@pantheon-systems/p1-media 0.4.4 → 0.4.5

package/dist/index.d.mts

@@ -58,7 +58,7 @@ interface MediaConfig {
 type GetAuthToken = () => Promise<string | null> | string | null;
 
 interface MediaPluginOptions {
-    /** The base URL of the Cloudflare Worker media API. Defaults to the production host. */
+    /** The base URL of the media API. Defaults to the production host. */
     workerUrl?: string;
     /**
      * Site identifier used to scope media to a specific site. Defaults to the
@@ -68,7 +68,7 @@ interface MediaPluginOptions {
     siteId?: string;
     /**
      * Workstream (branch) identifier. Currently accepted for forward-compat but not
-     * read by the Worker for any scoping decision — omit unless a future release
+     * read by the backend for any scoping decision — omit unless a future release
      * documents otherwise.
      */
     workstreamId?: string;
@@ -89,7 +89,7 @@ interface MediaPluginOptions {
     metadataFields?: MetadataFieldDef[];
 }
 /**
- * Creates a Puck plugin that adds a media library backed by Cloudflare R2 + D1.
+ * Creates a Puck plugin that adds a media library backed by Cloudflare R2.
  * It supports two field modes:
  *   - Basic: text fields matching image/media name patterns are replaced with the
  *     picker and store a clean CDN URL string. Render with `buildImageUrl()`.
@@ -145,7 +145,7 @@ interface ImageTransformParams {
     quality?: number;
 }
 /**
- * Merges Cloudflare Images transform params onto a CDN image URL.
+ * Merges image transform params onto a CDN image URL.
  * Preserves any existing params in the URL — e.g. the editor's crop intent
  * (`fit=cover&gravity=auto` for smart crop, `trim.*` for a manual crop).
  *
@@ -158,20 +158,17 @@ interface GetMediaPropsOptions {
     /**
      * The CDN image origin that serves media, e.g.
      * "https://staging.media.p1.pantheon.io". This is the public image host —
-     * NOT the Worker API URL (`…workers.dev`), whose origin would reject every
-     * real image URL.
+     * NOT the content API URL, whose origin would reject every real image URL.
      *
-     * Security (required): a value's `url` is untrusted document content — anyone
-     * who can edit a document, or call the CCR `/edits` API, controls it. Without
-     * an origin check a crafted `https://evil.example/beacon.png` turns every
-     * published render into a visitor-IP exfil beacon (and an SSRF under
-     * server-fetching `next/image`). getMediaProps therefore rejects any url that
-     * is not `https` on this exact origin. If `mediaBaseUrl` is omitted it
+     * Security (required): a value's `url` is untrusted document content —
+     * anyone who can edit a document controls it. getMediaProps rejects any url
+     * that is not `https` on this exact origin, so an edited document can't
+     * point a render at an arbitrary origin. If `mediaBaseUrl` is omitted it
      * **fails closed** (empty src) rather than degrading to an insecure pass-through.
      *
      * Local dev exception: when the configured base is itself `http` on a
-     * loopback host (`localhost`, `127.0.0.1`, `[::1]` — a local `wrangler dev`
-     * worker), same-origin `http` urls are allowed so rich values render locally.
+     * loopback host (`localhost`, `127.0.0.1`, `[::1]`), same-origin `http`
+     * urls are allowed so rich values render locally.
      */
     mediaBaseUrl?: string;
     /** Transform params merged onto the validated URL (width, height, format, quality). */

package/dist/index.d.ts

@@ -58,7 +58,7 @@ interface MediaConfig {
 type GetAuthToken = () => Promise<string | null> | string | null;
 
 interface MediaPluginOptions {
-    /** The base URL of the Cloudflare Worker media API. Defaults to the production host. */
+    /** The base URL of the media API. Defaults to the production host. */
     workerUrl?: string;
     /**
      * Site identifier used to scope media to a specific site. Defaults to the
@@ -68,7 +68,7 @@ interface MediaPluginOptions {
     siteId?: string;
     /**
      * Workstream (branch) identifier. Currently accepted for forward-compat but not
-     * read by the Worker for any scoping decision — omit unless a future release
+     * read by the backend for any scoping decision — omit unless a future release
      * documents otherwise.
      */
     workstreamId?: string;
@@ -89,7 +89,7 @@ interface MediaPluginOptions {
     metadataFields?: MetadataFieldDef[];
 }
 /**
- * Creates a Puck plugin that adds a media library backed by Cloudflare R2 + D1.
+ * Creates a Puck plugin that adds a media library backed by Cloudflare R2.
  * It supports two field modes:
  *   - Basic: text fields matching image/media name patterns are replaced with the
  *     picker and store a clean CDN URL string. Render with `buildImageUrl()`.
@@ -145,7 +145,7 @@ interface ImageTransformParams {
     quality?: number;
 }
 /**
- * Merges Cloudflare Images transform params onto a CDN image URL.
+ * Merges image transform params onto a CDN image URL.
  * Preserves any existing params in the URL — e.g. the editor's crop intent
  * (`fit=cover&gravity=auto` for smart crop, `trim.*` for a manual crop).
  *
@@ -158,20 +158,17 @@ interface GetMediaPropsOptions {
     /**
      * The CDN image origin that serves media, e.g.
      * "https://staging.media.p1.pantheon.io". This is the public image host —
-     * NOT the Worker API URL (`…workers.dev`), whose origin would reject every
-     * real image URL.
+     * NOT the content API URL, whose origin would reject every real image URL.
      *
-     * Security (required): a value's `url` is untrusted document content — anyone
-     * who can edit a document, or call the CCR `/edits` API, controls it. Without
-     * an origin check a crafted `https://evil.example/beacon.png` turns every
-     * published render into a visitor-IP exfil beacon (and an SSRF under
-     * server-fetching `next/image`). getMediaProps therefore rejects any url that
-     * is not `https` on this exact origin. If `mediaBaseUrl` is omitted it
+     * Security (required): a value's `url` is untrusted document content —
+     * anyone who can edit a document controls it. getMediaProps rejects any url
+     * that is not `https` on this exact origin, so an edited document can't
+     * point a render at an arbitrary origin. If `mediaBaseUrl` is omitted it
      * **fails closed** (empty src) rather than degrading to an insecure pass-through.
      *
      * Local dev exception: when the configured base is itself `http` on a
-     * loopback host (`localhost`, `127.0.0.1`, `[::1]` — a local `wrangler dev`
-     * worker), same-origin `http` urls are allowed so rich values render locally.
+     * loopback host (`localhost`, `127.0.0.1`, `[::1]`), same-origin `http`
+     * urls are allowed so rich values render locally.
      */
     mediaBaseUrl?: string;
     /** Transform params merged onto the validated URL (width, height, format, quality). */