@dimah-s3/server 0.8.6 → 1.0.0

package/dist/helpers/list-parts.d.ts

@@ -0,0 +1,8 @@
+import { type Part, type S3Client } from "@aws-sdk/client-s3";
+/** Page through ListParts until S3 reports no more parts. */
+export declare function listAllParts(client: S3Client, input: {
+    bucket: string;
+    key: string;
+    uploadId: string;
+}): Promise<Part[]>;
+//# sourceMappingURL=list-parts.d.ts.map

package/dist/helpers/list-parts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-parts.d.ts","sourceRoot":"","sources":["../../src/helpers/list-parts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAGhF,6DAA6D;AAC7D,wBAAsB,YAAY,CAChC,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvD,OAAO,CAAC,IAAI,EAAE,CAAC,CAsBjB"}

package/dist/helpers/request.d.ts

@@ -0,0 +1,3 @@
+/** Build a synthetic Request for server-side `api` calls. */
+export declare function requestFromHeaders(headers?: HeadersInit): Request;
+//# sourceMappingURL=request.d.ts.map

package/dist/helpers/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/helpers/request.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAEjE"}

package/dist/helpers/resolve-request-acl.d.ts

@@ -0,0 +1,10 @@
+import type { S3ObjectAcl } from "@dimah-s3/core";
+import type { AclPolicy } from "../types/config";
+export type { AclPolicy };
+/**
+ * Resolve object ACL. Default is `private`. A server `acl` is forced.
+ * Client `acl` is used only when `allowClientAcl` is set and no server ACL
+ * is configured.
+ */
+export declare function resolveRequestAcl(policy: AclPolicy | undefined, requested?: S3ObjectAcl): S3ObjectAcl;
+//# sourceMappingURL=resolve-request-acl.d.ts.map

package/dist/helpers/resolve-request-acl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-request-acl.d.ts","sourceRoot":"","sources":["../../src/helpers/resolve-request-acl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,SAAS,CAAC,EAAE,WAAW,GACtB,WAAW,CAIb"}

package/dist/helpers/resolve-target.d.ts

@@ -1,8 +1,5 @@
-import type { DownloadConfig, DeleteConfig, FeatureToggle, KeyPrefix, MultipartConfig, ResolvedDimahS3Config, ResolveKeyContext, UploadConfig } from "../types";
-type KeyPolicy = {
-    prefix?: KeyPrefix;
-    resolveKey?: (context: ResolveKeyContext) => string | Promise<string>;
-};
+import type { KeyPolicy, ResolvedDimahS3Config, ResolveKeyContext } from "../types";
+export type { KeyPolicy };
 /**
  * Normalize a client-proposed object key: strip leading slashes, reject
  * `.` / `..` segments, NUL, and backslashes.
@@ -20,32 +17,4 @@ export declare function resolveRequestTarget(config: ResolvedDimahS3Config, poli
     key: string;
     bucket: string;
 }>;
-export declare function normalizeFeature<T extends {
-    enabled?: boolean;
-}>(value: FeatureToggle<T> | undefined): (T & {
-    enabled: boolean;
-}) | undefined;
-export declare function isFeatureEnabled(config: ResolvedDimahS3Config, feature: "upload" | "download" | "delete" | "multipart"): boolean;
-export declare function applyMultipartDefault(config: ResolvedDimahS3Config, multipartInput: FeatureToggle<MultipartConfig> | undefined): ResolvedDimahS3Config;
-export type NormalizedFeatures = {
-    upload?: UploadConfig & {
-        enabled: boolean;
-    };
-    download?: DownloadConfig & {
-        enabled: boolean;
-    };
-    delete?: DeleteConfig & {
-        enabled: boolean;
-    };
-    multipart?: MultipartConfig & {
-        enabled: boolean;
-    };
-};
-export declare function normalizeFeatures(config: {
-    upload?: FeatureToggle<UploadConfig>;
-    download?: FeatureToggle<DownloadConfig>;
-    delete?: FeatureToggle<DeleteConfig>;
-    multipart?: FeatureToggle<MultipartConfig>;
-}): NormalizedFeatures;
-export {};
 //# sourceMappingURL=resolve-target.d.ts.map

