jskelet 0.6.3 → 0.6.4

package/src/server/logs/s3-put.js

@@ -1,214 +1,214 @@
-/**
- * Minimal S3 PutObject — yalnızca SigV4 + `fetch`.
- *
- * `@aws-sdk/client-s3` taşınmıyor: tek operasyon için SDK'nın maliyeti ve
- * peer yüzeyi gereksiz. Credential zinciri env'den okunur
- * (`JSKELET_S3_ACCESS_KEY_ID` / `JSKELET_S3_SECRET_ACCESS_KEY` /
- * `JSKELET_S3_SESSION_TOKEN`); IAM role / instance metadata yok —
- * container'a key vermeyen kurulumlar için sink zaten açılışta no-op'a düşer.
- */
-import crypto from "node:crypto";
-
-/**
- * @typedef {{ accessKeyId: string, secretAccessKey: string,
- *   sessionToken?: string | null }} AwsCredentials
- *
- * @typedef {{ bucket: string, key: string, body: string | Buffer,
- *   region: string, endpoint?: string | null, credentials: AwsCredentials,
- *   now?: Date }} PutObjectInput
- */
-
-/**
- * @param {string} algorithm
- * @param {string | Buffer} key
- * @param {string | Buffer} data
- * @returns {Buffer}
- */
-function hmac(algorithm, key, data) {
-  return crypto.createHmac(algorithm, key).update(data).digest();
-}
-
-/**
- * @param {string | Buffer} data
- * @returns {string}
- */
-export function sha256Hex(data) {
-  return crypto.createHash("sha256").update(data).digest("hex");
-}
-
-/**
- * @param {Date} date
- * @returns {{ amzDate: string, dateStamp: string }}
- */
-export function formatAmzDates(date) {
-  const iso = date.toISOString().replace(/[:-]|\.\d{3}/g, "");
-  return {
-    amzDate: iso,
-    dateStamp: iso.slice(0, 8),
-  };
-}
-
-/**
- * @param {string} secretAccessKey
- * @param {string} dateStamp
- * @param {string} region
- * @param {string} service
- * @returns {Buffer}
- */
-export function deriveSigningKey(secretAccessKey, dateStamp, region, service) {
-  const kDate = hmac("sha256", `AWS4${secretAccessKey}`, dateStamp);
-  const kRegion = hmac("sha256", kDate, region);
-  const kService = hmac("sha256", kRegion, service);
-  return hmac("sha256", kService, "aws4_request");
-}
-
-/**
- * @param {{ method: string, canonicalUri: string, canonicalQuerystring?: string,
- *   headers: Record<string, string>, payloadHash: string }} parts
- * @returns {{ canonicalRequest: string, signedHeaders: string }}
- */
-export function buildCanonicalRequest(parts) {
-  const names = Object.keys(parts.headers)
-    .map((name) => name.toLowerCase())
-    .sort();
-  const canonicalHeaders = names
-    .map((name) => `${name}:${parts.headers[name].trim().replace(/\s+/g, " ")}\n`)
-    .join("");
-  const signedHeaders = names.join(";");
-
-  const canonicalRequest = [
-    parts.method,
-    parts.canonicalUri,
-    parts.canonicalQuerystring ?? "",
-    canonicalHeaders,
-    signedHeaders,
-    parts.payloadHash,
-  ].join("\n");
-
-  return { canonicalRequest, signedHeaders };
-}
-
-/**
- * @param {{ amzDate: string, dateStamp: string, region: string, service: string,
- *   canonicalRequest: string }} parts
- * @returns {string}
- */
-export function buildStringToSign(parts) {
-  const scope = `${parts.dateStamp}/${parts.region}/${parts.service}/aws4_request`;
-  return [
-    "AWS4-HMAC-SHA256",
-    parts.amzDate,
-    scope,
-    sha256Hex(parts.canonicalRequest),
-  ].join("\n");
-}
-
-/**
- * URI path encode (S3 key segment'leri). `/` korunur.
- *
- * @param {string} value
- * @returns {string}
- */
-export function encodeS3Path(value) {
-  return value
-    .split("/")
-    .map((segment) => encodeURIComponent(segment).replace(/[!'()*]/g, (char) =>
-      `%${char.charCodeAt(0).toString(16).toUpperCase()}`,
-    ))
-    .join("/");
-}
-
-/**
- * PutObject isteğini imzalar; ağ çağrısı yapmaz — test edilebilir olsun diye.
