@still-running/health-check 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ali Alsamraay
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,100 @@
+# Workflow Health Check — parser core
+
+Static analysis of n8n workflow JSON and Make blueprint JSON. No execution, no
+network, no storage. Runs in the browser.
+
+## Architecture
+
+    src/core/model.ts        the neutral shape — the only thing checks may know about
+    src/core/providers.ts    credential expiry table (data, with sources)
+    src/core/checks/         four checks, none of which know a platform exists
+    src/adapters/n8n.ts      all n8n knowledge
+    src/adapters/make.ts     all Make knowledge
+    src/index.ts             detect format, run checks, return findings
+
+The rule that keeps platform three cheap: **a check may never import an adapter,
+and an adapter may never import a check.** Adding Zapier or Workato later is one
+new file in `adapters/` and one line in `parseWorkflow`. Nothing in `core/`
+changes. If a check ever needs `if (platform === ...)` for anything except
+wording a sentence, the model is missing a field — add the field instead.
+
+## Check order
+
+Deliberately inverted from the original spec:
+
+1. **zero-write** — writes that can be skipped while the run reports success
+2. **credential-expiry** — stated as a conditional, never as a prediction
+3. **no-cadence** — nothing declares how often this should run
+4. **error-handling** — table stakes; six free tools ship it already
+
+## Build and test
+
+Tests run straight off TypeScript source, no compile step:
+
+    npm test                          # from the repo root
+    npm run corpus -- ./workflows     # analyzer over a folder of exports
+
+`npm run build` compiles `src/` to `dist/` and stamps `dist/package.json` with
+`{"type":"commonjs"}` so Node parses the output correctly even though this
+package's own `type` is `"module"`. This is the form that actually gets
+published to npm (see `files` in `package.json` — only `dist/` and this
+README ship; `src/` does not) and the form every consumer resolves through
+`exports`, including this monorepo's own `apps/dashboard` and `apps/free-tool`.
+That's deliberate: a package whose `exports.import` condition points at raw
+`.ts` only works by accident, for whichever bundler happens to transpile
+`node_modules` — it would silently break for a real npm install. So the repo
+root's `build`/`dev:tool`/`dev:dash` scripts all build this package first;
+editing `src/` here requires re-running that build (or the app's dev script,
+which does it for you) before the change shows up downstream. Type *checking*
+still resolves straight to `src/index.ts` for both apps, unaffected — see the
+`paths` override in `tsconfig.base.json` and each app's own `tsconfig.json`.
+
+## Results on a real corpus
+
+2,043 workflows from the public n8n template library plus Make's own top-ten
+templates. 2,054 parsed, 12 skipped as not-a-workflow, **0 crashes**.
+
+| measure | result |
+|---|---|
+| workflows with at least one write step | 54.0% |
+| workflows carrying an OAuth credential | 34.3% |
+| workflows with any zero-write finding | 35.5% |
+| workflows the tool actually shouts about (high/critical) | 13.5% |
+
+## How the zero-write check works
+
+For each write step, compute the steps that **dominate** it — the ones every
+path from a trigger must pass through. If a dominator can emit zero items, the
+write is skipped and the run still finishes green.
+
+Dominators rather than path enumeration, for two reasons: a 246-node workflow
+has too many paths to walk, and a gate only truly starves a write when there is
+no way around it. That is exactly what dominance means. `test-dominators.mjs`
+pins the case that matters — a write reachable by a second path is **not**
+flagged.
+
+Severity depends on whether anything in the workflow could notice an empty run:
+an alert branch, a known cadence, or an error handler. With none of those, and
+one write, it is critical. With any of them, it drops. This is what took the
+shout rate from 33% to 13.5% — without it the check is true and unreadable.
+
+## Known limits — read before writing any copy
+
+- **"Can", never "did".** Static JSON cannot tell you a workflow wrote nothing
+  yesterday. It tells you it can, and that nobody would know. Run history is the
+  paid product, and every message here keeps that line visible.
+- **Triggers returning zero are not flagged.** A scheduled scenario that finds
+  no new rows is normal behaviour, and static analysis cannot separate "nothing
+  new today" from "the sheet was renamed". That separation needs a volume
+  baseline. Deliberately out of scope for the free tool.
