jskelet 0.6.7 → 0.6.9

package/CHANGELOG.md

@@ -8,6 +8,19 @@ one is listed under a **Breaking** heading.
 
 ## [Unreleased]
 
+### Added
+
+- Optional CDN asset publishing: `build.assets.prefix` /
+  `JSKELET_ASSET_PREFIX` prefixes `asset()` and optimised image URLs (manifest
+  stays relative on disk). When `JSKELET_ASSETS_BUCKET` (or
+  `build.assets.upload`) is set, production `jskelet build` PutObjects
+  `public/assets/` (and optional `include` dirs) to S3 after precompress.
+  Credentials prefer standard `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` /
+  `AWS_SESSION_TOKEN`, then `JSKELET_S3_*`. The Assets upload step always
+  appears on production builds; when off it logs a one-line reason
+  (`skipped (no JSKELET_ASSETS_BUCKET)`, `skipped (credentials missing)`, …).
+  Watch mode never uploads. `.br` / `.gz` siblings are skipped.
+
 ### Changed
 
 - Shared cache entries of 1 KB or more are stored as brotli (`JSK\x01`

package/docs/07-yapilandirma.md

@@ -95,6 +95,13 @@ export default {
     client: {
       groups: { charts: ["chart.js"] },
     },
+    assets: {
+      prefix: process.env.JSKELET_ASSET_PREFIX,
+      upload: {
+        enabled: Boolean(process.env.JSKELET_ASSETS_BUCKET),
+        bucket: process.env.JSKELET_ASSETS_BUCKET,
+      },
+    },
   },
 
   async headers() {
@@ -592,11 +599,14 @@ Elle URL kurmak için `remoteImageUrl(src, { width })` (`jskelet`).
 
 ## `build`
 
-**Tip:** `{ client?: { splitting?, groups?, chunkGroup? } }` — **Varsayılan:**
-`{ client: { splitting: true, groups: {}, chunkGroup: null } }`
+**Tip:** `{ client?: { splitting?, groups?, chunkGroup? }, assets?: { prefix?, upload? } }`
+— **Varsayılan:**
+`{ client: { splitting: true, groups: {}, chunkGroup: null }, assets: { prefix: "", upload: { enabled: false, … } } }`
+
+Client JS (esbuild) bundling knobs ve opsiyonel CDN / S3 asset dağıtımı.
+`fonts` / `icons` / `images` / `clientEnv` hâlâ top-level kalır.
 
-Client JS (esbuild) bundling knobs. `fonts` / `icons` / `images` / `clientEnv`
-hâlâ top-level kalır; bu bölüm yalnızca splitting ve chunk gruplaması içindir.
+### `build.client`
 
 | Alan | Tip | Varsayılan | Anlamı |
 | --- | --- | --- | --- |
@@ -611,6 +621,29 @@ zayıflar — bir üyeyi kullanan sayfa grubun geri kalanını da indirebilir
 `chunks/chunk.<hash>.js` kalır; grup adı config anahtarıdır, dosya adı değil.
 Ayrıntı: [08-build.md](./08-build.md).
 
+### `build.assets`
+
+CDN origin ve production build sonunda S3 upload. **Kapalıyken hiçbir şey
+değişmez** — asset'ler origin'den servis edilir.
+
+| Alan | Tip | Varsayılan | Anlamı |
+| --- | --- | --- | --- |
+| `assets.prefix` | `string` | `""` | `asset()` / optimize görsel URL öneki (sonunda `/` yok). `JSKELET_ASSET_PREFIX` ezer. Manifest diskte göreli kalır. |
+| `assets.upload.enabled` | `boolean` | `false` | `true` veya `JSKELET_ASSETS_BUCKET` doluysa açılır; açık `false` ezer. |
+| `assets.upload.bucket` | `string \| null` | `null` | Bucket veya `bucket/key/prefix`. `JSKELET_ASSETS_BUCKET` ezer. |
+| `assets.upload.keyPrefix` | `string` | `""` | Yolda verilmediyse nesne anahtarı öneki (`prefix` takma adı da kabul). |
+| `assets.upload.region` | `string` | `us-east-1` | `AWS_REGION` / `AWS_DEFAULT_REGION` / `JSKELET_S3_REGION`; custom endpoint'te varsayılan `auto`. |
+| `assets.upload.endpoint` | `string \| null` | `null` | S3-uyumlu API; `AWS_ENDPOINT_URL` / `JSKELET_S3_API_URL` ezer. |
+| `assets.upload.include` | `string[]` | `["assets"]` | `public/` altı dizinler (`assets`, isteğe `fonts`, …). |
+| `assets.upload.cacheControl` | `string` | `public, max-age=31536000, immutable` | PutObject `Cache-Control`. |
+
+Credential config'e yazılmaz. Öncelik: `AWS_ACCESS_KEY_ID` /
+`AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, yoksa `JSKELET_S3_*`. Production
+build'de Assets upload adımı her zaman görünür; kapalıysa
+`skipped (no JSKELET_ASSETS_BUCKET)` / `skipped (credentials missing)` gibi tek
+satır sebep basılır (build düşmez). Watch turunda adım yok. `.br` / `.gz`
+yüklenmez. Ayrıntı: [08-build.md](./08-build.md), [10-dagitim.md](./10-dagitim.md).
+
 ```js
 build: {
   client: {
@@ -623,6 +656,14 @@ build: {
       if (id.includes("node_modules/lodash")) return "vendor";
     },
   },
+  assets: {
+    prefix: process.env.JSKELET_ASSET_PREFIX, // https://dxxxx.cloudfront.net
+    upload: {
+      enabled: Boolean(process.env.JSKELET_ASSETS_BUCKET),
+      bucket: process.env.JSKELET_ASSETS_BUCKET, // my-bucket veya my-bucket/static
+      include: ["assets", "fonts"],
+    },
+  },
 },
 ```
 
@@ -954,7 +995,8 @@ parça silinir.
 | `s3.flushIntervalMs` | `number` | `5000` | Batch flush aralığı |
 | `s3.maxBatch` | `number` | `100` | Bu kadar satırda erken flush |
 