- *
- * @param {PutObjectInput} input
- * @returns {{ url: string, headers: Record<string, string>, body: Buffer }}
- */
-export function buildSignedPutObject(input) {
-  const body = Buffer.isBuffer(input.body) ? input.body : Buffer.from(input.body);
-  const now = input.now ?? new Date();
-  const { amzDate, dateStamp } = formatAmzDates(now);
-  const service = "s3";
-  const payloadHash = sha256Hex(body);
-
-  const keyPath = encodeS3Path(input.key.replace(/^\/+/, ""));
-  const usePathStyle = Boolean(input.endpoint);
-  const endpointHost = input.endpoint
-    ? new URL(input.endpoint).host
-    : `${input.bucket}.s3.${input.region}.amazonaws.com`;
-  const host = usePathStyle ? new URL(input.endpoint ?? "").host : endpointHost;
-
-  const canonicalUri = usePathStyle
-    ? `/${encodeS3Path(input.bucket)}/${keyPath}`
-    : `/${keyPath}`;
-
-  /** @type {Record<string, string>} */
-  const headers = {
-    host,
-    "content-type": "application/x-ndjson",
-    "content-length": String(body.length),
-    "x-amz-content-sha256": payloadHash,
-    "x-amz-date": amzDate,
-  };
-
-  if (input.credentials.sessionToken) {
-    headers["x-amz-security-token"] = input.credentials.sessionToken;
-  }
-
-  const { canonicalRequest, signedHeaders } = buildCanonicalRequest({
-    method: "PUT",
-    canonicalUri,
-    headers,
-    payloadHash,
-  });
-
-  const stringToSign = buildStringToSign({
-    amzDate,
-    dateStamp,
-    region: input.region,
-    service,
-    canonicalRequest,
-  });
-
-  const signingKey = deriveSigningKey(
-    input.credentials.secretAccessKey,
-    dateStamp,
-    input.region,
-    service,
-  );
-  const signature = hmac("sha256", signingKey, stringToSign).toString("hex");
-  const credentialScope = `${dateStamp}/${input.region}/${service}/aws4_request`;
-
-  headers.authorization =
-    `AWS4-HMAC-SHA256 Credential=${input.credentials.accessKeyId}/${credentialScope}, ` +
-    `SignedHeaders=${signedHeaders}, Signature=${signature}`;
-
-  const base = usePathStyle
-    ? String(input.endpoint).replace(/\/+$/, "")
-    : `https://${host}`;
-  const url = usePathStyle
-    ? `${base}/${encodeS3Path(input.bucket)}/${keyPath}`
-    : `${base}/${keyPath}`;
-
-  return { url, headers, body };
-}
-
-/**
- * @param {PutObjectInput} input
- * @returns {Promise<void>}
- */
-export async function putObject(input) {
-  const signed = buildSignedPutObject(input);
-  const response = await fetch(signed.url, {
-    method: "PUT",
-    headers: signed.headers,
-    body: signed.body,
-  });
-
-  if (!response.ok) {
-    const text = await response.text().catch(() => "");
-    throw new Error(
-      `S3 PutObject ${response.status}: ${text.slice(0, 200) || response.statusText}`,
-    );
-  }
-}
+/**
+ * Minimal S3 PutObject — yalnızca SigV4 + `fetch`.
+ *
+ * `@aws-sdk/client-s3` taşınmıyor: tek operasyon için SDK'nın maliyeti ve
+ * peer yüzeyi gereksiz. Credential zinciri env'den okunur
+ * (`JSKELET_S3_ACCESS_KEY_ID` / `JSKELET_S3_SECRET_ACCESS_KEY` /
+ * `JSKELET_S3_SESSION_TOKEN`); IAM role / instance metadata yok —
+ * container'a key vermeyen kurulumlar için sink zaten açılışta no-op'a düşer.
