export declare const EMAIL_VALIDATION_BLOCK_REASON: {
    readonly DISPOSABLE: "disposable";
    readonly FORBIDDEN_DOMAIN: "forbidden_domain";
};
export type EmailValidationBlockReason = (typeof EMAIL_VALIDATION_BLOCK_REASON)[keyof typeof EMAIL_VALIDATION_BLOCK_REASON];
export type EmailValidationResult = {
    status: 'allowed';
    email: string;
    domain: string;
} | {
    status: 'blocked';
    email: string;
    domain: string;
    reason: EmailValidationBlockReason;
} | {
    status: 'invalid';
};
type EmailValidationOptions = {
    /** Domain suffixes to block (e.g., 'test', 'example'). Blocks emails where domain ends with these suffixes. */
    forbiddenDomains?: string[];
};
/**
 * Validates email addresses for magic link authentication.
 *
 * Two security checks:
 * 1. Blocks disposable/temporary email domains (via MailChecker)
 * 2. Blocks emails with forbidden domain suffixes
 *
 * Suffix matching:
 * - 'example' blocks 'company.example' and 'sub.company.example'
 * - 'example' does NOT block 'example.com'
 * - To block 'example.com', use suffix 'example.com'
 *
 * @example
 * const service = new EmailValidationService({
 *   forbiddenDomains: ['test', 'example']
 * });
 *
 * // Allowed
 * service.validateMagicLinkEmail('user@gmail.com');     // ends with .com
 * service.validateMagicLinkEmail('user@example.com');  // ends with .com, not .example
 *
 * // Blocked - forbidden suffix
 * service.validateMagicLinkEmail('user@company.test');      // ends with .test
 * service.validateMagicLinkEmail('user@sub.mail.example');  // ends with .example
 */
export declare class EmailValidationService {
    private readonly forbiddenDomainSuffixes;
    constructor(options?: EmailValidationOptions);
    validateMagicLinkEmail(value: unknown): EmailValidationResult;
    /**
     * Checks if email uses a disposable/temporary email service.
     * Uses MailChecker library which maintains a list of known disposable domains.
     */
    private isDisposableEmail;
    /**
     * Checks if domain matches any forbidden suffix.
     * Matches only the END of domain (e.g., 'test' matches 'mail.test' but not 'test.com').
     *
     * @example
     * // forbidden suffixes: ['example', 'test']
     *
     * matchesForbiddenSuffix('company.example')       // true - ends with .example
     * matchesForbiddenSuffix('sub.company.example')   // true - ends with .example
     * matchesForbiddenSuffix('example.com')           // false - ends with .com
     * matchesForbiddenSuffix('test.org')              // false - ends with .org
     */
    private matchesForbiddenSuffix;
}
export {};
//# sourceMappingURL=email-validation-service.d.ts.map