@xyne/workflow-sdk 3.2.37 → 3.2.38

package/dist/connectors/core/credentials.d.ts

@@ -0,0 +1,104 @@
+/**
+ * What a connector declares about its credentials, and what a component accepts.
+ *
+ * ─── Type and shape are different things ───
+ *
+ * A credential has a TYPE and a SHAPE.
+ *
+ * - The type, `credType`, is the connector's own enum value — `SLACK_BOT_TOKEN`,
+ *   `GITHUB_WEBHOOK_SECRET`. It says who owns the credential and what it is for,
+ *   and it is what compatibility is checked on: a Slack step lists only Slack
+ *   credentials, even though a Jira token has the same shape.
+ * - The shape, `authType`, is one of the framework's small fixed set
+ *   ({@link CredentialAuthType}). It decides how values are stored, which form
+ *   the vault renders, and how the value is applied to an outbound request.
+ *
+ * A definition binds one type to one shape, and a stored credential carries both.
+ *
+ * ─── Definitions are referenced, not retyped ───
+ *
+ * Components refer to the DEFINITION OBJECT rather than repeating the type as
+ * text, so a typo is a compile error rather than a boot error:
+ *
+ *     export const SLACK_BOT_TOKEN = defineCredential({
+ *       connectorId: 'slack', credType: 'SLACK_BOT_TOKEN',
+ *       label: 'Bot token', authType: CredentialAuthType.Bearer,
+ *     });
+ *
+ *     override readonly credential = [SLACK_BOT_TOKEN];   // not ['SLACK_BOT_TOKEN']
+ */
+import type { CredentialAuthType } from '../../common/credentials.js';
+import type { AnyStep } from './base-connector.js';
+/**
+ * The format a `credType` must follow: SCREAMING_SNAKE_CASE, the way the
+ * framework's other enums read. Checked by the registry at boot.
+ */
+export declare const CREDENTIAL_TYPE_PATTERN: RegExp;
+/**
+ * One credential type a connector offers. Build with {@link defineCredential}.
+ *
+ * Generic over the OWNING CONNECTOR'S ID so the owner survives in the type:
+ * a definition owned by `acme` and one owned by `other` are different types,
+ * which is what lets {@link declareSteps} reject a step reaching for another
+ * connector's credential without running anything.
+ */
+export interface CredentialDefinition<TConnector extends string = string> {
+    /** The connector's enum value, e.g. `'SLACK_BOT_TOKEN'`. Globally unique. */
+    readonly credType: string;
+    /** The connector that owns it, for the registry's ownership check. */
+    readonly connectorId: TConnector;
+    /** Human label for the vault, e.g. `"Bot token"`. */
+    readonly label: string;
+    /** Where to find or how to choose the value. Shown when creating one. */
+    readonly description?: string;
+    /** The stored shape. Drives the vault's form and outbound application. */
+    readonly authType: CredentialAuthType;
+}
+/** Declare a credential type. Frozen, so every component holds the same object. */
+export declare function defineCredential<TConnector extends string>(input: {
+    connectorId: TConnector;
+    credType: string;
+    label: string;
+    description?: string;
+    authType: CredentialAuthType;
+}): CredentialDefinition<TConnector>;
+/**
+ * The credential types a component accepts — the definitions themselves.
+ *
+ * Empty means "authenticates nothing", which is most components. This says
+ * WHICH types are acceptable, not WHETHER one is needed: that stays with
+ * `credentialSlots`, because HTTP_REQUEST accepts several types while needing
+ * none.
+ */
+export type CredentialRequirement = readonly CredentialDefinition[];
+/** A component that authenticates nothing — a CODE step, a LOOP step. */
+export declare const NO_CREDENTIAL: CredentialRequirement;
+/** Can a stored credential of this type satisfy the requirement? */
+export declare function acceptsCredential(requirement: CredentialRequirement, credType: string): boolean;
+/**
+ * A step, narrowed to the credential types one connector offers.
+ *
+ * `AnyStep` erases each step's credential types, which is what lets a registry
+ * hold steps from every connector in one map — and also what stops the compiler
+ * from noticing a step reaching for a credential its connector never declared.
+ * This type puts that information back for the one moment it matters: when a
+ * connector lists the steps it owns.
+ */
+export type StepAccepting<TCredential extends CredentialDefinition> = Omit<AnyStep, 'credential'> & {
+    readonly credential?: readonly TCredential[];
+};
+/**
+ * Declare a connector's steps, checked against its credentials AT COMPILE TIME.
+ *
+ *     override readonly credentials = BUILTIN_CREDENTIALS;
+ *     override readonly steps = declareSteps(BUILTIN_CREDENTIALS, [
+ *       new HttpRequestStep(),   // accepts builtin types — fine
+ *       new ForeignStep(),       // accepts another connector's type — red squiggle
+ *     ]);
+ *
+ * The registry makes the same check at boot, because a step whose `credential`
+ * is typed as the wide `CredentialDefinition[]` has no literal types left to
+ * compare.
+ */
+export declare function declareSteps<TCredential extends CredentialDefinition>(_credentials: readonly TCredential[], steps: readonly StepAccepting<TCredential>[]): readonly AnyStep[];
+//# sourceMappingURL=credentials.d.ts.map

