@bolloon/bolloon-agent 0.4.22 → 0.4.24

package/dist/ios/mobile-sync.js

@@ -0,0 +1,193 @@
+/**
+ * 手机端 ↔ 电脑端 bolloon 数据同步
+ *
+ *   登录后 (或设置页手动点「立即同步」) 从电脑端一次拉取全部数据快照:
+ *     channels (会话) / judgments (判断力) / services (Agent Registry) /
+ *     resources (数字资源) / networks (已加入网络) / active (活跃身份)
+ *   落到本地 → 手机端离线也能读; 重复调用幂等, 不覆盖手机端本机会话.
+ *
+ *   依赖: 电脑端 server.ts 的 GET /api/mobile/snapshot (已开 CORS).
+ *   地址持久化在 localStorage (与 mobile-gateway 的 desktopBaseUrl 同一个 key).
+ */
+const URL_KEY = 'bolloon_desktop_base_url';
+const SNAP_KEY = 'bolloon_desktop_snapshot';
+const JUDGE_KEY = 'bolloon_judgments_cache';
+const ORBIT_KEY = 'bolloon_orbit_status';
+function ls() {
+    try {
+        return typeof localStorage !== 'undefined' ? localStorage : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** 电脑端地址 (如 http://192.168.1.5:7788) — 与 mobile-gateway 共用同一 key */
+export function getDesktopUrl() {
+    try {
+        return ls()?.getItem(URL_KEY) || '';
+    }
+    catch {
+        return '';
+    }
+}
+export function setDesktopUrl(url) {
+    try {
+        ls()?.setItem(URL_KEY, String(url || '').trim().replace(/\/+$/, ''));
+    }
+    catch { /* 忽略 */ }
+}
+export function getLastSnapshot() {
+    try {
+        const s = ls()?.getItem(SNAP_KEY);
+        return s ? JSON.parse(s) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** 电脑端同步下来的判断力库 (判断力 API 页离线读取) */
+export function getCachedJudgments() {
+    try {
+        const s = ls()?.getItem(JUDGE_KEY);
+        const a = s ? JSON.parse(s) : [];
+        return Array.isArray(a) ? a : [];
+    }
+    catch {
+        return [];
+    }
+}
+export function getSyncStatus() {
+    const snap = getLastSnapshot();
+    let orbit = null;
+    try {
+        const s = ls()?.getItem(ORBIT_KEY);
+        orbit = s ? JSON.parse(s) : null;
+    }
+    catch {
+        orbit = null;
+    }
+    return { url: getDesktopUrl(), lastTs: (snap && snap.ts) || 0, counts: (snap && snap.counts) || {}, orbit };
+}
+/** OrbitDB 库级复制: 本地副本 ↔ 电脑端 store (双向 merge). 独立入口, 便于本地写后立即推回. */
+export async function replicateOrbit(opts = {}) {
+    try {
+        const o = await import('./mobile-orbit.js');
+        const r = await o.replicateAll({ baseUrl: getDesktopUrl(), fetchImpl: opts.fetchImpl });
+        const out = { ok: r.ok, stores: r.stores, pulled: r.pulled, pushed: r.pushed, entries: r.entries, error: r.error };
+        try {
+            ls()?.setItem(ORBIT_KEY, JSON.stringify(out));
+        }
+        catch { /* 忽略 */ }
+        return out;
+    }
+    catch (e) {
+        const out = { ok: false, stores: 0, pulled: 0, pushed: 0, entries: 0, error: e?.message || String(e) };
+        try {
+            ls()?.setItem(ORBIT_KEY, JSON.stringify(out));
+        }
+        catch { /* 忽略 */ }
+        return out;
+    }
+}
+/**
+ * 从电脑端拉取全部数据快照并落地本地.
