# Mask

Replace field values with a fixed mask or deterministic keyed hash.

## Overview

The Mask transformation replaces the value at a given key so the original is no longer present in the
record. It supports two modes:

- **Simple** (`simple`) — replaces the value with a fixed mask (`*****`). Use this to redact a field
  entirely.
- **Deterministic** (`deterministic`) — replaces the value with a keyed HMAC-SHA256 hash. The same
  input and key always produce the same output, so masked values remain correlatable across records
  without exposing the plaintext.

## Configuration

| Argument | Type | Required | Default | Description |
| -------- | ---- | -------- | ------- | ----------- |
| key | string | Yes | — | Path to the field whose value will be masked |
| mode | object | Yes | — | Masking mode configuration |
| mode.type | string | Yes | `simple` | Masking mode: `simple` or `deterministic` |
| mode.deterministic.hash_key | secret | Yes (for `deterministic`) | — | HMAC key material, at least 16 bytes |

## Example

Redact the `user.email` field with a fixed mask:

```json
{
  "operation": "mask",
  "arguments": {
    "key": "user.email",
    "mode": {
      "type": "simple",
      "simple": {}
    }
  }
}
```

Given the input record:

```json
{
  "user": {
    "name": "Alice",
    "email": "alice@example.com"
  }
}
```

The output record replaces the value with the fixed mask:

```json
{
  "user": {
    "name": "Alice",
    "email": "*****"
  }
}
```

To produce a stable, correlatable value instead, use `deterministic` mode with an HMAC key:

```json
{
  "operation": "mask",
  "arguments": {
    "key": "user.email",
    "mode": {
      "type": "deterministic",
      "deterministic": {
        "hash_key": "<hmac-key-material>"
      }
    }
  }
}
```

The value is replaced with a hex-encoded HMAC-SHA256 digest, e.g.:

```json
{
  "user": {
    "name": "Alice",
    "email": "3f9a1c...hmac-digest..."
  }
}
```

## Notes

1. The value is replaced in place; no new field is created.
2. Simple mode always uses the fixed mask `*****`.
3. Deterministic mode requires `hash_key`, provided as a secret, and it must be at least 16 bytes.
4. Deterministic output is stable: identical inputs masked with the same key produce identical
   digests, enabling correlation without revealing the original value.