feat: switch to n8n-node lint (full ESLint community-nodes rules) (#147)

* fix: guard against a missing dependencies field in npm registry response

data.dependencies was typed as always present, but if the registry
response ever omitted it, accessing ["n8n-workflow"] would throw a raw
TypeError instead of the descriptive error this code is meant to give.

* feat: switch to n8n-node lint (full ESLint community-nodes rules)

oxlint + eslint-plugin-n8n-nodes-base only checked a narrow subset of
n8n's community-node rules and missed real issues: no dependencies
field validation, no auth-pattern checks, weaker type-safety
enforcement. Switch to n8n-node lint (matching n8n-nodes-actual),
which runs the official @n8n/eslint-plugin-community-nodes rules
alongside TypeScript ESLint and eslint-plugin-import-x.

Uses configWithoutCloudSupport (n8n.strict: false) rather than the
strict-mode default, since the cloud-only restricted-imports/globals
rules fire broadly on tests/ and scripts/ tooling that never ships to
n8n Cloud - same choice n8n-nodes-actual already made.

Fixes surfaced by the switch:
- package.json declared "dependencies" (eventsource, form-data), which
  community nodes must not do (they'd get bundled into the host n8n
  instance). Both are genuinely needed at runtime, so vendor them via
  an esbuild post-build step (scripts/bundle-vendor-deps.mjs) that
  inlines just those two packages into the two compiled files that use
  them, leaving n8n-workflow and local imports as normal requires.
  Verified the resulting dist/ has zero remaining requires for either
  package, and validated end-to-end via the full docker-compose
  pipeline (real n8n + PocketBase, including the expired-token
  isolated-process test) with the bundled build.
- 3 no-http-request-with-manual-auth findings in LoadOptions.ts are
  suppressed, not reverted: this project deliberately moved off
  httpRequestWithAuthentication (commit 8003c58) because n8n doesn't
  reliably invoke a credential's authenticate hook on scheduled
  executions, and the credential type no longer even declares one.
- RequestBodyFunctions.ts now throws NodeOperationError instead of a
  plain Error when rethrowing a JSON parse failure.
- PocketbaseTrigger.node.ts gained a subtitle and properly typed its
  EventSource handlers instead of using `any`.
- Reordered PocketbaseHttp's operation options alphabetically
  (cosmetic only - default is set explicitly, unaffected by order).
- Replaced no-explicit-any across test files with real types (or a
  justified inline suppression for the one test that deliberately
  feeds malformed input to check a runtime guard).
- no-console is scoped off for scripts/ (CLI tooling) and the one
  integration spec that intentionally logs live e2e diagnostics.

* test: assert NodeOperationError type, not just message, for invalid JSON body

The message-only assertion would still pass if the parse-failure path
regressed to throwing a plain Error again.

* fix: use NodeOperationError consistently across all three parseBodyJson throw sites

Only the JSON.parse catch-block rethrow was upgraded; the two
validation throws still used a plain Error despite node being
available as a parameter now, giving inconsistent error surfacing
for what are all "invalid body JSON" failures in the same helper.

Author: TheFehr

.oxlintrc.json

@@ -0,0 +1,20 @@
+import { configWithoutCloudSupport } from '@n8n/node-cli/eslint';
+
+export default [
+  ...configWithoutCloudSupport,
+  {
+    // scripts/ holds standalone CLI tooling (run via tsx, not bundled into the
+    // node), where console output is the point rather than something to avoid.
+    files: ['scripts/**/*.ts'],
+    rules: {
+      'no-console': 'off',
+    },
+  },
+  {
+    // Diagnostic output for a real e2e run against a live PocketBase instance.
+    files: ['tests/PocketbaseTriggerIntegration.spec.ts'],
+    rules: {
+      'no-console': 'off',
+    },
+  },
+];

eslint.config.mjs

@@ -102,7 +102,7 @@ export async function pagination(
   requestOptions: DeclarativeRestApiSettings.ResultOptions,
 ): Promise<INodeExecutionData[]> {
   const allIsActive = this.getNodeParameter("parameters.allElements", false) as boolean;
-  let executions: INodeExecutionData[] = [];
+  const executions: INodeExecutionData[] = [];
   let page: number = this.getNodeParameter("parameters.page", 1) as number;
   let totalPages: number = allIsActive ? Infinity : page;
 

nodes/Common/GenericFunctions.ts

@@ -38,6 +38,7 @@ async function loadPocketBaseFields(
     credentials.username as string,
     credentials.password as string,
   );
+  // eslint-disable-next-line @n8n/community-nodes/no-http-request-with-manual-auth -- httpRequestWithAuthentication relies on the credential's `authenticate` property, which this project deliberately removed (see commit 8003c58): n8n doesn't reliably invoke it during scheduled executions, causing 403s once the stored JWT expired. fetchPocketbaseToken replaces it with a reliable, cache-aware token fetch.
   const { fields } = (await this.helpers.httpRequest({
     url: `${normalizedUrl}/api/collections/${resource}`,
     method: "GET",
@@ -85,6 +86,7 @@ export const LoadOptions = {
     let totalPages: number = 0;
 
