jskelet 0.3.1 → 0.3.2

package/CHANGELOG.md

@@ -27,6 +27,12 @@ one is listed under a **Breaking** heading.
 
 ### Added
 
+- Top-level `logs` config for persistent sinks: daily NDJSON files
+  (`logs.file`) and batched S3 PutObject (`logs.s3`) with embedded SigV4 — no
+  `@aws-sdk` dependency. `kinds` selects `http` / `event` / `error`; `console`
+  toggles runtime stdout lines. Missing bucket/region/credentials warn and
+  disable the S3 sink without taking the site down. Env: `JSKELET_LOG_BUCKET`,
+  `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`, `AWS_REGION`.
 - Admin panel pages under `/_jskelet/admin`: Overview, Cache, Routes, Views,
   Logs and System. Configurable `allowIps` (exact or CIDR), `blockBots` (default
   on — crawler UAs get 404 before login), and `logSize`. Live Logs use an

package/docs/07-yapilandirma.md

@@ -752,6 +752,46 @@ redis: {
 }
 ```
 
+### `logs`
+
+Kalıcı log sink'leri. Varsayılan her şey kapalı: stdout ve admin paneli ring'i
+mevcut davranışını korur. Açıldığında HTTP access log ile framework olayları
+(`event` / `error`) NDJSON satırları olarak dosyaya ve/veya S3'e yazılır.
+
+| Alan | Tip | Varsayılan | Anlamı |
+| --- | --- | --- | --- |
+| `console` | `boolean` | `true` | Runtime `http` / `event` / `error` satırları stdout'a basılsın mı (banner/build satırları etkilenmez) |
+| `kinds` | `("http" \| "event" \| "error")[]` | hepsi | Sink'lere giden kayıt türleri |
+| `file.enabled` | `boolean` | `false` | Günlük dosya sink'i |
+| `file.dir` | `string` | `"logs"` | Proje köküne göre dizin; `jskelet-YYYY-MM-DD.log` |
+| `file.rotate` | `"daily"` | `"daily"` | Yalnızca günlük rotasyon |
+| `s3.enabled` | `boolean` | `false` | S3 batch PutObject sink'i |
+| `s3.bucket` | `string \| null` | `null` | Bucket; `JSKELET_LOG_BUCKET` ezer |
+| `s3.prefix` | `string` | `"jskelet/logs/"` | Nesne anahtarı öneki |
+| `s3.region` | `string \| null` | `null` | Bölge; verilmezse `AWS_REGION` / `AWS_DEFAULT_REGION` |
+| `s3.endpoint` | `string \| null` | `null` | MinIO vb. için path-style endpoint |
+| `s3.flushIntervalMs` | `number` | `5000` | Batch flush aralığı |
+| `s3.maxBatch` | `number` | `100` | Bu kadar satırda erken flush |
+
+S3 credential'ları config'e yazılmaz: `AWS_ACCESS_KEY_ID`,
+`AWS_SECRET_ACCESS_KEY`, isteğe bağlı `AWS_SESSION_TOKEN`. Bucket/region/
+credential eksikse uyarı basılır ve S3 sink kapanır; site ayağa kalkmaya devam
+eder. Framework `@aws-sdk` taşımaz — PutObject SigV4 ile gömülüdür.
+
+```js
+logs: {
+  console: true,
+  kinds: ["http", "error"],
+  file: { enabled: true, dir: "logs" },
+  s3: {
+    enabled: process.env.NODE_ENV === "production",
+    bucket: process.env.JSKELET_LOG_BUCKET,
+    prefix: "my-app/logs/",
+    region: process.env.AWS_REGION,
+  },
+}
+```
+
 ### `admin()`
 
 Framework yönetim paneli (`/_jskelet/admin`). Bellek içi / Redis / Cloudflare
@@ -933,6 +973,11 @@ basılmaz.
 | `JSKELET_SECRET` | `jskelet/cookies` | — | İmzalı cookie sırrı. `security.cookieSecret` verilmediğinde buradan okunur; ikisi de yoksa imzalı cookie API'si hata verir. [12](./12-panel-ve-oturum.md) |
 | `DEV_TOKEN` | `devGate`, `prewarm` | — | Ayarlıysa token taşımayan her isteğe 404 döner. Isıtma token'ı çerez olarak taşır. [09](./09-dev-araclari.md) |
 | `JSKELET_ADMIN` | `createApp` | — | Ayarlıysa yönetim panelini açar; `0` config'te açık olan paneli kapatır. Env config'i ezer, çünkü panel genelde bir arıza sırasında tek seferlik açılır. [06](./06-cache.md) |
+| `JSKELET_LOG_BUCKET` | `logs.s3` | — | S3 log bucket'ı; `logs.s3.bucket`'ı ezer |
+| `AWS_ACCESS_KEY_ID` | `logs.s3` | — | S3 PutObject imzası. Yoksa ve `s3.enabled` ise sink kapanır |
+| `AWS_SECRET_ACCESS_KEY` | `logs.s3` | — | S3 imza sırrı |
+| `AWS_SESSION_TOKEN` | `logs.s3` | — | Geçici credential'lar için isteğe bağlı |
+| `AWS_REGION` / `AWS_DEFAULT_REGION` | `logs.s3` | — | `logs.s3.region` verilmezse buradan okunur |
 | `JSKELET_CLOUDFLARE_KEY` | Cloudflare cache yüzeyi | — | API token. Verilene kadar CDN purge'ü ve edge analitiği kapalıdır; config'teki `apiToken`'ı ezer. Token hiçbir cevapta dönmez. [06](./06-cache.md) |
 | `JSKELET_CLOUDFLARE_ZONE_ID` | Cloudflare cache yüzeyi | — | Zone kimliği. Token'la birlikte verilmedikçe hiçbir Cloudflare ucu çağrılmaz |
 | `JSKELET_CLOUDFLARE_HOSTNAME` | Cloudflare cache yüzeyi | — | Purge URL'lerinin kökü. Panel iç bir adresten açılıyorsa gerekir |

package/docs/10-dagitim.md

@@ -47,6 +47,11 @@ ayarlamayı düşünmeniz gerekenler:
 | `PREWARM_MAX` | Site boyutuna göre | Açılışta ısıtılacak sayfa sayısı |
 | `PREWARM_INTERVAL_SECONDS` | `0` ya da uzun bir değer | Hiç ziyaret edilmeyen sayfaları sıcak tutmak isterseniz |
 | `DEV_TOKEN` | Yalnızca staging'de | Yayına açılmamış ortamı gizler |
+| `JSKELET_LOG_BUCKET` + `AWS_*` | Access log'u S3'e yazıyorsanız | `logs.s3` credential ve bucket; ayrıntı [07](./07-yapilandirma.md) |
+
+Production'da dosya veya S3 sink açıldığında HTTP access log middleware
+otomatik mount edilir (`logs.kinds` içinde `http` varsa). Admin paneli ring'i
+ayrıdır — disk/S3'e yazılan satırlar panele akmaz.
 
 Tam liste ve prewarm ayarlarının öncelik sırası:
 [07-yapilandirma.md](./07-yapilandirma.md).

package/docs/en/07-configuration.md

@@ -768,6 +768,46 @@ redis: {
 }
 ```
 
