n8nac 2.4.0 → 2.5.0

package/dist/core/services/folder-path-resolver.d.ts

@@ -0,0 +1,51 @@
+import { IFolder, IWorkflow } from '../types.js';
+/**
+ * Turns an n8n folder name into a path segment that is safe on every platform.
+ *
+ * Replaces filesystem-reserved characters, collapses whitespace, strips trailing
+ * dots and spaces (which Windows silently drops), and escapes reserved device
+ * names such as `CON` or `LPT1`. Never returns an empty string — unusable names
+ * fall back to `folder`.
+ */
+export declare function sanitizePathSegment(name: string): string;
+/**
+ * Turns a flat list of n8n folders into local path segments.
+ *
+ * Resolution is deterministic: the same remote tree always yields the same local
+ * layout. Two siblings whose sanitised names collide case-insensitively (which
+ * would be the same directory on Windows and macOS) are disambiguated with a
+ * short id suffix, and results are memoised per folder id.
+ *
+ * Only useful once n8n reports a workflow's folder — see the note on
+ * WorkflowStateTracker.createFolderResolver.
+ */
+export declare class FolderPathResolver {
+    private foldersById;
+    private memo;
+    private siblingSegmentById;
+    constructor(folders: IFolder[]);
+    /**
+     * Path segments for the folder a workflow lives in.
+     *
+     * @returns Segments from the project root down, or an empty array when the
+     * workflow sits at the root or carries no folder information.
+     */
+    getPathForWorkflow(workflow: IWorkflow): string[];
+    /** Path segments for a folder id, root first. */
+    getPathForFolderId(folderId: string): string[];
+    /**
+     * Precomputes one segment per folder, disambiguating case-insensitive
+     * collisions between siblings. Sorted by name then id so the folder that
+     * keeps the plain name is stable across runs.
+     */
+    private buildSiblingSegments;
+    /**
+     * Walks a folder up to the root, memoising each result.
+     *
+     * `seen` guards against a cycle in the remote data: a folder that cannot be
+     * resolved — unknown id or a loop — lands under `_Unresolved Folder` rather
+     * than recursing forever.
+     */
+    private resolve;
+}
+//# sourceMappingURL=folder-path-resolver.d.ts.map

package/dist/core/services/folder-path-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"folder-path-resolver.d.ts","sourceRoot":"","sources":["../../../src/core/services/folder-path-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQjD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiBxD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,kBAAkB;IAC3B,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,IAAI,CAA+B;IAC3C,OAAO,CAAC,kBAAkB,CAA6B;gBAE3C,OAAO,EAAE,OAAO,EAAE;IAO9B;;;;;OAKG;IACH,kBAAkB,CAAC,QAAQ,EAAE,SAAS,GAAG,MAAM,EAAE;IAMjD,iDAAiD;IACjD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAI9C;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAwB5B;;;;;;OAMG;IACH,OAAO,CAAC,OAAO;CAqBlB"}

package/dist/core/services/folder-path-resolver.js

@@ -0,0 +1,123 @@
+const WINDOWS_RESERVED_FILENAMES = new Set([
+    'CON', 'PRN', 'AUX', 'NUL',
+    'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9',
+    'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9',
+]);
+/**
+ * Turns an n8n folder name into a path segment that is safe on every platform.
+ *
+ * Replaces filesystem-reserved characters, collapses whitespace, strips trailing
+ * dots and spaces (which Windows silently drops), and escapes reserved device
+ * names such as `CON` or `LPT1`. Never returns an empty string — unusable names
+ * fall back to `folder`.
+ */
+export function sanitizePathSegment(name) {
+    let safeName = (name || '')
+        .replace(/[\u0000-\u001f\u007f<>:"/\\|?*]/g, '_')
+        .replace(/\s+/g, ' ')
+        .trim()
+        .replace(/[. ]+$/g, '');
+    if (!safeName || safeName === '.' || safeName === '..')
