type ToolCall={name:string;args:Record<string,unknown>;operationId:string};
export function authorizeBrowserTool(session:{actorId:string;scopes:Set<string>},call:ToolCall){
 const policy={"page.readSelection":"browser:read","page.openPublicUrl":"browser:navigate"};
 const required=policy[call.name];
 if(!required || !session.scopes.has(required)) throw Error("tool_not_authorized");
 const args=structuredClone(call.args);
 for(const k of ["cookie","authorization","privateKey","seed","password"]) delete args[k];
 return Object.freeze({actorId:session.actorId,name:call.name,args,operationId:call.operationId});
}