export declare function createExtensionsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<unknown>>;
export declare const DESTRUCTIVE_SQL_RE: RegExp;
export declare const SENSITIVE_SQL_RE: RegExp;
export declare const POSITIONAL_INSERT_RE: RegExp;
/**
 * Test a blocklist regex against the SQL with comments normalized two ways, so
 * a comment placed *inside* a keyword can't smuggle a blocked construct past a
 * literal-token match:
 *   - comments → space  catches `DROP /* x *​/ TABLE` (token boundaries kept)
 *   - comments → empty  catches `DR/**​/OP TABLE`     (split keyword rejoined)
 *
 * A statement is refused if EITHER normalization trips the regex. This only
 * ever ADDS matches — it never newly-allows SQL — so it cannot loosen the gate
 * (real extension SQL doesn't embed comments inside keywords, so false-positive
 * risk is negligible). The authoritative ownership boundary remains the
 * fail-closed temp-view scoping in scripts/db/scoping.ts; this stays defense in
 * depth. See the TODO above re: replacing all of this with a real SQL parser.
 */
export declare function matchesSqlGate(re: RegExp, sql: string): boolean;
//# sourceMappingURL=routes.d.ts.map