jskelet 0.6.10 → 0.6.11

package/CHANGELOG.md

@@ -16,8 +16,9 @@ one is listed under a **Breaking** heading.
   Production `jskelet build` PutObjects `public/assets/` (and optional
   `include` dirs) after precompress. Only credentials are read from env
   (`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, then
-  `JSKELET_S3_*`). The Assets upload step always appears on production builds;
-  when off it logs a one-line reason (`skipped (no build.assets.upload.bucket)`,
+  `JSKELET_S3_*`, then ECS task-role / EC2 instance-profile metadata). The
+  Assets upload step always appears on production builds; when off it logs a
+  one-line reason (`skipped (no build.assets.upload.bucket)`,
   `skipped (credentials missing)`, …). A URL in `upload.bucket` is rejected
   with a warning (CDN origin belongs in `prefix`). Watch mode never uploads.
   `.br` / `.gz` siblings are skipped.

package/docs/07-yapilandirma.md

@@ -638,13 +638,13 @@ değişmez** — asset'ler origin'den servis edilir.
 | `assets.upload.include` | `string[]` | `["assets"]` | `public/` altı dizinler (`assets`, isteğe `fonts`, …). |
 | `assets.upload.cacheControl` | `string` | `public, max-age=31536000, immutable` | PutObject `Cache-Control`. |
 
-**Yalnızca credential env'den gelir:** `AWS_ACCESS_KEY_ID` /
-`AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` (yoksa `JSKELET_S3_*`). Prefix,
-bucket, region vb. config'te yazılır. Production build'de Assets upload adımı
-her zaman görünür; kapalıysa `skipped (no build.assets.upload.bucket)` /
-`skipped (credentials missing)` gibi tek satır sebep basılır. Watch'ta adım
-yok. `.br` / `.gz` yüklenmez. Ayrıntı: [08-build.md](./08-build.md),
-[10-dagitim.md](./10-dagitim.md).
+**Credential config'e yazılmaz.** Zincir: `AWS_ACCESS_KEY_ID` /
+`AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` (yoksa `JSKELET_S3_*`) → ECS/Fargate
+task role (`AWS_CONTAINER_CREDENTIALS_*`) → EC2 instance profile (IMDSv2).
+Prefix, bucket, region vb. config'te yazılır. Task role varken env key şart
+değil. Production build'de Assets upload adımı her zaman görünür; kapalıysa
+`skipped (…)` ile sebep basılır. Watch'ta adım yok. `.br` / `.gz` yüklenmez.
+Ayrıntı: [08-build.md](./08-build.md), [10-dagitim.md](./10-dagitim.md).
 
 ```js
 build: {

package/docs/08-build.md

@@ -84,8 +84,8 @@ dosya adlarını okunur tutuyor. Hash'li olmaları sayesinde bu dosyalara
 
 ### CDN prefix ve S3 upload
 
-Varsayılan kapalıdır. Prefix / bucket / keyPrefix config'te; yalnızca
-credential env'den (`AWS_*`, yoksa `JSKELET_S3_*`). Açılınca:
+Varsayılan kapalıdır. Prefix / bucket / keyPrefix config'te; credential
+env → ECS task role → EC2 IMDS zincirinden. Açılınca:
 
 1. Production build `public/assets/` (ve `include` listesindeki diğer dizinler)
    altındaki dosyaları S3'e PutObject ile kopyalar.

package/docs/10-dagitim.md

@@ -72,9 +72,9 @@ build: {
 ```
 
 ```bash
+# CI / local: explicit keys. ECS/EC2'de task/instance role yeter — key şart değil.
