@geraldmaron/construct 1.0.15 → 1.0.17

package/lib/embedded-contract/model-resolve.mjs

@@ -0,0 +1,186 @@
+/**
+ * lib/embedded-contract/model-resolve.mjs — embedded model resolution contract.
+ *
+ * Given a host/IDE's provider context, resolve which model an embedded Construct
+ * workflow should use, following a fixed precedence:
+ *   1. host-model           — the host's model, when recognized
+ *   2. same-family-fallback — a tier model in the host model's provider family
+ *   3. tier-default         — Construct's configured tier default (env/config/registry)
+ *   4. config error         — structured error with remediation when nothing resolves
+ *
+ * Cross-provider fallback is only taken when the caller opts in; otherwise host
+ * context that cannot be honored within its family yields a config error rather
+ * than silently switching providers. The contract never reads or returns a
+ * credential value — `requiresCredential` is a derived boolean — and never
+ * claims provider health it cannot verify (`healthStatus` defaults to unknown).
+ */
+
+import { describeModelFamily, listModelFamilies } from '../model-router.mjs';
+import { resolveModelTiers } from '../model-registry.mjs';
+import { resolveProviderCapabilitiesSync } from '../provider-capabilities.js';
+
+const VALID_TIERS = ['reasoning', 'standard', 'fast'];
+const DEFAULT_TIER = 'standard';
+
+// Workflow types lean toward deeper reasoning or faster turnaround; this maps a
+// workflowType to a tier only when the caller did not request one explicitly.
+
+const WORKFLOW_TIER_HINTS = {
+  'architecture-review': 'reasoning',
+  'risk-review': 'reasoning',
+  'research-synthesis': 'reasoning',
+  'prd-draft': 'standard',
+  'proposal-review': 'standard',
+  'evidence-ingest': 'fast',
+};
+
+function normalizeTier(tier) {
+  return VALID_TIERS.includes(tier) ? tier : null;
+}
+
+function resolveTier({ requestedTier, workflowType }) {
+  return normalizeTier(requestedTier) || WORKFLOW_TIER_HINTS[workflowType] || DEFAULT_TIER;
+}
+
+// Capability matching is best-effort against the model's known capability flags;
+// names that cannot be confirmed are surfaced as warnings rather than asserted.
+
+function matchCapabilities(modelId, requested, warnings) {
+  if (!Array.isArray(requested) || requested.length === 0) return [];
+  const caps = resolveProviderCapabilitiesSync(modelId);
+  const matched = [];
+  const unverified = [];
+  for (const name of requested) {
+    const key = String(name);
+    if (caps[key] === true) matched.push(key);
+    else unverified.push(key);
+  }
+  if (unverified.length) {
+    warnings.push(`Capability not confirmed for ${modelId}: ${unverified.join(', ')} (capability verification is best-effort).`);
+  }
+  return matched;
+}
+
+function familyByProvider(hostProvider, env) {
+  if (!hostProvider || typeof hostProvider !== 'string') return null;
+  const families = listModelFamilies({ env });
+  return families.find((f) => f.id === hostProvider)
+    || families.find((f) => f.id === `openrouter-${hostProvider}`)
+    || null;
+}
+
+function success({ selectedModel, family, tier, resolutionSource, fallbackReason = null, tierSource = null, capabilities, warnings, env }) {
+  return {
+    selectedModel,
+    selectedProvider: family ? family.id : null,
+    providerFamily: family ? family.id : null,
+    resolutionSource,
+    requestedTier: tier,
+    fallbackReason,
+    tierSource,
+    capabilitiesMatched: matchCapabilities(selectedModel, capabilities, warnings),
+    healthStatus: 'unknown',
+    estimatedLimits: null,
+    requiresCredential: family ? !family.local && !family.configured : true,
+    error: null,
+    warnings,
+  };
+}
+
+function configError({ tier, reason, remediation, warnings }) {
+  return {
+    selectedModel: null,
+    selectedProvider: null,
+    providerFamily: null,
+    resolutionSource: 'config-error',
+    requestedTier: tier,
+    fallbackReason: null,
+    tierSource: null,
+    capabilitiesMatched: [],
+    healthStatus: 'unknown',
+    estimatedLimits: null,
+    requiresCredential: null,
+    error: { code: 'MODEL_UNRESOLVED', reason, remediation },
+    warnings,
+  };
+}
+
+/**
+ * Resolve the model an embedded workflow should use. Pure and synchronous;
+ * returns a result object carrying a `warnings` array (lifted into the envelope
+ * by the calling surface).
