@bolloon/bolloon-agent 0.4.33 → 0.5.1

package/dist/web/mobile-core.js

@@ -1374,7 +1374,7 @@
   }
   function encode(data, alphabet4, bitsPerChar) {
     const pad2 = alphabet4[alphabet4.length - 1] === "=";
-    const mask = (1 << bitsPerChar) - 1;
+    const mask2 = (1 << bitsPerChar) - 1;
     let out = "";
     let bits = 0;
     let buffer6 = 0;
@@ -1383,11 +1383,11 @@
       bits += 8;
       while (bits > bitsPerChar) {
         bits -= bitsPerChar;
-        out += alphabet4[mask & buffer6 >> bits];
+        out += alphabet4[mask2 & buffer6 >> bits];
       }
     }
     if (bits !== 0) {
-      out += alphabet4[mask & buffer6 << bitsPerChar - bits];
+      out += alphabet4[mask2 & buffer6 << bitsPerChar - bits];
     }
     if (pad2) {
       while ((out.length * bitsPerChar & 7) !== 0) {
@@ -3361,8 +3361,8 @@
   }
   function encodeInteger(value2) {
     const contents = new Uint8ArrayList();
-    const mask = 128;
-    const positive2 = (value2.subarray()[0] & mask) === mask;
+    const mask2 = 128;
+    const positive2 = (value2.subarray()[0] & mask2) === mask2;
     if (positive2) {
       contents.append(Uint8Array.from([0]));
     }
@@ -4974,13 +4974,13 @@
     const windows = Math.ceil(scalarBits2 / W2) + 1;
     const windowSize = 2 ** (W2 - 1);
     const maxNumber = 2 ** W2;
-    const mask = bitMask(W2);
+    const mask2 = bitMask(W2);
     const shiftBy = BigInt(W2);
-    return { windows, windowSize, mask, maxNumber, shiftBy };
+    return { windows, windowSize, mask: mask2, maxNumber, shiftBy };
   }
   function calcOffsets(n, window2, wOpts) {
-    const { windowSize, mask, maxNumber, shiftBy } = wOpts;
-    let wbits = Number(n & mask);
+    const { windowSize, mask: mask2, maxNumber, shiftBy } = wOpts;
+    let wbits = Number(n & mask2);
     let nextN = n >> shiftBy;
     if (wbits > windowSize) {
       wbits -= maxNumber;
@@ -6801,18 +6801,18 @@
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -12897,9 +12897,9 @@ ${indent}[Error list was empty]`;
       }
     }
   }
-  function simpleMaskLength(mask) {
+  function simpleMaskLength(mask2) {
     let ones = 0;
-    for (let [index, byte] of mask.entries()) {
+    for (let [index, byte] of mask2.entries()) {
       if (byte === 255) {
         ones += 8;
         continue;
@@ -12911,8 +12911,8 @@ ${indent}[Error list was empty]`;
       if ((byte & 128) != 0) {
         return -1;
       }
-      for (let i = index + 1; i < mask.length; i++) {
-        if (mask[i] != 0) {
+      for (let i = index + 1; i < mask2.length; i++) {
+        if (mask2[i] != 0) {
           return -1;
         }
       }
@@ -12920,9 +12920,9 @@ ${indent}[Error list was empty]`;
     }
     return ones;
   }
-  function maskToHex(mask) {
+  function maskToHex(mask2) {
     let hex = "0x";
-    for (const byte of mask) {
+    for (const byte of mask2) {
       hex += (byte >> 4).toString(16) + (byte & 15).toString(16);
     }
     return hex;
@@ -12934,20 +12934,20 @@ ${indent}[Error list was empty]`;
   });
 
