jskelet 0.3.2 → 0.3.3

package/CHANGELOG.md

@@ -30,9 +30,12 @@ one is listed under a **Breaking** heading.
 - Top-level `logs` config for persistent sinks: daily NDJSON files
   (`logs.file`) and batched S3 PutObject (`logs.s3`) with embedded SigV4 — no
   `@aws-sdk` dependency. `kinds` selects `http` / `event` / `error`; `console`
-  toggles runtime stdout lines. Missing bucket/region/credentials warn and
+  toggles runtime stdout lines. `JSKELET_LOG_BUCKET` (and `logs.s3.bucket`) may
+  be a plain bucket or a `bucket/prefix/…` path. `JSKELET_S3_API_URL` sets the
+  R2/MinIO endpoint (region defaults to `auto`). Missing credentials warn and
   disable the S3 sink without taking the site down. Env: `JSKELET_LOG_BUCKET`,
-  `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`, `AWS_REGION`.
+  `JSKELET_S3_ACCESS_KEY_ID`, `JSKELET_S3_SECRET_ACCESS_KEY`,
+  `JSKELET_S3_SESSION_TOKEN`, `JSKELET_S3_REGION`, `JSKELET_S3_API_URL`.
 - Admin panel pages under `/_jskelet/admin`: Overview, Cache, Routes, Views,
   Logs and System. Configurable `allowIps` (exact or CIDR), `blockBots` (default
   on — crawler UAs get 404 before login), and `logSize`. Live Logs use an

package/docs/07-yapilandirma.md

@@ -766,17 +766,18 @@ mevcut davranışını korur. Açıldığında HTTP access log ile framework ola
 | `file.dir` | `string` | `"logs"` | Proje köküne göre dizin; `jskelet-YYYY-MM-DD.log` |
 | `file.rotate` | `"daily"` | `"daily"` | Yalnızca günlük rotasyon |
 | `s3.enabled` | `boolean` | `false` | S3 batch PutObject sink'i |
-| `s3.bucket` | `string \| null` | `null` | Bucket; `JSKELET_LOG_BUCKET` ezer |
-| `s3.prefix` | `string` | `"jskelet/logs/"` | Nesne anahtarı öneki |
-| `s3.region` | `string \| null` | `null` | Bölge; verilmezse `AWS_REGION` / `AWS_DEFAULT_REGION` |
-| `s3.endpoint` | `string \| null` | `null` | MinIO vb. için path-style endpoint |
+| `s3.bucket` | `string \| null` | `null` | Bucket ya da `bucket/prefix/…` yolu; `JSKELET_LOG_BUCKET` ezer |
+| `s3.prefix` | `string` | `"jskelet/logs/"` | Nesne anahtarı öneki (yolda verilmediyse) |
+| `s3.region` | `string \| null` | `null` | Bölge; verilmezse `JSKELET_S3_REGION`, endpoint varken `auto` |
+| `s3.endpoint` | `string \| null` | `null` | R2 / MinIO API adresi; `JSKELET_S3_API_URL` ezer |
 | `s3.flushIntervalMs` | `number` | `5000` | Batch flush aralığı |
 | `s3.maxBatch` | `number` | `100` | Bu kadar satırda erken flush |
 
