jskelet 0.6.14 → 0.6.16

package/CHANGELOG.md

@@ -17,6 +17,16 @@ one is listed under a **Breaking** heading.
 
 ### Added
 
+- When `build.assets.prefix` is set, the CSS build rewrites root-absolute
+  `url()` paths under `static.prefixes` (e.g. `/fonts/…`) to the CDN
+  prefix so they match the S3 key (`…/js/fonts/…`). Default upload
+  `include` is `["assets", "fonts"]`; prefix also forces `fonts` into
+  `include`. Font uploads run PutBucketCors with
+  `upload.corsOrigin` (default `"*"`, set `null` to skip).
+- `asset(name, { origin: "document" })` skips `build.assets.prefix` and
+  returns the site-origin `/assets/…` path. `icon()` always resolves the
+  sprite this way so SVG `<use href>` keeps working when other assets are
+  on a CDN (the origin still serves `public/assets/`).
 - Dev overlay **API** tab (between Performance and Server): outbound
   `fetch` calls for the current page — browser and SSR — with host
   rollup, duration, status, and a detail pane on click (component,

package/docs/07-yapilandirma.md

@@ -629,13 +629,14 @@ değişmez** — asset'ler origin'den servis edilir.
 
 | Alan | Tip | Varsayılan | Anlamı |
 | --- | --- | --- | --- |
-| `assets.prefix` | `string` | `""` | CDN origin; `asset()` URL öneki (sonunda `/` yok). Yalnızca config. Manifest diskte göreli kalır. |
+| `assets.prefix` | `string` | `""` | CDN origin; `asset()` URL öneki (sonunda `/` yok). Yalnızca config. Manifest diskte göreli kalır. `asset(name, { origin: "document" })` ve `icon()` sprite'ı öneksiz kalır. |
 | `assets.upload.enabled` | `boolean` | `false` | `true` veya config'te `bucket` doluysa açılır; açık `false` ezer. |
 | `assets.upload.bucket` | `string \| null` | `null` | **S3 bucket adı** (`static.ornek.com` gibi noktalı adlar geçerli; PutObject path-style kullanır) veya `bucket/key/prefix`. `https://…` şeması kabul edilmez — o `prefix`. |
 | `assets.upload.keyPrefix` | `string` | `""` | Nesne anahtarı öneki; bucket yolunda verilmişse o kazanır (`prefix` takma adı da kabul). |
 | `assets.upload.region` | `string` | `us-east-1` | Config; custom `endpoint` varken varsayılan `auto`. |
 | `assets.upload.endpoint` | `string \| null` | `null` | S3-uyumlu API (R2 / MinIO); config. |
-| `assets.upload.include` | `string[]` | `["assets"]` | `public/` altı dizinler (`assets`, isteğe `fonts`, …). |
+| `assets.upload.include` | `string[]` | `["assets", "fonts"]` | `public/` altı dizinler. `assets.prefix` doluysa `fonts` yoksa eklenir. |
+| `assets.upload.corsOrigin` | `string \| null` | `"*"` | Font upload'ta PutBucketCors `AllowedOrigin`; `null` kapatır (önceki CORS'un üzerine yazar). |
 | `assets.upload.cacheControl` | `string` | `public, max-age=31536000, immutable` | PutObject `Cache-Control`. |
 
 **Credential config'e yazılmaz.** Zincir: `AWS_ACCESS_KEY_ID` /

package/docs/08-build.md

@@ -80,6 +80,10 @@ dosya adlarını okunur tutuyor. Hash'li olmaları sayesinde bu dosyalara
 - `asset(name)` manifest'te varsa hash'li URL'i, yoksa `/assets/<name>` döner.
   `build.assets.prefix` doluysa bu göreli yolun önüne CDN origin eklenir
   (manifest diskte göreli kalır).
+- `asset(name, { origin: "document" })` prefix'i atlar; site origin'indeki
+  `/assets/…` yolunu döner. SVG `<use href>` çapraz origin sprite
+  yüklemediği için `icon()` sprite'ı her zaman böyle çözer — origin hâlâ
+  `public/assets/` servis eder.
 - `hasAsset(name)` manifest'te olup olmadığını söyler.
 
