Fix webhook reliability and prepare a validated npm release

[georgeatparallel]

This package lets n8n workflows call Parallel for search, chat, research Tasks, and web monitoring. Its two webhook triggers start workflows when Parallel reports a Task result or a Monitor event. This PR fixes how those triggers handle callbacks, puts a real limit on waiting for Task results, and makes the package's release checks consistent.

Callbacks get a clear response

The triggers were marked as AI tools, which failed metadata validation. They also used noWebhookResponse to skip unwanted events without actually sending a response. In n8n, that flag means the node has already handled the HTTP response, so the sender could be left waiting.

The triggers now send HTTP 200 for filtered events without starting a workflow. Missing required event fields get 400, and invalid signatures get 401. Signature verification accepts both Standard and legacy signing formats while still checking the exact request bytes and timestamp. The regular action node remains available as an AI tool.

Fetching details for a callback now has a five-second HTTP timeout. If a Task result fetch fails, the trigger returns 503 so the sender can retry, with no workflow output. Monitor workflows keep the published behavior of emitting event_group_error by default; retrying with 503 is opt-in. Monitor output keeps event_group_id even when fetching is disabled or fails. Both triggers also expose webhook_id so workflows can recognize repeat deliveries.

Waiting for Tasks has a real budget

The old polling loop checked its deadline between failed requests, but did not cap each HTTP request or sleep to the time left. The new result-wait budget covers both, defaults to 75 minutes, and is configurable from 1 to 120 minutes. n8n's own execution limit can still end the wait sooner.

If retrieval fails or times out, the error includes the existing run ID and explains how to retrieve it later. Timing out does not cancel the remote Task or create another one.

Saved workflows and release checks

Saved Search workflows that omit a mode now default to Basic, preserving the old Base tier. Explicit Base and Pro values keep their mappings. Saved Monitor lookback options now fail with migration instructions instead of silently ignoring the requested history window. The upgrade guide also explains the current signature-secret requirement and Monitor response format changes. Node, credential, and operation identifiers stay unchanged.

CI and release now share formatting, lint, type, test, production-audit, and package checks. The package check installs a temporary tarball and loads every declared node and credential. The release command checks the version tag, event commit, and main ancestry. A dry-run rehearsal executes validation and publish hooks without writing to npm.

Validation and remaining release gates

Both CI jobs passed, and all 21 tests passed locally on Node 22.22 and 24. The release rehearsal passed; deliberately breaking a credential export correctly failed the package check. Review also exercised signed callbacks, saved defaults, bounded polling, recovery, and invalid release contexts. Existing n8n 2.36.8 runtime checks covered package discovery, saved triggers, live API operations, and signed HTTP requests. The actual Parallel callback test used signature validation disabled; signature verification was tested separately.

Publishing still needs Eng approval, the remaining dependency updates and final-main audit, and npm owner confirmation of trusted publishing. Development-tool advisories remain documented. The rehearsal does not prove publishing authority, and no npm version has been published.