+- **Credential expiry is unknowable from an export.** The file names the
+  connection, not the consent screen behind it. Every finding is a conditional
+  plus a way to check in under a minute.
+- **Make templates carry no connections.** Published templates have them
+  stripped; the tool says so rather than reporting a clean bill of health.
+- **Make blueprints from the API carry no schedule.** The schedule lives on the
+  scenario. The tool says which kind of export it received.
+- **Code nodes are opaque.** A Code step is marked "possible", never
+  "structural", and never drives a high severity on its own.
+
+The page that consumes this lives in `apps/free-tool`.

package/dist/adapters/make.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Make adapter. All Make knowledge lives here.
+ *
+ * Make differs from n8n in three ways that matter, and all three are absorbed
+ * here so the checks never learn about them:
+ *  1. The flow is a nested tree (routes, branches, onerror), not a flat node
+ *     list plus a connections map. We flatten it and synthesise the edges.
+ *  2. Filters sit on the LINK, not in a module. They become edge gates.
+ *  3. Scheduling sits outside the blueprint, next to it. Present in a template
+ *     export, absent from an API blueprint fetch — so we say which we got.
+ */
+import type { Workflow } from '../core/model.js';
+export declare function isMakeBlueprint(raw: any): boolean;
+export declare function parseMake(raw: any): Workflow;

package/dist/adapters/make.js

@@ -0,0 +1,213 @@
+"use strict";
+/**
+ * Make adapter. All Make knowledge lives here.
+ *
+ * Make differs from n8n in three ways that matter, and all three are absorbed
+ * here so the checks never learn about them:
+ *  1. The flow is a nested tree (routes, branches, onerror), not a flat node
+ *     list plus a connections map. We flatten it and synthesise the edges.
+ *  2. Filters sit on the LINK, not in a module. They become edge gates.
+ *  3. Scheduling sits outside the blueprint, next to it. Present in a template
+ *     export, absent from an API blueprint fetch — so we say which we got.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isMakeBlueprint = isMakeBlueprint;
+exports.parseMake = parseMake;
+const providers_js_1 = require("../core/providers.js");
+const WRITE_VERBS = [
+    [/:add(row|record|item)?/i, 'append'],
+    [/:create/i, 'create'],
+    [/:update/i, 'update'],
+    [/:upsert|:addupdate/i, 'upsert'],
+    [/:delete|:remove/i, 'delete'],
+    [/:send|:createmessage|:createatweet|:createpost|:post/i, 'send'],
+    [/:uploadfile|:upload/i, 'create'],
+];
+const EMPTY_READ = /:(search|list|get[a-z]*|retrieve|watch[a-z]*|iterate)/i;
+function moduleApp(module) {
+    return (module.split(':')[0] ?? module).replace(/-/g, ' ');
+}
+/** 'google-sheets:addRow' -> 'Add Row (google sheets)'. Modules are often unnamed. */
+function prettyLabel(module) {
+    const [app, action] = module.split(':');
+    if (!action)
+        return module;
+    const words = action
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/^./, (c) => c.toUpperCase());
+    return `${words} (${(app ?? '').replace(/-/g, ' ')})`;
+}
+function classify(m) {
+    const module = String(m.module ?? '');
+    const lower = module.toLowerCase();
+    if (/^builtin:basicrouter/i.test(module)) {
+        return {
+            role: 'gate',
+            zeroEmit: { cause: 'Every route out of this router can filter everything out.', certainty: 'possible' },
+        };
+    }
+    if (/^builtin:basicifelse/i.test(module)) {
+        return { role: 'gate', zeroEmit: { cause: 'The condition can be false for every bundle.', certainty: 'structural' } };
+    }
+    if (/^builtin:basicfeeder|:iterate/i.test(module)) {
+        return { role: 'loop', zeroEmit: { cause: 'The array being iterated can be empty, so nothing downstream runs.', certainty: 'structural' } };
+    }
+    if (/^builtin:basicaggregator|:aggregate/i.test(module))
+        return { role: 'transform', zeroEmit: null };
+    // A watch* module at the head of a flow is the trigger.
