@theowlops/boombot 0.0.0-stage → 1.1.0

package/dist/gateway/turns/routing/intent-classifier.js

@@ -0,0 +1,60 @@
+export class IntentClassifier {
+    /**
+     * Fast reflex classification based on prefixes, patterns, and structure.
+     */
+    static classify(input) {
+        const trimmed = input.trim();
+        // 1. Explicit Slash Commands
+        if (/^\/(plan|task|longtask|decompose)\b/i.test(trimmed)) {
+            const goal = trimmed.replace(/^\/(plan|task|longtask|decompose)\s*/i, '').trim();
+            return {
+                mode: 'planner',
+                reason: 'explicit /plan command',
+                goal: goal || trimmed,
+            };
+        }
+        if (/^\/(workflow|dag|mass)\b/i.test(trimmed)) {
+            const goal = trimmed.replace(/^\/(workflow|dag|mass)\s*/i, '').trim();
+            return {
+                mode: 'workflow',
+                reason: 'explicit /workflow command',
+                goal: goal || trimmed,
+            };
+        }
+        // 2. Parallel / DAG Workflow Intent (auto-detect without requiring /workflow)
+        const isParallelWorkflow = /(song song|đồng thời|parallel|multi-agent|chạy cùng lúc|phân nhánh|dag workflow|đồ thị tác vụ)/i.test(trimmed);
+        if (isParallelWorkflow) {
+            return {
+                mode: 'workflow',
+                reason: 'detected parallel / multi-agent workflow intent',
+                goal: trimmed,
+            };
+        }
+        // 3. Multi-step explicitly enumerated user plans (>= 2 steps, or sequential conjunctions)
+        const numberedStepCount = (trimmed.match(/(?:^|\n|\b)\s*(?:bước\s*\d+|\bstep\s*\d+|\bpha\s*\d+|\bphase\s*\d+|\d+[\.\)])\s+/gi) ?? []).length;
+        const hasSequentialFlow = /(?:sau đó|tiếp theo|rồi|lần lượt|then|after that|next|in order to)/i.test(trimmed);
+        if (numberedStepCount >= 2 || (numberedStepCount >= 1 && hasSequentialFlow)) {
+            return {
+                mode: 'planner',
+                reason: `detected structured multi-step plan (${numberedStepCount} steps)`,
+                goal: trimmed,
+            };
+        }
+        // 4. Complex autonomous engineering / refactoring / pipeline goals (lowered threshold)
+        const isMajorGoal = /(xây dựng tính năng|triển khai toàn bộ|phát triển mô đun|refactor toàn diện|phân rã tác vụ|build feature|implement full|architect and test|full refactor)/i.test(trimmed);
+        const hasPhases = /(từng bước|kế hoạch|hoàn chỉnh|toàn diện|end-to-end|lifecycle|từ đầu đến cuối)/i.test(trimmed);
+        if (isMajorGoal || (hasPhases && trimmed.length > 30)) {
+            return {
+                mode: 'planner',
+                reason: 'detected complex multi-phase engineering goal',
+                goal: trimmed,
+            };
+        }
+        // 5. Default: Standard ReAct loop
+        return {
+            mode: 'react',
+            reason: 'standard direct query / single-turn react',
+            goal: trimmed,
+        };
+    }
+}

