jskelet 0.6.8 → 0.6.10

package/CHANGELOG.md

@@ -10,14 +10,17 @@ one is listed under a **Breaking** heading.
 
 ### Added
 
-- Optional CDN asset publishing: `build.assets.prefix` /
-  `JSKELET_ASSET_PREFIX` prefixes `asset()` and optimised image URLs (manifest
-  stays relative on disk). When `JSKELET_ASSETS_BUCKET` (or
-  `build.assets.upload`) is set, production `jskelet build` PutObjects
-  `public/assets/` (and optional `include` dirs) to S3 after precompress.
-  Credentials prefer standard `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` /
-  `AWS_SESSION_TOKEN`, then `JSKELET_S3_*`. Missing bucket or credentials fail
-  the build; watch mode never uploads. `.br` / `.gz` siblings are skipped.
+- Optional CDN asset publishing via `build.assets`: `prefix` rewrites
+  `asset()` / optimised image URLs (manifest stays relative on disk);
+  `upload.bucket` / `keyPrefix` / `region` / `endpoint` come from config only.
+  Production `jskelet build` PutObjects `public/assets/` (and optional
+  `include` dirs) after precompress. Only credentials are read from env
+  (`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, then
+  `JSKELET_S3_*`). The Assets upload step always appears on production builds;
+  when off it logs a one-line reason (`skipped (no build.assets.upload.bucket)`,
+  `skipped (credentials missing)`, …). A URL in `upload.bucket` is rejected
+  with a warning (CDN origin belongs in `prefix`). Watch mode never uploads.
+  `.br` / `.gz` siblings are skipped.
 
 ### Changed
 

package/docs/07-yapilandirma.md

@@ -96,10 +96,11 @@ export default {
       groups: { charts: ["chart.js"] },
     },
     assets: {
-      prefix: process.env.JSKELET_ASSET_PREFIX,
+      prefix: "https://static.ornek.com/js",
       upload: {
-        enabled: Boolean(process.env.JSKELET_ASSETS_BUCKET),
-        bucket: process.env.JSKELET_ASSETS_BUCKET,
+        bucket: "static.ornek.com", // S3 bucket adı (noktalı olabilir)
+        keyPrefix: "js",
+        region: "eu-central-1",
       },
     },
   },
@@ -628,19 +629,21 @@ değişmez** — asset'ler origin'den servis edilir.
 
 | Alan | Tip | Varsayılan | Anlamı |
 | --- | --- | --- | --- |
-| `assets.prefix` | `string` | `""` | `asset()` / optimize görsel URL öneki (sonunda `/` yok). `JSKELET_ASSET_PREFIX` ezer. Manifest diskte göreli kalır. |
-| `assets.upload.enabled` | `boolean` | `false` | `true` veya `JSKELET_ASSETS_BUCKET` doluysa açılır; açık `false` ezer. |
-| `assets.upload.bucket` | `string \| null` | `null` | Bucket veya `bucket/key/prefix`. `JSKELET_ASSETS_BUCKET` ezer. |
-| `assets.upload.keyPrefix` | `string` | `""` | Yolda verilmediyse nesne anahtarı öneki (`prefix` takma adı da kabul). |
-| `assets.upload.region` | `string` | `us-east-1` | `AWS_REGION` / `AWS_DEFAULT_REGION` / `JSKELET_S3_REGION`; custom endpoint'te varsayılan `auto`. |
-| `assets.upload.endpoint` | `string \| null` | `null` | S3-uyumlu API; `AWS_ENDPOINT_URL` / `JSKELET_S3_API_URL` ezer. |
+| `assets.prefix` | `string` | `""` | CDN origin; `asset()` URL öneki (sonunda `/` yok). Yalnızca config. Manifest diskte göreli kalır. |
+| `assets.upload.enabled` | `boolean` | `false` | `true` veya config'te `bucket` doluysa açılır; açık `false` ezer. |
+| `assets.upload.bucket` | `string \| null` | `null` | **S3 bucket adı** (`static.ornek.com` gibi noktalı adlar geçerli) veya `bucket/key/prefix`. `https://…` şeması kabul edilmez — o `prefix`. |
+| `assets.upload.keyPrefix` | `string` | `""` | Nesne anahtarı öneki; bucket yolunda verilmişse o kazanır (`prefix` takma adı da kabul). |
+| `assets.upload.region` | `string` | `us-east-1` | Config; custom `endpoint` varken varsayılan `auto`. |
+| `assets.upload.endpoint` | `string \| null` | `null` | S3-uyumlu API (R2 / MinIO); config. |
 | `assets.upload.include` | `string[]` | `["assets"]` | `public/` altı dizinler (`assets`, isteğe `fonts`, …). |
 | `assets.upload.cacheControl` | `string` | `public, max-age=31536000, immutable` | PutObject `Cache-Control`. |
 
