/**
 * @module @arcis/node/middleware/sensitive-paths
 * v1.7 W2 wire-up. Blocks well-known scanner probe paths.
 *
 * Sensitive paths fall into three buckets and almost never have a
 * legitimate reason to be served by a typical app:
 *   1. Dotfile / VCS leaks   `/.env`, `/.git/*`, `/.svn/*`, `/.aws/`, ...
 *   2. PHP/Wordpress probes  `/wp-admin`, `/wp-login.php`, `/phpmyadmin`, ...
 *   3. Diagnostic endpoints  `/server-status`, `/phpinfo.php`, `/info.php`, ...
 *
 * Apps with legitimate routes that overlap (an actual WordPress site,
 * a custom `/admin` panel) opt out via `arcis({ scannerPaths: false })`
 * or pass a custom matcher list.
 */
import type { RequestHandler } from 'express';
export interface ScannerPathsOptions {
    /** HTTP status for blocked probes. Default: 403 */
    statusCode?: number;
    /** Error message for blocked probes. Default: 'Access denied.' */
    message?: string;
    /**
     * Custom matchers (overrides the default list entirely). Each entry
     * is matched against `req.path` with `.test()`. To EXTEND the default
     * list use `[...SENSITIVE_PATH_PATTERNS, /your-extra/]`.
     */
    patterns?: RegExp[];
}
/**
 * Default sensitive-path patterns. Each is a case-insensitive prefix
 * match anchored to the start of the request path. Conservative on
 * shapes that have any reasonable legit use; aggressive on dotfile and
 * VCS-leak paths that should never be served.
 */
export declare const SENSITIVE_PATH_PATTERNS: ReadonlyArray<RegExp>;
/**
 * Test a URL path against the sensitive-path list. Returns the first
 * matching pattern's source for logging/telemetry, or `null`.
 */
export declare function detectSensitivePath(path: string, patterns?: ReadonlyArray<RegExp>): string | null;
/**
 * Build an Express middleware that blocks sensitive-path probes.
 * `arcis()` wires this on by default; users can opt out via
 * `arcis({ scannerPaths: false })`.
 */
export declare function scannerPathProtection(options?: ScannerPathsOptions): RequestHandler;
//# sourceMappingURL=sensitive-paths.d.ts.map