+    if (/^[a-z0-9-]+:watch/i.test(module) || /gateway:customwebhook/i.test(module)) {
+        return { role: 'trigger', zeroEmit: null };
+    }
+    for (const [re, kind] of WRITE_VERBS) {
+        if (re.test(lower)) {
+            return { role: 'write', writeKind: kind, writeTarget: moduleApp(module), zeroEmit: null };
+        }
+    }
+    if (EMPTY_READ.test(lower)) {
+        return {
+            role: 'read',
+            zeroEmit: { cause: `The ${moduleApp(module)} search can return no bundles.`, certainty: 'structural' },
+        };
+    }
+    return { role: 'other', zeroEmit: null };
+}
+/** Connections hide in two places depending on how the blueprint was produced. */
+function readConnections(m) {
+    const out = [];
+    const restore = m?.metadata?.restore?.parameters?.__IMTCONN__;
+    if (restore) {
+        const slug = restore?.data?.connection;
+        const rawType = slug ? `account:${slug}` : 'account:unknown';
+        out.push({
+            rawType,
+            providerId: (0, providers_js_1.resolveProvider)(rawType, 'make')?.id ?? null,
+            authKind: (0, providers_js_1.guessAuthKind)(rawType),
+            label: typeof restore.label === 'string' ? restore.label : undefined,
+        });
+    }
+    for (const p of m?.metadata?.parameters ?? []) {
+        if (p?.name === '__IMTCONN__' && typeof p.type === 'string') {
+            if (out.some((c) => c.rawType === p.type))
+                continue;
+            out.push({
+                rawType: p.type,
+                providerId: (0, providers_js_1.resolveProvider)(p.type, 'make')?.id ?? null,
+                authKind: (0, providers_js_1.guessAuthKind)(p.type),
+            });
+        }
+    }
+    return out;
+}
+/** Walk the nested flow, emitting nodes and the edges implied by sequence. */
+function flatten(flow, prevId, acc, channel = 'main') {
+    let last = prevId;
+    for (const m of flow ?? []) {
+        const id = String(m.id ?? `${acc.nodes.length}`);
+        const c = classify(m);
+        const label = m?.metadata?.designer?.name || prettyLabel(String(m.module ?? id));
+        acc.nodes.push({
+            id,
+            label,
+            platformType: String(m.module ?? ''),
+            role: c.role,
+            writeKind: c.writeKind,
+            writeTarget: c.writeTarget,
+            zeroEmit: c.zeroEmit,
+            credentials: readConnections(m),
+            errorHandling: {
+                hasErrorBranch: Array.isArray(m.onerror) && m.onerror.length > 0,
+                retries: false,
+                continueOnFail: false,
+                alwaysOutputData: false,
+            },
+            disabled: m.disabled === true,
+        });
+        if (last) {
+            acc.edges.push({
+                from: last,
+                to: id,
+                channel,
+                gate: m.filter
+                    ? {
+                        label: String(m.filter.name ?? 'filter'),
+                        cause: `The filter "${m.filter.name ?? 'unnamed'}" can match nothing.`,
+                    }
+                    : null,
+            });
+            channel = 'main';
+        }
+        for (const route of m.routes ?? []) {
+            flatten(route.flow ?? [], id, acc, 'route');
+        }
+        for (const branch of m.branches ?? []) {
+            flatten(branch.flow ?? [], id, acc, branch.type === 'else' ? 'else' : 'branch');
+        }
+        for (const handler of m.onerror ?? []) {
+            const hFlow = Array.isArray(handler?.flow) ? handler.flow : [handler];
+            flatten(hFlow, id, acc, 'error');
+        }
+        // A router or if/else hands off through its branches, not in sequence.
