@skrr-ai/cli 0.1.115 → 0.1.117

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonScopes.js

@@ -1,95 +1,63 @@
 "use strict";
-/**
- * daemonScopes.ts — daemon-capability scope vocabulary for the
- * non-Mongoose tier.
- *
- * The schema-bound canonical home is
- * `@skrr-ai/data-schemas/common/daemonScopes` — that file owns the
- * Mongoose validators (`VALID_SCOPE_SET`, schema enum allowlists), the
- * consent-screen group metadata (`SCOPE_GROUPS`), and the helper
- * functions that the API server depends on at runtime.
- *
- * This file is the parallel home for tiers that cannot import
- * `@skrr-ai/data-schemas` without dragging Mongoose into their
- * bundle:
- *   - `daemon/` (Node CLI / standalone binary, ships via Bun compile)
- *   - `desktop/` (Electron main process, lean bundle)
- *   - `cli/` (oclif Sky CLI)
- *
- * The two homes are kept byte-equal at CI time by
- * `api/server/services/Auth/__tests__/daemonScopes.parity.spec.js`.
- * A new scope MUST be added in BOTH files; the parity test fails on
- * any drift before merge.
- *
- * # Vocabulary stability
- *
- * The six strings are user-visible (consent screens) and persisted
- * (JWT claims, Mongo column values, Redis hash fields, audit logs).
- * Renaming a scope is a breaking change for every credential already
- * minted with the old value. Add new scopes, deprecate old ones —
- * never rename in place.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAUTH_CLI_SCOPE = exports.VALID_DAEMON_SCOPE_SET = exports.DEFAULT_DAEMON_SCOPES = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
-exports.isDaemonScope = isDaemonScope;
-/**
- * The canonical daemon scope vocabulary. Seven strings, append-only.
- *
- *   - `daemon:tools:bash`        — bash tool execution
- *   - `daemon:tools:fs:read`     — Read tool (file read)
- *   - `daemon:tools:fs:write`    — Write + Edit tools (file mutation)
- *   - `daemon:browser:cdp`       — browser automation via CDP (reserved)
- *   - `daemon:native-ui:control` — native app GUI control via the helper
- *   - `daemon:session:replay`    — `daemon:session:replay` socket event
- *   - `daemon:offline-queue`     — daemon-initiated offline queue
- *
- * Order is the consent-screen render order: tools-first, I/O second,
- * control-flow last.
- *
- * `daemon:native-ui:control` is deliberately NOT folded into
- * `daemon:tools:bash`: a token minted to run shell commands must not
- * thereby be able to click around the user's desktop (OSK-11009).
- */
-exports.SCOPES = Object.freeze({
-    TOOLS_BASH: 'daemon:tools:bash',
-    TOOLS_FS_READ: 'daemon:tools:fs:read',
-    TOOLS_FS_WRITE: 'daemon:tools:fs:write',
-    BROWSER_CDP: 'daemon:browser:cdp',
-    NATIVE_UI_CONTROL: 'daemon:native-ui:control',
-    COMPUTER_USE_CONTROL: 'daemon:computer-use:control',
-    SESSION_REPLAY: 'daemon:session:replay',
-    OFFLINE_QUEUE: 'daemon:offline-queue',
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var daemonScopes_exports = {};
+__export(daemonScopes_exports, {
+  ALL_DAEMON_SCOPES: () => ALL_DAEMON_SCOPES,
+  DEFAULT_DAEMON_SCOPES: () => DEFAULT_DAEMON_SCOPES,
+  OAUTH_CLI_SCOPE: () => OAUTH_CLI_SCOPE,
+  SCOPES: () => SCOPES,
+  VALID_DAEMON_SCOPE_SET: () => VALID_DAEMON_SCOPE_SET,
+  isDaemonScope: () => isDaemonScope
 });
-/**
- * All daemon scopes in canonical order. Login defaults are a separate opt-in policy. Frozen so consumers can
- * pass it directly to OAuth `scope` parameters without defensive
- * copies.