+ *
+ * @param {object} request
+ * @param {string} [request.workflowType]
+ * @param {string} [request.requestedTier]      reasoning | standard | fast
+ * @param {string} [request.host]
+ * @param {string} [request.hostModel]
+ * @param {string} [request.hostProvider]
+ * @param {string[]} [request.capabilities]
+ * @param {boolean} [request.allowCrossProviderFallback=false]
+ * @param {object} [opts]
+ * @param {Record<string,string>} [opts.env]
+ * @param {string} [opts.registryPath]
+ * @returns {object}
+ */
+export function resolveEmbeddedModel(request = {}, { env = process.env, registryPath = null } = {}) {
+  const { workflowType, requestedTier, hostModel, hostProvider, capabilities, allowCrossProviderFallback = false } = request;
+  const tier = resolveTier({ requestedTier, workflowType });
+  const warnings = [];
+
+  const hostFamily = hostModel ? describeModelFamily(hostModel, { env }) : null;
+
+  if (hostModel && hostFamily) {
+    return success({ selectedModel: hostModel, family: hostFamily, tier, resolutionSource: 'host-model', capabilities, warnings, env });
+  }
+  if (hostModel && !hostFamily) {
+    warnings.push(`Host model "${hostModel}" is not a recognized provider family; attempting same-family or tier fallback.`);
+  }
+
+  const family = hostFamily || familyByProvider(hostProvider, env);
+  if (family) {
+    const model = family.tiers[tier];
+    if (model) {
+      const fallbackReason = hostModel
+        ? `Exact host model unavailable; resolved the ${tier} model in the same provider family (${family.id}).`
+        : `Resolved the ${tier} model within the host provider family (${family.id}).`;
+      return success({ selectedModel: model, family, tier, resolutionSource: 'same-family-fallback', fallbackReason, capabilities, warnings, env });
+    }
+  }
+
+  const hadHostContext = Boolean(hostModel || hostProvider);
+  if (hadHostContext && !allowCrossProviderFallback) {
+    return configError({
+      tier,
+      reason: 'Host model/provider could not be honored within its family and cross-provider fallback is disabled.',
+      remediation: 'Pass allowCrossProviderFallback=true, supply a recognized hostModel, or configure a same-family credential.',
+      warnings,
+    });
+  }
+
+  const tiers = resolveModelTiers({ env, registryPath });
+  const defaultModel = tiers.models[tier];
+  if (defaultModel) {
+    const fallbackReason = hadHostContext
+      ? 'Host context could not be honored within its family; used the Construct tier default after cross-provider fallback was permitted.'
+      : 'No host context supplied; used the Construct tier default.';
+    return success({
+      selectedModel: defaultModel,
+      family: describeModelFamily(defaultModel, { env }),
+      tier,
+      resolutionSource: 'tier-default',
+      fallbackReason,
+      tierSource: tiers.sources[tier] || 'default',
+      capabilities,
+      warnings,
+      env,
+    });
+  }
+
+  return configError({
+    tier,
+    reason: `No model could be resolved for the ${tier} tier.`,
+    remediation: 'Set CX_MODEL_REASONING/STANDARD/FAST or configure a provider credential.',
+    warnings,
+  });
+}

package/lib/embedded-contract/redaction.mjs

@@ -0,0 +1,91 @@
+/**
+ * lib/embedded-contract/redaction.mjs — structural no-secrets guard for contract output.
+ *
+ * Every embedded-contract response passes through this module before
+ * serialization. `redact` masks values at secret-looking keys; `assertNoSecrets`
+ * is the load-bearing guard — it throws if any live credential value (drawn from
+ * the environment by key name) appears anywhere in the payload, so a contract
+ * surface can never leak a token even if a future field copies one in by
+ * mistake. The check is generic and decoupled from the provider registry: it
+ * derives the secret set from env keys at call time rather than a hardcoded list.
+ */
+
+const SECRET_KEY_RE = /(api[_-]?key|secret|token|password|passwd|credential|authorization|bearer|cookie|session[_-]?id|private[_-]?key|client[_-]?secret|access[_-]?key)/i;
+
+const REDACTED = '[redacted]';
+
+// Credential env values shorter than this are treated as non-secret (empty
+// flags, "1", port numbers) and excluded so the guard does not false-positive.
