jskelet 0.6.0 → 0.6.2

package/docs/10-dagitim.md

@@ -50,7 +50,7 @@ ayarlamayı düşünmeniz gerekenler:
 | `HOST` | `0.0.0.0` | Yalnızca IPv4 dinlemek gerekiyorsa. Varsayılan `::` zaten çift yığın dinler |
 | `PREWARM_MAX` | Site boyutuna göre | Açılışta ısıtılacak sayfa sayısı |
 | `PREWARM_INTERVAL_SECONDS` | `0` ya da uzun bir değer | Hiç ziyaret edilmeyen sayfaları sıcak tutmak isterseniz |
-| `DEV_TOKEN` | Yalnızca staging'de | Yayına açılmamış ortamı gizler |
+| `DEV_GATE` + `DEV_TOKEN` | Yalnızca staging'de | Yayına açılmamış ortamı gizler. Token tek başına siteyi kilitlemez |
 | `JSKELET_S3_*` | Access log'u S3'e yazıyorsanız | Bucket + credential; ayrıntı [07](./07-yapilandirma.md) |
 
 Production'da dosya veya S3 sink açıldığında HTTP access log middleware
@@ -156,15 +156,11 @@ Build aşaması `npx jskelet build` ile bunları kendisi üretir.
 
 Bu depodaki örnekler jskelet'i npm'den değil `"jskelet": "file:../.."` ile
 alıyor. Coolify, Railway, Render gibi araçlarda "base directory" olarak
-`examples/marketing` verilirse build context yalnızca o dizin olur, `../..`
+`examples/blog` verilirse build context yalnızca o dizin olur, `../..`
 context'in dışında kalır ve kurulum `npm ci`de düşer. Doğru ayar: **base
-directory `/`**, Dockerfile konumu `/examples/marketing/Dockerfile`. Çalışan
-örnek `examples/marketing/Dockerfile` içinde ve context'i depo kökü kabul eder:
-
-```bash
-docker build -f examples/marketing/Dockerfile -t jskelet-marketing .
-docker run --rm -p 3000:3000 -e SITE_URL=https://example.com jskelet-marketing
-```
+directory `/`** (depo kökü) ve imajı yukarıdaki çok aşamalı Dockerfile ile
+uygulama dizinine göre uyarlamak — ya da jskelet'i npm bağımlılığı olarak
+kurup context'i uygulamanın kendi dizini yapmak.
 
 Kendi uygulamanızda jskelet normal bir bağımlılık olacağı için bu kısıt yoktur;
 yukarıdaki çok aşamalı imaj yeterli.
@@ -173,8 +169,8 @@ yukarıdaki çok aşamalı imaj yeterli.
 
 Framework hazır bir sağlık kontrolü ucu **eklemez**; kendi route'unuza koymanız
 gerekir. Varsayılan `devGateBypass` listesi `/api/healthcheck` yolunu içerdiği
-için bu adı kullanmak en az sürprizli seçenektir: `DEV_TOKEN` ayarlı bir ortamda
-bile erişilebilir kalır.
+için bu adı kullanmak en az sürprizli seçenektir: dev gate açıkken bile
+erişilebilir kalır.
 
 ```js
 // routes/00-health.mjs
@@ -331,7 +327,7 @@ istek başına iş neredeyse sıfıra iner.
 - [ ] `hooks.prewarmPaths()` en önemli sayfaları başa koyuyor
 - [ ] `headers()` içinde CSP ve güvenlik başlıkları tanımlı
 - [ ] Sağlık kontrolü ucu var ve `devGateBypass` listesinde
-- [ ] Staging'de `DEV_TOKEN` ayarlı, prod'da **ayarlı değil**
+- [ ] Staging'de `DEV_GATE=1` ve `DEV_TOKEN` ayarlı, prod'da gate **kapalı**
 - [ ] Ters proxy `Accept-Encoding`i iletiyor ve kendi sıkıştırmasını yapmıyor
 - [ ] `clientEnv` listesinde gizli anahtar yok
 

package/docs/README.md

@@ -47,7 +47,7 @@ eşlenik tutuluyor; birini değiştiriyorsan diğerini de değiştir.
 
 ## Çalışan örnekler
 
-Dördü de çalışır durumda; belgelerdeki örneklerin çoğu buralardan alınmıştır.
+Üçü de çalışır durumda; belgelerdeki örneklerin çoğu buralardan alınmıştır.
 
 **`examples/minimal/`** — iki route, bir bileşen, bir island, minimal config.
 Framework'ün en küçük çalışan hâli.
@@ -68,32 +68,7 @@ npm --prefix examples/blog install
 npm --prefix examples/blog run dev
 ```
 
