@dimah-s3/server 0.7.3 → 0.8.0

package/dist/index.js

@@ -1,127 +1,88 @@
-import { S3_API_ROUTES, DimahS3Error, parseFileName, buildContentDisposition, S3_ERROR_CODES, pluginEndpointPath, S3_API_BASE_PATH, normalizeS3ApiBasePath } from '@dimah-s3/core';
-export { DimahS3Error } from '@dimah-s3/core';
-import { ListPartsCommand, AbortMultipartUploadCommand, CompleteMultipartUploadCommand, HeadObjectCommand, UploadPartCommand, CreateMultipartUploadCommand, DeleteObjectCommand, GetObjectCommand, PutObjectCommand, GetObjectAclCommand } from '@aws-sdk/client-s3';
+import { S3_API_ROUTES, isAPIError, DimahS3Error, S3_ERROR_CODES, confirmBodySchema, deleteQuerySchema, downloadQuerySchema, multipartAbortBodySchema, multipartCompleteBodySchema, multipartInitBodySchema, multipartListPartsQuerySchema, multipartSignPartBodySchema, uploadBodySchema, parseFileName, buildContentDisposition, normalizeS3ApiBasePath, S3_API_BASE_PATH } from '@dimah-s3/core';
+export { DimahS3Error, isAPIError, isDimahS3Error, isS3ErrorCode } from '@dimah-s3/core';
+import { GetObjectAclCommand, HeadObjectCommand, DeleteObjectCommand, GetObjectCommand, AbortMultipartUploadCommand, ListPartsCommand, CompleteMultipartUploadCommand, CreateMultipartUploadCommand, UploadPartCommand, PutObjectCommand } from '@aws-sdk/client-s3';
+import { createMiddleware, createEndpoint, createRouter, toResponse } from 'better-call';
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
 import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
 
 // src/dimah-s3.ts
+
+// src/helpers/is-aws-not-found.ts
+function isAwsNotFound(err) {
+  const e = err;
+  return e?.name === "NoSuchKey" || e?.name === "NotFound" || e?.Code === "NoSuchKey" || e?.Code === "NotFound" || e?.$metadata?.httpStatusCode === 404;
+}
+var DEFAULT_ACL_LOOKUP_TIMEOUT_MS = 1500;
+async function resolveObjectAcl(s3, bucket, key, timeoutMs = DEFAULT_ACL_LOOKUP_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const result = await s3.send(
+      new GetObjectAclCommand({ Bucket: bucket, Key: key }),
+      { abortSignal: controller.signal }
+    );
+    const isPublic = result.Grants?.some(
+      (g) => g.Grantee?.URI === "http://acs.amazonaws.com/groups/global/AllUsers" && (g.Permission === "READ" || g.Permission === "FULL_CONTROL")
+    );
+    return isPublic ? "public-read" : "private";
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 var errors = {
-  notFound: () => new DimahS3Error("Not Found", 404, { code: S3_ERROR_CODES.NOT_FOUND }),
-  invalidJson: () => new DimahS3Error("Invalid JSON payload", 400, {
-    code: S3_ERROR_CODES.INVALID_JSON
-  }),
-  forbidden: () => new DimahS3Error("Forbidden", 403, { code: S3_ERROR_CODES.FORBIDDEN }),
-  internalError: () => new DimahS3Error("Internal server error", 500, {
-    code: S3_ERROR_CODES.INTERNAL_ERROR
-  }),
-  objectNotFound: () => new DimahS3Error("Object not found", 404, {
-    code: S3_ERROR_CODES.OBJECT_NOT_FOUND
-  }),
-  s3NetworkError: (code) => new DimahS3Error(
-    `S3 endpoint unreachable (${code}): check your endpoint URL and network connectivity`,
-    502,
-    { code: S3_ERROR_CODES.S3_NETWORK_ERROR, params: { code } }
-  ),
-  fieldRequired: (name) => new DimahS3Error(`${name} is required`, 400, {
-    code: S3_ERROR_CODES.FIELD_REQUIRED,
-    params: { name }
+  notFound: () => DimahS3Error.from("NOT_FOUND", S3_ERROR_CODES.NOT_FOUND),
+  unauthorized: () => DimahS3Error.from("UNAUTHORIZED", S3_ERROR_CODES.UNAUTHORIZED),
+  forbidden: () => DimahS3Error.from("FORBIDDEN", S3_ERROR_CODES.FORBIDDEN),
+  conflict: () => DimahS3Error.from("CONFLICT", S3_ERROR_CODES.CONFLICT),
+  internalError: () => DimahS3Error.from("INTERNAL_SERVER_ERROR", S3_ERROR_CODES.INTERNAL_ERROR),
+  objectNotFound: () => DimahS3Error.from("NOT_FOUND", S3_ERROR_CODES.OBJECT_NOT_FOUND),
+  featureDisabled: (feature) => DimahS3Error.from("NOT_FOUND", {
+    code: S3_ERROR_CODES.FEATURE_DISABLED.code,
+    message: S3_ERROR_CODES.FEATURE_DISABLED.message.replaceAll(
+      "{feature}",
+      feature
+    ),
+    params: { feature }
   }),
-  /** Missing `key` on query-string routes (download / delete / list-parts). */
-  keyRequired: () => new DimahS3Error("key query parameter is required", 400, {
-    code: S3_ERROR_CODES.KEY_REQUIRED
+  invalidKey: () => DimahS3Error.from("BAD_REQUEST", S3_ERROR_CODES.INVALID_KEY),
+  invalidBucket: (bucket) => DimahS3Error.from("FORBIDDEN", {
+    code: S3_ERROR_CODES.INVALID_BUCKET.code,
+    message: S3_ERROR_CODES.INVALID_BUCKET.message,
+    params: { bucket }
   }),
-  uploadIdRequired: () => new DimahS3Error("uploadId is required", 400, {
-    code: S3_ERROR_CODES.UPLOAD_ID_REQUIRED
+  s3NetworkError: (code) => DimahS3Error.from("BAD_GATEWAY", {
+    code: S3_ERROR_CODES.S3_NETWORK_ERROR.code,
+    message: S3_ERROR_CODES.S3_NETWORK_ERROR.message.replaceAll(
+      "{code}",
+      code
+    ),
+    params: { code }
   }),
-  partNumberInvalid: () => new DimahS3Error("partNumber must be a positive integer", 400, {
-    code: S3_ERROR_CODES.PART_NUMBER_INVALID
-  }),
-  partsRequired: () => new DimahS3Error("At least one valid part is required", 400, {
-    code: S3_ERROR_CODES.PARTS_REQUIRED
-  }),
-  fileSizeRequiredUpload: () => new DimahS3Error(
-    "fileSize is required when upload.requireFileSize is enabled",
-    400,
-    { code: S3_ERROR_CODES.FILE_SIZE_REQUIRED_UPLOAD }
+  fileSizeRequiredUpload: () => DimahS3Error.from("BAD_REQUEST", S3_ERROR_CODES.FILE_SIZE_REQUIRED_UPLOAD),