-Credential config'e yazılmaz. Öncelik: `AWS_ACCESS_KEY_ID` /
-`AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, yoksa `JSKELET_S3_*`. Upload açık
-iken bucket veya credential yoksa **build düşer**. Watch turunda upload yok.
-`.br` / `.gz` yüklenmez. Ayrıntı: [08-build.md](./08-build.md),
+**Yalnızca credential env'den gelir:** `AWS_ACCESS_KEY_ID` /
+`AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` (yoksa `JSKELET_S3_*`). Prefix,
+bucket, region vb. config'te yazılır. Production build'de Assets upload adımı
+her zaman görünür; kapalıysa `skipped (no build.assets.upload.bucket)` /
+`skipped (credentials missing)` gibi tek satır sebep basılır. Watch'ta adım
+yok. `.br` / `.gz` yüklenmez. Ayrıntı: [08-build.md](./08-build.md),
 [10-dagitim.md](./10-dagitim.md).
 
 ```js
@@ -656,10 +659,12 @@ build: {
     },
   },
   assets: {
-    prefix: process.env.JSKELET_ASSET_PREFIX, // https://dxxxx.cloudfront.net
+    // HTML: /assets/app.css → https://static.ornek.com/js/assets/app.css
+    prefix: "https://static.ornek.com/js",
     upload: {
-      enabled: Boolean(process.env.JSKELET_ASSETS_BUCKET),
-      bucket: process.env.JSKELET_ASSETS_BUCKET, // my-bucket veya my-bucket/static
+      bucket: "static.ornek.com", // veya "static.ornek.com/js" → keyPrefix js/
+      keyPrefix: "js",            // S3 key: js/assets/…
+      region: "eu-central-1",
       include: ["assets", "fonts"],
     },
   },
@@ -1227,13 +1232,9 @@ basılmaz.
 | `DEV_GATE` | `devGate` | kapalı | `1` gate'i açar, `0` config'te açık olsa da kapatır. `DEV_TOKEN` tek başına açmaz. [09](./09-dev-araclari.md) |
 | `DEV_TOKEN` | `devGate`, `prewarm` | — | Gate açıkken beklenen sır. Yoksa veya gate kapalıysa site açık kalır. Isıtma, gate açıkken token'ı çerez olarak taşır. [09](./09-dev-araclari.md) |
 | `JSKELET_ADMIN` | `createApp` | — | Ayarlıysa yönetim panelini açar; `0` config'te açık olan paneli kapatır. Env config'i ezer, çünkü panel genelde bir arıza sırasında tek seferlik açılır. [06](./06-cache.md) |
-| `JSKELET_ASSET_PREFIX` | `build.assets.prefix` | — | CDN origin; `asset()` URL'lerine eklenir (sonunda `/` yok) |
-| `JSKELET_ASSETS_BUCKET` | `build.assets.upload` | — | Asset upload hedefi: bucket veya `bucket/prefix`. Credential ile birlikte production build sonunda PutObject |
 | `AWS_ACCESS_KEY_ID` | S3 PutObject | — | Standart AWS imza anahtarı (log + asset upload); `JSKELET_S3_*`'dan önce |
 | `AWS_SECRET_ACCESS_KEY` | S3 PutObject | — | Standart AWS imza sırrı |
 | `AWS_SESSION_TOKEN` | S3 PutObject | — | Geçici credential (OIDC / STS) |
-| `AWS_REGION` / `AWS_DEFAULT_REGION` | `build.assets.upload` | — | Asset upload bölgesi |
-| `AWS_ENDPOINT_URL` | `build.assets.upload` | — | S3-uyumlu endpoint (asset upload) |
 | `JSKELET_LOG_BUCKET` | `logs.s3` | — | Log hedefi: bucket ya da `bucket/prefix` yolu. Credential ile birlikte varsa sink otomatik açılır |
 | `JSKELET_S3_BUCKET` | `logs.s3` | — | `JSKELET_LOG_BUCKET` yoksa bucket; `JSKELET_S3_KEY_PREFIX` ile birleşir |
 | `JSKELET_S3_KEY_PREFIX` | `logs.s3` | — | `JSKELET_S3_BUCKET` ile kullanılır (`bucket/prefix`) |

package/docs/08-build.md

@@ -20,7 +20,7 @@ davranışı burada. Çıktının çalışma anında nasıl servis edildiği
 5. Images         config.images !== false, watch değil ve sharp kurulu ise
 6. Manifest       .jskelet/manifest.json
 7. Precompress    watch değilse
-8. Assets upload  build.assets.upload açıksa (watch değil)
+8. Assets upload  watch değilse (kapalıysa `skipped (sebep)`)
 ```
 
 Şablon derlemesi asset taramasından **önce** biter; istek yolunda parse yoktur.
@@ -34,7 +34,8 @@ Sıra rastgele değil:
 - **Precompress, upload'tan hemen önce:** origin hâlâ `.br`/`.gz` üretir; S3
   adımı yalnızca ham dosyaları kopyalar.
 - **Görseller watch turunda hiç çalışmaz:** `sharp` ile yeniden kodlama pahalı.
-- **Assets upload watch'ta yok:** yalnızca production `jskelet build`.
+- **Assets upload watch'ta yok:** yalnızca production `jskelet build`; kapalıysa
+  yine satır basılır (`skipped (no build.assets.upload.bucket)` vb.).
 
