@webskill/sdk 0.0.4 → 0.0.6

package/dist/{dist-Bvhbxrrt.js → dist-33_zuOCm.js}

@@ -1,4 +1,5 @@
-import { A as parseBridgeRequest, C as bridgeError, H as WebSkillError, I as SKILLS_LOCKFILE, J as isValidSkillName, L as SKILL_MANIFEST_FILE, W as buildManifest, Z as parseSkillMarkdown, et as resolveInsideRoot, k as normalizeToolContent, nt as verifyManifest, o as FsArtifactStore, s as FsMemoryStore, tt as validateSkills } from "./dist-COsE72Ct.js";
+import { F as parseBridgeRequest, G as SKILL_PACK_FILE, H as SKILL_MANIFEST_FILE, J as WebSkillError, N as networkUrlHost, P as normalizeToolContent, V as SKILLS_LOCKFILE, X as buildManifest, a as CapabilityApproval, at as parseSkillMarkdown, c as FsMemoryStore, dt as verifyManifest, j as isNetworkAllowed, lt as resolveInsideRoot, nt as isValidSkillName, ot as parseSkillPackManifest, s as FsArtifactStore, tt as exportSkills, ut as validateSkills, w as bridgeError } from "./dist-nXiR40hi.js";
+import { unzipSync, zipSync } from "fflate";
 import { existsSync, promises, readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -8,7 +9,6 @@ import { parseSync } from "oxc-parser";
 import { createInterface } from "node:readline/promises";
 import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { unzipSync, zipSync } from "fflate";
 import * as tar from "tar";
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -224,6 +224,11 @@ var NodeScriptExecutor = class {
 const baseName = (p) => p.split("/").pop() ?? p;
 const toPlatform$1 = (p) => p.split("/").join(path.sep);
 const messageOf$5 = (e) => e instanceof Error ? e.message : String(e);
+/**
+* 网络策略判定函数源码（注入 Worker；匹配逻辑单一来源在
+* runtime/sandbox/networkPolicy.ts，Worker 线程不走 vitest 别名故注入而非 import）
+*/
+const NETWORK_POLICY_LIB = `${isNetworkAllowed.toString()}\n${networkUrlHost.toString()}`;
 /** Worker 入口文件：src 为同目录 .ts；dist 为 dist/executor/ 下的 .js */
 function workerEntryPath() {
 	const dir = path.dirname(fileURLToPath(import.meta.url));
@@ -245,6 +250,8 @@ var SandboxedScriptExecutor = class {
 	#fs;
 	#options;
 	#capabilities;
+	#networkPolicy;
+	#approval;
 	constructor(fs, options = {}) {
 		this.#fs = fs;
 		this.#options = options;
@@ -253,6 +260,11 @@ var SandboxedScriptExecutor = class {
 			writeArtifact: options.capabilities?.writeArtifact ?? true,
 			confirm: options.capabilities?.confirm ?? true
 		};
+		this.#networkPolicy = options.networkPolicy ?? "deny-all";
+		this.#approval = new CapabilityApproval({
+			...options.uiBridge ? { uiBridge: options.uiBridge } : {},
+			...options.approvalScope ? { scope: options.approvalScope } : {}
+		});
 	}
 	async #locateScript(skillRoot, scriptName) {
 		const tsPath = `${skillRoot}/scripts/${scriptName}.ts`;
@@ -302,7 +314,7 @@ var SandboxedScriptExecutor = class {
 				skillName: context.skillName,
 				runId: context.runId,
 				args
-			}, timeoutMs, (request) => this.#handleBridge(request, context));
+			}, timeoutMs, (request) => this.#handleBridge(request, context), (host) => context.onWarning?.(`Network request blocked by sandbox network policy: ${host}`));
 			if (!result.ok) {
 				const stderrSummary = result.stderr?.length ? ` | stderr: ${result.stderr.join(" | ").slice(0, 500)}` : "";
 				return {
@@ -335,12 +347,16 @@ var SandboxedScriptExecutor = class {
 		}
 	}
 	/** 起独立 Worker 执行任务；超时 terminate（同步死循环可杀）；非零退出码 → TOOL_EXECUTION_FAILED */
-	#runWorker(workerData, timeoutMs = 3e4, onBridge) {
+	#runWorker(workerData, timeoutMs = 3e4, onBridge, onNetworkBlocked) {