package/dist/connectors/core/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/connectors/core/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,QAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB,CAAC,UAAU,SAAS,MAAM,GAAG,MAAM;IACtE,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC;IACjC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,UAAU,SAAS,MAAM,EAAE,KAAK,EAAE;IACjE,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,kBAAkB,CAAC;CAC9B,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAQnC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,oBAAoB,EAAE,CAAC;AAEpE,yEAAyE;AACzE,eAAO,MAAM,aAAa,EAAE,qBAA0B,CAAC;AAEvD,oEAAoE;AACpE,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,qBAAqB,EAClC,QAAQ,EAAE,MAAM,GACf,OAAO,CAET;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,CAAC,WAAW,SAAS,oBAAoB,IAChE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CAC9C,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,WAAW,SAAS,oBAAoB,EACnE,YAAY,EAAE,SAAS,WAAW,EAAE,EACpC,KAAK,EAAE,SAAS,aAAa,CAAC,WAAW,CAAC,EAAE,GAC3C,SAAS,OAAO,EAAE,CAEpB"}

package/dist/connectors/core/credentials.js

@@ -0,0 +1,67 @@
+/**
+ * What a connector declares about its credentials, and what a component accepts.
+ *
+ * ─── Type and shape are different things ───
+ *
+ * A credential has a TYPE and a SHAPE.
+ *
+ * - The type, `credType`, is the connector's own enum value — `SLACK_BOT_TOKEN`,
+ *   `GITHUB_WEBHOOK_SECRET`. It says who owns the credential and what it is for,
+ *   and it is what compatibility is checked on: a Slack step lists only Slack
+ *   credentials, even though a Jira token has the same shape.
+ * - The shape, `authType`, is one of the framework's small fixed set
+ *   ({@link CredentialAuthType}). It decides how values are stored, which form
+ *   the vault renders, and how the value is applied to an outbound request.
+ *
+ * A definition binds one type to one shape, and a stored credential carries both.
+ *
+ * ─── Definitions are referenced, not retyped ───
+ *
+ * Components refer to the DEFINITION OBJECT rather than repeating the type as
+ * text, so a typo is a compile error rather than a boot error:
+ *
+ *     export const SLACK_BOT_TOKEN = defineCredential({
+ *       connectorId: 'slack', credType: 'SLACK_BOT_TOKEN',
+ *       label: 'Bot token', authType: CredentialAuthType.Bearer,
+ *     });
+ *
+ *     override readonly credential = [SLACK_BOT_TOKEN];   // not ['SLACK_BOT_TOKEN']
+ */
+/**
+ * The format a `credType` must follow: SCREAMING_SNAKE_CASE, the way the
+ * framework's other enums read. Checked by the registry at boot.
+ */
+export const CREDENTIAL_TYPE_PATTERN = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*$/;
+/** Declare a credential type. Frozen, so every component holds the same object. */
+export function defineCredential(input) {
+    return Object.freeze({
+        credType: input.credType,
+        connectorId: input.connectorId,
+        label: input.label,
+        ...(input.description !== undefined ? { description: input.description } : {}),
+        authType: input.authType,
+    });
+}
+/** A component that authenticates nothing — a CODE step, a LOOP step. */
+export const NO_CREDENTIAL = [];
+/** Can a stored credential of this type satisfy the requirement? */
+export function acceptsCredential(requirement, credType) {
+    return requirement.some((definition) => definition.credType === credType);
+}
+/**
+ * Declare a connector's steps, checked against its credentials AT COMPILE TIME.
+ *
+ *     override readonly credentials = BUILTIN_CREDENTIALS;
+ *     override readonly steps = declareSteps(BUILTIN_CREDENTIALS, [
+ *       new HttpRequestStep(),   // accepts builtin types — fine
+ *       new ForeignStep(),       // accepts another connector's type — red squiggle
+ *     ]);
+ *
+ * The registry makes the same check at boot, because a step whose `credential`
+ * is typed as the wide `CredentialDefinition[]` has no literal types left to
+ * compare.
+ */
+export function declareSteps(_credentials, steps) {
+    return steps;
+}
+//# sourceMappingURL=credentials.js.map