-**`examples/marketing/`** — framework'ün kendi tanıtım sitesi: hero, kıyaslama
-tablosu, canlı gecikme ölçümü, SSS, belgeler dizini, sürüm notları ve indirme
-sayfası. Sayfadaki bayt sayıları `lib/payload.js` içinde sitenin **kendi** build
-çıktısından, sürüm künyesi ise `lib/release.js` içinde kurulu paketin
-`package.json`'ından okunur; gecikme sayıları `latency` island'ında tarayıcıda
-ölçülür. Uzun TTL (bir saat) ve tüm sayfaları ısıtan prewarm ile, cache'in en
-verimli çalıştığı profili gösterir.
-
-Site aynı zamanda **bu belgeleri** servis ediyor: `/docs/<bölüm>` adresleri
-`node_modules/jskelet/docs/` altındaki markdown dosyalarını okuyup sol gezinme,
-"bu sayfada" listesi ve sıralı geçişle basıyor. Çevirici `lib/markdown.js`
-içinde küçük bir modül — bağımlılık yok — ve kaynak paketin kendisi olduğu için
-site kurulu sürümden hiç ayrışmıyor.
-
-Site aynı zamanda **iki dilli**: varsayılan İngilizce kökte, Türkçe `/tr`
-altında ve route adları iki dilde de aynı. Framework'te i18n yok; dil
-çözümlemesi `lib/i18n.js` içinde uygulamanın kendi sözleşmesi olarak duruyor ve
-`hooks.layoutContext` ile bir sözlüğe bağlanıyor. Çok dilli bir siteyi bu
-yüzeyle nasıl kurabileceğinizi görmek için bakılacak yer burası.
-
-```bash
-npm --prefix examples/marketing install
-npm --prefix examples/marketing run dev
-```
-
-**`examples/dashboard/`** — diğer üçünün tersi eksen: kişiye özel sayfalar.
+**`examples/dashboard/`** — diğer ikisinin tersi eksen: kişiye özel sayfalar.
 İmzalı cookie ile giriş, `private: true` korumalı panel, sayfalı tablo
 fragment'i, CSRF'li mutasyon formu ve temizlik fonksiyonu döndüren bir island.
 Public bir tanıtım sayfası da var, böylece aynı uygulamada önbelleklenen ve
@@ -104,5 +79,5 @@ npm --prefix examples/dashboard install
 npm --prefix examples/dashboard run dev
 ```
 
-Her dört örnekte `node smoke.mjs` sunucu ayaktayken uçların beklendiği gibi
+Her üç örnekte `node smoke.mjs` sunucu ayaktayken uçların beklendiği gibi
 yanıt verdiğini doğrular.

package/docs/en/02-architecture.md

@@ -36,9 +36,10 @@ Request
  ├─ rewrites(beforeFiles)          config → proxy or a change to req.url
  ├─ compression                    brotli/gzip negotiation (quality 5)
  ├─ headers                        static cache + config headers()
- ├─ devGate                        if DEV_TOKEN is set, 404 without a token
+ ├─ devGate                        if the gate is on, 404 without a token
  ├─ redirects                      config redirects(), first match wins
  ├─ trailingSlash                  308 when config trailingSlash is true
+ ├─ robots.txt                     appends framework Disallow rules to the user's body
  ├─ staticPrecompressed            .br/.gz copies produced at build (quality 11)
  ├─ express.static                 files under public/
  ├─ (dev) devtools                 only when NODE_ENV=development
@@ -71,6 +72,11 @@ position has a reason, and moving things around leads to silent breakage.
   leak even its redirect rules to the outside. `trailingSlash` sits after config
   redirects so explicit rules see the requested path first; the canonical slash
   form is enforced as a second step.
+- **`robots.txt` before static, and inside compression.** The body the
+  application wrote is left intact; the framework appends `Disallow` rules
+  for its own endpoints. A response that already has `Content-Encoding` is
+  not rewritten — the block is added to plain text, and compression stays
+  outside.
 - **`staticPrecompressed` before `express.static`.** If there are `.br`/`.gz`
   copies produced at build time, those are served (brotli quality 11);
   otherwise the request falls through to the `static` below it and the

package/docs/en/03-routing.md

@@ -158,7 +158,9 @@ stored), but the flag is the right place. Details in
 ## `fragment()` — a partial without the layout
 
 For endpoints that refresh a region. No layout is printed, the response is sent
-with `private, no-store` and no ETag, and it never touches the HTML cache.
+with `private, no-store` and no ETag, and it never touches the HTML cache. The
+`/_fragment/` prefix is appended to `robots.txt`, so partial endpoints are not
+indexed ([04](./04-rendering.md#robotstxt)).
 
