codika 3.0.0

package/dist/validation/workflow-scripts/credential-placeholders.js

@@ -0,0 +1,278 @@
+/**
+ * Script: CRED-PLACEHOLDER
+ *
+ * Validates that credential references in workflows use proper placeholders.
+ *
+ * Valid credential placeholder patterns:
+ * - {{FLEXCRED_CREDNAME_ID_DERCXELF}}   / {{FLEXCRED_CREDNAME_NAME_DERCXELF}}   (flexible - tries org first, falls back to user)
+ * - {{USERCRED_CREDNAME_ID_DERCRESU}}   / {{USERCRED_CREDNAME_NAME_DERCRESU}}   (user credentials)
+ * - {{ORGCRED_CREDNAME_ID_DERCGRO}}     / {{ORGCRED_CREDNAME_NAME_DERCGRO}}     (organization credentials)
+ * - {{INSTCRED_CREDNAME_ID_DERCTSNI}}   / {{INSTCRED_CREDNAME_NAME_DERCTSNI}}   (instance credentials)
+ *
+ * Both `id` and `name` fields must use proper placeholders with _ID_ and _NAME_ markers respectively.
+ */
+export const metadata = {
+    id: 'CRED-PLACEHOLDER',
+    name: 'credential_placeholders',
+    severity: 'should',
+    description: 'Credential references should use proper placeholders',
+    details: 'Replace hardcoded credential values with FLEXCRED, USERCRED, ORGCRED, or INSTCRED placeholders. ' +
+        'Use _ID_ suffix for id field and _NAME_ suffix for name field.',
+    category: 'credentials',
+};
+// Credential types and their corresponding suffixes
+const CREDENTIAL_TYPES = {
+    FLEXCRED: 'DERCXELF',
+    USERCRED: 'DERCRESU',
+    ORGCRED: 'DERCGRO',
+    INSTCRED: 'DERCTSNI',
+};
+// Pattern to extract credential type from a placeholder
+const PLACEHOLDER_PATTERN = /^\{\{(FLEXCRED|USERCRED|ORGCRED|INSTCRED)_([A-Z0-9_]+)_(ID|NAME)_(DERCXELF|DERCRESU|DERCGRO|DERCTSNI)\}\}$/;
+// Pattern to detect if something looks like a placeholder but has wrong format
+const LOOKS_LIKE_PLACEHOLDER = /^\{\{[A-Z_]+.*\}\}$/;
+/**
+ * Validates a credential ID placeholder
+ * Returns null if valid, error message if invalid
+ */
+function validateIdPlaceholder(value) {
+    const match = value.match(PLACEHOLDER_PATTERN);
+    if (!match) {
+        // Check if it looks like a placeholder but has wrong format
+        if (LOOKS_LIKE_PLACEHOLDER.test(value)) {
+            // Check for missing _ID_ marker
+            if (!value.includes('_ID_')) {
+                return { valid: false, error: 'missing _ID_ marker in placeholder' };
+            }
+            // Check for unknown credential type
+            const typeMatch = value.match(/^\{\{([A-Z]+)_/);
+            if (typeMatch && !(typeMatch[1] in CREDENTIAL_TYPES)) {
+                return { valid: false, error: `unknown credential type "${typeMatch[1]}"` };
+            }
+            // Check for wrong suffix
+            for (const [type, suffix] of Object.entries(CREDENTIAL_TYPES)) {
+                if (value.includes(`{{${type}_`)) {
+                    if (!value.endsWith(`_${suffix}}}`)) {
+                        return { valid: false, error: `wrong suffix for ${type} (expected ${suffix})` };
+                    }
+                }
+            }
+            return { valid: false, error: 'invalid placeholder format' };
+        }
+        return { valid: false };
+    }
+    const [, credType, , marker, suffix] = match;
+    // Validate marker is ID for id field
+    if (marker !== 'ID') {
+        return { valid: false, error: 'id field should use _ID_ marker, not _NAME_' };
+    }
+    // Validate suffix matches credential type
+    const expectedSuffix = CREDENTIAL_TYPES[credType];
+    if (suffix !== expectedSuffix) {
+        return { valid: false, error: `wrong suffix for ${credType} (expected ${expectedSuffix}, got ${suffix})` };
+    }
+    return { valid: true, type: credType };
+}
+/**
+ * Validates a credential NAME placeholder
+ * Returns null if valid, error message if invalid
+ */
+function validateNamePlaceholder(value) {
+    const match = value.match(PLACEHOLDER_PATTERN);
+    if (!match) {
+        // Check if it looks like a placeholder but has wrong format
+        if (LOOKS_LIKE_PLACEHOLDER.test(value)) {
+            // Check for missing _NAME_ marker
+            if (!value.includes('_NAME_')) {
+                return { valid: false, error: 'missing _NAME_ marker in placeholder' };
+            }
+            // Check for unknown credential type
+            const typeMatch = value.match(/^\{\{([A-Z]+)_/);
+            if (typeMatch && !(typeMatch[1] in CREDENTIAL_TYPES)) {
+                return { valid: false, error: `unknown credential type "${typeMatch[1]}"` };
+            }
+            // Check for wrong suffix
+            for (const [type, suffix] of Object.entries(CREDENTIAL_TYPES)) {
+                if (value.includes(`{{${type}_`)) {
+                    if (!value.endsWith(`_${suffix}}}`)) {
+                        return { valid: false, error: `wrong suffix for ${type} (expected ${suffix})` };
+                    }
+                }
+            }
+            return { valid: false, error: 'invalid placeholder format' };
+        }
+        return { valid: false };
+    }
+    const [, credType, , marker, suffix] = match;
+    // Validate marker is NAME for name field