+### `logs`
+
+Persistent log sinks. Everything is off by default: stdout and the admin panel
+ring keep their current behaviour. When enabled, HTTP access logs and framework
+events (`event` / `error`) are written as NDJSON lines to a file and/or S3.
+
+| Field | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `console` | `boolean` | `true` | Whether runtime `http` / `event` / `error` lines go to stdout (banner/build lines are unaffected) |
+| `kinds` | `("http" \| "event" \| "error")[]` | all | Which kinds reach the sinks |
+| `file.enabled` | `boolean` | `false` | Daily file sink |
+| `file.dir` | `string` | `"logs"` | Directory relative to the project root; `jskelet-YYYY-MM-DD.log` |
+| `file.rotate` | `"daily"` | `"daily"` | Daily rotation only |
+| `s3.enabled` | `boolean` | `false` | S3 batch PutObject sink |
+| `s3.bucket` | `string \| null` | `null` | Bucket; `JSKELET_LOG_BUCKET` overrides |
+| `s3.prefix` | `string` | `"jskelet/logs/"` | Object key prefix |
+| `s3.region` | `string \| null` | `null` | Region; falls back to `AWS_REGION` / `AWS_DEFAULT_REGION` when unset |
+| `s3.endpoint` | `string \| null` | `null` | Path-style endpoint for MinIO etc. |
+| `s3.flushIntervalMs` | `number` | `5000` | Batch flush interval |
+| `s3.maxBatch` | `number` | `100` | Flush early after this many lines |
+
+S3 credentials are not written in the config: `AWS_ACCESS_KEY_ID`,
+`AWS_SECRET_ACCESS_KEY`, optional `AWS_SESSION_TOKEN`. Missing bucket/region/
+credentials warn and disable the S3 sink; the site still starts. The framework
+does not ship `@aws-sdk` — PutObject is embedded with SigV4.
+
+```js
+logs: {
+  console: true,
+  kinds: ["http", "error"],
+  file: { enabled: true, dir: "logs" },
+  s3: {
+    enabled: process.env.NODE_ENV === "production",
+    bucket: process.env.JSKELET_LOG_BUCKET,
+    prefix: "my-app/logs/",
+    region: process.env.AWS_REGION,
+  },
+}
+```
+
 ### `admin()`
 
 The framework admin panel (`/_jskelet/admin`). It manages the in-process /
@@ -954,6 +994,11 @@ and no warning is printed.
 | `JSKELET_SECRET` | `jskelet/cookies` | — | The signed cookie secret. Read when `security.cookieSecret` is not set; if neither exists, the signed cookie API throws. [12](./12-dashboards-and-sessions.md) |
 | `DEV_TOKEN` | `devGate`, `prewarm` | — | If set, every request without a token gets a 404. Prewarming carries the token as a cookie. [09](./09-dev-tools.md) |
 | `JSKELET_ADMIN` | `createApp` | — | When set, turns the admin panel on; `0` turns off a panel enabled in the config. The env wins because the panel is usually opened once during an incident. [06](./06-caching.md) |
+| `JSKELET_LOG_BUCKET` | `logs.s3` | — | S3 log bucket; overrides `logs.s3.bucket` |
+| `AWS_ACCESS_KEY_ID` | `logs.s3` | — | Signs S3 PutObject. Missing when `s3.enabled` disables the sink |
+| `AWS_SECRET_ACCESS_KEY` | `logs.s3` | — | S3 signing secret |
+| `AWS_SESSION_TOKEN` | `logs.s3` | — | Optional, for temporary credentials |
+| `AWS_REGION` / `AWS_DEFAULT_REGION` | `logs.s3` | — | Read when `logs.s3.region` is unset |
 | `JSKELET_CLOUDFLARE_KEY` | Cloudflare cache surface | — | API token. Until it is set, CDN purging and edge analytics stay off; it overrides `apiToken` in the config. The token is never returned in a response. [06](./06-caching.md) |
 | `JSKELET_CLOUDFLARE_ZONE_ID` | Cloudflare cache surface | — | Zone identifier. No Cloudflare endpoint is called unless it is set alongside the token |
 | `JSKELET_CLOUDFLARE_HOSTNAME` | Cloudflare cache surface | — | The root for purge URLs. Required when the panel is opened over an internal address |

package/docs/en/10-deployment.md

@@ -48,6 +48,11 @@ considering in production:
 | `PREWARM_MAX` | Depends on site size | Number of pages warmed at startup |
 | `PREWARM_INTERVAL_SECONDS` | `0` or a long value | If you want to keep never-visited pages warm |
 | `DEV_TOKEN` | Staging only | Hides an environment that is not public yet |
+| `JSKELET_LOG_BUCKET` + `AWS_*` | If you write access logs to S3 | `logs.s3` credentials and bucket; details in [07](./07-configuration.md) |
+
+When a file or S3 sink is enabled in production, the HTTP access log middleware
+mounts automatically (if `http` is in `logs.kinds`). The admin panel ring is
+separate — lines written to disk/S3 do not stream into the panel.
 