package/dist/gateway/turns/routing/planner-adapter.js

@@ -0,0 +1,91 @@
+/**
+ * Planner Adapter for Gateway Execution.
+ *
+ * Translates high-level goals into multi-phase execution plans using `@boombot/core`'s
+ * `decomposeGoal`, executing each phase through the cognitive ReAct loop with checkpoints.
+ */
+import { decomposeGoal } from '@boombot/core';
+export async function executePlannedTurn(options) {
+    const { goal, baseContext, runtimeDeps, runTurn, onEvent, signal, onPhaseProgress, } = options;
+    // 1. Decompose the high-level goal into phases
+    const plan = await decomposeGoal(goal);
+    const totalPhases = plan.steps.length;
+    const aggregatedMessages = [...baseContext.messages];
+    let totalRounds = 0;
+    let totalExecuted = 0;
+    let totalDenied = 0;
+    const totalUsage = { inputTokens: 0, outputTokens: 0, totalTokens: 0 };
+    const phaseReports = [];
+    // 2. Execute each phase sequentially with full ReAct capabilities
+    for (let i = 0; i < totalPhases; i++) {
+        if (signal?.aborted) {
+            break;
+        }
+        const step = plan.steps[i];
+        onPhaseProgress?.(i + 1, totalPhases, step.title);
+        const phaseSystemPrompt = {
+            role: 'system',
+            content: [
+                `[AUTONOMOUS PLANNER: PHASE ${i + 1}/${totalPhases} - ${step.title.toUpperCase()}]`,
+                `Overall Goal: ${plan.goal}`,
+                `Current Objective: ${step.prompt}`,
+                'Execute this phase thoroughly using all required tools. Provide a clear summary upon completion of this phase.',
+            ].join('\n'),
+        };
+        const phaseContext = {
+            ...baseContext,
+            sessionId: `${baseContext.sessionId}:phase_${i + 1}`,
+            messages: [
+                ...aggregatedMessages,
+                phaseSystemPrompt,
+                { role: 'user', content: step.prompt },
+            ],
+            budget: { maxRounds: 10, maxToolCalls: 24 },
+        };
+        const phaseResult = await runTurn(runtimeDeps, phaseContext, onEvent, signal);
+        totalRounds += phaseResult.rounds;
+        totalExecuted += phaseResult.toolCallsExecuted;
+        totalDenied += phaseResult.toolCallsDenied;
+        if (phaseResult.usage) {
+            totalUsage.inputTokens += phaseResult.usage.inputTokens;
+            totalUsage.outputTokens += phaseResult.usage.outputTokens;
+            totalUsage.totalTokens += phaseResult.usage.totalTokens;
+        }
+        // Extract assistant summary of this phase
+        const phaseSummary = [...phaseResult.messages]
+            .reverse()
+            .find((m) => m.role === 'assistant')?.content ?? `Completed ${step.title}`;
+        phaseReports.push(`### Phase ${i + 1}: ${step.title}\n${phaseSummary}`);
+        // Append phase results to aggregated context for next phases
+        aggregatedMessages.push({ role: 'user', content: `[Completed Phase ${i + 1}: ${step.title}]` }, { role: 'assistant', content: phaseSummary });
+        if (phaseResult.status !== 'completed') {
+            return {
+                status: phaseResult.status,
+                messages: aggregatedMessages,
+                rounds: totalRounds,
+                toolCallsExecuted: totalExecuted,
+                toolCallsDenied: totalDenied,
+                usage: totalUsage,
+                error: `Phase ${i + 1} (${step.title}) failed: ${phaseResult.error ?? 'unknown error'}`,
+            };
+        }
+    }
+    // 3. Synthesize the final comprehensive multi-phase report
+    const finalSummaryText = [
+        `## Kế hoạch hoàn thành (${totalPhases}/${totalPhases} pha): ${plan.goal}`,
+        ...phaseReports,
+    ].join('\n\n');
+    const finalAssistantMessage = {
+        role: 'assistant',
+        content: finalSummaryText,
+    };
+    aggregatedMessages.push(finalAssistantMessage);
+    return {
+        status: 'completed',
+        messages: aggregatedMessages,
+        rounds: totalRounds,
+        toolCallsExecuted: totalExecuted,
+        toolCallsDenied: totalDenied,
+        usage: totalUsage,
+    };
+}

package/dist/gateway/turns/routing/types.js

@@ -0,0 +1 @@
+export {};