package/dist/helpers/resolve-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-target.d.ts","sourceRoot":"","sources":["../../src/helpers/resolve-target.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,SAAS,EACT,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,UAAU,CAAC;AAElB,KAAK,SAAS,GAAG;IACf,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAavD;AASD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,qBAAqB,EAC7B,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAQR;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,KAAK,EAAE;IACL,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAU1C;AAED,wBAAgB,gBAAgB,CAAC,CAAC,SAAS;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAC9D,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,GAClC,CAAC,CAAC,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,SAAS,CAKxC;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GACtD,OAAO,CAET;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,cAAc,EAAE,aAAa,CAAC,eAAe,CAAC,GAAG,SAAS,GACzD,qBAAqB,CAmBvB;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,CAAC,EAAE,YAAY,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7C,QAAQ,CAAC,EAAE,cAAc,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACjD,MAAM,CAAC,EAAE,YAAY,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7C,SAAS,CAAC,EAAE,eAAe,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACpD,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,MAAM,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAC5C,GAAG,kBAAkB,CAOrB"}
+{"version":3,"file":"resolve-target.d.ts","sourceRoot":"","sources":["../../src/helpers/resolve-target.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EACT,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAavD;AASD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,qBAAqB,EAC7B,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAQR;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,KAAK,EAAE;IACL,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAU1C"}

package/dist/index.d.ts

@@ -1,8 +1,7 @@
 export { dimahS3 } from "./dimah-s3";
 export type { DimahS3, DimahS3Api, MultipartAliasApi } from "./dimah-s3";
-export { DimahS3Error, errors, isAPIError, isDimahS3Error, isS3ErrorCode, } from "./errors";
+export { DimahS3Error, errors, isAPIError, isDimahS3Error, isS3ErrorCode, S3_ERROR_CODES, } from "./errors";
 export type { ServerErrors } from "./errors";
-export { resolveObjectAcl } from "./helpers/resolve-object-acl";
 export { createS3Endpoint, createS3Middleware } from "./api";
 export type { S3EndpointContext } from "./api";
 export { definePlugin } from "./plugin";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,YAAY,EACZ,MAAM,EACN,UAAU,EACV,cAAc,EACd,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAC;AAC7D,YAAY,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,GACd,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,aAAa,EACb,cAAc,EACd,YAAY,EACZ,aAAa,EACb,SAAS,EACT,eAAe,EACf,qBAAqB,EACrB,YAAY,GACb,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,YAAY,EACZ,MAAM,EACN,UAAU,EACV,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE7C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAC;AAC7D,YAAY,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,GACd,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,aAAa,EACb,cAAc,EACd,YAAY,EACZ,aAAa,EACb,SAAS,EACT,eAAe,EACf,qBAAqB,EACrB,YAAY,GACb,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -1,36 +1,11 @@
-import { S3_API_ROUTES, isAPIError, DimahS3Error, S3_ERROR_CODES, confirmBodySchema, deleteQuerySchema, downloadQuerySchema, multipartAbortBodySchema, multipartCompleteBodySchema, multipartInitBodySchema, multipartListPartsQuerySchema, multipartSignPartBodySchema, uploadBodySchema, parseFileName, buildContentDisposition, normalizeS3ApiBasePath, S3_API_BASE_PATH } from '@dimah-s3/core';
-export { DimahS3Error, isAPIError, isDimahS3Error, isS3ErrorCode } from '@dimah-s3/core';
-import { GetObjectAclCommand, HeadObjectCommand, DeleteObjectCommand, GetObjectCommand, AbortMultipartUploadCommand, ListPartsCommand, CompleteMultipartUploadCommand, CreateMultipartUploadCommand, UploadPartCommand, PutObjectCommand } from '@aws-sdk/client-s3';
+import { S3_API_ROUTES, isAPIError, DimahS3Error, S3_ERROR_CODES, confirmBodySchema, deleteQuerySchema, downloadQuerySchema, multipartAbortBodySchema, multipartCompleteBodySchema, multipartInitBodySchema, multipartListPartsQuerySchema, multipartSignPartBodySchema, uploadBodySchema, parseFileName, S3_MAX_EXPIRES_IN, buildContentDisposition, S3_MAX_POST_OBJECT_BYTES, normalizeS3ApiBasePath, S3_API_BASE_PATH, S3_DEFAULT_EXPIRES_IN } from '@dimah-s3/core';
+export { DimahS3Error, S3_ERROR_CODES, isAPIError, isDimahS3Error, isS3ErrorCode } from '@dimah-s3/core';
+import { DeleteObjectCommand, GetObjectCommand, CreateMultipartUploadCommand, UploadPartCommand, PutObjectCommand, GetObjectAclCommand, ListPartsCommand, CompleteMultipartUploadCommand, HeadObjectCommand, AbortMultipartUploadCommand } from '@aws-sdk/client-s3';
 import { createMiddleware, createEndpoint, createRouter, toResponse } from 'better-call';
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
 import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
 