- */
-exports.ALL_DAEMON_SCOPES = Object.freeze([
-    exports.SCOPES.TOOLS_BASH,
-    exports.SCOPES.TOOLS_FS_READ,
-    exports.SCOPES.TOOLS_FS_WRITE,
-    exports.SCOPES.BROWSER_CDP,
-    exports.SCOPES.NATIVE_UI_CONTROL,
-    exports.SCOPES.COMPUTER_USE_CONTROL,
-    exports.SCOPES.SESSION_REPLAY,
-    exports.SCOPES.OFFLINE_QUEUE,
+module.exports = __toCommonJS(daemonScopes_exports);
+const SCOPES = Object.freeze({
+  TOOLS_BASH: "daemon:tools:bash",
+  TOOLS_FS_READ: "daemon:tools:fs:read",
+  TOOLS_FS_WRITE: "daemon:tools:fs:write",
+  BROWSER_CDP: "daemon:browser:cdp",
+  NATIVE_UI_CONTROL: "daemon:native-ui:control",
+  COMPUTER_USE_CONTROL: "daemon:computer-use:control",
+  SESSION_REPLAY: "daemon:session:replay",
+  OFFLINE_QUEUE: "daemon:offline-queue"
+});
+const ALL_DAEMON_SCOPES = Object.freeze([
+  SCOPES.TOOLS_BASH,
+  SCOPES.TOOLS_FS_READ,
+  SCOPES.TOOLS_FS_WRITE,
+  SCOPES.BROWSER_CDP,
+  SCOPES.NATIVE_UI_CONTROL,
+  SCOPES.COMPUTER_USE_CONTROL,
+  SCOPES.SESSION_REPLAY,
+  SCOPES.OFFLINE_QUEUE
 ]);
-/** Login defaults retain the existing surface; script control is explicit opt-in. */
-exports.DEFAULT_DAEMON_SCOPES = Object.freeze(exports.ALL_DAEMON_SCOPES.filter((scope) => scope !== exports.SCOPES.COMPUTER_USE_CONTROL));
-/**
- * Set form of `ALL_DAEMON_SCOPES` for O(1) membership checks.
- */
-exports.VALID_DAEMON_SCOPE_SET = new Set(exports.ALL_DAEMON_SCOPES);
-/** Type guard for canonical daemon-scope strings. */
+const DEFAULT_DAEMON_SCOPES = Object.freeze(ALL_DAEMON_SCOPES.filter((scope) => scope !== SCOPES.COMPUTER_USE_CONTROL));
+const VALID_DAEMON_SCOPE_SET = new Set(ALL_DAEMON_SCOPES);
 function isDaemonScope(s) {
-    return typeof s === 'string' && exports.VALID_DAEMON_SCOPE_SET.has(s);
+  return typeof s === "string" && VALID_DAEMON_SCOPE_SET.has(s);
 }
-/**
- * `cli` — REST-only sign-in grant for first-party CLI clients. Peer
- * to the daemon scopes; lives on `OAuthClient.allowedScopes` for
- * the `oversky-cli` client. See the data-schemas canonical for the
- * full reasoning behind keeping this OUT of `ALL_DAEMON_SCOPES` (the
- * grandfather sentinel `expandScopes(undefined)` would over-grant).
- */
-exports.OAUTH_CLI_SCOPE = 'cli';
+const OAUTH_CLI_SCOPE = "cli";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ALL_DAEMON_SCOPES,
+  DEFAULT_DAEMON_SCOPES,
+  OAUTH_CLI_SCOPE,
+  SCOPES,
+  VALID_DAEMON_SCOPE_SET,
+  isDaemonScope
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonToolApproval.js

@@ -1,222 +1,161 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS = exports.ATTESTED_TOOL_APPROVAL_TTL_MS = exports.DAEMON_TOOL_CATEGORIES = exports.DAEMON_TOOL_READ_ONLY_CAPABILITY = exports.DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = void 0;
-exports.categoryForDaemonTool = categoryForDaemonTool;
-exports.canonicalApprovalJson = canonicalApprovalJson;
-exports.canonicalToolInputDigest = canonicalToolInputDigest;
-exports.mintAttestedToolApproval = mintAttestedToolApproval;
-exports.verifyAttestedToolApproval = verifyAttestedToolApproval;
-exports.verifyAttestedToolApprovalClaims = verifyAttestedToolApprovalClaims;
-const node_crypto_1 = require("node:crypto");
-/**
- * Server-attested tool approval (OSK-11975 follow-up to the `manual` mode
- * refusal on `daemon:tool:request`).
- *
- * A daemon category in `manual` mode means "a PERSON approves each call". On
- * the harness-session path the daemon asks through the permission bridge; on
- * the daemon-tool path a cloud agent's call used to be refused outright,
- * because the request carried no approval and there was no channel back to a
- * person. The attested-approval protocol closes that gap without weakening
- * the guarantee:
- *
- *   1. The daemon announces `daemon_tool_attested_approval_v1` and its
- *      resolved per-category posture (`toolPermissionModes`) at register time.