 ### CDN prefix ve S3 upload
@@ -87,11 +91,21 @@ dosya adlarını okunur tutuyor. Hash'li olmaları sayesinde bu dosyalara
 Varsayılan kapalıdır. Prefix / bucket / keyPrefix config'te; credential
 env → ECS task role → EC2 IMDS zincirinden. Açılınca:
 
-1. Production build `public/assets/` (ve `include` listesindeki diğer dizinler)
-   altındaki dosyaları S3'e PutObject ile kopyalar.
-2. Çalışma anında `asset()` / optimize görseller `build.assets.prefix` ile
-   absolute CDN URL basar. Entry CDN'deyse esbuild chunk'ları göreli yolla aynı
-   host'a gider.
+1. Production build `public/assets/` ve `public/fonts/` (varsayılan `include`)
+   altındaki dosyaları S3'e PutObject ile kopyalar. `assets.prefix` doluysa
+   `include`'da `fonts` yoksa otomatik eklenir.
+2. CSS derlemesi `static.prefixes` kök-mutlak `url()` yollarını
+   (`/fonts/…`, `/assets/…`) `prefix` ile yeniden yazar — aksi hâlde CDN'deki
+   stylesheet `url("/fonts/x")` yolunu host köküne çözer ve `keyPrefix`
+   kaybolur. `@font-face` CDN CSS içinde kalabilir; font ile CSS aynı host'ta
+   olduğu için ek CORS gerekmez.
+3. Font yüklendiğinde ve `upload.corsOrigin` doluysa (varsayılan `"*"`)
+   PutBucketCors bir GET/HEAD kuralı yazar — bucket'taki önceki CORS'un
+   **üzerine** yazar; kapatmak için `corsOrigin: null`. HTML'den çapraz
+   origin font için bu (veya CloudFront response header) gerekir.
+4. Çalışma anında `asset()` / optimize görseller `build.assets.prefix` ile
+   absolute CDN URL basar. `icon()` sprite'ı ve
+   `asset(name, { origin: "document" })` site origin'inde kalır.
 
 Bucket adı noktalı olabilir (`static.ornek.com`); `https://…` şeması
 `prefix`'e yazılır. Config sözlüğü: [07-yapilandirma.md](./07-yapilandirma.md#build).
@@ -292,6 +306,10 @@ Kullanımı stylesheet'te elle yazılır:
 `.woff2` uzantısı ve `/fonts/` öneki varsayılan `static` kurallarında olduğu için
 bu dosyalara otomatik olarak `immutable` cache yazılır.
 
+`build.assets.prefix` açıksa build, CSS'teki `url("/fonts/…")` yollarını CDN
+prefix'iyle yeniden yazar ve fontları S3'e de basar — layout'ta ayrı
+`@font-face` tutmaya gerek kalmaz.
+
 ## İkon sprite
 
 **Yalnızca kaynakta kullanılan** ikonlar için bir `<symbol>` seti üretir. Tüm
@@ -457,7 +475,9 @@ karşılaşmaması.
 - **Bazı Tailwind sınıfları çalışmıyor.** `@source` direktifi eksik olan bir
   dizinde yazılmışlar.
 - **İkon boş görünüyor.** Sprite'ta o sembol yok; dev'de `[icon] missing from sprite`
-  uyarısına bakın.
+  uyarısına bakın. CDN prefix açıkken sprite bilerek site origin'inde kalır
+  (`asset("sprite.svg", { origin: "document" })`); origin `public/assets/`
+  servis etmiyorsa `<use>` boş kalır.
 - **Island'lar hiç açılmıyor.** `main.js` manifest'te yok (entry dizini boş ya
   da build atlanmış) veya bir build hatası var.
 - **Dev'de sayfa aniden stilsiz kaldı.** Manifest ile diskteki dosya

package/docs/en/07-configuration.md

@@ -642,13 +642,14 @@ changes** — assets stay on the origin.
 
 | Field | Type | Default | Meaning |
 | --- | --- | --- | --- |
-| `assets.prefix` | `string` | `""` | CDN origin; prefix for `asset()` URLs (no trailing `/`). Config only. The on-disk manifest stays relative. |
+| `assets.prefix` | `string` | `""` | CDN origin; prefix for `asset()` URLs (no trailing `/`). Config only. The on-disk manifest stays relative. `asset(name, { origin: "document" })` and the `icon()` sprite stay unprefixed. |
 | `assets.upload.enabled` | `boolean` | `false` | Turns on when `true` or when `bucket` is set in config; explicit `false` wins. |
 | `assets.upload.bucket` | `string \| null` | `null` | **S3 bucket name** (dotted names like `static.example.com` are fine; PutObject uses path-style) or `bucket/key/prefix`. A `https://…` scheme is rejected — that belongs in `prefix`. |
 | `assets.upload.keyPrefix` | `string` | `""` | Object key prefix; a path on the bucket wins (`prefix` is accepted as an alias). |
 | `assets.upload.region` | `string` | `us-east-1` | Config; defaults to `auto` when `endpoint` is set. |
 | `assets.upload.endpoint` | `string \| null` | `null` | S3-compatible API (R2 / MinIO); config. |
-| `assets.upload.include` | `string[]` | `["assets"]` | Directories under `public/` (`assets`, optionally `fonts`, …). |
+| `assets.upload.include` | `string[]` | `["assets", "fonts"]` | Directories under `public/`. When `assets.prefix` is set, `fonts` is added if missing. |
+| `assets.upload.corsOrigin` | `string \| null` | `"*"` | PutBucketCors `AllowedOrigin` when fonts upload; `null` disables (replaces prior bucket CORS). |
 | `assets.upload.cacheControl` | `string` | `public, max-age=31536000, immutable` | PutObject `Cache-Control`. |
 