+    if (marker !== 'NAME') {
+        return { valid: false, error: 'name field should use _NAME_ marker, not _ID_' };
+    }
+    // Validate suffix matches credential type
+    const expectedSuffix = CREDENTIAL_TYPES[credType];
+    if (suffix !== expectedSuffix) {
+        return { valid: false, error: `wrong suffix for ${credType} (expected ${expectedSuffix}, got ${suffix})` };
+    }
+    return { valid: true, type: credType };
+}
+/**
+ * Check if a value looks like a hardcoded credential ID
+ */
+function looksLikeHardcodedValue(value) {
+    // UUID pattern
+    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value)) {
+        return true;
+    }
+    // Numeric ID
+    if (/^\d+$/.test(value)) {
+        return true;
+    }
+    // Firebase-style ID (alphanumeric, 20+ chars)
+    if (/^[A-Za-z0-9]{20,}$/.test(value)) {
+        return true;
+    }
+    // Plain text name (not a placeholder)
+    if (!value.startsWith('{{') && value.length > 0) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Generate helpful fix instructions
+ */
+function generateFixInstructions(credType, field) {
+    const marker = field === 'id' ? 'ID' : 'NAME';
+    const example = `{{FLEXCRED_${credType.toUpperCase()}_${marker}_DERCXELF}}`;
+    return (`Use a proper credential placeholder with _${marker}_ marker. ` +
+        `Available types: FLEXCRED (suffix: DERCXELF), USERCRED (suffix: DERCRESU), ORGCRED (suffix: DERCGRO), INSTCRED (suffix: DERCTSNI). ` +
+        `Example: ${example}`);
+}
+/**
+ * Check for credential placeholder issues
+ */
+export function checkCredentialPlaceholders(content, path) {
+    const findings = [];
+    // Parse as JSON to properly inspect credential blocks
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        // If not valid JSON, skip this check
+        return [];
+    }
+    // Check each node's credentials
+    if (Array.isArray(parsed.nodes)) {
+        for (const node of parsed.nodes) {
+            if (node.credentials) {
+                for (const [credType, credValue] of Object.entries(node.credentials)) {
+                    const credObj = credValue;
+                    if (!credObj)
+                        continue;
+                    const nodeName = node.name || node.id;
+                    let idType;
+                    let nameType;
+                    // Check ID field
+                    if (credObj.id !== undefined) {
+                        const idValue = String(credObj.id);
+                        // First check if it looks like a placeholder
+                        if (LOOKS_LIKE_PLACEHOLDER.test(idValue)) {
+                            const validation = validateIdPlaceholder(idValue);
+                            if (!validation.valid) {
+                                findings.push({
+                                    rule: metadata.id,
+                                    severity: metadata.severity,
+                                    path,
+                                    message: `Node "${nodeName}" credential "${credType}" id: ${validation.error || 'invalid placeholder'}`,
+                                    raw_details: generateFixInstructions(credType, 'id'),
+                                    nodeId: node.id,
+                                });
+                            }
+                            else {
+                                idType = validation.type;
+                            }
+                        }
+                        else if (looksLikeHardcodedValue(idValue)) {
+                            // It's a hardcoded value, not a placeholder
+                            findings.push({
+                                rule: metadata.id,
+                                severity: metadata.severity,
+                                path,
+                                message: `Node "${nodeName}" has hardcoded credential id for "${credType}"`,
+                                raw_details: generateFixInstructions(credType, 'id'),
+                                nodeId: node.id,
+                            });
+                        }
+                    }
+                    else {
+                        // Missing id field entirely
+                        findings.push({
+                            rule: metadata.id,
+                            severity: metadata.severity,
+                            path,
+                            message: `Node "${nodeName}" credential "${credType}" is missing id field`,
+                            raw_details: generateFixInstructions(credType, 'id'),
+                            nodeId: node.id,
+                        });
+                    }
+                    // Check NAME field
+                    if (credObj.name !== undefined) {
+                        const nameValue = String(credObj.name);
+                        // First check if it looks like a placeholder
+                        if (LOOKS_LIKE_PLACEHOLDER.test(nameValue)) {
+                            const validation = validateNamePlaceholder(nameValue);