 		const envWhitelist = this.#options.envWhitelist ?? [];
 		const env = Object.fromEntries(envWhitelist.filter((key) => process.env[key] !== void 0).map((key) => [key, process.env[key]]));
 		return new Promise((resolve, reject) => {
 			const worker = new Worker(workerEntryPath(), {
-				workerData,
+				workerData: {
+					...workerData,
+					networkPolicy: this.#networkPolicy,
+					networkPolicyLib: NETWORK_POLICY_LIB
+				},
 				env,
 				resourceLimits: this.#options.resourceLimits ?? {
 					maxOldGenerationSizeMb: 64,
@@ -361,6 +377,10 @@ var SandboxedScriptExecutor = class {
 				fn();
 			};
 			worker.on("message", (msg) => {
+				if (msg?.type === "network-blocked") {
+					if (typeof msg.host === "string") onNetworkBlocked?.(msg.host);
+					return;
+				}
 				if (msg?.type === "bridge" && onBridge) {
 					const request = parseBridgeRequest(msg.request);
 					const respond = (response) => worker.postMessage({
@@ -382,20 +402,36 @@ var SandboxedScriptExecutor = class {
 			});
 		});
 	}
-	/** 能力桥宿主侧处理：能力关闭即 TOOL_UNSUPPORTED；委托 context */
+	/** 能力桥宿主侧处理：能力关闭/授权拒绝即 TOOL_UNSUPPORTED；判定逻辑共用 runtime/sandbox/approval */
 	async #handleBridge(request, context) {
-		const unsupported = (capability) => bridgeError(request.id, "TOOL_UNSUPPORTED", `Capability "${capability}" is disabled`);
+		const gate = async (capability, message, details) => {
+			const decision = await this.#approval.authorize({
+				runId: context.runId,
+				capability,
+				mode: this.#capabilities[capability],
+				message,
+				...details !== void 0 ? { details } : {}
+			});
+			if (decision === "allowed") return void 0;
+			return bridgeError(request.id, "TOOL_UNSUPPORTED", decision === "disabled" ? `Capability "${capability}" is disabled` : `Capability "${capability}" was denied by the user`);
+		};
 		try {
 			switch (request.kind) {
-				case "readReference":
-					if (!this.#capabilities.readReference) return unsupported("readReference");
+				case "readReference": {
+					const denied = await gate("readReference", `Script "${context.skillName}" wants to read reference "${request.path}"`, { path: request.path });
+					if (denied) return denied;
 					return {
 						id: request.id,
 						ok: true,
 						value: await context.readReference(request.path)
 					};
+				}
 				case "writeArtifact": {
-					if (!this.#capabilities.writeArtifact) return unsupported("writeArtifact");
+					const denied = await gate("writeArtifact", `Script "${context.skillName}" wants to write artifact "${request.path}"`, {
+						path: request.path,
+						mimeType: request.mimeType
+					});
+					if (denied) return denied;
 					const content = typeof request.content === "string" ? request.content : new Uint8Array(request.content);
 					const artifact = await context.writeArtifact(request.path, content, { ...request.mimeType ? { mimeType: request.mimeType } : {} });
 					return {
@@ -404,13 +440,16 @@ var SandboxedScriptExecutor = class {
 						value: artifact
 					};
 				}
-				case "confirm":
-					if (!this.#capabilities.confirm || !context.confirm) return unsupported("confirm");
+				case "confirm": {
+					if (!context.confirm) return bridgeError(request.id, "TOOL_UNSUPPORTED", "Capability \"confirm\" is disabled");
+					const denied = await gate("confirm", `Script "${context.skillName}" asks for confirmation: ${request.message}`);
+					if (denied) return denied;
 					return {
 						id: request.id,
 						ok: true,