-S3 credential'ları config'e yazılmaz: `JSKELET_S3_ACCESS_KEY_ID`,
+S3 credential'ları config'e yazılmaz. Öncelik: `AWS_ACCESS_KEY_ID` /
+`AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, yoksa `JSKELET_S3_ACCESS_KEY_ID`,
 `JSKELET_S3_SECRET_ACCESS_KEY`, isteğe bağlı `JSKELET_S3_SESSION_TOKEN`.
 Bucket/region/credential eksikse uyarı basılır ve S3 sink kapanır; site ayağa
 kalkmaya devam eder. Framework `@aws-sdk` taşımaz — PutObject SigV4 ile
@@ -1186,14 +1228,21 @@ basılmaz.
 | `DEV_GATE` | `devGate` | kapalı | `1` gate'i açar, `0` config'te açık olsa da kapatır. `DEV_TOKEN` tek başına açmaz. [09](./09-dev-araclari.md) |
 | `DEV_TOKEN` | `devGate`, `prewarm` | — | Gate açıkken beklenen sır. Yoksa veya gate kapalıysa site açık kalır. Isıtma, gate açıkken token'ı çerez olarak taşır. [09](./09-dev-araclari.md) |
 | `JSKELET_ADMIN` | `createApp` | — | Ayarlıysa yönetim panelini açar; `0` config'te açık olan paneli kapatır. Env config'i ezer, çünkü panel genelde bir arıza sırasında tek seferlik açılır. [06](./06-cache.md) |
+| `JSKELET_ASSET_PREFIX` | `build.assets.prefix` | — | CDN origin; `asset()` URL'lerine eklenir (sonunda `/` yok) |
+| `JSKELET_ASSETS_BUCKET` | `build.assets.upload` | — | Asset upload hedefi: bucket veya `bucket/prefix`. Credential ile birlikte production build sonunda PutObject |
+| `AWS_ACCESS_KEY_ID` | S3 PutObject | — | Standart AWS imza anahtarı (log + asset upload); `JSKELET_S3_*`'dan önce |
+| `AWS_SECRET_ACCESS_KEY` | S3 PutObject | — | Standart AWS imza sırrı |
+| `AWS_SESSION_TOKEN` | S3 PutObject | — | Geçici credential (OIDC / STS) |
+| `AWS_REGION` / `AWS_DEFAULT_REGION` | `build.assets.upload` | — | Asset upload bölgesi |
+| `AWS_ENDPOINT_URL` | `build.assets.upload` | — | S3-uyumlu endpoint (asset upload) |
 | `JSKELET_LOG_BUCKET` | `logs.s3` | — | Log hedefi: bucket ya da `bucket/prefix` yolu. Credential ile birlikte varsa sink otomatik açılır |
 | `JSKELET_S3_BUCKET` | `logs.s3` | — | `JSKELET_LOG_BUCKET` yoksa bucket; `JSKELET_S3_KEY_PREFIX` ile birleşir |
 | `JSKELET_S3_KEY_PREFIX` | `logs.s3` | — | `JSKELET_S3_BUCKET` ile kullanılır (`bucket/prefix`) |
-| `JSKELET_S3_ACCESS_KEY_ID` | `logs.s3` | — | PutObject imzası |
-| `JSKELET_S3_SECRET_ACCESS_KEY` | `logs.s3` | — | İmza sırrı (`JSKELET_S3_ACCESS_SECRET` yedek ad) |
-| `JSKELET_S3_SESSION_TOKEN` | `logs.s3` | — | Geçici credential için isteğe bağlı |
-| `JSKELET_S3_REGION` | `logs.s3` | `auto` | Verilmezse `auto` |
-| `JSKELET_S3_API_URL` | `logs.s3` | — | S3-uyumlu endpoint; `logs.s3.endpoint`'i ezer |
+| `JSKELET_S3_ACCESS_KEY_ID` | S3 PutObject | — | `AWS_*` yoksa PutObject imzası (log + asset) |
+| `JSKELET_S3_SECRET_ACCESS_KEY` | S3 PutObject | — | İmza sırrı (`JSKELET_S3_ACCESS_SECRET` yedek ad) |
+| `JSKELET_S3_SESSION_TOKEN` | S3 PutObject | — | Geçici credential için isteğe bağlı |
+| `JSKELET_S3_REGION` | `logs.s3` / asset upload | `auto` (log) | Log'da verilmezse `auto`; asset upload'ta `AWS_REGION` yoksa |
+| `JSKELET_S3_API_URL` | `logs.s3` / asset upload | — | S3-uyumlu endpoint |
 | `JSKELET_CLOUDFLARE_KEY` | Cloudflare cache yüzeyi | — | API token. Verilene kadar CDN purge'ü ve edge analitiği kapalıdır; config'teki `apiToken`'ı ezer. Token hiçbir cevapta dönmez. [06](./06-cache.md) |
 | `JSKELET_CLOUDFLARE_ZONE_ID` | Cloudflare cache yüzeyi | — | Zone kimliği. Token'la birlikte verilmedikçe hiçbir Cloudflare ucu çağrılmaz |
 | `JSKELET_CLOUDFLARE_HOSTNAME` | Cloudflare cache yüzeyi | — | Purge URL'lerinin kökü. Panel iç bir adresten açılıyorsa gerekir |

package/docs/08-build.md

@@ -20,6 +20,7 @@ davranışı burada. Çıktının çalışma anında nasıl servis edildiği
 5. Images         config.images !== false, watch değil ve sharp kurulu ise
 6. Manifest       .jskelet/manifest.json
 7. Precompress    watch değilse
+8. Assets upload  watch değilse (kapalıysa `skipped (sebep)`)
 ```
 
 Şablon derlemesi asset taramasından **önce** biter; istek yolunda parse yoktur.
@@ -30,8 +31,11 @@ Sıra rastgele değil:
 
 - **CSS ikon sprite'ından sonra gelir.** Sprite bir varlıktır ve sınıf üretmez,
   ama manifest anahtarı verir.
-- **Precompress en sonda:** sıkıştırılacak her şey üretilmiş olmalı.
+- **Precompress, upload'tan hemen önce:** origin hâlâ `.br`/`.gz` üretir; S3
+  adımı yalnızca ham dosyaları kopyalar.
 - **Görseller watch turunda hiç çalışmaz:** `sharp` ile yeniden kodlama pahalı.
+- **Assets upload watch'ta yok:** yalnızca production `jskelet build`; kapalıysa
+  yine satır basılır (`skipped (no JSKELET_ASSETS_BUCKET)` vb.).
 
 Görevler yalnızca ilgili yapılandırma varsa çalışır. Font tanımlamayan bir proje
 font adımını hiç görmez; bu, "framework her projeye kendi varsayımlarını
@@ -74,8 +78,25 @@ dosya adlarını okunur tutuyor. Hash'li olmaları sayesinde bu dosyalara
 ```
 
 - `asset(name)` manifest'te varsa hash'li URL'i, yoksa `/assets/<name>` döner.
+  `build.assets.prefix` / `JSKELET_ASSET_PREFIX` doluysa bu göreli yolun önüne
+  CDN origin eklenir (manifest diskte göreli kalır).
 - `hasAsset(name)` manifest'te olup olmadığını söyler.
 
+### CDN prefix ve S3 upload
+
+Varsayılan kapalıdır. Açılınca:
+
+1. Production build `public/assets/` (ve `include` listesindeki diğer dizinler)
+   altındaki dosyaları S3'e PutObject ile kopyalar.
+2. Çalışma anında `asset()` / optimize görseller `JSKELET_ASSET_PREFIX` ile
+   absolute CDN URL basar. Entry CDN'deyse esbuild chunk'ları göreli yolla aynı
+   host'a gider.
+
+Credential: `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` (önce), yoksa
+`JSKELET_S3_*`. Bucket: `JSKELET_ASSETS_BUCKET`. Config sözlüğü:
+[07-yapilandirma.md](./07-yapilandirma.md#build). Dağıtım notları:
+[10-dagitim.md](./10-dagitim.md).
+
 Build çalışmadıysa uygulama yine ayağa kalkar: `hasAsset()` false olur, layout
 stylesheet ve script etiketlerini hiç basmaz. `jskelet build` unutulduğunda hata
 yerine stilsiz ama çalışan bir sayfa görürsünüz. Manifest hiç yoksa bir kez uyarı

package/docs/10-dagitim.md

@@ -51,7 +51,28 @@ ayarlamayı düşünmeniz gerekenler:
 | `PREWARM_MAX` | Site boyutuna göre | Açılışta ısıtılacak sayfa sayısı |
 | `PREWARM_INTERVAL_SECONDS` | `0` ya da uzun bir değer | Hiç ziyaret edilmeyen sayfaları sıcak tutmak isterseniz |
 | `DEV_GATE` + `DEV_TOKEN` | Yalnızca staging'de | Yayına açılmamış ortamı gizler. Token tek başına siteyi kilitlemez |
-| `JSKELET_S3_*` | Access log'u S3'e yazıyorsanız | Bucket + credential; ayrıntı [07](./07-yapilandirma.md) |
+| `JSKELET_S3_*` / `AWS_*` | Access log veya asset'leri S3'e yazıyorsanız | Credential; AWS deploy'da `AWS_ACCESS_KEY_ID` vb. yeter. Ayrıntı [07](./07-yapilandirma.md) |
+| `JSKELET_ASSETS_BUCKET` | Hash'li asset'leri S3/CloudFront'a basıyorsanız | Production `jskelet build` sonunda PutObject; `JSKELET_ASSET_PREFIX` ile HTML CDN URL basar |
+
+### Asset'leri S3 / CloudFront'a basmak
+
+Varsayılan kapalıdır. CI veya prod build ortamında:
+
+```bash
+JSKELET_ASSETS_BUCKET=my-app-assets          # veya my-app-assets/static
+JSKELET_ASSET_PREFIX=https://dxxxx.cloudfront.net
+AWS_REGION=eu-central-1
+AWS_ACCESS_KEY_ID=…
+AWS_SECRET_ACCESS_KEY=…
+# geçici credential ise:
+# AWS_SESSION_TOKEN=…
+```
+
+`jskelet build` bitince `public/assets/` (ve config'te `include` edilen
+dizinler) S3'e kopyalanır; origin'deki dosyalar da durur. Bucket veya
+credential yoksa adım `skipped (…)` ile sebep basar, build devam eder. Watch /
+`jskelet dev` upload yapmaz. CSP kullanıyorsanız CDN origin'ini `script-src` /
+`style-src` / `img-src` ve `preconnect` listesine ekleyin.
 