 The full list and the precedence order of the prewarm settings:
 [07-configuration.md](./07-configuration.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jskelet",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "A framework that feels like no framework: Express 5 + EJS server rendering, vanilla JS islands, Tailwind v4 and an in-process HTML TTL cache.",
   "type": "module",
   "license": "MIT",

package/src/config/defaults.js

@@ -191,6 +191,44 @@ export const DEFAULT_REDIS = {
   commandTimeoutMs: 200,
 };
 
+/**
+ * Kalıcı log sink'leri (dosya + S3).
+ *
+ * Varsayılan her şey kapalı: stdout ve admin ring mevcut davranışını korur.
+ * `kinds` hangi structured kayıtların sink'lere gideceğini seçer; `console`
+ * runtime `http`/`event`/`error` satırlarının terminalde görünmesini kontrol
+ * eder (banner/build satırlarına dokunmaz).
+ *
+ * S3 credential'ları config'e yazılmaz — `AWS_ACCESS_KEY_ID` /
+ * `AWS_SECRET_ACCESS_KEY` (ve isteğe bağlı `AWS_SESSION_TOKEN`). Bucket için
+ * `JSKELET_LOG_BUCKET` env'i config'i ezer.
+ */
+export const DEFAULT_LOGS = {
+  console: true,
+  /** @type {Array<"http" | "event" | "error">} */
+  kinds: ["http", "event", "error"],
+  file: {
+    enabled: false,
+    /** Proje köküne göre relative. */
+    dir: "logs",
+    /** Yalnızca günlük rotasyon. */
+    rotate: /** @type {"daily"} */ ("daily"),
+  },
+  s3: {
+    enabled: false,
+    /** @type {string | null} */
+    bucket: null,
+    prefix: "jskelet/logs/",
+    /** @type {string | null} */
+    region: null,
+    /** MinIO vb. için; null → AWS. */
+    /** @type {string | null} */
+    endpoint: null,
+    flushIntervalMs: 5000,
+    maxBatch: 100,
+  },
+};
+
 /**
  * Framework yönetim paneli (`/_jskelet/admin`).
  *

package/src/config/index.js

@@ -19,9 +19,10 @@
  *                   query?: { [source]: string[] | true }, maxEntries?: number,
  *                   data?: {...}, redis?: {...}, prewarm?: {...} }
  *   admin()     → { enabled?, basePath?, allowIps?, blockBots?, … }
+ *   logs        → { console?, kinds?, file?, s3? }
  *
  * Fonksiyon olmayan bölümler (`brand`, `security`, `static`, `navigation`…)
- * düz nesne olarak okunur.
+ * düz nesne olarak okunur. `logs` fonksiyon ya da düz nesne olabilir.
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -36,6 +37,7 @@ import {
   DEFAULT_DEV_GATE_BYPASS,
   DEFAULT_DIRS,
   DEFAULT_HTML_CACHE_MAX_ENTRIES,
+  DEFAULT_LOGS,
   DEFAULT_NAVIGATION,
   DEFAULT_NAVIGATION_EXCLUDE,
   DEFAULT_PREWARM,
@@ -75,6 +77,19 @@ const CONFIG_FILE = "jskelet.config.mjs";
  * @property {number} commandTimeoutMs
  */
 
+/**
+ * @typedef {"http" | "event" | "error"} LogKind
+ *
+ * @typedef {object} LogsConfig
+ * @property {boolean} console Runtime http/event/error satırları stdout'a
+ *   basılsın mı (banner/build satırları etkilenmez).
+ * @property {LogKind[]} kinds Sink'lere giden kayıt türleri.
+ * @property {{ enabled: boolean, dir: string, rotate: "daily" }} file
+ * @property {{ enabled: boolean, bucket: string | null, prefix: string,
+ *   region: string | null, endpoint: string | null, flushIntervalMs: number,
+ *   maxBatch: number }} s3
+ */
+
 /**
  * @typedef {import('./pattern.js').CompiledPattern} CompiledPattern
  *
@@ -96,6 +111,7 @@ const CONFIG_FILE = "jskelet.config.mjs";
  * @property {{ attempts: number, delayMs: number }} transientRetry
  * @property {RedisConfig} redis Opsiyonel Redis ikinci kademesi.
  * @property {typeof DEFAULT_UPSTREAM_LIMIT} upstream Upstream hız freni.
+ * @property {LogsConfig} logs Kalıcı log sink'leri (dosya + S3).
  * @property {typeof DEFAULT_ADMIN} admin Framework yönetim paneli.
  * @property {typeof DEFAULT_CLOUDFLARE} cloudflare Cloudflare cache yüzeyi.
  * @property {Record<string, unknown>} prewarm
@@ -384,6 +400,77 @@ function normalizeCloudflare(raw) {
   };
 }
 
+const LOG_KINDS = new Set(["http", "event", "error"]);
+
+/**
+ * Kalıcı log sink'leri. Bozuk bir `kinds` listesi siteyi düşürmemeli —
+ * bilinmeyen girdiler atılır; hiç geçerli tür kalmazsa varsayılana dönülür.
+ *
+ * @param {unknown} raw
+ * @returns {LogsConfig}
+ */
+export function normalizeLogs(raw) {
+  const source = /** @type {Record<string, any>} */ (raw ?? {});
+  const fileRaw = /** @type {Record<string, any>} */ (source.file ?? {});
+  const s3Raw = /** @type {Record<string, any>} */ (source.s3 ?? {});
+
+  /** @type {LogKind[]} */
+  let kinds = DEFAULT_LOGS.kinds;
+  if (Array.isArray(source.kinds)) {
+    const filtered = source.kinds.filter(
+      (entry) => typeof entry === "string" && LOG_KINDS.has(entry),
+    );
+    if (filtered.length) kinds = /** @type {LogKind[]} */ ([...new Set(filtered)]);
+    else {
+      console.warn(
+        "[config] logs.kinds has no valid entries (http|event|error), using defaults",
+      );
+    }
+  } else if (source.kinds != null) {
+    console.warn("[config] logs.kinds must be an array, using defaults");
+  }
+
+  const flush = Number(s3Raw.flushIntervalMs);
+  const batch = Number(s3Raw.maxBatch);
+
+  /** @param {unknown} value */
+  const text = (value) => (typeof value === "string" && value ? value : null);
+
+  const envBucket = process.env.JSKELET_LOG_BUCKET;
+  const envRegion = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION;
+
+  return {
+    console: source.console !== false,
+    kinds,
+    file: {
+      enabled: fileRaw.enabled === true,
+      dir:
+        typeof fileRaw.dir === "string" && fileRaw.dir.trim()
+          ? fileRaw.dir.trim()
+          : DEFAULT_LOGS.file.dir,
+      rotate: "daily",
+    },
+    s3: {
+      enabled: s3Raw.enabled === true,
+      bucket: text(envBucket) ?? text(s3Raw.bucket),
+      prefix:
+        typeof s3Raw.prefix === "string" && s3Raw.prefix
+          ? s3Raw.prefix
+          : DEFAULT_LOGS.s3.prefix,
+      region: text(s3Raw.region) ?? text(envRegion),
+      endpoint: text(s3Raw.endpoint),
+      flushIntervalMs:
+        Number.isFinite(flush) && flush >= 500
+          ? Math.min(60_000, Math.floor(flush))
+          : DEFAULT_LOGS.s3.flushIntervalMs,
+      maxBatch:
+        Number.isFinite(batch) && batch >= 1
+          ? Math.min(5000, Math.floor(batch))
+          : DEFAULT_LOGS.s3.maxBatch,
+    },
+  };
+}
+
 /**
  * `cache().query` → yol deseni başına, cache anahtarına girmesine izin verilen
  * query parametreleri.
@@ -680,12 +767,13 @@ export async function loadConfig(options = {}) {
     }
   };
 
