@dimah-s3/server presigns uploads and downloads, enforces route constraints, runs your guards, and calls your lifecycle hooks.

Uploads, and by default downloads, go straight between the browser and the bucket through short-lived signed URLs. Downloads can instead stream through your server in proxy mode. S3 credentials stay on the server, and deletes run there too.

Key features

One instance — dimahS3() returns an HTTP handler, an in-process api with the browser client's shape, and put for server-side uploads.
Server-owned keys — The browser sends a route name. The server builds the object key.
Upload tickets — Presign returns a signed ticket. Confirm and every later multipart call send only that ticket, optionally bound to a user.
HeadObject verification — Confirm reads the stored size and type from S3, not from the browser.
Guards and locals — Guards authorize each call and can pass typed locals to later hooks.
Hardened proxy — GET /file streams objects with a sandbox CSP, single-range support, and conditional requests.
Framework adapters — Next.js, Hono, Express, Fastify, SvelteKit, Elysia, Node, and any Fetch runtime.