import { CloudEnvironment, IToken } from '@microsoft/teams.api';
import { ILogger } from '@microsoft/teams.common';
/**
 * App ID of the Agent 365 platform.
 */
export declare const AGENT_365_PLATFORM_APP_ID = "5a807f24-c9de-44ee-a3a7-329e88a00ffc";
/**
 * Validator for inbound Teams activities.
 *
 * Classic bot activities use Bot Framework connector tokens. AgenticIdentity
 * activities use Entra tokens whose audience is the Agentic App Blueprint ID.
 */
export declare class InboundActivityTokenValidator {
    private jwtValidator;
    private entraValidatorsByTenantId;
    private credentials?;
    private appId;
    private cloud;
    private logger?;
    constructor(appId: string, tenantId?: string, serviceUrl?: string, logger?: ILogger, cloud?: CloudEnvironment);
    check(authHeader: string, body: any): Promise<IToken>;
    private decodePayload;
    private isEntraIssuer;
    private validateEntraToken;
    /**
     * Requires the client app that requested the token to be the Agent 365 platform.
     * Entra v2 tokens carry the caller in `azp` and v1 tokens carry it in `appid`.
     * `appid` is only consulted when `azp` is absent, so a present but invalid `azp` is rejected.
     */
    private validateEntraCallerApp;
    private getEntraValidator;
}