@bolloon/bolloon-agent 0.4.28 → 0.4.30

package/dist/web/mobile-core.js

@@ -71270,7 +71270,7 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
         i = this._head + i & this._capacityMask;
         return this._list[i];
       };
-      Denque2.prototype.get = function get2(i) {
+      Denque2.prototype.get = function get3(i) {
         return this.peekAt(i);
       };
       Denque2.prototype.peek = function peek() {
@@ -103541,7 +103541,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
       }
     }
   }
-  function get(source, path) {
+  function get2(source, path) {
     let node2 = source;
     for (const [index, key] of path.entries()) {
       node2 = node2[key];
@@ -103597,7 +103597,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
           return tree(this.value, []);
         }
         get(path = "/") {
-          return get(this.value, path.split("/").filter(Boolean));
+          return get2(this.value, path.split("/").filter(Boolean));
         }
       };
     }
@@ -119947,46 +119947,46 @@ ${values.join("\n")}` : `${blockName} :`;
       var len;
       revLookup["-".charCodeAt(0)] = 62;
       revLookup["_".charCodeAt(0)] = 63;
-      function getLens(b64) {
-        var len2 = b64.length;
+      function getLens(b642) {
+        var len2 = b642.length;
         if (len2 % 4 > 0) {
           throw new Error("Invalid string. Length must be a multiple of 4");
         }
-        var validLen = b64.indexOf("=");
+        var validLen = b642.indexOf("=");
         if (validLen === -1) validLen = len2;
         var placeHoldersLen = validLen === len2 ? 0 : 4 - validLen % 4;
         return [validLen, placeHoldersLen];
       }
-      function byteLength2(b64) {
-        var lens = getLens(b64);
+      function byteLength2(b642) {
+        var lens = getLens(b642);
         var validLen = lens[0];
         var placeHoldersLen = lens[1];
         return (validLen + placeHoldersLen) * 3 / 4 - placeHoldersLen;
       }
-      function _byteLength(b64, validLen, placeHoldersLen) {
+      function _byteLength(b642, validLen, placeHoldersLen) {
         return (validLen + placeHoldersLen) * 3 / 4 - placeHoldersLen;
       }
-      function toByteArray(b64) {
+      function toByteArray(b642) {
         var tmp;
-        var lens = getLens(b64);
+        var lens = getLens(b642);
         var validLen = lens[0];
         var placeHoldersLen = lens[1];
-        var arr = new Arr(_byteLength(b64, validLen, placeHoldersLen));
+        var arr = new Arr(_byteLength(b642, validLen, placeHoldersLen));
         var curByte = 0;
         var len2 = placeHoldersLen > 0 ? validLen - 4 : validLen;
         var i2;
         for (i2 = 0; i2 < len2; i2 += 4) {
-          tmp = revLookup[b64.charCodeAt(i2)] << 18 | revLookup[b64.charCodeAt(i2 + 1)] << 12 | revLookup[b64.charCodeAt(i2 + 2)] << 6 | revLookup[b64.charCodeAt(i2 + 3)];
+          tmp = revLookup[b642.charCodeAt(i2)] << 18 | revLookup[b642.charCodeAt(i2 + 1)] << 12 | revLookup[b642.charCodeAt(i2 + 2)] << 6 | revLookup[b642.charCodeAt(i2 + 3)];
           arr[curByte++] = tmp >> 16 & 255;
           arr[curByte++] = tmp >> 8 & 255;
           arr[curByte++] = tmp & 255;
         }
         if (placeHoldersLen === 2) {
-          tmp = revLookup[b64.charCodeAt(i2)] << 2 | revLookup[b64.charCodeAt(i2 + 1)] >> 4;
+          tmp = revLookup[b642.charCodeAt(i2)] << 2 | revLookup[b642.charCodeAt(i2 + 1)] >> 4;
           arr[curByte++] = tmp & 255;
         }
         if (placeHoldersLen === 1) {
-          tmp = revLookup[b64.charCodeAt(i2)] << 10 | revLookup[b64.charCodeAt(i2 + 1)] << 4 | revLookup[b64.charCodeAt(i2 + 2)] >> 2;
+          tmp = revLookup[b642.charCodeAt(i2)] << 10 | revLookup[b642.charCodeAt(i2 + 1)] << 4 | revLookup[b642.charCodeAt(i2 + 2)] >> 2;