+
+const MIN_SECRET_LENGTH = 8;
+
+/**
+ * Deep-clone `value`, masking any value whose key name looks like a secret.
+ *
+ * @param {*} value
+ * @returns {*}
+ */
+export function redact(value) {
+  if (Array.isArray(value)) return value.map((v) => redact(v));
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (SECRET_KEY_RE.test(k) && (typeof v === 'string' || typeof v === 'number')) {
+        out[k] = REDACTED;
+      } else {
+        out[k] = redact(v);
+      }
+    }
+    return out;
+  }
+  return value;
+}
+
+/**
+ * Collect non-trivial environment values whose key name looks like a secret.
+ *
+ * @param {Record<string,string>} [env]
+ * @returns {Set<string>}
+ */
+export function collectSecretValues(env = process.env) {
+  const out = new Set();
+  for (const [key, val] of Object.entries(env || {})) {
+    if (typeof val === 'string' && val.length >= MIN_SECRET_LENGTH && SECRET_KEY_RE.test(key)) {
+      out.add(val);
+    }
+  }
+  return out;
+}
+
+function walkStrings(value, visit, pathStr = '$') {
+  if (typeof value === 'string') {
+    visit(value, pathStr);
+  } else if (Array.isArray(value)) {
+    value.forEach((v, i) => walkStrings(v, visit, `${pathStr}[${i}]`));
+  } else if (value && typeof value === 'object') {
+    for (const [k, v] of Object.entries(value)) walkStrings(v, visit, `${pathStr}.${k}`);
+  }
+}
+
+/**
+ * Throw if any live credential value appears as a substring of any string in
+ * the payload. Returns the payload unchanged when clean.
+ *
+ * @param {*} value
+ * @param {{env?:Record<string,string>}} [opts]
+ * @returns {*}
+ */
+export function assertNoSecrets(value, { env = process.env } = {}) {
+  const secrets = collectSecretValues(env);
+  if (secrets.size === 0) return value;
+  const leaks = [];
+  walkStrings(value, (str, pathStr) => {
+    for (const secret of secrets) {
+      if (str.includes(secret)) leaks.push(pathStr);
+    }
+  });
+  if (leaks.length) {
+    throw new Error(`Secret value leaked into contract output at: ${[...new Set(leaks)].join(', ')}`);
+  }
+  return value;
+}

package/lib/embedded-contract/role-facts.mjs

@@ -0,0 +1,66 @@
+/**
+ * lib/embedded-contract/role-facts.mjs — shared role/contract enrichment.
+ *
+ * Both the triage/planning and workflow-invocation contracts need the same
+ * facts about a role chain: per-role rationale, the union of declared skills,
+ * and the evidence a role requires plus the outputs it must produce. Those facts
+ * come only from verifiable sources — the role catalog (registry) and the
+ * specialist contracts — so this module centralizes the lookups and keeps the
+ * two contracts consistent and free of invented requirements.
+ */
+
+import { listRoles } from '../roles/catalog.mjs';
+import { getIncomingContracts } from '../specialist-contracts.mjs';
+
+/**
+ * Map of role id → catalog descriptor for the current registry.
+ * @returns {Map<string, object>}
+ */
+export function roleMap() {
+  return new Map(listRoles().map((role) => [role.id, role]));
+}
+
+/**
+ * Per-role rationale for a chain, drawn from each role's catalog description.
+ *
+ * @param {string[]} chain
+ * @param {Map<string,object>} [map]
+ * @returns {Array<{role:string, reason:string}>}
+ */
+export function roleRationale(chain, map = roleMap()) {
+  return chain.map((id) => ({
+    role: `cx-${id}`,
+    reason: map.get(id)?.description || 'No role description available.',
+  }));
+}
+
+/**
+ * Union of declared skills across a role chain, de-duplicated.
+ *
+ * @param {string[]} chain
+ * @param {Map<string,object>} [map]
+ * @returns {string[]}
+ */
+export function skillsForChain(chain, map = roleMap()) {
+  return [...new Set(chain.flatMap((id) => map.get(id)?.skills || []))];
+}
+
+/**
+ * Evidence a role requires and the outputs it must produce, taken from the
+ * role's incoming specialist contract (input.mustContain + preconditions /
+ * output.mustContain). Returns empty arrays when no contract is declared.