-  const [headers, redirects, rewrites, cache, admin] = await Promise.all([
+  const [headers, redirects, rewrites, cache, admin, logs] = await Promise.all([
     section("headers"),
     section("redirects"),
     section("rewrites"),
     section("cache"),
     section("admin"),
+    section("logs"),
   ]);
 
   const {
@@ -721,6 +809,7 @@ export async function loadConfig(options = {}) {
     transientRetry,
     redis,
     upstream,
+    logs: normalizeLogs(logs),
     admin: normalizeAdmin(admin),
     cloudflare,
     prewarm,

package/src/log.mjs

@@ -18,6 +18,28 @@ const isTTY = Boolean(stream.isTTY);
 const useColor =
   !process.env.NO_COLOR && (isTTY || process.env.JSKELET_COLOR === "1");
 
+/**
+ * Runtime olaylarının (`http` / `event` / `errorBox`) stdout'a basılıp
+ * basılmayacağı. Banner ve build satırları etkilenmez — onlar başlangıç
+ * çıktısıdır, access log değil.
+ */
+let consoleEnabled = true;
+
+/**
+ * `http` kayıtlarının `emitLog` ile abonelere gidip gitmeyeceği. Access
+ * middleware mount edildiğinde kapatılır: aksi hâlde devtools + middleware
+ * aynı isteği iki kez sink'e yazar.
+ */
+let emitHttp = true;
+
+/**
+ * @param {{ console?: boolean, emitHttp?: boolean }} [options]
+ */
+export function configureLog(options = {}) {
+  if (options.console !== undefined) consoleEnabled = options.console !== false;
+  if (options.emitHttp !== undefined) emitHttp = options.emitHttp !== false;
+}
+
 /**
  * @param {string} open
  * @returns {(text: string) => string}
@@ -245,14 +267,16 @@ export function ready({ elapsed, url, watching, label = "Ready" }) {
  * @param {{ symbol?: string, scope: string, message: string, note?: string, time?: number | null }} info
  */
 export function event({ symbol = symbols.ok, scope, message, note, time = null }) {
-  const body = `${message}${note ? `  ${note}` : ""}`;
-  const padding = " ".repeat(Math.max(1, DETAIL - body.length));
+  if (consoleEnabled) {
+    const body = `${message}${note ? `  ${note}` : ""}`;
+    const padding = " ".repeat(Math.max(1, DETAIL - body.length));
 
-  write(
-    `${c.gray(clock())}  ${symbol} ${c.bold(scope.padEnd(10))} ` +
-    `${message}${note ? `  ${c.dim(note)}` : ""}${padding}` +
-    `${c.gray((time == null ? "" : ms(time)).padStart(TIME))}\n`,
-  );
+    write(
+      `${c.gray(clock())}  ${symbol} ${c.bold(scope.padEnd(10))} ` +
+      `${message}${note ? `  ${c.dim(note)}` : ""}${padding}` +
+      `${c.gray((time == null ? "" : ms(time)).padStart(TIME))}\n`,
+    );
+  }
 
   emitLog({
     kind: "event",
@@ -270,24 +294,28 @@ export function event({ symbol = symbols.ok, scope, message, note, time = null }
  * @param {{ method: string, url: string, status: number, ms: number, cache?: string | null }} info
  */
 export function http(info) {
-  const tint =
-    info.status >= 500 ? c.red : info.status >= 400 ? c.yellow : c.green;
-
-  write(
-    `${c.gray(clock())}  ${c.bold(info.method.padEnd(6))}` +
-    `${c.gray(truncate(info.url, 28).padEnd(30))}` +
-    `${tint(String(info.status))} ${c.gray(ms(info.ms).padStart(TIME))}` +
-    `${info.cache === "HIT" ? ` ${c.dim("cached")}` : ""}\n`,
-  );
+  if (consoleEnabled) {
+    const tint =
+      info.status >= 500 ? c.red : info.status >= 400 ? c.yellow : c.green;
 
-  emitLog({
-    kind: "http",
-    method: info.method,
-    url: info.url,
-    status: info.status,
-    ms: info.ms,
-    cache: info.cache ?? null,
-  });
+    write(
+      `${c.gray(clock())}  ${c.bold(info.method.padEnd(6))}` +
+      `${c.gray(truncate(info.url, 28).padEnd(30))}` +
+      `${tint(String(info.status))} ${c.gray(ms(info.ms).padStart(TIME))}` +
+      `${info.cache === "HIT" ? ` ${c.dim("cached")}` : ""}\n`,
+    );
+  }
+
+  if (emitHttp) {
+    emitLog({
+      kind: "http",
+      method: info.method,
+      url: info.url,
+      status: info.status,
+      ms: info.ms,
+      cache: info.cache ?? null,
+    });
+  }
 }
 
