import { AbstractProvider } from '../abstract';
import type { AppleIdTokenClaims, ProviderInterface, SocialUser } from '../types';
import type { ProviderConfig } from '../abstract';
/**
 * Apple replaces the static client secret with a signed JWT, so its
 * provider config carries the signing inputs instead of clientSecret
 * (which may be left '').
 */
export declare interface AppleProviderConfig extends ProviderConfig {
  teamId?: string
  keyId?: string
  privateKey?: string
}
/**
 * Sign in with Apple (OAuth2 / OIDC).
 *
 * Apple deviates from the other providers in three ways, all handled
 * here so callers keep the same getAuthUrl/getAccessToken/getUserByToken
 * contract:
 *
 * 1. There is no static client secret. Apple requires a short-lived JWT
 *    signed with an ES256 private key (.p8) issued in the developer
 *    portal, scoped by team ID and key ID. `generateClientSecret()`
 *    builds one per token exchange.
 * 2. There is no userinfo endpoint. Identity comes from the `id_token`
 *    returned by the token endpoint, so `getAccessToken()` returns the
 *    id_token (not the access token — there is nothing to spend it on),
 *    and `getUserByToken()` decodes its claims. The id_token arrives
 *    straight from Apple's token endpoint over TLS, which OIDC Core
 *    3.1.3.7 accepts in place of local signature verification; iss, aud
 *    and exp are still validated.
 * 3. When scopes are requested (they are by default: name + email),
 *    Apple mandates `response_mode=form_post` — the callback arrives as
 *    a cross-site POST, not a GET. Applications must register a POST
 *    callback route and use a cookie jar that survives cross-site POSTs
 *    (SameSite=None) if they carry state in cookies.
 *
 * Note that Apple only transmits the user's name (and only on the very
 * first authorization) as a `user` JSON field in the form_post body —
 * it is never part of the id_token. Reading it is the application's
 * job; `SocialUser.name` from this driver is therefore always ''.
 */
export declare class AppleProvider extends AbstractProvider implements ProviderInterface {
  protected baseUrl: string;
  protected teamId: string;
  protected keyId: string;
  protected privateKey: string;
  constructor(providerConfig: AppleProviderConfig);
  getAuthUrl(): Promise<string>;
  getAccessToken(code: string): Promise<string>;
  getUserByToken(token: string): Promise<SocialUser>;
  protected generateClientSecret(): string;
  protected decodeIdToken(idToken: string): AppleIdTokenClaims;
  protected validateConfig(): void;
  protected getTokenUrl(): string;
}