import type { ScopeDumpTable } from '@substrat-run/contracts';
import { MASKED, type Pseudonymizer } from './pseudonymize.js';
/** Mask one dump in place-shape (returns new arrays; never mutates the input). */
export declare function maskDump(tables: ScopeDumpTable[], mask: Pseudonymizer): Promise<ScopeDumpTable[]>;
/**
 * The same heuristic applied to plain JSON records — the directory half of a tenant
 * export (#36).
 *
 * A tenant export carries two kinds of thing: scope databases (table-shaped, masked by
 * `maskDump` above) and directory records (object-shaped — a tenant's display name, an
 * org's name, an identity link's external id, which is usually an email). Both halves
 * must be masked by the SAME rule, or the default-masked promise is only half true and
 * the leak is in the half nobody looked at.
 *
 * So this reuses `sweepJson` rather than growing a second heuristic: one PII column
 * list, one recursive sweep, one generator, two entry points. Ids and timestamps pass
 * through — the sweep targets free text, and ids are what keep an export intelligible.
 */
export declare function maskRecords<T>(records: readonly T[], mask: Pseudonymizer): Promise<T[]>;
export { MASKED };
//# sourceMappingURL=mask.d.ts.map