 /**
@@ -333,27 +361,29 @@ export function box({ title, lines, tint = c.cyan }) {
  * @param {{ title: string, name: string, message: string, lines?: string[] }} info
  */
 export function errorBox({ title, name, message, lines = [] }) {
-  const top = `┌─ ${title} ${"─".repeat(Math.max(0, BOX - title.length - 3))}┐`;
-  const bottom = `└${"─".repeat(BOX)}┘`;
-
-  /** @param {string} text @param {(value: string) => string} [tint] */
-  const line = (text, tint = (value) => value) => {
-    const clipped = truncate(text, BOX - 4);
-    write(
-      `${c.red("│")}  ${tint(clipped)}${" ".repeat(BOX - 4 - clipped.length)}  ${c.red("│")}\n`,
-    );
-  };
-
-  write(`\n${c.red(top)}\n`);
-  line("");
-  line(name, (value) => c.bold(c.red(value)));
-  for (const part of wrap(message, BOX - 4)) line(part);
-  if (lines.length) {
+  if (consoleEnabled) {
+    const top = `┌─ ${title} ${"─".repeat(Math.max(0, BOX - title.length - 3))}┐`;
+    const bottom = `└${"─".repeat(BOX)}┘`;
+
+    /** @param {string} text @param {(value: string) => string} [tint] */
+    const line = (text, tint = (value) => value) => {
+      const clipped = truncate(text, BOX - 4);
+      write(
+        `${c.red("│")}  ${tint(clipped)}${" ".repeat(BOX - 4 - clipped.length)}  ${c.red("│")}\n`,
+      );
+    };
+
+    write(`\n${c.red(top)}\n`);
+    line("");
+    line(name, (value) => c.bold(c.red(value)));
+    for (const part of wrap(message, BOX - 4)) line(part);
+    if (lines.length) {
+      line("");
+      for (const part of lines) line(part, c.gray);
+    }
     line("");
-    for (const part of lines) line(part, c.gray);
+    write(`${c.red(bottom)}\n\n`);
   }
-  line("");
-  write(`${c.red(bottom)}\n\n`);
 
   emitLog({
     kind: "error",

package/src/server/create-app.js

@@ -10,6 +10,8 @@
  *   3. headers → devGate → redirects → trailingSlash — gate'in 404'ü
  *      redirect'ten önce; trailingSlash config redirects'ten sonra, böylece
  *      açık kurallar istenen yolu önce görür.
+ *   3b. access log (açıksa) — tamamlanan yanıtların süresi; admin/prewarm
+ *      içeride elenir.
  *   4. staticPrecompressed → express.static — build'de üretilmiş `.br`/`.gz`
  *      kopyalar varsa onlar servis edilir (kalite 11), yoksa istek altındaki
  *      static'e düşer ve middleware anında sıkıştırır (kalite 5).
@@ -42,6 +44,7 @@ import { isPrewarmRequest, notePrewarmError, startPrewarm } from "./prewarm.js";
 import { trackUpstreamFetch } from "./upstream-tracking.js";
 import { configureUpstreamLimiter } from "./upstream-limiter.js";
 import { connectRedis, disconnectRedis } from "./redis.js";
+import { configureLogs, flushLogs, closeLogs } from "./logs/pipeline.js";
 import { isNotFoundError, isRedirectError } from "../http/control-flow.js";
 
 /**
@@ -68,6 +71,10 @@ export async function createApp(options = {}) {
   // dokunmayan, tamamen opsiyonel bir adım.
   await connectRedis(config);
 
+  // Kalıcı log sink'leri (dosya / S3). Credential eksikse uyarı + no-op;
+  // site düşmez. Access middleware gerektiğinde biraz aşağıda mount edilir.
+  const { accessLog } = await configureLogs(config);
+
   const app = express();
 
   app.disable("x-powered-by");
@@ -90,6 +97,13 @@ export async function createApp(options = {}) {
   app.use(redirects());
   app.use(trailingSlash());
 
+  // Access log: headers/redirects sonrası, statikten önce — böylece
+  // tamamlanan her yanıt (304 dahil) süre alır; admin/prewarm içeride elenir.
+  if (accessLog) {
+    const { accessLogMiddleware } = await import("./logs/access-middleware.js");
+    app.use(accessLogMiddleware());
+  }
+
   app.use(staticPrecompressed(config.dirs.public));
   app.use(
     express.static(config.dirs.public, {
@@ -248,8 +262,10 @@ export async function startServer(options = {}) {
 /**
  * `SIGTERM`/`SIGINT` sonrası düzenli kapanış.
  *
- * Kapatılması gereken tek dış bağlantı Redis ve `quit` uçuştaki komutların
- * bitmesini bekliyor; sert `disconnect` yarıda kalan bir `SET` bırakabiliyor.
+ * Kapatılması gereken dış kaynaklar Redis ve log sink buffer'ları. Redis
+ * `quit` uçuştaki komutların bitmesini bekliyor; sert `disconnect` yarıda
+ * kalan bir `SET` bırakabiliyor. S3 sink kapanışta kalan batch'i PutObject
+ * ile gönderir.
  *
  * Açık HTTP bağlantıları **beklenmez**. `close()` tek başına yalnızca yeni
  * bağlantıyı reddediyor; keep-alive bir istemci ya da dev panelinin
@@ -276,10 +292,11 @@ function attachShutdown(server) {
     server.close();
     server.closeAllConnections?.();
 
-    void disconnectRedis().finally(() => {
-      clearTimeout(timer);
-      process.exit(0);
-    });
+    void Promise.all([disconnectRedis(), flushLogs().then(() => closeLogs())])
+      .finally(() => {
+        clearTimeout(timer);
+        process.exit(0);
+      });
   };
 
   process.once("SIGTERM", shutdown);

package/src/server/logs/access-middleware.js

@@ -0,0 +1,66 @@
+/**
+ * HTTP access log middleware.
+ *
+ * Admin ve prewarm yolları atlanır. Kayıt `log.http` ile stdout'a (console
+ * açıksa) ve `acceptLogEntry` ile sink'lere gider. `emitHttp` kapalı olduğu
+ * için `log.http` abonelere ikinci kez yazmaz.
+ */
+import * as log from "../../log.mjs";
+import { getConfig } from "../../config/index.js";
+import { acceptLogEntry } from "./pipeline.js";
+
+/**
+ * @param {{ basePath?: string }} [options]
+ * @returns {import('express').RequestHandler}
+ */
+export function accessLogMiddleware(options = {}) {
+  const config = getConfig();
+  const brand = config.brand;
+  const basePath =
+    options.basePath ??
+    (config.admin.enabled ? config.admin.basePath : null);
+
+  /** @type {import('express').RequestHandler} */
+  return (req, res, next) => {
+    const pathname = req.path || "";
+    if (basePath && (pathname === basePath || pathname.startsWith(`${basePath}/`))) {
+      return next();
+    }
+
+    if (req.headers["user-agent"] === brand.prewarmUserAgent) {
+      return next();
+    }
+
+    const started = process.hrtime.bigint();
+
+    res.on("finish", () => {
+      const ms = Number(process.hrtime.bigint() - started) / 1e6;
+      const cache = /** @type {string | null} */ (
+        res.getHeader(brand.cacheHeader) ?? null
+      );
+
+      const info = {
+        method: req.method,
+        url: req.originalUrl,
+        status: res.statusCode,
+        ms,
+        cache,
+      };
+
+      // Stdout (console açıksa). emitHttp kapalı → subscribe çiftlemez.
+      log.http(info);
+
+      acceptLogEntry({
+        kind: "http",
+        method: info.method,
+        url: info.url,
+        path: req.path,
+        status: info.status,
+        ms: info.ms,
+        cache: info.cache,
+      });
+    });
+
+    next();
+  };
+}