 Görevler yalnızca ilgili yapılandırma varsa çalışır. Font tanımlamayan bir proje
 font adımını hiç görmez; bu, "framework her projeye kendi varsayımlarını
@@ -77,24 +78,24 @@ dosya adlarını okunur tutuyor. Hash'li olmaları sayesinde bu dosyalara
 ```
 
 - `asset(name)` manifest'te varsa hash'li URL'i, yoksa `/assets/<name>` döner.
-  `build.assets.prefix` / `JSKELET_ASSET_PREFIX` doluysa bu göreli yolun önüne
-  CDN origin eklenir (manifest diskte göreli kalır).
+  `build.assets.prefix` doluysa bu göreli yolun önüne CDN origin eklenir
+  (manifest diskte göreli kalır).
 - `hasAsset(name)` manifest'te olup olmadığını söyler.
 
 ### CDN prefix ve S3 upload
 
-Varsayılan kapalıdır. Açılınca:
+Varsayılan kapalıdır. Prefix / bucket / keyPrefix config'te; yalnızca
+credential env'den (`AWS_*`, yoksa `JSKELET_S3_*`). Açılınca:
 
 1. Production build `public/assets/` (ve `include` listesindeki diğer dizinler)
    altındaki dosyaları S3'e PutObject ile kopyalar.
-2. Çalışma anında `asset()` / optimize görseller `JSKELET_ASSET_PREFIX` ile
+2. Çalışma anında `asset()` / optimize görseller `build.assets.prefix` ile
    absolute CDN URL basar. Entry CDN'deyse esbuild chunk'ları göreli yolla aynı
    host'a gider.
 
-Credential: `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` (önce), yoksa
-`JSKELET_S3_*`. Bucket: `JSKELET_ASSETS_BUCKET`. Config sözlüğü:
-[07-yapilandirma.md](./07-yapilandirma.md#build). Dağıtım notları:
-[10-dagitim.md](./10-dagitim.md).
+Bucket adı noktalı olabilir (`static.ornek.com`); `https://…` şeması
+`prefix`'e yazılır. Config sözlüğü: [07-yapilandirma.md](./07-yapilandirma.md#build).
+Dağıtım notları: [10-dagitim.md](./10-dagitim.md).
 
 Build çalışmadıysa uygulama yine ayağa kalkar: `hasAsset()` false olur, layout
 stylesheet ve script etiketlerini hiç basmaz. `jskelet build` unutulduğunda hata

package/docs/10-dagitim.md

@@ -51,17 +51,27 @@ ayarlamayı düşünmeniz gerekenler:
 | `PREWARM_MAX` | Site boyutuna göre | Açılışta ısıtılacak sayfa sayısı |
 | `PREWARM_INTERVAL_SECONDS` | `0` ya da uzun bir değer | Hiç ziyaret edilmeyen sayfaları sıcak tutmak isterseniz |
 | `DEV_GATE` + `DEV_TOKEN` | Yalnızca staging'de | Yayına açılmamış ortamı gizler. Token tek başına siteyi kilitlemez |
-| `JSKELET_S3_*` / `AWS_*` | Access log veya asset'leri S3'e yazıyorsanız | Credential; AWS deploy'da `AWS_ACCESS_KEY_ID` vb. yeter. Ayrıntı [07](./07-yapilandirma.md) |
-| `JSKELET_ASSETS_BUCKET` | Hash'li asset'leri S3/CloudFront'a basıyorsanız | Production `jskelet build` sonunda PutObject; `JSKELET_ASSET_PREFIX` ile HTML CDN URL basar |
+| `JSKELET_S3_*` / `AWS_*` | Access log veya asset'leri S3'e yazıyorsanız | Yalnızca credential; bucket/prefix `jskelet.config.mjs` → `build.assets`. Ayrıntı [07](./07-yapilandirma.md) |
 
 ### Asset'leri S3 / CloudFront'a basmak
 
-Varsayılan kapalıdır. CI veya prod build ortamında:
+Varsayılan kapalıdır. Config'te prefix + bucket; CI'da yalnızca credential:
+
+```js
+// jskelet.config.mjs
+build: {
+  assets: {
+    prefix: "https://static.ornek.com/js",
+    upload: {
+      bucket: "static.ornek.com", // veya "static.ornek.com/js"
+      keyPrefix: "js",
+      region: "eu-central-1",
+    },
+  },
+},
+```
 
 ```bash
-JSKELET_ASSETS_BUCKET=my-app-assets          # veya my-app-assets/static
-JSKELET_ASSET_PREFIX=https://dxxxx.cloudfront.net
-AWS_REGION=eu-central-1
 AWS_ACCESS_KEY_ID=…
 AWS_SECRET_ACCESS_KEY=…
 # geçici credential ise:
@@ -70,9 +80,9 @@ AWS_SECRET_ACCESS_KEY=…
 
 `jskelet build` bitince `public/assets/` (ve config'te `include` edilen
 dizinler) S3'e kopyalanır; origin'deki dosyalar da durur. Bucket veya
-credential eksikken upload açıksa build düşer. Watch / `jskelet dev` upload
-yapmaz. CSP kullanıyorsanız CDN origin'ini `script-src` / `style-src` /
-`img-src` ve `preconnect` listesine ekleyin.
+credential yoksa adım `skipped (…)` ile sebep basar, build devam eder. Watch /
+`jskelet dev` upload yapmaz. CSP kullanıyorsanız CDN origin'ini `script-src` /
+`style-src` / `img-src` ve `preconnect` listesine ekleyin.
 