 ```js
 app.get(

package/docs/en/04-rendering.md

@@ -510,6 +510,30 @@ The `renderHeadMeta(metadata)` function is exported; it can be used when you
 need to produce the same tags outside the layout (for example in a fragment or
 an email).
 
+## robots.txt
+
+The application writes `robots.txt`: `public/robots.txt` or a plain route.
+The framework does not change that body; it appends a JSkelet note and
+`Disallow` rules **under** a successful text response. If there is no file
+and no route, the framework does not invent a `robots.txt`.
+
+Paths added:
+
+- `/_jskelet/` — admin panel, remote image proxy, auth handoff
+- `/__jskelet/` — development tools
+- `/_fragment/` — partial responses without a layout
+
+An endpoint moved off those prefixes is added too, but only when it is
+actually mounted: `admin.basePath`, `images.remote.path`,
+`auth.crossSubdomainHandoff.path`. `brand.devBasePath` is written only in
+development; in production that path may be the application's own page.
+
+The note starts with the configured brand name (`brand.name`, default
+`JSkelet`). The trailing group repeats `User-agent: *` together with every
+other agent already named in the file. Google does not merge a
+crawler-specific group with `*`; it does merge a second group for the same
+agent. If the note is already in the file, it is not appended again.
+
 ## Dynamic OG images
 
 Counterpart to Next.js `ImageResponse` / `opengraph-image.tsx`. There is no JSX:

package/docs/en/06-caching.md

@@ -231,7 +231,12 @@ price is acceptable, because live fields such as prices are updated on the
 client over WebSocket.
 
 The store is an LRU: an accessed entry is moved to the end, and once the limit
-(`cache().maxEntries`, 500 by default) is exceeded the oldest is evicted.
+(`cache().maxEntries`, 500 by default) is exceeded the oldest is evicted. Config
+may ask for more than 500; it **cannot exceed 800** — a higher value is clamped
+to 800 with a warning. Separately, in-process HTML strings plus compressed
+bodies **cannot exceed 256 MB**. A fat page or a `vary.host` copy that is still
+under the count limit is evicted by this budget too. A single page larger than
+256 MB is not stored; that response is still sent.
 
 ## What gets written to the cache
 
@@ -1145,9 +1150,9 @@ export default {
       html: { "/": 60, "/news/:slug": 300 },
       prewarm: {
         onVisit: {
-          perPage: 20,      // at most this many links per page
-          concurrency: 2,   // optional
-          rps: 4,           // optional; 0 = unlimited
+          perPage: 20,      // at most this many links per page; ceiling 20
+          concurrency: 2,   // ceiling 2
+          rps: 2,           // ceiling 2; 0 is clamped to 2 as well
         },
       },
     };
@@ -1163,7 +1168,15 @@ Rules:
   degraded or `no-store` responses do not extract links.
 - The warmer's own UA (`brand.prewarmUserAgent`) does not trigger — no crawl
   loop.
-- Paths that are already fresh are not enqueued.
+- Paths that are already fresh are not enqueued. Real keys look like
+  `h=host|/path?`; the check sees the vary prefix and the trailing `?`.
+  With `vary.host`, only this request's host counts as fresh.
+- The pending queue holds at most 64 paths; links beyond that are left for a
+  later response.
+- `perPage` 20, `rps` 2 and `concurrency` 2 are ceilings. A higher value (and
+  `rps: 0`) is clamped with a warning. Warm requests stay on loopback; when
+  `vary.host` is on, the public host is sent as `x-forwarded-host`, so a second
+  `h=127.0.0.1` entry is not created.
 - `nofollow`, `target="_blank"`, `data-no-prefetch`, `prewarmSkip` and
   `navigation.exclude` share the same exemptions as Speculation Rules.
 - Query strings are not warmed (default cache policy treats query as dynamic).
@@ -1308,8 +1321,9 @@ The requests go out with the headers `user-agent: jskelet-prewarm`
 (`brand.prewarmUserAgent`) and `accept-encoding: br, gzip`; the second one so
 that the compressed body enters the cache too.
 