+        safeName = 'folder';
+    const firstDotIndex = safeName.indexOf('.');
+    const baseName = firstDotIndex === -1 ? safeName : safeName.slice(0, firstDotIndex);
+    const rest = firstDotIndex === -1 ? '' : safeName.slice(firstDotIndex);
+    if (WINDOWS_RESERVED_FILENAMES.has(baseName.toUpperCase())) {
+        safeName = `${baseName}_${rest}`;
+    }
+    return safeName.replace(/[. ]+$/g, '') || 'folder';
+}
+/**
+ * Turns a flat list of n8n folders into local path segments.
+ *
+ * Resolution is deterministic: the same remote tree always yields the same local
+ * layout. Two siblings whose sanitised names collide case-insensitively (which
+ * would be the same directory on Windows and macOS) are disambiguated with a
+ * short id suffix, and results are memoised per folder id.
+ *
+ * Only useful once n8n reports a workflow's folder — see the note on
+ * WorkflowStateTracker.createFolderResolver.
+ */
+export class FolderPathResolver {
+    foldersById = new Map();
+    memo = new Map();
+    siblingSegmentById = new Map();
+    constructor(folders) {
+        for (const folder of folders) {
+            if (folder?.id)
+                this.foldersById.set(folder.id, folder);
+        }
+        this.buildSiblingSegments(folders);
+    }
+    /**
+     * Path segments for the folder a workflow lives in.
+     *
+     * @returns Segments from the project root down, or an empty array when the
+     * workflow sits at the root or carries no folder information.
+     */
+    getPathForWorkflow(workflow) {
+        const folderId = workflow.parentFolderId ?? workflow.parentFolder?.id ?? null;
+        if (!folderId)
+            return [];
+        return this.getPathForFolderId(folderId);
+    }
+    /** Path segments for a folder id, root first. */
+    getPathForFolderId(folderId) {
+        return this.resolve(folderId, new Set());
+    }
+    /**
+     * Precomputes one segment per folder, disambiguating case-insensitive
+     * collisions between siblings. Sorted by name then id so the folder that
+     * keeps the plain name is stable across runs.
+     */
+    buildSiblingSegments(folders) {
+        const siblings = new Map();
+        for (const folder of folders) {
+            const parentKey = folder.parentFolderId ?? '';
+            const current = siblings.get(parentKey) ?? [];
+            current.push(folder);
+            siblings.set(parentKey, current);
+        }
+        for (const group of siblings.values()) {
+            const used = new Map();
+            for (const folder of group.sort((a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id))) {
+                const base = sanitizePathSegment(folder.name);
+                let segment = base;
+                const existingId = used.get(segment.toLowerCase());
+                if (existingId && existingId !== folder.id) {
+                    segment = `${base}_${folder.id.slice(0, 8)}`;
+                }
+                used.set(segment.toLowerCase(), folder.id);
+                this.siblingSegmentById.set(folder.id, segment);
+            }
+        }
+    }
+    /**
+     * Walks a folder up to the root, memoising each result.
+     *
+     * `seen` guards against a cycle in the remote data: a folder that cannot be
+     * resolved — unknown id or a loop — lands under `_Unresolved Folder` rather
+     * than recursing forever.