 Production'da dosya veya S3 sink açıldığında HTTP access log middleware
 otomatik mount edilir (`logs.kinds` içinde `http` varsa). Admin paneli ring'i

package/docs/en/07-configuration.md

@@ -100,10 +100,11 @@ export default {
       groups: { charts: ["chart.js"] },
     },
     assets: {
-      prefix: process.env.JSKELET_ASSET_PREFIX,
+      prefix: "https://static.example.com/js",
       upload: {
-        enabled: Boolean(process.env.JSKELET_ASSETS_BUCKET),
-        bucket: process.env.JSKELET_ASSETS_BUCKET,
+        bucket: "static.example.com", // S3 bucket name (dots are fine)
+        keyPrefix: "js",
+        region: "eu-central-1",
       },
     },
   },
@@ -641,20 +642,22 @@ changes** — assets stay on the origin.
 
 | Field | Type | Default | Meaning |
 | --- | --- | --- | --- |
-| `assets.prefix` | `string` | `""` | Prefix for `asset()` / optimised image URLs (no trailing `/`). `JSKELET_ASSET_PREFIX` overrides. The on-disk manifest stays relative. |
-| `assets.upload.enabled` | `boolean` | `false` | Turns on when `true` or when `JSKELET_ASSETS_BUCKET` is set; explicit `false` wins. |
-| `assets.upload.bucket` | `string \| null` | `null` | Bucket or `bucket/key/prefix`. `JSKELET_ASSETS_BUCKET` overrides. |
-| `assets.upload.keyPrefix` | `string` | `""` | Object key prefix when not given in the path (`prefix` is accepted as an alias). |
-| `assets.upload.region` | `string` | `us-east-1` | `AWS_REGION` / `AWS_DEFAULT_REGION` / `JSKELET_S3_REGION`; defaults to `auto` with a custom endpoint. |
-| `assets.upload.endpoint` | `string \| null` | `null` | S3-compatible API; `AWS_ENDPOINT_URL` / `JSKELET_S3_API_URL` overrides. |
+| `assets.prefix` | `string` | `""` | CDN origin; prefix for `asset()` URLs (no trailing `/`). Config only. The on-disk manifest stays relative. |
+| `assets.upload.enabled` | `boolean` | `false` | Turns on when `true` or when `bucket` is set in config; explicit `false` wins. |
+| `assets.upload.bucket` | `string \| null` | `null` | **S3 bucket name** (dotted names like `static.example.com` are fine) or `bucket/key/prefix`. A `https://…` scheme is rejected — that belongs in `prefix`. |
+| `assets.upload.keyPrefix` | `string` | `""` | Object key prefix; a path on the bucket wins (`prefix` is accepted as an alias). |
+| `assets.upload.region` | `string` | `us-east-1` | Config; defaults to `auto` when `endpoint` is set. |
+| `assets.upload.endpoint` | `string \| null` | `null` | S3-compatible API (R2 / MinIO); config. |
 | `assets.upload.include` | `string[]` | `["assets"]` | Directories under `public/` (`assets`, optionally `fonts`, …). |
 | `assets.upload.cacheControl` | `string` | `public, max-age=31536000, immutable` | PutObject `Cache-Control`. |
 
-Credentials are not written in the config. Preference order:
-`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, then
-`JSKELET_S3_*`. When upload is on, a missing bucket or credentials **fails the
-build**. No upload on watch passes. `.br` / `.gz` siblings are not uploaded.
-Details: [08-build.md](./08-build.md), [10-deployment.md](./10-deployment.md).
+**Only credentials come from the environment:** `AWS_ACCESS_KEY_ID` /
+`AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` (else `JSKELET_S3_*`). Prefix,
+bucket, region, etc. are written in the config. On a production build the Assets
+upload step always appears; when off it logs a one-line reason such as
+`skipped (no build.assets.upload.bucket)` or `skipped (credentials missing)`.
+No upload on watch passes. `.br` / `.gz` siblings are not uploaded. Details:
+[08-build.md](./08-build.md), [10-deployment.md](./10-deployment.md).
 
 ```js
 build: {
@@ -669,10 +672,12 @@ build: {
     },
   },
   assets: {
-    prefix: process.env.JSKELET_ASSET_PREFIX, // https://dxxxx.cloudfront.net
+    // HTML: /assets/app.css → https://static.example.com/js/assets/app.css
+    prefix: "https://static.example.com/js",
     upload: {
-      enabled: Boolean(process.env.JSKELET_ASSETS_BUCKET),
-      bucket: process.env.JSKELET_ASSETS_BUCKET, // my-bucket or my-bucket/static
+      bucket: "static.example.com", // or "static.example.com/js" → keyPrefix js/
+      keyPrefix: "js",              // S3 key: js/assets/…
+      region: "eu-central-1",
       include: ["assets", "fonts"],
     },
   },
@@ -1249,13 +1254,9 @@ and no warning is printed.
 | `DEV_GATE` | `devGate` | off | `1` turns the gate on, `0` turns it off even when config enabled it. `DEV_TOKEN` alone does not turn it on. [09](./09-dev-tools.md) |
 | `DEV_TOKEN` | `devGate`, `prewarm` | — | The secret expected while the gate is on. If it is missing, or the gate is off, the site stays public. Prewarming carries the token as a cookie only while the gate is on. [09](./09-dev-tools.md) |
 | `JSKELET_ADMIN` | `createApp` | — | When set, turns the admin panel on; `0` turns off a panel enabled in the config. The env wins because the panel is usually opened once during an incident. [06](./06-caching.md) |
-| `JSKELET_ASSET_PREFIX` | `build.assets.prefix` | — | CDN origin prepended to `asset()` URLs (no trailing `/`) |
-| `JSKELET_ASSETS_BUCKET` | `build.assets.upload` | — | Asset upload target: bucket or `bucket/prefix`. With credentials, production build PutObject |
 | `AWS_ACCESS_KEY_ID` | S3 PutObject | — | Standard AWS signing key (logs + asset upload); before `JSKELET_S3_*` |
 | `AWS_SECRET_ACCESS_KEY` | S3 PutObject | — | Standard AWS signing secret |
 | `AWS_SESSION_TOKEN` | S3 PutObject | — | Temporary credentials (OIDC / STS) |
-| `AWS_REGION` / `AWS_DEFAULT_REGION` | `build.assets.upload` | — | Asset upload region |
-| `AWS_ENDPOINT_URL` | `build.assets.upload` | — | S3-compatible endpoint (asset upload) |
 | `JSKELET_LOG_BUCKET` | `logs.s3` | — | Log target: bucket or `bucket/prefix` path. With credentials, the sink turns on automatically |
 | `JSKELET_S3_BUCKET` | `logs.s3` | — | Bucket when `JSKELET_LOG_BUCKET` is unset; joins with `JSKELET_S3_KEY_PREFIX` |
 | `JSKELET_S3_KEY_PREFIX` | `logs.s3` | — | Used with `JSKELET_S3_BUCKET` (`bucket/prefix`) |

package/docs/en/08-build.md

@@ -20,7 +20,7 @@ build is in [09-dev-tools.md](./09-dev-tools.md).
 5. Images         if config.images !== false, not watch, and sharp is installed
 6. Manifest       .jskelet/manifest.json
 7. Precompress    if not watch
-8. Assets upload  if build.assets.upload is on (not watch)
+8. Assets upload  if not watch (logs `skipped (reason)` when off)
 ```
 