+  fileSizeRequiredMultipart: () => DimahS3Error.from(
+    "BAD_REQUEST",
+    S3_ERROR_CODES.FILE_SIZE_REQUIRED_MULTIPART
   ),
-  fileSizeRequiredMultipart: () => new DimahS3Error(
-    "fileSize is required when multipart.requireFileSize is enabled",
-    400,
-    { code: S3_ERROR_CODES.FILE_SIZE_REQUIRED_MULTIPART }
-  )
+  validationError: (message) => DimahS3Error.from("BAD_REQUEST", {
+    code: S3_ERROR_CODES.VALIDATION_ERROR.code,
+    message
+  })
 };
-function requireString(value, name) {
-  const trimmed = typeof value === "string" ? value.trim() : "";
-  if (!trimmed) throw errors.fieldRequired(name);
-  return trimmed;
-}
-function statusOf(err, fallback) {
-  return typeof err?.status === "number" ? err.status : fallback;
-}
-function toDimahS3Error(err, fallbackMessage, fallbackStatus = 403, options) {
-  if (err instanceof DimahS3Error) return err;
-  const message = err instanceof Error && err.message.trim() ? err.message : fallbackMessage;
-  const status = statusOf(err, fallbackStatus);
-  return new DimahS3Error(message, status, {
-    cause: err instanceof Error ? err : void 0,
-    ...{}
-  });
-}
-async function parseBody(request) {
-  try {
-    const body = await request.json();
-    return body && typeof body === "object" ? body : null;
-  } catch {
-    return null;
-  }
-}
-function errorJson(err) {
-  return Response.json(
-    {
-      message: err.message,
-      ...err.code !== void 0 ? { code: err.code } : {},
-      ...err.params !== void 0 ? { params: err.params } : {}
-    },
-    { status: err.status }
-  );
-}
-var NETWORK_CODES = /* @__PURE__ */ new Set([
-  "EAI_AGAIN",
-  "ECONNREFUSED",
-  "ECONNRESET",
-  "ETIMEDOUT",
-  "ENOTFOUND"
-]);
-function toErrorResponse(err) {
-  if (err instanceof DimahS3Error) {
-    return errorJson(err);
-  }
-  const code = err?.code;
-  if (typeof code === "string" && NETWORK_CODES.has(code)) {
-    const networkErr = errors.s3NetworkError(code);
-    console.error("[S3 API]", networkErr.message, err);
-    return errorJson(networkErr);
-  }
-  console.error("[S3 API]", err);
-  return errorJson(errors.internalError());
-}
-function wrapHandler(handler) {
-  return async (request) => {
-    try {
-      return await handler(request);
-    } catch (err) {
-      return toErrorResponse(err);
-    }
-  };
-}
+
+// src/internal-helpers.ts
 async function runHook(hook, context) {
   if (!hook) return;
   try {
     await hook(context);
   } catch (err) {
-    if (err instanceof DimahS3Error) throw err;
+    if (isAPIError(err)) throw err;
     if (err instanceof Error && err.message.trim()) {
-      throw toDimahS3Error(err, errors.forbidden().message, 403);
+      throw new DimahS3Error("FORBIDDEN", {
+        message: err.message,
+        cause: err
+      });
     }
     throw errors.forbidden();
   }
@@ -131,7 +92,7 @@ async function runLifecycleHook(hook, context) {
   try {
     await hook(context);
   } catch (err) {
-    if (err instanceof DimahS3Error) throw err;
+    if (isAPIError(err)) throw err;
     console.error("[S3 API] lifecycle hook failed", err);
     throw errors.internalError();
   }
@@ -144,44 +105,161 @@ function requestFromHeaders(headers) {
   return new Request("http://dimah-s3.local", { headers });
 }
 
-// src/helpers/is-aws-not-found.ts
-function isAwsNotFound(err) {
-  const e = err;
-  return e?.name === "NoSuchKey" || e?.name === "NotFound" || e?.Code === "NoSuchKey" || e?.Code === "NotFound" || e?.$metadata?.httpStatusCode === 404;
+// src/helpers/resolve-target.ts
+function assertSafeObjectKey(key) {
+  const trimmed = key.replace(/^\/+/u, "").replace(/\/+$/u, "");
+  if (!trimmed) {
+    throw errors.invalidKey();
+  }
+  if (trimmed.includes("\\") || trimmed.includes("\0")) {
+    throw errors.invalidKey();
+  }
+  const parts = trimmed.split("/");
+  if (parts.some((part) => part === "" || part === "." || part === "..")) {
+    throw errors.invalidKey();
+  }
+  return parts.join("/");
 }
-var DEFAULT_ACL_LOOKUP_TIMEOUT_MS = 1500;
-async function resolveObjectAcl(s3, bucket, key, timeoutMs = DEFAULT_ACL_LOOKUP_TIMEOUT_MS) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const result = await s3.send(
-      new GetObjectAclCommand({ Bucket: bucket, Key: key }),
-      { abortSignal: controller.signal }
-    );
-    const isPublic = result.Grants?.some(
-      (g) => g.Grantee?.URI === "http://acs.amazonaws.com/groups/global/AllUsers" && (g.Permission === "READ" || g.Permission === "FULL_CONTROL")
+function applyPrefix(prefix, key) {
+  const p = assertSafeObjectKey(prefix);
+  const k = assertSafeObjectKey(key);
+  if (k === p || k.startsWith(`${p}/`)) return k;
+  return `${p}/${k}`;
+}
+async function resolveObjectKey(policy, context) {
+  if (policy?.resolveKey) {
+    return assertSafeObjectKey(await policy.resolveKey(context));
+  }
+  const prefix = typeof policy?.prefix === "function" ? await policy.prefix(context) : policy?.prefix;
+  if (prefix) {
+    return applyPrefix(prefix, context.proposedKey);
+  }
+  return assertSafeObjectKey(context.proposedKey);
+}
+function resolveBucket(config, requested) {
+  if (!requested) return config.bucket;
+  if (config.allowClientBucket) return requested;
+  if (config.buckets?.length) {
+    if (config.buckets.includes(requested)) return requested;
+    throw errors.invalidBucket(requested);
+  }
+  return config.bucket;
+}
+async function resolveRequestTarget(config, policy, input) {