 Production'da dosya veya S3 sink açıldığında HTTP access log middleware
 otomatik mount edilir (`logs.kinds` içinde `http` varsa). Admin paneli ring'i

package/docs/en/07-configuration.md

@@ -99,6 +99,13 @@ export default {
     client: {
       groups: { charts: ["chart.js"] },
     },
+    assets: {
+      prefix: process.env.JSKELET_ASSET_PREFIX,
+      upload: {
+        enabled: Boolean(process.env.JSKELET_ASSETS_BUCKET),
+        bucket: process.env.JSKELET_ASSETS_BUCKET,
+      },
+    },
   },
 
   async headers() {
@@ -605,11 +612,14 @@ hand, use `remoteImageUrl(src, { width })` from `jskelet`.
 
 ## `build`
 
-**Type:** `{ client?: { splitting?, groups?, chunkGroup? } }` — **Default:**
-`{ client: { splitting: true, groups: {}, chunkGroup: null } }`
+**Type:** `{ client?: { splitting?, groups?, chunkGroup? }, assets?: { prefix?, upload? } }`
+— **Default:**
+`{ client: { splitting: true, groups: {}, chunkGroup: null }, assets: { prefix: "", upload: { enabled: false, … } } }`
+
+Client JS (esbuild) bundling knobs and optional CDN / S3 asset publishing.
+`fonts` / `icons` / `images` / `clientEnv` stay top-level.
 
-Client JS (esbuild) bundling knobs. `fonts` / `icons` / `images` / `clientEnv`
-stay top-level; this section is only for splitting and chunk grouping.
+### `build.client`
 
 | Field | Type | Default | Meaning |
 | --- | --- | --- | --- |
@@ -624,6 +634,31 @@ group weakens — a page that uses one member may download the rest of the group
 `chunks/chunk.<hash>.js`; the group name is a config key, not the file name.
 Details: [08-build.md](./08-build.md).
 
+### `build.assets`
+
+CDN origin and S3 upload at the end of a production build. **When off, nothing
+changes** — assets stay on the origin.
+
+| Field | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `assets.prefix` | `string` | `""` | Prefix for `asset()` / optimised image URLs (no trailing `/`). `JSKELET_ASSET_PREFIX` overrides. The on-disk manifest stays relative. |
+| `assets.upload.enabled` | `boolean` | `false` | Turns on when `true` or when `JSKELET_ASSETS_BUCKET` is set; explicit `false` wins. |
+| `assets.upload.bucket` | `string \| null` | `null` | Bucket or `bucket/key/prefix`. `JSKELET_ASSETS_BUCKET` overrides. |
+| `assets.upload.keyPrefix` | `string` | `""` | Object key prefix when not given in the path (`prefix` is accepted as an alias). |
+| `assets.upload.region` | `string` | `us-east-1` | `AWS_REGION` / `AWS_DEFAULT_REGION` / `JSKELET_S3_REGION`; defaults to `auto` with a custom endpoint. |
+| `assets.upload.endpoint` | `string \| null` | `null` | S3-compatible API; `AWS_ENDPOINT_URL` / `JSKELET_S3_API_URL` overrides. |
+| `assets.upload.include` | `string[]` | `["assets"]` | Directories under `public/` (`assets`, optionally `fonts`, …). |
+| `assets.upload.cacheControl` | `string` | `public, max-age=31536000, immutable` | PutObject `Cache-Control`. |
+
+Credentials are not written in the config. Preference order:
+`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, then
+`JSKELET_S3_*`. On a production build the Assets upload step always appears;
+when off it logs a one-line reason such as
+`skipped (no JSKELET_ASSETS_BUCKET)` or `skipped (credentials missing)` (the
+build does not fail). No upload on watch passes. `.br` / `.gz` siblings are not
+uploaded. Details: [08-build.md](./08-build.md),
+[10-deployment.md](./10-deployment.md).
+
 ```js
 build: {
   client: {
@@ -636,6 +671,14 @@ build: {
       if (id.includes("node_modules/lodash")) return "vendor";
     },
   },
+  assets: {
+    prefix: process.env.JSKELET_ASSET_PREFIX, // https://dxxxx.cloudfront.net
+    upload: {
+      enabled: Boolean(process.env.JSKELET_ASSETS_BUCKET),
+      bucket: process.env.JSKELET_ASSETS_BUCKET, // my-bucket or my-bucket/static
+      include: ["assets", "fonts"],
+    },
+  },
 },
 ```
 
@@ -971,10 +1014,12 @@ deleted.
 | `s3.flushIntervalMs` | `number` | `5000` | Batch flush interval |
 | `s3.maxBatch` | `number` | `100` | Flush early after this many lines |
 