     do {
+      // eslint-disable-next-line @n8n/community-nodes/no-http-request-with-manual-auth -- see comment in loadPocketBaseFields above
       const { items: pageItems, totalPages: pageTotalPages } = (await this.helpers.httpRequest({
         url: `${normalizedUrl}/api/collections`,
         method: "GET",
@@ -159,6 +161,7 @@ export const LoadOptions = {
     const maxPages = 5; // Load up to 5 pages for the dropdown
 
     do {
+      // eslint-disable-next-line @n8n/community-nodes/no-http-request-with-manual-auth -- see comment in loadPocketBaseFields above
       const { items: pageItems, totalPages: pageTotalPages } = (await this.helpers.httpRequest({
         url: `${normalizedUrl}/api/collections/${resource}/records`,
         method: "GET",
@@ -174,7 +177,7 @@ export const LoadOptions = {
     if (items.length === 0) {
       return [
         {
-          name: "No records found",
+          name: 'No Records Found',
           value: "",
         },
       ];

nodes/Common/LoadOptions.ts

@@ -1,10 +1,12 @@
-// eslint-disable-next-line @n8n/community-nodes/no-restricted-imports
+ 
 import FormData from "form-data";
 import {
   AssignmentCollectionValue,
   IDataObject,
   IExecuteSingleFunctions,
   IHttpRequestOptions,
+  INode,
+  NodeOperationError,
 } from "n8n-workflow";
 
 export async function prepareRequestBody(
@@ -37,7 +39,7 @@ export async function prepareRequestBody(
 
     if (bodyType.includes("bodyJson")) {
       const bodyJson = this.getNodeParameter("bodyJson", "{}") as string | Record<string, unknown>;
-      const parsedBody = parseBodyJson(bodyJson);
+      const parsedBody = parseBodyJson(bodyJson, this.getNode());
       const filteredParsedBody: IDataObject = {};
       Object.entries(parsedBody).forEach(([key, value]) => {
         if (
@@ -80,7 +82,7 @@ export async function prepareRequestBody(
 
   if (bodyType.includes("bodyJson")) {
     const bodyJson = this.getNodeParameter("bodyJson", "{}") as string | Record<string, unknown>;
-    const parsedBody = parseBodyJson(bodyJson);
+    const parsedBody = parseBodyJson(bodyJson, this.getNode());
     Object.entries(parsedBody).forEach(([key, value]) => {
       if (
         key &&
@@ -144,12 +146,15 @@ async function handleBinaryData(this: IExecuteSingleFunctions, formData: FormDat
   });
 }
 
-function parseBodyJson(bodyJson: string | Record<string, unknown>): Record<string, unknown> {
+function parseBodyJson(
+  bodyJson: string | Record<string, unknown>,
+  node: INode,
+): Record<string, unknown> {
   if (
     typeof bodyJson !== "string" &&
     (typeof bodyJson !== "object" || bodyJson === null || Array.isArray(bodyJson))
   ) {
-    throw new Error("JSON Body must be a JSON object or string");
+    throw new NodeOperationError(node, "JSON Body must be a JSON object or string");
   }
 
   let parsed: unknown;
@@ -158,14 +163,14 @@ function parseBodyJson(bodyJson: string | Record<string, unknown>): Record<strin
       parsed = JSON.parse(bodyJson);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      throw new Error(`Invalid JSON in Body: ${message}`);
+      throw new NodeOperationError(node, `Invalid JSON in Body: ${message}`);
     }
   } else {
     parsed = bodyJson;
   }
 
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new Error("JSON Body must be a JSON object");
+    throw new NodeOperationError(node, "JSON Body must be a JSON object");
   }
 
   return parsed as Record<string, unknown>;

nodes/Common/RequestBodyFunctions.ts

@@ -56,6 +56,20 @@ export class PocketbaseHttp implements INodeType {
         name: "operation",
         type: "options",
         options: [
+          {
+            name: "Create",
+            value: "create",
+            action: "Create an element in your collection",
+            routing: {
+              request: {
+                method: "POST",
+                url: `=/api/collections/{{$parameter["resource"]}}/records`,
+              },
+              send: {
+                preSend: [authenticatePreSend, recordCreatePreSendAction],
+              },
+            },
+          },
           {
             name: "List/Search",
             value: "search",
@@ -76,44 +90,30 @@ export class PocketbaseHttp implements INodeType {
             },
           },
           {
-            name: "View",
-            value: "view",
-            action: "View an element in your collection",
+            name: "Update",
+            value: "update",
+            action: "Update an element in your collection",
             routing: {
               request: {
-                method: "GET",
+                method: "PATCH",
                 url: `=/api/collections/{{$parameter["resource"]}}/records/{{$parameter["elementId"]}}`,
               },
               send: {
-                preSend: [authenticatePreSend, recordViewPreSendAction],
-              },
-            },
-          },
-          {
-            name: "Create",
-            value: "create",
-            action: "Create an element in your collection",
-            routing: {
-              request: {
-                method: "POST",
-                url: `=/api/collections/{{$parameter["resource"]}}/records`,
-              },
-              send: {
-                preSend: [authenticatePreSend, recordCreatePreSendAction],
+                preSend: [authenticatePreSend, recordUpdatePreSendAction],
               },
             },
           },
           {
-            name: "Update",
-            value: "update",
-            action: "Update an element in your collection",
+            name: "View",
+            value: "view",
+            action: "View an element in your collection",
             routing: {
               request: {
-                method: "PATCH",
+                method: "GET",
                 url: `=/api/collections/{{$parameter["resource"]}}/records/{{$parameter["elementId"]}}`,
               },
               send: {
-                preSend: [authenticatePreSend, recordUpdatePreSendAction],
+                preSend: [authenticatePreSend, recordViewPreSendAction],
               },
             },
           },