 						value: await context.confirm(request.message)
 					};
+				}
 			}
 		} catch (e) {
 			return bridgeError(request.id, e instanceof WebSkillError ? e.code : "TOOL_EXECUTION_FAILED", messageOf$5(e));
@@ -615,7 +654,8 @@ var FileMemoryStore = class extends FsMemoryStore {
 };
 /**
 * 命令行 UiBridge：ask→问答，confirm→y/n（带默认值），
-* form→逐字段提示（显示默认值与必填标记），select→编号列表。
+* form→逐字段提示（显示默认值与必填标记），select→编号列表，
+* authorize→授权询问（默认拒绝，仅显式 y/yes 批准）。
 * 输入/输出流可注入（测试用 PassThrough）。
 */
 var CliUiBridge = class {
@@ -659,6 +699,14 @@ var CliUiBridge = class {
 					value: option ? option.value : void 0
 				};
 			}
+			case "authorize": {
+				this.#write(`[authorization required: ${input.capability}]\n`);
+				const answer = (await this.#question(`${input.message} [y/N] `)).trim().toLowerCase();
+				return {
+					id: input.id,
+					value: answer === "y" || answer === "yes"
+				};
+			}
 		}
 	}
 	async progress(input) {
@@ -923,6 +971,15 @@ async function stageHttp(source, ctx, expectedSha256) {
 		await ctx.fs.writeBinary(archivePath, data);
 		await extractTarFile(toPlatform(archivePath), toPlatform(contentDir));
 	}
+	const packFilePath = `${contentDir}/${SKILL_PACK_FILE}`;
+	if (await ctx.fs.exists(packFilePath)) return {
+		skillDir: "",
+		source,
+		pack: {
+			contentDir,
+			manifest: parseSkillPackManifest(await ctx.fs.readText(packFilePath))
+		}
+	};
 	if (await ctx.fs.exists(`${contentDir}/SKILL.md`)) return {
 		skillDir: contentDir,
 		source
@@ -1109,6 +1166,7 @@ var SkillManager = class {
 					break;
 				case "archive": throw new WebSkillError("TOOL_UNSUPPORTED", "The \"archive\" install source is only supported by the browser skill manager");
 			}
+			if (staged.pack) return (await this.#installPack(staged.pack, staged.source, stagingRoot))[0];
 			let name;
 			let version;
 			try {
@@ -1150,6 +1208,61 @@ var SkillManager = class {
 		}
 	}
 	/**
+	* 包集安装：逐技能走单技能管线（归一 → 汇总校验 → 落 managed root → manifest → digest 比对）。
+	* 任一失败整体回滚（删除本次已落目录；lockfile 在全部成功后才写入，天然零残留）。
+	* 包是封闭产物：跳过安装期 schema 推导（sidecar 已随包携带，保证 digest 逐字节一致）。
+	*/
+	async #installPack(pack, source, stagingRoot) {
+		const fs = this.#fs;
+		const finalRoot = `${stagingRoot}/final`;
+		const installed = [];
+		try {
+			const versions = /* @__PURE__ */ new Map();
+			for (const entry of pack.manifest.skills) {
+				const skillDir = `${pack.contentDir}/${entry.name}`;
+				if (!await fs.exists(`${skillDir}/SKILL.md`)) throw new WebSkillError("INSTALL_FAILED", `Skill pack is missing a directory for skill "${entry.name}"`);
+				let name;
+				try {
+					const { metadata } = parseSkillMarkdown(await fs.readText(`${skillDir}/SKILL.md`));
+					name = metadata.name;
+					versions.set(name, typeof metadata["version"] === "string" ? metadata["version"] : void 0);
+				} catch (e) {
+					throw new WebSkillError("INSTALL_FAILED", `Failed to read skill name from SKILL.md of pack entry "${entry.name}": ${messageOf(e)}`, e);
+				}
+				if (name !== entry.name) throw new WebSkillError("INSTALL_FAILED", `Skill pack entry "${entry.name}" does not match the SKILL.md name "${name}"`);
+				await copyDir(fs, skillDir, `${finalRoot}/${name}`);
+			}
+			const report = await validateSkills(fs, [finalRoot]);
+			if (!report.ok) {
+				const errors = report.issues.filter((i) => i.severity === "error");
+				throw new WebSkillError("INSTALL_FAILED", `Skill pack failed validation: ${errors.map((i) => i.message).join("; ")}`, errors);
+			}
+			const manifests = [];
