n8n-mcp-community 0.1.0

package/dist/introspect/contracts.js

@@ -0,0 +1,309 @@
+import { z } from "zod";
+import { INTROSPECT_RULE_IDS } from "./rule-ids.js";
+export const INTROSPECT_SCHEMA_VERSION = "1.0.0";
+export const INTROSPECT_ENGINE_VERSION = "2.0.0";
+export const INTROSPECT_ERROR_CODES = Object.freeze([
+    "invalid_input",
+    "invalid_output",
+    "invalid_path",
+    "deadline_exceeded",
+    "response_too_large",
+    "upstream_http_error",
+    "invalid_json",
+    "invalid_schema",
+]);
+export const INTROSPECT_LIMITATION_CODES = Object.freeze([
+    "deadline_exceeded",
+    "response_too_large",
+    "upstream_http_error",
+    "invalid_json",
+    "invalid_schema",
+    "repeated_cursor",
+    "invalid_timestamp",
+    "invalid_execution_id",
+    "page_failed",
+    "detail_failed",
+    "ordering_unreliable",
+    "finding_limit",
+    "output_limit",
+    "label_redaction_limit",
+]);
+const WorkflowIdSchema = z
+    .string()
+    .min(1)
+    .max(128)
+    .regex(/^[A-Za-z0-9_-]+$/)
+    .describe("n8n workflow ID. Accepts only ASCII letters, digits, underscore, and hyphen.");
+export const IntrospectInputSchema = z
+    .object({
+    workflowId: WorkflowIdSchema,
+    profile: z
+        .enum(["quick", "deep"])
+        .default("quick")
+        .describe("Use quick for metadata-only analysis or deep for up to four redacted execution details."),
+    lookbackHours: z
+        .number()
+        .int()
+        .min(1)
+        .max(720)
+        .optional()
+        .describe("History window in hours. Defaults to 24 for quick and 168 for deep."),
+    maxExecutions: z
+        .number()
+        .int()
+        .min(1)
+        .max(100)
+        .optional()
+        .describe("Maximum saved executions to inspect. Defaults to 20 for quick and 50 for deep; quick is capped at 25."),
+    includeSanitizedLabels: z
+        .boolean()
+        .default(false)
+        .describe("Include bounded pattern-sanitized workflow and node labels. Opaque identifiers are returned by default."),
+})
+    .strict()
+    .superRefine((input, context) => {
+    if (input.profile === "quick" &&
+        input.maxExecutions !== undefined &&
+        input.maxExecutions > 25) {
+        context.addIssue({
+            code: z.ZodIssueCode.too_big,
+            maximum: 25,
+            inclusive: true,
+            type: "number",
+            path: ["maxExecutions"],
+            message: "Quick profile supports at most 25 executions",
+        });
+    }
+});
+export function resolveIntrospectInput(input) {
+    return {
+        workflowId: input.workflowId,
+        profile: input.profile,
+        lookbackHours: input.lookbackHours ?? (input.profile === "quick" ? 24 : 168),
+        maxExecutions: input.maxExecutions ?? (input.profile === "quick" ? 20 : 50),
+        includeSanitizedLabels: input.includeSanitizedLabels,
+    };
+}
+export const WorkflowNodeSchema = z
+    .object({
+    id: z.string().optional(),
+    name: z.string(),
+    type: z.string().optional(),
+    typeVersion: z.number().finite().min(-10_000).max(10_000).optional(),
+    disabled: z.boolean().optional(),
+    retryOnFail: z.boolean().optional(),
+    maxTries: z.number().optional(),
+    waitBetweenTries: z.number().optional(),
