IhawuKtor

The Ihawu masking plugin for Ktor. A single install gives @IhawuResource responses per-caller masking with no per-route code:

install(IhawuKtor) {
    resolvePrincipal = { it.ihawuPrincipal() }
    policies(ResourcePolicy("employee", mapOf("MANAGER" to listOf(FieldPolicy("ssn", REDACT)))))
    resources(Employee.serializer() to "employee")
}

It folds in the ContentNegotiation registration (do not install it separately) and, per call, wraps the pipeline in the caller's masking context via the kotlinx coroutine→thread-local bridge (ADR 0009), so the synchronous encode sees the principal. No principal → {}.