jskelet 0.6.9 → 0.6.11

package/CHANGELOG.md

@@ -10,16 +10,18 @@ one is listed under a **Breaking** heading.
 
 ### Added
 
-- Optional CDN asset publishing: `build.assets.prefix` /
-  `JSKELET_ASSET_PREFIX` prefixes `asset()` and optimised image URLs (manifest
-  stays relative on disk). When `JSKELET_ASSETS_BUCKET` (or
-  `build.assets.upload`) is set, production `jskelet build` PutObjects
-  `public/assets/` (and optional `include` dirs) to S3 after precompress.
-  Credentials prefer standard `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` /
-  `AWS_SESSION_TOKEN`, then `JSKELET_S3_*`. The Assets upload step always
-  appears on production builds; when off it logs a one-line reason
-  (`skipped (no JSKELET_ASSETS_BUCKET)`, `skipped (credentials missing)`, …).
-  Watch mode never uploads. `.br` / `.gz` siblings are skipped.
+- Optional CDN asset publishing via `build.assets`: `prefix` rewrites
+  `asset()` / optimised image URLs (manifest stays relative on disk);
+  `upload.bucket` / `keyPrefix` / `region` / `endpoint` come from config only.
+  Production `jskelet build` PutObjects `public/assets/` (and optional
+  `include` dirs) after precompress. Only credentials are read from env
+  (`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, then
+  `JSKELET_S3_*`, then ECS task-role / EC2 instance-profile metadata). The
+  Assets upload step always appears on production builds; when off it logs a
+  one-line reason (`skipped (no build.assets.upload.bucket)`,
+  `skipped (credentials missing)`, …). A URL in `upload.bucket` is rejected
+  with a warning (CDN origin belongs in `prefix`). Watch mode never uploads.
+  `.br` / `.gz` siblings are skipped.
 
 ### Changed
 

package/docs/07-yapilandirma.md

@@ -96,10 +96,11 @@ export default {
       groups: { charts: ["chart.js"] },
     },
     assets: {
-      prefix: process.env.JSKELET_ASSET_PREFIX,
+      prefix: "https://static.ornek.com/js",
       upload: {
-        enabled: Boolean(process.env.JSKELET_ASSETS_BUCKET),
-        bucket: process.env.JSKELET_ASSETS_BUCKET,
+        bucket: "static.ornek.com", // S3 bucket adı (noktalı olabilir)
+        keyPrefix: "js",
+        region: "eu-central-1",
       },
     },
   },
@@ -628,21 +629,22 @@ değişmez** — asset'ler origin'den servis edilir.
 
 | Alan | Tip | Varsayılan | Anlamı |
 | --- | --- | --- | --- |
-| `assets.prefix` | `string` | `""` | `asset()` / optimize görsel URL öneki (sonunda `/` yok). `JSKELET_ASSET_PREFIX` ezer. Manifest diskte göreli kalır. |
-| `assets.upload.enabled` | `boolean` | `false` | `true` veya `JSKELET_ASSETS_BUCKET` doluysa açılır; açık `false` ezer. |
-| `assets.upload.bucket` | `string \| null` | `null` | Bucket veya `bucket/key/prefix`. `JSKELET_ASSETS_BUCKET` ezer. |
-| `assets.upload.keyPrefix` | `string` | `""` | Yolda verilmediyse nesne anahtarı öneki (`prefix` takma adı da kabul). |
-| `assets.upload.region` | `string` | `us-east-1` | `AWS_REGION` / `AWS_DEFAULT_REGION` / `JSKELET_S3_REGION`; custom endpoint'te varsayılan `auto`. |
-| `assets.upload.endpoint` | `string \| null` | `null` | S3-uyumlu API; `AWS_ENDPOINT_URL` / `JSKELET_S3_API_URL` ezer. |
+| `assets.prefix` | `string` | `""` | CDN origin; `asset()` URL öneki (sonunda `/` yok). Yalnızca config. Manifest diskte göreli kalır. |
+| `assets.upload.enabled` | `boolean` | `false` | `true` veya config'te `bucket` doluysa açılır; açık `false` ezer. |
+| `assets.upload.bucket` | `string \| null` | `null` | **S3 bucket adı** (`static.ornek.com` gibi noktalı adlar geçerli) veya `bucket/key/prefix`. `https://…` şeması kabul edilmez — o `prefix`. |
+| `assets.upload.keyPrefix` | `string` | `""` | Nesne anahtarı öneki; bucket yolunda verilmişse o kazanır (`prefix` takma adı da kabul). |
+| `assets.upload.region` | `string` | `us-east-1` | Config; custom `endpoint` varken varsayılan `auto`. |
+| `assets.upload.endpoint` | `string \| null` | `null` | S3-uyumlu API (R2 / MinIO); config. |
 | `assets.upload.include` | `string[]` | `["assets"]` | `public/` altı dizinler (`assets`, isteğe `fonts`, …). |
 | `assets.upload.cacheControl` | `string` | `public, max-age=31536000, immutable` | PutObject `Cache-Control`. |
 