+ *
+ * @param {string} roleId   Bare role id (no cx- prefix).
+ * @returns {{evidenceRequirements:string[], expectedOutputs:string[]}}
+ */
+export function contractFacts(roleId) {
+  const contracts = getIncomingContracts(`cx-${roleId}`) || [];
+  const evidence = new Set();
+  const outputs = new Set();
+  for (const c of contracts) {
+    for (const item of c.input?.mustContain || []) evidence.add(item);
+    for (const pre of c.preconditions || []) evidence.add(pre);
+    for (const item of c.output?.mustContain || []) outputs.add(item);
+  }
+  return { evidenceRequirements: [...evidence], expectedOutputs: [...outputs] };
+}

package/lib/embedded-contract/triage.mjs

@@ -0,0 +1,134 @@
+/**
+ * lib/embedded-contract/triage.mjs — embedded triage and planning contract.
+ *
+ * Classifies an artifact and returns a role-aware plan without enqueuing or
+ * executing anything. Wraps the deterministic classifier (lib/intake/classify)
+ * and enriches it from real sources only: the role catalog supplies role
+ * rationale and skills, the specialist contracts supply evidence requirements
+ * and expected outputs. Classification confidence (how sure the classifier is)
+ * is reported as a distinct, labeled field from any downstream generation
+ * confidence, which is produced only when a workflow actually runs.
+ *
+ * Pure and side-effect-free: no queue write, no disk artifact, no model call.
+ */
+
+import { classifyRdIntake } from '../intake/classify.mjs';
+import { getDeploymentMode } from '../deployment-mode.mjs';
+import { roleMap, roleRationale, skillsForChain, contractFacts } from './role-facts.mjs';
+import { workflowTypeForIntake } from './workflow-defs.mjs';
+
+const CONFIDENCE_FLOOR = 0.6;
+
+function buildRiskFactors(triage) {
+  const factors = [];
+  if (triage.intakeType === 'unknown') factors.push('classification is unknown — no keywords matched');
+  if (typeof triage.confidence === 'number' && triage.confidence < CONFIDENCE_FLOOR) {
+    factors.push(`low classification confidence (${triage.confidence.toFixed(2)})`);
+  }
+  const ambiguous = (triage.rationale || '').includes('ambiguous');
+  if (ambiguous) factors.push('top two classifications are close (ambiguous)');
+  return factors;
+}
+
+/**
+ * Produce a role-aware plan for an artifact without enqueuing or executing it.
+ *
+ * @param {object} request
+ * @param {string} [request.input]          Artifact text to classify.
+ * @param {string} [request.sourcePath]     Filename/source hint for the classifier.
+ * @param {string} [request.artifactType]   Optional artifact-type hint (advisory).
+ * @param {string} [request.domain]
+ * @param {string} [request.desiredOutcome]
+ * @param {string[]} [request.constraints]
+ * @param {string[]} [request.availableRoles]  Restrict the plan to these role ids.
+ * @param {object} [request.profile]
+ * @param {object} [opts]   { env, cwd }
+ * @returns {object}
+ */
+export function recommendPlan(request = {}, { env = process.env, cwd = process.cwd() } = {}) {
+  const { input = '', sourcePath = '', artifactType, availableRoles, profile = null, ingestion = null } = request;
+  const warnings = [];
+
+  // Surface extraction provenance and flag low-yield/truncated inputs so a
+  // sparse classification is attributable to thin source text, not silent loss.