package/dist/connectors/core/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/connectors/core/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAuBzE,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAA4B,KAM3D;IACC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;AACL,CAAC;AAYD,yEAAyE;AACzE,MAAM,CAAC,MAAM,aAAa,GAA0B,EAAE,CAAC;AAEvD,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAC/B,WAAkC,EAClC,QAAgB;IAEhB,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAC1B,YAAoC,EACpC,KAA4C;IAE5C,OAAO,KAA2B,CAAC;AACrC,CAAC"}

package/dist/connectors/core/index.d.ts

@@ -0,0 +1,7 @@
+export { BaseConnector } from './base-connector.js';
+export type { AnyStep, AnyTrigger } from './base-connector.js';
+export { ConnectorRegistry, ConnectorRegistrationError, UnknownComponentError, } from './connector-registry.js';
+export type { RegisteredStep, RegisteredTrigger, RegisteredCredential, } from './connector-registry.js';
+export { defineCredential, acceptsCredential, declareSteps, NO_CREDENTIAL, CREDENTIAL_TYPE_PATTERN, } from './credentials.js';
+export type { CredentialDefinition, CredentialRequirement } from './credentials.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/connectors/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/connectors/core/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/connectors/core/index.js

@@ -0,0 +1,5 @@
+// The connector contract: what a connector is, and the registry that holds them.
+export { BaseConnector } from './base-connector.js';
+export { ConnectorRegistry, ConnectorRegistrationError, UnknownComponentError, } from './connector-registry.js';
+export { defineCredential, acceptsCredential, declareSteps, NO_CREDENTIAL, CREDENTIAL_TYPE_PATTERN, } from './credentials.js';
+//# sourceMappingURL=index.js.map

package/dist/connectors/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connectors/core/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,uBAAuB,GACxB,MAAM,kBAAkB,CAAC"}

package/dist/engine/available-context.d.ts

@@ -6,8 +6,7 @@
  * The frontend's variable picker uses this to show what refs are available at each step.
  */
 import type { WorkflowConfig } from '../types/workflow-config.js';
-import type { StepRegistry } from '../steps/step-registry.js';
-import type { TriggerRegistry } from '../triggers/trigger-registry.js';
+import type { ConnectorRegistry } from '../connectors/core/connector-registry.js';
 import { zodToJsonSchemaRecord } from '../util/schema-convert.js';
 /**
  * Resolve a step's or trigger's output to a JSON Schema — the single source of
@@ -21,7 +20,7 @@ export interface OutputSchemaProvider {
     resolveOutputJsonSchema?: (config: Record<string, unknown>) => Record<string, unknown>;
     outputSchema: Parameters<typeof zodToJsonSchemaRecord>[0];
 }
-export declare function resolveOutputJsonSchemaOf(impl: OutputSchemaProvider, config: Record<string, unknown>, steps?: StepRegistry): Record<string, unknown>;
+export declare function resolveOutputJsonSchemaOf(impl: OutputSchemaProvider, config: Record<string, unknown>, connectors?: ConnectorRegistry): Record<string, unknown>;
 export interface AvailableContext {
     /**
      * Map of context path → JSON Schema.
@@ -39,5 +38,5 @@ export interface AvailableContext {
  * preceding step outputs. Returns `null` if `atStepId` is not found
  * anywhere in the step tree.
  */
-export declare function getAvailableContext(config: WorkflowConfig, atStepId: string, steps: StepRegistry, triggers: TriggerRegistry): AvailableContext | null;
+export declare function getAvailableContext(config: WorkflowConfig, atStepId: string, connectors: ConnectorRegistry): AvailableContext | null;
 //# sourceMappingURL=available-context.d.ts.map