 **Credentials are not written in the config.** Chain: `AWS_ACCESS_KEY_ID` /

package/docs/en/08-build.md

@@ -83,6 +83,10 @@ They are passed to templates automatically; in server code,
 - `asset(name)` returns the hashed URL if it is in the manifest, otherwise
   `/assets/<name>`. When `build.assets.prefix` is set, that relative path is
   prefixed with the CDN origin (the on-disk manifest stays relative).
+- `asset(name, { origin: "document" })` skips the prefix and returns the
+  site-origin `/assets/…` path. SVG `<use href>` cannot load a cross-origin
+  sprite, so `icon()` always resolves the sprite this way — the origin still
+  serves `public/assets/`.
 - `hasAsset(name)` tells you whether it is in the manifest.
 
 ### CDN prefix and S3 upload
@@ -90,11 +94,21 @@ They are passed to templates automatically; in server code,
 Off by default. Prefix / bucket / keyPrefix come from config; credentials
 resolve from env → ECS task role → EC2 IMDS. When enabled:
 
-1. A production build PutObjects files under `public/assets/` (and any other
-   directories in `include`) to S3.
-2. At runtime `asset()` / optimised images emit absolute CDN URLs via
-   `build.assets.prefix`. When the entry script is on the CDN, esbuild chunks
-   resolve relatively on the same host.
+1. A production build PutObjects `public/assets/` and `public/fonts/`
+   (default `include`) to S3. When `assets.prefix` is set, `fonts` is added
+   to `include` if missing.
+2. The CSS step rewrites root-absolute `url()` paths under `static.prefixes`
+   (`/fonts/…`, `/assets/…`) with `prefix` — otherwise a stylesheet on the CDN
+   resolves `url("/fonts/x")` against the host root and drops `keyPrefix`.
+   `@font-face` can stay in the CDN CSS; font and CSS share a host, so no
+   extra CORS is needed for that path.
+3. When fonts are uploaded and `upload.corsOrigin` is set (default `"*"`),
+   PutBucketCors writes a GET/HEAD rule — it **replaces** the bucket's
+   previous CORS config; set `corsOrigin: null` to skip. Cross-origin fonts
+   from HTML still need this (or a CloudFront response-header policy).
+4. At runtime `asset()` / optimised images emit absolute CDN URLs via
+   `build.assets.prefix`. The `icon()` sprite and
+   `asset(name, { origin: "document" })` stay on the document origin.
 
 Bucket names may include dots (`static.example.com`); put `https://…` in
 `prefix`. Config reference: [07-configuration.md](./07-configuration.md#build).
@@ -300,6 +314,10 @@ Usage is written by hand in the stylesheet:
 Because the `.woff2` extension and the `/fonts/` prefix are in the default
 `static` rules, these files automatically get an `immutable` cache.
 
+When `build.assets.prefix` is set, the build rewrites `url("/fonts/…")` in CSS
+to the CDN prefix and uploads the font files too — you do not need a separate
+`@font-face` block in the layout.
+
 ## Icon sprite
 
 Produces a `<symbol>` set for **only the icons actually used in the source**.
@@ -473,7 +491,9 @@ directly does not end up facing an unstyled page.
 - **Some Tailwind classes do not work.** They were written in a directory whose
   `@source` directive is missing.
 - **An icon looks empty.** That symbol is not in the sprite; in dev, look for the
-  `[icon] missing from sprite` warning.
+  `[icon] missing from sprite` warning. With a CDN prefix the sprite stays on
+  the document origin on purpose (`asset("sprite.svg", { origin: "document" })`);
+  if the origin does not serve `public/assets/`, `<use>` stays blank.
 - **The islands never open.** `main.js` is not in the manifest (the entry
   directory is empty or the build was skipped) or there is a build error.
 - **The page suddenly went unstyled in dev.** The manifest and the file on disk

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jskelet",
-  "version": "0.6.14",
+  "version": "0.6.16",
   "description": "A framework that feels like no framework: Express 5 + build-time .jsk SSR (optional EJS peer), vanilla JS islands, Tailwind v4 and an in-process HTML TTL cache.",
   "type": "module",
   "license": "MIT",

