n8n-nodes-code-pro

Code Pro — self-hosted n8n community node for JavaScript with stock Code–compatible modes/helpers and a large built-in library surface (no NODE_FUNCTION_ALLOW_EXTERNAL / task-runner allowlists).

| | | |---|---| | Package | n8n-nodes-code-pro | | Node | Code Pro (codePro) | | Version | 0.4.0 | | Language | JavaScript only | | Inject globals | 70+ names (aliases included; see list below) | | npm packages | 60+ runtime libraries + first-party utils |

Globals are available by name in your script (e.g. _.map(...), dayjs(), z.object(...)).
Runtime inventory:

| Helper | Meaning | |---|---| | utils.getRegisteredLibraries() | Every inject name declared in the package | | utils.getAvailableLibraries() | Registered libs minus known load failures (lazy libs count until they fail) | | utils.getFailedLibraries() | Injects that failed to load (package/binary/platform) | | utils.isLibraryAvailable('Jimp') | Boolean check for one name | | utils.sitemap.* | Discover / parse / expand website sitemaps (see below) | | utils.mapPool(items, n, fn) | Bounded-concurrency async map (order-preserving) |

Heavy libraries (image, video, blockchain, spreadsheets, …) load on first use.

Supported libraries

Inject name = global in the Code Pro sandbox. Aliases share the same package.

Data manipulation & IDs

| Global(s) | npm package | What it’s for | |---|---|---| | _, lodash | lodash | Arrays/objects, grouping, deep get/set, chaining | | bytes | bytes | Human-readable byte sizes ↔ numbers | | ms | ms | Duration strings ("5m") ↔ milliseconds | | qs | qs | Query-string parse/stringify | | uuid | uuid | UUID v1/v4/v5 (e.g. uuid.v4()) | | nanoid | nanoid | Compact unique IDs (nanoid() / nanoid.nanoid()) | | utils | (built-in) | sleep, retry, mapPool, sitemap, flatten, getAvailableLibraries, … |

Dates & time

| Global(s) | npm package | What it’s for | |---|---|---| | dayjs | dayjs | Lightweight date parse/format/math | | moment | moment-timezone | Dates with timezone support | | dateFns | date-fns | Functional date helpers | | dateFnsTz | date-fns-tz | Timezone-aware date-fns | | luxon, DateTime | luxon | n8n-aligned DateTime API | | cronParser | cron-parser | Cron expression next/prev runs |

Validation & schemas

| Global(s) | npm package | What it’s for | |---|---|---| | joi, Joi | joi | Schema validation (object/string/number rules) | | yup | yup | Schema validation (chainable) | | z, zod | zod | TypeScript-first schema validation | | Ajv | ajv | JSON Schema validation | | validator | validator | String checks (email, URL, etc.) | | phoneNumber | libphonenumber-js | Parse/validate/format phone numbers | | iban | iban | IBAN validation |

Parse / serialize (CSV, XML, YAML, config)

| Global(s) | npm package | What it’s for | |---|---|---| | papaparse, Papa | papaparse | CSV parse/unparse | | xml2js | xml2js | XML ↔ JS objects | | XMLParser, XMLBuilder | fast-xml-parser | Fast XML parse/build | | YAML | yaml | YAML parse/stringify | | ini | ini | INI config files | | toml | toml | TOML config files | | jmespath | jmespath | Query nested JSON (a.b[0].c) | | jsonDiff | json-diff-ts | Structural JSON diffs |

HTML, text, templates, fuzzy match

| Global(s) | npm package | What it’s for | |---|---|---| | cheerio | cheerio | jQuery-like HTML parsing/scraping | | htmlToText | html-to-text | HTML → plain text | | marked | marked | Markdown → HTML | | Handlebars | handlebars | HTML/string templating | | slug | slug | URL-safe slugs | | pluralize | pluralize | English plural/singular | | fuzzy | fuse.js | Fuzzy search over lists | | stringSimilarity | string-similarity | Compare string similarity | | franc | franc-min | Language detection | | compromise | compromise | Lightweight NLP on text |