+ *   - 未配置地址 → 明确报错 (不静默)
+ *   - 网络/解析失败 → 返回 error, 保留上一次快照
+ */
+export async function syncFromDesktop(baseUrl, opts = {}) {
+    const base = String(baseUrl || getDesktopUrl() || '').trim().replace(/\/+$/, '');
+    if (!base)
+        return { ok: false, error: '未配置电脑端地址 (设置 → 电脑端同步)' };
+    const f = opts.fetchImpl || (typeof fetch !== 'undefined' ? fetch : null);
+    if (!f)
+        return { ok: false, error: '当前环境无 fetch' };
+    try {
+        const r = await f(`${base}/api/mobile/snapshot`, { method: 'GET' });
+        if (!r.ok)
+            return { ok: false, error: `电脑端返回 ${r.status}` };
+        const snap = (await r.json());
+        if (!snap || snap.ok === false)
+            return { ok: false, error: snap?.error || '快照无效' };
+        try {
+            ls()?.setItem(SNAP_KEY, JSON.stringify(snap));
+        }
+        catch { /* 存储满 → 忽略 */ }
+        if (Array.isArray(snap.judgments)) {
+            try {
+                ls()?.setItem(JUDGE_KEY, JSON.stringify(snap.judgments));
+            }
+            catch { /* 忽略 */ }
+        }
+        // 顺手做 OrbitDB 库级复制 (手机端本地副本 ↔ 电脑端 store, 双向 merge); 失败不影响快照结果
+        let orbit;
+        try {
+            const o = await import('./mobile-orbit.js');
+            const r = await o.replicateAll({ baseUrl: base, fetchImpl: opts.fetchImpl });
+            orbit = { ok: r.ok, stores: r.stores, pulled: r.pulled, pushed: r.pushed, entries: r.entries, error: r.error };
+            try {
+                ls()?.setItem(ORBIT_KEY, JSON.stringify(orbit));
+            }
+            catch { /* 忽略 */ }
+        }
+        catch (e) {
+            orbit = { ok: false, stores: 0, pulled: 0, pushed: 0, entries: 0, error: e?.message || String(e) };
+        }
+        return { ok: true, counts: snap.counts || {}, ts: snap.ts, orbit };
+    }
+    catch (e) {
+        return { ok: false, error: e?.message || String(e) };
+    }
+}
+/**
+ * 电脑端可拨的 P2P ws 地址。
+ *   手机(WebView)不能 listen → 只能主动拨入桌面节点; 桌面 listen 在 0.0.0.0:<随机端口>/ws,
+ *   所以要把 0.0.0.0/127.0.0.1 改写成手机实际访问的桌面主机(端口保持桌面真实端口)。
+ */
+export async function desktopP2PAddrs(opts = {}) {
+    const base = getDesktopUrl();
+    if (!base)
+        return { ok: false, addrs: [], error: '未配置电脑端地址 (设置 → 电脑端同步)' };
+    const f = opts.fetchImpl || (typeof fetch !== 'undefined' ? fetch : null);
+    if (!f)
+        return { ok: false, addrs: [], error: '当前环境无 fetch' };
+    try {
+        let host = '';
+        try {
+            host = new URL(base).hostname;
+        }
+        catch { /* 忽略 */ }
+        const r = await f(`${base.replace(/\/+$/, '')}/api/p2p/mobile-connect`);
+        if (!r.ok)
+            return { ok: false, addrs: [], error: `电脑端返回 ${r.status}` };
+        const j = await r.json();
+        const raw = Array.isArray(j?.wsAddrs) ? j.wsAddrs : [];
+        const rewrite = (a) => {
+            let out = a;
+            if (host)
+                out = out.replace(/\/ip4\/(0\.0\.0\.0|127\.0\.0\.1)\//, `/ip4/${host}/`);
+            out = out.replace(/\/ip6\/::1\//, `/ip4/${host || '127.0.0.1'}/`);
+            return out;
+        };
+        const keep = (a) => ip4Of(a) && !/\/ip4\/(0\.0\.0\.0|127\.0\.0\.1)\//.test(a);
+        const addrs = raw.map(rewrite).filter(keep);
+        const relayRaw = Array.isArray(j?.relayAddrs) ? j.relayAddrs : [];
+        const relayAddrs = relayRaw.map(rewrite).filter(keep);
+        const out = { ok: j?.ok !== false, peerId: j?.peerId || '', addrs: Array.from(new Set(addrs)) };
+        if (j?.isRelay === true)
+            out.isRelay = true;
+        if (relayAddrs.length)
+            out.relayAddrs = Array.from(new Set(relayAddrs));
+        if (typeof j?.relayProtocol === 'string')
+            out.relayProtocol = j.relayProtocol;
+        return out;
+    }
+    catch (e) {
+        return { ok: false, addrs: [], error: e?.message || String(e) };
+    }
+}
+/** 取多地址里的 ip4 (无则空串) */
+function ip4Of(addr) {
+    const m = /\/ip4\/([^/]+)\//.exec(String(addr || ''));
+    return m ? m[1] : '';
+}
+export default { getDesktopUrl, setDesktopUrl, getLastSnapshot, getCachedJudgments, getSyncStatus, syncFromDesktop, replicateOrbit, desktopP2PAddrs };

package/dist/ios/mobile-trade.js

@@ -0,0 +1,492 @@
+/**
+ * mobile-trade.ts — 手机端资源交易工作流 (Agent Economic Loop E2/E3/E4)
+ *
+ *   遵循 docs/wiki/agent-economic-protocol.md:
+ *     E2 x402 支付闭环 — buyer → POST /agent/service/call → 402 Payment Required(price+wallet)
+ *                        → x402_pay → 200 service result
+ *     E3 Policy Engine  — 单笔限额 / 日累计预算 / 收款方白名单 / 服务白名单 / 信誉阈值
+ *                        (纯函数判定 allow|confirm|deny, 非 AI 决策; 私钥隔离 — LLM 不见私钥)
+ *     E4 Reputation     — 结算后 tasks++ / success|failed|disputed → score = success/tasks
+ *
+ *   手机端离线可用: 交易记录/信誉落 localStorage (可注入 storage 便于单测).
