[kvz]

Why: API2 accepts Supabase user JWTs, but the released CLI rejects session_token before sending an Assembly. This blocks user-scoped Supabase uploads and a waiting customer reply.

Closes #636.

• Sync current Robot schemas from transloadit/api2@324f2c877f417a504d06263e60528e61743a3033, including /supabase/store.session_token. Use the existing alphalib sync tool’s filtered copier against a pinned git archive, retaining its SDK exclusions and regenerating the Robot index. Include the new schema dependencies; no generated schemas were hand-edited and no source checkout was switched. Because the repo-wide CLI would switch other active checkouts, a one-off Node load hook exposed syncAlphalibFromWorkspace without running its CLI; all 112 selected source files match API2 byte for byte.
• Warn and forward unknown top-level Step parameters in CLI Assembly/Template input. This is smaller than adding a network-dependent freshness gate and lets new API parameters work between SDK releases. Known parameters, Robot names, nested values, and instruction-wrapper properties remain validated. Warnings show names only.
• Add the coupled changeset for Node, the legacy wrapper, Types, Zod, and MCP. The full current contract also adds document splitting/Markdown/HTML and preview quality. It updates SFTP, concat, and thumbnail defaults. The changeset calls out widened document text formats and optional/nonempty thumbnail offsets.

Validation:

• Red before sync: the new CLI parser regression failed with Invalid steps format: exported: Unrecognized key(s) in object: 'session_token'.
• Green after sync: literal/interpolated JWTs are preserved without warnings; empty/non-string JWTs fail. A separate regression was red before warning-and-forward and now preserves new parameters while normalizing known ones. Invalid known and nested parameters still fail.
• Focused Assembly parsing/reporting: 92 tests pass.
• corepack yarn check and corepack yarn verify:full pass. CI is green on e12374e: all 14 active checks pass, including Node 20/22/24/26, E2E, packaging, and browser fixtures (run).
• Council review: round 1 was clean. Round 2 found two P3 wording issues, both fixed in e12374e: document the Storage-result and preview-fallback defaults, and make the unknown-parameter warning accurate for local signing. The warning correction has a red/green behavioral assertion; the changeset prose needs no behavioral test. The final two consecutive rounds (3 and 4) both returned “No issues found” on e12374e. Four rounds total; no open findings remain.

Diff: +896/−110 in 29 files: runtime +35/−2, synced schemas/dependencies +757/−108, tests +79/−0, and changeset +25/−0.

Release effect: merging this code PR updates the Version Packages PR; it does not publish these new versions. After Kevin separately approves and merges that version PR, the current changeset plan publishes @transloadit/node@6.6.0, transloadit@6.6.0, @transloadit/types@6.5.0, @transloadit/zod@7.5.0, and @transloadit/mcp-server@0.8.3. No npm publish or version/release PR merge was performed here.

_{🤖 Claimed by kvz on framework1/node-sdk since 2026-10-30 · resume: codex resume 01a18b66-a8f8-79a3-bcb5-acf622941b0c}