-S3 credentials are not written in the config: `JSKELET_S3_ACCESS_KEY_ID`,
-`JSKELET_S3_SECRET_ACCESS_KEY`, optional `JSKELET_S3_SESSION_TOKEN`. Missing
-bucket/region/credentials warn and disable the S3 sink; the site still starts.
-The framework does not ship `@aws-sdk` — PutObject is embedded with SigV4.
+S3 credentials are not written in the config. Preference order:
+`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, then
+`JSKELET_S3_ACCESS_KEY_ID`, `JSKELET_S3_SECRET_ACCESS_KEY`, optional
+`JSKELET_S3_SESSION_TOKEN`. Missing bucket/region/credentials warn and disable
+the S3 sink; the site still starts. The framework does not ship `@aws-sdk` —
+PutObject is embedded with SigV4.
 
 ```js
 logs: {
@@ -1207,14 +1252,21 @@ and no warning is printed.
 | `DEV_GATE` | `devGate` | off | `1` turns the gate on, `0` turns it off even when config enabled it. `DEV_TOKEN` alone does not turn it on. [09](./09-dev-tools.md) |
 | `DEV_TOKEN` | `devGate`, `prewarm` | — | The secret expected while the gate is on. If it is missing, or the gate is off, the site stays public. Prewarming carries the token as a cookie only while the gate is on. [09](./09-dev-tools.md) |
 | `JSKELET_ADMIN` | `createApp` | — | When set, turns the admin panel on; `0` turns off a panel enabled in the config. The env wins because the panel is usually opened once during an incident. [06](./06-caching.md) |
+| `JSKELET_ASSET_PREFIX` | `build.assets.prefix` | — | CDN origin prepended to `asset()` URLs (no trailing `/`) |
+| `JSKELET_ASSETS_BUCKET` | `build.assets.upload` | — | Asset upload target: bucket or `bucket/prefix`. With credentials, production build PutObject |
+| `AWS_ACCESS_KEY_ID` | S3 PutObject | — | Standard AWS signing key (logs + asset upload); before `JSKELET_S3_*` |
+| `AWS_SECRET_ACCESS_KEY` | S3 PutObject | — | Standard AWS signing secret |
+| `AWS_SESSION_TOKEN` | S3 PutObject | — | Temporary credentials (OIDC / STS) |
+| `AWS_REGION` / `AWS_DEFAULT_REGION` | `build.assets.upload` | — | Asset upload region |
+| `AWS_ENDPOINT_URL` | `build.assets.upload` | — | S3-compatible endpoint (asset upload) |
 | `JSKELET_LOG_BUCKET` | `logs.s3` | — | Log target: bucket or `bucket/prefix` path. With credentials, the sink turns on automatically |
 | `JSKELET_S3_BUCKET` | `logs.s3` | — | Bucket when `JSKELET_LOG_BUCKET` is unset; joins with `JSKELET_S3_KEY_PREFIX` |
 | `JSKELET_S3_KEY_PREFIX` | `logs.s3` | — | Used with `JSKELET_S3_BUCKET` (`bucket/prefix`) |
-| `JSKELET_S3_ACCESS_KEY_ID` | `logs.s3` | — | Signs PutObject |
-| `JSKELET_S3_SECRET_ACCESS_KEY` | `logs.s3` | — | Signing secret (`JSKELET_S3_ACCESS_SECRET` is an alias) |
-| `JSKELET_S3_SESSION_TOKEN` | `logs.s3` | — | Optional, for temporary credentials |
-| `JSKELET_S3_REGION` | `logs.s3` | `auto` | Defaults to `auto` when unset |
-| `JSKELET_S3_API_URL` | `logs.s3` | — | S3-compatible endpoint; overrides `logs.s3.endpoint` |
+| `JSKELET_S3_ACCESS_KEY_ID` | S3 PutObject | — | Signs PutObject when `AWS_*` is unset (logs + assets) |
+| `JSKELET_S3_SECRET_ACCESS_KEY` | S3 PutObject | — | Signing secret (`JSKELET_S3_ACCESS_SECRET` is an alias) |
+| `JSKELET_S3_SESSION_TOKEN` | S3 PutObject | — | Optional, for temporary credentials |
+| `JSKELET_S3_REGION` | `logs.s3` / asset upload | `auto` (logs) | Logs default to `auto`; asset upload uses it when `AWS_REGION` is unset |
+| `JSKELET_S3_API_URL` | `logs.s3` / asset upload | — | S3-compatible endpoint |
 | `JSKELET_CLOUDFLARE_KEY` | Cloudflare cache surface | — | API token. Until it is set, CDN purging and edge analytics stay off; it overrides `apiToken` in the config. The token is never returned in a response. [06](./06-caching.md) |
 | `JSKELET_CLOUDFLARE_ZONE_ID` | Cloudflare cache surface | — | Zone identifier. No Cloudflare endpoint is called unless it is set alongside the token |
 | `JSKELET_CLOUDFLARE_HOSTNAME` | Cloudflare cache surface | — | The root for purge URLs. Required when the panel is opened over an internal address |

package/docs/en/08-build.md

@@ -20,6 +20,7 @@ build is in [09-dev-tools.md](./09-dev-tools.md).
 5. Images         if config.images !== false, not watch, and sharp is installed
 6. Manifest       .jskelet/manifest.json
 7. Precompress    if not watch
+8. Assets upload  if not watch (logs `skipped (reason)` when off)
 ```
 
 Template compilation finishes **before** asset scanning; there is no parse on
@@ -30,9 +31,11 @@ The order is not arbitrary:
 
 - **CSS comes after the icon sprite.** The sprite is an asset and produces no
   classes, but it does give a manifest key.
-- **Precompress is last:** everything that gets compressed must already be
-  produced.
+- **Precompress runs just before upload:** the origin still gets `.br`/`.gz`;
+  the S3 step copies only the raw files.
 - **Images never run on a watch pass:** re-encoding with `sharp` is expensive.
+- **Assets upload never runs on watch:** only production `jskelet build`; when
+  off the step still prints (`skipped (no JSKELET_ASSETS_BUCKET)`, etc.).
 