           arr[curByte++] = tmp >> 8 & 255;
           arr[curByte++] = tmp & 255;
         }
@@ -162923,6 +162923,365 @@ ${error.stack}` : head;
     return result;
   }
 
+  // src/agents/contacts/grant-payload.ts
+  function canonicalGrantPayload(g) {
+    return JSON.stringify({
+      grantId: g.grantId,
+      identityId: g.identityId,
+      ownerDid: g.ownerDid,
+      level: g.level,
+      channels: g.channels,
+      contactScope: g.contactScope,
+      taskScope: g.taskScope,
+      contentScope: g.contentScope,
+      replyWakeAllowed: g.replyWakeAllowed,
+      autoSend: g.autoSend,
+      sensitiveContentAllowed: g.sensitiveContentAllowed,
+      newRecipientAllowed: g.newRecipientAllowed,
+      grantedAt: g.grantedAt,
+      grantedBy: g.grantedBy,
+      grantedVia: g.grantedVia,
+      deviceIds: [...g.deviceIds].sort(),
+      status: g.status,
+      revokedAt: g.revokedAt || "",
+      grantVersion: g.grantVersion
+    });
+  }
+  function canonicalRevocationPayload(r) {
+    return JSON.stringify({ grantId: r.grantId, grantVersion: r.grantVersion, revokedAt: r.revokedAt, by: r.by });
+  }
+  function presetForChoice(choice) {
+    const base6 = { channels: "both", replyWakeAllowed: true, autoSend: true, newRecipientAllowed: false };
+    switch (choice) {
+      case "task_once":
+        return { ...base6, level: "task_once", contactScope: "verified_contacts", taskScope: "current_goal", contentScope: "normal", autoSend: false, sensitiveContentAllowed: false };
+      case "persistent":
+        return { ...base6, level: "persistent", contactScope: "verified_contacts", taskScope: "all_future_goals", contentScope: "normal", sensitiveContentAllowed: false };
+      case "full_contact_access":
+        return { ...base6, level: "full_contact_access", contactScope: "all_contacts", taskScope: "all_future_goals", contentScope: "sensitive", sensitiveContentAllowed: true };
+    }
+  }
+
+  // src/web/mobile-contacts.ts
+  var K_DEVICE = "bolloon.contacts.device.v1";
+  var K_QUEUE = "bolloon.contacts.queue.v1";
+  var K_CAPS = "bolloon.contacts.capabilities.v1";
+  var cryptoOf = (c) => c || globalThis.crypto || null;
+  function ed25519Available(c) {
+    const cobj = cryptoOf(c);
+    if (!cobj?.subtle) return false;
+    try {
+      const alg = { name: "Ed25519" };
+      return typeof cobj.subtle.importKey === "function" && !!alg;
+    } catch {
+      return false;
+    }
+  }
+  function bytesOf(s2) {
+    const src4 = new TextEncoder().encode(s2);
+    const out = new Uint8Array(new ArrayBuffer(src4.byteLength));
+    out.set(src4);
+    return out;
+  }
+  function b64(buf) {
+    const arr = new Uint8Array(buf);
+    let out = "";
+    for (let i = 0; i < arr.length; i++) out += String.fromCharCode(arr[i]);
+    return btoa(out);
+  }
+  function pemFromSpki(spki) {
+    const b = b64(spki).replace(/(.{64})/g, "$1\n").trim();
+    return `-----BEGIN PUBLIC KEY-----
+${b}
+-----END PUBLIC KEY-----
+`;
+  }
+  async function sha256Hex(c, text) {
+    const d2 = await c.subtle.digest("SHA-256", bytesOf(text));
+    return [...new Uint8Array(d2)].map((x) => x.toString(16).padStart(2, "0")).join("");
+  }
+  async function loadOrCreateDeviceKey(storage2, c) {
+    const cobj = cryptoOf(c);
+    if (!cobj?.subtle) throw new Error("device_signing_unavailable: \u672C\u673A\u6CA1\u6709 WebCrypto");
+    const raw = storage2.getItem(K_DEVICE);
+    if (raw) {
+      try {
+        const parsed = JSON.parse(raw);
+        if (parsed?.privateKeyJwk && parsed?.publicKeyPem && parsed?.deviceId) return parsed;
+      } catch {
+      }
+    }
+    let pair;
+    try {
+      pair = await cobj.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
+    } catch (err2) {
+      throw new Error(`device_signing_unavailable: ${String(err2?.message || err2)}`);