 // src/dimah-s3.ts
-
-// src/helpers/is-aws-not-found.ts
-function isAwsNotFound(err) {
-  const e = err;
-  return e?.name === "NoSuchKey" || e?.name === "NotFound" || e?.Code === "NoSuchKey" || e?.Code === "NotFound" || e?.$metadata?.httpStatusCode === 404;
-}
-var DEFAULT_ACL_LOOKUP_TIMEOUT_MS = 1500;
-async function resolveObjectAcl(s3, bucket, key, timeoutMs = DEFAULT_ACL_LOOKUP_TIMEOUT_MS) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const result = await s3.send(
-      new GetObjectAclCommand({ Bucket: bucket, Key: key }),
-      { abortSignal: controller.signal }
-    );
-    const isPublic = result.Grants?.some(
-      (g) => g.Grantee?.URI === "http://acs.amazonaws.com/groups/global/AllUsers" && (g.Permission === "READ" || g.Permission === "FULL_CONTROL")
-    );
-    return isPublic ? "public-read" : "private";
-  } catch {
-    return void 0;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
 var errors = {
   notFound: () => DimahS3Error.from("NOT_FOUND", S3_ERROR_CODES.NOT_FOUND),
   unauthorized: () => DimahS3Error.from("UNAUTHORIZED", S3_ERROR_CODES.UNAUTHORIZED),
@@ -65,13 +40,69 @@ var errors = {
     "BAD_REQUEST",
     S3_ERROR_CODES.FILE_SIZE_REQUIRED_MULTIPART
   ),
+  multipartPartMissing: (partNumber) => DimahS3Error.from("BAD_REQUEST", {
+    code: S3_ERROR_CODES.MULTIPART_PART_MISSING.code,
+    message: S3_ERROR_CODES.MULTIPART_PART_MISSING.message.replaceAll(
+      "{partNumber}",
+      String(partNumber)
+    ),
+    params: { partNumber }
+  }),
+  payloadTooLarge: (message = S3_ERROR_CODES.PAYLOAD_TOO_LARGE.message) => DimahS3Error.from("PAYLOAD_TOO_LARGE", {
+    ...S3_ERROR_CODES.PAYLOAD_TOO_LARGE,
+    message
+  }),
   validationError: (message) => DimahS3Error.from("BAD_REQUEST", {
     code: S3_ERROR_CODES.VALIDATION_ERROR.code,
     message
   })
 };
 