-S3 credential'ları config'e yazılmaz: `AWS_ACCESS_KEY_ID`,
-`AWS_SECRET_ACCESS_KEY`, isteğe bağlı `AWS_SESSION_TOKEN`. Bucket/region/
-credential eksikse uyarı basılır ve S3 sink kapanır; site ayağa kalkmaya devam
-eder. Framework `@aws-sdk` taşımaz — PutObject SigV4 ile gömülüdür.
+S3 credential'ları config'e yazılmaz: `JSKELET_S3_ACCESS_KEY_ID`,
+`JSKELET_S3_SECRET_ACCESS_KEY`, isteğe bağlı `JSKELET_S3_SESSION_TOKEN`.
+Bucket/region/credential eksikse uyarı basılır ve S3 sink kapanır; site ayağa
+kalkmaya devam eder. Framework `@aws-sdk` taşımaz — PutObject SigV4 ile
+gömülüdür.
 
 ```js
 logs: {
@@ -787,7 +788,8 @@ logs: {
     enabled: process.env.NODE_ENV === "production",
     bucket: process.env.JSKELET_LOG_BUCKET,
     prefix: "my-app/logs/",
-    region: process.env.AWS_REGION,
+    region: process.env.JSKELET_S3_REGION,
+    endpoint: process.env.JSKELET_S3_API_URL,
   },
 }
 ```
@@ -973,11 +975,12 @@ basılmaz.
 | `JSKELET_SECRET` | `jskelet/cookies` | — | İmzalı cookie sırrı. `security.cookieSecret` verilmediğinde buradan okunur; ikisi de yoksa imzalı cookie API'si hata verir. [12](./12-panel-ve-oturum.md) |
 | `DEV_TOKEN` | `devGate`, `prewarm` | — | Ayarlıysa token taşımayan her isteğe 404 döner. Isıtma token'ı çerez olarak taşır. [09](./09-dev-araclari.md) |
 | `JSKELET_ADMIN` | `createApp` | — | Ayarlıysa yönetim panelini açar; `0` config'te açık olan paneli kapatır. Env config'i ezer, çünkü panel genelde bir arıza sırasında tek seferlik açılır. [06](./06-cache.md) |
-| `JSKELET_LOG_BUCKET` | `logs.s3` | — | S3 log bucket'ı; `logs.s3.bucket`'ı ezer |
-| `AWS_ACCESS_KEY_ID` | `logs.s3` | — | S3 PutObject imzası. Yoksa ve `s3.enabled` ise sink kapanır |
-| `AWS_SECRET_ACCESS_KEY` | `logs.s3` | — | S3 imza sırrı |
-| `AWS_SESSION_TOKEN` | `logs.s3` | — | Geçici credential'lar için isteğe bağlı |
-| `AWS_REGION` / `AWS_DEFAULT_REGION` | `logs.s3` | — | `logs.s3.region` verilmezse buradan okunur |
+| `JSKELET_LOG_BUCKET` | `logs.s3` | — | S3 bucket ya da `ayberkenis/jskelet/logs` gibi `bucket/prefix` yolu; `logs.s3.bucket`'ı ezer (`JSKELET_S3_BUCKET` yedek ad) |
+| `JSKELET_S3_ACCESS_KEY_ID` | `logs.s3` | — | S3 PutObject imzası. Yoksa ve `s3.enabled` ise sink kapanır |
+| `JSKELET_S3_SECRET_ACCESS_KEY` | `logs.s3` | — | S3 imza sırrı |
+| `JSKELET_S3_SESSION_TOKEN` | `logs.s3` | — | Geçici credential'lar için isteğe bağlı |
+| `JSKELET_S3_REGION` | `logs.s3` | — | `logs.s3.region` verilmezse; endpoint varken varsayılan `auto` |
+| `JSKELET_S3_API_URL` | `logs.s3` | — | R2 / MinIO endpoint; `logs.s3.endpoint`'i ezer |
 | `JSKELET_CLOUDFLARE_KEY` | Cloudflare cache yüzeyi | — | API token. Verilene kadar CDN purge'ü ve edge analitiği kapalıdır; config'teki `apiToken`'ı ezer. Token hiçbir cevapta dönmez. [06](./06-cache.md) |
 | `JSKELET_CLOUDFLARE_ZONE_ID` | Cloudflare cache yüzeyi | — | Zone kimliği. Token'la birlikte verilmedikçe hiçbir Cloudflare ucu çağrılmaz |
 | `JSKELET_CLOUDFLARE_HOSTNAME` | Cloudflare cache yüzeyi | — | Purge URL'lerinin kökü. Panel iç bir adresten açılıyorsa gerekir |