- *   2. Before proxying a call, the server reads the announced posture for the
- *      tool's category. `manual` means it must ask first — through the same
- *      permission surface (`canUseTool` → `permission:request`) an in-process
- *      SDK turn would have used — and only then dispatch, carrying an
- *      `attestedApproval` object on the request.
- *   3. The daemon verifies the attestation's SHAPE and BINDING — it is bound
- *      to this exact (toolUseId, toolName, toolInput digest) and expires
- *      quickly — and allows the call. A missing or malformed attestation gets
- *      the same named refusal as before.
- *
- * What the daemon verifies is the binding, not the server's honesty: the
- * request already arrives over the daemon's authenticated server channel, so
- * the field IS the attestation — it is unsigned, and `decidedBy` is a literal.
- * What the binding buys is that the model — which authors `toolInput` —
- * cannot mint an approval, and an approval for one call cannot be replayed
- * onto another. The verifier also bounds the validity window itself (never
- * trusting the issuer's `expiresAt` beyond `ATTESTED_TOOL_APPROVAL_TTL_MS`),
- * and the daemon spends each approval once: a second delivery of the same
- * attestation inside its window is refused as `replayed`. That ledger lives
- * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
- *
- * v2 (OSK-16614, `toolApprovalSignature.ts`) carries the same claims signed by
- * a platform Ed25519 key and bound to the daemon and session; a daemon that has
- * pinned the platform's keyset accepts only v2. This module stays the v1
- * format and the checks both versions share.
- */
-/** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
-exports.DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = 'daemon_tool_attested_approval_v1';
-/**
- * Announced by a daemon that honours `toolPosture: 'read_only'` on
- * daemon:tool:request — the daemon-tool-path expression of the wire `plan`
- * session mode: reads run, every mutating category is refused with a named
- * reason. Carries INTENT like `browserPolicy: 'read_only'` — the daemon owns
- * what read-only means, so the server cannot widen the fence by shipping a
- * wider value.
- */
-exports.DAEMON_TOOL_READ_ONLY_CAPABILITY = 'daemon_tool_read_only_v1';
-exports.DAEMON_TOOL_CATEGORIES = [
-    'read',
-    'write',
-    'bash',
-    'browser',
-    'claude_session',
-    'native_ui',
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var daemonToolApproval_exports = {};
+__export(daemonToolApproval_exports, {
+  ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS: () => ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS,
+  ATTESTED_TOOL_APPROVAL_TTL_MS: () => ATTESTED_TOOL_APPROVAL_TTL_MS,
+  DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY: () => DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY,
+  DAEMON_TOOL_CATEGORIES: () => DAEMON_TOOL_CATEGORIES,
+  DAEMON_TOOL_READ_ONLY_CAPABILITY: () => DAEMON_TOOL_READ_ONLY_CAPABILITY,
+  canonicalApprovalJson: () => canonicalApprovalJson,
+  canonicalToolInputDigest: () => canonicalToolInputDigest,
+  categoryForDaemonTool: () => categoryForDaemonTool,
+  mintAttestedToolApproval: () => mintAttestedToolApproval,
+  verifyAttestedToolApproval: () => verifyAttestedToolApproval,
+  verifyAttestedToolApprovalClaims: () => verifyAttestedToolApprovalClaims
+});
+module.exports = __toCommonJS(daemonToolApproval_exports);
+var import_node_crypto = require("node:crypto");
+const DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = "daemon_tool_attested_approval_v1";
+const DAEMON_TOOL_READ_ONLY_CAPABILITY = "daemon_tool_read_only_v1";
+const DAEMON_TOOL_CATEGORIES = [
+  "read",
+  "write",
+  "bash",
+  "browser",
+  "claude_session",
+  "native_ui"
 ];
-/** Map a tool name to its category. Unknown tools take the restrictive answer. */
 function categoryForDaemonTool(toolName) {
-    switch (String(toolName || '').toLowerCase()) {
-        case 'read':
-        case 'glob':
-        case 'grep':
-        case 'filetransferread':
-        case 'filelist':
-        case 'filestat':
-        case 'filereadtagged':
-            return 'read';
-        case 'write':
-        case 'edit':
-        case 'multiedit':
-        case 'apply_patch':
-        case 'filetransferwrite':
-        case 'filemkdir':
-        case 'filemove':
-        case 'filedelete':
-        case 'filewritetagged':
-            return 'write';
-        // Reading or stopping a background command is part of running it.