+                            if (!validation.valid) {
+                                findings.push({
+                                    rule: metadata.id,
+                                    severity: metadata.severity,
+                                    path,
+                                    message: `Node "${nodeName}" credential "${credType}" name: ${validation.error || 'invalid placeholder'}`,
+                                    raw_details: generateFixInstructions(credType, 'name'),
+                                    nodeId: node.id,
+                                });
+                            }
+                            else {
+                                nameType = validation.type;
+                            }
+                        }
+                        else if (looksLikeHardcodedValue(nameValue)) {
+                            // It's a hardcoded value, not a placeholder
+                            findings.push({
+                                rule: metadata.id,
+                                severity: metadata.severity,
+                                path,
+                                message: `Node "${nodeName}" has hardcoded credential name for "${credType}"`,
+                                raw_details: generateFixInstructions(credType, 'name'),
+                                nodeId: node.id,
+                            });
+                        }
+                    }
+                    else {
+                        // Missing name field entirely
+                        findings.push({
+                            rule: metadata.id,
+                            severity: metadata.severity,
+                            path,
+                            message: `Node "${nodeName}" credential "${credType}" is missing name field`,
+                            raw_details: generateFixInstructions(credType, 'name'),
+                            nodeId: node.id,
+                        });
+                    }
+                    // Check for mismatched types between id and name
+                    if (idType && nameType && idType !== nameType) {
+                        findings.push({
+                            rule: metadata.id,
+                            severity: metadata.severity,
+                            path,
+                            message: `Node "${nodeName}" credential "${credType}" has mismatched types: id uses ${idType} but name uses ${nameType}`,
+                            raw_details: 'Both id and name should use the same credential type (FLEXCRED, USERCRED, ORGCRED, or INSTCRED)',
+                            nodeId: node.id,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=credential-placeholders.js.map

package/dist/validation/workflow-scripts/credential-placeholders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-placeholders.js","sourceRoot":"","sources":["../../../src/validation/workflow-scripts/credential-placeholders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,MAAM,CAAC,MAAM,QAAQ,GAAiB;IACpC,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,yBAAyB;IAC/B,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,sDAAsD;IACnE,OAAO,EACL,kGAAkG;QAClG,gEAAgE;IAClE,QAAQ,EAAE,aAAa;CACxB,CAAC;AAEF,oDAAoD;AACpD,MAAM,gBAAgB,GAAG;IACvB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAIX,wDAAwD;AACxD,MAAM,mBAAmB,GAAG,4GAA4G,CAAC;AAEzI,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAErD;;;GAGG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAE/C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,4DAA4D;QAC5D,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,gCAAgC;YAChC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;YACvE,CAAC;YACD,oCAAoC;YACpC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAChD,IAAI,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,EAAE,CAAC;gBACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9E,CAAC;YACD,yBAAyB;YACzB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC9D,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;oBACjC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;wBACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,IAAI,cAAc,MAAM,GAAG,EAAE,CAAC;oBAClF,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,EAAE,QAAQ,EAAE,AAAD,EAAG,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IAE7C,qCAAqC;IACrC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;IAChF,CAAC;IAED,0CAA0C;IAC1C,MAAM,cAAc,GAAG,gBAAgB,CAAC,QAA0B,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,QAAQ,cAAc,cAAc,SAAS,MAAM,GAAG,EAAE,CAAC;IAC7G,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAA0B,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAE/C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,4DAA4D;QAC5D,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,kCAAkC;YAClC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;YACzE,CAAC;YACD,oCAAoC;YACpC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAChD,IAAI,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,EAAE,CAAC;gBACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