n8n-nodes-orbitpage 0.1.2 → 0.2.1

package/CHANGELOG.md

@@ -2,6 +2,55 @@
 
 All notable changes to this package are documented here.
 
+## Unreleased
+
+## 0.2.1 - 2026-09-02
+
+### Fixed
+
+- Make generated operation defaults statically recognizable by the official
+  n8n community-package scanner without changing their runtime values.
+
+## 0.2.0 - 2026-09-02
+
+### Breaking changes
+
+- Remove resources outside the public workspace API from the package. Review
+  workflows created with v0.1.x before upgrading to 0.2.0. All remaining
+  workspace resource and operation IDs are unchanged.
+
+### Changed
+
+- Clarify resource, operation, credential, trigger, and upload labels while
+  preserving the internal values used by remaining workspace workflows.
+- Keep Shop polling read-only with the API's `refresh=0` snapshot mode while
+  preserving the stored `shopChanged` trigger value.
+- Add explicit automatic, read-only snapshot, and forced-refresh modes to Get
+  Shop Overview, and cancel failed compound file uploads so reservations and
+  reserved storage are released promptly.
+- Add task-based operation selection, request-body, effect, output-shape, and
+  advanced-upload guidance for first-time users.
+- Add operation-specific JSON guidance for every action with a request body,
+  dynamic human-readable node subtitles, and combined possible-effect labels.
+- Correct immediate-public restore and managed-text-file descriptions, align
+  the bodyless Shop connection action with OpenAPI, and make credential tests
+  reject unsafe remote HTTP or cross-origin redirects.
+- Correct the scope guide to reflect that each selected write scope adds its
+  matching read scope.
+- Separate the published-version selector from the manual current-revision field,
+  while retaining a fallback for existing workflows.
+- Prevent Advanced API requests from reaching paths outside the public
+  workspace API contract through alternate encodings or separators.
+- Reorganize the npm README around requirements, installation, first use,
+  scopes, safety and focused guides.
+- Add contributor, security, example and maintainer documentation without
+  changing the runtime node contract.
+- Improve npm and in-editor discovery with a clearer OrbitPage/n8n description,
+  focused package keywords, and a direct integration-guide link.
+- Align the declared runtime floor with the current n8n toolchain at Node.js
+  22.22, test Node.js 22.22 and 24 in CI, and require exact package/lock/tag
+  parity for OIDC-only npm publishing.
+
 ## 0.1.2 - 2026-08-04
 
 - Add an end-to-end quick start covering token creation, exact n8n credential

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,32 @@
+# Code of Conduct
+
+OrbitPage should be a welcoming, professional place to collaborate on useful
+automation software.
+
+## Expected behavior
+
+- Be respectful, constructive, and specific when giving feedback.
+- Welcome contributors with different backgrounds and levels of experience.
+- Keep discussions focused on the project and its users.
+- Respect privacy. Never publish API tokens, workflow credentials, customer
+  data, private URLs, or unpatched vulnerability details.
+
+## Unacceptable behavior
+
+- Harassment, discrimination, threats, or personal attacks.
+- Sexualized language or unwanted attention.
+- Deliberate intimidation, disruption, or repeated bad-faith engagement.
+- Publishing another person's private information without permission.
+- Conduct that would be inappropriate in a professional community.
+
+## Scope and enforcement
+
+This policy applies in repository discussions, issues, pull requests, reviews,
+release conversations, and other spaces where someone represents the project.
+
+Report conduct concerns privately to `contact@orbitpage.com`. Maintainers may
+remove content and warn, restrict, or ban participants who violate this policy.
+Retaliation against a good-faith report is not acceptable.
+
+Security vulnerabilities follow the private process in
+[SECURITY.md](./SECURITY.md).