+ *   全部外部依赖可注入 (fetchImpl / payFn / walletForAgent / policy), 单测无需浏览器.
+ *   本模块被 mobile-core.ts import → esbuild bundle 进 mobile-core.js.
+ */
+// ============ 常量 ============
+export const TRADE_STORE_KEY = 'bolloon_trades';
+export const REP_STORE_KEY = 'bolloon_service_reputation';
+export const DEFAULT_TRADE_POLICY = {
+    perTransactionLimit: 1, // 单笔 ≤ 1
+    dailyLimit: 10, // 日累计 ≤ 10
+    allowedRecipients: [],
+    allowedServices: [],
+    reputationThreshold: 0,
+};
+const ZERO_REP = { tasks: 0, success: 0, failed: 0, disputed: 0, score: 0 };
+// ============ 基础设施 (storage / 工具) ============
+function ls() {
+    try {
+        if (typeof localStorage !== 'undefined' && localStorage)
+            return localStorage;
+    }
+    catch { /* 无 localStorage */ }
+    return null;
+}
+/** 无 localStorage 时的进程内回退 (Node 测试/SSR) */
+const mem = new Map();
+const MEM_STORAGE = {
+    getItem: (k) => (mem.has(k) ? mem.get(k) : null),
+    setItem: (k, v) => { mem.set(k, String(v)); },
+};
+function storageOf(injected) {
+    return injected || ls() || MEM_STORAGE;
+}
+function nowDefault() { return Date.now(); }
+function ridDefault() {
+    return `req_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+}
+function round2(n) { return Math.round(n * 100) / 100; }
+function numOf(v) {
+    const n = typeof v === 'number' ? v : Number(String(v ?? '').trim());
+    return Number.isFinite(n) ? n : NaN;
+}
+function sameDay(a, b) {
+    return new Date(a).toISOString().slice(0, 10) === new Date(b).toISOString().slice(0, 10);
+}
+function serviceKey(service) {
+    return String(service?.agentId || service?.payTo || service?.name || 'unknown');
+}
+// ============ E3: Policy Engine (纯函数) ============
+/**
+ * 纯函数策略判定 — 非 AI 决策 (对应 E3 / economic-policy.ts).
+ * 顺序: 非法金额 → 单笔限额 → 收款方白名单 → 服务白名单 → 信誉阈值 → 日累计 → confirm 软阈值 → allow.
