@xyne/workflow-sdk 3.2.36 → 3.2.38

package/dist/runtime/workflow-runtime.js

@@ -11,16 +11,25 @@
  * - Resume paused executions
  * - Process queued jobs (the worker loop body)
  */
+import { executionTopic, workflowTopic } from '../events/types.js';
 import { projectVariables } from '../types/workflow-variable.js';
 import { ConfigValidator } from '../engine/config-validator.js';
 import { validateTriggerPayload } from '../common/validate-payload.js';
 import { AccessDeniedError, ResourceNotFoundError } from '../authz/default.js';
 import { EventTrigger } from '../triggers/event-trigger.js';
 import { WebhookTrigger } from '../triggers/webhook-trigger.js';
+import { ApiTrigger } from '../triggers/api-trigger.js';
+import { CredentialResolver } from '../engine/credential-resolver.js';
+import { headerValue } from '../ingest/headers.js';
+import { parseInboundBody } from '../ingest/body.js';
+import { matchesTriggerFilter } from '../ingest/filter.js';
 import { CronTrigger } from '../triggers/cron-trigger.js';
 import { PauseStep } from '../engine/pause-step.js';
 import { leafStepId } from '../engine/node-path.js';
 // ─── Helpers ───
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
 const noopLogger = {
     info: () => { },
     warn: () => { },
@@ -31,6 +40,13 @@ function generateSecret() {
     crypto.getRandomValues(bytes);
     return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
 }
+/** The trigger's author-supplied input schema, when it has one. */
+function inputSchemaOf(config) {
+    const inputSchema = (config.trigger.config ?? {})['inputSchema'];
+    return inputSchema && typeof inputSchema === 'object' && !Array.isArray(inputSchema)
+        ? inputSchema
+        : undefined;
+}
 function parseWorkflowConfig(raw) {
     return JSON.parse(raw ?? '{}');
 }
@@ -68,12 +84,12 @@ export class WorkflowRuntime {
     queue;
     scheduler;
     services;
-    steps;
-    triggers;
+    connectors;
     executor;
+    credentialResolver;
     log;
     baseUrl;
-    /** Event bus for real-time SSE streaming. Exposed for the router. */
+    /** Pub/sub transport for live execution events. Exposed for the router's SSE stream. */
     eventBus;
     /** Storage adapter for file attachments. Exposed for the router. */
     storage;
@@ -94,9 +110,9 @@ export class WorkflowRuntime {
         this.queue = opts.queue;
         this.scheduler = opts.scheduler;
         this.services = opts.services;
-        this.steps = opts.steps;
-        this.triggers = opts.triggers;
+        this.connectors = opts.connectors;
         this.executor = opts.executor;
+        this.credentialResolver = new CredentialResolver(opts.persistence);
         this.log = opts.logger ?? noopLogger;
         this.eventBus = opts.eventBus;
         this.storage = opts.storage;
@@ -107,6 +123,43 @@ export class WorkflowRuntime {
         this.defaultCronTimezone = config.defaultCronTimezone ?? 'Asia/Kolkata';
         this.aiBuilder = config.aiBuilder;
     }
+    /**
+     * Publish to the bus. Fire-and-forget for the same reason the executor's
+     * `emitEvent` is: the bus may cross a network, and a mutation must not fail
+     * because the thing it was announcing itself to is unreachable. A lost
+     * notification costs a stale view until the next read; a failed write costs
+     * the user their work.
+     */
+    publish(topic, event) {
+        const bus = this.eventBus;
+        if (!bus)
+            return;
+        void bus.publish(topic, event).catch((err) => {
+            this.log.warn(`event bus publish failed (${event.event} on ${topic}): ${String(err)}`);
+        });
+    }
+    publishEvent(executionId, event) {
+        this.publish(executionTopic(executionId), event);
+    }
+    /**
+     * Announce that a workflow definition changed.
+     *
+     * Emitted from the runtime rather than the router on purpose: every writer goes
+     * through here — the builder, an agent's tool call, a host calling the runtime
+     * directly — so no caller can change a workflow without saying so. Put this in
+     * the HTTP layer instead and the first non-HTTP writer silently stops notifying.