package/dist/engine/available-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"available-context.d.ts","sourceRoot":"","sources":["../../src/engine/available-context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGlE;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,uBAAuB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvF,YAAY,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;CAC3D;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,CAAC,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0CzB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,eAAe,GACxB,gBAAgB,GAAG,IAAI,CAuBzB"}
+{"version":3,"file":"available-context.d.ts","sourceRoot":"","sources":["../../src/engine/available-context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAElF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGlE;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,uBAAuB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvF,YAAY,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;CAC3D;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,UAAU,CAAC,EAAE,iBAAiB,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0CzB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,iBAAiB,GAC5B,gBAAgB,GAAG,IAAI,CA0BzB"}

package/dist/engine/available-context.js

@@ -5,10 +5,11 @@
  * JSON Schema objects keyed by dotted path (e.g. "trigger", "steps.fetch_data.output").
  * The frontend's variable picker uses this to show what refs are available at each step.
  */
+import { TRIGGER_FILTER_SCOPE } from '../types/workflow-config.js';
 import { BaseControlFlowStep } from '../steps/base-step.js';
 import { zodToJsonSchemaRecord } from '../util/schema-convert.js';
 import { varsJsonSchema } from '../types/workflow-variable.js';
-export function resolveOutputJsonSchemaOf(impl, config, steps) {
+export function resolveOutputJsonSchemaOf(impl, config, connectors) {
     const base = impl.resolveOutputJsonSchema
         ? impl.resolveOutputJsonSchema(config)
         : zodToJsonSchemaRecord(impl.outputSchema);
@@ -18,17 +19,17 @@ export function resolveOutputJsonSchemaOf(impl, config, steps) {
     // step (present and future) gets result-referencing for free. Needs the
     // registry to resolve each inner step's output schema, and recurses so nested
     // control flow types all the way down. Without `steps` it degrades to `base`.
-    if (steps && impl instanceof BaseControlFlowStep && impl.getBranches) {
+    if (connectors && impl instanceof BaseControlFlowStep && impl.getBranches) {
         const branchProps = {};
         for (const [key, branchSteps] of Object.entries(impl.getBranches(config))) {
             const stepProps = {};
             for (const s of branchSteps) {
-                if (!steps.has(s.type))
+                if (!connectors.hasStep(s.type))
                     continue;
                 stepProps[s.id] = {
                     type: 'object',
                     properties: {
-                        output: resolveOutputJsonSchemaOf(steps.get(s.type), s.config, steps),
+                        output: resolveOutputJsonSchemaOf(connectors.getStep(s.type), s.config, connectors),
                     },
                 };
             }
@@ -53,14 +54,14 @@ export function resolveOutputJsonSchemaOf(impl, config, steps) {
  * preceding step outputs. Returns `null` if `atStepId` is not found
  * anywhere in the step tree.
  */
-export function getAvailableContext(config, atStepId, steps, triggers) {
+export function getAvailableContext(config, atStepId, connectors) {
     const ctx = {};
     // Add trigger output if registered. Use the trigger's per-instance
     // `resolveOutputJsonSchema(config)` when available (lets webhook /
     // manual triggers type headers/body/query from author-supplied schemas);
     // otherwise fall back to the static outputSchema.
-    if (config.trigger && triggers.has(config.trigger.type)) {
-        const triggerImpl = triggers.get(config.trigger.type);
+    if (config.trigger && connectors.hasTrigger(config.trigger.type)) {
+        const triggerImpl = connectors.getTrigger(config.trigger.type);
         ctx['trigger'] = resolveOutputJsonSchemaOf(triggerImpl, (config.trigger.config ?? {}));
     }
     // Author-time workflow variables, referenceable anywhere as {{vars.<key>}}.
@@ -68,23 +69,26 @@ export function getAvailableContext(config, atStepId, steps, triggers) {
     if (config.variables?.some((v) => v.key.trim().length > 0)) {
         ctx['vars'] = varsJsonSchema(config.variables);
     }
-    const found = walkForContext(config.steps, atStepId, ctx, steps);
+    // A trigger filter runs before any step exists, so it sees only the above.
+    if (atStepId === TRIGGER_FILTER_SCOPE)
+        return ctx;
+    const found = walkForContext(config.steps, atStepId, ctx, connectors);
     return found ? ctx : null;
 }
 /**
  * Walk steps in order. Returns true if `targetId` was found (meaning ctx is populated).
  * Stops as soon as the target is found — no further steps are added.
  */
-function walkForContext(stepList, targetId, ctx, steps) {
+function walkForContext(stepList, targetId, ctx, connectors) {
     for (const step of stepList) {
         // If this is the target step, stop — don't include its own output
         if (step.id === targetId) {
             return true;
         }
         // Register this step's output schema if registered
-        if (steps.has(step.type)) {
-            const impl = steps.get(step.type);
-            ctx[`steps.${step.id}.output`] = resolveOutputJsonSchemaOf(impl, step.config, steps);
+        if (connectors.hasStep(step.type)) {
+            const impl = connectors.getStep(step.type);
+            ctx[`steps.${step.id}.output`] = resolveOutputJsonSchemaOf(impl, step.config, connectors);
             // Recurse into control-flow branches
             if (impl instanceof BaseControlFlowStep && impl.getBranches) {
                 const branches = impl.getBranches(step.config);
@@ -92,7 +96,7 @@ function walkForContext(stepList, targetId, ctx, steps) {
                     // Branch gets a snapshot of current context — steps inside a branch
                     // shouldn't leak to sibling branches
                     const branchCtx = { ...ctx };
-                    if (walkForContext(branchSteps, targetId, branchCtx, steps)) {
+                    if (walkForContext(branchSteps, targetId, branchCtx, connectors)) {
                         // Found inside this branch — copy back accumulated context
                         Object.assign(ctx, branchCtx);
                         return true;