+    continueOnFail: z.boolean().optional(),
+    onError: z.string().max(128).optional(),
+    executeOnce: z.boolean().optional(),
+    alwaysOutputData: z.boolean().optional(),
+    parameters: z.record(z.unknown()).optional(),
+    credentials: z.record(z.unknown()).optional(),
+})
+    .passthrough();
+export const WorkflowResponseSchema = z
+    .object({
+    id: z.string(),
+    name: z.string(),
+    active: z.boolean(),
+    triggerCount: z.number().int().nonnegative().optional(),
+    nodes: z.array(WorkflowNodeSchema).max(1_000).default([]),
+    connections: z.record(z.unknown()).default({}),
+    settings: z.record(z.unknown()).default({}),
+    pinData: z.record(z.unknown()).nullable().optional(),
+})
+    .passthrough();
+const ApiIdentifierSchema = z.union([z.string(), z.number()]).transform(String);
+const ExecutionCursorSchema = z
+    .string()
+    .min(1)
+    .max(2_048)
+    .refine((value) => !/[\u0000-\u001f\u007f]/.test(value), "Execution cursors must not contain control characters.");
+export const ExecutionMetadataSchema = z
+    .object({
+    id: ApiIdentifierSchema,
+    status: z.string(),
+    mode: z.string().optional(),
+    startedAt: z.string().nullable().optional(),
+    stoppedAt: z.string().nullable().optional(),
+    waitTill: z.string().nullable().optional(),
+    workflowId: ApiIdentifierSchema.nullable().optional(),
+})
+    .passthrough();
+export const ExecutionListResponseSchema = z
+    .object({
+    data: z.array(ExecutionMetadataSchema).max(100).default([]),
+    nextCursor: ExecutionCursorSchema.nullable().optional(),
+})
+    .passthrough();
+export const ExecutionDetailResponseSchema = ExecutionMetadataSchema.extend({
+    data: z.record(z.unknown()).optional(),
+}).passthrough();
+export const SeveritySchema = z.enum(["critical", "high", "medium", "low", "info"]);
+export const ConfidenceSchema = z.enum(["high", "medium", "low"]);
+export const CategorySchema = z.enum([
+    "structure",
+    "contract",
+    "reliability",
+    "performance",
+    "privacy",
+    "maintainability",
+    "observability",
+]);
+const FactValueSchema = z.union([z.string(), z.number(), z.boolean(), z.null()]);
+const MAX_FINDING_ENTITY_KEY_LENGTH = 128;
+const MAX_FINDING_ID_LENGTH = Math.max(...INTROSPECT_RULE_IDS.map((ruleId) => ruleId.length)) +
+    1 +
+    MAX_FINDING_ENTITY_KEY_LENGTH;
+export const FindingSchema = z.object({
+    id: z.string().max(MAX_FINDING_ID_LENGTH),
+    ruleId: z.enum(INTROSPECT_RULE_IDS),
+    category: CategorySchema,
+    severity: SeveritySchema,
+    confidence: ConfidenceSchema,
+    title: z.string(),
+    summary: z.string(),
+    affectedEntity: z.object({
+        kind: z.string(),
+        key: z.string().max(MAX_FINDING_ENTITY_KEY_LENGTH),
+        label: z.string().optional(),
+    }),
+    evidence: z.object({
+        summary: z.string(),
+        facts: z.record(FactValueSchema).optional(),
+    }),
+    remediation: z.string(),
+    documentationUrl: z
+        .string()
+        .max(2_048)
+        .refine((value) => {
+        try {
+            const protocol = new URL(value).protocol;
+            return protocol === "https:" || protocol === "http:";
+        }
+        catch {
+            return false;
+        }
+    }, "Documentation URLs must use HTTP or HTTPS.")