9E,CAAC;YACD,yBAAyB;YACzB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC9D,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;oBACjC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;wBACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,IAAI,cAAc,MAAM,GAAG,EAAE,CAAC;oBAClF,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,EAAE,QAAQ,EAAE,AAAD,EAAG,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IAE7C,yCAAyC;IACzC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;IAClF,CAAC;IAED,0CAA0C;IAC1C,MAAM,cAAc,GAAG,gBAAgB,CAAC,QAA0B,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,QAAQ,cAAc,cAAc,SAAS,MAAM,GAAG,EAAE,CAAC;IAC7G,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAA0B,EAAE,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,KAAa;IAC5C,eAAe;IACf,IAAI,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa;IACb,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8CAA8C;IAC9C,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,QAAgB,EAAE,KAAoB;IACrE,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,OAAO,GAAG,cAAc,QAAQ,CAAC,WAAW,EAAE,IAAI,MAAM,aAAa,CAAC;IAE5E,OAAO,CACL,6CAA6C,MAAM,YAAY;QAC/D,qIAAqI;QACrI,YAAY,OAAO,EAAE,CACtB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe,EAAE,IAAY;IACvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,sDAAsD;IACtD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,gCAAgC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oBACrE,MAAM,OAAO,GAAG,SAAgB,CAAC;oBACjC,IAAI,CAAC,OAAO;wBAAE,SAAS;oBAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;oBACtC,IAAI,MAAkC,CAAC;oBACvC,IAAI,QAAoC,CAAC;oBAEzC,iBAAiB;oBACjB,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;wBAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBAEnC,6CAA6C;wBAC7C,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;4BACzC,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;4BAClD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gCACtB,QAAQ,CAAC,IAAI,CAAC;oCACZ,IAAI,EAAE,QAAQ,CAAC,EAAE;oCACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oCAC3B,IAAI;oCACJ,OAAO,EAAE,SAAS,QAAQ,iBAAiB,QAAQ,SAAS,UAAU,CAAC,KAAK,IAAI,qBAAqB,EAAE;oCACvG,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC;oCACpD,MAAM,EAAE,IAAI,CAAC,EAAE;iCAChB,CAAC,CAAC;4BACL,CAAC;iCAAM,CAAC;gCACN,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC;4BAC3B,CAAC;wBACH,CAAC;6BAAM,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;4BAC5C,4CAA4C;4BAC5C,QAAQ,CAAC,IAAI,CAAC;gCACZ,IAAI,EAAE,QAAQ,CAAC,EAAE;gCACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gCAC3B,IAAI;gCACJ,OAAO,EAAE,SAAS,QAAQ,sCAAsC,QAAQ,GAAG;gCAC3E,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC;gCACpD,MAAM,EAAE,IAAI,CAAC,EAAE;6BAChB,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,4BAA4B;wBAC5B,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,QAAQ,CAAC,EAAE;4BACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;4BAC3B,IAAI;4BACJ,OAAO,EAAE,SAAS,QAAQ,iBAAiB,QAAQ,uBAAuB;4BAC1E,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC;4BACpD,MAAM,EAAE,IAAI,CAAC,EAAE;yBAChB,CAAC,CAAC;oBACL,CAAC;oBAED,mBAAmB;oBACnB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBAEvC,6CAA6C;wBAC7C,IAAI,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;4BAC3C,MAAM,UAAU,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;4BACtD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gCACtB,QAAQ,CAAC,IAAI,CAAC;oCACZ,IAAI,EAAE,QAAQ,CAAC,EAAE;oCACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oCAC3B,IAAI;oCACJ,OAAO,EAAE,SAAS,QAAQ,iBAAiB,QAAQ,WAAW,UAAU,CAAC,KAAK,IAAI,qBAAqB,EAAE;oCACzG,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACtD,MAAM,EAAE,IAAI,CAAC,EAAE;iCAChB,CAAC,CAAC;4BACL,CAAC;iCAAM,CAAC;gCACN,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;4BAC7B,CAAC;wBACH,CAAC;6BAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;4BAC9C,4CAA4C;4BAC5C,QAAQ,CAAC,IAAI,CAAC;gCACZ,IAAI,EAAE,QAAQ,CAAC,EAAE;gCACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gCAC3B,IAAI;gCACJ,OAAO,EAAE,SAAS,QAAQ,wCAAwC,QAAQ,GAAG;gCAC7E,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC;gCACtD,MAAM,EAAE,IAAI,CAAC,EAAE;6BAChB,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,8BAA8B;wBAC9B,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,QAAQ,CAAC,EAAE;4BACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;4BAC3B,IAAI;4BACJ,OAAO,EAAE,SAAS,QAAQ,iBAAiB,QAAQ,yBAAyB;4BAC5E,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC;4BACtD,MAAM,EAAE,IAAI,CAAC,EAAE;yBAChB,CAAC,CAAC;oBACL,CAAC;oBAED,iDAAiD;oBACjD,IAAI,MAAM,IAAI,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;wBAC9C,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,QAAQ,CAAC,EAAE;4BACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;4BAC3B,IAAI;4BACJ,OAAO,EAAE,SAAS,QAAQ,iBAAiB,QAAQ,mCAAmC,MAAM,kBAAkB,QAAQ,EAAE;4BACxH,WAAW,EAAE,iGAAiG;4BAC9G,MAAM,EAAE,IAAI,CAAC,EAAE;yBAChB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/validation/workflow-scripts/db-always-output.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Script: DB-ALWAYS-OUTPUT
+ *
+ * Validates that database nodes have alwaysOutputData: true set.
