use:enhance and fetch do not report how many bytes have left the browser. Post the file with XMLHttpRequest and update a progress bar from upload.onprogress.

file.type and the filename are claims from the browser. Read the first bytes of the upload in SvelteKit and keep only JPEG, PNG, or WebP.

Form actions hit body size limits. Sign a short-lived S3 PUT URL on the server and let the browser send the file straight to the bucket.

A UUID in the URL is not a lock. Check the session on the GET that returns the bytes, record who owns the file, and keep shared caches from storing it.