/**
 * Bash `redact_secrets()` function embedded in the update-and-restart scripts
 * generated for both platforms (launchd on macOS, systemd on Linux).
 *
 * npm/login flows leak Bearer tokens, `_authToken=…`, `X-Auth-Token:` headers
 * and registry URLs with embedded basic-auth into command output, which the
 * agent log forwards to Sentry/heartbeat. Both platform generators must apply
 * the identical set of redaction patterns, so the snippet is kept here to
 * avoid the two copies drifting apart. Interpolate it verbatim into the
 * generated script (it defines a shell function; call sites pipe through
 * `| redact_secrets >&2`).
 */
export declare const REDACT_SECRETS_BASH = "redact_secrets() {\n  sed -E \\\n    -e 's#(Bearer )[A-Za-z0-9._-]+#\\1***REDACTED***#gi' \\\n    -e 's#(authToken[[:space:]]*[:=][[:space:]]*\"?)[^\"[:space:]]+#\\1***REDACTED***#gi' \\\n    -e 's#(_authToken[[:space:]]*[:=][[:space:]]*\"?)[^\"[:space:]]+#\\1***REDACTED***#gi' \\\n    -e 's#(X-Auth-Token:[[:space:]]*)[^[:space:]]+#\\1***REDACTED***#gi' \\\n    -e 's#(https?://)[^/:[:space:]@]+:[^@/[:space:]]+@#\\1***REDACTED***@#gi'\n}";
/**
 * Bash snippet that sources nvm so `node`/`npm` are on PATH when the wrapper
 * runs under a service manager (launchd on macOS, systemd on Linux).
 *
 * Both platform generators emit this identical three-line block. The
 * surrounding `# Load nvm …` comment and the PATH fallback that follows differ
 * per platform, so those stay inline at each call site; only the invariant
 * `NVM_DIR` export + guarded `source` is shared here to keep the copies from
 * drifting. The `\${…}` sequences are intentionally escaped so they reach the
 * generated script as literal shell parameter expansions.
 */
export declare const LOAD_NVM_BASH = "export NVM_DIR=\"${HOME}/.nvm\"\n# shellcheck disable=SC1091\n[ -s \"${NVM_DIR}/nvm.sh\" ] && source \"${NVM_DIR}/nvm.sh\"";
/**
 * Build the bash snippet that runs a docker container, optionally routing
 * its stdout/stderr through `ai-support-agent log-rotate` subprocesses.
 *
 * Both Linux (systemd) and macOS (launchd) wrappers share the same FIFO +
 * background-rotator pattern; only the surrounding `docker run` flags differ
 * between platforms. This helper encapsulates the shared structure:
 *
 * - With `logDir`: sets up named FIFOs, starts two rotator subprocesses,
 *   runs the docker command (provided by `buildDockerRun`) with output
 *   redirected to those FIFOs, then waits for the rotators to drain before
 *   the wrapper exits.
 * - Without `logDir`: runs the docker command directly with no log rotation.
 *
 * In both cases the result ends with `EXIT_CODE=$?` so the caller can check
 * for the exit-42 self-update sentinel.
 *
 * @param opts.buildDockerRun  Function that builds the `docker run …` command
 *                             string. Receives `outputRedirect` — the bash
 *                             fragment to append for stdout/stderr redirection
 *                             (e.g. `> "$FIFO/out" 2> "$FIFO/err"` when log
 *                             rotation is active, or `""` when not). The
 *                             returned string must NOT include a trailing
 *                             newline; the helper adds line endings as needed.
 * @param opts.logDir          When set, the directory under which `agent.out.log`
 *                             and `agent.err.log` are written via log-rotate.
 * @param opts.supervisorLabel Human-readable label for the inline comment
 *                             ("systemd" or "launchd"). No effect on behaviour.
 */
export declare function buildDockerRunWithLogRotate(opts: {
    buildDockerRun: (outputRedirect: string) => string;
    logDir: string | undefined;
    supervisorLabel: 'systemd' | 'launchd';
}): string;
//# sourceMappingURL=service-template-helpers.d.ts.map