-Credential config'e yazılmaz. Öncelik: `AWS_ACCESS_KEY_ID` /
-`AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, yoksa `JSKELET_S3_*`. Production
-build'de Assets upload adımı her zaman görünür; kapalıysa
-`skipped (no JSKELET_ASSETS_BUCKET)` / `skipped (credentials missing)` gibi tek
-satır sebep basılır (build düşmez). Watch turunda adım yok. `.br` / `.gz`
-yüklenmez. Ayrıntı: [08-build.md](./08-build.md), [10-dagitim.md](./10-dagitim.md).
+**Credential config'e yazılmaz.** Zincir: `AWS_ACCESS_KEY_ID` /
+`AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` (yoksa `JSKELET_S3_*`) → ECS/Fargate
+task role (`AWS_CONTAINER_CREDENTIALS_*`) → EC2 instance profile (IMDSv2).
+Prefix, bucket, region vb. config'te yazılır. Task role varken env key şart
+değil. Production build'de Assets upload adımı her zaman görünür; kapalıysa
+`skipped (…)` ile sebep basılır. Watch'ta adım yok. `.br` / `.gz` yüklenmez.
+Ayrıntı: [08-build.md](./08-build.md), [10-dagitim.md](./10-dagitim.md).
 
 ```js
 build: {
@@ -657,10 +659,12 @@ build: {
     },
   },
   assets: {
-    prefix: process.env.JSKELET_ASSET_PREFIX, // https://dxxxx.cloudfront.net
+    // HTML: /assets/app.css → https://static.ornek.com/js/assets/app.css
+    prefix: "https://static.ornek.com/js",
     upload: {
-      enabled: Boolean(process.env.JSKELET_ASSETS_BUCKET),
-      bucket: process.env.JSKELET_ASSETS_BUCKET, // my-bucket veya my-bucket/static
+      bucket: "static.ornek.com", // veya "static.ornek.com/js" → keyPrefix js/
+      keyPrefix: "js",            // S3 key: js/assets/…
+      region: "eu-central-1",
       include: ["assets", "fonts"],
     },
   },
@@ -1228,13 +1232,9 @@ basılmaz.
 | `DEV_GATE` | `devGate` | kapalı | `1` gate'i açar, `0` config'te açık olsa da kapatır. `DEV_TOKEN` tek başına açmaz. [09](./09-dev-araclari.md) |
 | `DEV_TOKEN` | `devGate`, `prewarm` | — | Gate açıkken beklenen sır. Yoksa veya gate kapalıysa site açık kalır. Isıtma, gate açıkken token'ı çerez olarak taşır. [09](./09-dev-araclari.md) |
 | `JSKELET_ADMIN` | `createApp` | — | Ayarlıysa yönetim panelini açar; `0` config'te açık olan paneli kapatır. Env config'i ezer, çünkü panel genelde bir arıza sırasında tek seferlik açılır. [06](./06-cache.md) |
-| `JSKELET_ASSET_PREFIX` | `build.assets.prefix` | — | CDN origin; `asset()` URL'lerine eklenir (sonunda `/` yok) |
-| `JSKELET_ASSETS_BUCKET` | `build.assets.upload` | — | Asset upload hedefi: bucket veya `bucket/prefix`. Credential ile birlikte production build sonunda PutObject |
 | `AWS_ACCESS_KEY_ID` | S3 PutObject | — | Standart AWS imza anahtarı (log + asset upload); `JSKELET_S3_*`'dan önce |
 | `AWS_SECRET_ACCESS_KEY` | S3 PutObject | — | Standart AWS imza sırrı |
 | `AWS_SESSION_TOKEN` | S3 PutObject | — | Geçici credential (OIDC / STS) |
-| `AWS_REGION` / `AWS_DEFAULT_REGION` | `build.assets.upload` | — | Asset upload bölgesi |
-| `AWS_ENDPOINT_URL` | `build.assets.upload` | — | S3-uyumlu endpoint (asset upload) |
 | `JSKELET_LOG_BUCKET` | `logs.s3` | — | Log hedefi: bucket ya da `bucket/prefix` yolu. Credential ile birlikte varsa sink otomatik açılır |
 | `JSKELET_S3_BUCKET` | `logs.s3` | — | `JSKELET_LOG_BUCKET` yoksa bucket; `JSKELET_S3_KEY_PREFIX` ile birleşir |
 | `JSKELET_S3_KEY_PREFIX` | `logs.s3` | — | `JSKELET_S3_BUCKET` ile kullanılır (`bucket/prefix`) |

package/docs/08-build.md

@@ -35,7 +35,7 @@ Sıra rastgele değil:
   adımı yalnızca ham dosyaları kopyalar.
 - **Görseller watch turunda hiç çalışmaz:** `sharp` ile yeniden kodlama pahalı.
 - **Assets upload watch'ta yok:** yalnızca production `jskelet build`; kapalıysa
-  yine satır basılır (`skipped (no JSKELET_ASSETS_BUCKET)` vb.).
+  yine satır basılır (`skipped (no build.assets.upload.bucket)` vb.).
 
 Görevler yalnızca ilgili yapılandırma varsa çalışır. Font tanımlamayan bir proje
 font adımını hiç görmez; bu, "framework her projeye kendi varsayımlarını
@@ -78,24 +78,24 @@ dosya adlarını okunur tutuyor. Hash'li olmaları sayesinde bu dosyalara
 ```
 
 - `asset(name)` manifest'te varsa hash'li URL'i, yoksa `/assets/<name>` döner.
-  `build.assets.prefix` / `JSKELET_ASSET_PREFIX` doluysa bu göreli yolun önüne
-  CDN origin eklenir (manifest diskte göreli kalır).
+  `build.assets.prefix` doluysa bu göreli yolun önüne CDN origin eklenir
+  (manifest diskte göreli kalır).
 - `hasAsset(name)` manifest'te olup olmadığını söyler.
 
 ### CDN prefix ve S3 upload
 
-Varsayılan kapalıdır. Açılınca:
+Varsayılan kapalıdır. Prefix / bucket / keyPrefix config'te; credential
+env → ECS task role → EC2 IMDS zincirinden. Açılınca:
 
 1. Production build `public/assets/` (ve `include` listesindeki diğer dizinler)
    altındaki dosyaları S3'e PutObject ile kopyalar.
-2. Çalışma anında `asset()` / optimize görseller `JSKELET_ASSET_PREFIX` ile
+2. Çalışma anında `asset()` / optimize görseller `build.assets.prefix` ile
    absolute CDN URL basar. Entry CDN'deyse esbuild chunk'ları göreli yolla aynı
    host'a gider.
 
-Credential: `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` (önce), yoksa
-`JSKELET_S3_*`. Bucket: `JSKELET_ASSETS_BUCKET`. Config sözlüğü:
-[07-yapilandirma.md](./07-yapilandirma.md#build). Dağıtım notları:
-[10-dagitim.md](./10-dagitim.md).
+Bucket adı noktalı olabilir (`static.ornek.com`); `https://…` şeması
+`prefix`'e yazılır. Config sözlüğü: [07-yapilandirma.md](./07-yapilandirma.md#build).
+Dağıtım notları: [10-dagitim.md](./10-dagitim.md).
 
