# Introduction (https://s3.dimah.dev/docs/server)



[`@dimah-s3/server`](https://www.npmjs.com/package/@dimah-s3/server) is the backend engine for dimah-s3. It generates presigned URLs, enforces route constraints, authorizes requests through guards, and coordinates lifecycle callbacks.

Upload and download operate directly between the client and the bucket via short-lived signed URLs. S3 credentials remain on the server, while deletion is handled securely server-side.

## Key features [#key-features]

* **Unified configuration** — `dimahS3()` exports both an HTTP route handler and a typed server-side `api`.
* **Server-owned keys** — Keys follow `{keyPrefix}/{uuid}/{name}` namespaces to prevent bucket tampering.
* **HeadObject verification** — Real file sizes and MIME types are verified directly from S3 on upload confirmation.
* **Lifecycle hooks** — Inject auth, database records, or quota checks at presign, confirmation, and deletion.
* **Universal adapters** — Native handlers for Next.js, Hono, Express, Fastify, SvelteKit, Elysia, and standard Fetch.

## Documentation [#documentation]

<Cards>
  <Card title="Setup & Adapters" href="/docs/server/setup" description="Install and mount route handlers across modern runtimes." />

  <Card title="Route Definitions" href="/docs/server/routes" description="Configure routes, file constraints, operations, and key prefixes." />

  <Card title="Security & Auth" href="/docs/server/security" description="Guards, key isolation, tenant scoping, and metadata validation." />

  <Card title="Error Handling" href="/docs/server/errors" description="APIError structure, error codes, and client mapping." />

  <Card title="Lifecycle Hooks" href="/docs/server/hooks/upload" description="Presign, confirmation, download, and delete lifecycle events." />

  <Card title="Plugins" href="/docs/server/plugins" description="Extend server capabilities with plugins like @dimah-s3/db." />
</Cards>