+        .optional(),
+});
+export const RuleCoverageSchema = z.object({
+    ruleId: z.enum(INTROSPECT_RULE_IDS),
+    outcome: z.enum(["triggered", "passed", "not_applicable", "inconclusive"]),
+    partiallyInconclusive: z.boolean(),
+    reason: z.string(),
+    findingCount: z.number().int().nonnegative(),
+    totalFindingCount: z.number().int().nonnegative(),
+    omittedFindingCount: z.number().int().nonnegative(),
+    detectedCycleCount: z.number().int().nonnegative(),
+    inconclusiveCycleCount: z.number().int().nonnegative(),
+});
+const StatusCountsSchema = z.object({
+    success: z.number().int().nonnegative(),
+    error: z.number().int().nonnegative(),
+    crashed: z.number().int().nonnegative(),
+    canceled: z.number().int().nonnegative(),
+    running: z.number().int().nonnegative(),
+    waiting: z.number().int().nonnegative(),
+    new: z.number().int().nonnegative(),
+    unknown: z.number().int().nonnegative(),
+});
+const DurationMetricsSchema = z.object({
+    sampleCount: z.number().int().nonnegative(),
+    meanMs: z.number().nonnegative().nullable(),
+    minMs: z.number().nonnegative().nullable(),
+    maxMs: z.number().nonnegative().nullable(),
+    p50Ms: z.number().nonnegative().nullable(),
+    p95Ms: z.number().nonnegative().nullable(),
+    p99Ms: z.number().nonnegative().nullable(),
+});
+export const IntrospectResultSchema = z.object({
+    schemaVersion: z.literal(INTROSPECT_SCHEMA_VERSION),
+    engineVersion: z.literal(INTROSPECT_ENGINE_VERSION),
+    status: z.enum(["complete", "partial"]),
+    profile: z.enum(["quick", "deep"]),
+    workflow: z.object({
+        id: z.string(),
+        label: z.string().optional(),
+        active: z.boolean(),
+        nodeCount: z.number().int().nonnegative(),
+    }),
+    sample: z.object({
+        lookbackHours: z.number().int().positive(),
+        maxExecutions: z.number().int().positive(),
+        metadataExecutions: z.number().int().nonnegative(),
+        eligibleExecutions: z.number().int().nonnegative(),
+        pages: z.number().int().nonnegative(),
+        detailRequests: z.number().int().nonnegative(),
+        sampledErrors: z.number().int().nonnegative(),
+        acceptedBytes: z.number().int().nonnegative(),
+        ordering: z.enum(["verified_newest_first", "unreliable", "unknown"]),
+        historyBoundary: z.enum([
+            "complete",
+            "lookback_reached",
+            "request_limited",
+            "execution_limited",
+            "ordering_unreliable",
+            "unknown",
+        ]),
+        oldestStartedAt: z.string().nullable(),
+        newestStartedAt: z.string().nullable(),
+    }),
+    summary: z.object({
+        findingCounts: z.object({
+            critical: z.number().int().nonnegative(),
+            high: z.number().int().nonnegative(),
+            medium: z.number().int().nonnegative(),
+            low: z.number().int().nonnegative(),
+            info: z.number().int().nonnegative(),
+        }),
+        ruleOutcomes: z.object({
+            triggered: z.number().int().nonnegative(),
+            passed: z.number().int().nonnegative(),
+            notApplicable: z.number().int().nonnegative(),
+            inconclusive: z.number().int().nonnegative(),
+            partiallyInconclusive: z.number().int().nonnegative(),
+        }),
+        findings: z.object({
+            totalCount: z.number().int().nonnegative(),
+            retainedCount: z.number().int().nonnegative(),
+            omittedCount: z.number().int().nonnegative(),
+            truncated: z.boolean(),
+        }),
+    }),
+    metrics: z.object({
+        statusCounts: StatusCountsSchema,
+        successRate: z.number().min(0).max(1).nullable(),
+        duration: DurationMetricsSchema,
+        consecutiveErrors: z.number().int().nonnegative().nullable(),
+        perNodeTimings: z
+            .array(z.object({
+            nodeRef: z.string(),
+            label: z.string().optional(),
+            sampleCount: z.number().int().positive(),
+            medianMs: z.number().nonnegative(),
+            maxMs: z.number().nonnegative(),
+        }))
+            .max(1_000),
+        errorClusters: z
+            .array(z.object({
+            fingerprint: z.string().regex(/^[a-f0-9]{16}$/),
+            nodeRef: z.string().optional(),
+            label: z.string().optional(),
+            sampleCount: z.number().int().positive(),
+            sampledErrorDetails: z.number().int().nonnegative(),
+            sampledErrors: z.number().int().nonnegative(),
+        }))
+            .max(100),
+    }),
+    findings: z.array(FindingSchema).max(1_000),
+    ruleCoverage: z.array(RuleCoverageSchema).max(100),