package/src/server/logs/file-sink.js

@@ -0,0 +1,66 @@
+/**
+ * Günlük rotasyonlu NDJSON dosya sink'i.
+ *
+ * Yol `path.resolve(root, dir)` ile bulunur — `getConfig().dirs` şişirilmez;
+ * log dizini opsiyonel bir yüzey ve çoğu kurulumda hiç açılmaz.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+
+/**
+ * @typedef {{ write: (entry: Record<string, unknown>) => Promise<void>,
+ *   flush: () => Promise<void>, close: () => Promise<void> }} LogSink
+ */
+
+/**
+ * @param {{ root: string, dir: string }} options
+ * @returns {LogSink}
+ */
+export function createFileSink(options) {
+  const baseDir = path.resolve(options.root, options.dir);
+  /** @type {string | null} */
+  let currentDay = null;
+  /** @type {string | null} */
+  let currentPath = null;
+  let ready = false;
+
+  /** @returns {string} */
+  function dayStamp(date = new Date()) {
+    const y = date.getUTCFullYear();
+    const m = String(date.getUTCMonth() + 1).padStart(2, "0");
+    const d = String(date.getUTCDate()).padStart(2, "0");
+    return `${y}-${m}-${d}`;
+  }
+
+  /**
+   * @param {string} day
+   * @returns {Promise<string>}
+   */
+  async function ensureFile(day) {
+    if (!ready) {
+      await fs.mkdir(baseDir, { recursive: true });
+      ready = true;
+    }
+    if (currentDay === day && currentPath) return currentPath;
+    currentDay = day;
+    currentPath = path.join(baseDir, `jskelet-${day}.log`);
+    return currentPath;
+  }
+
+  return {
+    async write(entry) {
+      const day = dayStamp(
+        typeof entry.at === "number" ? new Date(entry.at) : new Date(),
+      );
+      const file = await ensureFile(day);
+      await fs.appendFile(file, `${JSON.stringify(entry)}\n`, "utf8");
+    },
+    async flush() {
+      // appendFile senkron flush eder; ekstra iş yok.
+    },
+    async close() {
+      currentDay = null;
+      currentPath = null;
+    },
+  };
+}

package/src/server/logs/pipeline.js

@@ -0,0 +1,164 @@
+/**
+ * Structured log pipeline: `log.subscribe` → kinds filtresi → file / S3.
+ *
+ * Sink yokken abone olunmaz: `emitLog` boş Set üzerinde döner ve stdout
+ * yoluna maliyet eklemez. Credential eksikse S3 açılmaz, site ayağa kalkar.
+ */
+import process from "node:process";
+import * as log from "../../log.mjs";
+import { createFileSink } from "./file-sink.js";
+import { createS3Sink } from "./s3-sink.js";
+
+/**
+ * @typedef {import('../../config/index.js').LogsConfig} LogsConfig
+ * @typedef {import('../../config/index.js').ResolvedConfig} ResolvedConfig
+ * @typedef {import('./file-sink.js').LogSink} LogSink
+ */
+
+/** @type {(() => void) | null} */
+let unsubscribe = null;
+/** @type {LogSink[]} */
+let sinks = [];
+/** @type {Set<string>} */
+let kindSet = new Set();
+let accessMounted = false;
+
+/**
+ * @returns {import('./s3-put.js').AwsCredentials | null}
+ */
+function readCredentials() {
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+  if (!accessKeyId || !secretAccessKey) return null;
+  return {
+    accessKeyId,
+    secretAccessKey,
+    sessionToken: process.env.AWS_SESSION_TOKEN || null,
+  };
+}
+
+/**
+ * Access middleware mount edilmeli mi?
+ *
+ * Dev'de yalnızca console isteniyorsa mount edilmez — HTML satırlarını
+ * zaten devtools basıyor; çift kayıt olmasın. Sink açıksa ya da production
+ * console access log istiyorsa mount edilir.
+ *
+ * @param {LogsConfig} logs
+ * @returns {boolean}
+ */
+export function shouldMountAccessLog(logs) {
+  if (!logs.kinds.includes("http")) return false;
+  if (logs.file.enabled || logs.s3.enabled) return true;
+  return logs.console && process.env.NODE_ENV !== "development";
+}
+
+/**
+ * @param {ResolvedConfig} config
+ * @returns {Promise<{ accessLog: boolean }>}
+ */
+export async function configureLogs(config) {
+  await closeLogs();
+
+  const logs = config.logs;
+  kindSet = new Set(logs.kinds);
+  accessMounted = shouldMountAccessLog(logs);
+
+  log.configureLog({
+    console: logs.console,
+    // Access middleware HTTP'yi kendisi pipeline'a yazar; log.http yalnızca
+    // stdout için kalsın — aksi hâlde HTML istekleri (devtools) çiftlenir.
+    emitHttp: !accessMounted,
+  });
+
+  /** @type {LogSink[]} */
+  const next = [];
+
+  if (logs.file.enabled) {
+    next.push(createFileSink({ root: config.root, dir: logs.file.dir }));
+  }
+
+  if (logs.s3.enabled) {
+    const credentials = readCredentials();
+    if (!logs.s3.bucket) {
+      console.warn("[logs] s3.enabled but no bucket (set JSKELET_LOG_BUCKET or logs.s3.bucket)");
+    } else if (!logs.s3.region) {
+      console.warn("[logs] s3.enabled but no region (set AWS_REGION or logs.s3.region)");
+    } else if (!credentials) {
+      console.warn(
+        "[logs] s3.enabled but AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY missing — S3 sink disabled",
+      );
+    } else {
+      next.push(
+        createS3Sink({
+          bucket: logs.s3.bucket,
+          prefix: logs.s3.prefix,
+          region: logs.s3.region,
+          endpoint: logs.s3.endpoint,
+          credentials,
+          flushIntervalMs: logs.s3.flushIntervalMs,
+          maxBatch: logs.s3.maxBatch,
+        }),
+      );
+    }
+  }
+
+  sinks = next;
+
+  if (sinks.length) {
+    unsubscribe = log.subscribe((raw) => {
+      acceptLogEntry(raw);
+    });
+  }
+
+  return { accessLog: accessMounted };
+}
+
+/**
+ * Access middleware ve `log.subscribe` ortak giriş noktası.
+ *
+ * @param {Record<string, unknown>} raw
+ */
+export function acceptLogEntry(raw) {
+  if (!sinks.length) return;
+
+  const kind = typeof raw.kind === "string" ? raw.kind : "event";
+  if (!kindSet.has(kind)) return;
+
+  const entry = {
+    ...raw,
+    kind,
+    at: typeof raw.at === "number" ? raw.at : Date.now(),
+  };
+
+  for (const sink of sinks) {
+    void sink.write(entry).catch((error) => {
+      console.warn("[logs] sink write failed", error);
+    });
+  }
+}
+
+/**
+ * Kapanışta buffer'ları boşaltır.
+ *
+ * @returns {Promise<void>}
+ */
+export async function flushLogs() {
+  await Promise.all(sinks.map((sink) => sink.flush()));
+}
+
+/**
+ * @returns {Promise<void>}
+ */
+export async function closeLogs() {
+  if (unsubscribe) {
+    unsubscribe();
+    unsubscribe = null;
+  }
+  const closing = sinks;
+  sinks = [];
+  await Promise.all(closing.map((sink) => sink.close()));
+  kindSet = new Set();
+  accessMounted = false;
+  log.configureLog({ console: true, emitHttp: true });
+}

