/**
 * Private-blob providers backed by S3-compatible buckets.
 *
 * - `s3-private` stores blobs in the workspace's own bucket (Settings → File
 *   uploads, or `S3_*` env vars). A public URL is optional. When the bucket
 *   has one, anyone who learns an object key could read it there, so blobs
 *   are encrypted and never handed out as direct links.
 * - `hosted-private` stores blobs in the deployment's hosted private bucket
 *   (`hostedStorage`) when the workspace has no bucket of its own.
 *
 * Each handle records, encrypted, where its object lives and which credential
 * scope reads it. A reader without the owner's request context (an anonymous
 * viewer of a public page, a background job) still reads the right bucket,
 * and a tampered handle can't point at another workspace's object.
 */
import type { PrivateBlobProvider } from "./types.js";
export declare const S3_PRIVATE_BLOB_PROVIDER_ID = "s3-private";
export declare const HOSTED_PRIVATE_BLOB_PROVIDER_ID = "hosted-private";
export declare const s3PrivateBlobProvider: PrivateBlobProvider;
export declare const hostedPrivateBlobProvider: PrivateBlobProvider;
/**
 * Registers the S3 private providers once: the workspace's own bucket first,
 * then the hosted bucket, so a workspace that connected storage keeps its
 * private blobs there.
 */
export declare function ensureS3PrivateBlobProviders(): void;