import { AgenticIdentity, IToken } from '@microsoft/teams.api';
import { Token } from '@microsoft/teams.common';
import { BotApiCredential, GraphCredential } from './files/download';
/**
 * Choose which identity reads a file's bytes, for the current inbound activity.
 *
 * An Agentic User reads as itself, never the app token: an app-only token sees what the app may read tenant-wide, a different set from what was shared with the agent, so it would 403 on exactly the files the agent was given.
 *
 * The token is resolved lazily, so a turn that never touches files never acquires one.
 */
export declare function selectFilesCredential(options: {
    agenticIdentity?: AgenticIdentity;
    tenantId?: string;
    /** Graph host root derived from the cloud environment, e.g. `https://graph.microsoft.com`. */
    graphBaseUrlRoot?: string;
    getAppGraphToken: (tenantId?: string) => Promise<IToken | null>;
    getAgenticGraphToken: (identity: AgenticIdentity, tenantId?: string) => Promise<IToken | null>;
}): GraphCredential;
/**
 * Build the credential that reads inline images for the current activity, using the turn's Bot API token.
 *
 * The token is resolved lazily, so a turn that never downloads an inline image never acquires one.
 */
export declare function selectInlineImageCredential(options: {
    agenticIdentity?: AgenticIdentity;
    /** The activity's `serviceUrl`; the token is only sent to URLs under it. */
    serviceUrl?: string;
    /** Returns the API client's token source: a string, a string-like value, or a factory. */
    getToken: () => Token | undefined;
}): BotApiCredential;