+ */
+export function evaluatePolicy(intent, policy = DEFAULT_TRADE_POLICY, opts = {}) {
+    const dailySpent = numOf(opts.dailySpent) || 0;
+    const amount = numOf(intent?.amount);
+    const payTo = String(intent?.payTo || '').toLowerCase();
+    const service = String(intent?.service || '').toLowerCase();
+    const base = { dailySpent };
+    if (!Number.isFinite(amount) || amount < 0) {
+        return { decision: 'deny', reason: `非法金额: ${String(intent?.amount)}`, rule: 'invalid_amount', ...base };
+    }
+    if (!payTo) {
+        return { decision: 'deny', reason: '缺少收款方 (payTo)', rule: 'missing_payto', ...base };
+    }
+    // 1. 单笔限额
+    if (amount > policy.perTransactionLimit) {
+        return { decision: 'deny', reason: `单笔超限: ${amount} > ${policy.perTransactionLimit}`, rule: 'per_transaction_limit', ...base };
+    }
+    // 2. 收款方白名单 (空 = 全部允许)
+    if (policy.allowedRecipients.length > 0 && !policy.allowedRecipients.some((r) => String(r).toLowerCase() === payTo)) {
+        return { decision: 'deny', reason: `收款方不在白名单: ${payTo}`, rule: 'recipient_whitelist', ...base };
+    }
+    // 3. 服务白名单 (空 = 全部允许)
+    if (policy.allowedServices.length > 0 && service && !policy.allowedServices.some((s) => String(s).toLowerCase() === service)) {
+        return { decision: 'deny', reason: `服务不在白名单: ${service}`, rule: 'service_whitelist', ...base };
+    }
+    // 4. 信誉阈值
+    const rep = numOf(intent?.reputation);
+    const repVal = Number.isFinite(rep) ? rep : 0;
+    if (policy.reputationThreshold > 0 && repVal < policy.reputationThreshold) {
+        return { decision: 'deny', reason: `服务方信誉不足: ${repVal} < ${policy.reputationThreshold}`, rule: 'reputation_threshold', ...base };
+    }
+    // 5. 日累计预算
+    if (dailySpent + amount > policy.dailyLimit) {
+        return { decision: 'deny', reason: `日累计超限: ${dailySpent} + ${amount} > ${policy.dailyLimit}`, rule: 'daily_limit', ...base };
+    }
+    // 6. confirm 软阈值 (人工审批, 不自动签名)
+    const confirmAbove = opts.requireApprovalAbove ?? policy.confirmAbove;
+    if (confirmAbove !== undefined && Number.isFinite(confirmAbove) && amount > confirmAbove) {
+        return { decision: 'confirm', reason: `金额 ${amount} > 审批阈值 ${confirmAbove}, 需人工批准`, rule: 'confirm_above', ...base };
+    }
+    return { decision: 'allow', reason: '策略通过', rule: 'allow', ...base };
+}
+// ============ E2: 报价 / 校验价格结构 ============
+/** 生成报价 + 校验价格结构 (纯函数; 非法价格 → ok:false) */
+export function quoteService(service, request = {}, opts = {}) {
+    const now = opts.now || nowDefault;
+    const rid = opts.rid || ridDefault;
+    const ts = request.timestamp ?? now();
+    const requestId = String(request.requestId || '').trim() || rid();
+    const name = String(service?.name || '').trim();
+    const quantity = Number.isFinite(numOf(request.quantity)) && numOf(request.quantity) > 0 ? numOf(request.quantity) : 1;
+    const price = service?.price;
+    const currency = String(price?.currency || '').trim().toUpperCase();
+    const payTo = String(service?.payTo || '').trim();
+    const fail = (error) => ({
+        ok: false, error, serviceName: name, amount: NaN, currency, payTo,
+        per: price?.per, quantity, requestId, fingerprint: '', ts, endpoint: request.endpoint || service?.endpoint,
+    });
+    if (!name)
+        return fail('服务缺少 name');
+    if (!price)
+        return fail('服务缺少价格 (price)');
+    const unit = numOf(price.amount);
+    if (!Number.isFinite(unit) || unit < 0)
+        return fail(`价格结构非法: amount=${String(price.amount)}`);
+    if (!currency)
+        return fail('价格缺少 currency');
+    if (!payTo)
+        return fail('服务缺少收款钱包 (payTo)');
+    const amount = round2(unit * quantity);
+    const fingerprint = `${requestId}|${name}|${amount}|${currency}|${ts}`;
+    return {
+        ok: true, serviceName: name, amount, currency, payTo,
+        per: price.per, quantity, requestId, fingerprint, ts,