package/docs/10-dagitim.md

@@ -47,7 +47,7 @@ ayarlamayı düşünmeniz gerekenler:
 | `PREWARM_MAX` | Site boyutuna göre | Açılışta ısıtılacak sayfa sayısı |
 | `PREWARM_INTERVAL_SECONDS` | `0` ya da uzun bir değer | Hiç ziyaret edilmeyen sayfaları sıcak tutmak isterseniz |
 | `DEV_TOKEN` | Yalnızca staging'de | Yayına açılmamış ortamı gizler |
-| `JSKELET_LOG_BUCKET` + `AWS_*` | Access log'u S3'e yazıyorsanız | `logs.s3` credential ve bucket; ayrıntı [07](./07-yapilandirma.md) |
+| `JSKELET_S3_*` | Access log'u S3'e yazıyorsanız | Bucket + credential; ayrıntı [07](./07-yapilandirma.md) |
 
 Production'da dosya veya S3 sink açıldığında HTTP access log middleware
 otomatik mount edilir (`logs.kinds` içinde `http` varsa). Admin paneli ring'i

package/docs/en/07-configuration.md

@@ -782,17 +782,17 @@ events (`event` / `error`) are written as NDJSON lines to a file and/or S3.
 | `file.dir` | `string` | `"logs"` | Directory relative to the project root; `jskelet-YYYY-MM-DD.log` |
 | `file.rotate` | `"daily"` | `"daily"` | Daily rotation only |
 | `s3.enabled` | `boolean` | `false` | S3 batch PutObject sink |
-| `s3.bucket` | `string \| null` | `null` | Bucket; `JSKELET_LOG_BUCKET` overrides |
-| `s3.prefix` | `string` | `"jskelet/logs/"` | Object key prefix |
-| `s3.region` | `string \| null` | `null` | Region; falls back to `AWS_REGION` / `AWS_DEFAULT_REGION` when unset |
-| `s3.endpoint` | `string \| null` | `null` | Path-style endpoint for MinIO etc. |
+| `s3.bucket` | `string \| null` | `null` | Bucket or a `bucket/prefix/…` path; `JSKELET_LOG_BUCKET` overrides |
+| `s3.prefix` | `string` | `"jskelet/logs/"` | Object key prefix (when not given in the path) |
+| `s3.region` | `string \| null` | `null` | Region; falls back to `JSKELET_S3_REGION`, or `auto` when an endpoint is set |
+| `s3.endpoint` | `string \| null` | `null` | R2 / MinIO API URL; `JSKELET_S3_API_URL` overrides |
 | `s3.flushIntervalMs` | `number` | `5000` | Batch flush interval |
 | `s3.maxBatch` | `number` | `100` | Flush early after this many lines |
 