 Template compilation finishes **before** asset scanning; there is no parse on
@@ -34,7 +34,8 @@ The order is not arbitrary:
 - **Precompress runs just before upload:** the origin still gets `.br`/`.gz`;
   the S3 step copies only the raw files.
 - **Images never run on a watch pass:** re-encoding with `sharp` is expensive.
-- **Assets upload never runs on watch:** only production `jskelet build`.
+- **Assets upload never runs on watch:** only production `jskelet build`; when
+  off the step still prints (`skipped (no build.assets.upload.bucket)`, etc.).
 
 Tasks only run if the relevant configuration exists. A project that does not
 define any fonts never sees the font step; this is the build-side counterpart of
@@ -80,25 +81,24 @@ They are passed to templates automatically; in server code,
 ```
 
 - `asset(name)` returns the hashed URL if it is in the manifest, otherwise
-  `/assets/<name>`. When `build.assets.prefix` / `JSKELET_ASSET_PREFIX` is set,
-  that relative path is prefixed with the CDN origin (the on-disk manifest stays
-  relative).
+  `/assets/<name>`. When `build.assets.prefix` is set, that relative path is
+  prefixed with the CDN origin (the on-disk manifest stays relative).
 - `hasAsset(name)` tells you whether it is in the manifest.
 
 ### CDN prefix and S3 upload
 
-Off by default. When enabled:
+Off by default. Prefix / bucket / keyPrefix come from config; only credentials
+come from the environment (`AWS_*`, else `JSKELET_S3_*`). When enabled:
 
 1. A production build PutObjects files under `public/assets/` (and any other
    directories in `include`) to S3.
 2. At runtime `asset()` / optimised images emit absolute CDN URLs via
-   `JSKELET_ASSET_PREFIX`. When the entry script is on the CDN, esbuild chunks
+   `build.assets.prefix`. When the entry script is on the CDN, esbuild chunks
    resolve relatively on the same host.
 
-Credentials: `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` first, else
-`JSKELET_S3_*`. Bucket: `JSKELET_ASSETS_BUCKET`. Config reference:
-[07-configuration.md](./07-configuration.md#build). Deploy notes:
-[10-deployment.md](./10-deployment.md).
+Bucket names may include dots (`static.example.com`); put `https://…` in
+`prefix`. Config reference: [07-configuration.md](./07-configuration.md#build).
+Deploy notes: [10-deployment.md](./10-deployment.md).
 
 If the build has not run, the application still comes up: `hasAsset()` is false
 and the layout never emits the stylesheet and script tags. When `jskelet build`

package/docs/en/10-deployment.md

@@ -52,17 +52,27 @@ considering in production:
 | `PREWARM_MAX` | Depends on site size | Number of pages warmed at startup |
 | `PREWARM_INTERVAL_SECONDS` | `0` or a long value | If you want to keep never-visited pages warm |
 | `DEV_GATE` + `DEV_TOKEN` | Staging only | Hides an environment that is not public yet. The token alone does not lock the site |
-| `JSKELET_S3_*` / `AWS_*` | If you write access logs or assets to S3 | Credentials; on AWS, `AWS_ACCESS_KEY_ID` etc. are enough. Details in [07](./07-configuration.md) |
-| `JSKELET_ASSETS_BUCKET` | If you publish hashed assets to S3/CloudFront | PutObject at the end of production `jskelet build`; `JSKELET_ASSET_PREFIX` makes HTML emit CDN URLs |
+| `JSKELET_S3_*` / `AWS_*` | If you write access logs or assets to S3 | Credentials only; bucket/prefix live in `jskelet.config.mjs` → `build.assets`. Details in [07](./07-configuration.md) |
 
 ### Publishing assets to S3 / CloudFront
 
-Off by default. In CI or a production build environment:
+Off by default. Prefix + bucket in config; credentials only in CI:
+
+```js
+// jskelet.config.mjs
+build: {
+  assets: {
+    prefix: "https://static.example.com/js",
+    upload: {
+      bucket: "static.example.com", // or "static.example.com/js"
+      keyPrefix: "js",
+      region: "eu-central-1",
+    },
+  },
+},
+```
 