package/dist/gateway/turns/runtime-deps.js

@@ -0,0 +1,228 @@
+import { enrichWithSelfHealing } from '@boombot/core';
+import { RuleEvaluator, toGuardToolError, verifyBeforeExecute, DefaultApprovalPolicy } from '@boombot/security';
+import { sanitizeToolSchema } from './tool-schema.js';
+/**
+ * LLM client that resolves the real provider client lazily on first use
+ * and caches it for the lifetime of these deps (one turn). A fresh deps
+ * object is built per turn, so provider changes are picked up on the next
+ * turn. Never mocked: without an active provider every model round fails
+ * with a clear error instead of fake output.
+ */
+class LazyLlmClient {
+    providerService;
+    cached;
+    constructor(providerService) {
+        this.providerService = providerService;
+    }
+    resolve() {
+        if (this.cached === undefined) {
+            this.cached = (async () => {
+                if (this.providerService === undefined) {
+                    throw new Error('no LLM provider configured: activate a provider before submitting a turn');
+                }
+                const client = await this.providerService.resolveLlm();
+                if (client === undefined || client === null) {
+                    throw new Error('provider service did not return an LLM client');
+                }
+                return client;
+            })();
+        }
+        return this.cached;
+    }
+    async *complete(messages, tools, signal) {
+        const client = await this.resolve();
+        yield* client.complete(messages, tools, signal);
+    }
+}
+export class GatewayToolExecutor {
+    entries = new Map();
+    guardPolicy;
+    onGuardBlock;
+    /**
+     * Attach the deterministic harness guard (`@boombot/security`).
+     * Every registered tool call is verified BEFORE its handler runs; denials
+     * never reach the handler. `onBlock` fires once per denial so the turn
+     * service can announce it on the wire. Unset (default) = no guard.
+     */
+    setGuard(policy, onBlock) {
+        this.guardPolicy = policy;
+        this.onGuardBlock = onBlock;
+    }
+    /**
+     * Register a real tool implementation. Throws when the name is
+     * already taken so a later registration can never silently shadow one.
+     */
+    registerTool(definition, handler) {
+        if (this.entries.has(definition.name)) {
+            throw new Error(`tool already registered: '${definition.name}'`);
+        }
+        // Sanitize once at registration: MCP/plugin schemas may carry `$ref`,
+        // `$defs`, or other keywords providers reject with a 400. Sanitizing
+        // here (instead of per request) covers every registration path —
+        // built-in, MCP, plugin, deferred — through this single choke point.
+        const sanitized = {
+            ...definition,
+            parameters: sanitizeToolSchema(definition.parameters),
+        };
+        this.entries.set(definition.name, { definition: sanitized, handler });
+    }
+    /** Definitions handed to the model each round. */
+    listDefinitions() {
+        return [...this.entries.values()].map((entry) => entry.definition);
+    }
+    async execute(call, signal) {
+        throwIfAborted(signal);
+        const entry = this.entries.get(call.name);
+        if (entry === undefined) {
+            return {
+                callId: call.id,
+                name: call.name,
+                output: `tool not registered: '${call.name}' is not available on this gateway`,
+                error: true,
+            };
+        }
+        // Harness guard: deterministic pre-execution gate. A denial (or
+        // require-approval — there is no operator in this loop to approve)
+        // returns a policy error result; the handler never runs.
+        if (this.guardPolicy !== undefined) {
+            const verdict = await verifyBeforeExecute(call, new RuleEvaluator(this.guardPolicy), this.guardPolicy);
+            if (verdict.decision !== 'allow') {
+                const toolError = toGuardToolError(verdict);
+                this.onGuardBlock?.({ toolName: call.name, reason: verdict.reason, layer: verdict.layer });
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: `[${toolError.code}] ${toolError.message}`,
+                    error: true,
+                    deniedByPolicy: true,
+                    toolError,
+                };
+            }
+        }
+        try {
+            const result = await entry.handler(call, signal);
+            // Guarantee the result answers the call the loop actually made and enrich if failed
+            return enrichWithSelfHealing(call, { ...result, callId: call.id, name: call.name });
+        }