package/src/server/logs/s3-put.js

@@ -0,0 +1,214 @@
+/**
+ * Minimal S3 PutObject — yalnızca SigV4 + `fetch`.
+ *
+ * `@aws-sdk/client-s3` taşınmıyor: tek operasyon için SDK'nın maliyeti ve
+ * peer yüzeyi gereksiz. Credential zinciri env'den okunur
+ * (`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`);
+ * IAM role / instance metadata yok — container'a key vermeyen kurulumlar
+ * için sink zaten açılışta no-op'a düşer.
+ */
+import crypto from "node:crypto";
+
+/**
+ * @typedef {{ accessKeyId: string, secretAccessKey: string,
+ *   sessionToken?: string | null }} AwsCredentials
+ *
+ * @typedef {{ bucket: string, key: string, body: string | Buffer,
+ *   region: string, endpoint?: string | null, credentials: AwsCredentials,
+ *   now?: Date }} PutObjectInput
+ */
+
+/**
+ * @param {string} algorithm
+ * @param {string | Buffer} key
+ * @param {string | Buffer} data
+ * @returns {Buffer}
+ */
+function hmac(algorithm, key, data) {
+  return crypto.createHmac(algorithm, key).update(data).digest();
+}
+
+/**
+ * @param {string | Buffer} data
+ * @returns {string}
+ */
+export function sha256Hex(data) {
+  return crypto.createHash("sha256").update(data).digest("hex");
+}
+
+/**
+ * @param {Date} date
+ * @returns {{ amzDate: string, dateStamp: string }}
+ */
+export function formatAmzDates(date) {
+  const iso = date.toISOString().replace(/[:-]|\.\d{3}/g, "");
+  return {
+    amzDate: iso,
+    dateStamp: iso.slice(0, 8),
+  };
+}
+
+/**
+ * @param {string} secretAccessKey
+ * @param {string} dateStamp
+ * @param {string} region
+ * @param {string} service
+ * @returns {Buffer}
+ */
+export function deriveSigningKey(secretAccessKey, dateStamp, region, service) {
+  const kDate = hmac("sha256", `AWS4${secretAccessKey}`, dateStamp);
+  const kRegion = hmac("sha256", kDate, region);
+  const kService = hmac("sha256", kRegion, service);
+  return hmac("sha256", kService, "aws4_request");
+}
+
+/**
+ * @param {{ method: string, canonicalUri: string, canonicalQuerystring?: string,
+ *   headers: Record<string, string>, payloadHash: string }} parts
+ * @returns {{ canonicalRequest: string, signedHeaders: string }}
+ */
+export function buildCanonicalRequest(parts) {
+  const names = Object.keys(parts.headers)
+    .map((name) => name.toLowerCase())
+    .sort();
+  const canonicalHeaders = names
+    .map((name) => `${name}:${parts.headers[name].trim().replace(/\s+/g, " ")}\n`)
+    .join("");
+  const signedHeaders = names.join(";");
+
+  const canonicalRequest = [
+    parts.method,
+    parts.canonicalUri,
+    parts.canonicalQuerystring ?? "",
+    canonicalHeaders,
+    signedHeaders,
+    parts.payloadHash,
+  ].join("\n");
+
+  return { canonicalRequest, signedHeaders };
+}
+
+/**
+ * @param {{ amzDate: string, dateStamp: string, region: string, service: string,
+ *   canonicalRequest: string }} parts
+ * @returns {string}
+ */
+export function buildStringToSign(parts) {
+  const scope = `${parts.dateStamp}/${parts.region}/${parts.service}/aws4_request`;
+  return [
+    "AWS4-HMAC-SHA256",
+    parts.amzDate,
+    scope,
+    sha256Hex(parts.canonicalRequest),
+  ].join("\n");
+}
+
+/**
+ * URI path encode (S3 key segment'leri). `/` korunur.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+export function encodeS3Path(value) {
+  return value
+    .split("/")
+    .map((segment) => encodeURIComponent(segment).replace(/[!'()*]/g, (char) =>
+      `%${char.charCodeAt(0).toString(16).toUpperCase()}`,
+    ))
+    .join("/");
+}
+
+/**
+ * PutObject isteğini imzalar; ağ çağrısı yapmaz — test edilebilir olsun diye.
+ *
+ * @param {PutObjectInput} input
+ * @returns {{ url: string, headers: Record<string, string>, body: Buffer }}
+ */
+export function buildSignedPutObject(input) {
+  const body = Buffer.isBuffer(input.body) ? input.body : Buffer.from(input.body);
+  const now = input.now ?? new Date();
+  const { amzDate, dateStamp } = formatAmzDates(now);
+  const service = "s3";
+  const payloadHash = sha256Hex(body);
+
+  const keyPath = encodeS3Path(input.key.replace(/^\/+/, ""));
+  const usePathStyle = Boolean(input.endpoint);
+  const endpointHost = input.endpoint
+    ? new URL(input.endpoint).host
+    : `${input.bucket}.s3.${input.region}.amazonaws.com`;
+  const host = usePathStyle ? new URL(input.endpoint ?? "").host : endpointHost;
+
+  const canonicalUri = usePathStyle
+    ? `/${encodeS3Path(input.bucket)}/${keyPath}`
+    : `/${keyPath}`;
+
+  /** @type {Record<string, string>} */
+  const headers = {
+    host,
+    "content-type": "application/x-ndjson",
+    "content-length": String(body.length),
+    "x-amz-content-sha256": payloadHash,
+    "x-amz-date": amzDate,
+  };
+
+  if (input.credentials.sessionToken) {
+    headers["x-amz-security-token"] = input.credentials.sessionToken;
+  }
+
+  const { canonicalRequest, signedHeaders } = buildCanonicalRequest({
+    method: "PUT",
+    canonicalUri,
+    headers,
+    payloadHash,
+  });
+
+  const stringToSign = buildStringToSign({
+    amzDate,
+    dateStamp,
+    region: input.region,
+    service,
+    canonicalRequest,
+  });
+
+  const signingKey = deriveSigningKey(
+    input.credentials.secretAccessKey,
+    dateStamp,
+    input.region,
+    service,
+  );
+  const signature = hmac("sha256", signingKey, stringToSign).toString("hex");
+  const credentialScope = `${dateStamp}/${input.region}/${service}/aws4_request`;
+
+  headers.authorization =
+    `AWS4-HMAC-SHA256 Credential=${input.credentials.accessKeyId}/${credentialScope}, ` +
+    `SignedHeaders=${signedHeaders}, Signature=${signature}`;
+
+  const base = usePathStyle
+    ? String(input.endpoint).replace(/\/+$/, "")
+    : `https://${host}`;
+  const url = usePathStyle
+    ? `${base}/${encodeS3Path(input.bucket)}/${keyPath}`
+    : `${base}/${keyPath}`;
+
+  return { url, headers, body };
+}
+
+/**
+ * @param {PutObjectInput} input
+ * @returns {Promise<void>}
+ */
+export async function putObject(input) {
+  const signed = buildSignedPutObject(input);
+  const response = await fetch(signed.url, {
+    method: "PUT",
+    headers: signed.headers,
+    body: signed.body,
+  });
+
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(
+      `S3 PutObject ${response.status}: ${text.slice(0, 200) || response.statusText}`,
+    );
+  }
+}