 Build çalışmadıysa uygulama yine ayağa kalkar: `hasAsset()` false olur, layout
 stylesheet ve script etiketlerini hiç basmaz. `jskelet build` unutulduğunda hata

package/docs/10-dagitim.md

@@ -51,20 +51,30 @@ ayarlamayı düşünmeniz gerekenler:
 | `PREWARM_MAX` | Site boyutuna göre | Açılışta ısıtılacak sayfa sayısı |
 | `PREWARM_INTERVAL_SECONDS` | `0` ya da uzun bir değer | Hiç ziyaret edilmeyen sayfaları sıcak tutmak isterseniz |
 | `DEV_GATE` + `DEV_TOKEN` | Yalnızca staging'de | Yayına açılmamış ortamı gizler. Token tek başına siteyi kilitlemez |
-| `JSKELET_S3_*` / `AWS_*` | Access log veya asset'leri S3'e yazıyorsanız | Credential; AWS deploy'da `AWS_ACCESS_KEY_ID` vb. yeter. Ayrıntı [07](./07-yapilandirma.md) |
-| `JSKELET_ASSETS_BUCKET` | Hash'li asset'leri S3/CloudFront'a basıyorsanız | Production `jskelet build` sonunda PutObject; `JSKELET_ASSET_PREFIX` ile HTML CDN URL basar |
+| `JSKELET_S3_*` / `AWS_*` | Access log veya asset'leri S3'e yazıyorsanız | Yalnızca credential; bucket/prefix `jskelet.config.mjs` → `build.assets`. Ayrıntı [07](./07-yapilandirma.md) |
 
 ### Asset'leri S3 / CloudFront'a basmak
 
-Varsayılan kapalıdır. CI veya prod build ortamında:
+Varsayılan kapalıdır. Config'te prefix + bucket; CI'da yalnızca credential:
+
+```js
+// jskelet.config.mjs
+build: {
+  assets: {
+    prefix: "https://static.ornek.com/js",
+    upload: {
+      bucket: "static.ornek.com", // veya "static.ornek.com/js"
+      keyPrefix: "js",
+      region: "eu-central-1",
+    },
+  },
+},
+```
 
 ```bash
-JSKELET_ASSETS_BUCKET=my-app-assets          # veya my-app-assets/static
-JSKELET_ASSET_PREFIX=https://dxxxx.cloudfront.net
-AWS_REGION=eu-central-1
+# CI / local: explicit keys. ECS/EC2'de task/instance role yeter — key şart değil.
 AWS_ACCESS_KEY_ID=…
 AWS_SECRET_ACCESS_KEY=…
-# geçici credential ise:
 # AWS_SESSION_TOKEN=…
 ```
 

package/docs/en/07-configuration.md

@@ -100,10 +100,11 @@ export default {
       groups: { charts: ["chart.js"] },
     },
     assets: {
-      prefix: process.env.JSKELET_ASSET_PREFIX,
+      prefix: "https://static.example.com/js",
       upload: {
-        enabled: Boolean(process.env.JSKELET_ASSETS_BUCKET),
-        bucket: process.env.JSKELET_ASSETS_BUCKET,
+        bucket: "static.example.com", // S3 bucket name (dots are fine)
+        keyPrefix: "js",
+        region: "eu-central-1",
       },
     },
   },
@@ -641,22 +642,22 @@ changes** — assets stay on the origin.
 
 | Field | Type | Default | Meaning |
 | --- | --- | --- | --- |
-| `assets.prefix` | `string` | `""` | Prefix for `asset()` / optimised image URLs (no trailing `/`). `JSKELET_ASSET_PREFIX` overrides. The on-disk manifest stays relative. |
-| `assets.upload.enabled` | `boolean` | `false` | Turns on when `true` or when `JSKELET_ASSETS_BUCKET` is set; explicit `false` wins. |
-| `assets.upload.bucket` | `string \| null` | `null` | Bucket or `bucket/key/prefix`. `JSKELET_ASSETS_BUCKET` overrides. |
-| `assets.upload.keyPrefix` | `string` | `""` | Object key prefix when not given in the path (`prefix` is accepted as an alias). |
-| `assets.upload.region` | `string` | `us-east-1` | `AWS_REGION` / `AWS_DEFAULT_REGION` / `JSKELET_S3_REGION`; defaults to `auto` with a custom endpoint. |
-| `assets.upload.endpoint` | `string \| null` | `null` | S3-compatible API; `AWS_ENDPOINT_URL` / `JSKELET_S3_API_URL` overrides. |
+| `assets.prefix` | `string` | `""` | CDN origin; prefix for `asset()` URLs (no trailing `/`). Config only. The on-disk manifest stays relative. |
+| `assets.upload.enabled` | `boolean` | `false` | Turns on when `true` or when `bucket` is set in config; explicit `false` wins. |
+| `assets.upload.bucket` | `string \| null` | `null` | **S3 bucket name** (dotted names like `static.example.com` are fine) or `bucket/key/prefix`. A `https://…` scheme is rejected — that belongs in `prefix`. |
+| `assets.upload.keyPrefix` | `string` | `""` | Object key prefix; a path on the bucket wins (`prefix` is accepted as an alias). |
+| `assets.upload.region` | `string` | `us-east-1` | Config; defaults to `auto` when `endpoint` is set. |
+| `assets.upload.endpoint` | `string \| null` | `null` | S3-compatible API (R2 / MinIO); config. |
 | `assets.upload.include` | `string[]` | `["assets"]` | Directories under `public/` (`assets`, optionally `fonts`, …). |
 | `assets.upload.cacheControl` | `string` | `public, max-age=31536000, immutable` | PutObject `Cache-Control`. |
 