+  const bucket = resolveBucket(config, input.bucket);
+  const key = await resolveObjectKey(policy, {
+    request: input.request,
+    proposedKey: input.key,
+    fileName: input.fileName,
+    contentType: input.contentType,
+    bucket
+  });
+  return { key, bucket };
+}
+function normalizeFeature(value) {
+  if (value === void 0) return void 0;
+  if (value === false) return { enabled: false };
+  if (value === true) return { enabled: true };
+  return { ...value, enabled: value.enabled ?? true };
+}
+function isFeatureEnabled(config, feature) {
+  return config[feature]?.enabled === true;
+}
+function applyMultipartDefault(config, multipartInput) {
+  let next = config;
+  if (multipartInput === void 0 && config.upload?.enabled) {
+    next = {
+      ...config,
+      multipart: { ...config.multipart, enabled: true }
+    };
+  }
+  if (next.multipart && next.upload) {
+    next = {
+      ...next,
+      multipart: {
+        ...next.multipart,
+        prefix: next.multipart.prefix ?? next.upload.prefix,
+        resolveKey: next.multipart.resolveKey ?? next.upload.resolveKey
+      }
+    };
+  }
+  return next;
+}
+function normalizeFeatures(config) {
+  return {
+    upload: normalizeFeature(config.upload),
+    download: normalizeFeature(config.download),
+    delete: normalizeFeature(config.delete),
+    multipart: normalizeFeature(config.multipart)
+  };
+}
+
+// src/api/assert-feature-enabled.ts
+function assertFeatureEnabled(config, feature) {
+  if (!isFeatureEnabled(config, feature)) {
+    throw errors.featureDisabled(feature);
+  }
+}
+var s3ContextMiddleware = createMiddleware(async (ctx) => {
+  const injected = ctx.context;
+  if (!injected?.config) {
+    throw new Error(
+      "createS3Endpoint requires dimahS3 router context. Call endpoints through dimahS3().api or the HTTP handler."
     );
-    return isPublic ? "public-read" : "private";
-  } catch {
-    return void 0;
-  } finally {
-    clearTimeout(timeout);
   }
+  const request = ctx.request ?? injected.request ?? requestFromHeaders(ctx.headers);
+  await runHook(injected.config.guard, { request });
+  return {
+    config: injected.config,
+    request
+  };
+});
+var createS3Middleware = createMiddleware.create({
+  use: [s3ContextMiddleware]
+});
+
+// src/api/create-s3-endpoint.ts
+var createEndpointWithContext = createEndpoint.create({
+  use: [s3ContextMiddleware]
+});
+function withS3Validation(options) {
+  return {
+    ...options,
+    onValidationError: options.onValidationError ?? (({ message }) => {
+      throw errors.validationError(message);
+    })
+  };
 }
+var createS3Endpoint = ((pathOrOptions, optionsOrHandler, maybeHandler) => {
+  if (typeof pathOrOptions === "string") {
+    return createEndpointWithContext(
+      pathOrOptions,
+      withS3Validation(optionsOrHandler),
+      maybeHandler
+    );
+  }
+  return createEndpointWithContext(
+    withS3Validation(pathOrOptions),
+    optionsOrHandler
+  );
+});
 
-// src/procedures/confirm.ts
-async function confirm(config, input, request) {
-  const key = requireString(input.key, "key");
-  const bucket = input.bucket?.trim() || config.defaultBucket;
+// src/api/routes/confirm.ts
+async function handleConfirm(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.upload, {
+    request,
+    key: input.key,
+    bucket: input.bucket
+  });
   await runHook(config.upload?.confirmGuard, {
     request,
     key,
     bucket
   });
-  const head = await config.s3.send(
+  const head = await config.client.send(
     new HeadObjectCommand({ Bucket: bucket, Key: key })
   );
-  const acl = config.resolveObjectAcl ? await resolveObjectAcl(config.s3, bucket, key) : void 0;
+  const acl = config.resolveObjectAcl ? await resolveObjectAcl(config.client, bucket, key) : void 0;
   const fileName = parseFileName(head.ContentDisposition);
   const context = {
     request,
@@ -210,45 +288,68 @@ async function confirm(config, input, request) {
     lastModified: context.lastModified
   };
 }
-async function deleteObject(config, input, request) {
-  const key = input.key?.trim();
-  if (!key) {
-    throw errors.keyRequired();
+var confirm = createS3Endpoint(
+  S3_API_ROUTES.uploadConfirm,
+  { method: "POST", body: confirmBodySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "upload");
+    return handleConfirm(ctx.context.config, ctx.body, ctx.context.request);
   }
-  const bucket = input.bucket?.trim() || config.defaultBucket;
+);
+async function handleDelete(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.delete, {
+    request,
+    key: input.key,
+    bucket: input.bucket
+  });
   await runHook(config.delete?.guard, {
     request,
     key,
     bucket
   });
   try {
-    await config.s3.send(new HeadObjectCommand({ Bucket: bucket, Key: key }));
+    await config.client.send(
+      new HeadObjectCommand({ Bucket: bucket, Key: key })
+    );
   } catch (err) {
     if (isAwsNotFound(err)) {
       throw errors.objectNotFound();
     }
     throw err;
   }
-  await config.s3.send(new DeleteObjectCommand({ Bucket: bucket, Key: key }));
+  await config.client.send(
+    new DeleteObjectCommand({ Bucket: bucket, Key: key })
+  );
   await runLifecycleHook(config.delete?.onDeleted, { request, key, bucket });
   return { success: true, bucket, key };
 }
-async function download(config, input, request) {
-  const key = input.key?.trim();
-  if (!key) {
-    throw errors.keyRequired();