+    }
+    const publicKeyPem = pemFromSpki(await cobj.subtle.exportKey("spki", pair.publicKey));
+    const privateKeyJwk = await cobj.subtle.exportKey("jwk", pair.privateKey);
+    const deviceId = `dev-${(await sha256Hex(cobj, publicKeyPem)).slice(0, 12)}`;
+    const material = { deviceId, publicKeyPem, privateKeyJwk };
+    storage2.setItem(K_DEVICE, JSON.stringify(material));
+    return material;
+  }
+  async function importPrivate(storage2, c) {
+    const k = await loadOrCreateDeviceKey(storage2, c);
+    return c.subtle.importKey("jwk", k.privateKeyJwk, { name: "Ed25519" }, false, ["sign"]);
+  }
+  async function signGrantOnDevice(grant, storage2, c) {
+    const cobj = cryptoOf(c);
+    const key = await importPrivate(storage2, cobj);
+    const payload = canonicalGrantPayload(grant);
+    const sig = await cobj.subtle.sign({ name: "Ed25519" }, key, bytesOf(payload));
+    const dev = await loadOrCreateDeviceKey(storage2, cobj);
+    return { deviceId: dev.deviceId, alg: "ed25519", payloadHash: await sha256Hex(cobj, payload), sig: b64(sig) };
+  }
+  async function signRevocationOnDevice(rev, storage2, c) {
+    const cobj = cryptoOf(c);
+    const key = await importPrivate(storage2, cobj);
+    const payload = canonicalRevocationPayload(rev);
+    const sig = await cobj.subtle.sign({ name: "Ed25519" }, key, bytesOf(payload));
+    const dev = await loadOrCreateDeviceKey(storage2, cobj);
+    return { deviceId: dev.deviceId, alg: "ed25519", payloadHash: await sha256Hex(cobj, payload), sig: b64(sig) };
+  }
+  async function post(base6, path, body, f) {
+    const res = await f(`${String(base6).replace(/\/+$/, "")}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body ?? {})
+    });
+    let json = null;
+    try {
+      json = await res.json();
+    } catch {
+    }
+    return { status: res.status, json };
+  }
+  async function get(base6, path, f) {
+    const res = await f(`${String(base6).replace(/\/+$/, "")}${path}`);
+    let json = null;
+    try {
+      json = await res.json();
+    } catch {
+    }
+    return { status: res.status, json };
+  }
+  async function registerDeviceOnDesktop(base6, storage2, opts = {}) {
+    const f = opts.fetchImpl || fetch;
+    const dev = await loadOrCreateDeviceKey(storage2, opts.cryptoObj);
+    const r = await post(base6, "/api/contacts/devices", { deviceId: dev.deviceId, publicKeyPem: dev.publicKeyPem, label: opts.label || "\u624B\u673A" }, f);
+    if (r.status !== 200 || !r.json?.ok) return { ok: false, error: `\u684C\u9762\u672A\u63A5\u53D7\u8BBE\u5907\u767B\u8BB0: ${r.json?.error || r.status}`, data: dev };
+    return { ok: true, data: dev };
+  }
+  function saveCapabilityCopy(storage2, items) {
+    const clean8 = (items || []).map((c) => ({
+      contactId: String(c.contactId || ""),
+      kind: c.kind,
+      displayValue: String(c.displayValue || ""),
+      verificationStatus: String(c.verificationStatus || ""),
+      capabilities: [...c.capabilities || []],
+      provider: c.provider ? String(c.provider) : void 0,
+      state: c.state ? String(c.state) : void 0
+    }));
+    storage2.setItem(K_CAPS, JSON.stringify(clean8));
+  }
+  function loadCapabilityCopy(storage2) {
+    try {
+      const v = JSON.parse(storage2.getItem(K_CAPS) || "[]");
+      return Array.isArray(v) ? v : [];
+    } catch {
+      return [];
+    }
+  }
+  function pendingQueue(storage2) {
+    try {
+      const v = JSON.parse(storage2.getItem(K_QUEUE) || "[]");
+      return Array.isArray(v) ? v : [];
+    } catch {
+      return [];
+    }
+  }
+  function setQueue(storage2, q) {
+    storage2.setItem(K_QUEUE, JSON.stringify(q.slice(-20)));
+  }
+  async function flushQueuedGrants(base6, storage2, opts = {}) {
+    const f = opts.fetchImpl || fetch;