+     */
+    resolve(folderId, seen) {
+        const cached = this.memo.get(folderId);
+        if (cached)
+            return cached;
+        const folder = this.foldersById.get(folderId);
+        if (!folder || seen.has(folderId)) {
+            const fallback = ['_Unresolved Folder', sanitizePathSegment(folderId)];
+            this.memo.set(folderId, fallback);
+            return fallback;
+        }
+        seen.add(folderId);
+        const parentSegments = folder.parentFolderId
+            ? this.resolve(folder.parentFolderId, seen)
+            : [];
+        const segment = this.siblingSegmentById.get(folderId) ?? sanitizePathSegment(folder.name);
+        const segments = [...parentSegments, segment];
+        this.memo.set(folderId, segments);
+        seen.delete(folderId);
+        return segments;
+    }
+}
+//# sourceMappingURL=folder-path-resolver.js.map

package/dist/core/services/folder-path-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"folder-path-resolver.js","sourceRoot":"","sources":["../../../src/core/services/folder-path-resolver.ts"],"names":[],"mappings":"AAEA,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACvC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACtE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CACzE,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC5C,IAAI,QAAQ,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;SACtB,OAAO,CAAC,kCAAkC,EAAE,GAAG,CAAC;SAChD,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE;SACN,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE5B,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI;QAAE,QAAQ,GAAG,QAAQ,CAAC;IAE5E,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACvE,IAAI,0BAA0B,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACzD,QAAQ,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,OAAO,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;AACvD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,kBAAkB;IACnB,WAAW,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnC,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvD,YAAY,OAAkB;QAC1B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,MAAM,EAAE,EAAE;gBAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,QAAmB;QAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,YAAY,EAAE,EAAE,IAAI,IAAI,CAAC;QAC9E,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,iDAAiD;IACjD,kBAAkB,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACK,oBAAoB,CAAC,OAAkB;QAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;YACvC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAClG,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC9C,IAAI,OAAO,GAAG,IAAI,CAAC;gBACnB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;gBACnD,IAAI,UAAU,IAAI,UAAU,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;oBACzC,OAAO,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACjD,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACpD,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,OAAO,CAAC,QAAgB,EAAE,IAAiB;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAClC,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnB,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc;YACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC;YAC3C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,CAAC,GAAG,cAAc,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,QAAQ,CAAC;IACpB,CAAC;CACJ"}

package/dist/core/services/n8n-api-client.d.ts

@@ -1,10 +1,26 @@
-import { IN8nCredentials, IWorkflow, IProject, ITag, ITriggerInfo, ITestPlan, ITestResult, IExecutionDetails, IExecutionList, ExecutionStatus } from '../types.js';
+import { IN8nCredentials, IWorkflow, IProject, ITag, ITriggerInfo, ITestPlan, ITestResult, IExecutionDetails, IExecutionList, ExecutionStatus, IFolder } from '../types.js';
+/**
+ * Builds a combined CA certificate bundle from the trust anchors the user configured
+ * (`NODE_EXTRA_CA_CERTS`, `N8NAC_EXTRA_CA_CERTS`) plus the OS trust store, which is the
+ * programmatic equivalent of the `--use-system-ca` flag.
+ *
+ * Returns undefined when no source provides extra certificates. When it does return a bundle,
+ * the Node.js default Mozilla roots are included, because supplying `ca` replaces them.
+ *
+ * Note that this only covers the axios agent. Anything reaching n8n through the global `fetch`
+ * — the manager-core health probe, project listing and credential calls — ignores `https.Agent`
+ * entirely, which is why {@link installExtraCaCertificates} applies the same anchors
+ * process-wide.
+ */
+export declare function buildCaBundle(): string[] | undefined;
 export declare class N8nApiClient {
     private client;
     private apiKey;
     private projectsCache;
     private projectsCachePromise;
     private static readonly PERSONAL_PROJECT_PLACEHOLDER_ID;
+    /** Memoized result of resolveFolderProjectId(); `null` means "resolved to nothing". */
+    private folderProjectIdPromise;
     /** Shared agents keep DNS/TLS behavior consistent for API, health, and webhook calls. */
     private httpAgent;
     private httpsAgent;
@@ -34,6 +50,42 @@ export declare class N8nApiClient {
      * @returns Array of IProject
      */
     getProjects(): Promise<IProject[]>;
+    /**
+     * Lists every folder in a project, following n8n's skip/take pagination.
+     *
+     * Requires an instance where folders are licensed (`feat:folders`, unlocked by
+     * the free Community registration) and n8n 2.19+; callers are expected to
+     * handle 403/404 by falling back to a flat layout.
+     *
+     * @param projectId Real project id — the endpoint does not accept the
+     * `personal` alias that folder creation does. See resolveFolderProjectId().
+     */
+    getFolders(projectId: string): Promise<IFolder[]>;
+    /**
+     * Creates a folder in a project.
+     *
+     * @param projectId Project id, or `personal` to target the calling user's own
+     * project (n8n 2.32+).
+     * @param input `parentFolderId` nests the new folder; omit it for a
+     * project-root folder.
+     */
+    createFolder(projectId: string, input: {
+        name: string;
+        parentFolderId?: string | null;
+    }): Promise<IFolder>;
+    /**
+     * Resolves a project id usable with the folder endpoints.