-Credentials are not written in the config. Preference order:
-`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, then
-`JSKELET_S3_*`. On a production build the Assets upload step always appears;
-when off it logs a one-line reason such as
-`skipped (no JSKELET_ASSETS_BUCKET)` or `skipped (credentials missing)` (the
-build does not fail). No upload on watch passes. `.br` / `.gz` siblings are not
-uploaded. Details: [08-build.md](./08-build.md),
+**Credentials are not written in the config.** Chain: `AWS_ACCESS_KEY_ID` /
+`AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` (else `JSKELET_S3_*`) → ECS/Fargate
+task role (`AWS_CONTAINER_CREDENTIALS_*`) → EC2 instance profile (IMDSv2).
+Prefix, bucket, region, etc. live in the config. With a task role, env keys are
+not required. On a production build the Assets upload step always appears; when
+off it logs `skipped (…)`. No upload on watch passes. `.br` / `.gz` siblings are
+not uploaded. Details: [08-build.md](./08-build.md),
 [10-deployment.md](./10-deployment.md).
 
 ```js
@@ -672,10 +673,12 @@ build: {
     },
   },
   assets: {
-    prefix: process.env.JSKELET_ASSET_PREFIX, // https://dxxxx.cloudfront.net
+    // HTML: /assets/app.css → https://static.example.com/js/assets/app.css
+    prefix: "https://static.example.com/js",
     upload: {
-      enabled: Boolean(process.env.JSKELET_ASSETS_BUCKET),
-      bucket: process.env.JSKELET_ASSETS_BUCKET, // my-bucket or my-bucket/static
+      bucket: "static.example.com", // or "static.example.com/js" → keyPrefix js/
+      keyPrefix: "js",              // S3 key: js/assets/…
+      region: "eu-central-1",
       include: ["assets", "fonts"],
     },
   },
@@ -1252,13 +1255,9 @@ and no warning is printed.
 | `DEV_GATE` | `devGate` | off | `1` turns the gate on, `0` turns it off even when config enabled it. `DEV_TOKEN` alone does not turn it on. [09](./09-dev-tools.md) |
 | `DEV_TOKEN` | `devGate`, `prewarm` | — | The secret expected while the gate is on. If it is missing, or the gate is off, the site stays public. Prewarming carries the token as a cookie only while the gate is on. [09](./09-dev-tools.md) |
 | `JSKELET_ADMIN` | `createApp` | — | When set, turns the admin panel on; `0` turns off a panel enabled in the config. The env wins because the panel is usually opened once during an incident. [06](./06-caching.md) |
-| `JSKELET_ASSET_PREFIX` | `build.assets.prefix` | — | CDN origin prepended to `asset()` URLs (no trailing `/`) |
-| `JSKELET_ASSETS_BUCKET` | `build.assets.upload` | — | Asset upload target: bucket or `bucket/prefix`. With credentials, production build PutObject |
 | `AWS_ACCESS_KEY_ID` | S3 PutObject | — | Standard AWS signing key (logs + asset upload); before `JSKELET_S3_*` |
 | `AWS_SECRET_ACCESS_KEY` | S3 PutObject | — | Standard AWS signing secret |
 | `AWS_SESSION_TOKEN` | S3 PutObject | — | Temporary credentials (OIDC / STS) |
-| `AWS_REGION` / `AWS_DEFAULT_REGION` | `build.assets.upload` | — | Asset upload region |
-| `AWS_ENDPOINT_URL` | `build.assets.upload` | — | S3-compatible endpoint (asset upload) |
 | `JSKELET_LOG_BUCKET` | `logs.s3` | — | Log target: bucket or `bucket/prefix` path. With credentials, the sink turns on automatically |
 | `JSKELET_S3_BUCKET` | `logs.s3` | — | Bucket when `JSKELET_LOG_BUCKET` is unset; joins with `JSKELET_S3_KEY_PREFIX` |
 | `JSKELET_S3_KEY_PREFIX` | `logs.s3` | — | Used with `JSKELET_S3_BUCKET` (`bucket/prefix`) |

package/docs/en/08-build.md

@@ -35,7 +35,7 @@ The order is not arbitrary:
   the S3 step copies only the raw files.
 - **Images never run on a watch pass:** re-encoding with `sharp` is expensive.
 - **Assets upload never runs on watch:** only production `jskelet build`; when
-  off the step still prints (`skipped (no JSKELET_ASSETS_BUCKET)`, etc.).
+  off the step still prints (`skipped (no build.assets.upload.bucket)`, etc.).
 
 Tasks only run if the relevant configuration exists. A project that does not
 define any fonts never sees the font step; this is the build-side counterpart of
@@ -81,25 +81,24 @@ They are passed to templates automatically; in server code,
 ```
 
 - `asset(name)` returns the hashed URL if it is in the manifest, otherwise
-  `/assets/<name>`. When `build.assets.prefix` / `JSKELET_ASSET_PREFIX` is set,
-  that relative path is prefixed with the CDN origin (the on-disk manifest stays
-  relative).
+  `/assets/<name>`. When `build.assets.prefix` is set, that relative path is
+  prefixed with the CDN origin (the on-disk manifest stays relative).
 - `hasAsset(name)` tells you whether it is in the manifest.
 
 ### CDN prefix and S3 upload
 
-Off by default. When enabled:
+Off by default. Prefix / bucket / keyPrefix come from config; credentials
+resolve from env → ECS task role → EC2 IMDS. When enabled:
 
 1. A production build PutObjects files under `public/assets/` (and any other
    directories in `include`) to S3.
 2. At runtime `asset()` / optimised images emit absolute CDN URLs via
-   `JSKELET_ASSET_PREFIX`. When the entry script is on the CDN, esbuild chunks
+   `build.assets.prefix`. When the entry script is on the CDN, esbuild chunks
    resolve relatively on the same host.
 
-Credentials: `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` first, else
-`JSKELET_S3_*`. Bucket: `JSKELET_ASSETS_BUCKET`. Config reference:
-[07-configuration.md](./07-configuration.md#build). Deploy notes:
-[10-deployment.md](./10-deployment.md).
+Bucket names may include dots (`static.example.com`); put `https://…` in
+`prefix`. Config reference: [07-configuration.md](./07-configuration.md#build).
+Deploy notes: [10-deployment.md](./10-deployment.md).
 
 If the build has not run, the application still comes up: `hasAsset()` is false
 and the layout never emits the stylesheet and script tags. When `jskelet build`

package/docs/en/10-deployment.md

@@ -52,20 +52,30 @@ considering in production:
 | `PREWARM_MAX` | Depends on site size | Number of pages warmed at startup |
 | `PREWARM_INTERVAL_SECONDS` | `0` or a long value | If you want to keep never-visited pages warm |
 | `DEV_GATE` + `DEV_TOKEN` | Staging only | Hides an environment that is not public yet. The token alone does not lock the site |
-| `JSKELET_S3_*` / `AWS_*` | If you write access logs or assets to S3 | Credentials; on AWS, `AWS_ACCESS_KEY_ID` etc. are enough. Details in [07](./07-configuration.md) |
-| `JSKELET_ASSETS_BUCKET` | If you publish hashed assets to S3/CloudFront | PutObject at the end of production `jskelet build`; `JSKELET_ASSET_PREFIX` makes HTML emit CDN URLs |
+| `JSKELET_S3_*` / `AWS_*` | If you write access logs or assets to S3 | Credentials only; bucket/prefix live in `jskelet.config.mjs` → `build.assets`. Details in [07](./07-configuration.md) |
 