+    const q = pendingQueue(storage2);
+    const keep = [];
+    const results = [];
+    let sent = 0, failed = 0;
+    for (const item of q) {
+      try {
+        const r = await post(base6, "/api/contacts/grants/sync", { grant: { ...item.grant, signature: item.signature } }, f);
+        if (r.status === 200 && r.json?.ok) {
+          sent++;
+          results.push({ grantId: item.grant.grantId, ok: true });
+          continue;
+        }
+        failed++;
+        keep.push(item);
+        results.push({ grantId: item.grant.grantId, ok: false, error: r.json?.code || r.status });
+      } catch {
+        failed++;
+        keep.push(item);
+        results.push({ grantId: item.grant.grantId, ok: false, error: "network" });
+      }
+    }
+    setQueue(storage2, keep);
+    return { sent, failed, results };
+  }
+  async function authorizeFromPhone(input) {
+    const c = cryptoOf(input.cryptoObj);
+    if (!ed25519Available(c || void 0)) {
+      return { ok: false, error: "device_signing_unavailable: \u672C\u673A WebView \u4E0D\u652F\u6301 Ed25519 \u8BBE\u5907\u7B7E\u540D \u2014\u2014 \u8BF7\u5728\u684C\u9762\u7AEF\u6388\u6743 (\u6216\u5347\u7EA7\u7CFB\u7EDF WebView)" };
+    }
+    const dev = await loadOrCreateDeviceKey(input.storage, c);
+    const preset = presetForChoice(input.choice);
+    const grant = {
+      grantId: `gr-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`,
+      identityId: input.identityId || `sid-phone-${dev.deviceId.slice(-6)}`,
+      ownerDid: input.ownerDid,
+      ...preset,
+      grantedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      grantedBy: input.grantedBy || "leo",
+      grantedVia: "mobile",
+      deviceIds: [dev.deviceId],
+      status: "active",
+      grantVersion: 1
+    };
+    const signature = await signGrantOnDevice(grant, input.storage, c);
+    const f = input.fetchImpl || fetch;
+    const reg = await registerDeviceOnDesktop(input.base, input.storage, { fetchImpl: f, cryptoObj: c }).catch(() => ({ ok: false }));
+    if (!reg.ok) {
+      const q2 = pendingQueue(input.storage);
+      q2.push({ grant, signature, queuedAt: (/* @__PURE__ */ new Date()).toISOString() });
+      setQueue(input.storage, q2);
+      return {
+        ok: false,
+        queued: true,
+        error: `\u684C\u9762\u6682\u4E0D\u53EF\u8FBE \u2192 \u6388\u6743\u5DF2\u5B58\u5728\u624B\u673A, \u5F85\u684C\u9762\u5728\u7EBF\u65F6\u81EA\u52A8\u540C\u6B65 (${reg.error || "offline"})`,
+        data: { grantId: grant.grantId, level: grant.level, signature },
+        note: "\u684C\u9762\u4E0D\u5728\u7EBF\u65F6\u4E0D\u5047\u88C5\u5DF2\u751F\u6548: \u6388\u6743\u5728\u672C\u5730\u961F\u5217\u91CC, \u684C\u9762\u4E00\u4E0A\u7EBF\u5C31\u8865\u540C\u6B65"
+      };
+    }
+    const r = await post(input.base, "/api/contacts/grants/sync", { grant: { ...grant, signature } }, f);
+    if (r.status === 200 && r.json?.ok) {
+      return { ok: true, data: { grantId: grant.grantId, level: grant.level, signature }, note: "\u684C\u9762\u5DF2\u9A8C\u7B7E\u63A5\u53D7" };
+    }
+    const q = pendingQueue(input.storage);
+    q.push({ grant, signature, queuedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    setQueue(input.storage, q);
+    return {
+      ok: false,
+      queued: true,
+      error: `\u684C\u9762\u62D2\u7EDD/\u672A\u63A5\u53D7: ${r.json?.code || r.json?.reason || r.status}`,
+      data: { grantId: grant.grantId, level: grant.level, signature },
+      note: "\u5DF2\u4FDD\u5B58\u5728\u624B\u673A\u672C\u5730\u961F\u5217 (\u4E0D\u4F1A\u56E0\u4E3A\u5931\u8D25\u5C31\u5F53\u6210\u5DF2\u6388\u6743)"
+    };
+  }
+  async function revokeFromPhone(opts) {
+    const c = cryptoOf(opts.cryptoObj);