 Tasks only run if the relevant configuration exists. A project that does not
 define any fonts never sees the font step; this is the build-side counterpart of
@@ -78,9 +81,26 @@ They are passed to templates automatically; in server code,
 ```
 
 - `asset(name)` returns the hashed URL if it is in the manifest, otherwise
-  `/assets/<name>`.
+  `/assets/<name>`. When `build.assets.prefix` / `JSKELET_ASSET_PREFIX` is set,
+  that relative path is prefixed with the CDN origin (the on-disk manifest stays
+  relative).
 - `hasAsset(name)` tells you whether it is in the manifest.
 
+### CDN prefix and S3 upload
+
+Off by default. When enabled:
+
+1. A production build PutObjects files under `public/assets/` (and any other
+   directories in `include`) to S3.
+2. At runtime `asset()` / optimised images emit absolute CDN URLs via
+   `JSKELET_ASSET_PREFIX`. When the entry script is on the CDN, esbuild chunks
+   resolve relatively on the same host.
+
+Credentials: `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` first, else
+`JSKELET_S3_*`. Bucket: `JSKELET_ASSETS_BUCKET`. Config reference:
+[07-configuration.md](./07-configuration.md#build). Deploy notes:
+[10-deployment.md](./10-deployment.md).
+
 If the build has not run, the application still comes up: `hasAsset()` is false
 and the layout never emits the stylesheet and script tags. When `jskelet build`
 is forgotten you get an unstyled but working page instead of an error. If the

package/docs/en/10-deployment.md

@@ -52,7 +52,28 @@ considering in production:
 | `PREWARM_MAX` | Depends on site size | Number of pages warmed at startup |
 | `PREWARM_INTERVAL_SECONDS` | `0` or a long value | If you want to keep never-visited pages warm |
 | `DEV_GATE` + `DEV_TOKEN` | Staging only | Hides an environment that is not public yet. The token alone does not lock the site |
-| `JSKELET_S3_*` | If you write access logs to S3 | Bucket + credentials; details in [07](./07-configuration.md) |
+| `JSKELET_S3_*` / `AWS_*` | If you write access logs or assets to S3 | Credentials; on AWS, `AWS_ACCESS_KEY_ID` etc. are enough. Details in [07](./07-configuration.md) |
+| `JSKELET_ASSETS_BUCKET` | If you publish hashed assets to S3/CloudFront | PutObject at the end of production `jskelet build`; `JSKELET_ASSET_PREFIX` makes HTML emit CDN URLs |
+
+### Publishing assets to S3 / CloudFront
+
+Off by default. In CI or a production build environment:
+
+```bash
+JSKELET_ASSETS_BUCKET=my-app-assets          # or my-app-assets/static
+JSKELET_ASSET_PREFIX=https://dxxxx.cloudfront.net
+AWS_REGION=eu-central-1
+AWS_ACCESS_KEY_ID=…
+AWS_SECRET_ACCESS_KEY=…
+# for temporary credentials:
+# AWS_SESSION_TOKEN=…
+```
+
+When `jskelet build` finishes, files under `public/assets/` (and any other
+`include` directories) are copied to S3; origin copies remain. If the bucket or
+credentials are missing, the step logs `skipped (…)` with the reason and the
+build continues. Watch / `jskelet dev` never upload. If you use CSP, add the CDN
+origin to `script-src` / `style-src` / `img-src` and to `preconnect`.
 
 When a file or S3 sink is enabled in production, the HTTP access log middleware
 mounts automatically (if `http` is in `logs.kinds`). The admin panel ring is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jskelet",
-  "version": "0.6.7",
+  "version": "0.6.9",
   "description": "A framework that feels like no framework: Express 5 + build-time .jsk SSR (optional EJS peer), vanilla JS islands, Tailwind v4 and an in-process HTML TTL cache.",
   "type": "module",
   "license": "MIT",

package/src/build/build.mjs

@@ -1,11 +1,12 @@
 /**
  * Tek build girişi: fontlar → ikon sprite → CSS → client JS → görseller →
- * manifest → precompress.
+ * manifest → precompress → (opsiyonel) S3 asset upload.
  *
  * Sıra rastgele değil. CSS Tailwind için şablonları tarar, bu yüzden ikon
  * sprite'ından sonra gelir (sprite bir varlık, sınıf üretmez ama manifest
- * anahtarı verir). Precompress en sonda: sıkıştırılacak her şey üretilmiş
- * olmalı.
+ * anahtarı verir). Precompress upload'tan önce: origin hâlâ `.br` üretir;
+ * S3 adımı ham dosyaları kopyalar. Upload yalnızca `build.assets.upload`
+ * açıksa ve watch değilse çalışır.
  *
  * Görevler yalnızca ilgili yapılandırma varsa çalışır. Font tanımlamayan bir
  * proje font adımını hiç görmez; bu, "framework her projeye kendi
@@ -108,6 +109,14 @@ writeManifest(manifest);
 if (!watch) {
   const { precompressAssets } = await import("./tasks/precompress.mjs");
   await task("Precompress", precompressAssets);
+
+  // Her production build'de satır görünür; kapalıysa `skipped (sebep)`.
+  // CDN'e basılacak dosyalar precompress'ten sonra hazır; `.br`/`.gz` yüklenmez.
+  {
+    const { uploadAssets } = await import("./tasks/assets-upload.mjs");
+    await task("Assets upload", () => uploadAssets(config));
+  }
+
   log.section("output");
   for (const row of manifestRows()) log.line(row);
 }

package/src/build/tasks/assets-upload.mjs

@@ -0,0 +1,190 @@
+/**
+ * Production build sonunda hash'li varlıkları S3'e PutObject ile kopyalar.
+ *
+ * Watch turunda çalışmaz (çağıran sorumlu). Credential env'den gelir
+ * (`AWS_*` önce, `JSKELET_S3_*` yedek). Bucket / credential yoksa veya upload
+ * kapalıysa adım yine görünür: `skipped (…)` ile sebep basılır, build düşmez.
+ *
+ * `.br` / `.gz` kardeşleri yüklenmez: edge kendi sıkıştırmasını yapsın;
+ * origin precompress Express için kalır.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { readS3CredentialsFromEnv } from "../../config/index.js";
+import { putObject } from "../../server/logs/s3-put.js";
+import * as log from "../../log.mjs";
+import { paths } from "../paths.mjs";
+
+const CONCURRENCY = 8;
+
+/** @type {Record<string, string>} */
+const MIME = {
+  ".js": "application/javascript; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".gif": "image/gif",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".json": "application/json",
+  ".map": "application/json",
+  ".txt": "text/plain; charset=utf-8",
+};
+
+/**
+ * @param {string} filePath
+ * @returns {string}
+ */
+export function contentTypeFor(filePath) {
+  const ext = path.extname(filePath).toLowerCase();
+  return MIME[ext] ?? "application/octet-stream";
+}
+
+/**
+ * @param {string} dir
+ * @returns {string[]} Mutlak dosya yolları
+ */
+export function listFilesRecursive(dir) {
+  if (!fs.existsSync(dir)) return [];
+
+  /** @type {string[]} */
+  const out = [];
+  const walk = (current) => {
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const full = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        walk(full);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      // Precompress kardeşleri origin'e özel; S3'e basma.
+      if (entry.name.endsWith(".br") || entry.name.endsWith(".gz")) continue;
+      out.push(full);
+    }
+  };
+  walk(dir);
+  return out;
+}
+
+/**
+ * `include` adını `public/` altı mutlak dizine çevirir.
+ *
+ * @param {string} name
+ * @returns {string | null}
+ */
+function resolveIncludeDir(name) {
+  if (name === "assets") return paths.assets;
+  if (name === "fonts") return paths.fonts;
+  if (!name || name.includes("..") || path.isAbsolute(name)) return null;
+  return path.join(paths.public, name);
+}
+
+/**
+ * Upload yapılmayacaksa kısa sebep; yapılacaksa `null`.
+ *
+ * @param {import('../../config/index.js').ResolvedConfig} config
+ * @returns {string | null}
+ */
+export function assetsUploadSkipReason(config) {
+  const upload = config.build?.assets?.upload;
+
+  if (!upload?.enabled) {