 ### Publishing assets to S3 / CloudFront
 
-Off by default. In CI or a production build environment:
+Off by default. Prefix + bucket in config; credentials only in CI:
+
+```js
+// jskelet.config.mjs
+build: {
+  assets: {
+    prefix: "https://static.example.com/js",
+    upload: {
+      bucket: "static.example.com", // or "static.example.com/js"
+      keyPrefix: "js",
+      region: "eu-central-1",
+    },
+  },
+},
+```
 
 ```bash
-JSKELET_ASSETS_BUCKET=my-app-assets          # or my-app-assets/static
-JSKELET_ASSET_PREFIX=https://dxxxx.cloudfront.net
-AWS_REGION=eu-central-1
+# CI / local: explicit keys. On ECS/EC2 a task/instance role is enough — no keys required.
 AWS_ACCESS_KEY_ID=…
 AWS_SECRET_ACCESS_KEY=…
-# for temporary credentials:
 # AWS_SESSION_TOKEN=…
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jskelet",
-  "version": "0.6.9",
+  "version": "0.6.11",
   "description": "A framework that feels like no framework: Express 5 + build-time .jsk SSR (optional EJS peer), vanilla JS islands, Tailwind v4 and an in-process HTML TTL cache.",
   "type": "module",
   "license": "MIT",

package/src/build/tasks/assets-upload.mjs

@@ -1,16 +1,18 @@
 /**
  * Production build sonunda hash'li varlıkları S3'e PutObject ile kopyalar.
  *
- * Watch turunda çalışmaz (çağıran sorumlu). Credential env'den gelir
- * (`AWS_*` önce, `JSKELET_S3_*` yedek). Bucket / credential yoksa veya upload
- * kapalıysa adım yine görünür: `skipped (…)` ile sebep basılır, build düşmez.
+ * Watch turunda çalışmaz (çağıran sorumlu). Credential: env (`AWS_*` /
+ * `JSKELET_S3_*`) → ECS task role → EC2 instance profile. Bucket yoksa veya
+ * upload kapalıysa adım yine görünür: `skipped (…)` ile sebep basılır.
+ * Credential yalnızca env+metadata zinciri boşsa skip; task role varken
+ * env key şart değil.
  *
  * `.br` / `.gz` kardeşleri yüklenmez: edge kendi sıkıştırmasını yapsın;
  * origin precompress Express için kalır.
  */
 import fs from "node:fs";
 import path from "node:path";
-import { readS3CredentialsFromEnv } from "../../config/index.js";
+import { resolveS3Credentials } from "../../server/logs/s3-credentials.js";
 import { putObject } from "../../server/logs/s3-put.js";
 import * as log from "../../log.mjs";
 import { paths } from "../paths.mjs";
@@ -88,7 +90,7 @@ function resolveIncludeDir(name) {
 }
 
 /**
- * Upload yapılmayacaksa kısa sebep; yapılacaksa `null`.
+ * Config kapısı — credential burada bakılmaz (task role async).
  *
  * @param {import('../../config/index.js').ResolvedConfig} config
  * @returns {string | null}
@@ -97,22 +99,21 @@ export function assetsUploadSkipReason(config) {
   const upload = config.build?.assets?.upload;
 
   if (!upload?.enabled) {
-    // Bucket yoksa asıl eksik env'i söyle — `enabled: false` çoğu zaman
+    // Bucket yoksa asıl eksik alanı söyle — `enabled: false` çoğu zaman
     // bucket tanımlanmadığı için dolaylıdır.
-    if (!upload?.bucket) return "no JSKELET_ASSETS_BUCKET";
+    if (!upload?.bucket) return "no build.assets.upload.bucket";
     return "build.assets.upload.enabled is false";
   }
 
-  if (!upload.bucket) return "no JSKELET_ASSETS_BUCKET";
-
-  if (!readS3CredentialsFromEnv()) return "credentials missing";
+  if (!upload.bucket) return "no build.assets.upload.bucket";
 
   return null;
 }
 
 /**
  * @param {import('../../config/index.js').ResolvedConfig} config
- * @param {{ put?: typeof putObject }} [options]
+ * @param {{ put?: typeof putObject,
+ *   resolveCredentials?: typeof resolveS3Credentials }} [options]
  * @returns {Promise<void>}
  */
 export async function uploadAssets(config, options = {}) {
@@ -123,15 +124,17 @@ export async function uploadAssets(config, options = {}) {
   }
 
   const upload = config.build.assets.upload;
-  const credentials = readS3CredentialsFromEnv();
-  // skipReason null iken credential ve bucket vardır; TS/akış için daralt.
+  const resolve = options.resolveCredentials ?? resolveS3Credentials;
+  const credentials = await resolve();
   if (!upload.bucket || !credentials) {
     log.detail("skipped (credentials missing)");
     return;
   }
 
   const put = options.put ?? putObject;
-  const keyPrefix = (upload.keyPrefix || "").replace(/^\/+/, "");
+  // Normalize bazen atlanır (test / elle config); önek `/` ile bitsin.
+  let keyPrefix = (upload.keyPrefix || "").replace(/^\/+/, "");
+  if (keyPrefix && !keyPrefix.endsWith("/")) keyPrefix += "/";
 
   /** @type {{ file: string, key: string }[]} */
   const jobs = [];

package/src/config/defaults.js

@@ -498,10 +498,11 @@ export const DEFAULT_BUILD = {
     chunkGroup: null,
   },
   assets: {
-    /** CDN / CloudFront origin; sonunda `/` yok. Env: `JSKELET_ASSET_PREFIX`. */
+    /** CDN / CloudFront origin; sonunda `/` yok. Yalnızca config. */
     prefix: "",
     upload: {
       enabled: false,
+      /** S3 bucket adı (CDN URL değil). Yalnızca config; credential env'den. */
       bucket: null,
       /** Nesne anahtarı öneki (`bucket/path` split'inden veya config). */
       keyPrefix: "",

package/src/config/index.js

@@ -33,6 +33,10 @@ import path from "node:path";
 import process from "node:process";
 import { pathToFileURL } from "node:url";
 import { compilePattern, matchPattern } from "./pattern.js";
+import {
+  readS3CredentialsFromEnv,
+  resolveS3Credentials,
+} from "../server/logs/s3-credentials.js";
 import {
   DEFAULT_ADMIN,
   DEFAULT_AUTH,
@@ -64,6 +68,8 @@ import {
   DEFAULT_UPSTREAM_LIMIT,
 } from "./defaults.js";
 
+export { readS3CredentialsFromEnv, resolveS3Credentials };
+
 /** Framework paketinin kökü — kendi şablonlarına ve varlıklarına erişir. */
 export const FRAMEWORK_ROOT = path.resolve(import.meta.dirname, "..", "..");
 