-If `DEV_TOKEN` is set, the warm-up carries the token as a cookie; otherwise the
-dev gate returns 404 for all pages and the cache never fills.
+If the dev gate is on, the warm-up carries the token as a cookie; otherwise the
+gate returns 404 for all pages and the cache never fills. `DEV_TOKEN` alone
+does not turn the gate on.
 
 The request list in the dev panel and the terminal filter out requests carrying
 `prewarmUserAgent`: so that hundreds of warm-up requests do not flood the view.

package/docs/en/07-configuration.md

@@ -298,6 +298,21 @@ static: {
 }
 ```
 
+## `devGate`
+
+**Type:** `boolean` — **Default:** `false`
+
+Hides an environment that is not public yet. **`DEV_TOKEN` alone does not lock
+the site.** A shared task definition can carry the same variable into
+production; visitors are not required to present a token, and the site stays
+open.
+
+Turn the gate on with `devGate: true` or `DEV_GATE=1`. Then a request without
+the token gets a 404. `DEV_GATE=0` also turns off a gate the config enabled.
+If the token is empty, requests still pass even when the gate is on.
+
+Details: [09-dev-tools.md](./09-dev-tools.md).
+
 ## `devGateBypass`
 
 **Type:** `string[]` — **Default:**
@@ -305,8 +320,7 @@ static: {
 
 **Exact** paths the dev gate never closes off under any circumstances (not a
 prefix, an exact match). This is so that the health check and the robots files
-stay reachable in an environment where `DEV_TOKEN` is set. If provided, it
-replaces the default.
+stay reachable while the gate is on. If provided, it replaces the default.
 
 Details: [09-dev-tools.md](./09-dev-tools.md).
 
@@ -441,7 +455,8 @@ body > footer { view-transition-name: site-footer; }
 ::view-transition-new(root) { animation-duration: 180ms; }
 ```
 
-A working version lives in `examples/marketing/styles/globals.css`.
+Copy the Tailwind `@source` directives and view-transition CSS into your own
+app's `styles/globals.css`; the blocks above are a starting point.
 
 **If you use CSP**, the rules are emitted as an inline
 `<script type="speculationrules">`; your `script-src` policy needs to allow it.
@@ -771,6 +786,10 @@ raising this number burns through memory quickly; trying to solve a site with
 tens of thousands of paths from here is the wrong layer — the right place is
 `cache().data`.
 
+**Ceiling 800.** A higher value is clamped to 800 with a warning at load.
+In-process HTML plus compressed bodies also cannot exceed 256 MB; config
+cannot raise that budget.
+
 ### `cache().data`
 
 The upstream data cache (`withDataCache`). Details:
@@ -778,7 +797,7 @@ The upstream data cache (`withDataCache`). Details:
 
 | Field | Type | Default | Meaning |
 | --- | --- | --- | --- |
-| `maxEntries` | `number` | `10000` | The LRU entry limit. The limit is high because JSON is tens of times smaller than HTML. |
+| `maxEntries` | `number` | `10000` | The LRU entry limit. The limit is high because JSON is tens of times smaller than HTML. **Ceiling 20,000**; a higher value is clamped with a warning. |
 | `staleFactor` | `number` | `10` | For how many TTLs an entry stays usable after the TTL expired. `0` → no stale serving. |
 
 ### `cache().trackUpstream`
@@ -1023,13 +1042,13 @@ prewarm: {
 | Field | Type | Default | Meaning |
 | --- | --- | --- | --- |
 | `onVisit` | `true \| false \| object` | off | Visit-driven warming |
-| `onVisit.perPage` | `number` | `20` | At most how many links per page (top to bottom) |
-| `onVisit.concurrency` | `number` | same as classic | Parallel workers |
-| `onVisit.rps` | `number` | same as classic | Requests per second cap; `0` unlimited |
+| `onVisit.perPage` | `number` | `20` | At most how many links per page (top to bottom). **Ceiling 20** |
+| `onVisit.concurrency` | `number` | `2` | Parallel workers. **Ceiling 2** |
+| `onVisit.rps` | `number` | `2` | Requests per second cap. **Ceiling 2**; `0` is clamped to 2 as well |
 
 ```js
 prewarm: {
-  onVisit: { perPage: 20, rps: 4 },
+  onVisit: { perPage: 20, rps: 2 },
 }
 ```
 