+			for (const entry of pack.manifest.skills) {
+				const targetDir = `${this.#managedRoot}/${entry.name}`;
+				if (await fs.exists(targetDir)) await fs.remove(targetDir, { recursive: true });
+				await copyDir(fs, `${finalRoot}/${entry.name}`, targetDir);
+				installed.push(targetDir);
+				const manifest = await createManifest(fs, targetDir, {
+					name: entry.name,
+					...versions.get(entry.name) ? { version: versions.get(entry.name) } : {},
+					source
+				});
+				if (manifest.integrity.digest !== entry.digest) throw new WebSkillError("INSTALL_FAILED", `Skill "${entry.name}" digest mismatch: expected ${entry.digest}, got ${manifest.integrity.digest}`);
+				manifests.push(manifest);
+			}
+			for (const manifest of manifests) await upsertLockEntry(fs, this.#managedRoot, manifest.name, {
+				digest: manifest.integrity.digest,
+				installedAt: manifest.installedAt,
+				source
+			});
+			return manifests;
+		} catch (e) {
+			for (const targetDir of installed) await removeDirQuiet(fs, targetDir);
+			throw asInstallFailed(e);
+		}
+	}
+	/**
 	* D2 安装期预推导：scripts/ 下无显式 inputSchema 导出且无 sidecar 的脚本，
 	* 经 OXC 推导写 sidecar（计入 manifest.files；重装重新生成）
 	*/
@@ -1195,6 +1308,21 @@ var SkillManager = class {
 		if (!await this.#fs.exists(skillRoot)) throw new WebSkillError("EXPORT_FAILED", `Skill "${name}" is not installed`);
 		return exportArchive(this.#fs, skillRoot, options);
 	}
+	/** 多技能包集导出（webskill.skill-pack.json + 各技能目录含 manifest），写 outPath 并返回 */
+	async exportPack(names, options) {
+		if (names.length === 0) throw new WebSkillError("EXPORT_FAILED", "exportPack requires at least one skill name");
+		const roots = names.map((name) => {
+			if (!isValidSkillName(name)) throw new WebSkillError("EXPORT_FAILED", `Invalid skill name (path traversal rejected): ${JSON.stringify(name)}`);
+			return `${this.#managedRoot}/${name}`;
+		});
+		for (const [index, root] of roots.entries()) if (!await this.#fs.exists(root)) throw new WebSkillError("EXPORT_FAILED", `Skill "${names[index]}" is not installed`);
+		const bytes = await exportSkills(this.#fs, {
+			roots,
+			manifestBuilder: (root) => readManifest(this.#fs, root)
+		});
+		await this.#fs.writeBinary(options.outPath, bytes);
+		return options.outPath;
+	}
 };
 /**
 * 解析 .env（简单 KEY=VALUE 行解析，不引依赖），

package/dist/{dist-RcqvzAGF.js → dist-BQruQ9Hv.js}

@@ -5,10 +5,11 @@ function shapeInteractionValue(model, values) {
 		case "ask": return values["answer"];
 		case "confirm": return values["confirmed"] === true;
 		case "select": return values["selected"];
+		case "authorize": return true;
 		case "form": return values;
 	}
 }
-/** 四类 InteractionRequest → 统一中间模型（框架无关） */
+/** 五类 InteractionRequest → 统一中间模型（框架无关） */
 function interactionToFormModel(request) {
 	switch (request.type) {
 		case "ask": return {
@@ -63,6 +64,14 @@ function interactionToFormModel(request) {
 			submitLabel: "Select",
 			cancelLabel: "Cancel"
 		};
+		case "authorize": return {
+			kind: "authorize",
+			title: "Authorization required",
+			message: request.message,
+			controls: [],
+			submitLabel: "Allow",
+			cancelLabel: "Deny"
+		};
 	}
 }
 const isEmpty = (v) => v === void 0 || v === "";
@@ -181,9 +190,219 @@ function renderMiniMarkdown(text, doc) {
 	}
 	return root;
 }
-/** RenderBlock → DOM（markdown/json/table/image/file 五种） */
+/**
+* 轻量 SVG 图表自绘（bar/line/pie，零依赖，三端复用单一来源）。
+* 全部经 doc.createElementNS 构建（内容来自技能输出，不拼 innerHTML）。
+*/
+const SVG_NS = "http://www.w3.org/2000/svg";