Crypto, JWT, passwords

| Global(s) | npm package | What it’s for | |---|---|---| | CryptoJS | crypto-js | Hashing/encryption (MD5, AES, …) | | nodeCrypto | crypto (Node) | Native Node crypto | | forge | node-forge | TLS/PKI-oriented crypto primitives | | jwt | jsonwebtoken | Sign/verify JWTs | | bcrypt, bcryptjs | bcryptjs | Password hashing | | secp256k1 | @noble/secp256k1 | secp256k1 keys/signatures | | bip39 | @scure/bip39 | BIP-39 mnemonics |

HTTP & networking

| Global(s) | npm package | What it’s for | |---|---|---| | axios | axios | HTTP client (GET/POST, JSON, …) | | FormData | form-data | Multipart form bodies | | pRetry | p-retry | Retry async operations | | utils.sitemap | (built-in) | Sitemap find / parse / expand (uses axios) |

Spreadsheets, archives, QR

| Global(s) | npm package | What it’s for | |---|---|---| | XLSX, xlsx | xlsx | Read/write Excel workbooks (SheetJS community) | | ExcelJS | exceljs | Richer Excel read/write | | JSZip | jszip | Create/read ZIP archives | | pako | pako | Deflate/inflate compression | | QRCode | qrcode | Generate QR codes |

Image manipulation & metadata

| Global(s) | npm package | What it’s for | |---|---|---| | Jimp, jimp | jimp | Resize, crop, rotate, composite, encode/decode images (pure JS) | | imageSize | image-size | Fast width/height/type from buffer or file path | | exifr | exifr | EXIF / image metadata parse | | JPEG | jpeg-js | Low-level JPEG encode/decode | | PNG | pngjs | Low-level PNG encode/decode/sync API |

Video / media processing

| Global(s) | npm package | What it’s for | |---|---|---| | ffmpeg | fluent-ffmpeg | Programmatic FFmpeg pipelines (transcode, screenshots, filters). Auto-wires ffmpeg-static / ffprobe-static paths when present. | | ffmpegStatic | ffmpeg-static | Path to bundled ffmpeg binary | | ffprobeStatic | ffprobe-static | Path to bundled ffprobe binary (metadata / duration) |

Blockchain / trading (heavy; load when used)

| Global(s) | npm package | What it’s for | |---|---|---| | web3 | web3 | Ethereum / EVM interactions | | ccxt | ccxt | Crypto exchange APIs | | coinGecko | coingecko-api-v3 | CoinGecko market data client | | solana | @solana/web3.js | Solana web3 | | bitcoin | bitcoinjs-lib | Bitcoin transactions/scripts | | ytdl | @distube/ytdl-core | YouTube stream/info helpers |

Full inject name list

_, lodash, bytes, ms, qs, uuid, nanoid, utils, dayjs, moment, dateFns, dateFnsTz, luxon, DateTime, cronParser, joi, Joi, yup, z, zod, Ajv, validator, phoneNumber, iban, papaparse, Papa, xml2js, XMLParser, XMLBuilder, YAML, ini, toml, jmespath, jsonDiff, cheerio, htmlToText, marked, Handlebars, slug, pluralize, fuzzy, stringSimilarity, franc, compromise, CryptoJS, nodeCrypto, forge, jwt, bcrypt, bcryptjs, secp256k1, bip39, axios, FormData, pRetry, XLSX, xlsx, ExcelJS, JSZip, pako, QRCode, Jimp, jimp, imageSize, exifr, JPEG, PNG, ffmpeg, ffmpegStatic, ffprobeStatic, web3, ccxt, coinGecko, solana, bitcoin, ytdl

Install (self-hosted)

This package is large (many automation libraries + optional ffmpeg binaries). Prefer a machine with enough disk/RAM. Persist ~/.n8n (Docker: /home/node/.n8n). In queue mode, install on every worker.

Video tools use ffmpeg-static / ffprobe-static when the binary exists for your OS/arch; otherwise install system ffmpeg and set paths in code via ffmpeg.setFfmpegPath(...).