 AWS_ACCESS_KEY_ID=…
 AWS_SECRET_ACCESS_KEY=…
-# geçici credential ise:
 # AWS_SESSION_TOKEN=…
 ```
 

package/docs/en/07-configuration.md

@@ -651,13 +651,14 @@ changes** — assets stay on the origin.
 | `assets.upload.include` | `string[]` | `["assets"]` | Directories under `public/` (`assets`, optionally `fonts`, …). |
 | `assets.upload.cacheControl` | `string` | `public, max-age=31536000, immutable` | PutObject `Cache-Control`. |
 
-**Only credentials come from the environment:** `AWS_ACCESS_KEY_ID` /
-`AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` (else `JSKELET_S3_*`). Prefix,
-bucket, region, etc. are written in the config. On a production build the Assets
-upload step always appears; when off it logs a one-line reason such as
-`skipped (no build.assets.upload.bucket)` or `skipped (credentials missing)`.
-No upload on watch passes. `.br` / `.gz` siblings are not uploaded. Details:
-[08-build.md](./08-build.md), [10-deployment.md](./10-deployment.md).
+**Credentials are not written in the config.** Chain: `AWS_ACCESS_KEY_ID` /
+`AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` (else `JSKELET_S3_*`) → ECS/Fargate
+task role (`AWS_CONTAINER_CREDENTIALS_*`) → EC2 instance profile (IMDSv2).
+Prefix, bucket, region, etc. live in the config. With a task role, env keys are
+not required. On a production build the Assets upload step always appears; when
+off it logs `skipped (…)`. No upload on watch passes. `.br` / `.gz` siblings are
+not uploaded. Details: [08-build.md](./08-build.md),
+[10-deployment.md](./10-deployment.md).
 
 ```js
 build: {

package/docs/en/08-build.md

@@ -87,8 +87,8 @@ They are passed to templates automatically; in server code,
 
 ### CDN prefix and S3 upload
 
-Off by default. Prefix / bucket / keyPrefix come from config; only credentials
-come from the environment (`AWS_*`, else `JSKELET_S3_*`). When enabled:
+Off by default. Prefix / bucket / keyPrefix come from config; credentials
+resolve from env → ECS task role → EC2 IMDS. When enabled:
 
 1. A production build PutObjects files under `public/assets/` (and any other
    directories in `include`) to S3.

package/docs/en/10-deployment.md

@@ -73,9 +73,9 @@ build: {
 ```
 
 ```bash
+# CI / local: explicit keys. On ECS/EC2 a task/instance role is enough — no keys required.
 AWS_ACCESS_KEY_ID=…
 AWS_SECRET_ACCESS_KEY=…
-# for temporary credentials:
 # AWS_SESSION_TOKEN=…
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jskelet",
-  "version": "0.6.10",
+  "version": "0.6.11",
   "description": "A framework that feels like no framework: Express 5 + build-time .jsk SSR (optional EJS peer), vanilla JS islands, Tailwind v4 and an in-process HTML TTL cache.",
   "type": "module",
   "license": "MIT",

package/src/build/tasks/assets-upload.mjs

@@ -1,16 +1,18 @@
 /**
  * Production build sonunda hash'li varlıkları S3'e PutObject ile kopyalar.
  *
- * Watch turunda çalışmaz (çağıran sorumlu). Credential env'den gelir
- * (`AWS_*` önce, `JSKELET_S3_*` yedek). Bucket / credential yoksa veya upload
- * kapalıysa adım yine görünür: `skipped (…)` ile sebep basılır, build düşmez.
+ * Watch turunda çalışmaz (çağıran sorumlu). Credential: env (`AWS_*` /
+ * `JSKELET_S3_*`) → ECS task role → EC2 instance profile. Bucket yoksa veya
+ * upload kapalıysa adım yine görünür: `skipped (…)` ile sebep basılır.
+ * Credential yalnızca env+metadata zinciri boşsa skip; task role varken
+ * env key şart değil.
  *
  * `.br` / `.gz` kardeşleri yüklenmez: edge kendi sıkıştırmasını yapsın;
  * origin precompress Express için kalır.