+    limitations: z
+        .array(z.object({ code: z.enum(INTROSPECT_LIMITATION_CODES), message: z.string() }))
+        .max(100),
+    guidance: z.object({
+        instanceSecurityTool: z.literal("n8n_audit_generate"),
+        message: z.string(),
+    }),
+});

package/dist/introspect/engine.js

@@ -0,0 +1,184 @@
+import { Buffer } from "node:buffer";
+import { PROFILE_BUDGETS, collectSnapshot } from "./collector.js";
+import { INTROSPECT_ENGINE_VERSION, INTROSPECT_SCHEMA_VERSION, IntrospectInputSchema, IntrospectResultSchema, resolveIntrospectInput, } from "./contracts.js";
+import { computeMetrics, evaluateRules } from "./rules.js";
+export class IntrospectInputError extends Error {
+    code = "invalid_input";
+    constructor(message = "The Introspect input is invalid.") {
+        super(message);
+        this.name = "IntrospectInputError";
+    }
+}
+export class IntrospectOutputError extends Error {
+    code = "invalid_output";
+    constructor(message = "The Introspect result could not be represented safely.") {
+        super(message);
+        this.name = "IntrospectOutputError";
+    }
+}
+function findingCounts(findings) {
+    const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    findings.forEach((finding) => {
+        counts[finding.severity] += 1;
+    });
+    return counts;
+}
+function ruleOutcomeCounts(coverage) {
+    const counts = {
+        triggered: 0,
+        passed: 0,
+        notApplicable: 0,
+        inconclusive: 0,
+        partiallyInconclusive: 0,
+    };
+    coverage.forEach((record) => {
+        if (record.outcome === "not_applicable")
+            counts.notApplicable += 1;
+        else
+            counts[record.outcome] += 1;
+        if (record.partiallyInconclusive)
+            counts.partiallyInconclusive += 1;
+    });
+    return counts;
+}
+function findingDisclosure(coverage, retainedCount) {
+    const totalCount = coverage.reduce((sum, record) => sum + record.totalFindingCount, 0);
+    return {
+        totalCount,
+        retainedCount,
+        omittedCount: totalCount - retainedCount,
+        truncated: totalCount > retainedCount,
+    };
+}
+function synchronizeFindingDisclosure(result) {
+    const retainedByRule = new Map();
+    for (const finding of result.findings) {
+        retainedByRule.set(finding.ruleId, (retainedByRule.get(finding.ruleId) ?? 0) + 1);
+    }
+    for (const record of result.ruleCoverage) {
+        record.findingCount = retainedByRule.get(record.ruleId) ?? 0;
+        record.omittedFindingCount = record.totalFindingCount - record.findingCount;
+    }
+    result.summary.findingCounts = findingCounts(result.findings);
+    result.summary.findings = findingDisclosure(result.ruleCoverage, result.findings.length);
+}
+function jsonBytes(value) {
+    return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function addLimitation(limitations, code, message) {
+    if (!limitations.some((item) => item.code === code))
+        limitations.push({ code, message });
+}
+function retainLargestPrefix(items, fits) {
+    const original = [...items];
+    let low = 0;
+    let high = original.length;
+    let best = 0;
+    const setLength = (length) => {
+        items.length = 0;
+        for (const item of original.slice(0, length))
+            items.push(item);
+    };
+    while (low <= high) {
+        const middle = Math.floor((low + high) / 2);
+        setLength(middle);
+        if (fits()) {
+            best = middle;
+            low = middle + 1;
+        }
+        else {
+            high = middle - 1;
+        }
+    }
+    setLength(best);
+}
+export function fitStructuredResult(result) {
+    const limit = PROFILE_BUDGETS[result.profile].structuredOutputBytes;
+    if (jsonBytes(result) <= limit)
+        return result;
+    const reduced = structuredClone(result);
+    reduced.status = "partial";
+    addLimitation(reduced.limitations, "output_limit", "The report was reduced to remain within the immutable output byte limit.");
+    const synchronizedResultFits = () => {
+        synchronizeFindingDisclosure(reduced);
+        return jsonBytes(reduced) <= limit;
+    };
+    retainLargestPrefix(reduced.metrics.perNodeTimings, synchronizedResultFits);
+    if (!synchronizedResultFits()) {
+        retainLargestPrefix(reduced.metrics.errorClusters, synchronizedResultFits);
+    }
+    if (!synchronizedResultFits()) {
+        retainLargestPrefix(reduced.findings, synchronizedResultFits);
+    }
+    if (!synchronizedResultFits()) {
+        throw new IntrospectOutputError("The fixed Introspect contract exceeds its output budget.");
+    }
+    // A mismatch here is an internal engine invariant failure, never upstream n8n shape drift.