+        endpoint: String(request.endpoint || service?.endpoint || '').trim() || undefined,
+    };
+}
+// ============ E2: 交易记录存取 (localStorage) ============
+export function listTrades(storage, opts = {}) {
+    const s = storageOf(storage);
+    let raw = null;
+    try {
+        raw = s.getItem(TRADE_STORE_KEY);
+    }
+    catch {
+        raw = null;
+    }
+    if (!raw)
+        return [];
+    let arr = [];
+    try {
+        const p = JSON.parse(raw);
+        if (Array.isArray(p))
+            arr = p;
+    }
+    catch {
+        arr = [];
+    }
+    // 倒序: 新的在前 (ts 大者在前, 同 ts 按写入顺序靠后者在前)
+    const ordered = arr.map((r, i) => ({ r, i })).sort((a, b) => (b.r.ts - a.r.ts) || (b.i - a.i)).map((x) => x.r);
+    return opts.limit && opts.limit > 0 ? ordered.slice(0, opts.limit) : ordered;
+}
+export function appendTrade(rec, storage) {
+    const s = storageOf(storage);
+    const full = {
+        requestId: String(rec.requestId || ''),
+        service: String(rec.service || ''),
+        amount: numOf(rec.amount) || 0,
+        currency: String(rec.currency || 'USDC'),
+        txHash: rec.txHash,
+        status: rec.status,
+        ts: typeof rec.ts === 'number' ? rec.ts : nowDefault(),
+        payTo: rec.payTo,
+        reason: rec.reason,
+        fingerprint: rec.fingerprint,
+    };
+    const prev = listTrades(s).reverse(); // 还原写入顺序 (旧→新)
+    prev.push(full);
+    try {
+        s.setItem(TRADE_STORE_KEY, JSON.stringify(prev));
+    }
+    catch { /* 存储满 → 忽略 */ }
+    return full;
+}
+export function clearTrades(storage) {
+    const s = storageOf(storage);
+    try {
+        s.setItem(TRADE_STORE_KEY, '[]');
+    }
+    catch { /* 忽略 */ }
+}
+/** 防重放: 相同 requestId 已存在 → true (请求 ID + 金额 + 服务 + 时间戳 绑定) */
+export function isReplayed(requestId, storage) {
+    if (!requestId)
+        return false;
+    return listTrades(storage).some((t) => t.requestId === requestId);
+}
+// ============ 信誉存储 (E4) ============
+function repStoreOf(injected) {
+    if (injected)
+        return injected;
+    const s = storageOf();
+    return {
+        get: (k) => {
+            try {
+                const raw = s.getItem(REP_STORE_KEY);
+                const m = raw ? JSON.parse(raw) : {};
+                return (m && m[k]) ? { ...ZERO_REP, ...m[k] } : { ...ZERO_REP };
+            }
+            catch {
+                return { ...ZERO_REP };
+            }
+        },
+        set: (k, rep) => {
+            try {
+                const raw = s.getItem(REP_STORE_KEY);
+                const m = raw ? JSON.parse(raw) : {};
+                m[k] = rep;
+                s.setItem(REP_STORE_KEY, JSON.stringify(m));
+            }
+            catch { /* 忽略 */ }
+        },
+    };
+}
+/** E4: 结算后更新服务方信誉 — tasks++ / success|failed|disputed → score = success/tasks */
+export async function settleAndRate(params) {
+    const deps = params.deps || {};
+    const service = params.service || {};
+    const key = serviceKey(service);
+    const outcome = typeof params.ok === 'string'
+        ? params.ok
+        : (params.ok ? 'success' : 'failed');
+    if (!key || key === 'unknown') {
+        return { ok: false, key, outcome, reputation: { ...ZERO_REP }, score: 0, error: '无法定位服务方 (缺 agentId/payTo/name)' };
+    }
+    try {
+        const store = repStoreOf(deps.reputationStore);
+        const cur = { ...ZERO_REP, ...(await store.get(key) || {}) };
+        cur.tasks += 1;
+        if (outcome === 'success')
+            cur.success += 1;
+        else if (outcome === 'failed')
+            cur.failed += 1;
+        else
+            cur.disputed += 1;
+        cur.score = cur.tasks > 0 ? round2(cur.success / cur.tasks) : 0;
+        await store.set(key, cur);
+        return { ok: true, key, outcome, reputation: cur, score: cur.score };
+    }
+    catch (e) {
+        return { ok: false, key, outcome, reputation: { ...ZERO_REP }, score: 0, error: `信誉更新失败: ${String(e?.message || e)}` };