  */
 import fs from "node:fs";
 import path from "node:path";
-import { readS3CredentialsFromEnv } from "../../config/index.js";
+import { resolveS3Credentials } from "../../server/logs/s3-credentials.js";
 import { putObject } from "../../server/logs/s3-put.js";
 import * as log from "../../log.mjs";
 import { paths } from "../paths.mjs";
@@ -88,7 +90,7 @@ function resolveIncludeDir(name) {
 }
 
 /**
- * Upload yapılmayacaksa kısa sebep; yapılacaksa `null`.
+ * Config kapısı — credential burada bakılmaz (task role async).
  *
  * @param {import('../../config/index.js').ResolvedConfig} config
  * @returns {string | null}
@@ -105,14 +107,13 @@ export function assetsUploadSkipReason(config) {
 
   if (!upload.bucket) return "no build.assets.upload.bucket";
 
-  if (!readS3CredentialsFromEnv()) return "credentials missing";
-
   return null;
 }
 
 /**
  * @param {import('../../config/index.js').ResolvedConfig} config
- * @param {{ put?: typeof putObject }} [options]
+ * @param {{ put?: typeof putObject,
+ *   resolveCredentials?: typeof resolveS3Credentials }} [options]
  * @returns {Promise<void>}
  */
 export async function uploadAssets(config, options = {}) {
@@ -123,15 +124,17 @@ export async function uploadAssets(config, options = {}) {
   }
 
   const upload = config.build.assets.upload;
-  const credentials = readS3CredentialsFromEnv();
-  // skipReason null iken credential ve bucket vardır; TS/akış için daralt.
+  const resolve = options.resolveCredentials ?? resolveS3Credentials;
+  const credentials = await resolve();
   if (!upload.bucket || !credentials) {
     log.detail("skipped (credentials missing)");
     return;
   }
 
   const put = options.put ?? putObject;
-  const keyPrefix = (upload.keyPrefix || "").replace(/^\/+/, "");
+  // Normalize bazen atlanır (test / elle config); önek `/` ile bitsin.
+  let keyPrefix = (upload.keyPrefix || "").replace(/^\/+/, "");
+  if (keyPrefix && !keyPrefix.endsWith("/")) keyPrefix += "/";
 
   /** @type {{ file: string, key: string }[]} */
   const jobs = [];

package/src/config/index.js

@@ -33,6 +33,10 @@ import path from "node:path";
 import process from "node:process";
 import { pathToFileURL } from "node:url";
 import { compilePattern, matchPattern } from "./pattern.js";
+import {
+  readS3CredentialsFromEnv,
+  resolveS3Credentials,
+} from "../server/logs/s3-credentials.js";
 import {
   DEFAULT_ADMIN,
   DEFAULT_AUTH,
@@ -64,6 +68,8 @@ import {
   DEFAULT_UPSTREAM_LIMIT,
 } from "./defaults.js";
 
+export { readS3CredentialsFromEnv, resolveS3Credentials };
+
 /** Framework paketinin kökü — kendi şablonlarına ve varlıklarına erişir. */
 export const FRAMEWORK_ROOT = path.resolve(import.meta.dirname, "..", "..");
 
@@ -527,32 +533,6 @@ function envText(value) {
   return typeof value === "string" && value ? value : null;
 }
 
-/**
- * S3 imza credential'ları. AWS deploy'da standart env önce gelir; R2/MinIO
- * için `JSKELET_S3_*` yedek. IAM instance/task role (IMDS) desteklenmez —
- * CI'da `configure-aws-credentials` gibi araçlar zaten `AWS_*` basar.
- *
- * @returns {{ accessKeyId: string, secretAccessKey: string,
- *   sessionToken: string | null } | null}
- */
-export function readS3CredentialsFromEnv() {
-  const accessKeyId =
-    envText(process.env.AWS_ACCESS_KEY_ID) ??
-    envText(process.env.JSKELET_S3_ACCESS_KEY_ID);
-  const secretAccessKey =
-    envText(process.env.AWS_SECRET_ACCESS_KEY) ??