package/src/build/rewrite-css-urls.mjs

@@ -0,0 +1,40 @@
+/**
+ * CDN prefix varken CSS `url(/fonts/…)` yollarını upload path'iyle hizalar.
+ *
+ * CDN'deki `app.css` kök-mutlak `/fonts/x.woff2` görünce tarayıcı bunu
+ * `https://cdn.example.com/fonts/x` diye çözer — `keyPrefix` (`/js` vb.)
+ * kaybolur ve 403 gelir. Prefix + aynı göreli yol (`…/js/fonts/x`) doğru
+ * nesneye gider; font ile CSS aynı host'ta olduğu için `@font-face` CORS
+ * istemez. HTML'den CDN font yüklemek ayrı: bucket/CloudFront CORS gerekir.
+ */
+import { applyAssetPrefix } from "../server/assets.js";
+
+/**
+ * @param {string} css
+ * @param {{ prefix: string, prefixes?: string[] }} options
+ * @returns {string}
+ */
+export function rewriteCssStaticUrls(css, { prefix, prefixes = [] }) {
+  if (!prefix || !css) return css;
+
+  const roots = [...prefixes]
+    .filter((entry) => typeof entry === "string" && entry.startsWith("/"))
+    .map((entry) => (entry.endsWith("/") ? entry : `${entry}/`))
+    .sort((a, b) => b.length - a.length);
+
+  if (!roots.length) return css;
+
+  return css.replace(
+    /url\(\s*(['"]?)(\/[^)"'\s]+)\1\s*\)/gi,
+    (match, quote, urlPath) => {
+      const pathOnly = urlPath.split(/[?#]/, 1)[0];
+      if (!roots.some((root) => pathOnly === root.slice(0, -1) || pathOnly.startsWith(root))) {
+        return match;
+      }
+
+      const rewritten = applyAssetPrefix(prefix, urlPath);
+      const q = quote || '"';
+      return `url(${q}${rewritten}${q})`;
+    },
+  );
+}

package/src/build/tasks/assets-upload.mjs

@@ -16,12 +16,22 @@ import {
   resolveS3Credentials,
   s3CredentialsMissingReason,
 } from "../../server/logs/s3-credentials.js";
-import { putObject } from "../../server/logs/s3-put.js";
+import { putBucketCors, putObject } from "../../server/logs/s3-put.js";
 import * as log from "../../log.mjs";
 import { paths } from "../paths.mjs";
 
 const CONCURRENCY = 8;
 
+/** Font MIME — CDN'den HTML çapraz origin yüklerken CORS gerekir. */
+const FONT_MIME = new Set([
+  "font/woff",
+  "font/woff2",
+  "font/ttf",
+  "font/otf",
+  "application/font-woff",
+  "application/font-woff2",
+]);
+
 /** @type {Record<string, string>} */
 const MIME = {
   ".js": "application/javascript; charset=utf-8",
@@ -116,6 +126,7 @@ export function assetsUploadSkipReason(config) {
 /**
  * @param {import('../../config/index.js').ResolvedConfig} config
  * @param {{ put?: typeof putObject,
+ *   putCors?: typeof putBucketCors,
  *   resolveCredentials?: typeof resolveS3Credentials }} [options]
  * @returns {Promise<void>}
  */
@@ -135,6 +146,7 @@ export async function uploadAssets(config, options = {}) {
   }
 
   const put = options.put ?? putObject;
+  const putCors = options.putCors ?? putBucketCors;
   // Normalize bazen atlanır (test / elle config); önek `/` ile bitsin.
   let keyPrefix = (upload.keyPrefix || "").replace(/^\/+/, "");
   if (keyPrefix && !keyPrefix.endsWith("/")) keyPrefix += "/";
@@ -162,6 +174,27 @@ export async function uploadAssets(config, options = {}) {
     return;
   }
 
+  const uploadsFonts = jobs.some((job) =>
+    FONT_MIME.has(contentTypeFor(job.file)),
+  );
+  if (uploadsFonts && upload.corsOrigin) {
+    try {
+      await putCors({
+        bucket: upload.bucket,
+        region: upload.region,
+        endpoint: upload.endpoint,
+        credentials,
+        allowedOrigin: upload.corsOrigin,
+      });
+      log.detail(`cors ${upload.corsOrigin}`);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(
+        `[assets] PutBucketCors failed (${message}) — set CDN/bucket CORS manually for cross-origin fonts`,
+      );
+    }
+  }
+
   let uploaded = 0;
   let index = 0;
 

package/src/build/tasks/css.mjs

@@ -24,6 +24,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { paths, writeAsset, writeManifest } from "../paths.mjs";
+import { rewriteCssStaticUrls } from "../rewrite-css-urls.mjs";
 import { importFromApp, tryImportFromApp } from "../resolve-peer.mjs";
 import * as log from "../../log.mjs";
 
@@ -85,6 +86,23 @@ function listPageStyles(dir) {
     .map((name) => path.join(dir, name));
 }
 
+/**
+ * `build.assets.prefix` doluysa `static.prefixes` kök-mutlak `url()` yollarını
+ * CDN'e çevirir (`/fonts/…` → `https://cdn…/js/fonts/…`).
+ *
+ * @param {string} css
+ * @param {import('../../config/index.js').ResolvedConfig} config
+ * @returns {string}
+ */
+function applyCdnStaticUrls(css, config) {
+  const prefix = config.build?.assets?.prefix ?? "";
+  if (!prefix) return css;
+  return rewriteCssStaticUrls(css, {
+    prefix,
+    prefixes: config.static?.prefixes ?? ["/assets/", "/fonts/"],
+  });
+}
+
 /**
  * @param {import('../../config/index.js').ResolvedConfig} config
  * @param {{ watch?: boolean }} [options]
@@ -101,7 +119,7 @@ export async function buildCss(config, { watch = false } = {}) {
     const urls = {};
     let bytes = 0;
 
