *
+ * @example
+ * @Transform({ step: 2, name: 'redact' })
+ * @Redact({ fields: ['password', 'secretToken'] })
+ * redactSecrets(data: User) { return data; }
+ */
+export declare function Redact(fieldsOrOptions: string[] | RedactOptions): MethodDecorator;
+export declare function getRedactMetadata(target: object, key: string | symbol): RedactOptions | undefined;
+export interface EncryptOptions {
+    fields: string[];
+    /** 32-byte AES-256-GCM key (hex string or Buffer) */
+    key: string | Buffer;
+    /** Optional AAD (additional authenticated data) for GCM */
+    aad?: string;
+}
+export interface DecryptOptions {
+    fields: string[];
+    key: string | Buffer;
+    aad?: string;
+}
+/**
+ * AES-256-GCM encrypt specified fields before the method runs.
+ * Encrypted values are stored as "iv:authTag:ciphertext" (all hex-encoded).
+ *
+ * @example
+ * @Transform({ step: 3, name: 'encrypt-pii' })
+ * @Encrypt({ fields: ['ssn', 'dob'], key: process.env.FIELD_ENCRYPTION_KEY! })
+ * encryptPii(data: User) { return data; }
+ */
+export declare function Encrypt(options: EncryptOptions): MethodDecorator;
+/**
+ * Decrypt fields that were encrypted with @Encrypt.
+ */
+export declare function Decrypt(options: DecryptOptions): MethodDecorator;
+//# sourceMappingURL=pii.decorator.d.ts.map

package/dist/decorators/pii.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/pii.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAoB1B,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,WAAW,GAAG,eAAe,CAc7E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CAE7F;AAqCD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,aAAa,GAAG,eAAe,CAcjF;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,GAAG,SAAS,CAEjG;AAaD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qDAAqD;IACrD,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe,CAUhE;AA4BD;;GAEG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe,CAQhE"}