+    }
+}
+export async function getReputationOf(service, deps = {}) {
+    try {
+        return { ...ZERO_REP, ...(await repStoreOf(deps.reputationStore).get(serviceKey(service)) || {}) };
+    }
+    catch {
+        return { ...ZERO_REP };
+    }
+}
+// ============ E2: 402 解析 ============
+function headerOf(res, name) {
+    const h = res?.headers;
+    if (!h)
+        return undefined;
+    const g = h.get;
+    if (typeof g === 'function') {
+        const v = g.call(h, name);
+        return v == null ? undefined : String(v);
+    }
+    const lower = name.toLowerCase();
+    for (const k of Object.keys(h)) {
+        if (k.toLowerCase() === lower) {
+            const v = h[k];
+            return v == null ? undefined : String(v);
+        }
+    }
+    return undefined;
+}
+async function bodyOf(res) {
+    const r = res;
+    try {
+        if (typeof r?.json === 'function')
+            return await r.json();
+    }
+    catch { /* 非 JSON */ }
+    try {
+        if (typeof r?.text === 'function') {
+            const t = await r.text();
+            if (!t)
+                return null;
+            try {
+                return JSON.parse(t);
+            }
+            catch {
+                return t;
+            }
+        }
+    }
+    catch { /* 无 body */ }
+    return r?.body ?? null;
+}
+/** 解析 402 Payment Required 的价格 (header 优先, 其次 body.payment) */
+export function parse402(res, body) {
+    const b = (body && typeof body === 'object' ? body : {}) || {};
+    const p = (b.payment || {});
+    const amountRaw = headerOf(res, 'X-Payment-Amount') ?? p.amount ?? p.price;
+    const currencyRaw = headerOf(res, 'X-Payment-Currency') ?? p.currency ?? 'USDC';
+    const payToRaw = headerOf(res, 'X-Pay-To') ?? p.payTo ?? p.wallet ?? p.to;
+    const networkRaw = headerOf(res, 'X-Payment-Network') ?? p.network;
+    const amount = numOf(amountRaw);
+    if (!Number.isFinite(amount) || amount < 0)
+        return null;
+    if (!payToRaw)
+        return null;
+    const currency = String(currencyRaw || 'USDC').toUpperCase();
+    return { amount, currency, payTo: String(payToRaw), network: networkRaw ? String(networkRaw) : undefined };
+}
+// ============ 默认支付执行器 (签名隔离) ============
+async function defaultPayFn(deps, walletId, spec) {
+    if (deps.payFn)
+        return deps.payFn(spec);
+    if (!deps.getPrivateKey)
+        return { success: false, error: '未提供 payFn / getPrivateKey (无法签名)' };
+    if (!walletId)
+        return { success: false, error: 'agent 未被授权任何钱包 (walletForAgent)' };
+    const pk = await deps.getPrivateKey(walletId);
+    if (!pk)
+        return { success: false, error: '钱包已锁定, 请先解锁 (私钥仅在解锁后可取)' };
+    if (!deps.x402Pay)
+        return { success: false, error: '未注入 x402Pay 适配器 (桌面端 x402 未接线)' };
+    try {
+        const r = await deps.x402Pay({
+            privateKey: pk, amount: String(spec.amount), to: spec.to,
+            currency: spec.currency, network: spec.network || deps.network, memo: spec.memo,
+        });
+        return { success: !!r.success, txHash: r.txHash, error: r.error };
+    }
+    catch (e) {
+        return { success: false, error: `x402 支付异常: ${String(e?.message || e)}` };
+    }
+}
+async function resolveWallet(deps, buyer) {
+    if (!deps.walletForAgent)
+        return {};
+    if (!buyer)
+        return { error: '缺少 buyer agentId (无法定位钱包)' };
+    const info = await deps.walletForAgent(buyer);
+    if (!info || !info.exists || !info.wallets?.length)
+        return { error: info?.error || `agent ${buyer} 未被授权任何钱包` };
+    const w = info.wallets.find((x) => x.unlocked) || info.wallets[0];
+    return { id: w.id, address: w.address };
+}
+// ============ E2: 402 → 支付 → 取结果 闭环 ============
+/**
+ * 调用付费服务: POST endpoint → 402(price+wallet) → 策略门 → x402_pay → 200 result.
+ * 策略 confirm/deny 时**不支付**; 支付失败**不写成功记录**; 相同 requestId 直接判重放.
