/**
 * @module @arcis/node/middleware/signup-protection
 *
 * Composite signup-form protection: one middleware that combines email
 * validation (syntax + disposable), bot detection, and a dedicated
 * per-IP rate limit. Matches the Arcjet `protectSignup` convenience
 * primitive but stays fully local — no cloud lookups.
 *
 * @example
 *   app.post('/signup', signupProtection(), handler);
 *
 * @example
 *   app.post('/signup', signupProtection({
 *     emailField: 'email',
 *     rateLimit: { max: 5, windowMs: 60_000 },
 *     blockDisposable: true,
 *   }), handler);
 */
import type { Request, RequestHandler } from 'express';
import { type BotCategory } from './bot-detection';
export type SignupBlockReason = 'missing_email' | 'invalid_email' | 'disposable_email' | 'bot' | 'rate_limited';
export interface SignupCheckResult {
    allowed: boolean;
    reason: SignupBlockReason | 'ok';
    details?: Record<string, unknown>;
}
export interface SignupProtectionOptions {
    /** Request body field holding the email address. Default: 'email' */
    emailField?: string;
    /** Run email validation. Default: true */
    checkEmail?: boolean;
    /** Reject disposable email domains. Default: true */
    blockDisposable?: boolean;
    /** Run bot detection. Default: true */
    checkBot?: boolean;
    /** Bot categories allowed through (e.g. test harnesses). Default: [] — all bots blocked */
    allowedBotCategories?: BotCategory[];
    /** Per-IP rate limit on signup endpoint. Set to `false` to disable. Default: 5 requests / 60s */
    rateLimit?: {
        max?: number;
        windowMs?: number;
    } | false;
    /** Extra email domains to allow (bypasses disposable check) */
    allowedEmailDomains?: string[];
    /** Extra email domains to block */
    blockedEmailDomains?: string[];
    /** Called when a request is blocked — for telemetry/logging */
    onBlocked?: (req: Request, result: SignupCheckResult) => void;
}
export interface SignupProtectionMiddleware extends RequestHandler {
    /** Release the rate-limiter cleanup interval */
    close: () => void;
}
/**
 * Pure signup check — no rate-limit mutation, no response writes.
 * Useful for framework adapters or custom control flow.
 */
export declare function checkSignup(req: Request, options?: SignupProtectionOptions): SignupCheckResult;
/**
 * Express middleware: applies bot + email + rate-limit checks to a signup
 * endpoint. Responds 400/403/429 with a JSON body on block; otherwise
 * calls `next()`.
 */
export declare function signupProtection(options?: SignupProtectionOptions): SignupProtectionMiddleware;
//# sourceMappingURL=signup-protection.d.ts.map