+    const fitted = IntrospectResultSchema.safeParse(reduced);
+    if (!fitted.success)
+        throw new IntrospectOutputError();
+    return fitted.data;
+}
+export async function inspectWorkflow(client, rawInput) {
+    const parsedInput = IntrospectInputSchema.safeParse(rawInput);
+    if (!parsedInput.success)
+        throw new IntrospectInputError();
+    const input = resolveIntrospectInput(parsedInput.data);
+    const snapshot = await collectSnapshot(client, input);
+    const evaluation = evaluateRules(snapshot);
+    const metrics = computeMetrics(snapshot);
+    const limitations = [];
+    snapshot.limitations.forEach((item) => addLimitation(limitations, item.code, item.message));
+    if (evaluation.truncatedRuleIds.length > 0) {
+        addLimitation(limitations, "finding_limit", "One or more rules produced more occurrences than the immutable output cap allows.");
+    }
+    if (input.includeSanitizedLabels) {
+        addLimitation(limitations, "label_redaction_limit", "Pattern redaction cannot recognize every sensitive proper name; opaque identifiers remain authoritative.");
+    }
+    // The assembled result is a local invariant: a mismatch is an internal output failure
+    // (invalid_output), never upstream n8n response-shape drift.
+    const assembled = IntrospectResultSchema.safeParse({
+        schemaVersion: INTROSPECT_SCHEMA_VERSION,
+        engineVersion: INTROSPECT_ENGINE_VERSION,
+        status: snapshot.status === "partial" || evaluation.truncatedRuleIds.length > 0
+            ? "partial"
+            : "complete",
+        profile: input.profile,
+        workflow: {
+            id: snapshot.workflow.id,
+            ...(snapshot.workflow.label ? { label: snapshot.workflow.label } : {}),
+            active: snapshot.workflow.active,
+            nodeCount: snapshot.workflow.nodes.length,
+        },
+        sample: {
+            lookbackHours: input.lookbackHours,
+            maxExecutions: input.maxExecutions,
+            metadataExecutions: snapshot.totalMetadataExecutions,
+            eligibleExecutions: metrics.statusCounts.success + metrics.statusCounts.error + metrics.statusCounts.crashed,
+            pages: snapshot.pages,
+            detailRequests: snapshot.detailRequests,
+            sampledErrors: snapshot.sampledErrors,
+            acceptedBytes: snapshot.acceptedBytes,
+            ordering: snapshot.ordering,
+            historyBoundary: snapshot.historyBoundary,
+            oldestStartedAt: snapshot.oldestStartedAt,
+            newestStartedAt: snapshot.newestStartedAt,
+        },
+        summary: {
+            findingCounts: findingCounts(evaluation.findings),
+            ruleOutcomes: ruleOutcomeCounts(evaluation.coverage),
+            findings: findingDisclosure(evaluation.coverage, evaluation.findings.length),
+        },
+        metrics,
+        findings: evaluation.findings,
+        ruleCoverage: evaluation.coverage,
+        limitations,
+        guidance: {
+            instanceSecurityTool: "n8n_audit_generate",
+            message: "Use n8n_audit_generate for instance-wide security facts; this report inspects one saved workflow and a bounded execution sample.",
+        },
+    });
+    if (!assembled.success)
+        throw new IntrospectOutputError();
+    return fitStructuredResult(assembled.data);
+}

package/dist/introspect/http-client.js

@@ -0,0 +1,142 @@
+import { IntrospectCollectionError } from "./collector.js";
+function isSafeEncodedPath(path) {
+    if (!/^\/[A-Za-z0-9_./%~-]*$/.test(path) || /%(?![A-Fa-f0-9]{2})/.test(path)) {
+        return false;
+    }
+    for (const rawSegment of path.split("/").slice(1)) {
+        if (rawSegment === "")
+            return false;
+        let decoded;
+        try {
+            decoded = decodeURIComponent(rawSegment);
+        }
+        catch {