+     *
+     * `GET /api/v1/projects` is gated behind `feat:projectRole:admin` (Business /
+     * Enterprise), and `GET /projects/:id/folders` does not accept the `personal`
+     * alias that `POST` does — so on a Community instance we have no direct way to
+     * name our own project. Workflow payloads carry it though: the public API loads
+     * the `shared` relation, and `shared[0].projectId` is the owning project.
+     *
+     * Returns null when nothing could be resolved (e.g. no workflows exist yet), in
+     * which case callers should skip folder assignment rather than fail the sync.
+     */
+    resolveFolderProjectId(preferredProjectId?: string): Promise<string | null>;
     /**
      * Fetches all projects from n8n and caches them.
      * Returns a Map of projectId -> IProject for quick lookups.

package/dist/core/services/n8n-api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"n8n-api-client.d.ts","sourceRoot":"","sources":["../../../src/core/services/n8n-api-client.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAwD,iBAAiB,EAAE,cAAc,EAAqB,eAAe,EAAE,MAAM,aAAa,CAAC;AAsB5O,qBAAa,YAAY;IACrB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAAsC;IAC3D,OAAO,CAAC,oBAAoB,CAA+C;IAC3E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAc;IACrE,yFAAyF;IACzF,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,UAAU,CAAc;gBAEpB,WAAW,EAAE,eAAe;IA0BxC,OAAO,CAAC,uBAAuB;IA8BzB,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAUlC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC,cAAc,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAAE,GAAG,IAAI,CAAC;IA4BxG,mBAAmB,IAAI,OAAO,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAkC5D,OAAO,CAAC,iBAAiB;IAqBzB,OAAO,CAAC,yBAAyB;IAiBjC,OAAO,CAAC,gCAAgC;IAKxC,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,8BAA8B;IAItC;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAqCxC;;;;;;;;OAQG;YACW,gBAAgB;YAahB,mBAAmB;IAwC3B,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IA0JzD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAyBxD;;;;;;OAMG;YACW,sBAAsB;IAiC9B,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IA4BrE,OAAO,CAAC,0BAA0B;IAqB5B,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAsB1B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBtC,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUvC,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAS5C,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAY9E,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAqBjF,OAAO,CAAC,0BAA0B;IAqB5B,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU5C,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAexE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKvE,eAAe,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAa1D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAK3D,gBAAgB,CAAC,OAAO,EAAE;QAC5B,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAK9B,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW9C,cAAc,CAAC,OAAO,GAAE;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,eAAe,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,cAAc,CAAC;IA8B1B,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA0B7F,SAAS,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA2CzC,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAapC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,QAAQ,EAAE,SAAS,GAAG,YAAY,GAAG,IAAI;IAkEvD;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,kBAAkB;IAuC1B;;;;;;;OAOG;IACH,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM;IAmB3C;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM;IAkB3C,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA2EzD;;;;;;;;;OASG;IACG,YAAY,CACd,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,OAAO,CAAC,WAAW,CAAC;IAqIvB;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAuDzB,OAAO,CAAC,sBAAsB;IAsC9B,OAAO,CAAC,oBAAoB;IAqE5B,OAAO,CAAC,0BAA0B;IAWlC,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,sBAAsB;CAejC"}
+{"version":3,"file":"n8n-api-client.d.ts","sourceRoot":"","sources":["../../../src/core/services/n8n-api-client.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAwD,iBAAiB,EAAE,cAAc,EAAqB,eAAe,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAIrP;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,GAAG,SAAS,CAEpD;AA4BD,qBAAa,YAAY;IACrB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAAsC;IAC3D,OAAO,CAAC,oBAAoB,CAA+C;IAC3E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAc;IACrE,uFAAuF;IACvF,OAAO,CAAC,sBAAsB,CAAuC;IACrE,yFAAyF;IACzF,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,UAAU,CAAc;gBAEpB,WAAW,EAAE,eAAe;IAsCxC,OAAO,CAAC,uBAAuB;IA8BzB,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAUlC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC,cAAc,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAAE,GAAG,IAAI,CAAC;IA4