-        case 'bash':
-        case 'taskoutput':
-        case 'taskstop':
-            return 'bash';
-        case 'browser':
-            return 'browser';
-        case 'native':
-            return 'native_ui';
-        case 'claude_session':
-        case 'claude-session':
-            return 'claude_session';
-        default:
-            return 'write';
-    }
+  switch (String(toolName || "").toLowerCase()) {
+    case "read":
+    case "glob":
+    case "grep":
+    case "filetransferread":
+    case "filelist":
+    case "filestat":
+    case "filereadtagged":
+      return "read";
+    case "write":
+    case "edit":
+    case "multiedit":
+    case "apply_patch":
+    case "filetransferwrite":
+    case "filemkdir":
+    case "filemove":
+    case "filedelete":
+    case "filewritetagged":
+      return "write";
+    // Reading or stopping a background command is part of running it.
+    case "bash":
+    case "taskoutput":
+    case "taskstop":
+      return "bash";
+    case "browser":
+      return "browser";
+    case "native":
+      return "native_ui";
+    case "claude_session":
+    case "claude-session":
+      return "claude_session";
+    default:
+      return "write";
+  }
 }
-// ---------------------------------------------------------------------------
-// Attested approval
-// ---------------------------------------------------------------------------
-/**
- * How long an attestation stays valid. Short: it answers ONE person, about
- * THIS call, moments ago — it is not a standing grant. The server asks and
- * dispatches back-to-back, so the window only has to outlive publish latency.
- */
-exports.ATTESTED_TOOL_APPROVAL_TTL_MS = 60 * 1000;
-/**
- * Deterministic serialization for the input digest: objects sort keys
- * recursively, arrays keep order, non-JSON values normalize the way
- * `JSON.stringify` would emit them (undefined/functions in objects drop, in
- * arrays become null). Both runtimes must digest the SAME bytes — the server
- * mints and the daemon verifies — so this lives here, once.
- */
+const ATTESTED_TOOL_APPROVAL_TTL_MS = 60 * 1e3;
 function canonicalApprovalJson(value) {
-    return canonicalJson(value);
+  return canonicalJson(value);
 }
 function canonicalJson(value) {
-    if (value === null || typeof value !== 'object') {
-        if (value === undefined || typeof value === 'function' || typeof value === 'symbol') {
-            return 'null';
-        }
-        return JSON.stringify(value);
-    }
-    if (Array.isArray(value)) {
-        return `[${value.map((entry) => canonicalJson(entry)).join(',')}]`;
+  if (value === null || typeof value !== "object") {
+    if (value === void 0 || typeof value === "function" || typeof value === "symbol") {
+      return "null";
     }
-    const record = value;
-    const keys = Object.keys(record).filter((key) => record[key] !== undefined &&
-        typeof record[key] !== 'function' &&
-        typeof record[key] !== 'symbol');
-    keys.sort();
-    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(',')}}`;
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((entry) => canonicalJson(entry)).join(",")}]`;
+  }
+  const record = value;
+  const keys = Object.keys(record).filter((key) => record[key] !== void 0 && typeof record[key] !== "function" && typeof record[key] !== "symbol");
+  keys.sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
 }
-/** The digest both sides compute over `toolInput`. */
 function canonicalToolInputDigest(toolInput) {
-    return (0, node_crypto_1.createHash)('sha256')
-        .update(canonicalJson(toolInput ?? {}))
-        .digest('hex');
+  return (0, import_node_crypto.createHash)("sha256").update(canonicalJson(toolInput ?? {})).digest("hex");
 }
-/** Server side: mint the attestation after a person approved THIS call. */
 function mintAttestedToolApproval(args) {
-    const now = args.now ?? Date.now();
-    return {
-        v: 1,
-        toolUseId: args.toolUseId,
-        toolName: args.toolName,
-        inputSha256: canonicalToolInputDigest(args.toolInput),
-        decidedBy: 'user',
-        issuedAt: now,
-        expiresAt: now + (args.ttlMs ?? exports.ATTESTED_TOOL_APPROVAL_TTL_MS),
-    };
+  const now = args.now ?? Date.now();
+  return {
+    v: 1,
+    toolUseId: args.toolUseId,
+    toolName: args.toolName,
+    inputSha256: canonicalToolInputDigest(args.toolInput),
+    decidedBy: "user",
+    issuedAt: now,
+    expiresAt: now + (args.ttlMs ?? ATTESTED_TOOL_APPROVAL_TTL_MS)
+  };
 }
-/**
- * Clock skew tolerated on `issuedAt`: a server clock slightly ahead of the
- * daemon's must not refuse a fresh approval.
- */
-exports.ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS = 30 * 1000;
-/**
- * Daemon side: verify an attestation against the call it claims to approve.