+    if (!ed25519Available(c || void 0)) return { ok: false, error: "device_signing_unavailable: \u672C\u673A\u4E0D\u652F\u6301\u8BBE\u5907\u7B7E\u540D, \u64A4\u9500\u9700\u5728\u684C\u9762\u7AEF\u8FDB\u884C" };
+    const revokedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const payload = { grantId: opts.grantId, grantVersion: opts.version || 1, revokedAt, by: "mobile" };
+    const signature = await signRevocationOnDevice(payload, opts.storage, c);
+    const f = opts.fetchImpl || fetch;
+    const r = await post(opts.base, "/api/contacts/grants/revoke-sync", { grantId: opts.grantId, by: "mobile", reason: opts.reason, version: payload.grantVersion, revokedAt, signature }, f);
+    if (r.status === 200 && r.json?.ok) return { ok: true, data: { grantId: opts.grantId }, note: "\u684C\u9762\u5DF2\u9A8C\u7B7E\u5E76\u7ACB\u5373\u5931\u6548" };
+    return { ok: false, error: `\u64A4\u9500\u672A\u9001\u8FBE: ${r.json?.code || r.json?.error || r.status}`, note: "\u684C\u9762\u4E0D\u5728\u7EBF\u65F6\u64A4\u9500**\u4E0D\u4F1A**\u88AB\u5F53\u4F5C\u5DF2\u5B8C\u6210 \u2014\u2014 \u8BF7\u5728\u684C\u9762\u5728\u7EBF\u540E\u91CD\u8BD5 (\u6216\u684C\u9762\u7AEF\u64A4\u9500)" };
+  }
+  async function loadFromDesktop(base6, storage2, opts = {}) {
+    const f = opts.fetchImpl || fetch;
+    if (!base6) {
+      const caps = loadCapabilityCopy(storage2);
+      return {
+        ok: false,
+        error: "desktop_offline",
+        data: { contacts: caps, grants: [], effective: "\u684C\u9762\u4E0D\u5728\u7EBF (\u663E\u793A\u624B\u673A\u672C\u5730\u526F\u672C)", approvals: [], waiting: [] },
+        note: "\u4EE5\u4E0B\u662F\u4F60\u624B\u673A\u4E0A\u4FDD\u5B58\u7684\u80FD\u529B\u526F\u672C (\u4E0D\u662F\u684C\u9762\u5B9E\u65F6\u72B6\u6001)"
+      };
+    }
+    try {
+      const a = await get(base6, "/api/contacts", f);
+      const b = await get(base6, "/api/contacts/grants", f);
+      if (a.status !== 200 && b.status !== 200) return { ok: false, error: `desktop_http_${a.status || b.status}` };
+      const view = {
+        contacts: a.json?.contacts || [],
+        grants: b.json?.grants || [],
+        effective: b.json?.effective || "",
+        approvals: a.json?.approvals || [],
+        waiting: a.json?.waiting || []
+      };
+      saveCapabilityCopy(storage2, (view.contacts || []).filter((c) => c.capabilities?.includes("send")).map((c) => ({
+        contactId: c.contactId,
+        kind: c.kind,
+        displayValue: c.displayValue,
+        verificationStatus: c.status,
+        capabilities: c.capabilities,
+        provider: c.provider,
+        state: c.status
+      })));
+      return { ok: true, data: view };
+    } catch (err2) {
+      const caps = loadCapabilityCopy(storage2);
+      return {
+        ok: false,
+        error: "desktop_offline",
+        data: { contacts: caps, grants: [], effective: "\u684C\u9762\u4E0D\u5728\u7EBF (\u663E\u793A\u624B\u673A\u672C\u5730\u526F\u672C)", approvals: [], waiting: [] },
+        note: `\u8FDE\u4E0D\u4E0A\u684C\u9762 (${String(err2?.message || err2).slice(0, 60)}) \u2014\u2014 \u663E\u793A\u672C\u5730\u526F\u672C`
+      };
+    }
+  }
+  async function bindFromPhone(base6, opts, storage2, f) {
+    const impl = f || fetch;
+    if (!base6) return { ok: false, error: "desktop_offline: \u7ED1\u5B9A\u9700\u8981\u684C\u9762\u7AEF\u5728\u7EBF (\u684C\u9762\u8D1F\u8D23\u843D\u76D8\u4E0E\u9A8C\u8BC1\u7801\u901A\u9053)" };
+    const r = await post(base6, "/api/contacts/bind", { kind: opts.kind, value: opts.value, region: opts.region }, impl);
+    if (r.status === 200 && r.json?.ok) return { ok: true, data: r.json };
+    return { ok: false, error: r.json?.error || `HTTP ${r.status}` };
+  }
+  async function verifyFromPhone(base6, opts, storage2, f) {
+    const impl = f || fetch;
+    if (!base6) return { ok: false, error: "desktop_offline: \u9A8C\u8BC1\u9700\u8981\u684C\u9762\u7AEF\u5728\u7EBF" };