-// src/internal-helpers.ts
+// src/helpers/is-aws-not-found.ts
+function isAwsNotFound(err) {
+  const e = err;
+  return e?.name === "NoSuchKey" || e?.name === "NotFound" || e?.name === "NoSuchUpload" || e?.Code === "NoSuchKey" || e?.Code === "NotFound" || e?.Code === "NoSuchUpload" || e?.$metadata?.httpStatusCode === 404;
+}
+async function sendOrObjectNotFound(send) {
+  try {
+    return await send();
+  } catch (err) {
+    if (isAwsNotFound(err)) throw errors.objectNotFound();
+    throw err;
+  }
+}
+var DEFAULT_ACL_LOOKUP_TIMEOUT_MS = 1500;
+async function resolveObjectAcl(s3, bucket, key, timeoutMs = DEFAULT_ACL_LOOKUP_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const result = await s3.send(
+      new GetObjectAclCommand({ Bucket: bucket, Key: key }),
+      { abortSignal: controller.signal }
+    );
+    const isPublic = result.Grants?.some(
+      (g) => g.Grantee?.URI === "http://acs.amazonaws.com/groups/global/AllUsers" && (g.Permission === "READ" || g.Permission === "FULL_CONTROL")
+    );
+    return isPublic ? "public-read" : "private";
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// src/helpers/resolve-request-acl.ts
+function resolveRequestAcl(policy, requested) {
+  if (policy?.acl) return policy.acl;
+  if (policy?.allowClientAcl && requested) return requested;
+  return "private";
+}
+function normalizeExpiresIn(value, maxExpiresIn = S3_MAX_EXPIRES_IN) {
+  const n = Number(value);
+  const expires = Number.isFinite(n) && n > 0 ? Math.floor(n) : S3_DEFAULT_EXPIRES_IN;
+  const max = Number.isFinite(maxExpiresIn) && maxExpiresIn > 0 ? Math.floor(maxExpiresIn) : S3_MAX_EXPIRES_IN;
+  return Math.min(expires, max);
+}
 async function runHook(hook, context) {
   if (!hook) return;
   try {
@@ -97,10 +128,8 @@ async function runLifecycleHook(hook, context) {
     throw errors.internalError();
   }
 }
-function normalizeExpiresIn(value) {
-  const n = Number(value);
-  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 600;
-}
+
+// src/helpers/request.ts
 function requestFromHeaders(headers) {
   return new Request("http://dimah-s3.local", { headers });
 }
@@ -156,11 +185,56 @@ async function resolveRequestTarget(config, policy, input) {
   });
   return { key, bucket };
 }
+async function headObjectOrNotFound(client, bucket, key) {
+  return sendOrObjectNotFound(
+    () => client.send(new HeadObjectCommand({ Bucket: bucket, Key: key }))
+  );
+}
+async function headObjectAfterMultipartComplete(client, bucket, key) {
+  const send = () => sendOrObjectNotFound(
+    () => client.send(new HeadObjectCommand({ Bucket: bucket, Key: key }))
+  );
+  let head = await send();
+  for (let attempt = 0; attempt < 4 && !head.ContentLength; attempt++) {
+    await new Promise((r) => setTimeout(r, 250 * 2 ** attempt));
+    head = await send();
+  }
+  return head;
+}
+function requireContentLength(head) {
+  if (typeof head.ContentLength !== "number") {
+    throw errors.internalError();
+  }
+  return head.ContentLength;
+}
+async function listAllParts(client, input) {
+  const parts = [];
+  let partNumberMarker;
+  let isTruncated = true;
+  while (isTruncated) {
+    const response = await sendOrObjectNotFound(
+      () => client.send(
+        new ListPartsCommand({
+          Bucket: input.bucket,
+          Key: input.key,
+          UploadId: input.uploadId,
+          ...partNumberMarker ? { PartNumberMarker: partNumberMarker } : {}
+        })
+      )
+    );
+    parts.push(...response.Parts ?? []);
+    isTruncated = response.IsTruncated === true;
+    partNumberMarker = isTruncated ? response.NextPartNumberMarker : void 0;
+  }
+  return parts;
+}
+
+// src/helpers/features.ts
 function normalizeFeature(value) {
   if (value === void 0) return void 0;
   if (value === false) return { enabled: false };
   if (value === true) return { enabled: true };
-  return { ...value, enabled: value.enabled ?? true };
+  return { ...value, enabled: true };
 }
 function isFeatureEnabled(config, feature) {
   return config[feature]?.enabled === true;
@@ -179,7 +253,10 @@ function applyMultipartDefault(config, multipartInput) {
       multipart: {
         ...next.multipart,
         prefix: next.multipart.prefix ?? next.upload.prefix,
-        resolveKey: next.multipart.resolveKey ?? next.upload.resolveKey
+        resolveKey: next.multipart.resolveKey ?? next.upload.resolveKey,
+        acl: next.multipart.acl ?? next.upload.acl,
+        allowClientAcl: next.multipart.allowClientAcl ?? next.upload.allowClientAcl,
+        requireFileSize: next.multipart.requireFileSize ?? next.upload.requireFileSize
       }
     };
   }
@@ -193,6 +270,13 @@ function normalizeFeatures(config) {
     multipart: normalizeFeature(config.multipart)
   };
 }
+function assertExclusiveBucketFlags(config) {
+  if (config.allowClientBucket && config.buckets?.length) {
+    throw new Error(
+      "dimahS3: set either allowClientBucket or buckets, not both. allowClientBucket honors any client-sent bucket; buckets is an allowlist."
+    );
+  }
+}
 