+        if ((m.routes ?? []).length || (m.branches ?? []).length)
+            last = null;
+        else
+            last = id;
+    }
+    return last;
+}
+function isMakeBlueprint(raw) {
+    if (!raw || typeof raw !== 'object')
+        return false;
+    if (Array.isArray(raw.flow))
+        return true;
+    if (raw.blueprint && Array.isArray(raw.blueprint.flow))
+        return true;
+    return false;
+}
+function parseMake(raw) {
+    const bp = raw.blueprint ?? raw;
+    const parseNotes = [];
+    const acc = { nodes: [], edges: [] };
+    flatten(bp.flow ?? [], null, acc);
+    const scenarioMeta = bp?.metadata?.scenario ?? {};
+    const scheduling = raw.scheduling ?? bp.scheduling ?? null;
+    let cadence;
+    if (scheduling && typeof scheduling.interval === 'number') {
+        cadence = {
+            kind: 'schedule',
+            description: scheduling.interval >= 3600
+                ? `every ${Math.round(scheduling.interval / 3600)} hour${scheduling.interval >= 7200 ? 's' : ''}`
+                : `every ${Math.round(scheduling.interval / 60)} minute${scheduling.interval >= 120 ? 's' : ''}`,
+            intervalSeconds: scheduling.interval,
+            expectedIntervalKnown: true,
+        };
+    }
+    else if (bp?.metadata?.instant === true) {
+        cadence = { kind: 'event', description: 'an instant trigger (webhook)', intervalSeconds: null, expectedIntervalKnown: false };
+    }
+    else {
+        cadence = { kind: 'unknown', description: 'no scheduling in this export', intervalSeconds: null, expectedIntervalKnown: false };
+        parseNotes.push('This blueprint carries no scheduling block. Blueprints fetched from the Make API contain the flow only — the schedule lives on the scenario. Export from the scenario menu to include it.');
+    }
+    const withConnections = acc.nodes.filter((n) => n.credentials.length > 0).length;
+    if (acc.nodes.length > 0 && withConnections === 0) {
+        parseNotes.push('No connection data in this blueprint, so the credential check found nothing to look at. Published templates have connections stripped out; your own scenario export will have them.');
+    }
+    const triggerIds = acc.nodes.filter((n) => n.role === 'trigger').map((n) => n.id);
+    if (triggerIds.length === 0 && acc.nodes.length > 0)
+        triggerIds.push(acc.nodes[0].id);
+    return {
+        platform: 'make',
+        name: String(raw.name ?? bp.name ?? 'Untitled scenario'),
+        nodes: acc.nodes,
+        edges: acc.edges,
+        triggerIds,
+        cadence,
+        errorPolicy: {
+            workflowLevelHandler: acc.nodes.some((n) => n.errorHandling.hasErrorBranch),
+            storesFailedRuns: typeof scenarioMeta.dlq === 'boolean' ? scenarioMeta.dlq : null,
+            maxErrors: typeof scenarioMeta.maxErrors === 'number' ? scenarioMeta.maxErrors : null,
+            notes: [],
+        },
+        parseNotes,
+    };
+}

package/dist/adapters/n8n.d.ts

@@ -0,0 +1,9 @@
+/**
+ * n8n adapter. All n8n knowledge lives here and nowhere else.
+ *
+ * Classification tables below are ranked by what actually appears in 2,043 real
+ * workflows from the public template library, not by guesswork.
+ */
+import type { Workflow } from '../core/model.js';
+export declare function isN8nWorkflow(raw: any): boolean;
+export declare function parseN8n(raw: any): Workflow;

package/dist/adapters/n8n.js

@@ -0,0 +1,273 @@
+"use strict";
+/**
+ * n8n adapter. All n8n knowledge lives here and nowhere else.