+ */
+import crypto from "node:crypto";
+
+/**
+ * @typedef {{ accessKeyId: string, secretAccessKey: string,
+ *   sessionToken?: string | null }} AwsCredentials
+ *
+ * @typedef {{ bucket: string, key: string, body: string | Buffer,
+ *   region: string, endpoint?: string | null, credentials: AwsCredentials,
+ *   now?: Date }} PutObjectInput
+ */
+
+/**
+ * @param {string} algorithm
+ * @param {string | Buffer} key
+ * @param {string | Buffer} data
+ * @returns {Buffer}
+ */
+function hmac(algorithm, key, data) {
+  return crypto.createHmac(algorithm, key).update(data).digest();
+}
+
+/**
+ * @param {string | Buffer} data
+ * @returns {string}
+ */
+export function sha256Hex(data) {
+  return crypto.createHash("sha256").update(data).digest("hex");
+}
+
+/**
+ * @param {Date} date
+ * @returns {{ amzDate: string, dateStamp: string }}
+ */
+export function formatAmzDates(date) {
+  const iso = date.toISOString().replace(/[:-]|\.\d{3}/g, "");
+  return {
+    amzDate: iso,
+    dateStamp: iso.slice(0, 8),
+  };
+}
+
+/**
+ * @param {string} secretAccessKey
+ * @param {string} dateStamp
+ * @param {string} region
+ * @param {string} service
+ * @returns {Buffer}
+ */
+export function deriveSigningKey(secretAccessKey, dateStamp, region, service) {
+  const kDate = hmac("sha256", `AWS4${secretAccessKey}`, dateStamp);
+  const kRegion = hmac("sha256", kDate, region);
+  const kService = hmac("sha256", kRegion, service);
+  return hmac("sha256", kService, "aws4_request");
+}
+
+/**
+ * @param {{ method: string, canonicalUri: string, canonicalQuerystring?: string,
+ *   headers: Record<string, string>, payloadHash: string }} parts
+ * @returns {{ canonicalRequest: string, signedHeaders: string }}
+ */
+export function buildCanonicalRequest(parts) {
+  const names = Object.keys(parts.headers)
+    .map((name) => name.toLowerCase())
+    .sort();
+  const canonicalHeaders = names
+    .map((name) => `${name}:${parts.headers[name].trim().replace(/\s+/g, " ")}\n`)
+    .join("");
+  const signedHeaders = names.join(";");
+
+  const canonicalRequest = [
+    parts.method,
+    parts.canonicalUri,
+    parts.canonicalQuerystring ?? "",
+    canonicalHeaders,
+    signedHeaders,
+    parts.payloadHash,
+  ].join("\n");
+
+  return { canonicalRequest, signedHeaders };
+}
+
+/**
+ * @param {{ amzDate: string, dateStamp: string, region: string, service: string,
+ *   canonicalRequest: string }} parts
+ * @returns {string}
+ */
+export function buildStringToSign(parts) {
+  const scope = `${parts.dateStamp}/${parts.region}/${parts.service}/aws4_request`;
+  return [
+    "AWS4-HMAC-SHA256",
+    parts.amzDate,
+    scope,
+    sha256Hex(parts.canonicalRequest),
+  ].join("\n");
+}
+
+/**
+ * URI path encode (S3 key segment'leri). `/` korunur.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+export function encodeS3Path(value) {
+  return value
+    .split("/")
+    .map((segment) => encodeURIComponent(segment).replace(/[!'()*]/g, (char) =>
+      `%${char.charCodeAt(0).toString(16).toUpperCase()}`,
+    ))
+    .join("/");
+}
+
+/**
+ * PutObject isteğini imzalar; ağ çağrısı yapmaz — test edilebilir olsun diye.
+ *
+ * @param {PutObjectInput} input
+ * @returns {{ url: string, headers: Record<string, string>, body: Buffer }}
+ */
+export function buildSignedPutObject(input) {
+  const body = Buffer.isBuffer(input.body) ? input.body : Buffer.from(input.body);
+  const now = input.now ?? new Date();
+  const { amzDate, dateStamp } = formatAmzDates(now);
+  const service = "s3";
+  const payloadHash = sha256Hex(body);
+
+  const keyPath = encodeS3Path(input.key.replace(/^\/+/, ""));
+  const usePathStyle = Boolean(input.endpoint);
+  const endpointHost = input.endpoint
+    ? new URL(input.endpoint).host
+    : `${input.bucket}.s3.${input.region}.amazonaws.com`;
+  const host = usePathStyle ? new URL(input.endpoint ?? "").host : endpointHost;
+
+  const canonicalUri = usePathStyle
+    ? `/${encodeS3Path(input.bucket)}/${keyPath}`
+    : `/${keyPath}`;
+
+  /** @type {Record<string, string>} */
+  const headers = {
+    host,
+    "content-type": "application/x-ndjson",
+    "content-length": String(body.length),
+    "x-amz-content-sha256": payloadHash,
+    "x-amz-date": amzDate,
+  };
+
+  if (input.credentials.sessionToken) {
+    headers["x-amz-security-token"] = input.credentials.sessionToken;
+  }
+
+  const { canonicalRequest, signedHeaders } = buildCanonicalRequest({
+    method: "PUT",
+    canonicalUri,
+    headers,
+    payloadHash,
+  });
+
+  const stringToSign = buildStringToSign({
