n8n nodes for TrueForth

This package connects n8n to the governed TrueForth developer API. It does not
connect directly to the TrueForth database, reuse a client login, or expose Xero
credentials. TrueForth remains the tenant, consent, audit, evidence, confidence
and approval control plane.

Capabilities

• List and inspect tenant-scoped evidence metadata.
• Upload binary evidence with an idempotency key into the immutable evidence vault.
• Start the bounded finance pilot and inspect its status.
• Receive HMAC-SHA256 signed finance/evidence events with replay-window checks.

The finance pilot may read and propose. It cannot approve allocations, post
ledger entries, pay, file, sign, or release a professional report.

Controlled installation sequence

1. A TrueForth administrator registers the n8n application and its purpose.
2. The client reviews and approves the exact scopes and expiry in Connections.
3. An administrator issues the credential once. Store it only in n8n Credentials.
4. Add a TrueForth Trigger to a workflow and activate it to obtain its HTTPS URL.
5. Register that URL and explicit event types in TrueForth Admin. Copy the
   one-time webhook secret into the same n8n credential.
6. Test with a synthetic tenant before granting access to a real client.

Recommended scopes are evidence.read, evidence.write, finance.read, and
workflow.execute. Remove any scope that a workflow does not need.

Development

Node.js 22.22.0 or later is required.

pnpm install --frozen-lockfile
pnpm build
pnpm lint
pnpm test
pnpm verify-package

After an exact version is published, run n8n's official
@n8n/scan-community-package against that registry version. The official
scanner downloads from npm and therefore cannot validate an unpublished tree.

Do not publish this package or connect it to production until the isolated
developer-platform acceptance run has passed.

Controlled publication

.github/workflows/publish-n8n.yml is the only approved publication route. It
rebuilds, lints, tests and packs the exact repository version on a GitHub-hosted
runner. The default stage mode sends the package to npm's staged-publishing
queue for a human 2FA approval. After the package exists, configure npm trusted
publishing for repository ivynedenis/TrueForthApp and workflow
publish-n8n.yml; later releases can use short-lived OIDC credentials and
no reusable write token. npm provenance is intentionally disabled while the
source repository is private because npm accepts GitHub provenance only from
public repositories. Enable provenance if the repository is made public.

The one-time first release uses the narrowly scoped NPM_BOOTSTRAP_TOKEN.
Later staged releases may use NPM_TOKEN until trusted publishing is configured.
Remove both reusable tokens after trusted publishing is configured. Every
successful public release executes n8n's official registry scanner against the
exact released version.