+        catch (err) {
+            const rawErrorResult = {
+                callId: call.id,
+                name: call.name,
+                output: `tool '${call.name}' failed: ${err instanceof Error ? err.message : 'unknown error'}`,
+                error: true,
+            };
+            return enrichWithSelfHealing(call, rawErrorResult);
+        }
+    }
+}
+/**
+ * Attach the harness guard to a turn's tool executor. No-op when the deps
+ * do not carry a `GatewayToolExecutor` (foreign executors stay untouched).
+ */
+export function attachHarnessGuard(deps, policy, onBlock) {
+    if (deps.tools instanceof GatewayToolExecutor) {
+        deps.tools.setGuard(policy, onBlock);
+    }
+}
+/** Memory port delegating to the gateway memory service; `[]` when absent. */
+class GatewayMemoryPort {
+    memoryService;
+    constructor(memoryService) {
+        this.memoryService = memoryService;
+    }
+    async recall(query) {
+        if (this.memoryService === undefined) {
+            return [];
+        }
+        return this.memoryService.recall(query);
+    }
+}
+/**
+ * Policy port over `DefaultApprovalPolicy` (deterministic risk floors).
+ *
+ * - `allow` → the call proceeds.
+ * - `deny` → the loop stops safely.
+ * - `require-approval` → the loop sees `ask`; the turn service supplies the
+ *   ApprovalPort and pauses until the operator answers `turn.approve`.
+ */
+class GatewayPolicyPort {
+    principalId;
+    policy;
+    constructor(principalId, allowTools = [], denyTools = [], autonomous = false) {
+        this.principalId = principalId;
+        // Operators may explicitly allow or hard-deny tools. Everything else
+        // keeps the default risk policy and can pause for HITL approval.
+        this.policy = new DefaultApprovalPolicy({
+            allowTools: [...allowTools],
+            denyTools: [...denyTools],
+            autonomous,
+        });
+    }
+    checkToolCall(call) {
+        const evaluation = this.policy.evaluate({
+            tool: call.name,
+            args: call.arguments,
+            principalId: this.principalId,
+        });
+        return evaluation.decision === 'require-approval' ? 'ask' : evaluation.decision;
+    }
+}
+/** Build one turn's runtime deps. Cheap and side-effect free (LLM resolves lazily). */
+export function createAgentRuntimeDeps(options = {}) {
+    return {
+        llm: new LazyLlmClient(options.providerService),
+        tools: new GatewayToolExecutor(),
+        memory: new GatewayMemoryPort(options.memoryService),
+        policy: new GatewayPolicyPort(options.principalId ?? 'gateway', options.policyAllowTools ?? [], options.policyDenyTools ?? [], options.autonomous ?? false),
+    };
+}
+/**
+ * Read the tool definitions to offer the model. Works on any
+ * `AgentRuntimeDeps`; returns `[]` for foreign `ToolExecutor`
+ * implementations that do not expose a definition list.
+ */
+/**
+ * Id used to probe the policy for a tool's verdict. A definition is judged
+ * by NAME, before the model has picked arguments, so the probe carries none.
+ * A policy that denies on *arguments* is unaffected: it still denies at
+ * execution time, exactly as before.
+ */
+const POLICY_PROBE_CALL_ID = 'policy-probe';
+/**
+ * Read the tool definitions to offer the model, minus the ones this turn's
+ * policy would hard-deny.
+ *
+ * A denied tool is worse than an absent one. The model cannot see the
+ * policy, so it reaches for whatever looks useful (`shell.exec` is the
+ * obvious way to "find a file"), the call is refused, and a refusal stops
+ * the entire turn — the model is punished for a choice it had no way to
+ * make correctly. Filtering is what turns the fail-closed default into a
+ * capability list rather than a trap.
+ *
+ * `'ask'` decisions are deliberately kept: those are the calls a human may
+ * legitimately approve, and the approval gate is the point of them.
+ */
+export async function getToolDefinitions(deps) {
+    const tools = deps.tools;
+    if (typeof tools.listDefinitions !== 'function')
+        return [];
+    const definitions = tools.listDefinitions();
+    const judged = await Promise.all(definitions.map(async (definition) => ({
+        definition,
+        decision: await deps.policy.checkToolCall({
+            id: POLICY_PROBE_CALL_ID,
+            name: definition.name,
+            arguments: {},
+        }),
+    })));
+    return judged
+        .filter((entry) => entry.decision !== 'deny')
+        .map((entry) => entry.definition);
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted === true) {
+        const err = new Error('turn cancelled');
+        err.name = 'AbortError';
+        throw err;
+    }
+}