-S3 credentials are not written in the config: `AWS_ACCESS_KEY_ID`,
-`AWS_SECRET_ACCESS_KEY`, optional `AWS_SESSION_TOKEN`. Missing bucket/region/
-credentials warn and disable the S3 sink; the site still starts. The framework
-does not ship `@aws-sdk` — PutObject is embedded with SigV4.
+S3 credentials are not written in the config: `JSKELET_S3_ACCESS_KEY_ID`,
+`JSKELET_S3_SECRET_ACCESS_KEY`, optional `JSKELET_S3_SESSION_TOKEN`. Missing
+bucket/region/credentials warn and disable the S3 sink; the site still starts.
+The framework does not ship `@aws-sdk` — PutObject is embedded with SigV4.
 
 ```js
 logs: {
@@ -803,7 +803,8 @@ logs: {
     enabled: process.env.NODE_ENV === "production",
     bucket: process.env.JSKELET_LOG_BUCKET,
     prefix: "my-app/logs/",
-    region: process.env.AWS_REGION,
+    region: process.env.JSKELET_S3_REGION,
+    endpoint: process.env.JSKELET_S3_API_URL,
   },
 }
 ```
@@ -994,11 +995,12 @@ and no warning is printed.
 | `JSKELET_SECRET` | `jskelet/cookies` | — | The signed cookie secret. Read when `security.cookieSecret` is not set; if neither exists, the signed cookie API throws. [12](./12-dashboards-and-sessions.md) |
 | `DEV_TOKEN` | `devGate`, `prewarm` | — | If set, every request without a token gets a 404. Prewarming carries the token as a cookie. [09](./09-dev-tools.md) |
 | `JSKELET_ADMIN` | `createApp` | — | When set, turns the admin panel on; `0` turns off a panel enabled in the config. The env wins because the panel is usually opened once during an incident. [06](./06-caching.md) |
-| `JSKELET_LOG_BUCKET` | `logs.s3` | — | S3 log bucket; overrides `logs.s3.bucket` |
-| `AWS_ACCESS_KEY_ID` | `logs.s3` | — | Signs S3 PutObject. Missing when `s3.enabled` disables the sink |
-| `AWS_SECRET_ACCESS_KEY` | `logs.s3` | — | S3 signing secret |
-| `AWS_SESSION_TOKEN` | `logs.s3` | — | Optional, for temporary credentials |
-| `AWS_REGION` / `AWS_DEFAULT_REGION` | `logs.s3` | — | Read when `logs.s3.region` is unset |
+| `JSKELET_LOG_BUCKET` | `logs.s3` | — | S3 bucket or a `bucket/prefix` path like `ayberkenis/jskelet/logs`; overrides `logs.s3.bucket` (`JSKELET_S3_BUCKET` is an alias) |
+| `JSKELET_S3_ACCESS_KEY_ID` | `logs.s3` | — | Signs S3 PutObject. Missing when `s3.enabled` disables the sink |
+| `JSKELET_S3_SECRET_ACCESS_KEY` | `logs.s3` | — | S3 signing secret |
+| `JSKELET_S3_SESSION_TOKEN` | `logs.s3` | — | Optional, for temporary credentials |
+| `JSKELET_S3_REGION` | `logs.s3` | — | Used when `logs.s3.region` is unset; defaults to `auto` when an endpoint is set |
+| `JSKELET_S3_API_URL` | `logs.s3` | — | R2 / MinIO endpoint; overrides `logs.s3.endpoint` |
 | `JSKELET_CLOUDFLARE_KEY` | Cloudflare cache surface | — | API token. Until it is set, CDN purging and edge analytics stay off; it overrides `apiToken` in the config. The token is never returned in a response. [06](./06-caching.md) |
 | `JSKELET_CLOUDFLARE_ZONE_ID` | Cloudflare cache surface | — | Zone identifier. No Cloudflare endpoint is called unless it is set alongside the token |
 | `JSKELET_CLOUDFLARE_HOSTNAME` | Cloudflare cache surface | — | The root for purge URLs. Required when the panel is opened over an internal address |

package/docs/en/10-deployment.md

@@ -48,7 +48,7 @@ considering in production:
 | `PREWARM_MAX` | Depends on site size | Number of pages warmed at startup |
 | `PREWARM_INTERVAL_SECONDS` | `0` or a long value | If you want to keep never-visited pages warm |
 | `DEV_TOKEN` | Staging only | Hides an environment that is not public yet |
-| `JSKELET_LOG_BUCKET` + `AWS_*` | If you write access logs to S3 | `logs.s3` credentials and bucket; details in [07](./07-configuration.md) |
+| `JSKELET_S3_*` | If you write access logs to S3 | Bucket + credentials; details in [07](./07-configuration.md) |
 
