/** Project a `/api/groups` chats array down to the public, board-only fields
 *  for anonymous visitors. Explicit ALLOW-LIST (fail-closed): a chat field that
 *  isn't named here never reaches an anon visitor, so management/config metadata
 *  doesn't ride along. Dropped: `description`, `ownerId` (group config/PII),
 *  `hasRole` (leaks the role/persona existence matrix even though the roles
 *  page is token-gated), `oncallChat` (carries workingDir), `error`,
 *  `firstSeenAt`. Kept: chat `chatId/name/chatMode/avatar` (name-map + group
 *  头像，与公开看板已暴露的群名同等敏感度) and
 *  `memberBots[].larkAppId/botName/inChat` (roster). Returns a new array; never
 *  mutates the input. */
export declare function redactGroupsForPublic(chats: unknown[]): unknown[];
/** Drop `prompt` (business instructions) and `workingDir` (repo/customer path)
 *  from `/api/schedules` rows for anonymous visitors. Returns a new array; never
 *  mutates the input. Name / timing / status fields are preserved so the
 *  read-only schedules view still renders. */
export declare function redactSchedulesForPublic(schedules: unknown[]): unknown[];
/** Who is receiving the session board.
 *  - `management` — the local Dashboard owner cookie: full row, no projection.
 *  - `workbench`  — an authenticated Feishu H5 / platform Workbench identity:
 *                   display fields restored, bearer write credential still gone.
 *  - `anonymous`  — a tokenless `publicReadOnly` visitor: full redaction. */
export type SessionBoardAudience = 'management' | 'workbench' | 'anonymous';
/** Map the two authentication facts dashboard.ts already computes per request
 *  onto an audience. Exported so the judgement itself is unit-testable:
 *  dashboard.ts starts an HTTP listener on import and cannot be loaded from a
 *  test, which is how the H5 board silently regressed to the anonymous
 *  projection in the first place. */
export declare function sessionBoardAudienceFor(identity: {
    /** Holds the local Dashboard management cookie (`legacy-dashboard`). */
    legacyAuthed: boolean;
    /** Holds an authenticated Feishu H5 or `platform-dashboard` identity. */
    workbenchIdentity: boolean;
}): SessionBoardAudience;
/** Single entry point for `GET /api/sessions`. Never mutates the input, so the
 *  aggregator's own rows stay intact for other audiences on the next request. */
export declare function projectSessionsForAudience(sessions: unknown[], audience: SessionBoardAudience): unknown[];
/** Single entry point for the `/events` SSE relay — same rule as the REST list,
 *  or the REST-side projection would be trivially bypassed by subscribing. */
export declare function projectSessionEventForAudience(type: string, body: unknown, audience: SessionBoardAudience): unknown;
/** Branch names often carry issue/customer identifiers. `riffAccessUrl` is the
 * Riff AIO Sandbox **write** capability — a bearer URL whose unique subdomain is
 * itself the credential (riff-backend.ts:hashUrlForLog), so an anonymous read-only
 * visitor must never receive it (they'd gain write access to the sandbox). Read
 * access on the dashboard goes through the local worker log terminal (webPort),
 * which stays; only the sandbox write URL is stripped. `/api/sessions` and
 * `/events` are both public-read surfaces, so keep one non-mutating projection
 * for their shared session row shape. */
export declare function redactSessionForPublic(session: unknown): unknown;
export declare function redactSessionsForPublic(sessions: unknown[]): unknown[];
/** Apply the same branch-name policy to session rows delivered over SSE. */
export declare function redactSessionEventForPublic(type: string, body: unknown): unknown;
/** 匿名只读面板不展示外部 Codex 活动、目标 Bot 或投递运行态,也不展示过载
 *  告警的目标 Bot / 收件人提示。 */
export declare function redactSettingsForPublic(settings: unknown): unknown;
//# sourceMappingURL=public-redact.d.ts.map