+var deleteObject = createS3Endpoint(
+  S3_API_ROUTES.delete,
+  { method: "DELETE", query: deleteQuerySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "delete");
+    return handleDelete(ctx.context.config, ctx.query, ctx.context.request);
   }
-  const bucket = input.bucket?.trim() || config.defaultBucket;
+);
+async function handleDownload(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.download, {
+    request,
+    key: input.key,
+    bucket: input.bucket,
+    fileName: input.fileName
+  });
   const expiresIn = normalizeExpiresIn(input.expiresIn);
-  const fileName = input.fileName?.trim();
-  await runHook(config.download?.presignGuard, {
+  const fileName = input.fileName;
+  await runHook(config.download?.guard, {
     request,
     key,
     bucket,
-    fileName: fileName || void 0
+    fileName
   });
   try {
-    await config.s3.send(new HeadObjectCommand({ Bucket: bucket, Key: key }));
+    await config.client.send(
+      new HeadObjectCommand({ Bucket: bucket, Key: key })
+    );
   } catch (err) {
     if (isAwsNotFound(err)) {
       throw errors.objectNotFound();
@@ -256,7 +357,7 @@ async function download(config, input, request) {
     throw err;
   }
   const url = await getSignedUrl(
-    config.s3,
+    config.client,
     new GetObjectCommand({
       Bucket: bucket,
       Key: key,
@@ -268,23 +369,34 @@ async function download(config, input, request) {
     request,
     key,
     bucket,
-    fileName: fileName || void 0,
+    fileName,
     url,
     expiresIn
   });
   return { bucket, key, url, expiresIn };
 }
-async function multipartAbort(config, input, request) {
-  const key = requireString(input.key, "key");
-  const uploadId = requireString(input.uploadId, "uploadId");
-  const bucket = input.bucket?.trim() || config.defaultBucket;
+var download = createS3Endpoint(
+  S3_API_ROUTES.download,
+  { method: "GET", query: downloadQuerySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "download");
+    return handleDownload(ctx.context.config, ctx.query, ctx.context.request);
+  }
+);
+async function handleAbort(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.multipart, {
+    request,
+    key: input.key,
+    bucket: input.bucket
+  });
+  const uploadId = input.uploadId;
   await runHook(config.multipart?.abortGuard, {
     request,
     key,
     bucket,
     uploadId
   });
-  await config.s3.send(
+  await config.client.send(
     new AbortMultipartUploadCommand({
       Bucket: bucket,
       Key: key,
@@ -299,14 +411,22 @@ async function multipartAbort(config, input, request) {
   });
   return { bucket, key, uploadId, aborted: true };
 }
-async function multipartComplete(config, input, request) {
-  const key = requireString(input.key, "key");
-  const uploadId = requireString(input.uploadId, "uploadId");
-  const parts = (Array.isArray(input.parts) ? input.parts : []).map(({ partNumber }) => Number(partNumber)).filter((n) => Number.isInteger(n) && n > 0).sort((a, b) => a - b);
-  if (!parts.length) {
-    throw errors.partsRequired();
+var multipartAbort = createS3Endpoint(
+  S3_API_ROUTES.multipartAbort,
+  { method: "POST", body: multipartAbortBodySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "multipart");
+    return handleAbort(ctx.context.config, ctx.body, ctx.context.request);
   }
-  const bucket = input.bucket?.trim() || config.defaultBucket;
+);
+async function handleComplete(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.multipart, {
+    request,
+    key: input.key,
+    bucket: input.bucket
+  });
+  const uploadId = input.uploadId;
+  const parts = input.parts.map(({ partNumber }) => partNumber).sort((a, b) => a - b);
   const partRefs = parts.map((partNumber) => ({ partNumber }));
   await runHook(config.multipart?.completeGuard, {
     request,
@@ -315,7 +435,7 @@ async function multipartComplete(config, input, request) {
     uploadId,
     parts: partRefs
   });
-  const listed = await config.s3.send(
+  const listed = await config.client.send(
     new ListPartsCommand({ Bucket: bucket, Key: key, UploadId: uploadId })
   );
   const listedParts = listed.Parts ?? [];
@@ -323,7 +443,7 @@ async function multipartComplete(config, input, request) {
     const found = listedParts.find((p) => p.PartNumber === partNumber);
     return { PartNumber: partNumber, ETag: found?.ETag ?? "" };
   });
-  const completeResult = await config.s3.send(
+  const completeResult = await config.client.send(
     new CompleteMultipartUploadCommand({
       Bucket: bucket,
       Key: key,
@@ -331,12 +451,12 @@ async function multipartComplete(config, input, request) {
       MultipartUpload: { Parts: completeParts }
     })
   );
-  let head = await config.s3.send(
+  let head = await config.client.send(
     new HeadObjectCommand({ Bucket: bucket, Key: key })
   );
   for (let attempt = 0; attempt < 4 && !head.ContentLength; attempt++) {
     await new Promise((r) => setTimeout(r, 250 * 2 ** attempt));
-    head = await config.s3.send(
+    head = await config.client.send(
       new HeadObjectCommand({ Bucket: bucket, Key: key })
     );
   }
@@ -346,7 +466,7 @@ async function multipartComplete(config, input, request) {
   const metadata = head.Metadata ?? {};
   const versionId = head.VersionId;
   const lastModified = head.LastModified?.toISOString();
-  const acl = config.resolveObjectAcl ? await resolveObjectAcl(config.s3, bucket, key) : void 0;
+  const acl = config.resolveObjectAcl ? await resolveObjectAcl(config.client, bucket, key) : void 0;