-    const appCss = await compile(input);
+    const appCss = applyCdnStaticUrls(await compile(input), config);
     const appUrl = writeAsset("app.css", appCss);
     urls["app.css"] = appUrl;
     bytes += Buffer.byteLength(appCss);
@@ -111,7 +129,7 @@ export async function buildCss(config, { watch = false } = {}) {
 
     for (const file of listPageStyles(pagesDir)) {
       const name = path.basename(file);
-      const css = await compile(file);
+      const css = applyCdnStaticUrls(await compile(file), config);
       const url = writeAsset(name, css);
       urls[name] = url;
       bytes += Buffer.byteLength(css);

package/src/config/defaults.js

@@ -508,9 +508,19 @@ export const DEFAULT_BUILD = {
       keyPrefix: "",
       region: "us-east-1",
       endpoint: null,
-      /** `public/` altı dizin adları. */
-      include: /** @type {string[]} */ (["assets"]),
+      /**
+       * `public/` altı dizin adları. `fonts` varsayılan: CDN CSS'teki
+       * `/fonts/…` rewrite'ı upload nesnesiyle hizalansın.
+       */
+      include: /** @type {string[]} */ (["assets", "fonts"]),
       cacheControl: "public, max-age=31536000, immutable",
+      /**
+       * Upload sırasında PutBucketCors ile yazılan `AllowedOrigin`.
+       * `null` / `false` → CORS adımı atlanır. Bucket'taki önceki CORS
+       * kuralının üzerine yazar — paylaşımlı kovada bilinçli açın.
+       * CDN CSS + aynı host font için genelde gerekmez.
+       */
+      corsOrigin: /** @type {string | null} */ ("*"),
     },
   },
 };

package/src/config/index.js

@@ -184,6 +184,7 @@ const CONFIG_FILE = "jskelet.config.mjs";
  * @property {string | null} endpoint
  * @property {string[]} include
  * @property {string} cacheControl
+ * @property {string | null} corsOrigin Font/CDN PutBucketCors `AllowedOrigin`; `null` kapatır.
  *
  * @typedef {object} BuildAssetsConfig
  * @property {string} prefix CDN origin (`build.assets.prefix`); sonunda `/` yok.
@@ -1264,11 +1265,25 @@ export function normalizeBuildAssets(raw) {
     }
   }
 
+  // CDN CSS `/fonts/…` → prefix'li URL yazar; fontlar upload'ta yoksa 403.
+  // Kullanıcı `include: ["assets"]` yazsa bile prefix varken `fonts` eklenir.
+  if (prefix && !include.includes("fonts")) {
+    include = [...include, "fonts"];
+  }
+
   const cacheControl =
     typeof uploadRaw.cacheControl === "string" && uploadRaw.cacheControl.trim()
       ? uploadRaw.cacheControl.trim()
       : DEFAULT_BUILD.assets.upload.cacheControl;
 
+  /** @type {string | null} */
+  let corsOrigin = DEFAULT_BUILD.assets.upload.corsOrigin;
+  if (uploadRaw.corsOrigin === null || uploadRaw.corsOrigin === false) {
+    corsOrigin = null;
+  } else if (typeof uploadRaw.corsOrigin === "string") {
+    corsOrigin = uploadRaw.corsOrigin.trim() || null;
+  }
+
   // Config'te bucket varsa `enabled` unutulmuş olsa bile aç. Açık `false` ezer.
   const enabled =
     uploadRaw.enabled === true ||
@@ -1284,6 +1299,7 @@ export function normalizeBuildAssets(raw) {
       endpoint,
       include,
       cacheControl,
+      corsOrigin,
     },
   };
 }

package/src/server/assets.js

@@ -9,6 +9,11 @@
  * `build.assets.prefix` doluysa HTML'e basılan URL'lere CDN origin eklenir;
  * manifest diskte göreli kalır. Dosya sistemi okumaları (`getSpriteIds`)
  * göreli yolu kullanır.
+ *
+ * Bazı varlıklar bilinçli olarak site origin'inde kalır: SVG `<use href>`
+ * çapraz origin sprite yüklemez. `asset(name, { origin: "document" })`
+ * prefix'i atlar; `icon()` sprite için bunu kullanır. Origin hâlâ
+ * `public/assets/` servis eder.
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -17,7 +22,7 @@ import { getConfig } from "../config/index.js";
 
 const isDev = process.env.NODE_ENV === "development";
 