+    amzDate,
+    dateStamp,
+    region: input.region,
+    service,
+    canonicalRequest,
+  });
+
+  const signingKey = deriveSigningKey(
+    input.credentials.secretAccessKey,
+    dateStamp,
+    input.region,
+    service,
+  );
+  const signature = hmac("sha256", signingKey, stringToSign).toString("hex");
+  const credentialScope = `${dateStamp}/${input.region}/${service}/aws4_request`;
+
+  headers.authorization =
+    `AWS4-HMAC-SHA256 Credential=${input.credentials.accessKeyId}/${credentialScope}, ` +
+    `SignedHeaders=${signedHeaders}, Signature=${signature}`;
+
+  const base = usePathStyle
+    ? String(input.endpoint).replace(/\/+$/, "")
+    : `https://${host}`;
+  const url = usePathStyle
+    ? `${base}/${encodeS3Path(input.bucket)}/${keyPath}`
+    : `${base}/${keyPath}`;
+
+  return { url, headers, body };
+}
+
+/**
+ * @param {PutObjectInput} input
+ * @returns {Promise<void>}
+ */
+export async function putObject(input) {
+  const signed = buildSignedPutObject(input);
+  const response = await fetch(signed.url, {
+    method: "PUT",
+    headers: signed.headers,
+    body: signed.body,
+  });
+
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw new Error(
+      `S3 PutObject ${response.status}: ${text.slice(0, 200) || response.statusText}`,
+    );
+  }
+}

package/src/server/logs/s3-sink.js

@@ -1,112 +1,112 @@
-/**
- * S3 batch sink — satırları biriktirir, aralık / maxBatch ile PutObject atar.
- *
- * Başarısız bir yükleme süreci düşürmez: bir kez uyarır, batch'i bırakır.
- * Backpressure için yeniden kuyruk yok — log kaybı, belleğin şişmesinden
- * tercih edilir.
- */
-import os from "node:os";
-import process from "node:process";
-import { putObject } from "./s3-put.js";
-
-/**
- * @typedef {import('./file-sink.js').LogSink} LogSink
- * @typedef {import('./s3-put.js').AwsCredentials} AwsCredentials
- */
-
-/**
- * @param {{ bucket: string, prefix: string, region: string,
- *   endpoint?: string | null, credentials: AwsCredentials,
- *   flushIntervalMs: number, maxBatch: number,
- *   put?: typeof putObject }} options
- * @returns {LogSink & { pendingCount: () => number }}
- */
-export function createS3Sink(options) {
-  /** @type {string[]} */
-  let buffer = [];
-  let seq = 0;
-  let warned = false;
-  /** @type {Promise<void>} */
-  let chain = Promise.resolve();
-  /** @type {ReturnType<typeof setInterval> | null} */
-  let timer = null;
-
-  const put = options.put ?? putObject;
-  const host = os.hostname().replace(/[^a-zA-Z0-9._-]/g, "-") || "host";
-  const prefix = options.prefix.endsWith("/")
-    ? options.prefix
-    : `${options.prefix}/`;
-
-  /**
-   * @param {Date} [date]
-   * @returns {string}
-   */
-  function objectKey(date = new Date()) {
-    const y = date.getUTCFullYear();
-    const m = String(date.getUTCMonth() + 1).padStart(2, "0");
-    const d = String(date.getUTCDate()).padStart(2, "0");
-    const iso = date.toISOString().replace(/[:.]/g, "-");
-    seq += 1;
-    return `${prefix}${y}/${m}/${d}/${host}-${process.pid}-${iso}-${seq}.ndjson`;
-  }
-
-  /**
-   * @param {string} message
-   * @param {unknown} [error]
-   */
-  function warnOnce(message, error) {
-    if (warned) return;
-    warned = true;
-    console.warn(`[logs] ${message}`, error ?? "");
-  }
-
-  async function flushNow() {
-    if (!buffer.length) return;
-    const lines = buffer;
-    buffer = [];
-    const body = `${lines.join("\n")}\n`;
-    try {
-      await put({
-        bucket: options.bucket,
-        key: objectKey(),
-        body,
-        region: options.region,
-        endpoint: options.endpoint ?? null,
-        credentials: options.credentials,
-      });
-    } catch (error) {
-      warnOnce("S3 PutObject failed; dropping batch", error);
-    }
-  }
-
-  /** Flush'ları sıraya dizer — iki timer çakışmasın. */
-  function enqueueFlush() {
-    chain = chain.then(flushNow).catch(() => {});
-    return chain;
-  }
-
-  timer = setInterval(() => {
-    void enqueueFlush();
-  }, options.flushIntervalMs);
-  timer.unref?.();
-
-  return {
-    pendingCount() {
-      return buffer.length;
-    },
-    async write(entry) {
-      buffer.push(JSON.stringify(entry));
-      if (buffer.length >= options.maxBatch) await enqueueFlush();
-    },
-    async flush() {
-      await enqueueFlush();
-    },
-    async close() {
-      if (timer) {
-        clearInterval(timer);
-        timer = null;
-      }
-      await enqueueFlush();
-    },
-  };
-}
+/**
+ * S3 batch sink — satırları biriktirir, aralık / maxBatch ile PutObject atar.