+     */
+    publishWorkflowChange(workflowId, change, origin) {
+        this.publish(workflowTopic(workflowId), {
+            event: 'workflow_changed',
+            data: {
+                workflowId,
+                change,
+                ...(origin === undefined ? {} : { origin }),
+                at: new Date().toISOString(),
+            },
+        });
+    }
     // ─── Authorization primitives ───
     //
     // Every caller-facing operation goes through exactly one of these. There is no
@@ -209,21 +262,27 @@ export class WorkflowRuntime {
      * can render inline in the workflow builder.
      */
     validateConfig(config) {
-        const validator = new ConfigValidator(this.triggers, this.steps);
+        const validator = new ConfigValidator(this.connectors);
         return validator.validate(config);
     }
     // ─── Workflow Lifecycle ───
     /**
      * Activate a workflow's trigger.
      *
-     * - WebhookTrigger: generates a unique path, stores it, calls onActivate()
+     * - Every trigger: its credential slots must resolve to accepted credentials
      * - CronTrigger: registers with the scheduler
-     * - EventTrigger / ManualTrigger: no activation needed (status change only)
+     *
+     * Only then is the workflow marked ACTIVE. Webhook ingest and event dispatch
+     * both key off that status, so it is what actually turns a workflow on.
      */
-    async activateWorkflow(ctx, workflowId) {
+    async activateWorkflow(ctx, workflowId, opts) {
         // Guard up front, before any external side-effects (webhook/scheduler).
         const { record } = await this.authorizedWorkflow(ctx, workflowId, 'workflow:activate');
-        return this.activateInternal(record);
+        await this.activateInternal(record);
+        await this.persistence.updateWorkflow(workflowId, { status: 'ACTIVE' });
+        // After the side-effects, never before: an activation that failed is not a
+        // change worth telling anyone about.
+        this.publishWorkflowChange(workflowId, 'activated', opts?.origin);
     }
     /**
      * The activation work, already authorized. Used by the guarded
@@ -233,20 +292,16 @@ export class WorkflowRuntime {
     async activateInternal(workflow) {
         const workflowId = workflow.id;
         const config = parseWorkflowConfig(workflow.config);
-        if (!this.triggers.has(config.trigger.type)) {
+        if (!this.connectors.hasTrigger(config.trigger.type)) {
             throw new Error(`Trigger type "${config.trigger.type}" is not registered`);
         }
-        const trigger = this.triggers.get(config.trigger.type);
+        const trigger = this.connectors.getTrigger(config.trigger.type);
+        // A missing, revoked or wrong-type credential fails here, naming the slot,
+        // rather than on the first event.
+        if (trigger.credentialSlots?.length) {
+            await this.credentialResolver.resolve(workflow.attributes, trigger, config.trigger.config);
+        }
         if (trigger instanceof WebhookTrigger) {
-            const secret = generateSecret();
-            const path = `/webhooks/${workflowId}/${secret}`;
-            await this.persistence.storeWebhookPath(workflowId, path, secret);
-            if (trigger.onActivate) {
-                await trigger.onActivate(config.trigger.config, {
-                    webhookUrl: this.baseUrl + path,
-                    credentials: {},
-                });
-            }
             this.log.info(`activated webhook trigger for workflow ${workflowId}`);
         }
         else if (trigger instanceof CronTrigger) {
@@ -259,30 +314,27 @@ export class WorkflowRuntime {
     /**
      * Deactivate a workflow's trigger.
      */
-    async deactivateWorkflow(ctx, workflowId) {
+    async deactivateWorkflow(ctx, workflowId, opts) {
         const workflow = await this.persistence.getWorkflow(workflowId);
         if (!workflow) {
             throw new Error(`Workflow ${workflowId} not found`);
         }
         await this.require(ctx, 'workflow:activate', this.workflowRef(workflow));
         const config = parseWorkflowConfig(workflow.config);
-        if (!this.triggers.has(config.trigger.type))
-            return;
-        const trigger = this.triggers.get(config.trigger.type);
-        if (trigger instanceof WebhookTrigger) {
-            if (trigger.onDeactivate) {
-                await trigger.onDeactivate(config.trigger.config, {
-                    webhookUrl: '',
-                    credentials: {},
-                });
-            }
-            await this.persistence.removeWebhookPath(workflowId);
-            this.log.info(`deactivated webhook trigger for workflow ${workflowId}`);
-        }
-        else if (trigger instanceof CronTrigger) {
+        // Falls through rather than returning early on an unregistered trigger type:
+        // the call still succeeded, and every successful call must leave by the same
+        // door so that none of them can quietly skip the notification below.