package/dist/gateway/turns/self-config-tool.js

@@ -0,0 +1,277 @@
+/**
+ * Self-Configuration & In-Process Plugin Management Tools.
+ *
+ * Allows BoomBot to dynamically inspect, update, and self-evolve its own
+ * runtime configuration and plugin ecosystem WITHOUT dropping connections or
+ * restarting the gateway process.
+ */
+import { readFile, writeFile } from 'node:fs/promises';
+import { PluginInstaller } from '@boombot/plugins';
+export const CONFIG_MANAGE_TOOL_NAME = 'config_manage';
+export const PLUGIN_MANAGE_TOOL_NAME = 'plugin_manage';
+export const configManageDefinition = {
+    name: CONFIG_MANAGE_TOOL_NAME,
+    description: 'Inspect or update BoomBot runtime configuration (autonomous mode, ports, providers, shell opt-in) without restart.',
+    parameters: {
+        type: 'object',
+        properties: {
+            action: {
+                type: 'string',
+                enum: ['get', 'update'],
+                description: "'get' to read current configuration; 'update' to patch configuration.",
+            },
+            settings: {
+                type: 'object',
+                description: 'Key-value pairs to merge into config.json when action is update.',
+            },
+        },
+        required: ['action'],
+    },
+};
+export const pluginManageDefinition = {
+    name: PLUGIN_MANAGE_TOOL_NAME,
+    description: 'Manage BoomBot plugins live without dropping sessions: list installed & marketplace plugins, install new plugins from catalog/git/npm, uninstall, or hot-reload.',
+    parameters: {
+        type: 'object',
+        properties: {
+            action: {
+                type: 'string',
+                enum: ['list', 'install', 'uninstall', 'reload'],
+                description: 'Action to perform: list, install, uninstall, or hot-reload.',
+            },
+            name: {
+                type: 'string',
+                description: 'Plugin identifier (e.g. boombot.browser), git repository URL, or npm package name for install/uninstall.',
+            },
+        },
+        required: ['action'],
+    },
+};
+export function registerSelfConfigTools(registry, options) {
+    const { configPath, pluginsRoot, liveConfig, pluginManager } = options;
+    // 1. config_manage
+    registry.registerTool(configManageDefinition, async (call) => {
+        const action = String(call.arguments['action'] ?? 'get');
+        if (action === 'get') {
+            try {
+                const raw = await readFile(configPath, 'utf8');
+                const parsed = JSON.parse(raw);
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: JSON.stringify({
+                        status: 'ok',
+                        configPath,
+                        config: parsed,
+                        liveRuntime: {
+                            autonomous: liveConfig['autonomous'] ?? true,
+                            installedPlugins: pluginManager?.manifests.map((m) => m.id) ?? [],
+                            registeredPluginTools: pluginManager?.toolNames ?? [],
+                        },
+                    }, null, 2),
+                    error: false,
+                };
+            }
+            catch (err) {
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: `Failed to read config file: ${err instanceof Error ? err.message : String(err)}`,
+                    error: true,
+                };
+            }
+        }
+        if (action === 'update') {
+            const updates = call.arguments['settings'];
+            if (!updates || typeof updates !== 'object') {
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: 'Error: settings object required for update action',
+                    error: true,
+                };
+            }
+            try {
+                let existing = {};
+                try {
+                    const raw = await readFile(configPath, 'utf8');
+                    existing = JSON.parse(raw);
+                }
+                catch {
+                    // fresh
+                }
+                const merged = { ...existing, ...updates };
+                await writeFile(configPath, JSON.stringify(merged, null, 2), 'utf8');
+                // Apply live updates in memory immediately
+                for (const [k, v] of Object.entries(updates)) {
+                    liveConfig[k] = v;
+                }
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: JSON.stringify({
+                        status: 'ok',
+                        message: 'Configuration updated and applied live to memory and disk.',
+                        updatedKeys: Object.keys(updates),
+                    }, null, 2),
+                    error: false,
+                };
+            }
+            catch (err) {
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: `Failed to write config: ${err instanceof Error ? err.message : String(err)}`,
+                    error: true,
+                };
+            }
+        }
+        return {
+            callId: call.id,
+            name: call.name,
+            output: `Unknown action: ${action}`,
+            error: true,
+        };
+    });
+    // 2. plugin_manage
+    registry.registerTool(pluginManageDefinition, async (call) => {
+        const action = String(call.arguments['action'] ?? 'list');