 ```bash
-JSKELET_ASSETS_BUCKET=my-app-assets          # or my-app-assets/static
-JSKELET_ASSET_PREFIX=https://dxxxx.cloudfront.net
-AWS_REGION=eu-central-1
 AWS_ACCESS_KEY_ID=…
 AWS_SECRET_ACCESS_KEY=…
 # for temporary credentials:
@@ -70,10 +80,10 @@ AWS_SECRET_ACCESS_KEY=…
 ```
 
 When `jskelet build` finishes, files under `public/assets/` (and any other
-`include` directories) are copied to S3; origin copies remain. If upload is on
-and the bucket or credentials are missing, the build fails. Watch /
-`jskelet dev` never upload. If you use CSP, add the CDN origin to
-`script-src` / `style-src` / `img-src` and to `preconnect`.
+`include` directories) are copied to S3; origin copies remain. If the bucket or
+credentials are missing, the step logs `skipped (…)` with the reason and the
+build continues. Watch / `jskelet dev` never upload. If you use CSP, add the CDN
+origin to `script-src` / `style-src` / `img-src` and to `preconnect`.
 
 When a file or S3 sink is enabled in production, the HTTP access log middleware
 mounts automatically (if `http` is in `logs.kinds`). The admin panel ring is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jskelet",
-  "version": "0.6.8",
+  "version": "0.6.10",
   "description": "A framework that feels like no framework: Express 5 + build-time .jsk SSR (optional EJS peer), vanilla JS islands, Tailwind v4 and an in-process HTML TTL cache.",
   "type": "module",
   "license": "MIT",

package/src/build/build.mjs

@@ -110,8 +110,9 @@ if (!watch) {
   const { precompressAssets } = await import("./tasks/precompress.mjs");
   await task("Precompress", precompressAssets);
 
+  // Her production build'de satır görünür; kapalıysa `skipped (sebep)`.
   // CDN'e basılacak dosyalar precompress'ten sonra hazır; `.br`/`.gz` yüklenmez.
-  if (config.build?.assets?.upload?.enabled) {
+  {
     const { uploadAssets } = await import("./tasks/assets-upload.mjs");
     await task("Assets upload", () => uploadAssets(config));
   }

package/src/build/tasks/assets-upload.mjs

@@ -2,8 +2,8 @@
  * Production build sonunda hash'li varlıkları S3'e PutObject ile kopyalar.
  *
  * Watch turunda çalışmaz (çağıran sorumlu). Credential env'den gelir
- * (`AWS_*` önce, `JSKELET_S3_*` yedek). Bucket yoksa veya credential yoksa
- * build düşer — CDN prefix ile boş bucket'a deploy olmasın diye.
+ * (`AWS_*` önce, `JSKELET_S3_*` yedek). Bucket / credential yoksa veya upload
+ * kapalıysa adım yine görünür: `skipped (…)` ile sebep basılır, build düşmez.
  *
  * `.br` / `.gz` kardeşleri yüklenmez: edge kendi sıkıştırmasını yapsın;
  * origin precompress Express için kalır.
@@ -12,6 +12,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { readS3CredentialsFromEnv } from "../../config/index.js";
 import { putObject } from "../../server/logs/s3-put.js";
+import * as log from "../../log.mjs";
 import { paths } from "../paths.mjs";
 
 const CONCURRENCY = 8;
@@ -87,27 +88,46 @@ function resolveIncludeDir(name) {
 }
 
 /**
+ * Upload yapılmayacaksa kısa sebep; yapılacaksa `null`.
+ *
  * @param {import('../../config/index.js').ResolvedConfig} config
- * @param {{ put?: typeof putObject }} [options]
- * @returns {Promise<string>} Özet satır (log.task için)
+ * @returns {string | null}
  */
-export async function uploadAssets(config, options = {}) {
+export function assetsUploadSkipReason(config) {
   const upload = config.build?.assets?.upload;
-  if (!upload?.enabled) return "skipped";
 
-  if (!upload.bucket) {
-    throw new Error(
-      "[assets] upload enabled but no bucket — set JSKELET_ASSETS_BUCKET " +
-        "or build.assets.upload.bucket",
-    );
+  if (!upload?.enabled) {
+    // Bucket yoksa asıl eksik alanı söyle — `enabled: false` çoğu zaman
+    // bucket tanımlanmadığı için dolaylıdır.
+    if (!upload?.bucket) return "no build.assets.upload.bucket";
+    return "build.assets.upload.enabled is false";
+  }
+
+  if (!upload.bucket) return "no build.assets.upload.bucket";
+
+  if (!readS3CredentialsFromEnv()) return "credentials missing";
+
+  return null;
+}
+
+/**
+ * @param {import('../../config/index.js').ResolvedConfig} config