+        const trigger = this.connectors.hasTrigger(config.trigger.type)
+            ? this.connectors.getTrigger(config.trigger.type)
+            : null;
+        if (trigger instanceof CronTrigger) {
             await this.scheduler.unschedule(workflowId);
             this.log.info(`deactivated cron trigger for workflow ${workflowId}`);
         }
+        // Webhook, event and manual triggers need no teardown: webhook ingest and
+        // event dispatch only reach ACTIVE workflows, so the status below stops them.
+        await this.persistence.updateWorkflow(workflowId, { status: 'DISABLED' });
+        this.publishWorkflowChange(workflowId, 'deactivated', opts?.origin);
     }
     // ─── Workflow callback secret ───
     /**
@@ -333,9 +385,9 @@ export class WorkflowRuntime {
         const executionIds = [];
         for (const workflow of workflows) {
             const config = parseWorkflowConfig(workflow.config);
-            if (!this.triggers.has(config.trigger.type))
+            if (!this.connectors.hasTrigger(config.trigger.type))
                 continue;
-            const trigger = this.triggers.get(config.trigger.type);
+            const trigger = this.connectors.getTrigger(config.trigger.type);
             if (!(trigger instanceof EventTrigger))
                 continue;
             // Hydrate lightweight payload → full context
@@ -353,6 +405,10 @@ export class WorkflowRuntime {
             if (!trigger.matchFilters(config.trigger.config, payload)) {
                 continue;
             }
+            // And the author's filter, before a run exists.
+            if (!matchesTriggerFilter(config.trigger.filter, payload, config.variables)) {
+                continue;
+            }
             const execId = await this.createAndEnqueue(workflow, {
                 type: event.type,
                 ...payload,
@@ -362,43 +418,80 @@ export class WorkflowRuntime {
         return executionIds;
     }
     /**
-     * Handle an incoming webhook request.
+     * Ingest a request to a workflow's webhook URL, `<baseUrl>/webhooks/<workflowId>`.
+     *
+     * The order is fixed, and the trigger's own code runs only after the sender is
+     * authenticated:
+     *
+     * 1. The workflow exists, is ACTIVE and uses a webhook trigger — else 404, the
+     *    same answer for each so workflow ids cannot be probed.
+     * 2. The trigger's credentials resolve — else 401, before any connector code runs.
+     * 3. The trigger's own `verify` accepts the request — else 401.
+     * 4. The body is parsed from the raw bytes — else 400.
+     * 5. The trigger turns the request into events and a reply.
+     * 6. Each event must pass the workflow's trigger filter, or it is dropped.
+     * 7. Survivors are enqueued before the reply is returned.
      *
-     * Looks up the workflow by webhook path, delegates to the trigger's
-     * `handleRequest()`, and enqueues an execution.
+     * Reasons for a rejection go to the log; responses stay generic.
      */
-    async handleWebhook(path, request) {
-        const webhookRecord = await this.persistence.getWebhookByPath(path);
-        if (!webhookRecord) {
-            return {
-                executionId: '',
-                httpResponse: { status: 404, body: { error: 'Webhook not found' } },
-            };
+    async handleWebhook(workflowId, request) {
+        const notFound = {
+            reply: { status: 404, body: { error: 'Webhook not found' } },
+            executionIds: [],
+        };
+        const unauthorized = {
+            reply: { status: 401, body: { error: 'Unauthorized' } },
+            executionIds: [],
+        };
+        const workflow = await this.persistence.getWorkflow(workflowId);
+        if (!workflow || workflow.status !== 'ACTIVE')
+            return notFound;
+        const config = parseWorkflowConfig(workflow.config);
+        const trigger = this.connectors.findTrigger(config.trigger.type)?.trigger;
+        if (!(trigger instanceof WebhookTrigger))
+            return notFound;
+        const attributes = workflow.attributes;
+        const triggerConfig = config.trigger.config;
+        let ctx;
+        try {
+            const credentials = await this.credentialResolver.resolve(attributes, trigger, triggerConfig);
+            ctx = { credentials, attributes, baseUrl: this.baseUrl };
         }
-        const workflow = await this.persistence.getWorkflow(webhookRecord.workflowId);
-        if (!workflow || workflow.status !== 'ACTIVE') {
-            return {
-                executionId: '',
-                httpResponse: { status: 404, body: { error: 'Workflow not active' } },
-            };
+        catch (err) {
+            // Fail closed: verification never runs without the credentials it needs.