   const fileName = parseFileName(head.ContentDisposition);
   await runLifecycleHook(config.multipart?.onComplete, {
     request,
@@ -376,9 +496,22 @@ async function multipartComplete(config, input, request) {
     lastModified
   };
 }
-async function multipartInit(config, input, request) {
-  const key = requireString(input.key, "key");
-  const bucket = input.bucket?.trim() || config.defaultBucket;
+var multipartComplete = createS3Endpoint(
+  S3_API_ROUTES.multipartComplete,
+  { method: "POST", body: multipartCompleteBodySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "multipart");
+    return handleComplete(ctx.context.config, ctx.body, ctx.context.request);
+  }
+);
+async function handleMultipartInit(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.multipart, {
+    request,
+    key: input.key,
+    bucket: input.bucket,
+    fileName: input.fileName,
+    contentType: input.contentType
+  });
   const acl = input.acl === "public-read" ? "public-read" : "private";
   const fileSize = typeof input.fileSize === "number" && input.fileSize > 0 ? Math.floor(input.fileSize) : void 0;
   if (config.multipart?.requireFileSize && fileSize === void 0) {
@@ -390,7 +523,7 @@ async function multipartInit(config, input, request) {
     bucket,
     fileSize
   });
-  const { UploadId } = await config.s3.send(
+  const { UploadId } = await config.client.send(
     new CreateMultipartUploadCommand({
       Bucket: bucket,
       Key: key,
@@ -413,24 +546,33 @@ async function multipartInit(config, input, request) {
   });
   return { bucket, key, uploadId: UploadId };
 }
-async function multipartListParts(config, input, request) {
-  const key = input.key?.trim() ?? "";
-  const uploadId = input.uploadId?.trim() ?? "";
-  const bucketParam = input.bucket?.trim();
-  if (!key) {
-    throw errors.keyRequired();
-  }
-  if (!uploadId) {
-    throw errors.uploadIdRequired();
+var multipartInit = createS3Endpoint(
+  S3_API_ROUTES.multipartInit,
+  { method: "POST", body: multipartInitBodySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "multipart");
+    ctx.setStatus(201);
+    return handleMultipartInit(
+      ctx.context.config,
+      ctx.body,
+      ctx.context.request
+    );
   }
-  const bucket = bucketParam || config.defaultBucket;
+);
+async function handleListParts(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.multipart, {
+    request,
+    key: input.key,
+    bucket: input.bucket
+  });
+  const uploadId = input.uploadId;
   await runHook(config.multipart?.listGuard, {
     request,
     key,
     bucket,
     uploadId
   });
-  const response = await config.s3.send(
+  const response = await config.client.send(
     new ListPartsCommand({
       Bucket: bucket,
       Key: key,
@@ -451,14 +593,22 @@ async function multipartListParts(config, input, request) {
   });
   return { parts };
 }
-async function multipartSignPart(config, input, request) {
-  const key = requireString(input.key, "key");
-  const uploadId = requireString(input.uploadId, "uploadId");
-  const partNumber = Number(input.partNumber);
-  if (!Number.isInteger(partNumber) || partNumber <= 0) {
-    throw errors.partNumberInvalid();
+var multipartListParts = createS3Endpoint(
+  S3_API_ROUTES.multipartListParts,
+  { method: "GET", query: multipartListPartsQuerySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "multipart");
+    return handleListParts(ctx.context.config, ctx.query, ctx.context.request);
   }
-  const bucket = input.bucket?.trim() || config.defaultBucket;
+);
+async function handleSignPart(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.multipart, {
+    request,
+    key: input.key,
+    bucket: input.bucket
+  });
+  const uploadId = input.uploadId;
+  const partNumber = input.partNumber;
   const expiresIn = normalizeExpiresIn(input.expiresIn);
   const partSize = typeof input.partSize === "number" && input.partSize > 0 ? Math.floor(input.partSize) : null;
   await runHook(config.multipart?.partGuard, {
@@ -470,7 +620,7 @@ async function multipartSignPart(config, input, request) {
     partSize: partSize ?? void 0
   });
   const presignedUrl = await getSignedUrl(
-    config.s3,
+    config.client,
     new UploadPartCommand({
       Bucket: bucket,
       Key: key,
@@ -492,14 +642,27 @@ async function multipartSignPart(config, input, request) {
     ...partSize !== null ? { partSize } : {}
   };
 }
-async function upload(config, input, request) {
-  const key = requireString(input.key, "key");
-  const bucket = input.bucket?.trim() || config.defaultBucket;
+var multipartPart = createS3Endpoint(
+  S3_API_ROUTES.multipartPart,
+  { method: "POST", body: multipartSignPartBodySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "multipart");
+    return handleSignPart(ctx.context.config, ctx.body, ctx.context.request);
+  }
+);
+async function handleUpload(config, input, request) {
+  const { key, bucket } = await resolveRequestTarget(config, config.upload, {
+    request,
+    key: input.key,
+    bucket: input.bucket,
+    fileName: input.fileName,
+    contentType: input.contentType
+  });
   const expiresIn = normalizeExpiresIn(input.expiresIn);
   const acl = input.acl === "public-read" ? "public-read" : "private";
-  const contentType = input.contentType?.trim() || "application/octet-stream";
+  const contentType = input.contentType ?? "application/octet-stream";