+ * Without this, empty query results cause all downstream nodes to
+ * be silently skipped — the #1 gotcha in n8n workflow development.
+ *
+ * This is a top-level node property (not inside parameters).
+ */
+import type { Finding, RuleMetadata } from '../types.js';
+export declare const metadata: RuleMetadata;
+/**
+ * Check that all database nodes have alwaysOutputData: true
+ */
+export declare function checkDbAlwaysOutput(content: string, path: string): Finding[];
+//# sourceMappingURL=db-always-output.d.ts.map

package/dist/validation/workflow-scripts/db-always-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-always-output.d.ts","sourceRoot":"","sources":["../../../src/validation/workflow-scripts/db-always-output.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzD,eAAO,MAAM,QAAQ,EAAE,YAWtB,CAAC;AAwCF;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAwC5E"}

package/dist/validation/workflow-scripts/db-always-output.js

@@ -0,0 +1,95 @@
+/**
+ * Script: DB-ALWAYS-OUTPUT
+ *
+ * Validates that database nodes have alwaysOutputData: true set.
+ * Without this, empty query results cause all downstream nodes to
+ * be silently skipped — the #1 gotcha in n8n workflow development.
+ *
+ * This is a top-level node property (not inside parameters).
+ */
+export const metadata = {
+    id: 'DB-ALWAYS-OUTPUT',
+    name: 'db_always_output',
+    severity: 'should',
+    description: 'Database nodes should have alwaysOutputData: true',
+    details: 'Without alwaysOutputData: true, a database query that returns zero rows will ' +
+        'cause all downstream nodes to be silently skipped. Set this property to ensure ' +
+        'downstream nodes always receive input (even if empty).',
+    fixable: true,
+    category: 'resilience',
+};
+/**
+ * Database node types that should have alwaysOutputData: true.
+ * Matched by checking the last segment of the node type.
+ */
+const DATABASE_NODE_NAMES = new Set([
+    'supabase',
+    'postgres',
+    'mysql',
+    'microsoftSql',
+    'mongoDb',
+    'redis',
+    'elasticsearch',
+]);
+/**
+ * Check if a node type is a database node
+ */
+function isDatabaseNode(type) {
+    const segments = type.split('.');
+    const nodeName = segments[segments.length - 1];
+    return DATABASE_NODE_NAMES.has(nodeName);
+}
+/**
+ * Set alwaysOutputData: true on a node. Simple JSON parse/modify/stringify.
+ * Formatting is handled by WORKFLOW-FORMAT which runs last.