package/dist/engine/available-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"available-context.js","sourceRoot":"","sources":["../../src/engine/available-context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAe/D,MAAM,UAAU,yBAAyB,CACvC,IAA0B,EAC1B,MAA+B,EAC/B,KAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB;QACvC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;QACtC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE7C,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrE,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACjC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG;oBAChB,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,yBAAyB,CAC/B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EACjB,CAAC,CAAC,MAAiC,EACnC,KAAK,CACN;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,GAAG;gBACjB,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE;aACjE,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAI,IAAI,CAAC,YAAY,CAAyC,IAAI,EAAE,CAAC;QACpF,OAAO;YACL,GAAG,IAAI;YACP,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE;SACpF,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAsB,EACtB,QAAgB,EAChB,KAAmB,EACnB,QAAyB;IAEzB,MAAM,GAAG,GAAqB,EAAE,CAAC;IAEjC,mEAAmE;IACnE,mEAAmE;IACnE,yEAAyE;IACzE,kDAAkD;IAClD,IAAI,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,GAAG,CAAC,SAAS,CAAC,GAAG,yBAAyB,CACxC,WAAW,EACX,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAA4B,CACzD,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,QAA8B,EAC9B,QAAgB,EAChB,GAAqB,EACrB,KAAmB;IAEnB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,kEAAkE;QAClE,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mDAAmD;QACnD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,GAAG,CAAC,SAAS,IAAI,CAAC,EAAE,SAAS,CAAC,GAAG,yBAAyB,CACxD,IAAI,EACJ,IAAI,CAAC,MAAiC,EACtC,KAAK,CACN,CAAC;YAEF,qCAAqC;YACrC,IAAI,IAAI,YAAY,mBAAmB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAC/B,IAAI,CAAC,MAAiC,CACvC,CAAC;gBACF,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClD,oEAAoE;oBACpE,qCAAqC;oBACrC,MAAM,SAAS,GAAqB,EAAE,GAAG,GAAG,EAAE,CAAC;oBAC/C,IAAI,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;wBAC5D,2DAA2D;wBAC3D,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;wBAC9B,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"available-context.js","sourceRoot":"","sources":["../../src/engine/available-context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAe/D,MAAM,UAAU,yBAAyB,CACvC,IAA0B,EAC1B,MAA+B,EAC/B,UAA8B;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB;QACvC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;QACtC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE7C,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,UAAU,IAAI,IAAI,YAAY,mBAAmB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1E,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC1C,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG;oBAChB,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,yBAAyB,CAC/B,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAC1B,CAAC,CAAC,MAAiC,EACnC,UAAU,CACX;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,GAAG;gBACjB,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE;aACjE,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAI,IAAI,CAAC,YAAY,CAAyC,IAAI,EAAE,CAAC;QACpF,OAAO;YACL,GAAG,IAAI;YACP,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE;SACpF,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAsB,EACtB,QAAgB,EAChB,UAA6B;IAE7B,MAAM,GAAG,GAAqB,EAAE,CAAC;IAEjC,mEAAmE;IACnE,mEAAmE;IACnE,yEAAyE;IACzE,kDAAkD;IAClD,IAAI,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,yBAAyB,CACxC,WAAW,EACX,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAA4B,CACzD,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,2EAA2E;IAC3E,IAAI,QAAQ,KAAK,oBAAoB;QAAE,OAAO,GAAG,CAAC;IAElD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,QAA8B,EAC9B,QAAgB,EAChB,GAAqB,EACrB,UAA6B;IAE7B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,kEAAkE;QAClE,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mDAAmD;QACnD,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,IAAI,CAAC,EAAE,SAAS,CAAC,GAAG,yBAAyB,CACxD,IAAI,EACJ,IAAI,CAAC,MAAiC,EACtC,UAAU,CACX,CAAC;YAEF,qCAAqC;YACrC,IAAI,IAAI,YAAY,mBAAmB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAC/B,IAAI,CAAC,MAAiC,CACvC,CAAC;gBACF,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClD,oEAAoE;oBACpE,qCAAqC;oBACrC,MAAM,SAAS,GAAqB,EAAE,GAAG,GAAG,EAAE,CAAC;oBAC/C,IAAI,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;wBACjE,2DAA2D;wBAC3D,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;wBAC9B,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/engine/config-validator.d.ts