+    const r = await post(base6, "/api/contacts/verify", { contactId: opts.contactId, challengeId: opts.challengeId, code: opts.code }, impl);
+    if (r.status === 200 && r.json?.ok) return { ok: true, data: r.json };
+    return { ok: false, error: r.json?.error || `HTTP ${r.status}` };
+  }
+  async function decideApprovalFromPhone(base6, opts, f) {
+    const impl = f || fetch;
+    if (!base6) return { ok: false, error: "desktop_offline: \u6279\u51C6\u9700\u8981\u684C\u9762\u7AEF\u5728\u7EBF (\u624B\u673A\u4E0D\u5728\u7EBF\u65F6\u4E0D\u4F1A\u5047\u88C5\u5DF2\u6279\u51C6)" };
+    const r = await post(base6, `/api/contacts/approvals/${encodeURIComponent(opts.consentId)}/${opts.action}`, { by: "leo", via: "mobile", body: opts.body, reason: opts.reason }, impl);
+    if (r.status === 200 && r.json?.ok) return { ok: true, data: r.json };
+    return { ok: false, error: r.json?.error || `HTTP ${r.status}` };
+  }
+  function buildPhoneCard(view, opts) {
+    return {
+      title: "\u8BA9 Bolloon \u4EE3\u8868\u4F60\u8054\u7CFB\u5916\u90E8\u7684\u4EBA",
+      effective: view?.effective || opts.offline || "\u672A\u77E5",
+      contacts: (view?.contacts || []).map((c) => ({
+        displayValue: c.displayValue || "",
+        kind: c.kind || "",
+        state: c.status || c.verificationStatus || "",
+        label: c.capabilities?.includes("send") ? "\u53EF\u8054\u7CFB" : "\u4E0D\u53EF\u8054\u7CFB"
+      })),
+      approvals: (view?.approvals || []).map((a) => ({
+        consentId: a.consentId,
+        contactName: a.contactName,
+        channel: a.channel,
+        subject: a.subject,
+        bodyPreview: a.bodyPreview || "",
+        reason: a.reason,
+        reallySent: !!a.reallySent
+      })),
+      choices: [
+        { id: "task_once", label: "\u4EC5\u672C\u6B21\u4EFB\u52A1" },
+        { id: "persistent", label: "\u957F\u671F\u4F7F\u7528 (\u63A8\u8350)" },
+        { id: "full_contact_access", label: "\u5B8C\u5168\u6388\u6743\u8054\u7CFB\u65B9\u5F0F\u80FD\u529B" }
+      ],
+      willNotGet: ["\u8BFB\u53D6\u5168\u90E8\u90AE\u7BB1", "\u8BFB\u53D6\u901A\u8BAF\u5F55", "\u7FA4\u53D1\u6D88\u606F", "\u81EA\u52A8\u652F\u4ED8/\u8F6C\u8D26", "\u4EE3\u8868\u4F60\u7B7E\u7F72\u5408\u540C", "\u62FF\u5230\u624B\u673A\u53F7/\u90AE\u7BB1\u660E\u6587"],
+      deviceSigning: opts.deviceSigning
+    };
+  }
+
   // src/web/mobile-core.ts
   var busHandlers = /* @__PURE__ */ new Set();
   function busBroadcast(msg) {
@@ -163033,6 +163392,8 @@ ${error.stack}` : head;
       if (p === "/api/peers") return () => core.peers.list();
       if (p === "/api/mcp/tools") return () => core.mcp.tools();
       if (p === "/api/skills") return () => core.skills.list();
+      if (p === "/api/contacts") return () => core.contacts.view();
+      if (p === "/api/contacts/grants") return () => core.contacts.grants();
       if (p === "/api/auth/status") return () => core.identity.status();
       if (p === "/api/payments/pending") return () => core.payments.pending();
       if (p === "/api/llm-config") return () => core.data.getLlmConfig();
@@ -163786,6 +164147,111 @@ ${error.stack}` : head;
         return mobileGatewayTool2(String(name10 || ""), args || {});
       }
     },
+    /**
+     * 联系方式与持久授权 (2026-09-19, Phase 5/10)
+     *   手机负责: 输入 · OTP 确认 · 生物识别/系统确认 · 展示待发内容 · 批准高风险联系 · **签名长期授权**
+     *   桌面负责: 落盘 · 执行 · 等待回复 · 证据
+     * 铁律: 明文不进手机存储 (只存 capability 副本), 桌面离线不假装成功, 不支持 Ed25519 就明说。
+     */
+    contacts: {
+      /** 本机是否能做设备签名 (老 WebView 可能没有 Ed25519) */
+      deviceSigning() {
+        return ed25519Available();
+      },
+      /** 桌面 HTTP 地址 (拿不到 → null, 不猜) */
+      async desktopBase() {
+        try {
+          const u = await core.desktop?.url?.();