+    // Bucket yoksa asıl eksik env'i söyle — `enabled: false` çoğu zaman
+    // bucket tanımlanmadığı için dolaylıdır.
+    if (!upload?.bucket) return "no JSKELET_ASSETS_BUCKET";
+    return "build.assets.upload.enabled is false";
+  }
+
+  if (!upload.bucket) return "no JSKELET_ASSETS_BUCKET";
+
+  if (!readS3CredentialsFromEnv()) return "credentials missing";
+
+  return null;
+}
+
+/**
+ * @param {import('../../config/index.js').ResolvedConfig} config
+ * @param {{ put?: typeof putObject }} [options]
+ * @returns {Promise<void>}
+ */
+export async function uploadAssets(config, options = {}) {
+  const reason = assetsUploadSkipReason(config);
+  if (reason) {
+    log.detail(`skipped (${reason})`);
+    return;
+  }
+
+  const upload = config.build.assets.upload;
+  const credentials = readS3CredentialsFromEnv();
+  // skipReason null iken credential ve bucket vardır; TS/akış için daralt.
+  if (!upload.bucket || !credentials) {
+    log.detail("skipped (credentials missing)");
+    return;
+  }
+
+  const put = options.put ?? putObject;
+  const keyPrefix = (upload.keyPrefix || "").replace(/^\/+/, "");
+
+  /** @type {{ file: string, key: string }[]} */
+  const jobs = [];
+  for (const name of upload.include) {
+    const dir = resolveIncludeDir(name);
+    if (!dir) {
+      console.warn(`[assets] upload.include "${name}" is invalid, skipping`);
+      continue;
+    }
+    for (const file of listFilesRecursive(dir)) {
+      const relative = path
+        .relative(paths.public, file)
+        .split(path.sep)
+        .join("/");
+      if (relative.startsWith("..")) continue;
+      jobs.push({ file, key: `${keyPrefix}${relative}` });
+    }
+  }
+
+  if (!jobs.length) {
+    log.detail("0 files");
+    return;
+  }
+
+  let uploaded = 0;
+  let index = 0;
+
+  /** @returns {Promise<void>} */
+  const worker = async () => {
+    while (index < jobs.length) {
+      const job = jobs[index++];
+      const body = fs.readFileSync(job.file);
+      await put({
+        bucket: upload.bucket,
+        key: job.key,
+        body,
+        region: upload.region,
+        endpoint: upload.endpoint,
+        credentials,
+        contentType: contentTypeFor(job.file),
+        cacheControl: upload.cacheControl,
+      });
+      uploaded += 1;
+    }
+  };
+
+  const workers = Array.from(
+    { length: Math.min(CONCURRENCY, jobs.length) },
+    () => worker(),
+  );
+  await Promise.all(workers);
+
+  const target = `${upload.bucket}/${keyPrefix}`.replace(/\/+/g, "/");
+  const via = upload.endpoint ? ` @ ${upload.endpoint}` : "";
+  log.detail(`${uploaded} → s3://${target}${via}`);
+}

package/src/config/defaults.js

@@ -471,10 +471,14 @@ export const DEFAULT_SECURITY = {
 };
 
 /**
- * Client bundle (esbuild) ayarları.
+ * Client bundle (esbuild) ayarları + opsiyonel CDN prefix / S3 upload.
  *
  * `groups` / `chunkGroup` esbuild'in native manualChunks'ı olmadığı için
  * framework plugin'i ile uygulanır — ayrıntı `src/build/chunk-groups.mjs`.
+ *
+ * `assets.prefix` HTML'deki `asset()` URL'lerine eklenir (manifest diskte
+ * göreli kalır). `assets.upload` production build sonunda `public/` altındaki
+ * seçili dizinleri S3'e PutObject ile kopyalar; credential env'den okunur.
  */
 export const DEFAULT_BUILD = {
   client: {
@@ -493,6 +497,21 @@ export const DEFAULT_BUILD = {
      */
     chunkGroup: null,
   },
+  assets: {
+    /** CDN / CloudFront origin; sonunda `/` yok. Env: `JSKELET_ASSET_PREFIX`. */
+    prefix: "",
+    upload: {
+      enabled: false,
+      bucket: null,
+      /** Nesne anahtarı öneki (`bucket/path` split'inden veya config). */
+      keyPrefix: "",
+      region: "us-east-1",
+      endpoint: null,
+      /** `public/` altı dizin adları. */
+      include: /** @type {string[]} */ (["assets"]),
+      cacheControl: "public, max-age=31536000, immutable",
+    },
+  },
 };
 
 /**

package/src/config/index.js

@@ -161,7 +161,7 @@ const CONFIG_FILE = "jskelet.config.mjs";
  * @property {{ scan?: string[], dir: string } | false} icons
  * @property {ImagesConfig | false} images
  * @property {string[]} clientEnv Client bundle'a gömülecek env anahtarları.
- * @property {BuildConfig} build Client bundling (esbuild splitting / chunk groups).
+ * @property {BuildConfig} build Client bundling + CDN prefix / S3 asset upload.
  */
 
 /**
@@ -170,8 +170,22 @@ const CONFIG_FILE = "jskelet.config.mjs";
  * @property {Record<string, string[]>} groups
  * @property {((id: string) => string | null | undefined) | null} chunkGroup
  *
+ * @typedef {object} BuildAssetsUploadConfig
+ * @property {boolean} enabled
+ * @property {string | null} bucket
+ * @property {string} keyPrefix
+ * @property {string} region
+ * @property {string | null} endpoint
+ * @property {string[]} include
+ * @property {string} cacheControl
+ *
+ * @typedef {object} BuildAssetsConfig
+ * @property {string} prefix CDN origin (`JSKELET_ASSET_PREFIX`); sonunda `/` yok.
+ * @property {BuildAssetsUploadConfig} upload
+ *
  * @typedef {object} BuildConfig
  * @property {BuildClientConfig} client
+ * @property {BuildAssetsConfig} assets
  */
 
 /**
@@ -514,19 +528,28 @@ function envText(value) {
 }
 
 /**
+ * S3 imza credential'ları. AWS deploy'da standart env önce gelir; R2/MinIO
+ * için `JSKELET_S3_*` yedek. IAM instance/task role (IMDS) desteklenmez —
+ * CI'da `configure-aws-credentials` gibi araçlar zaten `AWS_*` basar.
+ *
  * @returns {{ accessKeyId: string, secretAccessKey: string,
  *   sessionToken: string | null } | null}
  */
 export function readS3CredentialsFromEnv() {
-  const accessKeyId = envText(process.env.JSKELET_S3_ACCESS_KEY_ID);
+  const accessKeyId =
+    envText(process.env.AWS_ACCESS_KEY_ID) ??
+    envText(process.env.JSKELET_S3_ACCESS_KEY_ID);
   const secretAccessKey =
+    envText(process.env.AWS_SECRET_ACCESS_KEY) ??
     envText(process.env.JSKELET_S3_SECRET_ACCESS_KEY) ??
     envText(process.env.JSKELET_S3_ACCESS_SECRET);
   if (!accessKeyId || !secretAccessKey) return null;
   return {
     accessKeyId,
     secretAccessKey,
-    sessionToken: envText(process.env.JSKELET_S3_SESSION_TOKEN),
+    sessionToken:
+      envText(process.env.AWS_SESSION_TOKEN) ??
+      envText(process.env.JSKELET_S3_SESSION_TOKEN),
   };
 }
 
@@ -1152,7 +1175,122 @@ function normalizeSecurity(raw) {
 }
 
 /**
- * Client build ayarları (`build.client`). Bozuk tipler uyarıyla varsayılana düşer.
+ * @returns {BuildClientConfig}
+ */
+function defaultBuildClient() {
+  return {
+    splitting: DEFAULT_BUILD.client.splitting,
+    groups: {},
+    chunkGroup: null,
+  };
+}
+
+/**
+ * CDN prefix + S3 upload (`build.assets`). Credential config'e yazılmaz.
+ *
+ * @param {unknown} raw
+ * @returns {BuildAssetsConfig}
+ */
+export function normalizeBuildAssets(raw) {
+  const source =
+    raw != null && typeof raw === "object" && !Array.isArray(raw)
+      ? /** @type {Record<string, any>} */ (raw)
+      : {};
+
+  if (raw != null && (typeof raw !== "object" || Array.isArray(raw))) {
+    console.warn("[config] build.assets must be an object, ignoring it");
+  }
+
+  const envPrefix = envText(process.env.JSKELET_ASSET_PREFIX);
+  const configPrefix =
+    typeof source.prefix === "string" ? source.prefix.trim() : "";
+  const prefix = (envPrefix ?? configPrefix).replace(/\/+$/, "");
+
+  const uploadRaw =
+    source.upload != null &&
+    typeof source.upload === "object" &&
+    !Array.isArray(source.upload)
+      ? /** @type {Record<string, any>} */ (source.upload)
+      : {};
+
+  if (
+    source.upload != null &&