+
+  if (ingestion) {
+    if (ingestion.error) warnings.push(`ingestion: ${ingestion.error.code} — ${ingestion.error.reason}`);
+    for (const drop of ingestion.droppedInfo || []) {
+      warnings.push(`ingestion: ${drop.kind || 'dropped-content'}${drop.recoverable ? ' (recoverable)' : ''}.`);
+    }
+    if (ingestion.truncated) warnings.push('ingestion: source text was truncated before classification.');
+    if (ingestion.note) warnings.push(`ingestion: ${ingestion.note}`);
+  }
+
+  const triage = classifyRdIntake({ sourcePath: sourcePath || (artifactType ? `${artifactType}.md` : ''), extractedText: input, profile });
+  const roles = roleMap();
+
+  let chain = [...(triage.recommendedChain || [])];
+  const primaryOwner = triage.primaryOwner;
+
+  if (Array.isArray(availableRoles) && availableRoles.length) {
+    const allowed = new Set(availableRoles);
+    const dropped = chain.filter((r) => !allowed.has(r));
+    if (dropped.length) warnings.push(`Roles not in availableRoles were dropped from the chain: ${dropped.join(', ')}.`);
+    chain = chain.filter((r) => allowed.has(r));
+    if (primaryOwner && !allowed.has(primaryOwner)) {
+      warnings.push(`Primary owner ${primaryOwner} is not in availableRoles; the plan cannot be executed as recommended.`);
+    }
+  }
+
+  const rationale = roleRationale(chain, roles);
+  const suggestedSkills = skillsForChain(chain, roles);
+
+  const { evidenceRequirements, expectedOutputs } = contractFacts(primaryOwner);
+  if (!evidenceRequirements.length) {
+    warnings.push(`No declared evidence contract for cx-${primaryOwner}; evidence requirements are unspecified.`);
+  }
+
+  const deploymentMode = getDeploymentMode(env, { cwd });
+  const requiresApproval = Boolean(triage.requiresApproval) || deploymentMode === 'enterprise';
+  const approvalRequirements = {
+    requiresApproval,
+    reason: triage.requiresApproval
+      ? 'The classified work type requires approval before durable changes.'
+      : (deploymentMode === 'enterprise' ? 'Enterprise deployment mode mandates approval for durable changes.' : 'No approval required before proposing changes.'),
+  };
+
+  const ownerAvailable = !primaryOwner || !Array.isArray(availableRoles) || !availableRoles.length || availableRoles.includes(primaryOwner);
+  const canExecute = triage.intakeType !== 'unknown'
+    && typeof triage.confidence === 'number' && triage.confidence >= CONFIDENCE_FLOOR
+    && chain.length > 0
+    && ownerAvailable;
+  const canExecuteReason = canExecute
+    ? 'Classification is confident and maps to a role chain that can be invoked.'
+    : 'Execution is not recommended: classification is unknown, low-confidence, or no usable role chain remains.';
+
+  const nextStepOptions = [
+    { action: 'enqueue', description: 'Add to the intake queue for processing (construct intake process).' },
+  ];
+  if (canExecute) nextStepOptions.push({ action: 'invoke-workflow', description: 'Invoke the recommended role chain as an embedded workflow.' });
+  if (!canExecute) nextStepOptions.push({ action: 'clarify', description: 'Request more detail; classification confidence is low or unknown.' });
+
+  return {
+    classification: { intakeType: triage.intakeType, rdStage: triage.rdStage },
+    ingestion,
+    confidenceKind: 'classification',
+    classificationConfidence: triage.confidence,
+    primaryOwner,
+    recommendedAction: triage.recommendedAction,
+    recommendedChain: chain,
+    suggestedWorkflowType: workflowTypeForIntake(triage.intakeType),
+    roleRationale: rationale,
+    suggestedSkills,
+    evidenceRequirements,
+    expectedOutputs,
+    approvalRequirements,
+    risks: { level: triage.risk || 'unknown', factors: buildRiskFactors(triage) },
+    nextStepOptions,
+    canExecute,
+    canExecuteReason,
+    rationale: triage.rationale,
+    candidates: triage.candidates || [],
+    warnings,
+  };
+}

package/lib/embedded-contract/workflow-defs.mjs

@@ -0,0 +1,125 @@
+/**
+ * lib/embedded-contract/workflow-defs.mjs — embedded workflow type definitions.
+ *
+ * The single source of truth for the workflow types an embedding application can
+ * invoke. Each definition names a default role chain (real registry role ids), a
+ * model tier, a default approval mode, an optional output-schema artifact, and a
+ * one-line description. Skills are not hardcoded here — they are derived from the
+ * selected roles' declared skills (role-facts) so this file never names a skill
+ * id that does not exist. Capability discovery reads these definitions so the
+ * published workflow list cannot drift from what invocation actually supports.