+            this.log.warn(`webhook ${workflowId}: rejected, ${messageOf(err)}`);
+            return unauthorized;
         }
-        const config = parseWorkflowConfig(workflow.config);
-        const trigger = this.triggers.get(config.trigger.type);
-        if (!(trigger instanceof WebhookTrigger)) {
-            return {
-                executionId: '',
-                httpResponse: {
-                    status: 400,
-                    body: { error: 'Workflow does not use a webhook trigger' },
-                },
-            };
+        let verified = false;
+        try {
+            verified = await trigger.verify(request, triggerConfig, ctx);
         }
-        const { triggerData, httpResponse } = await trigger.handleRequest(request, config.trigger.config);
-        const execId = await this.createAndEnqueue(workflow, {
-            type: config.trigger.type,
-            ...triggerData,
-        }, { publicTrigger: true });
-        return { executionId: execId, httpResponse };
+        catch (err) {
+            this.log.warn(`webhook ${workflowId}: verification threw: ${messageOf(err)}`);
+        }
+        if (!verified) {
+            this.log.warn(`webhook ${workflowId}: rejected by ${trigger.type} verification`);
+            return unauthorized;
+        }
+        let body;
+        try {
+            body = parseInboundBody(request.rawBody, headerValue(request.headers, 'content-type'));
+        }
+        catch (err) {
+            this.log.warn(`webhook ${workflowId}: rejected, ${messageOf(err)}`);
+            return { reply: { status: 400, body: { error: 'Malformed request body' } }, executionIds: [] };
+        }
+        const translation = await trigger.handleRequest({ ...request, body }, triggerConfig, ctx);
+        const executionIds = [];
+        for (const event of translation.events) {
+            if (!matchesTriggerFilter(config.trigger.filter, event.payload, config.variables))
+                continue;
+            executionIds.push(await this.createAndEnqueue(workflow, { type: event.type, ...event.payload }, { publicTrigger: true }));
+        }
+        return {
+            reply: translation.reply ?? { status: 200, body: { ok: true } },
+            executionIds,
+        };
     }
     /**
      * Handle an incoming wait-callback at `POST /wait/callback/<secret>/<executionId>`.
@@ -478,91 +571,67 @@ export class WorkflowRuntime {
         return this.createAndEnqueue(workflow, triggerPayload);
     }
     /**
-     * Fire a workflow through the unauthenticated Webhook V2 API.
+     * Start a workflow from the API trigger route.
+     *
+     * No caller reaches the SDK here: the route has no session, and the SDK does
+     * not authorize whoever calls it. A host that exposes the route guards it
+     * itself, for example with an API key. The workflow must use an API trigger,
+     * and the payload must satisfy its input schema.
      *
-     * This intentionally bypasses caller authorization because the host exposes
-     * the route publicly. The workflow itself must opt in by using WEBHOOK_V2,
-     * and the execution is marked as public so privileged steps can enforce their
-     * own public-trigger restrictions.
+     * Runs are marked as public triggers, so privileged steps refuse them.
      */
-    async triggerWebhookV2Public(workflowId, payload) {
-        const workflow = await this.persistence.getWorkflow(workflowId);
-        if (!workflow) {
-            throw new Error(`Workflow ${workflowId} not found`);
-        }
-        const config = parseWorkflowConfig(workflow.config);
-        if (config.trigger.type !== 'WEBHOOK_V2') {
-            throw new Error(`Workflow ${workflowId} does not use a WEBHOOK_V2 trigger`);
-        }
-        const triggerCfg = (config.trigger.config ?? {});
-        const inputSchema = triggerCfg['inputSchema'];
-        const webhookV2InputSchema = inputSchema && Array.isArray(inputSchema['required'])
+    async triggerViaApi(workflowId, payload) {
+        const { workflow, config } = await this.apiTriggerWorkflow(workflowId);
+        const inputSchema = inputSchemaOf(config);
+        // Uploaded documents are optional on this route even when the schema lists
+        // them as required.
