import { type Egress } from "./untrusted-egress.js";
/** A SHORT, SECRET-SCRUBBED primary-arg summary. Abbreviation REDUCES the surface; the `same-principal` tier's pass
 *  is the leak boundary, on whichever field the summary came from (the value is PERSISTED + SSE-forwarded and may be
 *  read by a platform operator in a multi-tenant deployment). Rules:
 *   • command → the command NAME (skip leading `VAR=val` env-prefixes; bail to `undefined` on a quoted assignment
 *     or a lone assignment; basename a path-form command; `+ …` if it had args).
 *   • file path → BASENAME only (no host directory layout).
 *   • url → `new URL` origin+pathname (drops `user:pass@` userinfo + query/fragment).
 *   • else → pattern/query/description, else the first string field whose name is no credential name.
 *  Then the tier's pass, then a code-point cut. */
export declare function primaryActivityArg(args: unknown): Egress<"same-principal"> | undefined;