@@ -1,7 +1,6 @@
 import type { WorkflowConfig } from '../types/workflow-config.js';
 import type { ValidationResult } from '../types/validation.js';
-import type { TriggerRegistry } from '../triggers/trigger-registry.js';
-import type { StepRegistry } from '../steps/step-registry.js';
+import type { ConnectorRegistry } from '../connectors/core/connector-registry.js';
 /**
  * Validates a complete WorkflowConfig against registered triggers and steps.
  *
@@ -13,11 +12,20 @@ import type { StepRegistry } from '../steps/step-registry.js';
  * 5. Control-flow branches are recursively validated via `getBranches()`
  */
 export declare class ConfigValidator {
-    private readonly triggerRegistry;
-    private readonly stepRegistry;
-    constructor(triggerRegistry: TriggerRegistry, stepRegistry: StepRegistry);
+    private readonly connectors;
+    constructor(connectors: ConnectorRegistry);
     validate(config: WorkflowConfig): ValidationResult;
     private walkSteps;
+    /**
+     * A required credential slot left empty. Reported once per field: a field the
+     * config schema already rejected keeps that issue instead.
+     */
+    private checkCredentialSlots;
+    /**
+     * A trigger filter must be well formed, and may only read what exists before
+     * a run: the trigger's output and workflow variables.
+     */
+    private validateTriggerFilter;
     /**
      * Validate a step's author citations (documentation overlay):
      * - the cited field path must address a real field in `config`;