+        const apiInputSchema = inputSchema && Array.isArray(inputSchema['required'])
             ? {
                 ...inputSchema,
                 required: inputSchema['required'].filter((field) => field !== 'documents'),
             }
             : inputSchema;
-        const errors = validateTriggerPayload(webhookV2InputSchema, payload);
+        const errors = validateTriggerPayload(apiInputSchema, payload);
         if (errors.length > 0) {
             throw new Error(`Invalid trigger payload: ${errors.map((e) => e.message).join('; ')}`);
         }
-        return this.createAndEnqueue(workflow, {
-            type: config.trigger.type,
-            ...payload,
-        }, { publicTrigger: true });
+        return this.createAndEnqueue(workflow, { type: config.trigger.type, ...payload }, { publicTrigger: true });
     }
     /**
-     * Return the configured trigger input schema for routes that need to translate
-     * transport-level payloads before calling `triggerManual()`.
+     * What the API trigger route needs before it builds a payload: the trigger's
+     * input schema, and the workflow's scope for storing uploaded files. Checked
+     * the same way as {@link triggerViaApi}.
      */
-    async getWorkflowTriggerInputSchema(ctx, workflowId) {
-        const workflow = await this.persistence.getWorkflow(workflowId);
-        if (!workflow) {
-            throw new Error(`Workflow ${workflowId} not found`);
-        }
-        await this.require(ctx, 'workflow:run', this.workflowRef(workflow));
-        const config = parseWorkflowConfig(workflow.config);
-        const triggerCfg = (config.trigger.config ?? {});
-        const inputSchema = triggerCfg['inputSchema'];
-        return inputSchema && typeof inputSchema === 'object' && !Array.isArray(inputSchema)
-            ? inputSchema
-            : undefined;
+    async getApiTriggerTarget(workflowId) {
+        const { workflow, config } = await this.apiTriggerWorkflow(workflowId);
+        return {
+            inputSchema: inputSchemaOf(config),
+            storageScope: workflow.attributes,
+        };
     }
-    /**
-     * Return trigger input schema for public transport routes.
-     *
-     * Unlike getWorkflowTriggerInputSchema(), this does not authorize a caller;
-     * it only verifies the workflow exists and opted into the expected public
-     * trigger type.
-     */
-    async getWorkflowTriggerInputSchemaPublic(workflowId, expectedTriggerType) {
+    /** The workflow exists and uses an API trigger. */
+    async apiTriggerWorkflow(workflowId) {
         const workflow = await this.persistence.getWorkflow(workflowId);
-        if (!workflow) {
-            throw new Error(`Workflow ${workflowId} not found`);
-        }
+        if (!workflow)
+            throw new ResourceNotFoundError('Workflow', workflowId);
         const config = parseWorkflowConfig(workflow.config);
-        if (config.trigger.type !== expectedTriggerType) {
-            throw new Error(`Workflow ${workflowId} does not use a ${expectedTriggerType} trigger`);
+        const trigger = this.connectors.findTrigger(config.trigger.type)?.trigger;
+        if (!(trigger instanceof ApiTrigger)) {
+            throw new Error(`Workflow ${workflowId} does not use an API trigger`);
         }
-        const triggerCfg = (config.trigger.config ?? {});
-        const inputSchema = triggerCfg['inputSchema'];
-        return inputSchema && typeof inputSchema === 'object' && !Array.isArray(inputSchema)
-            ? inputSchema
-            : undefined;
+        return { workflow, config };
     }
     /**
-     * Return the workflow-owned storage scope for public transport routes.
+     * Return the configured trigger input schema for routes that need to translate
+     * transport-level payloads before calling `triggerManual()`.
      */
-    async getWorkflowStorageScopePublic(workflowId, expectedTriggerType) {
+    async getWorkflowTriggerInputSchema(ctx, workflowId) {
         const workflow = await this.persistence.getWorkflow(workflowId);
         if (!workflow) {
             throw new Error(`Workflow ${workflowId} not found`);
         }
-        const config = parseWorkflowConfig(workflow.config);
-        if (config.trigger.type !== expectedTriggerType) {
-            throw new Error(`Workflow ${workflowId} does not use a ${expectedTriggerType} trigger`);
-        }
-        return workflow.attributes;
+        await this.require(ctx, 'workflow:run', this.workflowRef(workflow));
+        return inputSchemaOf(parseWorkflowConfig(workflow.config));
     }
     /**
      * Resume a paused execution. Guards `execution:approve`, then does the work.