   const fileSize = typeof input.fileSize === "number" && input.fileSize > 0 ? Math.floor(input.fileSize) : null;
-  await runHook(config.upload?.presignGuard, {
+  await runHook(config.upload?.guard, {
     request,
     key,
     bucket,
@@ -523,7 +686,7 @@ async function upload(config, input, request) {
       );
     }
     const url2 = await getSignedUrl(
-      config.s3,
+      config.client,
       new PutObjectCommand({
         Bucket: bucket,
         Key: key,
@@ -569,13 +732,16 @@ async function upload(config, input, request) {
   }
   const rangeMin = fileSize ?? 1;
   const rangeMax = fileSize ?? void 0;
-  const { url, fields: signedFields } = await createPresignedPost(config.s3, {
-    Bucket: bucket,
-    Key: key,
-    Conditions: rangeMax !== void 0 ? [["content-length-range", rangeMin, rangeMax]] : [["content-length-range", rangeMin, Number.MAX_SAFE_INTEGER]],
-    Fields: fields,
-    Expires: expiresIn
-  });
+  const { url, fields: signedFields } = await createPresignedPost(
+    config.client,
+    {
+      Bucket: bucket,
+      Key: key,
+      Conditions: rangeMax !== void 0 ? [["content-length-range", rangeMin, rangeMax]] : [["content-length-range", rangeMin, Number.MAX_SAFE_INTEGER]],
+      Fields: fields,
+      Expires: expiresIn
+    }
+  );
   await runLifecycleHook(config.upload?.onPresigned, {
     request,
     key,
@@ -597,255 +763,30 @@ async function upload(config, input, request) {
     method: "POST"
   };
 }
-
-// src/procedures/registry.ts
-var PROCEDURE_REGISTRY = {
-  upload: {
-    path: S3_API_ROUTES.upload,
-    method: "POST",
-    isEnabled: (c) => c.upload?.enabled,
-    run: (config, input, request) => upload(config, input, request)
-  },
-  uploadConfirm: {
-    path: S3_API_ROUTES.uploadConfirm,
-    method: "POST",
-    isEnabled: (c) => c.upload?.enabled,
-    run: (config, input, request) => confirm(config, input, request)
-  },
-  download: {
-    path: S3_API_ROUTES.download,
-    method: "GET",
-    isEnabled: (c) => c.download?.enabled,
-    run: (config, input, request) => download(config, input, request)
-  },
-  delete: {
-    path: S3_API_ROUTES.delete,
-    method: "DELETE",
-    isEnabled: (c) => c.delete?.enabled,
-    run: (config, input, request) => deleteObject(
-      config,
-      input,
-      request
-    )
-  },
-  multipartInit: {
-    path: S3_API_ROUTES.multipartInit,
-    method: "POST",
-    status: 201,
-    isEnabled: (c) => c.multipart?.enabled,
-    run: (config, input, request) => multipartInit(
-      config,
-      input,
-      request
-    )
-  },
-  multipartPart: {
-    path: S3_API_ROUTES.multipartPart,
-    method: "POST",
-    isEnabled: (c) => c.multipart?.enabled,
-    run: (config, input, request) => multipartSignPart(
-      config,
-      input,
-      request
-    )
-  },
-  multipartComplete: {
-    path: S3_API_ROUTES.multipartComplete,
-    method: "POST",
-    isEnabled: (c) => c.multipart?.enabled,
-    run: (config, input, request) => multipartComplete(
-      config,
-      input,
-      request
-    )
-  },
-  multipartAbort: {
-    path: S3_API_ROUTES.multipartAbort,
-    method: "POST",
-    isEnabled: (c) => c.multipart?.enabled,
-    run: (config, input, request) => multipartAbort(
-      config,
-      input,
-      request
-    )
-  },
-  multipartListParts: {
-    path: S3_API_ROUTES.multipartListParts,
-    method: "GET",
-    isEnabled: (c) => c.multipart?.enabled,
-    run: (config, input, request) => multipartListParts(
-      config,
-      input,
-      request
-    )
+var upload = createS3Endpoint(
+  S3_API_ROUTES.upload,
+  { method: "POST", body: uploadBodySchema },
+  async (ctx) => {
+    assertFeatureEnabled(ctx.context.config, "upload");
+    return handleUpload(ctx.context.config, ctx.body, ctx.context.request);
   }
-};
+);
 
-// src/api.ts
-async function runProcedure(config, entry, headers, input) {
-  const request = requestFromHeaders(headers);
-  await runHook(config.guard, { request });
-  if (!entry.isEnabled(config)) {
-    throw errors.notFound();
-  }
-  return entry.run(config, input, request);
-}
-function createServerApi(config) {
-  return {
-    upload: (payload) => {
-      const { headers, ...input } = payload;
-      return runProcedure(config, PROCEDURE_REGISTRY.upload, headers, input);
-    },
-    confirm: (payload) => {
-      const { headers, ...input } = payload;
-      return runProcedure(
-        config,
-        PROCEDURE_REGISTRY.uploadConfirm,
-        headers,
-        input
-      );
-    },
-    download: (key, options) => {
-      const { headers, ...rest } = options ?? {};
-      return runProcedure(config, PROCEDURE_REGISTRY.download, headers, {
-        key,
-        ...rest
-      });
-    },
-    delete: (key, options) => {
-      const { headers, ...rest } = options ?? {};
-      return runProcedure(config, PROCEDURE_REGISTRY.delete, headers, {
-        key,
-        ...rest
-      });
-    },
-    multipart: {
-      init: (payload) => {
-        const { headers, ...input } = payload;
-        return runProcedure(
-          config,
-          PROCEDURE_REGISTRY.multipartInit,
-          headers,
-          input
-        );
-      },
-      signPart: (payload) => {
-        const { headers, ...input } = payload;
-        return runProcedure(
-          config,
-          PROCEDURE_REGISTRY.multipartPart,
-          headers,
-          input
-        );
-      },
-      listParts: (payload) => {
-        const { headers, ...input } = payload;