 When a file or S3 sink is enabled in production, the HTTP access log middleware
 mounts automatically (if `http` is in `logs.kinds`). The admin panel ring is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jskelet",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "A framework that feels like no framework: Express 5 + EJS server rendering, vanilla JS islands, Tailwind v4 and an in-process HTML TTL cache.",
   "type": "module",
   "license": "MIT",

package/src/config/defaults.js

@@ -199,9 +199,11 @@ export const DEFAULT_REDIS = {
  * runtime `http`/`event`/`error` satırlarının terminalde görünmesini kontrol
  * eder (banner/build satırlarına dokunmaz).
  *
- * S3 credential'ları config'e yazılmaz — `AWS_ACCESS_KEY_ID` /
- * `AWS_SECRET_ACCESS_KEY` (ve isteğe bağlı `AWS_SESSION_TOKEN`). Bucket için
- * `JSKELET_LOG_BUCKET` env'i config'i ezer.
+ * S3 credential'ları config'e yazılmaz — `JSKELET_S3_ACCESS_KEY_ID` /
+ * `JSKELET_S3_SECRET_ACCESS_KEY` (ve isteğe bağlı `JSKELET_S3_SESSION_TOKEN`).
+ * Bucket için `JSKELET_LOG_BUCKET` (veya `JSKELET_S3_BUCKET`) env'i config'i
+ * ezer ve `ayberkenis/jskelet/logs` gibi `bucket/prefix` yolunu kabul eder.
+ * Uyumlu API adresi `JSKELET_S3_API_URL` (R2 / MinIO).
  */
 export const DEFAULT_LOGS = {
   console: true,

package/src/config/index.js

@@ -402,6 +402,34 @@ function normalizeCloudflare(raw) {
 
 const LOG_KINDS = new Set(["http", "event", "error"]);
 
+/**
+ * `bucket`, `JSKELET_LOG_BUCKET` veya `JSKELET_S3_BUCKET` değeri
+ * `ayberkenis/jskelet/logs` gibi bir yol olabilir: ilk segment bucket adı,
+ * kalanı nesne öneki. Böylece tek env ile hem kova hem klasör verilmiş olur.
+ *
+ * @param {string | null} value
+ * @returns {{ bucket: string | null, prefix: string | null }}
+ *   `prefix` null → yol öneki taşımıyor; config/varsayılan kalsın.
+ */
+export function splitS3BucketPath(value) {
+  if (!value) return { bucket: null, prefix: null };
+
+  const trimmed = value.replace(/^\/+|\/+$/g, "");
+  if (!trimmed) return { bucket: null, prefix: null };
+
+  const slash = trimmed.indexOf("/");
+  if (slash < 0) return { bucket: trimmed, prefix: null };
+
+  const bucket = trimmed.slice(0, slash);
+  const rest = trimmed.slice(slash + 1).replace(/^\/+|\/+$/g, "");
+  if (!bucket) return { bucket: null, prefix: null };
+
+  return {
+    bucket,
+    prefix: rest ? `${rest}/` : null,
+  };
+}
+
 /**
  * Kalıcı log sink'leri. Bozuk bir `kinds` listesi siteyi düşürmemeli —
  * bilinmeyen girdiler atılır; hiç geçerli tür kalmazsa varsayılana dönülür.
@@ -436,8 +464,28 @@ export function normalizeLogs(raw) {
   /** @param {unknown} value */
   const text = (value) => (typeof value === "string" && value ? value : null);
 
-  const envBucket = process.env.JSKELET_LOG_BUCKET;
-  const envRegion = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION;
+  const bucketPath = splitS3BucketPath(
+    text(process.env.JSKELET_LOG_BUCKET) ??
+      text(process.env.JSKELET_S3_BUCKET) ??
+      text(s3Raw.bucket),
+  );
+
+  const configPrefix =
+    typeof s3Raw.prefix === "string" && s3Raw.prefix
+      ? s3Raw.prefix.endsWith("/")
+        ? s3Raw.prefix
+        : `${s3Raw.prefix}/`
+      : DEFAULT_LOGS.s3.prefix;
+
+  const endpoint =
+    text(process.env.JSKELET_S3_API_URL) ?? text(s3Raw.endpoint);
+
+  // R2 / uyumlu API'lerde bölge çoğu zaman `auto`; endpoint varken region
+  // zorunlu tutulursa tek satırlık env kurulumu boşa düşer.
+  const region =
+    text(s3Raw.region) ??
+    text(process.env.JSKELET_S3_REGION) ??
+    (endpoint ? "auto" : null);
 