package/dist/engine/config-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-validator.d.ts","sourceRoot":"","sources":["../../src/engine/config-validator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,6BAA6B,CAAC;AAIrC,OAAO,KAAK,EAGV,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAiQ9D;;;;;;;;;GASG;AACH,qBAAa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,eAAe,EAAE,eAAe,EAChC,YAAY,EAAE,YAAY;IAG7C,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB;IAoDlD,OAAO,CAAC,SAAS;IAwFjB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IA8CzB,OAAO,CAAC,YAAY;IA0BpB,OAAO,CAAC,QAAQ;IAqGhB,OAAO,CAAC,sBAAsB;CAmB/B"}
+{"version":3,"file":"config-validator.d.ts","sourceRoot":"","sources":["../../src/engine/config-validator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,6BAA6B,CAAC;AAOrC,OAAO,KAAK,EAGV,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAiQlF;;;;;;;;;GASG;AACH,qBAAa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,iBAAiB;IAGhD,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB;IA4DlD,OAAO,CAAC,SAAS;IAgGjB;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IA2B5B;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IA+C7B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IA8CzB,OAAO,CAAC,YAAY;IA0BpB,OAAO,CAAC,QAAQ;IAqGhB,OAAO,CAAC,sBAAsB;CAmB/B"}

package/dist/engine/config-validator.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
-import { getVariableRefInnerSchema } from '../types/workflow-config.js';
+import { getVariableRefInnerSchema, TriggerFilterSchema } from '../types/workflow-config.js';
+import { extractRefPath } from '../util/variable-ref.js';
 import { resolveCitationPath } from '../util/citation-path.js';
 import { ValidationIssueCode } from '../types/validation.js';
 import { BaseControlFlowStep } from '../steps/base-step.js';
@@ -247,11 +248,9 @@ function stepRefLocation(stepId, prefix, location) {
  * 5. Control-flow branches are recursively validated via `getBranches()`
  */
 export class ConfigValidator {
-    triggerRegistry;
-    stepRegistry;
-    constructor(triggerRegistry, stepRegistry) {
-        this.triggerRegistry = triggerRegistry;
-        this.stepRegistry = stepRegistry;
+    connectors;
+    constructor(connectors) {
+        this.connectors = connectors;
     }
     validate(config) {
         const issues = [];
@@ -260,7 +259,7 @@ export class ConfigValidator {
         const outputSchemas = new Map();
         // --- Trigger validation ---
         if (config.trigger) {
-            if (!this.triggerRegistry.has(config.trigger.type)) {
+            if (!this.connectors.hasTrigger(config.trigger.type)) {
                 issues.push({
                     path: 'trigger.type',
                     code: ValidationIssueCode.SHAPE,
@@ -269,7 +268,7 @@ export class ConfigValidator {
                 });
             }
             else {
-                const triggerImpl = this.triggerRegistry.get(config.trigger.type);
+                const triggerImpl = this.connectors.getTrigger(config.trigger.type);
                 const result = triggerImpl.configSchema.safeParse(config.trigger.config);
                 if (!result.success) {
                     for (const issue of result.error.issues) {
@@ -281,8 +280,10 @@ export class ConfigValidator {
                         });
                     }
                 }
+                this.checkCredentialSlots(triggerImpl.credentialSlots, config.trigger.config, 'trigger.config', { scope: 'trigger' }, issues);
                 outputSchemas.set('trigger', resolveOutputJsonSchemaOf(triggerImpl, (config.trigger.config ?? {})));
             }
+            this.validateTriggerFilter(config.trigger.filter, issues);
         }
         // --- Variables (author-time constants) ---
         // Registered unconditionally so a `{{vars.x}}` ref when nothing is declared
@@ -307,7 +308,7 @@ export class ConfigValidator {
                 });
             }
             seenIds.add(step.id);
-            if (!this.stepRegistry.has(step.type)) {
+            if (!this.connectors.hasStep(step.type)) {
                 issues.push({
                     path: `${stepPath}.type`,
                     code: ValidationIssueCode.SHAPE,
@@ -316,7 +317,7 @@ export class ConfigValidator {
                 });
                 continue;
             }
-            const stepImpl = this.stepRegistry.get(step.type);
+            const stepImpl = this.connectors.getStep(step.type);
             const shapeResult = stepImpl.configSchema.safeParse(step.config);
             if (!shapeResult.success) {
                 for (const issue of shapeResult.error.issues) {