 // src/api/assert-feature-enabled.ts
 function assertFeatureEnabled(config, feature) {
@@ -256,9 +340,7 @@ async function handleConfirm(config, input, request) {
     key,
     bucket
   });
-  const head = await config.client.send(
-    new HeadObjectCommand({ Bucket: bucket, Key: key })
-  );
+  const head = await headObjectOrNotFound(config.client, bucket, key);
   const acl = config.resolveObjectAcl ? await resolveObjectAcl(config.client, bucket, key) : void 0;
   const fileName = parseFileName(head.ContentDisposition);
   const context = {
@@ -266,7 +348,7 @@ async function handleConfirm(config, input, request) {
     key,
     bucket,
     contentType: head.ContentType,
-    contentLength: head.ContentLength ?? 0,
+    contentLength: requireContentLength(head),
     eTag: head.ETag?.replace(/"/g, ""),
     metadata: head.Metadata,
     acl,
@@ -307,16 +389,7 @@ async function handleDelete(config, input, request) {
     key,
     bucket
   });
-  try {
-    await config.client.send(
-      new HeadObjectCommand({ Bucket: bucket, Key: key })
-    );
-  } catch (err) {
-    if (isAwsNotFound(err)) {
-      throw errors.objectNotFound();
-    }
-    throw err;
-  }
+  await headObjectOrNotFound(config.client, bucket, key);
   await config.client.send(
     new DeleteObjectCommand({ Bucket: bucket, Key: key })
   );
@@ -338,7 +411,7 @@ async function handleDownload(config, input, request) {
     bucket: input.bucket,
     fileName: input.fileName
   });
-  const expiresIn = normalizeExpiresIn(input.expiresIn);
+  const expiresIn = normalizeExpiresIn(input.expiresIn, config.maxExpiresIn);
   const fileName = input.fileName;
   await runHook(config.download?.guard, {
     request,
@@ -346,16 +419,7 @@ async function handleDownload(config, input, request) {
     bucket,
     fileName
   });
-  try {
-    await config.client.send(
-      new HeadObjectCommand({ Bucket: bucket, Key: key })
-    );
-  } catch (err) {
-    if (isAwsNotFound(err)) {
-      throw errors.objectNotFound();
-    }
-    throw err;
-  }
+  await headObjectOrNotFound(config.client, bucket, key);
   const url = await getSignedUrl(
     config.client,
     new GetObjectCommand({
@@ -396,12 +460,14 @@ async function handleAbort(config, input, request) {
     bucket,
     uploadId
   });
-  await config.client.send(
-    new AbortMultipartUploadCommand({
-      Bucket: bucket,
-      Key: key,
-      UploadId: uploadId
-    })
+  await sendOrObjectNotFound(
+    () => config.client.send(
+      new AbortMultipartUploadCommand({
+        Bucket: bucket,
+        Key: key,
+        UploadId: uploadId
+      })
+    )
   );
   await runLifecycleHook(config.multipart?.onAbort, {
     request,
@@ -435,32 +501,34 @@ async function handleComplete(config, input, request) {
     uploadId,
     parts: partRefs
   });
-  const listed = await config.client.send(
-    new ListPartsCommand({ Bucket: bucket, Key: key, UploadId: uploadId })
-  );
-  const listedParts = listed.Parts ?? [];
+  const listedParts = await listAllParts(config.client, {
+    bucket,
+    key,
+    uploadId
+  });
   const completeParts = parts.map((partNumber) => {
     const found = listedParts.find((p) => p.PartNumber === partNumber);
-    return { PartNumber: partNumber, ETag: found?.ETag ?? "" };
+    if (!found?.ETag) {
+      throw errors.multipartPartMissing(partNumber);
+    }
+    return { PartNumber: partNumber, ETag: found.ETag };
   });
-  const completeResult = await config.client.send(
-    new CompleteMultipartUploadCommand({