+ *
+ * Classification tables below are ranked by what actually appears in 2,043 real
+ * workflows from the public template library, not by guesswork.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isN8nWorkflow = isN8nWorkflow;
+exports.parseN8n = parseN8n;
+const providers_js_1 = require("../core/providers.js");
+const TRIGGER_HINTS = [
+    'trigger',
+    'webhook',
+    'cron',
+    'interval',
+    'formtrigger',
+    'chattrigger',
+    'localfiletrigger',
+];
+/** Nodes that produce writes. Keyed by short type; value maps operation -> kind. */
+const WRITE_OPS = {
+    googleSheets: { append: 'append', update: 'update', appendOrUpdate: 'upsert', delete: 'delete' },
+    airtable: { create: 'create', update: 'update', upsert: 'upsert', append: 'append', deleteRecord: 'delete' },
+    notion: { create: 'create', update: 'update', append: 'append' },
+    supabase: { create: 'create', update: 'update', upsert: 'upsert' },
+    mongoDb: { insert: 'create', update: 'update', upsert: 'upsert' },
+    redis: { set: 'update' },
+    telegram: 'send',
+    slack: 'send',
+    gmail: { send: 'send', reply: 'send', sendAndWait: 'send' },
+    emailSend: 'send',
+    whatsApp: 'send',
+    discord: 'send',
+    twilio: 'send',
+    hubspot: { create: 'create', upsert: 'upsert', update: 'update' },
+    pipedrive: { create: 'create', update: 'update' },
+    salesforce: { create: 'create', upsert: 'upsert', update: 'update' },
+    wordpress: { create: 'create', update: 'update' },
+    googleDrive: { upload: 'create', createFromText: 'create', copy: 'create' },
+    readWriteFile: { write: 'create' },
+    googleCalendar: { create: 'create', update: 'update' },
+    clickUp: { create: 'create', update: 'update' },
+    trello: { create: 'create', update: 'update' },
+    monday: { create: 'create', update: 'update' },
+    jira: { create: 'create', update: 'update' },
+    baserow: { create: 'create', update: 'update' },
+    nocoDb: { create: 'create', update: 'update' },
+};
+const WRITE_TARGETS = {
+    googleSheets: 'Google Sheets',
+    airtable: 'Airtable',
+    notion: 'Notion',
+    supabase: 'Supabase',
+    mongoDb: 'MongoDB',
+    postgres: 'Postgres',
+    mySql: 'MySQL',
+    hubspot: 'HubSpot',
+    salesforce: 'Salesforce',
+    slack: 'Slack',
+    telegram: 'Telegram',
+    gmail: 'Gmail',
+    whatsApp: 'WhatsApp',
+};
+/** Steps whose whole job is to let some items through and stop the rest. */
+const STRUCTURAL_GATES = {
+    filter: 'The filter can match nothing.',
+    if: 'The condition can be false for every item.',
+    switch: 'Every item can fall through without matching a branch.',
+    removeDuplicates: 'Everything can be a duplicate of a previous run, leaving nothing new.',
+    limit: 'The limit can resolve to zero items.',
+    splitOut: 'The field being split can be an empty list.',
+    splitInBatches: 'The list being looped over can be empty, so the loop body never runs.',
+    compareDatasets: 'The comparison can find nothing on either side.',
+};
+/** Reads that legitimately return nothing. Type -> operations that can be empty. */
+const EMPTY_READS = {
+    googleSheets: ['read', 'getAll', 'lookup'],
+    airtable: ['search', 'list', 'getAll'],
+    notion: ['getAll', 'search'],
+    gmail: ['getAll', 'get'],
+    postgres: ['executeQuery', 'select'],
+    mySql: ['executeQuery', 'select'],
+    mongoDb: ['find'],
+    hubspot: ['getAll', 'search'],
+    googleCalendar: ['getAll'],
+    googleDrive: ['list', 'search'],
+    rssFeedRead: ['*'],
+    supabase: ['getAll', 'get'],
+};
+function shortType(type) {
+    return type.split('.').pop() ?? type;
+}
+function classify(node) {
+    const type = node.type ?? '';
+    const st = shortType(type);
+    const lower = type.toLowerCase();
+    const params = node.parameters ?? {};
+    const op = typeof params.operation === 'string' ? params.operation : undefined;
+    if (st === 'stickyNote')
+        return { role: 'note', zeroEmit: null };
+    if (TRIGGER_HINTS.some((h) => lower.includes(h)))
+        return { role: 'trigger', zeroEmit: null };
+    if (st === 'stopAndError')
+        return { role: 'error-handler', zeroEmit: null };
+    if (STRUCTURAL_GATES[st]) {
+        return { role: 'gate', zeroEmit: { cause: STRUCTURAL_GATES[st], certainty: 'structural' } };
+    }
+    const writeSpec = WRITE_OPS[st];
+    if (writeSpec) {
+        if (typeof writeSpec === 'string') {
+            return { role: 'write', writeKind: writeSpec, writeTarget: WRITE_TARGETS[st] ?? st, zeroEmit: null };
+        }
+        if (op && writeSpec[op]) {
+            return { role: 'write', writeKind: writeSpec[op], writeTarget: WRITE_TARGETS[st] ?? st, zeroEmit: null };
+        }
+    }
+    // Raw SQL: read the verb rather than the operation name.