+    (typeof source.upload !== "object" || Array.isArray(source.upload))
+  ) {
+    console.warn("[config] build.assets.upload must be an object, ignoring it");
+  }
+
+  const envBucket = envText(process.env.JSKELET_ASSETS_BUCKET);
+  const bucketPath = splitS3BucketPath(
+    envBucket ?? envText(uploadRaw.bucket),
+  );
+
+  const configKeyPrefix =
+    typeof uploadRaw.keyPrefix === "string" && uploadRaw.keyPrefix
+      ? uploadRaw.keyPrefix.endsWith("/")
+        ? uploadRaw.keyPrefix
+        : `${uploadRaw.keyPrefix}/`
+      : typeof uploadRaw.prefix === "string" && uploadRaw.prefix
+        ? uploadRaw.prefix.endsWith("/")
+          ? uploadRaw.prefix
+          : `${uploadRaw.prefix}/`
+        : DEFAULT_BUILD.assets.upload.keyPrefix;
+
+  const endpoint =
+    envText(process.env.AWS_ENDPOINT_URL) ??
+    envText(process.env.JSKELET_S3_API_URL) ??
+    envText(uploadRaw.endpoint);
+
+  // Gerçek AWS'te region imza için gerekir; custom endpoint'te `auto` yaygın.
+  const region =
+    envText(uploadRaw.region) ??
+    envText(process.env.AWS_REGION) ??
+    envText(process.env.AWS_DEFAULT_REGION) ??
+    envText(process.env.JSKELET_S3_REGION) ??
+    (endpoint ? "auto" : DEFAULT_BUILD.assets.upload.region);
+
+  /** @type {string[]} */
+  let include = [...DEFAULT_BUILD.assets.upload.include];
+  if (uploadRaw.include != null) {
+    const list = asArray(uploadRaw.include, "build.assets.upload.include")
+      .filter((entry) => typeof entry === "string" && entry.trim())
+      .map((entry) => String(entry).trim().replace(/^\/+|\/+$/g, ""));
+    if (list.length) include = [...new Set(list)];
+    else {
+      console.warn(
+        "[config] build.assets.upload.include has no valid entries, using defaults",
+      );
+    }
+  }
+
+  const cacheControl =
+    typeof uploadRaw.cacheControl === "string" && uploadRaw.cacheControl.trim()
+      ? uploadRaw.cacheControl.trim()
+      : DEFAULT_BUILD.assets.upload.cacheControl;
+
+  // `JSKELET_ASSETS_BUCKET` doluysa config'te `enabled` unutulmuş olsa bile aç.
+  // Açık `enabled: false` ezer.
+  const enabled =
+    uploadRaw.enabled === true ||
+    (uploadRaw.enabled !== false && Boolean(bucketPath.bucket));
+
+  return {
+    prefix,
+    upload: {
+      enabled,
+      bucket: bucketPath.bucket,
+      keyPrefix: bucketPath.prefix ?? configKeyPrefix,
+      region,
+      endpoint,
+      include,
+      cacheControl,
+    },
+  };
+}
+
+/**
+ * Client build ayarları (`build.client` + `build.assets`). Bozuk tipler
+ * uyarıyla varsayılana düşer.
  *
  * @param {unknown} raw
  * @returns {BuildConfig}
@@ -1160,47 +1298,30 @@ function normalizeSecurity(raw) {
 export function normalizeBuild(raw) {
   if (raw == null) {
     return {
-      client: {
-        splitting: DEFAULT_BUILD.client.splitting,
-        groups: {},
-        chunkGroup: null,
-      },
+      client: defaultBuildClient(),
+      assets: normalizeBuildAssets(null),
     };
   }
 
   if (typeof raw !== "object" || Array.isArray(raw)) {
     console.warn("[config] build must be an object, ignoring it");
     return {
-      client: {
-        splitting: DEFAULT_BUILD.client.splitting,
-        groups: {},
-        chunkGroup: null,
-      },
+      client: defaultBuildClient(),
+      assets: normalizeBuildAssets(null),
     };
   }
 
   const source = /** @type {Record<string, any>} */ (raw);
+  const assets = normalizeBuildAssets(source.assets);
   const clientRaw = source.client;
 
   if (clientRaw == null) {
-    return {
-      client: {
-        splitting: DEFAULT_BUILD.client.splitting,
-        groups: {},
-        chunkGroup: null,
-      },
-    };
+    return { client: defaultBuildClient(), assets };
   }
 
   if (typeof clientRaw !== "object" || Array.isArray(clientRaw)) {
     console.warn("[config] build.client must be an object, ignoring it");
-    return {
-      client: {
-        splitting: DEFAULT_BUILD.client.splitting,
-        groups: {},
-        chunkGroup: null,
-      },
-    };
+    return { client: defaultBuildClient(), assets };
   }
 
   const client = /** @type {Record<string, any>} */ (clientRaw);
@@ -1250,7 +1371,7 @@ export function normalizeBuild(raw) {
     );
   }
 
-  return { client: { splitting, groups, chunkGroup } };
+  return { client: { splitting, groups, chunkGroup }, assets };
 }
 
 /**

package/src/index.js

@@ -43,7 +43,13 @@ export {
   writeSharedCookie,
 } from "./http/shared-cookie.js";
 export { reportUpstreamFailure } from "./server/upstream-tracking.js";
-export { asset, hasAsset, optimizedImage, getSpriteIds } from "./server/assets.js";
+export {
+  asset,
+  hasAsset,
+  optimizedImage,
+  getSpriteIds,
+  applyAssetPrefix,
+} from "./server/assets.js";
 export { remoteImageUrl, parseAllowedRemoteUrl } from "./server/image-optimizer.js";
 export {
   ImageResponse,

package/src/server/assets.js

@@ -5,6 +5,10 @@
  * döner ve `hasAsset()` false olur; layout stylesheet/script etiketlerini hiç
  * basmaz. Böylece `jskelet build` unutulduğunda hata yerine stilsiz ama
  * çalışan bir sayfa görürsünüz.
+ *
+ * `build.assets.prefix` / `JSKELET_ASSET_PREFIX` doluysa HTML'e basılan
+ * URL'lere CDN origin eklenir; manifest diskte göreli kalır (çok ortamlı
+ * tek artifact). Dosya sistemi okumaları (`getSpriteIds`) göreli yolu kullanır.
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -44,12 +48,45 @@ function state() {
   return cached;
 }
 
+/**
+ * CDN prefix + göreli asset yolu. Zaten mutlak (`https:…`) URL'lere dokunmaz.
+ *
+ * @param {string} prefix Sonunda `/` olmadan (normalize edilmiş).
+ * @param {string} url
+ * @returns {string}
+ */
+export function applyAssetPrefix(prefix, url) {
+  if (!prefix || !url) return url;
+  if (/^[a-z][a-z0-9+.-]*:/i.test(url)) return url;
+  const pathPart = url.startsWith("/") ? url : `/${url}`;
+  return `${prefix.replace(/\/+$/, "")}${pathPart}`;
+}
+
+/** @returns {string} */
+function assetPrefix() {
+  try {
+    return getConfig().build?.assets?.prefix ?? "";
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Manifest'teki göreli yol (prefix yok) — disk okuma için.
+ *
+ * @param {string} name
+ * @returns {string}
+ */
+function assetPath(name) {
+  return state().manifest[name] ?? `/assets/${name}`;
+}
+
 /**
  * @param {string} name Örn. "app.css", "main.js", "sprite.svg"
  * @returns {string}
  */
 export function asset(name) {
-  return state().manifest[name] ?? `/assets/${name}`;
+  return applyAssetPrefix(assetPrefix(), assetPath(name));
 }
 
 /**
@@ -113,7 +150,20 @@ export function optimizedImage(src) {
     }
   }
 
-  return src ? images[src] : undefined;
+  if (!src) return undefined;
+  const entry = images[src];
+  if (!entry) return undefined;
+
+  const prefix = assetPrefix();
+  if (!prefix) return entry;
+
+  return {
+    ...entry,
+    variants: entry.variants.map((variant) => ({
+      ...variant,
+      url: applyAssetPrefix(prefix, variant.url),
+    })),
+  };
 }
 
 /** @type {{ url: string, ids: Set<string> } | null} */
@@ -128,20 +178,21 @@ let spriteIds = null;
  * @returns {Set<string>}
  */
 export function getSpriteIds() {
-  const url = asset("sprite.svg");
-  if (spriteIds?.url === url) return spriteIds.ids;
+  // Disk yolu göreli olmalı; CDN prefix dosya sisteminde yok.
+  const relative = assetPath("sprite.svg");
+  if (spriteIds?.url === relative) return spriteIds.ids;
 
   /** @type {Set<string>} */
   const ids = new Set();
 
   try {
-    const file = path.join(getConfig().dirs.public, url.replace(/^\//, ""));
+    const file = path.join(getConfig().dirs.public, relative.replace(/^\//, ""));