+ */
+function patchAlwaysOutputData(content, nodeId) {
+    const workflow = JSON.parse(content);
+    for (const n of workflow.nodes) {
+        if (n.id === nodeId) {
+            n.alwaysOutputData = true;
+            break;
+        }
+    }
+    return JSON.stringify(workflow, null, 2) + '\n';
+}
+/**
+ * Check that all database nodes have alwaysOutputData: true
+ */
+export function checkDbAlwaysOutput(content, path) {
+    const findings = [];
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return [];
+    }
+    const nodes = parsed.nodes || [];
+    for (const node of nodes) {
+        if (!isDatabaseNode(node.type))
+            continue;
+        if (node.alwaysOutputData !== true) {
+            const nodeName = node.name || node.id;
+            const nodeId = node.id;
+            findings.push({
+                rule: metadata.id,
+                severity: metadata.severity,
+                path,
+                message: `Database node "${nodeName}" is missing alwaysOutputData: true — empty results will skip downstream nodes`,
+                raw_details: 'Set alwaysOutputData: true on the node to ensure downstream nodes always ' +
+                    'receive input, even when the query returns zero rows.',
+                nodeId,
+                fixable: true,
+                fix: {
+                    description: `Add alwaysOutputData: true to "${nodeName}"`,
+                    apply: (fileContent) => {
+                        return patchAlwaysOutputData(fileContent, nodeId);
+                    },
+                },
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=db-always-output.js.map

package/dist/validation/workflow-scripts/db-always-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-always-output.js","sourceRoot":"","sources":["../../../src/validation/workflow-scripts/db-always-output.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,CAAC,MAAM,QAAQ,GAAiB;IACpC,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,kBAAkB;IACxB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,mDAAmD;IAChE,OAAO,EACL,+EAA+E;QAC/E,iFAAiF;QACjF,wDAAwD;IAC1D,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,YAAY;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,UAAU;IACV,UAAU;IACV,OAAO;IACP,cAAc;IACd,SAAS;IACT,OAAO;IACP,eAAe;CAChB,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,OAAe,EAAE,MAAc;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;YACpB,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC1B,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,IAAY;IAC/D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAU,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAEzC,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,QAAQ,CAAC,EAAE;gBACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI;gBACJ,OAAO,EAAE,kBAAkB,QAAQ,gFAAgF;gBACnH,WAAW,EACT,2EAA2E;oBAC3E,uDAAuD;gBACzD,MAAM;gBACN,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE;oBACH,WAAW,EAAE,kCAAkC,QAAQ,GAAG;oBAC1D,KAAK,EAAE,CAAC,WAAmB,EAAE,EAAE;wBAC7B,OAAO,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;oBACpD,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/validation/workflow-scripts/exec-workflow-wait.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Script: EXEC-WORKFLOW-WAIT
+ *
+ * Validates that Execute Workflow nodes have waitForSubWorkflow: true
+ * in their options. Without this setting, the parent workflow does not
+ * wait for the sub-workflow to complete and return values are silently
+ * lost — leading to undefined data in downstream nodes.
+ */
+import type { Finding, RuleMetadata } from '../types.js';
+export declare const metadata: RuleMetadata;
+/**
+ * Check that all executeWorkflow nodes have waitForSubWorkflow: true
+ */
+export declare function checkExecWorkflowWait(content: string, path: string): Finding[];
+//# sourceMappingURL=exec-workflow-wait.d.ts.map

package/dist/validation/workflow-scripts/exec-workflow-wait.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-workflow-wait.d.ts","sourceRoot":"","sources":["../../../src/validation/workflow-scripts/exec-workflow-wait.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzD,eAAO,MAAM,QAAQ,EAAE,YAWtB,CAAC;AAqBF;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAgD9E"}

package/dist/validation/workflow-scripts/exec-workflow-wait.js

@@ -0,0 +1,85 @@
+/**
+ * Script: EXEC-WORKFLOW-WAIT
+ *
+ * Validates that Execute Workflow nodes have waitForSubWorkflow: true
+ * in their options. Without this setting, the parent workflow does not
+ * wait for the sub-workflow to complete and return values are silently
+ * lost — leading to undefined data in downstream nodes.
+ */
+export const metadata = {
+    id: 'EXEC-WORKFLOW-WAIT',
+    name: 'exec_workflow_wait',
+    severity: 'should',
+    description: 'Execute Workflow nodes should have waitForSubWorkflow: true',
+    details: 'Without waitForSubWorkflow: true, the parent workflow does not wait for the ' +
+        'sub-workflow to complete. Return values are silently lost, causing undefined ' +
+        'data in downstream nodes.',
+    fixable: true,
+    category: 'structure',
+};
+const EXEC_WORKFLOW_TYPE = 'n8n-nodes-base.executeWorkflow';
+/**
+ * Set waitForSubWorkflow: true on a node. Simple JSON parse/modify/stringify.
+ * Formatting is handled by WORKFLOW-FORMAT which runs last.