BxG,mBAAmB,IAAI,OAAO,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAkC5D,OAAO,CAAC,iBAAiB;IAqBzB,OAAO,CAAC,yBAAyB;IAiBjC,OAAO,CAAC,gCAAgC;IAKxC,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,8BAA8B;IAItC;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAqCxC;;;;;;;;;OASG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IA0DvD;;;;;;;OAOG;IACG,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAchH;;;;;;;;;;;OAWG;IACG,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAuBjF;;;;;;;;OAQG;YACW,gBAAgB;YAahB,mBAAmB;IAwC3B,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IA0JzD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAyBxD;;;;;;OAMG;YACW,sBAAsB;IAkD9B,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IA4BrE,OAAO,CAAC,0BAA0B;IAsB5B,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAsB1B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBtC,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUvC,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAS5C,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAY9E,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAqBjF,OAAO,CAAC,0BAA0B;IAyB5B,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU5C,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAexE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKvE,eAAe,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAa1D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAK3D,gBAAgB,CAAC,OAAO,EAAE;QAC5B,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAK9B,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW9C,cAAc,CAAC,OAAO,GAAE;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,eAAe,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,cAAc,CAAC;IA8B1B,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA0B7F,SAAS,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA2CzC,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAapC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,QAAQ,EAAE,SAAS,GAAG,YAAY,GAAG,IAAI;IAkEvD;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,kBAAkB;IAuC1B;;;;;;;OAOG;IACH,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM;IAmB3C;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM;IAkB3C,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA2EzD;;;;;;;;;OASG;IACG,YAAY,CACd,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,OAAO,CAAC,WAAW,CAAC;IAqIvB;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAuDzB,OAAO,CAAC,sBAAsB;IAsC9B,OAAO,CAAC,oBAAoB;IAqE5B,OAAO,CAAC,0BAA0B;IAWlC,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,sBAAsB;CAejC"}

package/dist/core/services/n8n-api-client.js

@@ -2,6 +2,31 @@ import axios from 'axios';
 import * as dns from 'dns';
 import * as http from 'http';
 import * as https from 'https';
+import * as tls from 'tls';
+import { resolveExtraCaCertificates, shouldVerifyServerCertificate } from './tls-certificates.js';
+/**
+ * Builds a combined CA certificate bundle from the trust anchors the user configured
+ * (`NODE_EXTRA_CA_CERTS`, `N8NAC_EXTRA_CA_CERTS`) plus the OS trust store, which is the
+ * programmatic equivalent of the `--use-system-ca` flag.
+ *
+ * Returns undefined when no source provides extra certificates. When it does return a bundle,
+ * the Node.js default Mozilla roots are included, because supplying `ca` replaces them.
+ *
+ * Note that this only covers the axios agent. Anything reaching n8n through the global `fetch`
+ * — the manager-core health probe, project listing and credential calls — ignores `https.Agent`
+ * entirely, which is why {@link installExtraCaCertificates} applies the same anchors
+ * process-wide.
+ */
+export function buildCaBundle() {
+    return resolveAgentTrust().ca;
+}
+function resolveAgentTrust() {
+    const resolution = resolveExtraCaCertificates({ useSystemCertificateAuthorities: true });
+    return {
+        ca: resolution.certificates.length ? [...tls.rootCertificates, ...resolution.certificates] : undefined,
+        hasConfiguredAnchors: resolution.hasConfiguredAnchors,
+    };
+}
 function createIpv4FirstLookup() {
     return ((hostname, options, callback) => {
         const lookupOptions = { ...options, verbatim: false };
@@ -25,6 +50,8 @@ export class N8nApiClient {
     projectsCache = null;
     projectsCachePromise = null;
     static PERSONAL_PROJECT_PLACEHOLDER_ID = 'personal';
+    /** Memoized result of resolveFolderProjectId(); `null` means "resolved to nothing". */
+    folderProjectIdPromise = null;
     /** Shared agents keep DNS/TLS behavior consistent for API, health, and webhook calls. */
     httpAgent;
     httpsAgent;
@@ -34,12 +61,23 @@ export class N8nApiClient {
         if (host.endsWith('/')) {
             host = host.slice(0, -1);
         }
-        // Allow self-signed certificates by default to avoid issues in local environments.