+/** 固定 8 色循环调色板 */
+const CHART_PALETTE = [
+	"#4e79a7",
+	"#f28e2b",
+	"#e15759",
+	"#76b7b2",
+	"#59a14f",
+	"#edc948",
+	"#b07aa1",
+	"#ff9da7"
+];
+const WIDTH = 320;
+const HEIGHT = 200;
+function el(doc, name, attrs) {
+	const node = doc.createElementNS(SVG_NS, name);
+	for (const [key, value] of Object.entries(attrs)) node.setAttribute(key, value);
+	return node;
+}
+function text$1(doc, x, y, content, attrs = {}) {
+	const node = el(doc, "text", {
+		x: String(x),
+		y: String(y),
+		"font-size": "9",
+		fill: "#555",
+		...attrs
+	});
+	node.textContent = content;
+	return node;
+}
+const fmt = (n) => Number.isInteger(n) ? String(n) : n.toFixed(1);
+function maxValue(chart) {
+	let max = 0;
+	for (const s of chart.series) for (const v of s.data) if (v > max) max = v;
+	return max;
+}
+function renderBar(chart, svg, doc) {
+	const plot = {
+		x0: 30,
+		y0: 24,
+		x1: 312,
+		y1: 164
+	};
+	const max = maxValue(chart);
+	svg.appendChild(el(doc, "line", {
+		x1: String(plot.x0),
+		y1: String(plot.y0),
+		x2: String(plot.x0),
+		y2: String(plot.y1),
+		stroke: "#999"
+	}));
+	svg.appendChild(el(doc, "line", {
+		x1: String(plot.x0),
+		y1: String(plot.y1),
+		x2: String(plot.x1),
+		y2: String(plot.y1),
+		stroke: "#999"
+	}));
+	if (max <= 0 || chart.labels.length === 0 || chart.series.length === 0) return;
+	const groupWidth = (plot.x1 - plot.x0) / chart.labels.length;
+	const barWidth = Math.max(1, groupWidth / chart.series.length * .7);
+	chart.series.forEach((series, si) => {
+		const color = CHART_PALETTE[si % CHART_PALETTE.length];
+		series.data.forEach((value, li) => {
+			if (li >= chart.labels.length) return;
+			const height = (plot.y1 - plot.y0) * value / max;
+			const x = plot.x0 + li * groupWidth + (groupWidth - barWidth * chart.series.length) / 2 + si * barWidth;
+			const y = plot.y1 - height;
+			svg.appendChild(el(doc, "rect", {
+				x: String(x),
+				y: String(y),
+				width: String(barWidth),
+				height: String(height),
+				fill: color,
+				"data-series": series.name ?? String(si)
+			}));
+			if (chart.series.length === 1) svg.appendChild(text$1(doc, x + barWidth / 2, y - 2, fmt(value), { "text-anchor": "middle" }));
+		});
+	});
+	chart.labels.forEach((label, li) => {
+		svg.appendChild(text$1(doc, plot.x0 + li * groupWidth + groupWidth / 2, plot.y1 + 12, label, { "text-anchor": "middle" }));
+	});
+}
+function renderLine(chart, svg, doc) {
+	const plot = {
+		x0: 30,
+		y0: 24,
+		x1: 312,
+		y1: 164
+	};
+	const max = maxValue(chart);
+	svg.appendChild(el(doc, "line", {
+		x1: String(plot.x0),
+		y1: String(plot.y0),
+		x2: String(plot.x0),
+		y2: String(plot.y1),
+		stroke: "#999"
+	}));
+	svg.appendChild(el(doc, "line", {
+		x1: String(plot.x0),
+		y1: String(plot.y1),
+		x2: String(plot.x1),
+		y2: String(plot.y1),
+		stroke: "#999"
+	}));
+	if (max <= 0 || chart.labels.length === 0 || chart.series.length === 0) return;
+	const step = chart.labels.length > 1 ? (plot.x1 - plot.x0) / (chart.labels.length - 1) : 0;
+	const px = (li) => chart.labels.length > 1 ? plot.x0 + li * step : (plot.x0 + plot.x1) / 2;
+	const py = (v) => plot.y1 - (plot.y1 - plot.y0) * v / max;
+	chart.series.forEach((series, si) => {
+		const color = CHART_PALETTE[si % CHART_PALETTE.length];
+		const points = series.data.slice(0, chart.labels.length).map((v, li) => `${px(li)},${py(v)}`).join(" ");
+		if (points !== "") svg.appendChild(el(doc, "polyline", {
+			points,
+			fill: "none",