+ */
+function patchWaitForSubWorkflow(content, nodeId) {
+    const workflow = JSON.parse(content);
+    for (const n of workflow.nodes) {
+        if (n.id === nodeId) {
+            if (!n.parameters)
+                n.parameters = {};
+            if (!n.parameters.options)
+                n.parameters.options = {};
+            n.parameters.options.waitForSubWorkflow = true;
+            break;
+        }
+    }
+    return JSON.stringify(workflow, null, 2) + '\n';
+}
+/**
+ * Check that all executeWorkflow nodes have waitForSubWorkflow: true
+ */
+export function checkExecWorkflowWait(content, path) {
+    const findings = [];
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return [];
+    }
+    const nodes = parsed.nodes || [];
+    for (const node of nodes) {
+        if (node.type !== EXEC_WORKFLOW_TYPE)
+            continue;
+        const options = node.parameters?.options;
+        const waitForSubWorkflow = options?.waitForSubWorkflow;
+        // Skip if explicitly set to false — that's a deliberate fire-and-forget choice
+        if (waitForSubWorkflow === false)
+            continue;
+        // Only flag when waitForSubWorkflow is missing entirely (oversight)
+        if (waitForSubWorkflow !== true) {
+            const nodeName = node.name || node.id;
+            const nodeId = node.id;
+            findings.push({
+                rule: metadata.id,
+                severity: metadata.severity,
+                path,
+                message: `Node "${nodeName}" is missing waitForSubWorkflow: true — sub-workflow return values will be lost`,
+                raw_details: 'Add waitForSubWorkflow: true to the node\'s options to ensure the parent ' +
+                    'workflow waits for the sub-workflow to complete before continuing. ' +
+                    'Set to false explicitly if fire-and-forget is intentional.',
+                nodeId,
+                fixable: true,
+                fix: {
+                    description: `Add waitForSubWorkflow: true to "${nodeName}"`,
+                    apply: (fileContent) => {
+                        return patchWaitForSubWorkflow(fileContent, nodeId);
+                    },
+                },
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=exec-workflow-wait.js.map

package/dist/validation/workflow-scripts/exec-workflow-wait.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-workflow-wait.js","sourceRoot":"","sources":["../../../src/validation/workflow-scripts/exec-workflow-wait.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,CAAC,MAAM,QAAQ,GAAiB;IACpC,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,oBAAoB;IAC1B,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,6DAA6D;IAC1E,OAAO,EACL,8EAA8E;QAC9E,+EAA+E;QAC/E,2BAA2B;IAC7B,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAE5D;;;GAGG;AACH,SAAS,uBAAuB,CAAC,OAAe,EAAE,MAAc;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,CAAC,UAAU;gBAAE,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO;gBAAE,CAAC,CAAC,UAAU,CAAC,OAAO,GAAG,EAAE,CAAC;YACrD,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/C,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,IAAY;IACjE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAU,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB;YAAE,SAAS;QAE/C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;QACzC,MAAM,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,CAAC;QAEvD,+EAA+E;QAC/E,IAAI,kBAAkB,KAAK,KAAK;YAAE,SAAS;QAE3C,oEAAoE;QACpE,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,QAAQ,CAAC,EAAE;gBACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI;gBACJ,OAAO,EAAE,SAAS,QAAQ,iFAAiF;gBAC3G,WAAW,EACT,2EAA2E;oBAC3E,qEAAqE;oBACrE,4DAA4D;gBAC9D,MAAM;gBACN,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE;oBACH,WAAW,EAAE,oCAAoC,QAAQ,GAAG;oBAC5D,KAAK,EAAE,CAAC,WAAmB,EAAE,EAAE;wBAC7B,OAAO,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;oBACtD,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/validation/workflow-scripts/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Workflow Scripts
+ *
+ * Non-Flowlint validation scripts that operate on raw workflow content.
+ * These are used for checks that don't fit the graph-based rule pattern.
+ */
+import type { WorkflowScript } from '../types.js';
+/**
+ * All workflow scripts to run during validation
+ *
+ * Each script receives the raw file content and path,
+ * and returns an array of findings.
+ *
+ * IMPORTANT: checkWorkflowFormat MUST be last — it normalizes
+ * formatting after all other fixes have been applied.
+ */
+export declare const workflowScripts: WorkflowScript[];
+export { checkInstparmQuoting } from './instparm-quoting.js';
+export { checkPlaceholderSyntax } from './placeholder-syntax.js';
+export { checkCredentialPlaceholders } from './credential-placeholders.js';
+export { checkWorkflowSettings } from './workflow-settings.js';
+export { checkWorkflowSanitization } from './workflow-sanitization.js';
+export { checkLlmOutputAccess } from './llm-output-access.js';
+export { checkWebhookId } from './webhook-id.js';
+export { checkLlmModelId } from './llm-model-id.js';
+export { checkRetryBackoff } from './retry-backoff.js';
+export { checkMergeBeforeTerminal } from './merge-before-terminal.js';
+export { checkExecWorkflowWait } from './exec-workflow-wait.js';
+export { checkDbAlwaysOutput } from './db-always-output.js';
+export { checkWorkflowFormat } from './workflow-format.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/validation/workflow-scripts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/validation/workflow-scripts/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAelD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAE,cAAc,EAc3C,CAAC;AAGF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/validation/workflow-scripts/index.js

@@ -0,0 +1,58 @@
+/**
+ * Workflow Scripts
+ *
+ * Non-Flowlint validation scripts that operate on raw workflow content.