+            return false;
+        }
+        if (decoded === "." ||
+            decoded === ".." ||
+            decoded.includes("/") ||
+            decoded.includes("\\") ||
+            decoded.includes("%") ||
+            /[\u0000-\u001f\u007f-\u009f]/.test(decoded)) {
+            return false;
+        }
+    }
+    return true;
+}
+async function readBoundedBody(response, maxBytes, truncateOnOverflow) {
+    if (!response.body)
+        return { body: new Uint8Array(), bytes: 0 };
+    const reader = response.body.getReader();
+    const chunks = [];
+    let bytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            const remaining = maxBytes - bytes;
+            if (value.byteLength > remaining) {
+                if (truncateOnOverflow && remaining > 0)
+                    chunks.push(value.subarray(0, remaining));
+                bytes += truncateOnOverflow ? Math.max(remaining, 0) : value.byteLength;
+                await reader.cancel();
+                if (!truncateOnOverflow) {
+                    throw new IntrospectCollectionError("response_too_large", "The public n8n API response exceeded the Introspect byte limit.");
+                }
+                break;
+            }
+            chunks.push(value);
+            bytes += value.byteLength;
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const body = new Uint8Array(bytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        body.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return { body, bytes };
+}
+export function createN8nReadClient(options) {
+    const fetchImplementation = options.fetchImplementation ?? fetch;
+    const baseUrl = new URL(options.baseUrl);
+    const basePath = baseUrl.pathname.replace(/\/$/, "");
+    const apiRoot = `${basePath}/api/v1`.replace(/\/{2,}/g, "/");
+    return {
+        async get(endpoint, query, budget) {
+            if (!isSafeEncodedPath(endpoint)) {
+                throw new IntrospectCollectionError("invalid_path", "The public n8n API path is invalid.");
+            }
+            options.beforeRequest?.();
+            if (!Number.isInteger(budget.timeoutMs) || budget.timeoutMs < 1) {
+                throw new IntrospectCollectionError("deadline_exceeded", "The Introspect request timeout is invalid.");
+            }
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), budget.timeoutMs);
+            try {
+                const requestedPath = `${apiRoot}${endpoint}`.replace(/\/{2,}/g, "/");
+                const url = new URL(baseUrl.href);
+                url.pathname = requestedPath;
+                url.search = "";
+                for (const [key, value] of Object.entries(query))
+                    url.searchParams.set(key, value);
+                if (url.origin !== baseUrl.origin ||
+                    url.pathname !== requestedPath ||
+                    !url.pathname.startsWith(`${apiRoot}/`)) {
+                    throw new IntrospectCollectionError("invalid_path", "The public n8n API origin or path changed unexpectedly.");
+                }
+                const response = await fetchImplementation(url, {
+                    method: "GET",
+                    headers: {
+                        "X-N8N-API-KEY": options.apiKey,
+                        Accept: "application/json",
+                    },
+                    signal: controller.signal,
+                    redirect: "error",
+                });
+                if (!response.ok) {
+                    await readBoundedBody(response, 8_192, true);
+                    throw new IntrospectCollectionError("upstream_http_error", `The public n8n API returned HTTP ${response.status}; verify the workflow ID, API access, and n8n availability.`, response.status);
+                }
+                const contentLength = response.headers.get("content-length");
