emdash-plugin-r2-variants 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # emdash-plugin-r2-variants
 
+## 0.1.1
+
+- Docs only, no code changes. The README now lists the declared capability
+  (`media:read`) and explains the native trust boundary, as EmDash's guide to
+  distributing native plugins asks.
+
 ## 0.1.0
 
 - First release: `Image` component, Portable Text `image` block, dark-mode
@@ -10,3 +16,5 @@
   points and colours from content, skip originals over 25 MB, validate options.
 - Uses EmDash's exported helpers and constants instead of copies. Removed the
   `prefix` option.
+- Capabilities: declares `media:read`, which EmDash requires for the
+  `media:afterUpload` hook that schedules cleanup. No allowed hosts.

package/README.md

@@ -153,6 +153,20 @@ import { Image } from "emdash-plugin-r2-variants/astro";
 3. Add a cron trigger to `wrangler.jsonc` so EmDash's scheduled handler runs plugin
    jobs, for example `"triggers": { "crons": ["* * * * *"] }`.
 
+## Capabilities
+
+| Capability   | Used by                                                                                   |
+| ------------ | ----------------------------------------------------------------------------------------- |
+| `media:read` | The `media:afterUpload` hook, which schedules the daily cleanup job. EmDash requires this capability for that hook. |
+
+The plugin declares no allowed hosts and makes no network requests.
+
+Capabilities gate only the `ctx` APIs that EmDash passes to the plugin. As a
+native plugin, this code also has access to everything the site's Worker has,
+including all bindings and environment variables. That access is why the
+plugin can read and write R2 directly. Review it as you would the site's own
+code.
+
 ## Security
 
 - Storage keys are read from content, so the plugin accepts only keys that

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "emdash-plugin-r2-variants",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Image variants plugin for EmDash CMS - stores each resized image in R2 once and serves it without a Worker transform",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -12,7 +12,7 @@ export function r2Variants(options = {}) {
 	validate(options);
 	return {
 		id: "r2-variants",
-		version: "0.1.0",
+		version: "0.1.1",
 		format: "native",
 		entrypoint: "emdash-plugin-r2-variants/plugin",
 		componentsEntry: "emdash-plugin-r2-variants/astro",

package/src/plugin.js

@@ -16,7 +16,7 @@ export function createPlugin(options = {}) {
 	configure(options);
 	return definePlugin({
 		id: "r2-variants",
-		version: "0.1.0",
+		version: "0.1.1",
 		// media:read is what EmDash requires for media:afterUpload.
 		capabilities: ["media:read"],
 		hooks: {