+ */
+
+const DEFS = {
+  'evidence-ingest': {
+    tier: 'fast',
+    defaultApprovalMode: 'proposal-only',
+    chain: ['researcher', 'data-analyst'],
+    outputSchema: null,
+    description: 'Ingest and structure raw evidence (notes, documents, signals) into a normalized summary.',
+  },
+  'proposal-review': {
+    tier: 'standard',
+    defaultApprovalMode: 'requires-human-approval',
+    chain: ['reviewer', 'devil-advocate'],
+    outputSchema: 'review-report',
+    description: 'Review a proposal for correctness, risk, and hidden assumptions before acceptance.',
+  },
+  'prd-draft': {
+    tier: 'standard',
+    defaultApprovalMode: 'proposal-only',
+    chain: ['product-manager', 'architect'],
+    outputSchema: 'decision',
+    description: 'Draft a product requirements document from a problem statement and supporting evidence.',
+  },
+  'architecture-review': {
+    tier: 'reasoning',
+    defaultApprovalMode: 'requires-human-approval',
+    chain: ['architect', 'security', 'devil-advocate'],
+    outputSchema: 'review-report',
+    description: 'Review an architecture or design for trade-offs, failure modes, and security exposure.',
+  },
+  'risk-review': {
+    tier: 'reasoning',
+    defaultApprovalMode: 'requires-human-approval',
+    chain: ['devil-advocate', 'security', 'legal-compliance'],
+    outputSchema: 'review-report',
+    description: 'Stress-test a plan for risk: failure modes, security, and compliance exposure.',
+  },
+  'research-synthesis': {
+    tier: 'reasoning',
+    defaultApprovalMode: 'proposal-only',
+    chain: ['researcher', 'data-analyst', 'evaluator'],
+    outputSchema: null,
+    description: 'Synthesize multiple sources into a cited, evidence-graded research summary.',
+  },
+  'transcript-process': {
+    tier: 'fast',
+    defaultApprovalMode: 'proposal-only',
+    chain: ['researcher', 'data-analyst'],
+    outputSchema: null,
+    description: 'Process a meeting/call transcript into a summary, decisions, and action items.',
+  },
+  'data-structure': {
+    tier: 'standard',
+    defaultApprovalMode: 'proposal-only',
+    chain: ['data-analyst', 'data-engineer'],
+    outputSchema: null,
+    description: 'Parse, validate, and profile a raw dataset into a structured, described shape.',
+  },
+  'memo-draft': {
+    tier: 'fast',
+    defaultApprovalMode: 'proposal-only',
+    chain: ['docs-keeper', 'reviewer'],
+    outputSchema: null,
+    description: 'Draft a decision or status memo from a problem statement and context.',
+  },
+  'structure-notes': {
+    tier: 'fast',
+    defaultApprovalMode: 'proposal-only',
+    chain: ['orchestrator', 'researcher'],
+    outputSchema: null,
+    description: 'Structure an unclassified brain-dump or rough notes into a normalized summary with extracted intents.',
+  },
+};
+
+// Maps a classifier intakeType to the workflow type that would carry it out, so
+// the triage contract can suggest a directly-invokable workflow. Returns null
+// when no workflow covers the classification (the plan is not directly invokable).
+
+const INTAKE_TO_WORKFLOW = {
+  proposal: 'proposal-review',
+  prd: 'prd-draft',
+  'meta-prd': 'prd-draft',
+  architecture: 'architecture-review',
+  rfc: 'architecture-review',
+  risk: 'risk-review',
+  security: 'risk-review',
+  research: 'research-synthesis',
+  'research-note': 'research-synthesis',
+  signal: 'evidence-ingest',
+  'user-signal': 'evidence-ingest',
+  evidence: 'evidence-ingest',
+  memo: 'memo-draft',
+  transcript: 'transcript-process',
+  'raw-data': 'data-structure',
+  unknown: 'structure-notes',
+};
+
+export const WORKFLOW_TYPES = Object.keys(DEFS);
+
+export function getWorkflowDef(type) {
+  return DEFS[type] || null;
+}
+
+/**
+ * Public, secret-free description of every workflow type for capability discovery.
+ * @returns {Array<object>}
+ */
+export function listWorkflowDefs() {
+  return WORKFLOW_TYPES.map((type) => ({ type, ...DEFS[type] }));
+}
+
+export function workflowTypeForIntake(intakeType) {
+  return INTAKE_TO_WORKFLOW[intakeType] || null;
+}