@@ -180,7 +186,7 @@ const CONFIG_FILE = "jskelet.config.mjs";
  * @property {string} cacheControl
  *
  * @typedef {object} BuildAssetsConfig
- * @property {string} prefix CDN origin (`JSKELET_ASSET_PREFIX`); sonunda `/` yok.
+ * @property {string} prefix CDN origin (`build.assets.prefix`); sonunda `/` yok.
  * @property {BuildAssetsUploadConfig} upload
  *
  * @typedef {object} BuildConfig
@@ -527,32 +533,6 @@ function envText(value) {
   return typeof value === "string" && value ? value : null;
 }
 
-/**
- * S3 imza credential'ları. AWS deploy'da standart env önce gelir; R2/MinIO
- * için `JSKELET_S3_*` yedek. IAM instance/task role (IMDS) desteklenmez —
- * CI'da `configure-aws-credentials` gibi araçlar zaten `AWS_*` basar.
- *
- * @returns {{ accessKeyId: string, secretAccessKey: string,
- *   sessionToken: string | null } | null}
- */
-export function readS3CredentialsFromEnv() {
-  const accessKeyId =
-    envText(process.env.AWS_ACCESS_KEY_ID) ??
-    envText(process.env.JSKELET_S3_ACCESS_KEY_ID);
-  const secretAccessKey =
-    envText(process.env.AWS_SECRET_ACCESS_KEY) ??
-    envText(process.env.JSKELET_S3_SECRET_ACCESS_KEY) ??
-    envText(process.env.JSKELET_S3_ACCESS_SECRET);
-  if (!accessKeyId || !secretAccessKey) return null;
-  return {
-    accessKeyId,
-    secretAccessKey,
-    sessionToken:
-      envText(process.env.AWS_SESSION_TOKEN) ??
-      envText(process.env.JSKELET_S3_SESSION_TOKEN),
-  };
-}
-
 /**
  * Log hedefi. Öncelik: `JSKELET_LOG_BUCKET` → `JSKELET_S3_BUCKET`
  * (+ isteğe bağlı `JSKELET_S3_KEY_PREFIX`).
@@ -1186,7 +1166,34 @@ function defaultBuildClient() {
 }
 
 /**
- * CDN prefix + S3 upload (`build.assets`). Credential config'e yazılmaz.
+ * Asset upload bucket'ı. CDN URL buraya yazılmaz — o `build.assets.prefix`.
+ *
+ * @param {unknown} value
+ * @returns {{ bucket: string | null, prefix: string | null }}
+ */
+function normalizeAssetsBucket(value) {
+  const text = typeof value === "string" ? value.trim() : "";
+  if (!text) return { bucket: null, prefix: null };
+
+  // Noktalı bucket adları geçerli (`static.investvio.com`). Reddedilen yalnızca
+  // şemalı URL — CDN origin `build.assets.prefix`'te kalır.
+  if (/^https?:\/\//i.test(text)) {
+    console.warn(
+      "[config] build.assets.upload.bucket looks like a URL — use the S3 " +
+        "bucket name without a scheme (e.g. \"static.investvio.com\" or " +
+        "\"static.investvio.com/js\"); put https://… in build.assets.prefix",
+    );
+    return { bucket: null, prefix: null };
+  }
+
+  return splitS3BucketPath(text);
+}
+
+/**
+ * CDN prefix + S3 upload (`build.assets`).
+ *
+ * Prefix / bucket / keyPrefix / region / endpoint **yalnızca config**'ten.
+ * Credential env'den (`AWS_*`, yoksa `JSKELET_S3_*`) — config'e yazılmaz.
  *
  * @param {unknown} raw
  * @returns {BuildAssetsConfig}
@@ -1201,10 +1208,9 @@ export function normalizeBuildAssets(raw) {
     console.warn("[config] build.assets must be an object, ignoring it");
   }
 
-  const envPrefix = envText(process.env.JSKELET_ASSET_PREFIX);
-  const configPrefix =
-    typeof source.prefix === "string" ? source.prefix.trim() : "";
-  const prefix = (envPrefix ?? configPrefix).replace(/\/+$/, "");
+  const prefix = (
+    typeof source.prefix === "string" ? source.prefix.trim() : ""
+  ).replace(/\/+$/, "");
 
   const uploadRaw =
     source.upload != null &&
@@ -1220,10 +1226,7 @@ export function normalizeBuildAssets(raw) {
     console.warn("[config] build.assets.upload must be an object, ignoring it");
   }
 
-  const envBucket = envText(process.env.JSKELET_ASSETS_BUCKET);
-  const bucketPath = splitS3BucketPath(
-    envBucket ?? envText(uploadRaw.bucket),
-  );
+  const bucketPath = normalizeAssetsBucket(uploadRaw.bucket);
 
   const configKeyPrefix =
     typeof uploadRaw.keyPrefix === "string" && uploadRaw.keyPrefix
@@ -1236,17 +1239,15 @@ export function normalizeBuildAssets(raw) {
           : `${uploadRaw.prefix}/`
         : DEFAULT_BUILD.assets.upload.keyPrefix;
 
-  const endpoint =
-    envText(process.env.AWS_ENDPOINT_URL) ??
-    envText(process.env.JSKELET_S3_API_URL) ??
-    envText(uploadRaw.endpoint);
+  // Bucket yolundaki önek (`my-bucket/js`) `keyPrefix`'i ezer — tek alanda
+  // hem kova hem klasör vermek için.
+  const keyPrefix = bucketPath.prefix ?? configKeyPrefix;
+
+  const endpoint = envText(uploadRaw.endpoint);
 
   // Gerçek AWS'te region imza için gerekir; custom endpoint'te `auto` yaygın.
   const region =
     envText(uploadRaw.region) ??
-    envText(process.env.AWS_REGION) ??
-    envText(process.env.AWS_DEFAULT_REGION) ??
-    envText(process.env.JSKELET_S3_REGION) ??
     (endpoint ? "auto" : DEFAULT_BUILD.assets.upload.region);
 
   /** @type {string[]} */
@@ -1268,8 +1269,7 @@ export function normalizeBuildAssets(raw) {
       ? uploadRaw.cacheControl.trim()
       : DEFAULT_BUILD.assets.upload.cacheControl;
 
-  // `JSKELET_ASSETS_BUCKET` doluysa config'te `enabled` unutulmuş olsa bile aç.
-  // Açık `enabled: false` ezer.
+  // Config'te bucket varsa `enabled` unutulmuş olsa bile aç. Açık `false` ezer.
   const enabled =
     uploadRaw.enabled === true ||
     (uploadRaw.enabled !== false && Boolean(bucketPath.bucket));
@@ -1279,7 +1279,7 @@ export function normalizeBuildAssets(raw) {
     upload: {
       enabled,
       bucket: bucketPath.bucket,
-      keyPrefix: bucketPath.prefix ?? configKeyPrefix,
+      keyPrefix,
       region,
       endpoint,
       include,

package/src/server/assets.js

@@ -6,9 +6,9 @@
  * basmaz. Böylece `jskelet build` unutulduğunda hata yerine stilsiz ama
  * çalışan bir sayfa görürsünüz.
  *