+ * @param {{ put?: typeof putObject }} [options]
+ * @returns {Promise<void>}
+ */
+export async function uploadAssets(config, options = {}) {
+  const reason = assetsUploadSkipReason(config);
+  if (reason) {
+    log.detail(`skipped (${reason})`);
+    return;
   }
 
+  const upload = config.build.assets.upload;
   const credentials = readS3CredentialsFromEnv();
-  if (!credentials) {
-    throw new Error(
-      "[assets] upload enabled but credentials missing — set " +
-        "AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or JSKELET_S3_*",
-    );
+  // skipReason null iken credential ve bucket vardır; TS/akış için daralt.
+  if (!upload.bucket || !credentials) {
+    log.detail("skipped (credentials missing)");
+    return;
   }
 
   const put = options.put ?? putObject;
@@ -131,7 +151,10 @@ export async function uploadAssets(config, options = {}) {
     }
   }
 
-  if (!jobs.length) return "0 files";
+  if (!jobs.length) {
+    log.detail("0 files");
+    return;
+  }
 
   let uploaded = 0;
   let index = 0;
@@ -163,5 +186,5 @@ export async function uploadAssets(config, options = {}) {
 
   const target = `${upload.bucket}/${keyPrefix}`.replace(/\/+/g, "/");
   const via = upload.endpoint ? ` @ ${upload.endpoint}` : "";
-  return `${uploaded} → s3://${target}${via}`;
+  log.detail(`${uploaded} → s3://${target}${via}`);
 }

package/src/config/defaults.js

@@ -498,10 +498,11 @@ export const DEFAULT_BUILD = {
     chunkGroup: null,
   },
   assets: {
-    /** CDN / CloudFront origin; sonunda `/` yok. Env: `JSKELET_ASSET_PREFIX`. */
+    /** CDN / CloudFront origin; sonunda `/` yok. Yalnızca config. */
     prefix: "",
     upload: {
       enabled: false,
+      /** S3 bucket adı (CDN URL değil). Yalnızca config; credential env'den. */
       bucket: null,
       /** Nesne anahtarı öneki (`bucket/path` split'inden veya config). */
       keyPrefix: "",

package/src/config/index.js

@@ -180,7 +180,7 @@ const CONFIG_FILE = "jskelet.config.mjs";
  * @property {string} cacheControl
  *
  * @typedef {object} BuildAssetsConfig
- * @property {string} prefix CDN origin (`JSKELET_ASSET_PREFIX`); sonunda `/` yok.
+ * @property {string} prefix CDN origin (`build.assets.prefix`); sonunda `/` yok.
  * @property {BuildAssetsUploadConfig} upload
  *
  * @typedef {object} BuildConfig
@@ -1186,7 +1186,34 @@ function defaultBuildClient() {
 }
 
 /**
- * CDN prefix + S3 upload (`build.assets`). Credential config'e yazılmaz.
+ * Asset upload bucket'ı. CDN URL buraya yazılmaz — o `build.assets.prefix`.
+ *
+ * @param {unknown} value
+ * @returns {{ bucket: string | null, prefix: string | null }}
+ */
+function normalizeAssetsBucket(value) {
+  const text = typeof value === "string" ? value.trim() : "";
+  if (!text) return { bucket: null, prefix: null };
+
+  // Noktalı bucket adları geçerli (`static.investvio.com`). Reddedilen yalnızca
+  // şemalı URL — CDN origin `build.assets.prefix`'te kalır.
+  if (/^https?:\/\//i.test(text)) {
+    console.warn(
+      "[config] build.assets.upload.bucket looks like a URL — use the S3 " +
+        "bucket name without a scheme (e.g. \"static.investvio.com\" or " +
+        "\"static.investvio.com/js\"); put https://… in build.assets.prefix",
+    );
+    return { bucket: null, prefix: null };
+  }
+
+  return splitS3BucketPath(text);
+}
+
+/**
+ * CDN prefix + S3 upload (`build.assets`).
+ *
+ * Prefix / bucket / keyPrefix / region / endpoint **yalnızca config**'ten.
+ * Credential env'den (`AWS_*`, yoksa `JSKELET_S3_*`) — config'e yazılmaz.
  *
  * @param {unknown} raw
  * @returns {BuildAssetsConfig}
@@ -1201,10 +1228,9 @@ export function normalizeBuildAssets(raw) {
     console.warn("[config] build.assets must be an object, ignoring it");
   }
 
-  const envPrefix = envText(process.env.JSKELET_ASSET_PREFIX);
-  const configPrefix =
-    typeof source.prefix === "string" ? source.prefix.trim() : "";
-  const prefix = (envPrefix ?? configPrefix).replace(/\/+$/, "");
+  const prefix = (
+    typeof source.prefix === "string" ? source.prefix.trim() : ""
+  ).replace(/\/+$/, "");
 
   const uploadRaw =
     source.upload != null &&