     const svg = fs.readFileSync(file, "utf8");
     for (const match of svg.matchAll(/<symbol id="([^"]+)"/g)) ids.add(match[1]);
   } catch {
     // Sprite okunamazsa uyarı üretilmez; asıl akış etkilenmez.
   }
 
-  spriteIds = { url, ids };
+  spriteIds = { url: relative, ids };
   return ids;
 }

package/src/server/logs/pipeline.js

@@ -80,7 +80,7 @@ export async function configureLogs(config) {
       );
     } else if (!credentials) {
       console.warn(
-        "[logs] s3.enabled but credentials missing — set JSKELET_S3_ACCESS_KEY_ID and JSKELET_S3_SECRET_ACCESS_KEY",
+        "[logs] s3.enabled but credentials missing — set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or JSKELET_S3_*",
       );
     } else {
       const region = logs.s3.region || "auto";

package/src/server/logs/s3-put.js

@@ -2,10 +2,9 @@
  * Minimal S3 PutObject — yalnızca SigV4 + `fetch`.
  *
  * `@aws-sdk/client-s3` taşınmıyor: tek operasyon için SDK'nın maliyeti ve
- * peer yüzeyi gereksiz. Credential zinciri env'den okunur
- * (`JSKELET_S3_ACCESS_KEY_ID` / `JSKELET_S3_SECRET_ACCESS_KEY` /
- * `JSKELET_S3_SESSION_TOKEN`); IAM role / instance metadata yok —
- * container'a key vermeyen kurulumlar için sink zaten açılışta no-op'a düşer.
+ * peer yüzeyi gereksiz. Credential zinciri env'den okunur (`AWS_*` önce,
+ * sonra `JSKELET_S3_*`); IAM role / instance metadata yok — CI'da
+ * `configure-aws-credentials` gibi araçlar key basar.
  */
 import crypto from "node:crypto";
 
@@ -15,7 +14,7 @@ import crypto from "node:crypto";
  *
  * @typedef {{ bucket: string, key: string, body: string | Buffer,
  *   region: string, endpoint?: string | null, credentials: AwsCredentials,
- *   now?: Date }} PutObjectInput
+ *   contentType?: string, cacheControl?: string | null, now?: Date }} PutObjectInput
  */
 
 /**
@@ -145,12 +144,17 @@ export function buildSignedPutObject(input) {
   /** @type {Record<string, string>} */
   const headers = {
     host,
-    "content-type": "application/x-ndjson",
+    // Log sink varsayılanı; asset upload `contentType` geçirir.
+    "content-type": input.contentType ?? "application/x-ndjson",
     "content-length": String(body.length),
     "x-amz-content-sha256": payloadHash,
     "x-amz-date": amzDate,
   };
 
+  if (input.cacheControl) {
+    headers["cache-control"] = input.cacheControl;
+  }
+
   if (input.credentials.sessionToken) {
     headers["x-amz-security-token"] = input.credentials.sessionToken;
   }

package/types/config/defaults.d.ts

@@ -421,10 +421,14 @@ export declare const DEFAULT_SECURITY: {
     };
 };
 /**
- * Client bundle (esbuild) ayarları.
+ * Client bundle (esbuild) ayarları + opsiyonel CDN prefix / S3 upload.
  *
  * `groups` / `chunkGroup` esbuild'in native manualChunks'ı olmadığı için
  * framework plugin'i ile uygulanır — ayrıntı `src/build/chunk-groups.mjs`.
+ *
+ * `assets.prefix` HTML'deki `asset()` URL'lerine eklenir (manifest diskte
+ * göreli kalır). `assets.upload` production build sonunda `public/` altındaki
+ * seçili dizinleri S3'e PutObject ile kopyalar; credential env'den okunur.
  */
 export declare const DEFAULT_BUILD: {
     client: {
@@ -443,6 +447,21 @@ export declare const DEFAULT_BUILD: {
          */
         chunkGroup: ((id: string) => string | null | undefined) | null;
     };
+    assets: {
+        /** CDN / CloudFront origin; sonunda `/` yok. Env: `JSKELET_ASSET_PREFIX`. */
+        prefix: string;
+        upload: {
+            enabled: boolean;
+            bucket: null;
+            /** Nesne anahtarı öneki (`bucket/path` split'inden veya config). */
+            keyPrefix: string;
+            region: string;
+            endpoint: null;
+            /** `public/` altı dizin adları. */
+            include: string[];
+            cacheControl: string;
+        };
+    };
 };
 /**
  * Build-zamanı görsel adımı + opsiyonel runtime uzak görsel proxy.

package/types/config/index.d.ts

@@ -221,7 +221,7 @@ export type ResolvedConfig = {
      */
     clientEnv: string[];
     /**
-     * Client bundling (esbuild splitting / chunk groups).
+     * Client bundling + CDN prefix / S3 asset upload.
      */
     build: BuildConfig;
 };
@@ -230,8 +230,25 @@ export type BuildClientConfig = {
     groups: Record<string, string[]>;
     chunkGroup: ((id: string) => string | null | undefined) | null;
 };
+export type BuildAssetsUploadConfig = {
+    enabled: boolean;
+    bucket: string | null;
+    keyPrefix: string;
+    region: string;
+    endpoint: string | null;
+    include: string[];
+    cacheControl: string;
+};
+export type BuildAssetsConfig = {
+    /**
+     * CDN origin (`JSKELET_ASSET_PREFIX`); sonunda `/` yok.
+     */
+    prefix: string;
+    upload: BuildAssetsUploadConfig;
+};
 export type BuildConfig = {
     client: BuildClientConfig;
+    assets: BuildAssetsConfig;
 };
 export type ImagesRemoteConfig = {
     enabled: boolean;
@@ -262,6 +279,10 @@ export declare function splitS3BucketPath(value: string | null): {
     prefix: string | null;
 };
 /**
+ * S3 imza credential'ları. AWS deploy'da standart env önce gelir; R2/MinIO
+ * için `JSKELET_S3_*` yedek. IAM instance/task role (IMDS) desteklenmez —
+ * CI'da `configure-aws-credentials` gibi araçlar zaten `AWS_*` basar.
+ *
  * @returns {{ accessKeyId: string, secretAccessKey: string,
  *   sessionToken: string | null } | null}
  */
@@ -292,7 +313,15 @@ export type SecurityConfig = {
     };
 };
 /**
- * Client build ayarları (`build.client`). Bozuk tipler uyarıyla varsayılana düşer.
+ * CDN prefix + S3 upload (`build.assets`). Credential config'e yazılmaz.
+ *
+ * @param {unknown} raw
+ * @returns {BuildAssetsConfig}
+ */
+export declare function normalizeBuildAssets(raw: unknown): BuildAssetsConfig;
+/**
+ * Client build ayarları (`build.client` + `build.assets`). Bozuk tipler
+ * uyarıyla varsayılana düşer.
  *
  * @param {unknown} raw
  * @returns {BuildConfig}

package/types/index.d.ts

@@ -13,7 +13,7 @@ export { cache, withRequestCache } from "./http/request-cache.js";
 export { clearCookie, getSignedCookie, parseCookies, randomToken, safeEqual, serializeCookie, setCookie, setSignedCookie, } from "./http/cookies.js";
 export { clearSharedCookie, requestIsHttps, resolveSharedCookieDomain, SHARED_COOKIE_WARN_BYTES, writeSharedCookie, } from "./http/shared-cookie.js";
 export { reportUpstreamFailure } from "./server/upstream-tracking.js";
-export { asset, hasAsset, optimizedImage, getSpriteIds } from "./server/assets.js";
+export { asset, hasAsset, optimizedImage, getSpriteIds, applyAssetPrefix, } from "./server/assets.js";
 export { remoteImageUrl, parseAllowedRemoteUrl } from "./server/image-optimizer.js";
 export { ImageResponse, OG_SIZE, buildOgSvg, escapeXml, ogHandler, ogImage, sendOgImage, wrapText, } from "./server/og-image.js";
 export { headHints } from "./server/head-hints.js";

package/types/server/assets.d.ts

@@ -1,3 +1,11 @@
+/**
+ * CDN prefix + göreli asset yolu. Zaten mutlak (`https:…`) URL'lere dokunmaz.
+ *
+ * @param {string} prefix Sonunda `/` olmadan (normalize edilmiş).
+ * @param {string} url
+ * @returns {string}
+ */
+export declare function applyAssetPrefix(prefix: string, url: string): string;
 /**
  * @param {string} name Örn. "app.css", "main.js", "sprite.svg"
  * @returns {string}

package/types/server/logs/s3-put.d.ts

@@ -10,6 +10,8 @@ export type PutObjectInput = {
     region: string;
     endpoint?: string | null;
     credentials: AwsCredentials;
+    contentType?: string;
+    cacheControl?: string | null;
     now?: Date;
 };
 /**