-      Bucket: bucket,
-      Key: key,
-      UploadId: uploadId,
-      MultipartUpload: { Parts: completeParts }
-    })
+  const completeResult = await sendOrObjectNotFound(
+    () => config.client.send(
+      new CompleteMultipartUploadCommand({
+        Bucket: bucket,
+        Key: key,
+        UploadId: uploadId,
+        MultipartUpload: { Parts: completeParts }
+      })
+    )
   );
-  let head = await config.client.send(
-    new HeadObjectCommand({ Bucket: bucket, Key: key })
+  const head = await headObjectAfterMultipartComplete(
+    config.client,
+    bucket,
+    key
   );
-  for (let attempt = 0; attempt < 4 && !head.ContentLength; attempt++) {
-    await new Promise((r) => setTimeout(r, 250 * 2 ** attempt));
-    head = await config.client.send(
-      new HeadObjectCommand({ Bucket: bucket, Key: key })
-    );
-  }
-  const contentLength = head.ContentLength ?? 0;
+  const contentLength = requireContentLength(head);
   const contentType = head.ContentType;
   const eTag = (head.ETag ?? completeResult.ETag ?? "").replace(/"/g, "");
   const metadata = head.Metadata ?? {};
@@ -512,7 +580,7 @@ async function handleMultipartInit(config, input, request) {
     fileName: input.fileName,
     contentType: input.contentType
   });
-  const acl = input.acl === "public-read" ? "public-read" : "private";
+  const acl = resolveRequestAcl(config.multipart, input.acl);
   const fileSize = typeof input.fileSize === "number" && input.fileSize > 0 ? Math.floor(input.fileSize) : void 0;
   if (config.multipart?.requireFileSize && fileSize === void 0) {
     throw errors.fileSizeRequiredMultipart();
@@ -521,7 +589,11 @@ async function handleMultipartInit(config, input, request) {
     request,
     key,
     bucket,
-    fileSize
+    fileSize,
+    contentType: input.contentType,
+    metadata: input.metadata,
+    acl,
+    fileName: input.fileName
   });
   const { UploadId } = await config.client.send(
     new CreateMultipartUploadCommand({
@@ -533,6 +605,9 @@ async function handleMultipartInit(config, input, request) {
       ACL: acl
     })
   );
+  if (!UploadId) {
+    throw errors.internalError();
+  }
   await runLifecycleHook(config.multipart?.onInit, {
     request,
     key,
@@ -572,14 +647,8 @@ async function handleListParts(config, input, request) {
     bucket,
     uploadId
   });
-  const response = await config.client.send(
-    new ListPartsCommand({
-      Bucket: bucket,
-      Key: key,
-      UploadId: uploadId
-    })
-  );
-  const parts = (response.Parts ?? []).map((p) => ({
+  const listed = await listAllParts(config.client, { bucket, key, uploadId });
+  const parts = listed.map((p) => ({
     partNumber: p.PartNumber ?? 0,
     size: p.Size ?? 0,
     eTag: (p.ETag ?? "").replace(/"/g, "")
@@ -609,7 +678,7 @@ async function handleSignPart(config, input, request) {
   });
   const uploadId = input.uploadId;
   const partNumber = input.partNumber;
-  const expiresIn = normalizeExpiresIn(input.expiresIn);
+  const expiresIn = normalizeExpiresIn(input.expiresIn, config.maxExpiresIn);
   const partSize = typeof input.partSize === "number" && input.partSize > 0 ? Math.floor(input.partSize) : null;
   await runHook(config.multipart?.partGuard, {
     request,
@@ -650,6 +719,14 @@ var multipartPart = createS3Endpoint(
     return handleSignPart(ctx.context.config, ctx.body, ctx.context.request);
   }
 );
+function putMetadataHeaders(metadata) {
+  if (!metadata) return {};
+  const headers = {};
+  for (const [k, v] of Object.entries(metadata)) {