package/src/server/logs/s3-sink.js

@@ -0,0 +1,112 @@
+/**
+ * S3 batch sink — satırları biriktirir, aralık / maxBatch ile PutObject atar.
+ *
+ * Başarısız bir yükleme süreci düşürmez: bir kez uyarır, batch'i bırakır.
+ * Backpressure için yeniden kuyruk yok — log kaybı, belleğin şişmesinden
+ * tercih edilir.
+ */
+import os from "node:os";
+import process from "node:process";
+import { putObject } from "./s3-put.js";
+
+/**
+ * @typedef {import('./file-sink.js').LogSink} LogSink
+ * @typedef {import('./s3-put.js').AwsCredentials} AwsCredentials
+ */
+
+/**
+ * @param {{ bucket: string, prefix: string, region: string,
+ *   endpoint?: string | null, credentials: AwsCredentials,
+ *   flushIntervalMs: number, maxBatch: number,
+ *   put?: typeof putObject }} options
+ * @returns {LogSink & { pendingCount: () => number }}
+ */
+export function createS3Sink(options) {
+  /** @type {string[]} */
+  let buffer = [];
+  let seq = 0;
+  let warned = false;
+  /** @type {Promise<void>} */
+  let chain = Promise.resolve();
+  /** @type {ReturnType<typeof setInterval> | null} */
+  let timer = null;
+
+  const put = options.put ?? putObject;
+  const host = os.hostname().replace(/[^a-zA-Z0-9._-]/g, "-") || "host";
+  const prefix = options.prefix.endsWith("/")
+    ? options.prefix
+    : `${options.prefix}/`;
+
+  /**
+   * @param {Date} [date]
+   * @returns {string}
+   */
+  function objectKey(date = new Date()) {
+    const y = date.getUTCFullYear();
+    const m = String(date.getUTCMonth() + 1).padStart(2, "0");
+    const d = String(date.getUTCDate()).padStart(2, "0");
+    const iso = date.toISOString().replace(/[:.]/g, "-");
+    seq += 1;
+    return `${prefix}${y}/${m}/${d}/${host}-${process.pid}-${iso}-${seq}.ndjson`;
+  }
+
+  /**
+   * @param {string} message
+   * @param {unknown} [error]
+   */
+  function warnOnce(message, error) {
+    if (warned) return;
+    warned = true;
+    console.warn(`[logs] ${message}`, error ?? "");
+  }
+
+  async function flushNow() {
+    if (!buffer.length) return;
+    const lines = buffer;
+    buffer = [];
+    const body = `${lines.join("\n")}\n`;
+    try {
+      await put({
+        bucket: options.bucket,
+        key: objectKey(),
+        body,
+        region: options.region,
+        endpoint: options.endpoint ?? null,
+        credentials: options.credentials,
+      });
+    } catch (error) {
+      warnOnce("S3 PutObject failed; dropping batch", error);
+    }
+  }
+
+  /** Flush'ları sıraya dizer — iki timer çakışmasın. */
+  function enqueueFlush() {
+    chain = chain.then(flushNow).catch(() => {});
+    return chain;
+  }
+
+  timer = setInterval(() => {
+    void enqueueFlush();
+  }, options.flushIntervalMs);
+  timer.unref?.();
+
+  return {
+    pendingCount() {
+      return buffer.length;
+    },
+    async write(entry) {
+      buffer.push(JSON.stringify(entry));
+      if (buffer.length >= options.maxBatch) await enqueueFlush();
+    },
+    async flush() {
+      await enqueueFlush();
+    },
+    async close() {
+      if (timer) {
+        clearInterval(timer);
+        timer = null;
+      }
+      await enqueueFlush();
+    },
+  };
+}