+        const name = String(call.arguments['name'] ?? '').trim();
+        if (action === 'list') {
+            try {
+                const installed = await PluginInstaller.listInstalled(pluginsRoot);
+                const catalog = PluginInstaller.getMarketplace();
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: JSON.stringify({
+                        installedCount: installed.length,
+                        installed: installed.map((p) => ({
+                            id: p.id,
+                            version: p.version,
+                            displayName: p.displayName,
+                            description: p.description,
+                            capabilities: p.capabilities,
+                        })),
+                        marketplaceAvailable: catalog.map((c) => ({
+                            id: c.id,
+                            name: c.name,
+                            description: c.description,
+                            tags: c.tags,
+                        })),
+                    }, null, 2),
+                    error: false,
+                };
+            }
+            catch (err) {
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: `Failed to list plugins: ${err instanceof Error ? err.message : String(err)}`,
+                    error: true,
+                };
+            }
+        }
+        if (action === 'install') {
+            if (!name) {
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: 'Error: plugin name or source required for install action',
+                    error: true,
+                };
+            }
+            try {
+                const res = await PluginInstaller.install(name, { root: pluginsRoot });
+                // Live hot-reload into memory
+                if (pluginManager) {
+                    await pluginManager.reload();
+                }
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: JSON.stringify({
+                        status: 'ok',
+                        message: `Plugin '${res.id}' installed and activated live with zero downtime!`,
+                        installedPlugin: res,
+                        activePluginTools: pluginManager?.toolNames ?? [],
+                    }, null, 2),
+                    error: false,
+                };
+            }
+            catch (err) {
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: `Failed to install plugin '${name}': ${err instanceof Error ? err.message : String(err)}`,
+                    error: true,
+                };
+            }
+        }
+        if (action === 'uninstall') {
+            if (!name) {
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: 'Error: plugin id required for uninstall action',
+                    error: true,
+                };
+            }
+            try {
+                const ok = await PluginInstaller.uninstall(name, { root: pluginsRoot });
+                if (pluginManager) {
+                    await pluginManager.reload();
+                }
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: JSON.stringify({
+                        status: ok ? 'ok' : 'not_found',
+                        message: ok
+                            ? `Plugin '${name}' uninstalled and unloaded live.`
+                            : `Plugin '${name}' not found.`,
+                        activePluginTools: pluginManager?.toolNames ?? [],
+                    }),
+                    error: false,
+                };
+            }
+            catch (err) {
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: `Failed to uninstall plugin: ${err instanceof Error ? err.message : String(err)}`,
+                    error: true,
+                };
+            }
+        }
+        if (action === 'reload') {
+            try {
+                const tools = pluginManager ? await pluginManager.reload() : [];
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: JSON.stringify({
+                        status: 'ok',
+                        message: 'Plugins hot-reloaded successfully in-memory.',
+                        activePluginTools: tools,
+                    }),
+                    error: false,
+                };
+            }
+            catch (err) {
+                return {
+                    callId: call.id,
+                    name: call.name,
+                    output: `Failed to reload plugins: ${err instanceof Error ? err.message : String(err)}`,
+                    error: true,
+                };
+            }
+        }
+        return {
+            callId: call.id,
+            name: call.name,
+            output: `Unknown action: ${action}`,
+            error: true,
+        };
+    });
+}

package/dist/gateway/turns/service-types.js

@@ -0,0 +1,11 @@
+/**
+ * Default HITL approval window: 60 seconds.
+ *
+ * The window bounds how long a turn may sit in SILENCE, not how much work it
+ * may do. The pause is announced on the wire the moment it starts
+ * (`turn.approval_required`) and persisted as `pending`, so five minutes
+ * bought nothing over one minute except a five-minute stall when nobody was
+ * watching the client. At the deadline the call is recorded `expired` and
+ * rejected; that is a turn the user can retry, not one that looks hung.
+ */
+export const DEFAULT_APPROVAL_TIMEOUT_MS = 60_000;