- * `build.assets.prefix` / `JSKELET_ASSET_PREFIX` doluysa HTML'e basılan
- * URL'lere CDN origin eklenir; manifest diskte göreli kalır (çok ortamlı
- * tek artifact). Dosya sistemi okumaları (`getSpriteIds`) göreli yolu kullanır.
+ * `build.assets.prefix` doluysa HTML'e basılan URL'lere CDN origin eklenir;
+ * manifest diskte göreli kalır. Dosya sistemi okumaları (`getSpriteIds`)
+ * göreli yolu kullanır.
  */
 import fs from "node:fs";
 import path from "node:path";

package/src/server/logs/pipeline.js

@@ -6,9 +6,9 @@
  */
 import process from "node:process";
 import * as log from "../../log.mjs";
-import { readS3CredentialsFromEnv } from "../../config/index.js";
 import { createFileSink } from "./file-sink.js";
 import { createS3Sink } from "./s3-sink.js";
+import { resolveS3Credentials } from "./s3-credentials.js";
 
 /**
  * @typedef {import('../../config/index.js').LogsConfig} LogsConfig
@@ -73,14 +73,15 @@ export async function configureLogs(config) {
   }
 
   if (logs.s3.enabled) {
-    const credentials = readS3CredentialsFromEnv();
+    const credentials = await resolveS3Credentials();
     if (!logs.s3.bucket) {
       console.warn(
         "[logs] s3.enabled but no bucket (set JSKELET_LOG_BUCKET, JSKELET_S3_BUCKET or logs.s3.bucket)",
       );
     } else if (!credentials) {
       console.warn(
-        "[logs] s3.enabled but credentials missing — set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or JSKELET_S3_*",
+        "[logs] s3.enabled but credentials missing — set AWS_ACCESS_KEY_ID/" +
+          "AWS_SECRET_ACCESS_KEY or JSKELET_S3_*, or run with an ECS/EC2 IAM role",
       );
     } else {
       const region = logs.s3.region || "auto";

package/src/server/logs/s3-credentials.js

@@ -0,0 +1,195 @@
+/**
+ * S3 imza credential zinciri — SDK yok.
+ *
+ * 1. Env: `AWS_*` sonra `JSKELET_S3_*`
+ * 2. ECS/Fargate task role: `AWS_CONTAINER_CREDENTIALS_*`
+ * 3. EC2 instance profile: IMDSv2 (kısa timeout; local'de asılı kalmaz)
+ *
+ * EKS IRSA (`AWS_WEB_IDENTITY_TOKEN_FILE`) bilinçli olarak yok — STS çağrısı
+ * ayrı yüzey; CI genelde zaten `AWS_*` basar.
+ */
+import fs from "node:fs";
+import process from "node:process";
+
+/**
+ * @typedef {{ accessKeyId: string, secretAccessKey: string,
+ *   sessionToken: string | null }} AwsCredentials
+ */
+
+const METADATA_TIMEOUT_MS = 400;
+const ECS_METADATA_HOST = "http://169.254.170.2";
+const EC2_METADATA_HOST = "http://169.254.169.254";
+
+/**
+ * @param {unknown} value
+ * @returns {string | null}
+ */
+function envText(value) {
+  return typeof value === "string" && value ? value : null;
+}
+
+/**
+ * @returns {AwsCredentials | null}
+ */
+export function readS3CredentialsFromEnv() {
+  const accessKeyId =
+    envText(process.env.AWS_ACCESS_KEY_ID) ??
+    envText(process.env.JSKELET_S3_ACCESS_KEY_ID);
+  const secretAccessKey =
+    envText(process.env.AWS_SECRET_ACCESS_KEY) ??
+    envText(process.env.JSKELET_S3_SECRET_ACCESS_KEY) ??
+    envText(process.env.JSKELET_S3_ACCESS_SECRET);
+  if (!accessKeyId || !secretAccessKey) return null;
+  return {
+    accessKeyId,
+    secretAccessKey,
+    sessionToken:
+      envText(process.env.AWS_SESSION_TOKEN) ??
+      envText(process.env.JSKELET_S3_SESSION_TOKEN),
+  };
+}
+
+/**
+ * @param {Record<string, unknown>} data
+ * @returns {AwsCredentials | null}
+ */
+function fromAwsCredentialJson(data) {
+  const accessKeyId =
+    typeof data.AccessKeyId === "string" ? data.AccessKeyId : null;
+  const secretAccessKey =
+    typeof data.SecretAccessKey === "string" ? data.SecretAccessKey : null;
+  if (!accessKeyId || !secretAccessKey) return null;
+  const token =
+    (typeof data.Token === "string" && data.Token) ||
+    (typeof data.SessionToken === "string" && data.SessionToken) ||
+    null;
+  return { accessKeyId, secretAccessKey, sessionToken: token };
+}
+
+/**
+ * @param {string} url
+ * @param {RequestInit} [init]
+ * @param {number} [timeoutMs]
+ * @returns {Promise<unknown | null>}
+ */
+async function fetchJson(url, init = {}, timeoutMs = METADATA_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { ...init, signal: controller.signal });
+    if (!response.ok) return null;
+    return await response.json();
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * @param {string} url
+ * @param {RequestInit} [init]
+ * @param {number} [timeoutMs]
+ * @returns {Promise<string | null>}
+ */
+async function fetchText(url, init = {}, timeoutMs = METADATA_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { ...init, signal: controller.signal });
+    if (!response.ok) return null;
+    return (await response.text()).trim() || null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * ECS task role / container credential provider.
+ *
+ * @returns {Promise<AwsCredentials | null>}
+ */
+export async function readS3CredentialsFromEcs() {
+  const relative = envText(process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI);
+  const full = envText(process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI);
+  if (!relative && !full) return null;
+
+  const url = full ?? `${ECS_METADATA_HOST}${relative}`;
+
+  /** @type {Record<string, string>} */
+  const headers = {};
+  const token =
+    envText(process.env.AWS_CONTAINER_AUTHORIZATION_TOKEN) ??
+    readTokenFile(process.env.AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE);
+  if (token) headers.Authorization = token;
+
+  const data = await fetchJson(url, { headers });
+  if (!data || typeof data !== "object") return null;
+  return fromAwsCredentialJson(/** @type {Record<string, unknown>} */ (data));
+}
+
+/**
+ * @param {unknown} pathValue
+ * @returns {string | null}
+ */
+function readTokenFile(pathValue) {
