/**
 * file-bytes.ts — turning bytes into text that a content guard can actually scan.
 *
 * Every guard in this repo that reads files used to decide "is this text?" with
 * some form of `buffer.includes(0)` and skip the file when the answer was no.
 * That is not a heuristic, it is an opt-out: appending or prepending one NUL
 * byte removed a file from the scan entirely, silently, and the guard still
 * exited 0. It was live in three places at once — the R4 infrastructure scan,
 * `content-scan.ts`'s secret/PII scanner, and `release-guard.ts`'s own marker
 * scan, which is the actual publish gate.
 *
 * The rule here is: decode everything, skip almost nothing, and let the caller
 * treat a skip as a finding.
 */
/**
 * Whether the bytes are a compiled/compressed binary.
 *
 * Decided by CONTENT, never by filename. A filename-based version of this check
 * was itself a bypass: a plain-text file named `leak.gz` was skipped without
 * ever being opened. An extension is attacker-chosen; the leading bytes are not.
 *
 * Note what this deliberately does NOT do: it does not treat "contains a NUL"
 * as binary. Plenty of legitimate text files contain NUL — fixtures, test
 * corpora, anything storing a NUL-separated key — and treating that byte as a
 * skip signal is exactly the hole being closed.
 */
export declare function looksBinary(buffer: Buffer): boolean;
/**
 * Decode file bytes to scannable text.
 *
 *  - UTF-16 (BOM-marked, or detected from the alternating-NUL pattern of
 *    BOM-less ASCII) is decoded properly, so an identifier stored as UTF-16 is
 *    ordinary text by the time any rule sees it.
 *  - NUL bytes are stripped AFTER decoding, which defeats NUL-interleaved
 *    payloads (`1\0"2\0"3456789012`) and, as a bonus, renders BOM-less UTF-16
 *    ASCII readable even when the heuristic misses it.
 *  - Line structure is preserved: NUL is not a newline, so reported line
 *    numbers stay correct.
 *
 * Stripping NULs cannot cause a false negative — no rule in this repo matches a
 * NUL — and it removes the single byte that most reliably blinded these guards.
 */
export declare function decodeForScanning(buffer: Buffer): string;