   return {
     console: source.console !== false,
@@ -452,13 +500,11 @@ export function normalizeLogs(raw) {
     },
     s3: {
       enabled: s3Raw.enabled === true,
-      bucket: text(envBucket) ?? text(s3Raw.bucket),
-      prefix:
-        typeof s3Raw.prefix === "string" && s3Raw.prefix
-          ? s3Raw.prefix
-          : DEFAULT_LOGS.s3.prefix,
-      region: text(s3Raw.region) ?? text(envRegion),
-      endpoint: text(s3Raw.endpoint),
+      bucket: bucketPath.bucket,
+      // Yoldaki önek tek env ile klasör vermeyi mümkün kılar; yoksa config.
+      prefix: bucketPath.prefix ?? configPrefix,
+      region,
+      endpoint,
       flushIntervalMs:
         Number.isFinite(flush) && flush >= 500
           ? Math.min(60_000, Math.floor(flush))

package/src/server/logs/pipeline.js

@@ -27,13 +27,13 @@ let accessMounted = false;
  * @returns {import('./s3-put.js').AwsCredentials | null}
  */
 function readCredentials() {
-  const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
-  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+  const accessKeyId = process.env.JSKELET_S3_ACCESS_KEY_ID;
+  const secretAccessKey = process.env.JSKELET_S3_SECRET_ACCESS_KEY;
   if (!accessKeyId || !secretAccessKey) return null;
   return {
     accessKeyId,
     secretAccessKey,
-    sessionToken: process.env.AWS_SESSION_TOKEN || null,
+    sessionToken: process.env.JSKELET_S3_SESSION_TOKEN || null,
   };
 }
 
@@ -81,12 +81,16 @@ export async function configureLogs(config) {
   if (logs.s3.enabled) {
     const credentials = readCredentials();
     if (!logs.s3.bucket) {
-      console.warn("[logs] s3.enabled but no bucket (set JSKELET_LOG_BUCKET or logs.s3.bucket)");
+      console.warn(
+        "[logs] s3.enabled but no bucket (set JSKELET_LOG_BUCKET or logs.s3.bucket)",
+      );
     } else if (!logs.s3.region) {
-      console.warn("[logs] s3.enabled but no region (set AWS_REGION or logs.s3.region)");
+      console.warn(
+        "[logs] s3.enabled but no region (set JSKELET_S3_REGION or logs.s3.region)",
+      );
     } else if (!credentials) {
       console.warn(
-        "[logs] s3.enabled but AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY missing — S3 sink disabled",
+        "[logs] s3.enabled but JSKELET_S3_ACCESS_KEY_ID / JSKELET_S3_SECRET_ACCESS_KEY missing — S3 sink disabled",
       );
     } else {
       next.push(

package/src/server/logs/s3-put.js

@@ -3,9 +3,9 @@
  *
  * `@aws-sdk/client-s3` taşınmıyor: tek operasyon için SDK'nın maliyeti ve
  * peer yüzeyi gereksiz. Credential zinciri env'den okunur
- * (`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`);
- * IAM role / instance metadata yok — container'a key vermeyen kurulumlar
- * için sink zaten açılışta no-op'a düşer.
+ * (`JSKELET_S3_ACCESS_KEY_ID` / `JSKELET_S3_SECRET_ACCESS_KEY` /
+ * `JSKELET_S3_SESSION_TOKEN`); IAM role / instance metadata yok —
+ * container'a key vermeyen kurulumlar için sink zaten açılışta no-op'a düşer.
  */
 import crypto from "node:crypto";