+  const file = envText(pathValue);
+  if (!file) return null;
+  try {
+    const text = fs.readFileSync(file, "utf8").trim();
+    return text || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * EC2 instance profile via IMDSv2 (IMDSv1'e düşmez).
+ *
+ * @returns {Promise<AwsCredentials | null>}
+ */
+export async function readS3CredentialsFromImds() {
+  const token = await fetchText(
+    `${EC2_METADATA_HOST}/latest/api/token`,
+    {
+      method: "PUT",
+      headers: { "X-aws-ec2-metadata-token-ttl-seconds": "21600" },
+    },
+  );
+  if (!token) return null;
+
+  const headers = { "X-aws-ec2-metadata-token": token };
+  const roleName = await fetchText(
+    `${EC2_METADATA_HOST}/latest/meta-data/iam/security-credentials/`,
+    { headers },
+  );
+  if (!roleName) return null;
+
+  // Birden fazla satır olursa ilki.
+  const role = roleName.split("\n")[0]?.trim();
+  if (!role || role.includes("..") || role.includes("/")) return null;
+
+  const data = await fetchJson(
+    `${EC2_METADATA_HOST}/latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`,
+    { headers },
+  );
+  if (!data || typeof data !== "object") return null;
+  return fromAwsCredentialJson(/** @type {Record<string, unknown>} */ (data));
+}
+
+/**
+ * Env → ECS task role → EC2 instance profile.
+ *
+ * @returns {Promise<AwsCredentials | null>}
+ */
+export async function resolveS3Credentials() {
+  const fromEnv = readS3CredentialsFromEnv();
+  if (fromEnv) return fromEnv;
+
+  const fromEcs = await readS3CredentialsFromEcs();
+  if (fromEcs) return fromEcs;
+
+  return readS3CredentialsFromImds();
+}

package/src/server/logs/s3-put.js

@@ -2,9 +2,8 @@
  * Minimal S3 PutObject — yalnızca SigV4 + `fetch`.
  *
  * `@aws-sdk/client-s3` taşınmıyor: tek operasyon için SDK'nın maliyeti ve
- * peer yüzeyi gereksiz. Credential zinciri env'den okunur (`AWS_*` önce,
- * sonra `JSKELET_S3_*`); IAM role / instance metadata yok — CI'da
- * `configure-aws-credentials` gibi araçlar key basar.
+ * peer yüzeyi gereksiz. Credential `resolveS3Credentials` ile gelir
+ * (env → ECS task role → EC2 IMDS).
  */
 import crypto from "node:crypto";
 

package/types/config/defaults.d.ts

@@ -448,10 +448,11 @@ export declare const DEFAULT_BUILD: {
         chunkGroup: ((id: string) => string | null | undefined) | null;
     };
     assets: {
-        /** CDN / CloudFront origin; sonunda `/` yok. Env: `JSKELET_ASSET_PREFIX`. */
+        /** CDN / CloudFront origin; sonunda `/` yok. Yalnızca config. */
         prefix: string;
         upload: {
             enabled: boolean;
+            /** S3 bucket adı (CDN URL değil). Yalnızca config; credential env'den. */
             bucket: null;
             /** Nesne anahtarı öneki (`bucket/path` split'inden veya config). */
             keyPrefix: string;

package/types/config/index.d.ts

@@ -1,4 +1,6 @@
+import { readS3CredentialsFromEnv, resolveS3Credentials } from "../server/logs/s3-credentials.js";
 import { DEFAULT_ADMIN, DEFAULT_CLOUDFLARE, DEFAULT_UPSTREAM_LIMIT } from "./defaults.js";
+export { readS3CredentialsFromEnv, resolveS3Credentials };
 /** Framework paketinin kökü — kendi şablonlarına ve varlıklarına erişir. */
 export declare const FRAMEWORK_ROOT: string;
 export type Eagerness = "conservative" | "moderate" | "eager";
@@ -241,7 +243,7 @@ export type BuildAssetsUploadConfig = {
 };
 export type BuildAssetsConfig = {
     /**
-     * CDN origin (`JSKELET_ASSET_PREFIX`); sonunda `/` yok.
+     * CDN origin (`build.assets.prefix`); sonunda `/` yok.
      */
     prefix: string;
     upload: BuildAssetsUploadConfig;
@@ -278,19 +280,6 @@ export declare function splitS3BucketPath(value: string | null): {
     bucket: string | null;
     prefix: string | null;
 };
-/**
- * S3 imza credential'ları. AWS deploy'da standart env önce gelir; R2/MinIO
- * için `JSKELET_S3_*` yedek. IAM instance/task role (IMDS) desteklenmez —
- * CI'da `configure-aws-credentials` gibi araçlar zaten `AWS_*` basar.
- *
- * @returns {{ accessKeyId: string, secretAccessKey: string,
- *   sessionToken: string | null } | null}
- */
-export declare function readS3CredentialsFromEnv(): {
-    accessKeyId: string;
-    secretAccessKey: string;
-    sessionToken: string | null;
-} | null;
 /**
  * Kalıcı log sink'leri. Bozuk bir `kinds` listesi siteyi düşürmemeli —
  * bilinmeyen girdiler atılır; hiç geçerli tür kalmazsa varsayılana dönülür.
@@ -313,7 +302,10 @@ export type SecurityConfig = {
     };
 };
 /**
- * CDN prefix + S3 upload (`build.assets`). Credential config'e yazılmaz.
+ * CDN prefix + S3 upload (`build.assets`).
+ *
+ * Prefix / bucket / keyPrefix / region / endpoint **yalnızca config**'ten.
+ * Credential env'den (`AWS_*`, yoksa `JSKELET_S3_*`) — config'e yazılmaz.
  *
  * @param {unknown} raw
  * @returns {BuildAssetsConfig}

package/types/server/logs/s3-credentials.d.ts

@@ -0,0 +1,27 @@
+export type AwsCredentials = {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string | null;
+};
+/**
+ * @returns {AwsCredentials | null}
+ */
+export declare function readS3CredentialsFromEnv(): AwsCredentials | null;
+/**
+ * ECS task role / container credential provider.
+ *
+ * @returns {Promise<AwsCredentials | null>}
+ */
+export declare function readS3CredentialsFromEcs(): Promise<AwsCredentials | null>;
+/**
+ * EC2 instance profile via IMDSv2 (IMDSv1'e düşmez).
+ *
+ * @returns {Promise<AwsCredentials | null>}
+ */
+export declare function readS3CredentialsFromImds(): Promise<AwsCredentials | null>;
+/**
+ * Env → ECS task role → EC2 instance profile.
+ *
+ * @returns {Promise<AwsCredentials | null>}
+ */
+export declare function resolveS3Credentials(): Promise<AwsCredentials | null>;