+                if (contentLength &&
+                    /^\d+$/.test(contentLength) &&
+                    Number(contentLength) > budget.maxBytes) {
+                    await response.body?.cancel();
+                    throw new IntrospectCollectionError("response_too_large", "The public n8n API declared a response larger than the Introspect byte limit.");
+                }
+                const body = await readBoundedBody(response, budget.maxBytes, false);
+                let text;
+                try {
+                    text = new TextDecoder("utf-8", { fatal: true }).decode(body.body);
+                }
+                catch {
+                    throw new IntrospectCollectionError("invalid_json", "The public n8n API response was not valid UTF-8 JSON.");
+                }
+                try {
+                    return { value: JSON.parse(text), bytes: body.bytes };
+                }
+                catch {
+                    throw new IntrospectCollectionError("invalid_json", "The public n8n API response was not valid JSON.");
+                }
+            }
+            catch (error) {
+                if (error instanceof IntrospectCollectionError)
+                    throw error;
+                if (error instanceof Error && error.name === "AbortError") {
+                    throw new IntrospectCollectionError("deadline_exceeded", "The public n8n API request exceeded the Introspect deadline.");
+                }
+                throw new IntrospectCollectionError("upstream_http_error", "The public n8n API request failed; verify connectivity and API access.");
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+    };
+}

package/dist/introspect/index.js

@@ -0,0 +1,5 @@
+export { IntrospectInputSchema, IntrospectResultSchema } from "./contracts.js";
+export { IntrospectCollectionError } from "./collector.js";
+export { inspectWorkflow, IntrospectInputError, IntrospectOutputError } from "./engine.js";
+export { renderIntrospect } from "./render.js";
+export { createN8nReadClient } from "./http-client.js";

package/dist/introspect/order.js

@@ -0,0 +1,3 @@
+export function compareCodeUnits(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}

package/dist/introspect/render.js

@@ -0,0 +1,25 @@
+import { Buffer } from "node:buffer";
+import { PROFILE_BUDGETS } from "./collector.js";
+import { IntrospectOutputError } from "./engine.js";
+function percentage(value) {
+    return value === null ? "unavailable" : `${(value * 100).toFixed(1)}%`;
+}
+export function renderIntrospect(result) {
+    const counts = result.summary.findingCounts;
+    const outcomes = result.summary.ruleOutcomes;
+    const summary = [
+        `n8n workflow Introspect ${result.status}: ${result.workflow.id}.`,
+        `Profile ${result.profile}; ${result.sample.metadataExecutions} metadata executions; ${result.sample.detailRequests} detail requests.`,
+        `Findings: ${counts.critical} critical, ${counts.high} high, ${counts.medium} medium, ${counts.low} low, ${counts.info} info.`,
+        `Rule outcomes: ${outcomes.inconclusive} inconclusive, ${outcomes.partiallyInconclusive} partially inconclusive; limitations: ${result.limitations.length}.`,
+        `Observed success rate: ${percentage(result.metrics.successRate)}.`,
+        `Ordering: ${result.sample.ordering}; history boundary: ${result.sample.historyBoundary}.`,
+        "The following JSON is the authoritative machine-readable report.",
+    ].join(" ");
+    const json = JSON.stringify(result);
+    const combinedBytes = Buffer.byteLength(summary, "utf8") + Buffer.byteLength(json, "utf8") * 2;
+    if (combinedBytes > PROFILE_BUDGETS[result.profile].combinedOutputBytes) {
+        throw new IntrospectOutputError("The rendered Introspect report exceeds its combined output budget.");
+    }
+    return { summary, json, combinedBytes };
+}