+			stroke: color,
+			"stroke-width": "1.5"
+		}));
+		series.data.slice(0, chart.labels.length).forEach((v, li) => {
+			svg.appendChild(el(doc, "circle", {
+				cx: String(px(li)),
+				cy: String(py(v)),
+				r: "2",
+				fill: color
+			}));
+		});
+	});
+	chart.labels.forEach((label, li) => {
+		svg.appendChild(text$1(doc, px(li), plot.y1 + 12, label, { "text-anchor": "middle" }));
+	});
+}
+function renderPie(chart, svg, doc) {
+	const data = (chart.series[0]?.data ?? []).slice(0, chart.labels.length);
+	const total = data.reduce((sum, v) => sum + (v > 0 ? v : 0), 0);
+	const cx = 90;
+	const cy = 104;
+	const r = 72;
+	if (total <= 0) {
+		svg.appendChild(text$1(doc, cx, cy, "No data", { "text-anchor": "middle" }));
+		return;
+	}
+	let angle = -Math.PI / 2;
+	data.forEach((value, i) => {
+		const label = chart.labels[i] ?? String(i);
+		const color = CHART_PALETTE[i % CHART_PALETTE.length];
+		const slice = Math.max(value, 0) / total * Math.PI * 2;
+		const x0 = cx + r * Math.cos(angle);
+		const y0 = cy + r * Math.sin(angle);
+		const x1 = cx + r * Math.cos(angle + slice);
+		const y1 = cy + r * Math.sin(angle + slice);
+		const path = el(doc, "path", {
+			d: `M ${cx} ${cy} L ${x0} ${y0} A ${r} ${r} 0 ${slice > Math.PI ? "1" : "0"} 1 ${x1} ${y1} Z`,
+			fill: color,
+			"data-label": label
+		});
+		svg.appendChild(path);
+		angle += slice;
+		const ly = 40 + i * 14;
+		svg.appendChild(el(doc, "rect", {
+			x: "190",
+			y: String(ly - 7),
+			width: "8",
+			height: "8",
+			fill: color
+		}));
+		svg.appendChild(text$1(doc, 202, ly, `${label} (${fmt(value)})`));
+	});
+}
+/** ChartSpec → SVG（bar 等宽柱 + 值标签；line 折线 + 点；pie 扇形 + 图例；空数据容错） */
+function renderMiniChart(chart, doc) {
+	const svg = el(doc, "svg", {
+		viewBox: `0 0 ${WIDTH} ${HEIGHT}`,
+		width: String(WIDTH),
+		height: String(HEIGHT),
+		class: `webskill-chart webskill-chart--${chart.kind}`,
+		role: "img"
+	});
+	if (chart.title) svg.appendChild(text$1(doc, WIDTH / 2, 14, chart.title, {
+		"text-anchor": "middle",
+		"font-size": "11",
+		fill: "#333"
+	}));
+	switch (chart.kind) {
+		case "bar":
+			renderBar(chart, svg, doc);
+			break;
+		case "line":
+			renderLine(chart, svg, doc);
+			break;
+		case "pie":
+			renderPie(chart, svg, doc);
+			break;
+	}
+	return svg;
+}
+/** A2UI/OpenUI 降级：chart → table（labels 为首列，series 各为一列） */
+function chartToTable(chart) {
+	return {
+		type: "table",
+		columns: ["label", ...chart.series.map((s, i) => s.name ?? `series ${i + 1}`)],
+		rows: chart.labels.map((label, li) => [label, ...chart.series.map((s) => s.data[li] ?? null)])
+	};
+}
+/** RenderBlock → DOM（markdown/json/table/image/file/chart 六种） */
 function renderBlocks(container, blocks, doc) {
 	for (const block of blocks) switch (block.type) {
+		case "chart":
+			container.appendChild(renderMiniChart(block.chart, doc));
+			break;
 		case "markdown":
 			container.appendChild(renderMiniMarkdown(block.text, doc));
 			break;
@@ -551,6 +770,15 @@ function toOpenUiLang(request) {
 				options: request.options
 			}];
 			break;
+		case "authorize":
+			title = "Authorization required";
+			fields = [{
+				name: "approved",
+				label: request.message,
+				control: "boolean",
+				defaultValue: false
+			}];
+			break;
 	}
 	lines.push(...fieldStatements(fields));
 	const children = fields.map((_, i) => `f${i}`);
@@ -617,7 +845,11 @@ function toA2uiMessages(request) {
 		components.push(text("title", request.title, "h3"));
 		children.push("title");