-        return runProcedure(
-          config,
-          PROCEDURE_REGISTRY.multipartListParts,
-          headers,
-          input
-        );
-      },
-      complete: (payload) => {
-        const { headers, ...input } = payload;
-        return runProcedure(
-          config,
-          PROCEDURE_REGISTRY.multipartComplete,
-          headers,
-          input
-        );
-      },
-      abort: (payload) => {
-        const { headers, ...input } = payload;
-        return runProcedure(
-          config,
-          PROCEDURE_REGISTRY.multipartAbort,
-          headers,
-          input
-        );
-      }
-    }
-  };
-}
-async function requireJson(request) {
-  const body = await parseBody(request);
-  if (!body) {
-    throw errors.invalidJson();
-  }
-  return body;
-}
-function decodeInput(entry, ctx) {
-  const { request, url } = ctx;
-  const { searchParams } = url;
-  switch (entry.path) {
-    case PROCEDURE_REGISTRY.download.path: {
-      const expiresRaw = searchParams.get("expiresIn");
-      return Promise.resolve({
-        key: searchParams.get("key")?.trim() ?? "",
-        bucket: searchParams.get("bucket")?.trim() || void 0,
-        fileName: searchParams.get("fileName")?.trim() || void 0,
-        expiresIn: expiresRaw != null ? Number(expiresRaw) : void 0
-      });
-    }
-    case PROCEDURE_REGISTRY.delete.path:
-      return Promise.resolve({
-        key: searchParams.get("key")?.trim() ?? "",
-        bucket: searchParams.get("bucket")?.trim() || void 0
-      });
-    case PROCEDURE_REGISTRY.multipartListParts.path:
-      return Promise.resolve({
-        key: searchParams.get("key")?.trim() ?? "",
-        uploadId: searchParams.get("uploadId")?.trim() ?? "",
-        bucket: searchParams.get("bucket")?.trim() || void 0
-      });
-    default:
-      return requireJson(request);
-  }
-}
-var routes = Object.values(PROCEDURE_REGISTRY).map((entry) => ({
-  method: entry.method,
-  path: entry.path,
-  enabled: entry.isEnabled,
-  status: "status" in entry ? entry.status : void 0,
-  run: async (ctx) => {
-    const input = await decodeInput(entry, ctx);
-    return entry.run(ctx.config, input, ctx.request);
-  }
-}));
-function createHandler(config, basePath = S3_API_BASE_PATH, pluginEndpoints = []) {
-  const base = normalizeS3ApiBasePath(basePath);
-  const pluginRoutes = pluginEndpoints.map((e) => ({
-    method: e.method,
-    path: pluginEndpointPath(e.pluginId, e.path),
-    status: e.status,
-    enabled: () => true,
-    run: ({ config: cfg, request, url }) => e.handler({
-      request,
-      url,
-      config: cfg,
-      errors,
-      json: () => parseBody(request)
-    })
-  }));
-  const allRoutes = [...routes, ...pluginRoutes];
-  return wrapHandler(async (request) => {
-    await runHook(config.guard, { request });
-    const url = new URL(request.url);
-    const subpath = url.pathname.slice(base.length).replace(/^\//, "");
-    const route = allRoutes.find(
-      (r) => r.method === request.method && r.path === subpath
-    );
-    if (!route || !route.enabled(config)) {
-      throw errors.notFound();
-    }
-    const data = await route.run({ config, request, url, errors });
-    return Response.json(
-      data,
-      route.status ? { status: route.status } : void 0
-    );
-  });
-}
+// src/api/routes/index.ts
+var coreEndpoints = {
+  upload,
+  confirm,
+  download,
+  delete: deleteObject,
+  multipartInit,
+  multipartPart,
+  multipartListParts,
+  multipartComplete,
+  multipartAbort
+};
+var CORE_ENDPOINT_NAMES = Object.keys(
+  coreEndpoints
+);
 
 // src/plugin/chain-hooks.ts
 function chainHooks(...hooks) {
@@ -858,8 +799,8 @@ function chainHooks(...hooks) {
 
 // src/plugin/hook-registry.ts
 var FEATURE_HOOK_KEYS = {
-  upload: ["presignGuard", "onPresigned", "confirmGuard", "onConfirmed"],
-  download: ["presignGuard", "onPresigned"],
+  upload: ["guard", "onPresigned", "confirmGuard", "onConfirmed"],
+  download: ["guard", "onPresigned"],
   delete: ["guard", "onDeleted"],
   multipart: [
     "initGuard",
@@ -879,7 +820,9 @@ var RESERVED_PLUGIN_IDS = [
   "handler",
   "api",
   "context",
-  "getPlugin"
+  "getPlugin",
+  "$ERROR_CODES",
+  "$Infer"
 ];
 
 // src/plugin/apply-plugins.ts
@@ -895,7 +838,7 @@ function mergeFeatureHooks(feature, keys, plugins, userFeature) {
   if (!userFeature && plugins.every((p) => !p.hooks?.[feature])) {
     return userFeature;
   }
-  const merged = { ...userFeature };
+  const merged = { ...userFeature ?? {} };
   for (const key of keys) {
     const fromPlugins = plugins.map(
       (p) => p.hooks?.[feature]?.[key]
@@ -963,34 +906,57 @@ function applyPlugins(config) {
     }
   }
   const reservedRoutePaths = new Set(Object.values(S3_API_ROUTES));
+  const reservedNames = /* @__PURE__ */ new Set([...CORE_ENDPOINT_NAMES, "multipart"]);
   const seenEndpointKeys = /* @__PURE__ */ new Set();
-  const endpoints = [];
+  const endpoints = {};
   for (const plugin of plugins) {
     for (const [name, endpoint] of Object.entries(plugin.endpoints ?? {})) {
-      const mounted = pluginEndpointPath(plugin.id, endpoint.path);
-      if (reservedRoutePaths.has(mounted)) {
+      if (reservedNames.has(name) || name in endpoints) {
+        throw new Error(
+          `Plugin "${plugin.id}" endpoint "${name}" collides with an existing endpoint.`
+        );
+      }
+      const path = endpoint.path;
+      if (typeof path !== "string" || !path.startsWith("/")) {