-    envText(process.env.JSKELET_S3_SECRET_ACCESS_KEY) ??
-    envText(process.env.JSKELET_S3_ACCESS_SECRET);
-  if (!accessKeyId || !secretAccessKey) return null;
-  return {
-    accessKeyId,
-    secretAccessKey,
-    sessionToken:
-      envText(process.env.AWS_SESSION_TOKEN) ??
-      envText(process.env.JSKELET_S3_SESSION_TOKEN),
-  };
-}
-
 /**
  * Log hedefi. Öncelik: `JSKELET_LOG_BUCKET` → `JSKELET_S3_BUCKET`
  * (+ isteğe bağlı `JSKELET_S3_KEY_PREFIX`).

package/src/server/logs/pipeline.js

@@ -6,9 +6,9 @@
  */
 import process from "node:process";
 import * as log from "../../log.mjs";
-import { readS3CredentialsFromEnv } from "../../config/index.js";
 import { createFileSink } from "./file-sink.js";
 import { createS3Sink } from "./s3-sink.js";
+import { resolveS3Credentials } from "./s3-credentials.js";
 
 /**
  * @typedef {import('../../config/index.js').LogsConfig} LogsConfig
@@ -73,14 +73,15 @@ export async function configureLogs(config) {
   }
 
   if (logs.s3.enabled) {
-    const credentials = readS3CredentialsFromEnv();
+    const credentials = await resolveS3Credentials();
     if (!logs.s3.bucket) {
       console.warn(
         "[logs] s3.enabled but no bucket (set JSKELET_LOG_BUCKET, JSKELET_S3_BUCKET or logs.s3.bucket)",
       );
     } else if (!credentials) {
       console.warn(
-        "[logs] s3.enabled but credentials missing — set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or JSKELET_S3_*",
+        "[logs] s3.enabled but credentials missing — set AWS_ACCESS_KEY_ID/" +
+          "AWS_SECRET_ACCESS_KEY or JSKELET_S3_*, or run with an ECS/EC2 IAM role",
       );
     } else {
       const region = logs.s3.region || "auto";

package/src/server/logs/s3-credentials.js

@@ -0,0 +1,195 @@
+/**
+ * S3 imza credential zinciri — SDK yok.
+ *
+ * 1. Env: `AWS_*` sonra `JSKELET_S3_*`
+ * 2. ECS/Fargate task role: `AWS_CONTAINER_CREDENTIALS_*`
+ * 3. EC2 instance profile: IMDSv2 (kısa timeout; local'de asılı kalmaz)
+ *
+ * EKS IRSA (`AWS_WEB_IDENTITY_TOKEN_FILE`) bilinçli olarak yok — STS çağrısı
+ * ayrı yüzey; CI genelde zaten `AWS_*` basar.
+ */
+import fs from "node:fs";
+import process from "node:process";
+
+/**
+ * @typedef {{ accessKeyId: string, secretAccessKey: string,
+ *   sessionToken: string | null }} AwsCredentials
+ */
+
+const METADATA_TIMEOUT_MS = 400;
+const ECS_METADATA_HOST = "http://169.254.170.2";
+const EC2_METADATA_HOST = "http://169.254.169.254";
+
+/**
+ * @param {unknown} value
+ * @returns {string | null}
+ */
+function envText(value) {
+  return typeof value === "string" && value ? value : null;
+}
+
+/**
+ * @returns {AwsCredentials | null}
+ */
+export function readS3CredentialsFromEnv() {
+  const accessKeyId =
+    envText(process.env.AWS_ACCESS_KEY_ID) ??
+    envText(process.env.JSKELET_S3_ACCESS_KEY_ID);
+  const secretAccessKey =
+    envText(process.env.AWS_SECRET_ACCESS_KEY) ??
+    envText(process.env.JSKELET_S3_SECRET_ACCESS_KEY) ??