+ */
+export async function callService(params) {
+    const deps = params.deps || {};
+    const service = params.service;
+    const request = params.request || {};
+    const now = deps.now || nowDefault;
+    const policy = deps.policy || DEFAULT_TRADE_POLICY;
+    // 1. 报价 + 价格结构校验
+    const quote = quoteService(service, request, { now, rid: deps.rid });
+    const requestId = quote.requestId;
+    if (!quote.ok) {
+        return { ok: false, requestId, status: 'failed', error: quote.error, quote };
+    }
+    // 2. 防重放 (请求 ID + 金额 + 服务 + 时间戳 绑定)
+    if (isReplayed(requestId, deps.storage)) {
+        return { ok: false, requestId, status: 'replayed', replayed: true, reason: `重放请求被拒: ${requestId}`, quote };
+    }
+    // 3. 信誉 (E4) — service.reputation 优先, 否则查信誉库
+    let reputation = numOf(service.reputation);
+    if (!Number.isFinite(reputation) && deps.getReputation) {
+        try {
+            reputation = numOf(await deps.getReputation(service));
+        }
+        catch {
+            reputation = 0;
+        }
+    }
+    const repVal = Number.isFinite(reputation) ? reputation : 0;
+    // 4. 今日已花费 (日累计预算)
+    let dailySpent = 0;
+    if (deps.dailySpent) {
+        try {
+            dailySpent = numOf(await deps.dailySpent()) || 0;
+        }
+        catch {
+            dailySpent = 0;
+        }
+    }
+    else
+        dailySpent = listTrades(deps.storage).filter((t) => t.status === 'success' && sameDay(t.ts, now())).reduce((s, t) => s + (numOf(t.amount) || 0), 0);
+    // 5. Policy Engine (E3) — 非 AI 决策
+    const verdict = evaluatePolicy({ payTo: quote.payTo, amount: quote.amount, currency: quote.currency, service: quote.serviceName, requestId, reputation: repVal, timestamp: quote.ts }, policy, { dailySpent });
+    if (verdict.decision === 'deny') {
+        appendTrade({ requestId, service: quote.serviceName, amount: quote.amount, currency: quote.currency, status: 'denied', payTo: quote.payTo, reason: verdict.reason, fingerprint: quote.fingerprint, ts: quote.ts }, deps.storage);
+        return { ok: false, requestId, status: 'denied', denied: true, reason: verdict.reason, verdict, quote };
+    }
+    if (verdict.decision === 'confirm') {
+        appendTrade({ requestId, service: quote.serviceName, amount: quote.amount, currency: quote.currency, status: 'pending_approval', payTo: quote.payTo, reason: verdict.reason, fingerprint: quote.fingerprint, ts: quote.ts }, deps.storage);
+        return { ok: false, requestId, status: 'pending_approval', needsApproval: true, reason: verdict.reason, verdict, quote };
+    }
+    // 6. 钱包 (buyer)
+    const wallet = await resolveWallet(deps, request.buyer);
+    if (!deps.payFn && wallet.error) {
+        return { ok: false, requestId, status: 'failed', error: wallet.error, verdict, quote };
+    }
+    const f = deps.fetchImpl || (typeof fetch !== 'undefined' ? fetch : null);
+    if (!f)
+        return { ok: false, requestId, status: 'failed', error: '当前环境无 fetch', verdict, quote };
+    const endpoint = quote.endpoint || String(service?.endpoint || '').trim();
+    if (!endpoint)
+        return { ok: false, requestId, status: 'failed', error: '服务缺少 endpoint', verdict, quote };
+    const reqBody = JSON.stringify(request.body ?? {});
+    const baseHeaders = { 'Content-Type': 'application/json', 'X-Request-Id': requestId };
+    try {
+        // ① 首次请求 → 期望 402
+        const first = await f(endpoint, { method: 'POST', headers: baseHeaders, body: reqBody });
+        const firstStatus = Number(first?.status ?? 0);
+        const firstBody = await bodyOf(first);
+        if (firstStatus === 402) {
+            const req = parse402(first, firstBody);
+            if (!req) {
+                appendTrade({ requestId, service: quote.serviceName, amount: quote.amount, currency: quote.currency, status: 'failed', payTo: quote.payTo, reason: '402 响应无法解析', fingerprint: quote.fingerprint, ts: quote.ts }, deps.storage);
+                return { ok: false, requestId, status: 'failed', error: '402 响应缺少价格/收款钱包', verdict, quote };
+            }
+            // 价格完整性: 402 声明金额/币种/收款方必须与报价一致 (防抬价/篡改)
+            if (req.amount !== quote.amount || req.currency !== quote.currency || req.payTo.toLowerCase() !== quote.payTo.toLowerCase()) {
+                appendTrade({ requestId, service: quote.serviceName, amount: quote.amount, currency: quote.currency, status: 'denied', payTo: quote.payTo, reason: '402 价格与报价不符', fingerprint: quote.fingerprint, ts: quote.ts }, deps.storage);
