@cosmicdrift/kumiko-types 0.196.1 → 0.197.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-types",
-  "version": "0.196.1",
+  "version": "0.197.1",
   "description": "Framework-Type-Definitions für Kumiko — FeatureDefinition, BootCheck-Types und die reinen Engine-Types. Erlaubt Downstream-Konsumenten, gegen die Type-Contracts zu bauen, ohne das ganze Framework-Package zu importieren. Enthaelt keine identitaets-sensitiven Runtime-Werte mehr (Error-Klassen leben seit #1629 in kumiko-framework, Brand-Symbole nutzen Symbol.for) und ist deshalb eine plain dependency, keine peerDependency.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/derivatives-types.ts

@@ -35,10 +35,12 @@ export type VariantSpec = {
 //
 // The renderer must produce `spec.format` when set, and the source's own
 // format otherwise. It never reports back what it produced: the caller
-// derives the output mimeType from the spec alone (see outputMimeType in
-// derivatives-context.ts), because a cache hit has no renderer run to read
-// a mimeType off, and a spec-derived value is the only one both branches
-// can share.
+// derives the output mimeType from the spec plus the source FileRef's
+// mimeType (see outputMimeType in derivatives-context.ts), because a cache
+// hit has no renderer run to read a mimeType off. When `spec.format` is
+// unset, the source mimeType is client-controlled, so outputMimeType
+// allowlists it against known-safe raster types instead of passing it
+// through verbatim (#2021).
 export type DerivativeRendererPlugin = {
   readonly render: (
     input: Uint8Array,