+    headers[`x-amz-meta-${k}`] = v;
+  }
+  return headers;
+}
 async function handleUpload(config, input, request) {
   const { key, bucket } = await resolveRequestTarget(config, config.upload, {
     request,
@@ -658,10 +735,13 @@ async function handleUpload(config, input, request) {
     fileName: input.fileName,
     contentType: input.contentType
   });
-  const expiresIn = normalizeExpiresIn(input.expiresIn);
-  const acl = input.acl === "public-read" ? "public-read" : "private";
+  const expiresIn = normalizeExpiresIn(input.expiresIn, config.maxExpiresIn);
+  const acl = resolveRequestAcl(config.upload, input.acl);
   const contentType = input.contentType ?? "application/octet-stream";
   const fileSize = typeof input.fileSize === "number" && input.fileSize > 0 ? Math.floor(input.fileSize) : null;
+  if (config.upload?.requireFileSize && fileSize === null) {
+    throw errors.fileSizeRequiredUpload();
+  }
   await runHook(config.upload?.guard, {
     request,
     key,
@@ -673,12 +753,10 @@ async function handleUpload(config, input, request) {
     fileName: input.fileName
   });
   const method = config.upload?.method ?? "POST";
-  if (method === "PUT" && config.upload?.requireFileSize && fileSize === null) {
-    throw errors.fileSizeRequiredUpload();
-  }
   if (method === "PUT") {
     const putHeaders = {
-      "Content-Type": contentType
+      "Content-Type": contentType,
+      ...putMetadataHeaders(input.metadata)
     };
     if (input.fileName) {
       putHeaders["Content-Disposition"] = buildContentDisposition(
@@ -692,6 +770,7 @@ async function handleUpload(config, input, request) {
         Key: key,
         ContentType: contentType,
         ACL: acl,
+        Metadata: input.metadata,
         ...input.fileName ? { ContentDisposition: buildContentDisposition(input.fileName) } : {},
         ...fileSize !== null ? { ContentLength: fileSize } : {}
       }),
@@ -737,7 +816,7 @@ async function handleUpload(config, input, request) {
     {
       Bucket: bucket,
       Key: key,
-      Conditions: rangeMax !== void 0 ? [["content-length-range", rangeMin, rangeMax]] : [["content-length-range", rangeMin, Number.MAX_SAFE_INTEGER]],
+      Conditions: rangeMax !== void 0 ? [["content-length-range", rangeMin, rangeMax]] : [["content-length-range", rangeMin, S3_MAX_POST_OBJECT_BYTES]],
       Fields: fields,
       Expires: expiresIn
     }
@@ -939,6 +1018,7 @@ function applyPlugins(config) {
     }
   }
   const { plugins: _omit, ...rest } = config;
+  assertExclusiveBucketFlags(rest);
   for (const plugin of plugins) {
     plugin.init?.({ config: rest, getPlugin });
   }
@@ -991,10 +1071,7 @@ function bindEndpoints(endpoints, context) {
         ...input,
         headers: headers ?? request.headers,
         request,
-        context: {
-          ...context,
-          ...typeof input.context === "object" && input.context !== null ? input.context : {}
-        }
+        context
       });
     });
     bound.path = endpoint.path;
@@ -1004,7 +1081,7 @@ function bindEndpoints(endpoints, context) {
   return api;
 }
 
-// src/router.ts
+// src/api/router.ts
 var NETWORK_CODES = /* @__PURE__ */ new Set([
   "EAI_AGAIN",
   "ECONNREFUSED",
@@ -1080,6 +1157,6 @@ function dimahS3(config) {
   };
 }
 
-export { createS3Endpoint, createS3Middleware, definePlugin, dimahS3, errors, resolveObjectAcl };
+export { createS3Endpoint, createS3Middleware, definePlugin, dimahS3, errors };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map