-/** @type {{ manifest: Record<string, string> } | null} */
+/** @type {{ manifest: Record<string, string>, generated: string } | null} */
 let cached = null;
 let warned = false;
 
@@ -38,13 +43,15 @@ function load() {
     }
   }
 
-  return { manifest };
+  return { manifest, generated };
 }
 
 function state() {
   // Dev'de her istekte yeniden okunur (watch build hash'leri değiştirir);
-  // prod'da bir kez.
-  if (isDev || !cached) cached = load();
+  // prod'da bir kez. `generated` yolu değiştiyse (test / başka kök) de
+  // yenilenir — aksi hâlde eski manifest takılı kalır.
+  const generated = getConfig().dirs.generated;
+  if (isDev || !cached || cached.generated !== generated) cached = load();
   return cached;
 }
 
@@ -82,11 +89,22 @@ function assetPath(name) {
 }
 
 /**
+ * @typedef {{ origin?: "cdn" | "document" }} AssetOptions
+ */
+
+/**
+ * Manifest'teki hash'li (veya yedek) URL.
+ *
  * @param {string} name Örn. "app.css", "main.js", "sprite.svg"
+ * @param {AssetOptions} [options]
+ *   `origin: "document"` → `build.assets.prefix` uygulanmaz; site
+ *   origin'indeki `/assets/…` yolu döner (varsayılan `"cdn"`).
  * @returns {string}
  */
-export function asset(name) {
-  return applyAssetPrefix(assetPrefix(), assetPath(name));
+export function asset(name, options = {}) {
+  const relative = assetPath(name);
+  if (options.origin === "document") return relative;
+  return applyAssetPrefix(assetPrefix(), relative);
 }
 
 /**

package/src/server/logs/s3-put.js

@@ -14,6 +14,9 @@ import crypto from "node:crypto";
  * @typedef {{ bucket: string, key: string, body: string | Buffer,
  *   region: string, endpoint?: string | null, credentials: AwsCredentials,
  *   contentType?: string, cacheControl?: string | null, now?: Date }} PutObjectInput
+ *
+ * @typedef {{ bucket: string, region: string, endpoint?: string | null,
+ *   credentials: AwsCredentials, allowedOrigin: string, now?: Date }} PutBucketCorsInput
  */
 
 /**
@@ -131,6 +134,24 @@ export function useS3PathStyle(bucket, endpoint) {
   return bucket.includes(".");
 }
 
+/**
+ * @param {{ bucket: string, region: string, endpoint?: string | null }} input
+ * @returns {{ host: string, base: string, pathStyle: boolean }}
+ */
+function s3EndpointParts(input) {
+  const pathStyle = useS3PathStyle(input.bucket, input.endpoint);
+  if (input.endpoint) {
+    const base = String(input.endpoint).replace(/\/+$/, "");
+    return { host: new URL(input.endpoint).host, base, pathStyle: true };
+  }
+  if (pathStyle) {
+    const host = `s3.${input.region}.amazonaws.com`;
+    return { host, base: `https://${host}`, pathStyle: true };
+  }
+  const host = `${input.bucket}.s3.${input.region}.amazonaws.com`;
+  return { host, base: `https://${host}`, pathStyle: false };
+}
+
 /**
  * PutObject isteğini imzalar; ağ çağrısı yapmaz — test edilebilir olsun diye.
  *
@@ -145,22 +166,7 @@ export function buildSignedPutObject(input) {
   const payloadHash = sha256Hex(body);
 
   const keyPath = encodeS3Path(input.key.replace(/^\/+/, ""));
-  const pathStyle = useS3PathStyle(input.bucket, input.endpoint);
-
-  /** @type {string} */
-  let host;
-  /** @type {string} */
-  let base;
-  if (input.endpoint) {
-    base = String(input.endpoint).replace(/\/+$/, "");
-    host = new URL(input.endpoint).host;
-  } else if (pathStyle) {
-    host = `s3.${input.region}.amazonaws.com`;
-    base = `https://${host}`;
-  } else {
-    host = `${input.bucket}.s3.${input.region}.amazonaws.com`;
-    base = `https://${host}`;
-  }
+  const { host, base, pathStyle } = s3EndpointParts(input);
 
   const canonicalUri = pathStyle
     ? `/${encodeS3Path(input.bucket)}/${keyPath}`
@@ -219,6 +225,132 @@ export function buildSignedPutObject(input) {
   return { url, headers, body };
 }
 