+    if (st === 'postgres' || st === 'mySql') {
+        const q = String(params.query ?? '').trim().toLowerCase();
+        if (/^(insert|update|upsert|merge|delete)/.test(q)) {
+            return { role: 'write', writeKind: 'create', writeTarget: WRITE_TARGETS[st], zeroEmit: null };
+        }
+        if (/^(select|with)/.test(q) || !q) {
+            return { role: 'read', zeroEmit: { cause: 'The query can return no rows.', certainty: 'structural' } };
+        }
+    }
+    if (st === 'httpRequest') {
+        const method = String(params.method ?? 'GET').toUpperCase();
+        if (['POST', 'PUT', 'PATCH'].includes(method)) {
+            return { role: 'write', writeKind: 'send', writeTarget: 'an API', zeroEmit: null };
+        }
+        return {
+            role: 'read',
+            zeroEmit: { cause: 'The request can come back with an empty list.', certainty: 'possible' },
+        };
+    }
+    const empties = EMPTY_READS[st];
+    if (empties && (empties.includes('*') || (op && empties.includes(op)))) {
+        return {
+            role: 'read',
+            zeroEmit: { cause: `"${node.name}" can find no matching records.`, certainty: 'structural' },
+        };
+    }
+    if (st === 'code' || st === 'function' || st === 'functionItem') {
+        return {
+            role: 'transform',
+            zeroEmit: { cause: 'The code step can return an empty list.', certainty: 'possible' },
+        };
+    }
+    return { role: 'other', zeroEmit: null };
+}
+function readCadence(nodes) {
+    for (const n of nodes) {
+        const st = shortType(n.type ?? '');
+        const p = n.parameters ?? {};
+        if (st === 'scheduleTrigger') {
+            const rule = p.rule?.interval?.[0];
+            if (rule) {
+                const field = rule.field ?? 'unknown';
+                const every = rule.minutesInterval ?? rule.hoursInterval ?? rule.daysInterval ?? 1;
+                const secs = { minutes: 60, hours: 3600, days: 86400, weeks: 604800 };
+                const unit = String(field).replace(/s$/, '');
+                const phrase = Number(every) === 1 ? `every ${unit}` : `every ${every} ${unit}s`;
+                return {
+                    kind: 'schedule',
+                    description: phrase,
+                    intervalSeconds: (secs[field] ?? 0) * Number(every) || null,
+                    expectedIntervalKnown: true,
+                };
+            }
+            return { kind: 'schedule', description: 'a schedule with no interval set', intervalSeconds: null, expectedIntervalKnown: false };
+        }
+        if (st === 'cron') {
+            return { kind: 'schedule', description: 'a cron expression', intervalSeconds: null, expectedIntervalKnown: true };
+        }
+        if (st === 'intervalTrigger') {
+            return { kind: 'schedule', description: 'a fixed interval', intervalSeconds: null, expectedIntervalKnown: true };
+        }
+    }
+    for (const n of nodes) {
+        const lower = String(n.type ?? '').toLowerCase();
+        if (lower.includes('manualtrigger')) {
+            return { kind: 'manual', description: 'the Execute Workflow button', intervalSeconds: null, expectedIntervalKnown: false };
+        }
+        if (lower.includes('webhook') || lower.includes('formtrigger') || lower.includes('chattrigger')) {
+            return { kind: 'event', description: 'an incoming call from outside', intervalSeconds: null, expectedIntervalKnown: false };
+        }
+        if (lower.includes('trigger')) {
+            return { kind: 'event', description: `the ${shortType(n.type)} event`, intervalSeconds: null, expectedIntervalKnown: false };
+        }
+    }
+    return { kind: 'unknown', description: 'no trigger found', intervalSeconds: null, expectedIntervalKnown: false };
+}
+function isN8nWorkflow(raw) {