@@ -1129,7 +1148,8 @@ and no warning is printed.
 | `PORT` | `startServer` | `3000` | Port to listen on. If busy, the process refuses to start; `jskelet start|dev --murder` kills the listener |
 | `HOST` | `startServer` | `::` | Interface to bind to. The default listens dual-stack (IPv6 + IPv4); it falls back to `0.0.0.0` where IPv6 is unavailable |
 | `JSKELET_SECRET` | `jskelet/cookies` | — | The signed cookie secret. Read when `security.cookieSecret` is not set; if neither exists, the signed cookie API throws. [12](./12-dashboards-and-sessions.md) |
-| `DEV_TOKEN` | `devGate`, `prewarm` | — | If set, every request without a token gets a 404. Prewarming carries the token as a cookie. [09](./09-dev-tools.md) |
+| `DEV_GATE` | `devGate` | off | `1` turns the gate on, `0` turns it off even when config enabled it. `DEV_TOKEN` alone does not turn it on. [09](./09-dev-tools.md) |
+| `DEV_TOKEN` | `devGate`, `prewarm` | — | The secret expected while the gate is on. If it is missing, or the gate is off, the site stays public. Prewarming carries the token as a cookie only while the gate is on. [09](./09-dev-tools.md) |
 | `JSKELET_ADMIN` | `createApp` | — | When set, turns the admin panel on; `0` turns off a panel enabled in the config. The env wins because the panel is usually opened once during an incident. [06](./06-caching.md) |
 | `JSKELET_LOG_BUCKET` | `logs.s3` | — | Log target: bucket or `bucket/prefix` path. With credentials, the sink turns on automatically |
 | `JSKELET_S3_BUCKET` | `logs.s3` | — | Bucket when `JSKELET_LOG_BUCKET` is unset; joins with `JSKELET_S3_KEY_PREFIX` |

package/docs/en/09-dev-tools.md

@@ -303,11 +303,20 @@ production process.
 
 ## Dev gate — `DEV_TOKEN`
 
-To hide an environment that is not public yet: while `DEV_TOKEN` is set,
-**every** request without the token gets a 404.
+To hide an environment that is not public yet. **The framework does not require
+the token:** a `DEV_TOKEN` sitting in the environment does not lock the site.
+You turn the gate on.
 
 ```bash
-DEV_TOKEN=a-long-random-string npm start
+DEV_GATE=1 DEV_TOKEN=a-long-random-string npm start
+```
+
+The same thing from config:
+
+```js
+export default {
+  devGate: true,
+};
 ```
 
 Access:
@@ -328,10 +337,12 @@ Behavior:
   `/site.webmanifest`, `/favicon.ico`. If your health check lives at a different
   path, remember to add it to this list, otherwise your orchestrator will see a
   404.
-- Without `DEV_TOKEN` the middleware is entirely disabled and costs nothing in
-  production.
-- Since warming makes requests to its own server, it carries the token as a
-  cookie; without it every page gets a 404 and the cache never fills up
+- While `devGate` is off (the default) or `DEV_TOKEN` is empty, the middleware
+  passes the request through. A `DEV_TOKEN` that leaked into a production task
+  does not ask visitors for a token; startup prints a warning.
+- `DEV_GATE=0` turns the gate off even when config says `devGate: true`.
+- While the gate is on, warming carries the token as a cookie; without it every
+  page gets a 404 and the cache never fills up
   ([06-caching.md](./06-caching.md)).
 
 In the middleware chain the gate sits after `headers` and **before**

package/docs/en/10-deployment.md

@@ -51,7 +51,7 @@ considering in production:
 | `HOST` | `0.0.0.0` | Only if you need to listen on IPv4 alone; the `::` default already listens dual-stack |
 | `PREWARM_MAX` | Depends on site size | Number of pages warmed at startup |
 | `PREWARM_INTERVAL_SECONDS` | `0` or a long value | If you want to keep never-visited pages warm |
-| `DEV_TOKEN` | Staging only | Hides an environment that is not public yet |
+| `DEV_GATE` + `DEV_TOKEN` | Staging only | Hides an environment that is not public yet. The token alone does not lock the site |
 | `JSKELET_S3_*` | If you write access logs to S3 | Bucket + credentials; details in [07](./07-configuration.md) |
 
 When a file or S3 sink is enabled in production, the HTTP access log middleware
@@ -157,16 +157,11 @@ The build stage produces these itself with `npx jskelet build`.
 