@@ -328,12 +329,13 @@ export class ConfigValidator {
                     });
                 }
             }
+            this.checkCredentialSlots(stepImpl.credentialSlots, step.config, `${stepPath}.config`, { scope: 'step', stepId: step.id }, issues);
             // Ref validation for action steps
             this.validateRefs(step.config, `${stepPath}.config`, stepImpl.configSchema, outputSchemas, issues, step.id);
             // Register this step's input + output schemas (JSON Schema, resolved like
             // the picker so refs into dynamic outputs — e.g. HTTP body — line up).
             outputSchemas.set(`${step.id}.input`, zodToJsonSchemaRecord(stepImpl.configSchema));
-            outputSchemas.set(`${step.id}.output`, resolveOutputJsonSchemaOf(stepImpl, step.config, this.stepRegistry));
+            outputSchemas.set(`${step.id}.output`, resolveOutputJsonSchemaOf(stepImpl, step.config, this.connectors));
             // Author citations (documentation overlay) — validate target field + ref.
             this.validateCitations(step, stepPath, outputSchemas, issues);
             // Control-flow branch discovery via getBranches()
@@ -346,6 +348,82 @@ export class ConfigValidator {
             }
         }
     }
+    /**
+     * A required credential slot left empty. Reported once per field: a field the
+     * config schema already rejected keeps that issue instead.
+     */
+    checkCredentialSlots(slots, config, pathPrefix, location, issues) {
+        for (const slot of slots ?? []) {
+            if (!slot.required)
+                continue;
+            const value = config?.[slot.name];
+            if (value !== undefined && value !== null && value !== '')
+                continue;
+            const alreadyReported = issues.some((issue) => issue.location?.scope === location.scope &&
+                issue.location.stepId === location.stepId &&
+                issue.location.field === slot.name);
+            if (alreadyReported)
+                continue;
+            issues.push({
+                path: `${pathPrefix}.${slot.name}`,
+                code: ValidationIssueCode.MISSING_CREDENTIAL,
+                message: 'Select a credential',
+                location: { ...location, field: slot.name },
+            });
+        }
+    }
+    /**
+     * A trigger filter must be well formed, and may only read what exists before
+     * a run: the trigger's output and workflow variables.
+     */
+    validateTriggerFilter(filter, issues) {
+        if (filter === undefined)
+            return;
+        const location = { scope: 'trigger', field: 'filter' };
+        const parsed = TriggerFilterSchema.safeParse(filter);
+        if (!parsed.success) {
+            for (const issue of parsed.error.issues) {
+                issues.push({
+                    path: ['trigger.filter', ...issue.path].join('.'),
+                    code: ValidationIssueCode.INVALID_FILTER,
+                    message: issue.message,
+                    location,
+                });
+            }
+            return;
+        }
+        const visit = (condition, path) => {
+            if ('all' in condition) {
+                condition.all.forEach((child, i) => visit(child, `${path}.all[${i}]`));
+                return;
+            }
+            if ('any' in condition) {
+                condition.any.forEach((child, i) => visit(child, `${path}.any[${i}]`));
+                return;
+            }
+            const refPath = extractRefPath(condition.variable);
+            if (!refPath) {
+                issues.push({
+                    path: `${path}.variable`,
+                    code: ValidationIssueCode.INVALID_FILTER,
+                    message: 'Choose a value for every filter condition',
+                    location,
+                });
+                return;
+            }
+            const head = refPath.split('.')[0];
+            if (head !== 'trigger' && head !== 'vars') {
+                issues.push({
+                    path: `${path}.variable`,
+                    code: ValidationIssueCode.INVALID_FILTER,
+                    message: `Filters can only use trigger data and workflow variables, not "{{${refPath}}}"`,
+                    location,
+                });
+            }
+        };
+        if (parsed.data.conditions)
+            visit(parsed.data.conditions, 'trigger.filter.conditions');
+    }
     /**
      * Validate a step's author citations (documentation overlay):
      * - the cited field path must address a real field in `config`;