+    return !!raw && typeof raw === 'object' && Array.isArray(raw.nodes) && typeof raw.connections === 'object';
+}
+function parseN8n(raw) {
+    const rawNodes = raw.nodes ?? [];
+    const parseNotes = [];
+    const nodes = rawNodes.map((n) => {
+        const c = classify(n);
+        const credentials = Object.entries(n.credentials ?? {}).map(([rawType, val]) => ({
+            rawType,
+            providerId: (0, providers_js_1.resolveProvider)(rawType, 'n8n')?.id ?? null,
+            authKind: (0, providers_js_1.guessAuthKind)(rawType),
+            label: typeof val?.name === 'string' ? val.name : undefined,
+        }));
+        return {
+            id: String(n.id ?? n.name),
+            label: String(n.name ?? n.id ?? 'unnamed step'),
+            platformType: String(n.type ?? ''),
+            role: c.role,
+            writeKind: c.writeKind,
+            writeTarget: c.writeTarget,
+            zeroEmit: c.zeroEmit,
+            credentials,
+            errorHandling: {
+                hasErrorBranch: n.onError === 'continueErrorOutput',
+                retries: n.retryOnFail === true,
+                continueOnFail: n.continueOnFail === true || n.onError === 'continueRegularOutput',
+                alwaysOutputData: n.alwaysOutputData === true,
+            },
+            disabled: n.disabled === true,
+        };
+    });
+    // n8n keys connections by node NAME; the model keys by id. Bridge it.
+    const idByName = new Map(rawNodes.map((n) => [String(n.name), String(n.id ?? n.name)]));
+    const edges = [];
+    for (const [sourceName, outputs] of Object.entries(raw.connections ?? {})) {
+        const from = idByName.get(sourceName);
+        if (!from)
+            continue;
+        for (const [channel, groups] of Object.entries(outputs ?? {})) {
+            (groups ?? []).forEach((group, outputIndex) => {
+                (group ?? []).forEach((conn) => {
+                    const to = idByName.get(String(conn?.node));
+                    if (!to)
+                        return;
+                    const sourceNode = rawNodes.find((n) => String(n.name) === sourceName);
+                    const isIf = shortType(sourceNode?.type ?? '') === 'if';
+                    edges.push({
+                        from,
+                        to,
+                        channel: channel === 'main' && isIf ? (outputIndex === 0 ? 'true' : 'false') : channel,
+                        gate: null,
+                    });
+                });
+            });
+        }
+    }
+    const triggerIds = nodes.filter((n) => n.role === 'trigger').map((n) => n.id);
+    const hasErrorTrigger = rawNodes.some((n) => shortType(n.type ?? '') === 'errorTrigger');
+    const settings = raw.settings ?? {};
+    if (!raw.id && !raw.versionId) {
+        parseNotes.push('This looks like a template export rather than a live workflow export.');
+    }
+    return {
+        platform: 'n8n',
+        name: String(raw.name ?? 'Untitled workflow'),
+        nodes,
+        edges,
+        triggerIds,
+        cadence: readCadence(rawNodes),
+        errorPolicy: {
+            workflowLevelHandler: Boolean(settings.errorWorkflow) || hasErrorTrigger,
+            storesFailedRuns: null,
+            maxErrors: null,
+            notes: [],
+        },
+        parseNotes,
+    };
+}

package/dist/core/checks/others.d.ts

@@ -0,0 +1,10 @@
+/**
+ * CHECK 3 — credential expiry risk.
+ * CHECK 2 — triggers with no expected cadence.
+ * CHECK 1 — error handling. Table stakes: six free tools already do this, so it
+ *           is a short footer, never the headline.
+ */
+import type { Finding, Workflow } from '../model.js';
+export declare function checkCredentialExpiry(wf: Workflow): Finding[];
+export declare function checkCadence(wf: Workflow): Finding[];
+export declare function checkErrorHandling(wf: Workflow): Finding[];