         // Prefer IPv4 when both A and AAAA records exist; remote self-hosted n8n instances
         // often publish IPv6 records that are unreachable from the extension host.
         const lookup = createIpv4FirstLookup();
         this.httpAgent = new http.Agent({ lookup });
-        this.httpsAgent = new https.Agent({ rejectUnauthorized: false, lookup });
+        // Trust whatever the user configured (--use-system-ca / NODE_EXTRA_CA_CERTS) and verify
+        // against it. Verification is only relaxed for a loopback or private-network host that
+        // the user has not configured an anchor for: those cannot hold a publicly trusted
+        // certificate, so a self-signed one there is the normal setup rather than an attack, and
+        // that is the backward compatibility the fallback exists for. A public host name is
+        // always verified — there is no benign reason to skip it, and skipping it is what makes
+        // the connection interceptable. See `shouldVerifyServerCertificate` for the opt-out.
+        const { ca, hasConfiguredAnchors } = resolveAgentTrust();
+        this.httpsAgent = new https.Agent({
+            rejectUnauthorized: shouldVerifyServerCertificate({ host, hasConfiguredAnchors }),
+            ca,
+            lookup,
+        });
         this.client = axios.create({
             baseURL: host,
             headers: {
@@ -251,6 +289,128 @@ export class N8nApiClient {
             return [];
         }
     }
+    /**
+     * Lists every folder in a project, following n8n's skip/take pagination.
+     *
+     * Requires an instance where folders are licensed (`feat:folders`, unlocked by
+     * the free Community registration) and n8n 2.19+; callers are expected to
+     * handle 403/404 by falling back to a flat layout.
+     *
+     * @param projectId Real project id — the endpoint does not accept the
+     * `personal` alias that folder creation does. See resolveFolderProjectId().
+     */
+    async getFolders(projectId) {
+        const folders = [];
+        const seen = new Set();
+        let skip = 0;
+        const take = 100;
+        let useSelect = true;
+        while (true) {
+            const params = {
+                skip: String(skip),
+                take: String(take),
+            };
+            if (useSelect) {
+                // Field names come from n8n's ListFolderQueryDto allow-list
+                // (id, name, createdAt, updatedAt, project, tags, parentFolder,
+                // workflowCount, subFolderCount, path). `parentFolderId` is NOT
+                // a valid select field — asking for it makes n8n reject the whole
+                // query with a 400, which used to send every call through the
+                // no-select fallback below.
+                params.select = JSON.stringify(['id', 'name', 'parentFolder', 'path', 'createdAt', 'updatedAt']);
+            }
+            let res;
+            try {
+                res = await this.client.get(`/api/v1/projects/${encodeURIComponent(projectId)}/folders`, { params });
+            }
+            catch (error) {
+                if (useSelect && error?.response?.status === 400) {
+                    useSelect = false;
+                    continue;
+                }
+                throw error;
+            }
+            const data = Array.isArray(res.data?.data) ? res.data.data : (Array.isArray(res.data) ? res.data : []);
+            const beforeCount = folders.length;
+            for (const folder of data) {
+                if (!folder?.id || seen.has(folder.id))
+                    continue;
+                seen.add(folder.id);
+                folders.push({
+                    id: folder.id,
+                    name: folder.name ?? 'Folder',
+                    parentFolderId: folder.parentFolderId ?? folder.parentFolder?.id ?? null,
+                    path: folder.path,
+                    createdAt: folder.createdAt,
+                    updatedAt: folder.updatedAt,
+                });
+            }
+            const count = typeof res.data?.count === 'number' ? res.data.count : undefined;
+            if (count !== undefined && folders.length >= count)
+                break;
+            if (folders.length === beforeCount)
+                break;
+            if (data.length === 0 || (count === undefined && data.length < take))
+                break;
+            skip += take;
+        }
+        return folders;
+    }
+    /**
+     * Creates a folder in a project.
+     *
+     * @param projectId Project id, or `personal` to target the calling user's own
+     * project (n8n 2.32+).