nodes/PocketbaseHttp/PocketbaseHttp.node.ts

@@ -3,9 +3,10 @@ import {
   ITriggerResponse,
   INodeType,
   INodeTypeDescription,
+  IDataObject,
   NodeConnectionTypes,
 } from "n8n-workflow";
-import { EventSource } from "eventsource";
+import { EventSource, ErrorEvent as EventSourceErrorEvent } from "eventsource";
 import { LoadOptions } from "../Common/LoadOptions";
 
 export class PocketbaseTrigger implements INodeType {
@@ -16,6 +17,7 @@ export class PocketbaseTrigger implements INodeType {
     group: ["trigger"],
     version: 1,
     description: "Handle Pocketbase events via SSE (Beta)",
+    subtitle: '={{$parameter["collection"]}}',
     defaults: {
       name: "Pocketbase Trigger",
     },
@@ -29,15 +31,15 @@ export class PocketbaseTrigger implements INodeType {
     ],
     properties: [
       {
-        displayName: "Collection Name",
+        displayName: 'Collection Name or ID',
         name: "collection",
         type: "options",
         typeOptions: {
           loadOptionsMethod: "getCollections",
         },
         default: "",
         required: true,
-        description: "The name of the collection to watch for changes",
+        description: 'The name of the collection to watch for changes. Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>.',
       },
       {
         displayName: "Events",
@@ -62,6 +64,7 @@ export class PocketbaseTrigger implements INodeType {
         description: "The events to trigger the node",
       },
     ],
+		usableAsTool: true,
   };
 
   methods = {
@@ -108,7 +111,7 @@ function subscribeToPocketbaseSSE(
   const MAX_RECONNECT_ATTEMPTS = 50;
   let consecutiveFailures = 0;
 
-  const onConnect = async (e: any) => {
+  const onConnect = async (e: MessageEvent) => {
     try {
       const data = JSON.parse(e.data as string);
       const clientId = data.clientId;
@@ -143,7 +146,7 @@ function subscribeToPocketbaseSSE(
     }
   };
 
-  const onError = (error: any) => {
+  const onError = (error: EventSourceErrorEvent) => {
     if (stabilityTimer) {
       clearTimeout(stabilityTimer);
       stabilityTimer = null;
@@ -153,12 +156,17 @@ function subscribeToPocketbaseSSE(
       baseUrl,
     });
 
-    const normalizedError = new Error(
-      (error && error.message) || "PocketBase SSE connection failure",
-    );
-    if (error && error.code) (normalizedError as any).code = error.code;
-    if (error && error.status) (normalizedError as any).status = error.status;
-    (normalizedError as any).originalErrorEvent = error;
+    const normalizedError = new Error(error.message || "PocketBase SSE connection failure") as Error & {
+      code?: number;
+      status?: number;
+      originalErrorEvent?: EventSourceErrorEvent;
+    };
+    // `status` isn't part of eventsource's declared ErrorEvent shape, but the
+    // library has been observed attaching it on some HTTP error responses.
+    const status = (error as unknown as { status?: number }).status;
+    if (error.code) normalizedError.code = error.code;
+    if (status) normalizedError.status = status;
+    normalizedError.originalErrorEvent = error;
 
     // Only emit error on the first failure. Subsequent reconnect attempts will not flood the error stream.
     if (consecutiveFailures === 0) {
@@ -168,17 +176,17 @@ function subscribeToPocketbaseSSE(
     reconnect();
   };
 
-  const onMessage = (e: any) => {
+  const onMessage = (e: MessageEvent) => {
     try {
       const data = JSON.parse(e.data as string);
       if (events.includes(data.action) && data.record) {
-        const output = {
+        const output: IDataObject & { __original_action?: unknown; __action?: unknown } = {
           ...data.record,
         };
         if ("action" in output) {
-          (output as any).__original_action = output.action;
+          output.__original_action = output.action;
         }
-        (output as any).__action = data.action;
+        output.__action = data.action;
 
         this.emit([this.helpers.returnJsonArray(output)]);
       }