+ * These are used for checks that don't fit the graph-based rule pattern.
+ */
+import { checkInstparmQuoting } from './instparm-quoting.js';
+import { checkPlaceholderSyntax } from './placeholder-syntax.js';
+import { checkCredentialPlaceholders } from './credential-placeholders.js';
+import { checkWorkflowSettings } from './workflow-settings.js';
+import { checkWorkflowSanitization } from './workflow-sanitization.js';
+import { checkLlmOutputAccess } from './llm-output-access.js';
+import { checkWebhookId } from './webhook-id.js';
+import { checkLlmModelId } from './llm-model-id.js';
+import { checkRetryBackoff } from './retry-backoff.js';
+import { checkMergeBeforeTerminal } from './merge-before-terminal.js';
+import { checkExecWorkflowWait } from './exec-workflow-wait.js';
+import { checkDbAlwaysOutput } from './db-always-output.js';
+import { checkWorkflowFormat } from './workflow-format.js';
+/**
+ * All workflow scripts to run during validation
+ *
+ * Each script receives the raw file content and path,
+ * and returns an array of findings.
+ *
+ * IMPORTANT: checkWorkflowFormat MUST be last — it normalizes
+ * formatting after all other fixes have been applied.
+ */
+export const workflowScripts = [
+    checkInstparmQuoting,
+    checkPlaceholderSyntax,
+    checkCredentialPlaceholders,
+    checkWorkflowSettings,
+    checkWorkflowSanitization,
+    checkLlmOutputAccess,
+    checkWebhookId,
+    checkLlmModelId,
+    checkRetryBackoff,
+    checkMergeBeforeTerminal,
+    checkExecWorkflowWait,
+    checkDbAlwaysOutput,
+    checkWorkflowFormat,
+];
+// Re-export individual scripts
+export { checkInstparmQuoting } from './instparm-quoting.js';
+export { checkPlaceholderSyntax } from './placeholder-syntax.js';
+export { checkCredentialPlaceholders } from './credential-placeholders.js';
+export { checkWorkflowSettings } from './workflow-settings.js';
+export { checkWorkflowSanitization } from './workflow-sanitization.js';
+export { checkLlmOutputAccess } from './llm-output-access.js';
+export { checkWebhookId } from './webhook-id.js';
+export { checkLlmModelId } from './llm-model-id.js';
+export { checkRetryBackoff } from './retry-backoff.js';
+export { checkMergeBeforeTerminal } from './merge-before-terminal.js';
+export { checkExecWorkflowWait } from './exec-workflow-wait.js';
+export { checkDbAlwaysOutput } from './db-always-output.js';
+export { checkWorkflowFormat } from './workflow-format.js';
+//# sourceMappingURL=index.js.map

package/dist/validation/workflow-scripts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/validation/workflow-scripts/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqB;IAC/C,oBAAoB;IACpB,sBAAsB;IACtB,2BAA2B;IAC3B,qBAAqB;IACrB,yBAAyB;IACzB,oBAAoB;IACpB,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,wBAAwB;IACxB,qBAAqB;IACrB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF,+BAA+B;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/validation/workflow-scripts/instparm-quoting.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Script: INSTPARM-QUOTE
+ *
+ * Checks that INSTPARM placeholders are not incorrectly quoted.
+ *
+ * CORRECT:   const x = {{INSTPARM_NAME_MRAPTSNI}};
+ * INCORRECT: const x = '{{INSTPARM_NAME_MRAPTSNI}}';
+ *
+ * When INSTPARM placeholders are quoted, they become string literals
+ * instead of being replaced with the actual value at runtime.
+ *
+ * This script provides auto-fix capability to remove the quotes.
+ */
+import type { Finding } from '../types.js';
+import type { RuleMetadata } from '../types.js';
+export declare const metadata: RuleMetadata;
+/**
+ * Check for incorrectly quoted INSTPARM placeholders
+ */
+export declare function checkInstparmQuoting(content: string, path: string): Finding[];
+//# sourceMappingURL=instparm-quoting.d.ts.map

package/dist/validation/workflow-scripts/instparm-quoting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instparm-quoting.d.ts","sourceRoot":"","sources":["../../../src/validation/workflow-scripts/instparm-quoting.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,eAAO,MAAM,QAAQ,EAAE,YAQtB,CAAC;AAMF;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAkC7E"}