+    envText(process.env.JSKELET_S3_ACCESS_SECRET);
+  if (!accessKeyId || !secretAccessKey) return null;
+  return {
+    accessKeyId,
+    secretAccessKey,
+    sessionToken:
+      envText(process.env.AWS_SESSION_TOKEN) ??
+      envText(process.env.JSKELET_S3_SESSION_TOKEN),
+  };
+}
+
+/**
+ * @param {Record<string, unknown>} data
+ * @returns {AwsCredentials | null}
+ */
+function fromAwsCredentialJson(data) {
+  const accessKeyId =
+    typeof data.AccessKeyId === "string" ? data.AccessKeyId : null;
+  const secretAccessKey =
+    typeof data.SecretAccessKey === "string" ? data.SecretAccessKey : null;
+  if (!accessKeyId || !secretAccessKey) return null;
+  const token =
+    (typeof data.Token === "string" && data.Token) ||
+    (typeof data.SessionToken === "string" && data.SessionToken) ||
+    null;
+  return { accessKeyId, secretAccessKey, sessionToken: token };
+}
+
+/**
+ * @param {string} url
+ * @param {RequestInit} [init]
+ * @param {number} [timeoutMs]
+ * @returns {Promise<unknown | null>}
+ */
+async function fetchJson(url, init = {}, timeoutMs = METADATA_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { ...init, signal: controller.signal });
+    if (!response.ok) return null;
+    return await response.json();
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * @param {string} url
+ * @param {RequestInit} [init]
+ * @param {number} [timeoutMs]
+ * @returns {Promise<string | null>}
+ */
+async function fetchText(url, init = {}, timeoutMs = METADATA_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { ...init, signal: controller.signal });
+    if (!response.ok) return null;
+    return (await response.text()).trim() || null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * ECS task role / container credential provider.
+ *
+ * @returns {Promise<AwsCredentials | null>}
+ */
+export async function readS3CredentialsFromEcs() {
+  const relative = envText(process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI);
+  const full = envText(process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI);
+  if (!relative && !full) return null;
+
+  const url = full ?? `${ECS_METADATA_HOST}${relative}`;
+
+  /** @type {Record<string, string>} */
+  const headers = {};
+  const token =
+    envText(process.env.AWS_CONTAINER_AUTHORIZATION_TOKEN) ??
+    readTokenFile(process.env.AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE);
+  if (token) headers.Authorization = token;
+
+  const data = await fetchJson(url, { headers });
+  if (!data || typeof data !== "object") return null;
+  return fromAwsCredentialJson(/** @type {Record<string, unknown>} */ (data));
+}
+
+/**
+ * @param {unknown} pathValue
+ * @returns {string | null}
+ */
+function readTokenFile(pathValue) {
+  const file = envText(pathValue);
+  if (!file) return null;
+  try {
+    const text = fs.readFileSync(file, "utf8").trim();
+    return text || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * EC2 instance profile via IMDSv2 (IMDSv1'e düşmez).
+ *
+ * @returns {Promise<AwsCredentials | null>}
+ */
+export async function readS3CredentialsFromImds() {
+  const token = await fetchText(
+    `${EC2_METADATA_HOST}/latest/api/token`,
+    {
+      method: "PUT",
+      headers: { "X-aws-ec2-metadata-token-ttl-seconds": "21600" },
+    },
+  );
+  if (!token) return null;
+
+  const headers = { "X-aws-ec2-metadata-token": token };
+  const roleName = await fetchText(
+    `${EC2_METADATA_HOST}/latest/meta-data/iam/security-credentials/`,
+    { headers },
+  );
+  if (!roleName) return null;
+
+  // Birden fazla satır olursa ilki.
+  const role = roleName.split("\n")[0]?.trim();
+  if (!role || role.includes("..") || role.includes("/")) return null;
+
+  const data = await fetchJson(
+    `${EC2_METADATA_HOST}/latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`,
+    { headers },
+  );
+  if (!data || typeof data !== "object") return null;
+  return fromAwsCredentialJson(/** @type {Record<string, unknown>} */ (data));
+}
+
+/**
+ * Env → ECS task role → EC2 instance profile.