 	}
-	const message = request.type === "ask" || request.type === "confirm" || request.type === "select" ? request.message : void 0;
+	if (request.type === "authorize") {
+		components.push(text("title", "Authorization required", "h3"));
+		children.push("title");
+	}
+	const message = request.type === "ask" || request.type === "confirm" || request.type === "select" || request.type === "authorize" ? request.message : void 0;
 	if (message) {
 		components.push(text("message", message));
 		children.push("message");
@@ -632,7 +864,7 @@ function toA2uiMessages(request) {
 		label: request.message,
 		type: "boolean",
 		defaultValue: request.defaultValue ?? true
-	}] : [{
+	}] : request.type === "authorize" ? [] : [{
 		name: "selected",
 		label: request.message,
 		type: "select",
@@ -675,7 +907,7 @@ function toA2uiMessages(request) {
 		});
 		children.push(`field_${field.name}`);
 	}
-	components.push(text("submit_label", "Submit"));
+	components.push(text("submit_label", request.type === "authorize" ? "Allow" : "Submit"));
 	components.push({
 		id: "submit",
 		component: "Button",
@@ -686,7 +918,7 @@ function toA2uiMessages(request) {
 			context: { requestId: request.id }
 		} }
 	});
-	components.push(text("cancel_label", "Cancel"));
+	components.push(text("cancel_label", request.type === "authorize" ? "Deny" : "Cancel"));
 	components.push({
 		id: "cancel",
 		component: "Button",
@@ -15359,13 +15591,15 @@ var LitRendererBridge = class {
 				const surfaces = processor.getClientDataModel("v0.9.1")?.surfaces;
 				const formValues = typeof surfaces?.[surfaceId] === "object" && surfaces[surfaceId] !== null ? surfaces[surfaceId]["form"] ?? action.context : action.context;
 				cleanup(surfaceEl);
-				resolve(fromA2uiAction({
+				const response = fromA2uiAction({
 					...action,
 					context: {
 						...action.context,
 						values: formValues
 					}
-				}));
+				});
+				if (input.type === "authorize" && !response.cancelled) response.value = true;
+				resolve(response);
 			}, { version: "v0.9.1" });
 			processor.onSurfaceCreated((surface) => {
 				const el = this.#doc.createElement("a2ui-surface");
@@ -15379,4 +15613,4 @@ var LitRendererBridge = class {
 };
 
 //#endregion
-export { toOpenUiLang as C, toA2uiMessages as S, interactionToFormModel as _, LitRendererBridge as a, renderRenderResult as b, VERCEL_INTERACTION_TOOL_NAME as c, WebFormBridge as d, collectValues as f, fromVercelToolResult as g, fromOpenUiAction as h, A2UI_VERSION as i, VercelUiBridge as l, fromA2uiAction as m, A2UI_CANCEL_ACTION as n, OPENUI_CANCEL_ACTION as o, ensureStyles as p, A2UI_SUBMIT_ACTION as r, OPENUI_SUBMIT_ACTION as s, A2UI_BASIC_CATALOG_ID as t, WEBSKILL_STYLES_CSS as u, renderBlocks as v, toVercelToolInvocation as w, shapeInteractionValue as x, renderMiniMarkdown as y };
+export { renderRenderResult as C, toVercelToolInvocation as D, toOpenUiLang as E, renderMiniMarkdown as S, toA2uiMessages as T, fromOpenUiAction as _, CHART_PALETTE as a, renderBlocks as b, OPENUI_SUBMIT_ACTION as c, WEBSKILL_STYLES_CSS as d, WebFormBridge as f, fromA2uiAction as g, ensureStyles as h, A2UI_VERSION as i, VERCEL_INTERACTION_TOOL_NAME as l, collectValues as m, A2UI_CANCEL_ACTION as n, LitRendererBridge as o, chartToTable as p, A2UI_SUBMIT_ACTION as r, OPENUI_CANCEL_ACTION as s, A2UI_BASIC_CATALOG_ID as t, VercelUiBridge as u, fromVercelToolResult as v, shapeInteractionValue as w, renderMiniChart as x, interactionToFormModel as y };