+ *
+ * Başarısız bir yükleme süreci düşürmez: bir kez uyarır, batch'i bırakır.
+ * Backpressure için yeniden kuyruk yok — log kaybı, belleğin şişmesinden
+ * tercih edilir.
+ */
+import os from "node:os";
+import process from "node:process";
+import { putObject } from "./s3-put.js";
+
+/**
+ * @typedef {import('./file-sink.js').LogSink} LogSink
+ * @typedef {import('./s3-put.js').AwsCredentials} AwsCredentials
+ */
+
+/**
+ * @param {{ bucket: string, prefix: string, region: string,
+ *   endpoint?: string | null, credentials: AwsCredentials,
+ *   flushIntervalMs: number, maxBatch: number,
+ *   put?: typeof putObject }} options
+ * @returns {LogSink & { pendingCount: () => number }}
+ */
+export function createS3Sink(options) {
+  /** @type {string[]} */
+  let buffer = [];
+  let seq = 0;
+  let warned = false;
+  /** @type {Promise<void>} */
+  let chain = Promise.resolve();
+  /** @type {ReturnType<typeof setInterval> | null} */
+  let timer = null;
+
+  const put = options.put ?? putObject;
+  const host = os.hostname().replace(/[^a-zA-Z0-9._-]/g, "-") || "host";
+  const prefix = options.prefix.endsWith("/")
+    ? options.prefix
+    : `${options.prefix}/`;
+
+  /**
+   * @param {Date} [date]
+   * @returns {string}
+   */
+  function objectKey(date = new Date()) {
+    const y = date.getUTCFullYear();
+    const m = String(date.getUTCMonth() + 1).padStart(2, "0");
+    const d = String(date.getUTCDate()).padStart(2, "0");
+    const iso = date.toISOString().replace(/[:.]/g, "-");
+    seq += 1;
+    return `${prefix}${y}/${m}/${d}/${host}-${process.pid}-${iso}-${seq}.ndjson`;
+  }
+
+  /**
+   * @param {string} message
+   * @param {unknown} [error]
+   */
+  function warnOnce(message, error) {
+    if (warned) return;
+    warned = true;
+    console.warn(`[logs] ${message}`, error ?? "");
+  }
+
+  async function flushNow() {
+    if (!buffer.length) return;
+    const lines = buffer;
+    buffer = [];
+    const body = `${lines.join("\n")}\n`;
+    try {
+      await put({
+        bucket: options.bucket,
+        key: objectKey(),
+        body,
+        region: options.region,
+        endpoint: options.endpoint ?? null,
+        credentials: options.credentials,
+      });
+    } catch (error) {
+      warnOnce("S3 PutObject failed; dropping batch", error);
+    }
+  }
+
+  /** Flush'ları sıraya dizer — iki timer çakışmasın. */
+  function enqueueFlush() {
+    chain = chain.then(flushNow).catch(() => {});
+    return chain;
+  }
+
+  timer = setInterval(() => {
+    void enqueueFlush();
+  }, options.flushIntervalMs);
+  timer.unref?.();
+
+  return {
+    pendingCount() {
+      return buffer.length;
+    },
+    async write(entry) {
+      buffer.push(JSON.stringify(entry));
+      if (buffer.length >= options.maxBatch) await enqueueFlush();
+    },
+    async flush() {
+      await enqueueFlush();
+    },
+    async close() {
+      if (timer) {
+        clearInterval(timer);
+        timer = null;
+      }
+      await enqueueFlush();
+    },
+  };
+}