- * Untrusted wire input — every field is checked, and any mismatch is a plain
- * "no approval", never a partial credit. `reason` is for daemon logs; the
- * refusal text stays generic so a probing caller learns nothing new.
- */
+const ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS = 30 * 1e3;
 function verifyAttestedToolApproval(approval, call) {
-    if (approval === undefined || approval === null)
-        return { ok: false, reason: 'absent' };
-    if (typeof approval !== 'object' || Array.isArray(approval)) {
-        return { ok: false, reason: 'malformed' };
-    }
-    const a = approval;
-    if (a.v !== 1 ||
-        typeof a.toolUseId !== 'string' ||
-        typeof a.toolName !== 'string' ||
-        typeof a.inputSha256 !== 'string' ||
-        a.decidedBy !== 'user' ||
-        typeof a.issuedAt !== 'number' ||
-        typeof a.expiresAt !== 'number') {
-        return { ok: false, reason: 'malformed' };
-    }
-    return verifyAttestedToolApprovalClaims({
-        toolUseId: a.toolUseId,
-        toolName: a.toolName,
-        inputSha256: a.inputSha256,
-        issuedAt: a.issuedAt,
-        expiresAt: a.expiresAt,
-    }, call);
+  if (approval === void 0 || approval === null)
+    return { ok: false, reason: "absent" };
+  if (typeof approval !== "object" || Array.isArray(approval)) {
+    return { ok: false, reason: "malformed" };
+  }
+  const a = approval;
+  if (a.v !== 1 || typeof a.toolUseId !== "string" || typeof a.toolName !== "string" || typeof a.inputSha256 !== "string" || a.decidedBy !== "user" || typeof a.issuedAt !== "number" || typeof a.expiresAt !== "number") {
+    return { ok: false, reason: "malformed" };
+  }
+  return verifyAttestedToolApprovalClaims({
+    toolUseId: a.toolUseId,
+    toolName: a.toolName,
+    inputSha256: a.inputSha256,
+    issuedAt: a.issuedAt,
+    expiresAt: a.expiresAt
+  }, call);
 }
-/**
- * The checks every attestation version shares once its claims are trusted to
- * be what the issuer wrote: freshness, the verifier-owned window, and the
- * binding to this exact call. v1 reaches here after a shape check; v2
- * (`toolApprovalSignature.ts`) only after its signature verified, so one
- * implementation decides "expired", "window" and "binding" for both.
- */
 function verifyAttestedToolApprovalClaims(a, call) {
-    const now = call.now ?? Date.now();
-    if (a.expiresAt <= now || a.issuedAt > now + exports.ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS) {
-        return { ok: false, reason: 'expired' };
-    }
-    // The TTL is the VERIFIER's bound, not the issuer's claim (OSK-12108): an
-    // attestation whose own window is longer than one approval may stay valid
-    // is refused whatever `expiresAt` says, so "answers one person about this
-    // call, moments ago" holds even against an issuer that set a year.
-    const window = a.expiresAt - a.issuedAt;
-    if (!(window > 0) || window > exports.ATTESTED_TOOL_APPROVAL_TTL_MS) {
-        return { ok: false, reason: 'window' };
-    }
-    if (a.toolUseId !== call.toolUseId ||
-        a.toolName.toLowerCase() !== String(call.toolName).toLowerCase() ||
-        a.inputSha256 !== canonicalToolInputDigest(call.toolInput)) {
-        return { ok: false, reason: 'binding' };
-    }
-    return { ok: true };
+  const now = call.now ?? Date.now();
+  if (a.expiresAt <= now || a.issuedAt > now + ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS) {
+    return { ok: false, reason: "expired" };
+  }
+  const window = a.expiresAt - a.issuedAt;
+  if (!(window > 0) || window > ATTESTED_TOOL_APPROVAL_TTL_MS) {
+    return { ok: false, reason: "window" };
+  }
+  if (a.toolUseId !== call.toolUseId || a.toolName.toLowerCase() !== String(call.toolName).toLowerCase() || a.inputSha256 !== canonicalToolInputDigest(call.toolInput)) {
+    return { ok: false, reason: "binding" };
+  }
+  return { ok: true };
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS,
+  ATTESTED_TOOL_APPROVAL_TTL_MS,
+  DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY,
+  DAEMON_TOOL_CATEGORIES,
+  DAEMON_TOOL_READ_ONLY_CAPABILITY,
+  canonicalApprovalJson,
+  canonicalToolInputDigest,
+  categoryForDaemonTool,
+  mintAttestedToolApproval,
+  verifyAttestedToolApproval,
+  verifyAttestedToolApprovalClaims
+});