 The examples in this repo pull jskelet with `"jskelet": "file:../.."` rather
 than from npm. In tools like Coolify, Railway or Render, if you set the "base
-directory" to `examples/marketing`, the build context becomes only that
-directory, `../..` falls outside the context, and installation fails at
-`npm ci`. The correct setting: **base directory `/`**, Dockerfile location
-`/examples/marketing/Dockerfile`. The working example is in
-`examples/marketing/Dockerfile` and assumes the repo root as its context:
-
-```bash
-docker build -f examples/marketing/Dockerfile -t jskelet-marketing .
-docker run --rm -p 3000:3000 -e SITE_URL=https://example.com jskelet-marketing
-```
+directory" to `examples/blog`, the build context becomes only that directory,
+`../..` falls outside the context, and installation fails at `npm ci`. The
+correct setting: **base directory `/`** (the repo root) and adapt the
+multi-stage Dockerfile above to the app directory — or install jskelet as a
+normal npm dependency and use the app directory as the context.
 
 In your own application jskelet will be an ordinary dependency, so this
 constraint does not apply; the multi-stage image above is enough.
@@ -176,7 +171,7 @@ constraint does not apply; the multi-stage image above is enough.
 The framework does **not** add a ready-made health check endpoint; you have to
 put it in your own route. Since the default `devGateBypass` list contains
 `/api/healthcheck`, using that name is the least surprising option: it stays
-reachable even in an environment with `DEV_TOKEN` set.
+reachable even while the dev gate is on.
 
 ```js
 // routes/00-health.mjs
@@ -333,7 +328,7 @@ goes up, the work per request drops to almost zero.
 - [ ] `hooks.prewarmPaths()` puts the most important pages first
 - [ ] CSP and security headers are defined in `headers()`
 - [ ] A health check endpoint exists and is in the `devGateBypass` list
-- [ ] `DEV_TOKEN` is set on staging and **not set** in production
+- [ ] Staging has `DEV_GATE=1` and `DEV_TOKEN`; production leaves the gate **off**
 - [ ] The reverse proxy forwards `Accept-Encoding` and does not do its own
       compression
 - [ ] There are no secret keys in the `clientEnv` list

package/docs/en/README.md

@@ -50,7 +50,7 @@ change one, change the other.
 
 ## Runnable examples
 
-All four are in working order; most of the examples in the docs were taken from
+All three are in working order; most of the examples in the docs were taken from
 them.
 
 **`examples/minimal/`** — two routes, one component, one island, minimal config.
@@ -72,34 +72,7 @@ npm --prefix examples/blog install
 npm --prefix examples/blog run dev
 ```
 
