[kvz]

Why

The published CLI now stores mixed-media originals, but the Viewer reference still described image-only catalogs, warn-only integrity mismatches and sync rejecting non-images. This misleads people following the website onboarding flow tracked in transloadit/content#7151.

Changes

• Align the reference with Node SDK/CLI 6.9.0: verified original bytes, checkpointed receipts on mismatch, image/file catalog partitions and mixed-prefix recovery.
• Distinguish the original-preserving CLI from storeImage() callers that deliberately accept transformed image bytes.
• Explain hashed replay recovery without suggesting that renaming bypasses a watermark policy; use a contract link that also works from the published Viewer package.
• Remove one fixture-test assertion on obsolete prose. Existing behavioral upload, mismatch and recovery tests remain unchanged; no source-string assertion replaces it.
• Regenerate the legacy transloadit README from the reviewed Node README; both are byte-identical.
• Default public onboarding to npm/npx with exact tested Viewer/CLI versions. Keep contributor workflows on Yarn and existing application lockfiles intact.
• Document the existing framework-neutral root model and standard Web server handlers, separately from the React/Next adapters. No new adapters or runtime redesign.
• Extend the existing packed Viewer fixture with a small non-React consumer (--core-only for focused runs). Verify exact local package artifacts, absent React/React DOM/Next, version-pinned public URLs, synchronous server signing, and per-request authorized GET/HEAD redirects. Add the neutral browser entry to existing bundle-budget tests.

Documentation and regression-test changes only; no runtime behavior, package version or release is changed.

November 14 follow-up validation

• Fable 5.2 independently reviewed the design and implementation. Its remaining packaging-proof prerequisite was cleared by the full Viewer suite: all nine packaging cases pass, including the neutral root/server bundles.
• Full yarn check passes, and generated legacy README synchronization passes.
• The clean packed consumer passes four behavior tests. A separate clean installation of published Viewer 0.1.0 and Utils 4.11.0 passes the same four tests; neither installation contains React or Next.js. The fixture now confirms that packed runs resolve Viewer/Utils to the exact local tarballs. npm registry access is needed for external dependencies; this is not an offline test.
• Removed only the obsolete command-position/literal and README line-count assertions (19 lines), rather than hardcoding replacement prose. This deliberately removes the 110/40-line editorial caps; behavior, scaffold and manifest checks remain. Wording and brevity are independently reviewed instead.
• Follow-up council: two rounds with no accepted defects. The first round suggested a Zod wrapper for npm's freshly generated fixture lockfile; this is not an untrusted application boundary, malformed data already aborts and exact artifact assertions prevent registry substitution. A comment records that decision. The second round found no issues. No runtime gate or behavior test was relaxed.
• New-head CI 43612770892 is green on e9122ae: all 14 executed checks pass, including Node 20/22/24/26, the packed Next.js fixture, Supabase Edge, E2E and release dry run. The exact-head watcher exited 0; no package was published.

Earlier batch validation

• Full corepack yarn check.
• yarn lint:transloadit-sync after generating the legacy wrapper README. The first CI run caught this missing derived file; it was cancelled before the corrected push, not treated as passing. CI on the corrected head is green, including the published-package fixtures and ready-only checks.
• Council: three rounds, ending with two consecutive clean rounds. Fixed the fresh-basename recovery omission and the package-relative contract link from the first round.
• That earlier batch changed only prose; existing CLI behavior remained the source of truth. The follow-up now adds the isolated consumer proof described above.

Shipment

Squashmerged under Kevin's shipping approval on November 15 at 11:20:36 UTC as 0ebefa40bd5aadcdc6d14c99236f89eb62f8663e, after all 14 executed checks passed on exact head e9122ae85dfb9c301442af97bfe7bc8a4274a018. The initial GraphQL request returned HTTP 502, and its retry reported “merge already in progress”; fresh readback still showed open/clean, after which the SHA-bound REST merge succeeded and independent PR readback confirmed the merge. No code or CI was changed for recovery.

Companion public guide: https://github.com/transloadit/content/pull/7428. Its reference dependency is now on main; Content follows after its main-conflict resolution and green new CI under Kevin's separate admin-squash/website-deploy approval. No new package version or manual npm publication is needed.

Related: https://github.com/transloadit/content/issues/7151 · DAM-071.

_{🤖 Claimed by kvz on studio1/content-clone-7; framework1/node-sdk since 2026-11-14 · resume: codex resume 019fa2ee-f994-79d0-9d50-071bf2cb7ad6}