package/dist/decorators/pii.decorator.js

@@ -0,0 +1,197 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Mask = Mask;
+exports.getMaskMetadata = getMaskMetadata;
+exports.Redact = Redact;
+exports.getRedactMetadata = getRedactMetadata;
+exports.Encrypt = Encrypt;
+exports.Decrypt = Decrypt;
+require("reflect-metadata");
+/**
+ * PII-safety decorators for pipeline methods.
+ *
+ * These decorators run **before** the decorated method executes,
+ * modifying the data according to the specified operation.
+ *
+ * @Mask  — replaces field values with "****"
+ * @Redact — removes fields entirely
+ * @Encrypt — AES-256-GCM encrypts field values (Node.js crypto required)
+ * @Decrypt — decrypts previously encrypted values
+ */
+const MASK_METADATA_KEY = 'hazel:data:pii:mask';
+const REDACT_METADATA_KEY = 'hazel:data:pii:redact';
+const ENCRYPT_METADATA_KEY = 'hazel:data:pii:encrypt';
+/**
+ * Mask specified fields before the method runs.
+ *
+ * @example
+ * @Transform({ step: 1, name: 'sanitize' })
+ * @Mask({ fields: ['email', 'ssn'] })
+ * sanitize(data: User) { return data; }
+ */
+function Mask(fieldsOrOptions) {
+    const options = Array.isArray(fieldsOrOptions)
+        ? { fields: fieldsOrOptions }
+        : fieldsOrOptions;
+    return (target, propertyKey, descriptor) => {
+        Reflect.defineMetadata(MASK_METADATA_KEY, options, target, propertyKey);
+        const original = descriptor.value;
+        descriptor.value = function (data, ...rest) {
+            return original.call(this, applyMask(data, options), ...rest);
+        };
+        return descriptor;
+    };
+}
+function getMaskMetadata(target, key) {
+    return Reflect.getMetadata(MASK_METADATA_KEY, target, key);
+}
+function applyMask(data, options) {
+    const { fields, replacement = '****', showLast = 0 } = options;
+    if (!data || typeof data !== 'object')
+        return data;
+    const result = { ...data };
+    for (const field of fields) {
+        const parts = field.split('.');
+        maskNested(result, parts, replacement, showLast);
+    }
+    return result;
+}
+function maskNested(obj, path, replacement, showLast) {
+    if (path.length === 1) {
+        const val = obj[path[0]];
+        if (typeof val === 'string' && showLast > 0) {
+            obj[path[0]] = replacement + val.slice(-showLast);
+        }
+        else if (val !== undefined && val !== null) {
+            obj[path[0]] = replacement;
+        }
+        return;
+    }
+    const nested = obj[path[0]];
+    if (nested && typeof nested === 'object' && !Array.isArray(nested)) {
+        maskNested(nested, path.slice(1), replacement, showLast);
+    }
+}
+/**
+ * Remove specified fields entirely before the method runs.
+ *
+ * @example
+ * @Transform({ step: 2, name: 'redact' })
+ * @Redact({ fields: ['password', 'secretToken'] })
+ * redactSecrets(data: User) { return data; }
+ */
+function Redact(fieldsOrOptions) {
+    const options = Array.isArray(fieldsOrOptions)
+        ? { fields: fieldsOrOptions }
+        : fieldsOrOptions;
+    return (target, propertyKey, descriptor) => {
+        Reflect.defineMetadata(REDACT_METADATA_KEY, options, target, propertyKey);
+        const original = descriptor.value;
+        descriptor.value = function (data, ...rest) {
+            return original.call(this, applyRedact(data, options), ...rest);
+        };
+        return descriptor;
+    };
+}
+function getRedactMetadata(target, key) {
+    return Reflect.getMetadata(REDACT_METADATA_KEY, target, key);
+}
+function applyRedact(data, options) {
+    if (!data || typeof data !== 'object')
+        return data;
+    const result = { ...data };
+    for (const field of options.fields) {
+        delete result[field];
+    }
+    return result;
+}
+/**
+ * AES-256-GCM encrypt specified fields before the method runs.
+ * Encrypted values are stored as "iv:authTag:ciphertext" (all hex-encoded).
+ *
+ * @example
+ * @Transform({ step: 3, name: 'encrypt-pii' })
+ * @Encrypt({ fields: ['ssn', 'dob'], key: process.env.FIELD_ENCRYPTION_KEY! })
+ * encryptPii(data: User) { return data; }
+ */
+function Encrypt(options) {
+    return (target, propertyKey, descriptor) => {
+        Reflect.defineMetadata(ENCRYPT_METADATA_KEY, options, target, propertyKey);
+        const original = descriptor.value;
+        descriptor.value = function (data, ...rest) {
+            return original.call(this, applyEncrypt(data, options), ...rest);
+        };
+        return descriptor;
+    };
+}
+function applyEncrypt(data, options) {
+    if (!data || typeof data !== 'object')
+        return data;
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const crypto = require('crypto');
+    const keyBuf = typeof options.key === 'string' ? Buffer.from(options.key, 'hex') : options.key;
+    const result = { ...data };
+    for (const field of options.fields) {
+        const val = result[field];
+        if (val === undefined || val === null)
+            continue;
+        const iv = crypto.randomBytes(12);
+        const cipher = crypto.createCipheriv('aes-256-gcm', keyBuf, iv);
+        if (options.aad)
+            cipher.setAAD(Buffer.from(options.aad));
+        const plaintext = typeof val === 'string' ? val : JSON.stringify(val);
+        const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+        const authTag = cipher.getAuthTag();
+        result[field] = `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted.toString('hex')}`;
+    }
+    return result;
+}
+/**
+ * Decrypt fields that were encrypted with @Encrypt.
+ */
+function Decrypt(options) {
+    return (_target, _propertyKey, descriptor) => {
+        const original = descriptor.value;
+        descriptor.value = function (data, ...rest) {
+            return original.call(this, applyDecrypt(data, options), ...rest);
+        };
+        return descriptor;
+    };
+}
+function applyDecrypt(data, options) {
+    if (!data || typeof data !== 'object')
+        return data;
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const crypto = require('crypto');
+    const keyBuf = typeof options.key === 'string' ? Buffer.from(options.key, 'hex') : options.key;
+    const result = { ...data };
+    for (const field of options.fields) {
+        const val = result[field];
+        if (typeof val !== 'string')
+            continue;
+        const parts = val.split(':');
+        if (parts.length !== 3)
+            continue;
+        try {
+            const [ivHex, authTagHex, ciphertextHex] = parts;
+            const iv = Buffer.from(ivHex, 'hex');
+            const authTag = Buffer.from(authTagHex, 'hex');
+            const ciphertext = Buffer.from(ciphertextHex, 'hex');
+            const decipher = crypto.createDecipheriv('aes-256-gcm', keyBuf, iv);
+            decipher.setAuthTag(authTag);
+            if (options.aad)
+                decipher.setAAD(Buffer.from(options.aad));
+            const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+            try {
+                result[field] = JSON.parse(decrypted);
+            }
+            catch {
+                result[field] = decrypted;
+            }
+        }
+        catch {
+            // Leave as-is if decryption fails
+        }
+    }
+    return result;
+}

package/dist/decorators/pii.decorator.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pii.decorator.test.d.ts.map

package/dist/decorators/pii.decorator.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii.decorator.test.d.ts","sourceRoot":"","sources":["../../src/decorators/pii.decorator.test.ts"],"names":[],"mappings":""}