+          const raw = u && typeof u === "object" ? u.url || u.baseUrl || "" : u;
+          const s2 = String(raw || "").replace(/\/+$/, "");
+          return s2 || null;
+        } catch {
+          return null;
+        }
+      },
+      /** 手机端本地存储 (只放: 设备私钥 JWK / capability 副本 / 离线队列) */
+      storage() {
+        try {
+          if (typeof localStorage !== "undefined") return localStorage;
+        } catch {
+        }
+        const mem2 = /* @__PURE__ */ new Map();
+        return { getItem: (k) => mem2.has(k) ? mem2.get(k) : null, setItem: (k, v) => {
+          mem2.set(k, v);
+        }, removeItem: (k) => {
+          mem2.delete(k);
+        } };
+      },
+      /** 从桌面读脱敏视图 (桌面离线 → 退回本地 capability 副本并标注) */
+      async view() {
+        const base6 = await core.contacts.desktopBase();
+        const r = await loadFromDesktop(base6, core.contacts.storage());
+        return { ...r.data || { contacts: [], grants: [], effective: "", approvals: [], waiting: [] }, offline: !r.ok, note: r.note, error: r.error };
+      },
+      async grants() {
+        const v = await core.contacts.view();
+        return { grants: v.grants || [], effective: v.effective || "", offline: v.offline };
+      },
+      /** 手机端摘要卡 (给 UI 直接渲染) */
+      async card() {
+        const base6 = await core.contacts.desktopBase();
+        const r = await loadFromDesktop(base6, core.contacts.storage());
+        return buildPhoneCard(r.data || null, { deviceSigning: ed25519Available(), offline: r.error });
+      },
+      /** 确认授权 (三个选项之一) → 设备签名 → 桌面验签; 桌面离线则进本地队列 */
+      async authorize(choice, ownerDid) {
+        const base6 = await core.contacts.desktopBase();
+        let did = ownerDid;
+        if (!did) {
+          try {
+            const st = await core.identity?.status?.();
+            did = st?.did;
+          } catch {
+          }
+        }
+        return authorizeFromPhone({
+          base: base6 || "",
+          choice,
+          ownerDid: did || "did:bolln:local",
+          storage: core.contacts.storage(),
+          grantedBy: "leo"
+        });
+      },
+      /** 手机撤销 (带签名; 桌面离线不假装已撤销) */
+      async revoke(grantId, reason) {
+        const base6 = await core.contacts.desktopBase();
+        if (!base6) return { ok: false, error: "desktop_offline: \u64A4\u9500\u9700\u8981\u684C\u9762\u5728\u7EBF" };
+        return revokeFromPhone({ base: base6, grantId, reason, storage: core.contacts.storage(), version: Date.now() });
+      },
+      async bind(kind, value2, region) {
+        const base6 = await core.contacts.desktopBase();
+        return bindFromPhone(base6, { kind, value: value2, region }, core.contacts.storage());
+      },
+      async verify(contactId, challengeId, code10) {
+        const base6 = await core.contacts.desktopBase();
+        return verifyFromPhone(base6, { contactId, challengeId, code: code10 }, core.contacts.storage());
+      },
+      /** 手机上批准/拒绝高风险联系 (展示待发内容后) */
+      async decide(consentId, action, opts = {}) {
+        const base6 = await core.contacts.desktopBase();
+        return decideApprovalFromPhone(base6, { consentId, action, ...opts });
+      },
+      /** 桌面回来后补同步排队中的授权 */
+      async flushQueue() {
+        const base6 = await core.contacts.desktopBase();
+        if (!base6) return { sent: 0, failed: pendingQueue(core.contacts.storage()).length, results: [] };
+        return flushQueuedGrants(base6, core.contacts.storage());
+      },
+      queue() {
+        return pendingQueue(core.contacts.storage());
+      },
+      capabilities() {
+        return loadCapabilityCopy(core.contacts.storage());
+      },
+      device() {
+        return loadOrCreateDeviceKey(core.contacts.storage());
+      }
+    },
     skills: {
       async list() {
