/**
 * Portal Callback and Logout Route Handlers
 *
 * Provides route handlers for portal authentication that can be used by both:
 * - The Riverbank frontend app (apps/frontend)
 * - External SDK sites
 *
 * Usage in your site's app/api/portal/callback/route.ts:
 * ```ts
 * import { handlePortalCallback } from '@riverbankcms/sdk/portal';
 *
 * export const GET = handlePortalCallback();
 * ```
 *
 * Usage in your site's app/api/portal/logout/route.ts:
 * ```ts
 * import { handlePortalLogout } from '@riverbankcms/sdk/portal';
 *
 * export const POST = handlePortalLogout();
 * ```
 */
import type { NextRequest } from 'next/server';
export interface PortalCallbackOptions {
    /**
     * Default redirect path if redirect_to is missing or invalid.
     * Defaults to '/portal'
     */
    defaultRedirectPath?: string;
    /**
     * @deprecated Use defaultRedirectPath instead
     */
    redirectPath?: string;
    /**
     * Whether to use secure cookies (HTTPS only).
     * Defaults to true in production.
     */
    secure?: boolean;
    /**
     * Dashboard URL for exchanging portal codes.
     * Can be:
     * - A string URL
     * - A function that returns the URL
     * - Omitted for auto-detection from RIVERBANK_*_DASHBOARD_URL env vars
     */
    dashboardUrl?: string | (() => string);
    /**
     * Timeout for code exchange request in milliseconds.
     * Defaults to 10 seconds.
     */
    exchangeTimeoutMs?: number;
}
export interface PortalLogoutOptions {
    /**
     * Default redirect path after logout if redirect_to is missing or invalid.
     * Defaults to '/'
     */
    defaultRedirectPath?: string;
    /**
     * @deprecated Use defaultRedirectPath instead
     */
    redirectPath?: string;
    /**
     * Whether to use secure cookies (HTTPS only).
     * Defaults to true in production.
     */
    secure?: boolean;
    /**
     * Dashboard URL for invalidating the session.
     * Can be:
     * - A string URL
     * - A function that returns the URL
     * - Omitted for auto-detection from RIVERBANK_*_DASHBOARD_URL env vars
     */
    dashboardUrl?: string | (() => string);
}
export interface PortalResponseCookie {
    name: string;
    value: string;
    httpOnly?: boolean;
    secure?: boolean;
    sameSite?: 'lax' | 'strict' | 'none';
    path?: string;
    maxAge?: number;
}
export interface PortalRouteResponse extends Response {
    cookies: {
        get(name: string): PortalResponseCookie | undefined;
    };
}
/**
 * Get dashboard URL from environment without requiring API keys.
 * Returns null if not configured.
 *
 * This is a simpler alternative to getRiverbankEnv() that doesn't
 * require SITE_ID or API_KEY to be set.
 */
export declare function getDashboardUrl(): string | null;
/**
 * Create a GET route handler for the portal callback.
 *
 * This handler:
 * 1. Extracts the portal_code from the URL query params
 * 2. Validates the redirect_to path (prevents open redirects)
 * 3. Exchanges portal_code server-to-server for session token
 * 4. Stores the token in an httpOnly cookie
 * 5. Redirects to the validated path
 *
 * @param options - Configuration options
 * @returns GET route handler function
 */
export declare function handlePortalCallback(options?: PortalCallbackOptions): (request: NextRequest) => Promise<PortalRouteResponse>;
/**
 * Create a POST route handler for portal logout.
 *
 * This handler:
 * 1. Gets the redirect path from form data or query params
 * 2. Calls the dashboard logout API to invalidate the session
 * 3. Clears the portal token cookie
 * 4. Redirects to the validated path
 *
 * @param options - Configuration options
 * @returns POST route handler function
 */
export declare function handlePortalLogout(options?: PortalLogoutOptions): (request: NextRequest) => Promise<PortalRouteResponse>;
