# Hash

Compute a digest of the whole record or selected fields and store it on a key.

## Overview

The Hash transformation computes a hash digest and writes its hex-encoded value to a key, leaving the
rest of the record unchanged. It can hash either the entire record or a chosen subset of fields, and
supports several algorithms.

- **Whole record** (no `fields`) — the record is canonicalized first (object keys sorted recursively),
  so two records that differ only in key order produce the same digest.
- **Selected fields** (`fields` set) — only those field values are hashed. The field list is treated as
  a set, so `["a","b"]` and `["b","a"]` produce the same digest.

Common uses are creating a stable fingerprint for correlation, or precomputing a key you later
deduplicate on.

## Configuration

| Argument | Type | Required | Default | Description |
| -------- | ---- | -------- | ------- | ----------- |
| key | string | Yes | — | Path where the resulting hex digest is written |
| algorithm | string | No | `sha256` | Hash algorithm: `md5`, `sha1`, `sha256`, or `xxh128` |
| fields | array of strings | No | `[]` | Field paths to hash; empty hashes the whole record |

## Example

Hash the whole record and store the digest under `_fingerprint`:

```json
{
  "operation": "hash",
  "arguments": {
    "key": "_fingerprint",
    "algorithm": "sha256"
  }
}
```

Given the input record:

```json
{
  "user": "alice",
  "action": "login"
}
```

The output adds the digest, leaving the rest untouched:

```json
{
  "user": "alice",
  "action": "login",
  "_fingerprint": "9f2c...hex-digest..."
}
```

To fingerprint only specific fields, set `fields`:

```json
{
  "operation": "hash",
  "arguments": {
    "key": "identity_key",
    "algorithm": "xxh128",
    "fields": ["user", "action"]
  }
}
```

## Notes

1. The digest is written as a lowercase hex string; the original fields are left in place.
2. Default algorithm is `sha256`. Use `xxh128` for a fast, non-cryptographic fingerprint.
3. Whole-record hashing is key-order independent (the record is canonicalized first).
4. In `fields` mode the field list is order-independent; a field that is present as `null` or `""`
   still counts, but a wholly absent field simply contributes nothing to the digest.
5. The digests shown above are illustrative.