+/**
+ * PutBucketCors gövdesi — tek kural, GET/HEAD.
+ *
+ * @param {string} allowedOrigin
+ * @returns {string}
+ */
+export function corsConfigurationXml(allowedOrigin) {
+  const origin = String(allowedOrigin)
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+
+  return (
+    `<?xml version="1.0" encoding="UTF-8"?>` +
+    `<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">` +
+    `<CORSRule>` +
+    `<AllowedOrigin>${origin}</AllowedOrigin>` +
+    `<AllowedMethod>GET</AllowedMethod>` +
+    `<AllowedMethod>HEAD</AllowedMethod>` +
+    `<AllowedHeader>*</AllowedHeader>` +
+    `<ExposeHeader>ETag</ExposeHeader>` +
+    `<ExposeHeader>Content-Type</ExposeHeader>` +
+    `<MaxAgeSeconds>86400</MaxAgeSeconds>` +
+    `</CORSRule>` +
+    `</CORSConfiguration>`
+  );
+}
+
+/**
+ * PutBucketCors isteğini imzalar (`PUT /?cors` veya path-style `/bucket?cors`).
+ *
+ * @param {PutBucketCorsInput} input
+ * @returns {{ url: string, headers: Record<string, string>, body: Buffer }}
+ */
+export function buildSignedPutBucketCors(input) {
+  const body = Buffer.from(corsConfigurationXml(input.allowedOrigin), "utf8");
+  const now = input.now ?? new Date();
+  const { amzDate, dateStamp } = formatAmzDates(now);
+  const payloadHash = sha256Hex(body);
+  const { host, base, pathStyle } = s3EndpointParts(input);
+
+  // AWS: cors alt kaynağının canonical query'si `cors=` (boş değer).
+  const canonicalQuerystring = "cors=";
+  const canonicalUri = pathStyle ? `/${encodeS3Path(input.bucket)}` : "/";
+
+  /** @type {Record<string, string>} */
+  const headers = {
+    host,
+    "content-type": "application/xml",
+    "content-length": String(body.length),
+    "x-amz-content-sha256": payloadHash,
+    "x-amz-date": amzDate,
+  };
+
+  if (input.credentials.sessionToken) {
+    headers["x-amz-security-token"] = input.credentials.sessionToken;
+  }
+
+  const { canonicalRequest, signedHeaders } = buildCanonicalRequest({
+    method: "PUT",
+    canonicalUri,
+    canonicalQuerystring,
+    headers,
+    payloadHash,
+  });
+
+  const stringToSign = buildStringToSign({
+    amzDate,
+    dateStamp,
+    region: input.region,
+    service: "s3",
+    canonicalRequest,
+  });
+
+  const signingKey = deriveSigningKey(
+    input.credentials.secretAccessKey,
+    dateStamp,
+    input.region,
+    "s3",
+  );
+  const signature = hmac("sha256", signingKey, stringToSign).toString("hex");
+  const credentialScope = `${dateStamp}/${input.region}/s3/aws4_request`;
+
+  headers.authorization =
+    `AWS4-HMAC-SHA256 Credential=${input.credentials.accessKeyId}/${credentialScope}, ` +
+    `SignedHeaders=${signedHeaders}, Signature=${signature}`;
+
+  const url = pathStyle
+    ? `${base}/${encodeS3Path(input.bucket)}?cors`
+    : `${base}/?cors`;
+
+  return { url, headers, body };
+}
+
+/**
+ * Bucket CORS yazar. Mevcut kuralların **üzerine** yazar; paylaşımlı
+ * kovada bilinçli kullanılmalı. İzin yoksa çağıran uyarır, upload sürer.
+ *
+ * @param {PutBucketCorsInput} input
+ * @returns {Promise<void>}
+ */
+export async function putBucketCors(input) {
+  const signed = buildSignedPutBucketCors(input);
+  /** @type {Response} */
+  let response;
+  try {
+    response = await fetch(signed.url, {
+      method: "PUT",
+      headers: signed.headers,
+      body: signed.body,
+    });
+  } catch (error) {
+    const detail =
+      error instanceof Error ? error.message : String(error);
+    throw new Error(`S3 PutBucketCors fetch failed (${signed.url}): ${detail}`);
+  }
+
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(
+      `S3 PutBucketCors ${response.status}: ${text.slice(0, 200) || response.statusText}`,
+    );
+  }
+}
+
 /**
  * @param {PutObjectInput} input
  * @returns {Promise<void>}

package/src/views/helpers/tags.js

@@ -195,6 +195,11 @@ export function preloadImage({ href, imagesrcset, imagesizes }) {
 /**
  * Phosphor ikonları — build zamanı üretilen SVG sprite'tan `<use>`.
  * `weight` sprite id'sine dahildir (regular/bold/fill).
+ *
+ * Sprite URL'si her zaman site origin'indedir (`asset(..., { origin:
+ * "document" })`). `<use href>` çapraz origin SVG yüklemez; CDN prefix
+ * açıkken bile `public/assets/sprite.<hash>.svg` aynı host'tan gelir.
+ *
  * @param {{ name: string, size?: number | string, weight?: string,
  *   class?: string, attrs?: Record<string, unknown> }} props
  * @returns {string}
@@ -208,7 +213,7 @@ export function icon(props) {
     attrs: extra = {},
   } = props;
 