@@ -1220,10 +1246,7 @@ export function normalizeBuildAssets(raw) {
     console.warn("[config] build.assets.upload must be an object, ignoring it");
   }
 
-  const envBucket = envText(process.env.JSKELET_ASSETS_BUCKET);
-  const bucketPath = splitS3BucketPath(
-    envBucket ?? envText(uploadRaw.bucket),
-  );
+  const bucketPath = normalizeAssetsBucket(uploadRaw.bucket);
 
   const configKeyPrefix =
     typeof uploadRaw.keyPrefix === "string" && uploadRaw.keyPrefix
@@ -1236,17 +1259,15 @@ export function normalizeBuildAssets(raw) {
           : `${uploadRaw.prefix}/`
         : DEFAULT_BUILD.assets.upload.keyPrefix;
 
-  const endpoint =
-    envText(process.env.AWS_ENDPOINT_URL) ??
-    envText(process.env.JSKELET_S3_API_URL) ??
-    envText(uploadRaw.endpoint);
+  // Bucket yolundaki önek (`my-bucket/js`) `keyPrefix`'i ezer — tek alanda
+  // hem kova hem klasör vermek için.
+  const keyPrefix = bucketPath.prefix ?? configKeyPrefix;
+
+  const endpoint = envText(uploadRaw.endpoint);
 
   // Gerçek AWS'te region imza için gerekir; custom endpoint'te `auto` yaygın.
   const region =
     envText(uploadRaw.region) ??
-    envText(process.env.AWS_REGION) ??
-    envText(process.env.AWS_DEFAULT_REGION) ??
-    envText(process.env.JSKELET_S3_REGION) ??
     (endpoint ? "auto" : DEFAULT_BUILD.assets.upload.region);
 
   /** @type {string[]} */
@@ -1268,8 +1289,7 @@ export function normalizeBuildAssets(raw) {
       ? uploadRaw.cacheControl.trim()
       : DEFAULT_BUILD.assets.upload.cacheControl;
 
-  // `JSKELET_ASSETS_BUCKET` doluysa config'te `enabled` unutulmuş olsa bile aç.
-  // Açık `enabled: false` ezer.
+  // Config'te bucket varsa `enabled` unutulmuş olsa bile aç. Açık `false` ezer.
   const enabled =
     uploadRaw.enabled === true ||
     (uploadRaw.enabled !== false && Boolean(bucketPath.bucket));
@@ -1279,7 +1299,7 @@ export function normalizeBuildAssets(raw) {
     upload: {
       enabled,
       bucket: bucketPath.bucket,
-      keyPrefix: bucketPath.prefix ?? configKeyPrefix,
+      keyPrefix,
       region,
       endpoint,
       include,

package/src/server/assets.js

@@ -6,9 +6,9 @@
  * basmaz. Böylece `jskelet build` unutulduğunda hata yerine stilsiz ama
  * çalışan bir sayfa görürsünüz.
  *
- * `build.assets.prefix` / `JSKELET_ASSET_PREFIX` doluysa HTML'e basılan
- * URL'lere CDN origin eklenir; manifest diskte göreli kalır (çok ortamlı
- * tek artifact). Dosya sistemi okumaları (`getSpriteIds`) göreli yolu kullanır.
+ * `build.assets.prefix` doluysa HTML'e basılan URL'lere CDN origin eklenir;
+ * manifest diskte göreli kalır. Dosya sistemi okumaları (`getSpriteIds`)
+ * göreli yolu kullanır.
  */
 import fs from "node:fs";
 import path from "node:path";

package/types/config/defaults.d.ts

@@ -448,10 +448,11 @@ export declare const DEFAULT_BUILD: {
         chunkGroup: ((id: string) => string | null | undefined) | null;
     };
     assets: {
-        /** CDN / CloudFront origin; sonunda `/` yok. Env: `JSKELET_ASSET_PREFIX`. */
+        /** CDN / CloudFront origin; sonunda `/` yok. Yalnızca config. */
         prefix: string;
         upload: {
             enabled: boolean;
+            /** S3 bucket adı (CDN URL değil). Yalnızca config; credential env'den. */
             bucket: null;
             /** Nesne anahtarı öneki (`bucket/path` split'inden veya config). */
             keyPrefix: string;

package/types/config/index.d.ts

@@ -241,7 +241,7 @@ export type BuildAssetsUploadConfig = {
 };
 export type BuildAssetsConfig = {
     /**
-     * CDN origin (`JSKELET_ASSET_PREFIX`); sonunda `/` yok.
+     * CDN origin (`build.assets.prefix`); sonunda `/` yok.
      */
     prefix: string;
     upload: BuildAssetsUploadConfig;
@@ -313,7 +313,10 @@ export type SecurityConfig = {
     };
 };
 /**
- * CDN prefix + S3 upload (`build.assets`). Credential config'e yazılmaz.
+ * CDN prefix + S3 upload (`build.assets`).
+ *
+ * Prefix / bucket / keyPrefix / region / endpoint **yalnızca config**'ten.
+ * Credential env'den (`AWS_*`, yoksa `JSKELET_S3_*`) — config'e yazılmaz.
  *
  * @param {unknown} raw
  * @returns {BuildAssetsConfig}