+        throw new Error(
+          `Plugin "${plugin.id}" endpoint "${name}" path must start with "/".`
+        );
+      }
+      if (reservedRoutePaths.has(path)) {
         throw new Error(
           `Plugin "${plugin.id}" endpoint "${name}" collides with a core route.`
         );
       }
-      const routeKey = `${endpoint.method} ${mounted}`;
-      if (seenEndpointKeys.has(routeKey)) {
-        throw new Error(`Duplicate plugin endpoint ${routeKey}.`);
+      const methods = Array.isArray(endpoint.options.method) ? endpoint.options.method : [endpoint.options.method];
+      for (const method of methods) {
+        const routeKey = `${method} ${path}`;
+        if (seenEndpointKeys.has(routeKey)) {
+          throw new Error(`Duplicate plugin endpoint ${routeKey}.`);
+        }
+        seenEndpointKeys.add(routeKey);
       }
-      seenEndpointKeys.add(routeKey);
-      endpoints.push({ ...endpoint, pluginId: plugin.id });
+      endpoints[name] = endpoint;
     }
   }
   const { plugins: _omit, ...rest } = config;
   for (const plugin of plugins) {
     plugin.init?.({ config: rest, getPlugin });
   }
+  const features = normalizeFeatures(rest);
+  const {
+    upload: _upload,
+    download: _download,
+    delete: _delete,
+    multipart: _multipart,
+    ...base
+  } = rest;
   const guard = mergeHookField(
     plugins.map((p) => p.hooks?.guard),
     rest.guard
   );
   const merged = {
-    ...rest,
+    ...base,
+    ...features,
     ...guard !== void 0 ? { guard } : {}
   };
   for (const feature of Object.keys(FEATURE_HOOK_KEYS)) {
@@ -998,50 +964,122 @@ function applyPlugins(config) {
       feature,
       FEATURE_HOOK_KEYS[feature],
       plugins,
-      rest[feature]
+      merged[feature]
     );
   }
   return {
-    config: merged,
+    config: applyMultipartDefault(merged, rest.multipart),
     context,
     getPlugin,
     endpoints
   };
 }
 
-// src/plugin/create-endpoint.ts
-function createEndpoint(path, options, handler) {
-  return {
-    path,
-    method: options.method,
-    status: options.status,
-    handler
-  };
-}
-
 // src/plugin/define-plugin.ts
 function definePlugin(plugin) {
   return plugin;
 }
 
+// src/api/bind-endpoints.ts
+function bindEndpoints(endpoints, context) {
+  const api = {};
+  for (const [key, endpoint] of Object.entries(endpoints)) {
+    const bound = (async (input = {}) => {
+      const headers = input.headers;
+      const request = input.request ?? requestFromHeaders(headers);
+      return endpoint({
+        ...input,
+        headers: headers ?? request.headers,
+        request,
+        context: {
+          ...context,
+          ...typeof input.context === "object" && input.context !== null ? input.context : {}
+        }
+      });
+    });
+    bound.path = endpoint.path;
+    bound.options = endpoint.options;
+    api[key] = bound;
+  }
+  return api;
+}
+
+// src/router.ts
+var NETWORK_CODES = /* @__PURE__ */ new Set([
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "ENOTFOUND"
+]);
+function onS3RouterError(error) {
+  if (isAPIError(error)) return;
+  const code = error?.code;
+  if (typeof code === "string" && NETWORK_CODES.has(code)) {
+    const networkErr = errors.s3NetworkError(code);
+    console.error("[S3 API]", networkErr.message, error);
+    throw networkErr;
+  }
+  console.error("[S3 API]", error);
+  throw errors.internalError();
+}
+function withUnmatchedRouteJson(handler) {
+  return async (request) => {
+    const response = await handler(request);
+    if (response.status !== 404) return response;
+    const contentType = response.headers.get("content-type") ?? "";
+    if (contentType.includes("application/json")) return response;
+    return toResponse(errors.notFound());
+  };
+}
+function createS3Router(endpoints, env) {
+  const basePath = normalizeS3ApiBasePath(
+    env.config.basePath ?? S3_API_BASE_PATH
+  );
+  const router = createRouter(endpoints, {
+    basePath,
+    routerContext: { config: env.config },
+    openapi: { disabled: true },
+    onError: onS3RouterError
+  });
+  return {
+    endpoints: bindEndpoints(router.endpoints, { config: env.config }),
+    handler: withUnmatchedRouteJson(router.handler)
+  };
+}
+
 // src/dimah-s3.ts
 function dimahS3(config) {
   const {
     config: resolved,
     context,
     getPlugin,
-    endpoints
+    endpoints: pluginEndpoints
   } = applyPlugins(config);
-  const basePath = resolved.basePath ?? S3_API_BASE_PATH;
+  const endpoints = { ...coreEndpoints, ...pluginEndpoints };
+  const router = createS3Router(endpoints, { config: resolved });
+  const bound = router.endpoints;
+  const api = {
+    ...bound,
+    multipart: {
+      init: bound.multipartInit,
+      signPart: bound.multipartPart,
+      listParts: bound.multipartListParts,
+      complete: bound.multipartComplete,
+      abort: bound.multipartAbort
+    }
+  };
   return {
-    handler: createHandler(resolved, basePath, endpoints),
-    api: createServerApi(resolved),
+    handler: router.handler,
+    api,
     context,
     getPlugin,
+    $ERROR_CODES: S3_ERROR_CODES,
+    $Infer: {},
     ...context
   };
 }
 
-export { FEATURE_HOOK_KEYS, RESERVED_PLUGIN_IDS, applyPlugins, chainHooks, createEndpoint, definePlugin, dimahS3, errors, resolveObjectAcl };
+export { createS3Endpoint, createS3Middleware, definePlugin, dimahS3, errors, resolveObjectAcl };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map