# Server (https://v1.s3.dimah.dev/docs/server)

[`@dimah-s3/server`](https://www.npmjs.com/package/@dimah-s3/server) generates
presigned URLs, enforces route constraints, authorizes requests through
guards, and coordinates lifecycle callbacks.

Uploads and, by default, downloads travel directly between the browser and the
bucket through short-lived signed URLs. Downloads can instead use same-origin
proxy mode. S3 credentials stay on the server, and deletions run server-side.

## Key features [#key-features]

- **Unified configuration** — `dimahS3()` exports both an HTTP route handler and a typed server-side `api`.
- **Server-owned keys** — The server generates namespaced object keys instead of trusting browser-provided keys.
- **HeadObject verification** — Confirmation rechecks stored byte length and `Content-Type` metadata from S3.
- **Lifecycle hooks** — Run auth, persistence, quotas, and cleanup at defined operation boundaries.
- **Framework adapters** — Mount handlers in Next.js, Hono, Express, Fastify, SvelteKit, Elysia, and standard Fetch runtimes.

## Documentation [#documentation]

<Cards>
  <Card
    title="Server Setup"
    href="/docs/server/setup"
    description="Install and mount route handlers across modern runtimes."
  />
  <Card
    title="Routes"
    href="/docs/server/routes"
    description="Configure routes, file constraints, operations, and key prefixes."
  />
  <Card
    title="Security"
    href="/docs/server/security"
    description="Guards, key isolation, tenant scoping, and metadata validation."
  />
  <Card
    title="Errors"
    href="/docs/server/errors"
    description="APIError structure, error codes, and client mapping."
  />
  <Card
    title="Lifecycle Hooks"
    href="/docs/server/hooks/upload"
    description="Presign, confirmation, download, and delete lifecycle events."
  />
  <Card
    title="Plugins"
    href="/docs/server/plugins"
    description="Extend server capabilities with plugins like @dimah-s3/db."
  />
</Cards>