@@ -591,7 +660,7 @@ export class WorkflowRuntime {
         const isAbort = input?.abort === true || input?.data?.action === 'abort';
         if (isAbort) {
             await this.persistence.updateExecutionStatus(executionId, 'CANCELLED');
-            this.eventBus?.emit(executionId, { event: 'execution_cancelled', data: {} });
+            this.publishEvent(executionId, { event: 'execution_cancelled', data: {} });
             this.log.info(`execution ${executionId} aborted by user`);
             return;
         }
@@ -696,7 +765,7 @@ export class WorkflowRuntime {
      * Validates the config, persists it, and optionally activates the trigger.
      * Returns the created WorkflowRecord.
      */
-    async createWorkflow(ctx, input) {
+    async createWorkflow(ctx, input, opts) {
         // Create is an action on the *container*: the folder is the thing that
         // exists, so this same decision is what the UI projects onto its "New
         // workflow" button. Also proves the folder exists — no separate lookup.
@@ -720,11 +789,17 @@ export class WorkflowRuntime {
                 // Internal post-create activation — already authorized by the create above.
                 await this.activateInternal(record);
             }
-            catch {
-                // Non-fatal — workflow is created but trigger may need manual activation
+            catch (err) {
+                // Non-fatal — the workflow is created, and its trigger can be activated
+                // once whatever failed is fixed.
+                this.log.warn(`created workflow ${id} but could not activate its trigger: ${messageOf(err)}`);
             }
         }
         this.log.info(`created workflow ${id} (${input.name})`);
+        // One event, not also an `activated` one from the self-activation above: a
+        // subscriber re-reads and sees the settled state either way, and two frames
+        // for one call would just cost it a second read.
+        this.publishWorkflowChange(id, 'created', opts?.origin);
         return record;
     }
     /**
@@ -733,7 +808,7 @@ export class WorkflowRuntime {
      * Accepts partial updates: config, metadata, or both.
      * If config changes, validates it and updates the trigger type.
      */
-    async updateWorkflow(ctx, workflowId, input) {
+    async updateWorkflow(ctx, workflowId, input, opts) {
         const { record: existing } = await this.authorizedWorkflow(ctx, workflowId, 'workflow:update');
         const update = {};
         if (input.summary !== undefined)
@@ -767,6 +842,7 @@ export class WorkflowRuntime {
         if (!updated)
             throw new Error('Failed to read updated workflow');
         this.log.info(`updated workflow ${workflowId}`);
+        this.publishWorkflowChange(workflowId, 'updated', opts?.origin);
         return updated;
     }
     // ─── Folders ───
@@ -814,13 +890,13 @@ export class WorkflowRuntime {
         return created;
     }
     /** Reorganize folders and workflows in one batch (drag-and-drop). */
-    async moveBatch(ctx, input) {
+    async moveBatch(ctx, input, opts) {
         // Each item is authorized individually by the op it delegates to, which
         // guards both ends of the move: `*:update` on the thing moved and
         // `*:create` on the destination container.
         await Promise.all([
             ...input.folders.map((f) => this.updateFolder(ctx, f.id, { parentId: f.parentId })),
-            ...input.workflows.map((w) => this.updateWorkflow(ctx, w.id, { folderId: w.folderId })),
+            ...input.workflows.map((w) => this.updateWorkflow(ctx, w.id, { folderId: w.folderId }, opts)),
         ]);
     }
     async updateFolder(ctx, id, input) {
@@ -1036,7 +1112,7 @@ export class WorkflowRuntime {
             throw new Error(`Execution ${executionId} is already terminal (status: ${exec.status})`);
         }
         await this.persistence.updateExecutionStatus(executionId, 'CANCELLED');
-        this.eventBus?.emit(executionId, { event: 'execution_cancelled', data: {} });
+        this.publishEvent(executionId, { event: 'execution_cancelled', data: {} });
         this.log.info(`execution ${executionId} cancelled`);
     }
     /** List the credentials visible to `ctx` as safe, paginated summaries. */
@@ -1157,9 +1233,9 @@ export class WorkflowRuntime {
         if (!workflow || workflow.status !== 'ACTIVE')
             return null;
         const config = parseWorkflowConfig(workflow.config);
-        if (!this.triggers.has(config.trigger.type))
+        if (!this.connectors.hasTrigger(config.trigger.type))
             return null;
-        const trigger = this.triggers.get(config.trigger.type);
+        const trigger = this.connectors.getTrigger(config.trigger.type);
         if (!(trigger instanceof CronTrigger))
             return null;
         const metadata = JSON.parse(workflow.metadata ?? '{}');