         const s2 = await Promise.resolve().then(() => (init_mobile_sync(), mobile_sync_exports));

package/dist/web/mobile.html

@@ -121,6 +121,7 @@
       <div class="list-item" id="item-settings"><span class="list-icon"><svg class="ico" viewBox="0 0 24 24"><path d="M4 7.5h6M14 7.5h6M4 16.5h9M17 16.5h3"/><circle cx="12" cy="7.5" r="2.2"/><circle cx="15" cy="16.5" r="2.2"/></svg></span><span>设置</span><span class="list-arrow">›</span></div>
       <div class="list-item" id="item-wallet"><span class="list-icon"><svg class="ico" viewBox="0 0 24 24"><rect x="3" y="6.5" width="18" height="12" rx="3"/><path d="M3 10.5h18"/><circle cx="16.8" cy="14.5" r="1.3" fill="currentColor" stroke="none"/></svg></span><span>钱包</span><span class="list-arrow">›</span></div>
       <div class="list-item" id="item-judgments"><span class="list-icon"><svg class="ico" viewBox="0 0 24 24"><path d="M11 3.5l1.8 4.7 4.7 1.8-4.7 1.8L11 16.5l-1.8-4.7L4.5 10l4.7-1.8z"/><path d="M18.5 16l.6 1.6 1.6.6-1.6.6-.6 1.6-.6-1.6-1.6-.6 1.6-.6z"/></svg></span><span>判断力 API</span><span class="list-arrow">›</span></div>
+      <div class="list-item" id="item-contacts"><span class="list-icon"><svg class="ico" viewBox="0 0 24 24"><rect x="3.5" y="5.5" width="17" height="13" rx="2.5"/><path d="M3.5 9h17"/><circle cx="8.5" cy="14" r="1.6"/><path d="M12 13h5M12 15.5h3"/></svg></span><span>联系方式与授权</span><span class="list-arrow" id="contacts-arrow">›</span></div>
       <div class="list-item" id="item-login"><span class="list-icon"><svg class="ico" viewBox="0 0 24 24"><rect x="4.5" y="10.5" width="15" height="9.5" rx="2.5"/><path d="M8 10.5V7.5a4 4 0 0 1 8 0v3"/></svg></span><span id="login-label">登录</span><span class="list-arrow">›</span></div>
       <div class="list-item" id="item-logout"><span class="list-icon"><svg class="ico" viewBox="0 0 24 24"><path d="M14.5 4.5h3.5a2 2 0 0 1 2 2v11a2 2 0 0 1-2 2h-3.5"/><path d="M10 8.5l-3.5 3.5L10 15.5M6.5 12h8"/></svg></span><span>注销</span></div>
     </div>
@@ -235,3 +236,34 @@ if ('serviceWorker' in navigator) {
 </script>
 </body>
 </html>
+
+<!-- 联系方式与持久授权 (2026-09-19): 手机确认一次, Agent 长期自动使用 -->
+<div class="sheet" id="contacts-sheet" hidden>
+  <div class="sheet-inner">
+    <div class="sheet-title">联系方式与授权</div>
+    <div class="sheet-text" id="contacts-effective">加载中...</div>
+    <div class="sheet-text" id="contacts-signing" style="font-size:12px;color:var(--text-secondary)"></div>
+
+    <div id="contacts-approvals"></div>
+
+    <div class="sheet-title" style="margin-top:10px">我的联系方式</div>
+    <div id="contacts-list"><div class="sheet-text">加载中...</div></div>
+
+    <div style="margin-top:10px">
+      <input id="contacts-value" placeholder="手机号 (+86...) 或 邮箱" style="width:100%;padding:10px 12px;border-radius:10px;border:1px solid var(--border);background:transparent;color:var(--text);font-size:14px" />
+      <div style="display:flex;gap:8px;margin-top:8px">
+        <button class="sheet-choice" id="contacts-bind" style="flex:1">绑定并发送验证码</button>
+      </div>
+      <input id="contacts-code" placeholder="收到的验证码" inputmode="numeric" style="width:100%;margin-top:8px;padding:10px 12px;border-radius:10px;border:1px solid var(--border);background:transparent;color:var(--text);font-size:14px" />
+      <button class="sheet-choice" id="contacts-verify" style="margin-top:8px;width:100%">验证</button>
+    </div>
+
+    <div class="sheet-title" style="margin-top:12px">让 Bolloon 代表你联系外部的人</div>
+    <div class="sheet-text" id="contacts-willnot" style="font-size:12px"></div>
+    <div class="sheet-inner-choices" id="contacts-choices" style="margin-top:8px"></div>
+    <div class="sheet-inner-choices">
+      <button class="sheet-choice" id="contacts-revoke-all">撤销全部授权</button>
+      <button class="sheet-choice sheet-cancel" id="contacts-close">关闭</button>
+    </div>
+  </div>
+</div>