-  const spritePath = asset("sprite.svg");
+  const spritePath = asset("sprite.svg", { origin: "document" });
   const id = `${toKebab(name)}-${weight}`;
 
   if (isDev && !warnedIcons.has(id)) {

package/types/config/defaults.d.ts

@@ -458,9 +458,19 @@ export declare const DEFAULT_BUILD: {
             keyPrefix: string;
             region: string;
             endpoint: null;
-            /** `public/` altı dizin adları. */
+            /**
+             * `public/` altı dizin adları. `fonts` varsayılan: CDN CSS'teki
+             * `/fonts/…` rewrite'ı upload nesnesiyle hizalansın.
+             */
             include: string[];
             cacheControl: string;
+            /**
+             * Upload sırasında PutBucketCors ile yazılan `AllowedOrigin`.
+             * `null` / `false` → CORS adımı atlanır. Bucket'taki önceki CORS
+             * kuralının üzerine yazar — paylaşımlı kovada bilinçli açın.
+             * CDN CSS + aynı host font için genelde gerekmez.
+             */
+            corsOrigin: string | null;
         };
     };
 };

package/types/config/index.d.ts

@@ -240,6 +240,10 @@ export type BuildAssetsUploadConfig = {
     endpoint: string | null;
     include: string[];
     cacheControl: string;
+    /**
+     * Font/CDN PutBucketCors `AllowedOrigin`; `null` kapatır.
+     */
+    corsOrigin: string | null;
 };
 export type BuildAssetsConfig = {
     /**

package/types/server/assets.d.ts

@@ -6,11 +6,22 @@
  * @returns {string}
  */
 export declare function applyAssetPrefix(prefix: string, url: string): string;
+export type AssetOptions = {
+    origin?: "cdn" | "document";
+};
+/**
+ * @typedef {{ origin?: "cdn" | "document" }} AssetOptions
+ */
 /**
+ * Manifest'teki hash'li (veya yedek) URL.
+ *
  * @param {string} name Örn. "app.css", "main.js", "sprite.svg"
+ * @param {AssetOptions} [options]
+ *   `origin: "document"` → `build.assets.prefix` uygulanmaz; site
+ *   origin'indeki `/assets/…` yolu döner (varsayılan `"cdn"`).
  * @returns {string}
  */
-export declare function asset(name: string): string;
+export declare function asset(name: string, options?: AssetOptions): string;
 /**
  * @param {string} name
  * @returns {boolean}

package/types/server/logs/s3-put.d.ts

@@ -14,6 +14,14 @@ export type PutObjectInput = {
     cacheControl?: string | null;
     now?: Date;
 };
+export type PutBucketCorsInput = {
+    bucket: string;
+    region: string;
+    endpoint?: string | null;
+    credentials: AwsCredentials;
+    allowedOrigin: string;
+    now?: Date;
+};
 /**
  * @param {string | Buffer} data
  * @returns {string}
@@ -91,6 +99,32 @@ export declare function buildSignedPutObject(input: PutObjectInput): {
     headers: Record<string, string>;
     body: Buffer;
 };
+/**
+ * PutBucketCors gövdesi — tek kural, GET/HEAD.
+ *
+ * @param {string} allowedOrigin
+ * @returns {string}
+ */
+export declare function corsConfigurationXml(allowedOrigin: string): string;
+/**
+ * PutBucketCors isteğini imzalar (`PUT /?cors` veya path-style `/bucket?cors`).
+ *
+ * @param {PutBucketCorsInput} input
+ * @returns {{ url: string, headers: Record<string, string>, body: Buffer }}
+ */
+export declare function buildSignedPutBucketCors(input: PutBucketCorsInput): {
+    url: string;
+    headers: Record<string, string>;
+    body: Buffer;
+};
+/**
+ * Bucket CORS yazar. Mevcut kuralların **üzerine** yazar; paylaşımlı
+ * kovada bilinçli kullanılmalı. İzin yoksa çağıran uyarır, upload sürer.
+ *
+ * @param {PutBucketCorsInput} input
+ * @returns {Promise<void>}
+ */
+export declare function putBucketCors(input: PutBucketCorsInput): Promise<void>;
 /**
  * @param {PutObjectInput} input
  * @returns {Promise<void>}

package/types/views/helpers/tags.d.ts

@@ -60,6 +60,11 @@ export declare function preloadImage({ href, imagesrcset, imagesizes }: {
 /**
  * Phosphor ikonları — build zamanı üretilen SVG sprite'tan `<use>`.
  * `weight` sprite id'sine dahildir (regular/bold/fill).
+ *
+ * Sprite URL'si her zaman site origin'indedir (`asset(..., { origin:
+ * "document" })`). `<use href>` çapraz origin SVG yüklemez; CDN prefix
+ * açıkken bile `public/assets/sprite.<hash>.svg` aynı host'tan gelir.
+ *
  * @param {{ name: string, size?: number | string, weight?: string,
  *   class?: string, attrs?: Record<string, unknown> }} props
  * @returns {string}