+ *
+ * @returns {Promise<AwsCredentials | null>}
+ */
+export async function resolveS3Credentials() {
+  const fromEnv = readS3CredentialsFromEnv();
+  if (fromEnv) return fromEnv;
+
+  const fromEcs = await readS3CredentialsFromEcs();
+  if (fromEcs) return fromEcs;
+
+  return readS3CredentialsFromImds();
+}

package/src/server/logs/s3-put.js

@@ -2,9 +2,8 @@
  * Minimal S3 PutObject — yalnızca SigV4 + `fetch`.
  *
  * `@aws-sdk/client-s3` taşınmıyor: tek operasyon için SDK'nın maliyeti ve
- * peer yüzeyi gereksiz. Credential zinciri env'den okunur (`AWS_*` önce,
- * sonra `JSKELET_S3_*`); IAM role / instance metadata yok — CI'da
- * `configure-aws-credentials` gibi araçlar key basar.
+ * peer yüzeyi gereksiz. Credential `resolveS3Credentials` ile gelir
+ * (env → ECS task role → EC2 IMDS).
  */
 import crypto from "node:crypto";
 

package/types/config/index.d.ts

@@ -1,4 +1,6 @@
+import { readS3CredentialsFromEnv, resolveS3Credentials } from "../server/logs/s3-credentials.js";
 import { DEFAULT_ADMIN, DEFAULT_CLOUDFLARE, DEFAULT_UPSTREAM_LIMIT } from "./defaults.js";
+export { readS3CredentialsFromEnv, resolveS3Credentials };
 /** Framework paketinin kökü — kendi şablonlarına ve varlıklarına erişir. */
 export declare const FRAMEWORK_ROOT: string;
 export type Eagerness = "conservative" | "moderate" | "eager";
@@ -278,19 +280,6 @@ export declare function splitS3BucketPath(value: string | null): {
     bucket: string | null;
     prefix: string | null;
 };
-/**
- * S3 imza credential'ları. AWS deploy'da standart env önce gelir; R2/MinIO
- * için `JSKELET_S3_*` yedek. IAM instance/task role (IMDS) desteklenmez —
- * CI'da `configure-aws-credentials` gibi araçlar zaten `AWS_*` basar.
- *
- * @returns {{ accessKeyId: string, secretAccessKey: string,
- *   sessionToken: string | null } | null}
- */
-export declare function readS3CredentialsFromEnv(): {
-    accessKeyId: string;
-    secretAccessKey: string;
-    sessionToken: string | null;
-} | null;
 /**
  * Kalıcı log sink'leri. Bozuk bir `kinds` listesi siteyi düşürmemeli —
  * bilinmeyen girdiler atılır; hiç geçerli tür kalmazsa varsayılana dönülür.

package/types/server/logs/s3-credentials.d.ts

@@ -0,0 +1,27 @@
+export type AwsCredentials = {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string | null;
+};
+/**
+ * @returns {AwsCredentials | null}
+ */
+export declare function readS3CredentialsFromEnv(): AwsCredentials | null;
+/**
+ * ECS task role / container credential provider.
+ *
+ * @returns {Promise<AwsCredentials | null>}
+ */
+export declare function readS3CredentialsFromEcs(): Promise<AwsCredentials | null>;
+/**
+ * EC2 instance profile via IMDSv2 (IMDSv1'e düşmez).
+ *
+ * @returns {Promise<AwsCredentials | null>}
+ */
+export declare function readS3CredentialsFromImds(): Promise<AwsCredentials | null>;
+/**
+ * Env → ECS task role → EC2 instance profile.
+ *
+ * @returns {Promise<AwsCredentials | null>}
+ */
+export declare function resolveS3Credentials(): Promise<AwsCredentials | null>;