+     * @param input `parentFolderId` nests the new folder; omit it for a
+     * project-root folder.
+     */
+    async createFolder(projectId, input) {
+        const payload = { name: input.name };
+        if (input.parentFolderId)
+            payload.parentFolderId = input.parentFolderId;
+        const res = await this.client.post(`/api/v1/projects/${encodeURIComponent(projectId)}/folders`, payload);
+        return {
+            id: res.data.id,
+            name: res.data.name,
+            parentFolderId: res.data.parentFolderId ?? res.data.parentFolder?.id ?? null,
+            path: res.data.path,
+            createdAt: res.data.createdAt,
+            updatedAt: res.data.updatedAt,
+        };
+    }
+    /**
+     * Resolves a project id usable with the folder endpoints.
+     *
+     * `GET /api/v1/projects` is gated behind `feat:projectRole:admin` (Business /
+     * Enterprise), and `GET /projects/:id/folders` does not accept the `personal`
+     * alias that `POST` does — so on a Community instance we have no direct way to
+     * name our own project. Workflow payloads carry it though: the public API loads
+     * the `shared` relation, and `shared[0].projectId` is the owning project.
+     *
+     * Returns null when nothing could be resolved (e.g. no workflows exist yet), in
+     * which case callers should skip folder assignment rather than fail the sync.
+     */
+    async resolveFolderProjectId(preferredProjectId) {
+        if (preferredProjectId && !this.isPlaceholderPersonalProjectId(preferredProjectId)) {
+            return preferredProjectId;
+        }
+        this.folderProjectIdPromise ??= (async () => {
+            try {
+                const res = await this.client.get('/api/v1/workflows', { params: { limit: 1 } });
+                const data = res.data?.data ?? (Array.isArray(res.data) ? res.data : []);
+                const workflow = Array.isArray(data) ? data[0] : undefined;
+                const shared = Array.isArray(workflow?.shared) ? workflow.shared[0] : undefined;
+                return shared?.projectId ?? shared?.project?.id ?? null;
+            }
+            catch (error) {
+                if (process.env.DEBUG) {
+                    console.debug(`[N8nApiClient] Could not resolve project id from workflows: ${error?.message || error}`);
+                }
+                return null;
+            }
+        })();
+        return await this.folderProjectIdPromise;
+    }
     /**
      * Fetches all projects from n8n and caches them.
      * Returns a Map of projectId -> IProject for quick lookups.
@@ -510,6 +670,23 @@ export class N8nApiClient {
         if (workflow.isArchived !== undefined) {
             enriched.isArchived = workflow.isArchived;
         }
+        if ('parentFolderId' in workflow) {
+            enriched.parentFolderId = workflow.parentFolderId ?? null;
+        }
+        else if (workflow.parentFolder?.id) {
+            enriched.parentFolderId = workflow.parentFolder.id;
+        }
+        if ('parentFolder' in workflow) {
+            enriched.parentFolder = workflow.parentFolder ?? null;
+        }
+        if (workflow.folderPath && Array.isArray(workflow.folderPath)) {
+            enriched.folderPath = workflow.folderPath;
+            enriched.folderPathString = workflow.folderPath.join('/');
+        }
+        else if (typeof workflow.folderPathString === 'string') {
+            enriched.folderPathString = workflow.folderPathString;
+            enriched.folderPath = workflow.folderPathString.split('/').filter(Boolean);
+        }
         return enriched;
     }
     async createWorkflow(payload) {
@@ -542,6 +719,7 @@ export class N8nApiClient {
             'settings',
             'staticData',
             'projectId',
+            'parentFolderId',
         ]);
         const clean = {};
         for (const [key, value] of Object.entries(payload)) {
@@ -641,6 +819,10 @@ export class N8nApiClient {
             'settings',
             'staticData',
             'pinData',
+            // parentFolderId is forwarded on update so a folderSync push of an
+            // already-tracked workflow moves it to the inferred folder on n8n.
+            // The create path was already wired up; the update path was missing.
+            'parentFolderId',
         ]);
         const clean = {};
         for (const [key, value] of Object.entries(payload)) {