Community Nodes UI (after publish)

1. Settings → Community Nodes → Install
2. Package: n8n-nodes-code-pro
3. Restart n8n if needed

Local / custom extensions

cd n8n-nodes-code-pro
npm install
npm run build

# Windows PowerShell example
$env:N8N_CUSTOM_EXTENSIONS = "C:\path\to\n8n-nodes-code-pro"

Restart n8n. Palette: Code Pro.

Usage (parameters)

| Parameter | Description | |---|---| | Mode | Run Once for All Items / Run Once for Each Item | | JavaScript | Your script (jsCode); libraries are globals | | Options → Timeout | Soft timeout seconds (default 60). Does not hard-kill async HTTP/ffmpeg | | Options → Max Output Items | Fail if more items returned (default 10 000); not bypassed by continueOnFail |

Return shape: all-items → [{ json: { ... } }, ...]; each-item → single { json: { ... } }. Prefer pairedItem when counts differ.

Sitemap workflows (utils.sitemap)

First-party helpers for sitemap-heavy jobs: discover XML via robots.txt + common paths, parse urlsets/indexes, optionally expand nested indexes to page URLs. Uses the same axios inject (browser-like headers, gzip .xml.gz, parallel probes, attempt diagnostics).

| Method | What it does | |---|---| | utils.sitemap.find(website, opts?) | Discover + fetch primary sitemap XML | | utils.sitemap.parse(rawXml) | Parse urlset / sitemapindex (no network) | | utils.sitemap.expand(urlOrXml, opts?) | Walk indexes → page URLs (caps: maxDepth, maxSitemaps, maxUrls) | | utils.sitemap.fromWebsite(website, opts?) | find + optional expand: true | | utils.sitemap.fromWebsites(list, opts?) | Batch sites (websiteConcurrency) |

Defaults that matter: expand is opt-in (expand: true). Expanded urls are strings unless includeMetadata: true. rawXml is dropped when expanding (set includeRawXml: true to keep it). Caps default to maxDepth: 3, maxSitemaps: 50, maxUrls: 10000.

A) One item per site (discovery)

// Mode: Run Once for All Items — raise Timeout for many sites
const sites = $input.all().map((i) => i.json.website || i.json.Website);
const results = await utils.sitemap.fromWebsites(sites, {
  expand: false,
  websiteConcurrency: 3,
  concurrency: 4,
  timeoutMs: 8000,
});
return results.map((r, index) => ({
  json: {
    website: r.website,
    found: r.found,
    sourceUrl: r.sourceUrl,
    kind: r.kind,
    robotsSitemaps: r.robotsSitemaps,
    hasXml: !!r.rawXml,
    // attempts[] explains found:false (not_xml, http_403, timeout, …)
    attempts: r.attempts,
  },
  pairedItem: { item: index },
}));

B) One item per page URL (expand, cap-aware)

const website = $json.website || $json.Website;
const r = await utils.sitemap.fromWebsite(website, {
  expand: true,
  maxUrls: 5000,
  maxDepth: 3,
  concurrency: 4,
});
if (!r.found) {
  return [{ json: { website, found: false, attempts: r.attempts } }];
}
// Watch Options → Max Output Items when fan-out is large
return r.urls.map((loc) => ({
  json: { loc, website, sourceUrl: r.sourceUrl, truncated: r.truncated },
}));

Tips

• Prefer All Items for multi-site batches.
• Raise Timeout (e.g. 90–120s) for large expand / many hosts. Soft timeout does not hard-cancel in-flight axios.
• Large expands can hit Max Output Items — lower maxUrls or batch.
• Example workflow: examples/code-pro-sitemap.json
• Offline tests: npm run test:sitemap
• Design notes (repo, not on npm): docs/SITEMAP.md

Optional workflow imports: examples/code-pro-basic.json, examples/code-pro-validate-zod.json.

Security

Code Pro runs in the n8n process (not the stock Code task-runner sandbox), with network-capable libraries available. Treat it as a trusted power-user node on self-hosted instances only.

Develop

npm install
npm run build
npm run lint
npm run smoke:libs
npm run test:libs
npm run test:golden
npm run dev

Live n8n acceptance (required before claiming the node works in production): see scripts/live-n8n-checklist.md. Use utils.getCodeProVersion() inside the node to confirm the loaded build.

License

MIT