+                return { ok: false, requestId, status: 'denied', denied: true, reason: `402 价格与报价不符 (报价 ${quote.amount} ${quote.currency} → 402 ${req.amount} ${req.currency})`, verdict, quote };
+            }
+            // ② 支付 (签名隔离: 私钥仅在 defaultPayFn 内可见)
+            const pay = await defaultPayFn(deps, wallet.id, { amount: req.amount, currency: req.currency, to: req.payTo, memo: `${quote.serviceName} ${requestId}`, network: req.network });
+            if (!pay.success) {
+                appendTrade({ requestId, service: quote.serviceName, amount: quote.amount, currency: quote.currency, status: 'failed', payTo: quote.payTo, reason: pay.error || '支付失败', fingerprint: quote.fingerprint, ts: quote.ts }, deps.storage);
+                if (deps.reputationStore)
+                    await settleAndRate({ ok: false, service, deps });
+                return { ok: false, requestId, status: 'failed', error: pay.error || '支付失败', verdict, quote };
+            }
+            // ③ 携带支付凭据重试 → 200 取结果
+            const proof = pay.proof || pay.txHash || '';
+            const second = await f(endpoint, {
+                method: 'POST',
+                headers: { ...baseHeaders, 'X-Payment': proof, 'X-Payment-TxHash': pay.txHash || '', 'X-Payment-Request-Id': requestId },
+                body: reqBody,
+            });
+            const secondStatus = Number(second?.status ?? 0);
+            const secondOk = second?.ok ?? (secondStatus >= 200 && secondStatus < 300);
+            const secondBody = await bodyOf(second);
+            if (!secondOk) {
+                appendTrade({ requestId, service: quote.serviceName, amount: quote.amount, currency: quote.currency, status: 'failed', txHash: pay.txHash, payTo: quote.payTo, reason: `支付后重试失败 ${secondStatus}`, fingerprint: quote.fingerprint, ts: quote.ts }, deps.storage);
+                if (deps.reputationStore)
+                    await settleAndRate({ ok: false, service, deps });
+                return { ok: false, requestId, status: 'failed', txHash: pay.txHash, error: `支付后重试失败 (${secondStatus})`, verdict, quote };
+            }
+            appendTrade({ requestId, service: quote.serviceName, amount: quote.amount, currency: quote.currency, status: 'success', txHash: pay.txHash, payTo: quote.payTo, fingerprint: quote.fingerprint, ts: quote.ts }, deps.storage);
+            if (deps.reputationStore)
+                await settleAndRate({ ok: true, service, deps });
+            return { ok: true, requestId, status: 'success', result: secondBody, txHash: pay.txHash, paid: quote.amount, currency: quote.currency, verdict, quote };
+        }
+        // 非 402: 免费服务 (200) 或错误
+        const firstOk = first?.ok ?? (firstStatus >= 200 && firstStatus < 300);
+        if (firstOk) {
+            if (quote.amount > 0) {
+                // 付费服务却直接放行 → 保守: 记录但标记异常
+                return { ok: false, requestId, status: 'failed', error: `服务声明收费 ${quote.amount} ${quote.currency} 但未返回 402`, verdict, quote };
+            }
+            appendTrade({ requestId, service: quote.serviceName, amount: 0, currency: quote.currency, status: 'success', payTo: quote.payTo, fingerprint: quote.fingerprint, ts: quote.ts }, deps.storage);
+            return { ok: true, requestId, status: 'success', result: firstBody, paid: 0, currency: quote.currency, verdict, quote };
+        }
+        appendTrade({ requestId, service: quote.serviceName, amount: quote.amount, currency: quote.currency, status: 'failed', payTo: quote.payTo, reason: `服务返回 ${firstStatus}`, fingerprint: quote.fingerprint, ts: quote.ts }, deps.storage);
+        return { ok: false, requestId, status: 'failed', error: `服务返回 ${firstStatus}`, verdict, quote };
+    }
+    catch (e) {
+        const msg = String(e?.message || e);
+        appendTrade({ requestId, service: quote.serviceName, amount: quote.amount, currency: quote.currency, status: 'failed', payTo: quote.payTo, reason: msg, fingerprint: quote.fingerprint, ts: quote.ts }, deps.storage);
+        return { ok: false, requestId, status: 'failed', error: `调用失败: ${msg}`, verdict, quote };
+    }
+}
+export default {
+    evaluatePolicy, quoteService, callService, settleAndRate, getReputationOf,
+    appendTrade, listTrades, clearTrades, isReplayed, parse402,
+    DEFAULT_TRADE_POLICY,
+};