/**
 * PiiMasker (v3.x)
 *
 * Column-level PII masking. Strategies:
 *  - mask: replace with '***'  (default)
 *  - mask_last4: keep last 4 chars, mask rest
 *  - hash: SHA-256 hex of input (deterministic, useful for joins across rows)
 *  - redact: replace with 'REDACTED'
 *  - passthrough: no change (off-switch for a column)
 *
 * Configuration: loaded once at startup from `pii.config.json`. Configurable
 * per-profile (record-level scoping). Runtime updates via `setProfileConfig`.
 */
export type MaskStrategy = 'mask' | 'mask_last4' | 'hash' | 'redact' | 'passthrough';
export interface PiiColumnConfig {
    table: string;
    column: string;
    strategy: MaskStrategy;
}
export interface PiiConfig {
    profiles: Record<string, PiiColumnConfig[]>;
}
export declare class PiiMasker {
    private static cfg;
    /**
     * Load PII configuration from a JSON file. Throws on invalid config.
     */
    static loadFromFile(path: string): PiiConfig;
    /** Pure validator — exported for use by config-loader. */
    static validate(cfg: unknown): asserts cfg is PiiConfig;
    /** Direct setter — used by MCP / HTTP set_pii_config. */
    static setProfileConfig(profileName: string, columns: PiiColumnConfig[], replace: boolean): void;
    /** Read-only accessor — used by MCP / HTTP get_pii_config. */
    static getConfig(): PiiConfig;
    /** Apply a single strategy to a value. */
    static applyStrategy(value: unknown, strategy: MaskStrategy): unknown;
    /**
     * Apply masking to a list of result rows. The `table` argument is matched
     * by exact case-insensitive substring (e.g. schema='public', table='users'
     * → matches 'public.users'). Unknown tables fall through with no mask.
     */
    static mask(profileName: string, table: string, rows: Record<string, unknown>[]): Record<string, unknown>[];
}
//# sourceMappingURL=pii-masker.d.ts.map