email

Business-email rule shared by sign-up, invites and onboarding: refuses personal providers, privacy relays and disposable domains, subdomains included.

This package owns the rule and its domain lists (free-email-domains, disposable-email-domains-js, and the privacy relays in src/relay-domains.ts). Callers decide what to do with a refusal.

• @cfxlabsinc/email exports businessEmailRefusal, isPersonalEmailDomain and emailDomain. It loads the lists, so it is server-only: keep it out of client bundles.
• @cfxlabsinc/email/domain exports emailDomain only. It is client-safe.
• Updating the lists: bump the two exactly-pinned versions in the root package.json (free-email-domains, disposable-email-domains-js), then bun install.
• Never add free-email-domains to trustedDependencies. Its postinstall re-downloads the list from live URLs, so trusting it would replace the pinned list that ships with whatever those URLs serve at install time.
• A business domain a list gets wrong goes in src/allowed-domains.ts; see docs/runbooks/business-email-false-positive.md.