-**`examples/marketing/`** — the framework's own marketing site: hero, comparison
-table, live latency measurement, FAQ, docs index, release notes and a download
-page. The byte counts on the page are read in `lib/payload.js` from the site's
-**own** build output, and the release info in `lib/release.js` from the
-installed package's `package.json`; the latency numbers are measured in the
-browser by the `latency` island. With a long TTL (one hour) and a prewarm that
-warms every page, it shows the profile in which the cache works most
-efficiently.
-
-It also serves **these documents**: `/docs/<chapter>` reads the markdown files
-in `node_modules/jskelet/docs/` and renders them with a sidebar, an "on this
-page" list and sequential navigation. The renderer is a small module in
-`lib/markdown.js` — no dependency — and the source of truth stays the package,
-so the site never drifts from the installed version.
-
-The site is also **bilingual**: English by default at the root, Turkish under
-`/tr`, with the same route names in both languages. There is no i18n in the
-framework; language resolution lives in `lib/i18n.js` as the application's own
-contract and is wired to a dictionary via `hooks.layoutContext`. This is the
-place to look if you want to see how to build a multilingual site with this
-surface.
-
-```bash
-npm --prefix examples/marketing install
-npm --prefix examples/marketing run dev
-```
-
-**`examples/dashboard/`** — the opposite axis from the other three: per-visitor
+**`examples/dashboard/`** — the opposite axis from the other two: per-visitor
 pages. Sign-in with a signed cookie session, a `private: true` protected panel,
 a paginated table fragment, a CSRF-protected mutation form and an island that
 returns a cleanup function. It also has a public landing page, so a cached
@@ -110,5 +83,5 @@ npm --prefix examples/dashboard install
 npm --prefix examples/dashboard run dev
 ```
 
-In all four examples, `node smoke.mjs` verifies that the endpoints respond as
+In all three examples, `node smoke.mjs` verifies that the endpoints respond as
 expected while the server is up.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jskelet",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "A framework that feels like no framework: Express 5 + build-time .jsk SSR (optional EJS peer), vanilla JS islands, Tailwind v4 and an in-process HTML TTL cache.",
   "type": "module",
   "license": "MIT",
@@ -135,4 +135,4 @@
     "globals": "^16",
     "typescript": "^7.0.2"
   }
-}
+}

package/src/config/defaults.js

@@ -106,18 +106,34 @@ export const DEFAULT_PREWARM_ON_VISIT = {
   /** Sayfa başına üstten alta en fazla kaç link kuyruğa alınır. */
   perPage: 20,
   /**
-   * Paralel işçi; `null` → klasik prewarm ile aynı varsayılan
-   * (prod 4 / dev 1) `startPrewarm` içinde çözülür.
+   * Paralel işçi. `null` yalnızca kapalı modda durur; açıkken tavan
+   * (`ON_VISIT_CONCURRENCY_CEILING`) uygulanır. Klasik prewarm'daki
+   * prod 4 burada geçerli değil — onVisit sürekli çalışır.
    * @type {number | null}
    */
   concurrency: null,
   /**
-   * Saniyedeki istek tavanı; `null` → klasik ile aynı (prod 0 / dev 4).
+   * Saniyedeki istek tavanı. `null` yalnızca kapalı modda durur; açıkken
+   * `0` (sınırsız) dahil her şey `ON_VISIT_RPS_CEILING` ile kesilir.
    * @type {number | null}
    */
   rps: null,
 };
 
+/**
+ * onVisit sürekli tur olduğu için klasik prewarm'daki "sınırsız" burada yok.
+ * Config daha yükseğini yazsa da çözümlenen değer bu tavanları geçemez.
+ */
+export const ON_VISIT_PER_PAGE_CEILING = 20;
+export const ON_VISIT_RPS_CEILING = 2;
+export const ON_VISIT_CONCURRENCY_CEILING = 2;
+
+/**
+ * Bekleyen onVisit yolları. Bir sayfa düzinelerce link basınca kuyruk
+ * birikmesin; taşan link bu turda alınmaz.
+ */
+export const ON_VISIT_QUEUE_MAX = 64;
+
 /** `onVisit` açıkken `cache().prewarm` kökünde yasak olan klasik alanlar. */
 export const CLASSIC_PREWARM_KEYS = [
   "enabled",
@@ -136,9 +152,26 @@ export const CLASSIC_PREWARM_KEYS = [
  * HTML önbelleğinin girdi sınırı. 500 girdi ortalama bir sayfa boyutunda
  * yaklaşık 100-200 MB tutar; uzun kuyruklu siteler bunu yükseltmek yerine
  * veri önbelleğine yaslanmalı (bkz. `DEFAULT_DATA_CACHE`).
+ *
+ * Config daha yükseğini istese de girdi sayısı `HTML_CACHE_MAX_ENTRIES_CEILING`
+ * değerini geçemez. Asıl bellek freni bayt bütçesidir: şişman sayfa ve
+ * `vary.host` kopyası sayı tavanının altında da RSS'i şişirir.
  */
 export const DEFAULT_HTML_CACHE_MAX_ENTRIES = 500;
 
+/** `cache().maxEntries` için sert tavan. Üstü uyarıyla bu değere çekilir. */
+export const HTML_CACHE_MAX_ENTRIES_CEILING = 800;
+
+/**
+ * Süreç içi HTML string + sıkıştırılmış gövde tavanı (256 MB).
+ * `install()` bunu uygular; config yükseltemez. Tek sayfa bütçeden büyükse
+ * saklanmaz, yanıt yine gider.
+ */
+export const HTML_CACHE_BYTE_BUDGET = 256 * 1024 * 1024;
+
+/** `cache().data.maxEntries` için sert tavan. Uzun kuyruk burada durur, HTML'de değil. */
+export const DATA_CACHE_MAX_ENTRIES_CEILING = 20_000;
+
 /**
  * `notFound()` geçici bir upstream hatasına denk geldiğinde sayfanın kaç kez
  * daha denenmesi gerektiği.