package/CONTRIBUTING.md

@@ -0,0 +1,143 @@
+# Contributing
+
+Thank you for improving the OrbitPage community nodes. This repository is
+public, so contributions must contain only information and code that can be
+published on GitHub and npm. By participating, you agree to follow the project
+[Code of Conduct](./CODE_OF_CONDUCT.md).
+
+## Before you start
+
+- Use a public issue for reproducible bugs, documentation problems, and feature
+  proposals that contain no sensitive data.
+- Report suspected vulnerabilities privately through [SECURITY.md](SECURITY.md).
+- Keep a change focused. Discuss broad API or node-architecture changes before
+  investing in a large implementation.
+- Use respectful, technical communication and avoid including customer or
+  tenant data in examples.
+
+## Development environment
+
+Use Node.js 22.22 or newer and install the locked dependencies:
+
+```bash
+npm ci
+```
+
+Run the local n8n development environment with:
+
+```bash
+npm run dev
+```
+
+The package declares runtime support for Node.js 22.22 or newer. CI validates
+the locked toolchain on Node.js 22.22 and 24.
+
+## Repository conventions
+
+- Keep runtime dependencies empty unless a concrete requirement has been
+  reviewed. `n8n-workflow` remains a peer dependency.
+- Preserve one output item and `pairedItem` linking for each input item.
+- Preserve intentional `Continue On Fail` behavior.
+- Keep authentication inside the n8n credential and transport helper.
+- Never log credentials, signed upload URLs, authorization headers, or
+  sensitive response bodies.
+- Require HTTPS for non-localhost endpoints and do not weaken redirect or host
+  restrictions.
+- Prefer guided operations over special-case execution code.
+- Keep private OrbitPage SaaS implementation details outside this public
+  repository.
+
+The programmatic action node is intentional because the integration combines a
+large typed operation catalog with revision preflights, signed binary uploads,
+item linking, and guarded custom paths. New special execution paths still need
+a concrete reason and tests.
+
+## Changing the API catalog
+
+`nodes/OrbitPage/operations.ts` is the source of truth for guided operations.
+When the public OpenAPI contract changes:
+
+1. Verify method, path, `operationId`, scope, parameters, body requirements,
+   revision source, and publish behavior.
+2. Update the typed operation catalog.
+3. Add editor properties only when the operation needs new input.
+4. Add request-level tests in addition to catalog-count assertions.
+5. Build and regenerate the operation matrix:
+
+   ```bash
+   npm run build
+   npm run docs:generate
+   ```
+
+6. Review the generated diff.
+
+`docs/OPERATIONS.md` is generated by
+`scripts/generate-operation-docs.cjs`. Do not edit it manually.
+
+## Documentation changes
+
+The npm README should remain a concise first-use path. Put detailed procedures
+in `docs/guides/` and add them to `docs/README.md`.
+
+When behavior changes, update all affected surfaces:
+
+- node field descriptions;
+- generated operation metadata;
+- focused guide;
+- troubleshooting guidance;
+- examples, when their behavior changes;
+- `CHANGELOG.md` for user-visible release notes.
+
+Use relative links for repository files so documentation works on both GitHub
+and npm. Do not copy the generated operation table into hand-written guides.
+
+## Tests and checks
+
+Run the complete suite before opening a pull request:
+
+```bash
+npm run check
+```
+
+This runs lint, build, isolated package loading, generated-documentation
+verification, and Vitest.
+
+Add behavioral tests for the successful path and important failure modes,
+especially for:
+
+- revision and `If-Match` behavior;
+- path parameters and custom-path validation;
+- upload reserve, finalize, and cleanup;
+- trigger baseline and state comparison;
+- credentials and Base URL restrictions;
+- item linking and `Continue On Fail`.
+
+For documentation-only changes, also verify every relative Markdown link and
+anchor. External links should point to primary OrbitPage, n8n, GitHub, or npm
+sources.
+
+## Pull-request checklist
+
+- [ ] The change is limited to this public community-node repository.
+- [ ] No token, signed URL, tenant data, customer data, or private SaaS code is
+      included.
+- [ ] `npm run check` passes.
+- [ ] New behavior has regression tests.
+- [ ] Generated files were regenerated rather than manually edited.
+- [ ] Documentation and examples match the editor and runtime behavior.
+- [ ] Compatibility or migration impact is explained.
+- [ ] `CHANGELOG.md` is updated when users will observe the change.
+
+## Versions and releases
+
+Maintainers release the npm package through the checked-in GitHub Actions
+workflow with provenance. Contributors should not create version tags or
+publish the package from a pull request.
+
+The npm package version and the n8n node version solve different problems. Use
+semantic versioning for package releases; change the node version only when n8n
+must preserve old stored workflow behavior. Parameter renames require an
+explicit compatibility plan or fallback.
+
+See [Development and release](docs/guides/development-and-release.md) for the
+full repository layout and maintainer process.