   // node_modules/@chainsafe/netmask/dist/src/ip.js
-  function maskIp(ip, mask) {
-    if (mask.length === IPv6Len && ip.length === IPv4Len && allFF(mask, 0, 11)) {
-      mask = mask.slice(12);
+  function maskIp(ip, mask2) {
+    if (mask2.length === IPv6Len && ip.length === IPv4Len && allFF(mask2, 0, 11)) {
+      mask2 = mask2.slice(12);
     }
-    if (mask.length === IPv4Len && ip.length === IPv6Len && deepEqual(ip, ipv4Prefix, 0, 11)) {
+    if (mask2.length === IPv4Len && ip.length === IPv6Len && deepEqual(ip, ipv4Prefix, 0, 11)) {
       ip = ip.slice(12);
     }
     const n = ip.length;
-    if (n != mask.length) {
+    if (n != mask2.length) {
       throw new Error("Failed to mask ip");
     }
     const out = new Uint8Array(n);
     for (let i = 0; i < n; i++) {
-      out[i] = ip[i] & mask[i];
+      out[i] = ip[i] & mask2[i];
     }
     return out;
   }
@@ -13009,10 +13009,10 @@ ${indent}[Error list was empty]`;
     if (Number.isNaN(m2) || String(m2).length !== maskString.length || m2 < 0 || m2 > ipLength * 8) {
       throw new Error("Failed to parse given CIDR: " + s2);
     }
-    const mask = cidrMask(m2, 8 * ipLength);
+    const mask2 = cidrMask(m2, 8 * ipLength);
     return {
-      network: maskIp(ip, mask),
-      mask
+      network: maskIp(ip, mask2),
+      mask: mask2
     };
   }
   function cidrMask(ones, bits) {
@@ -13054,18 +13054,18 @@ ${indent}[Error list was empty]`;
          * @param ipOrCidr either network ip or full cidr address
          * @param mask in case ipOrCidr is network this can be either mask in decimal format or as ip address
          */
-        constructor(ipOrCidr, mask) {
-          if (mask == null) {
+        constructor(ipOrCidr, mask2) {
+          if (mask2 == null) {
             ({ network: this.network, mask: this.mask } = parseCidr(ipOrCidr));
           } else {
             const ipResult = parseIP(ipOrCidr);
             if (ipResult == null) {
               throw new Error("Failed to parse network");
             }
-            mask = String(mask);
-            const m2 = parseInt(mask, 10);
-            if (Number.isNaN(m2) || String(m2).length !== mask.length || m2 < 0 || m2 > ipResult.length * 8) {
-              const maskResult = parseIP(mask);
+            mask2 = String(mask2);
+            const m2 = parseInt(mask2, 10);
+            if (Number.isNaN(m2) || String(m2).length !== mask2.length || m2 < 0 || m2 > ipResult.length * 8) {
+              const maskResult = parseIP(mask2);
               if (maskResult == null) {
                 throw new Error("Failed to parse mask");
               }
@@ -13087,8 +13087,8 @@ ${indent}[Error list was empty]`;
         /**Serializes back to string format */
         toString() {
           const l = simpleMaskLength(this.mask);
-          const mask = l !== -1 ? String(l) : maskToHex(this.mask);
-          return ipToString(this.network) + "/" + mask;
+          const mask2 = l !== -1 ? String(l) : maskToHex(this.mask);
+          return ipToString(this.network) + "/" + mask2;
         }
       };
     }
@@ -13309,11 +13309,11 @@ ${indent}[Error list was empty]`;
         }
       }
       var Netmask4Impl = class _Netmask4Impl {
-        constructor(net, mask) {
+        constructor(net, mask2) {
           if (typeof net !== "string") {
             throw new Error("Missing `net' parameter");
           }
-          let maskStr = mask;
+          let maskStr = mask2;
           if (!maskStr) {
             const parts = net.split("/", 2);
             net = parts[0];
@@ -13498,11 +13498,11 @@ ${indent}[Error list was empty]`;
         }
       }
       var Netmask6Impl = class _Netmask6Impl {
-        constructor(net, mask) {
+        constructor(net, mask2) {
           if (typeof net !== "string") {
             throw new Error("Missing `net' parameter");
           }
-          let prefixLen = mask;
+          let prefixLen = mask2;
           if (prefixLen === void 0 || prefixLen === null) {
             const slashIdx = net.indexOf("/");
             if (slashIdx !== -1) {
@@ -13585,15 +13585,15 @@ ${indent}[Error list was empty]`;
       } });
       var netmask6_1 = require_netmask6();
       var Netmask2 = class _Netmask {
-        constructor(net, mask) {
+        constructor(net, mask2) {
           if (typeof net !== "string") {
             throw new Error("Missing `net' parameter");
           }
           const addrPart = net.indexOf("/") !== -1 ? net.substring(0, net.indexOf("/")) : net;
           if (addrPart.indexOf(":") !== -1) {
-            this._impl = new netmask6_1.Netmask6Impl(net, mask);
+            this._impl = new netmask6_1.Netmask6Impl(net, mask2);
           } else {
-            this._impl = new netmask4_1.Netmask4Impl(net, mask);
+            this._impl = new netmask4_1.Netmask4Impl(net, mask2);
           }
           this.base = this._impl.base;
           this.mask = this._impl.mask;
@@ -18414,11 +18414,11 @@ ${indent}[Error list was empty]`;
   function toToken2(data, pos, prefix, length20, options2) {
     const totLength = prefix + length20;
     assertEnoughData(data, pos, totLength);
-    const tok = new Token(Type.string, toStr(data, pos + prefix, pos + totLength), totLength);
+    const tok2 = new Token(Type.string, toStr(data, pos + prefix, pos + totLength), totLength);
     if (options2.retainStringBytes === true) {
-      tok.byteValue = data.slice(pos + prefix, pos + totLength);
+      tok2.byteValue = data.slice(pos + prefix, pos + totLength);
     }
-    return tok;
+    return tok2;
   }
   function decodeStringCompact(data, pos, minor, options2) {
     return toToken2(data, pos, 1, minor, options2);
@@ -21481,18 +21481,18 @@ ${indent}[Error list was empty]`;
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -24141,18 +24141,18 @@ ${indent}[Error list was empty]`;
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -28712,18 +28712,18 @@ ${indent}[Error list was empty]`;
   }
   function multiaddrToIpNet(ma) {
     const config = getNetConfig(ma);
-    let mask = config.cidr;
+    let mask2 = config.cidr;
     if (config.type !== "ip4" && config.type !== "ip6") {
       throw new InvalidParametersError(`Multiaddr ${ma} was not an IPv4 or IPv6 address`);
     }
-    if (mask == null) {
+    if (mask2 == null) {
       switch (config.type) {
         case "ip4": {
-          mask = 32;
+          mask2 = 32;
           break;
         }
         case "ip6": {
-          mask = 128;
+          mask2 = 128;
           break;
         }
         default: {
@@ -28731,7 +28731,7 @@ ${indent}[Error list was empty]`;
         }
       }
     }
-    return new IpNet(config.host, mask);
+    return new IpNet(config.host, mask2);
   }
   function isDirect(ma) {
     return !Circuit.exactMatch(ma);
@@ -35926,12 +35926,12 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
             g[i] &= 8191;
           }
           g[9] -= 1 << 13;
-          let mask = (c ^ 1) - 1;
+          let mask2 = (c ^ 1) - 1;
           for (let i = 0; i < 10; i++)
-            g[i] &= mask;
-          mask = ~mask;
+            g[i] &= mask2;
+          mask2 = ~mask2;
           for (let i = 0; i < 10; i++)
-            h3[i] = h3[i] & mask | g[i];
+            h3[i] = h3[i] & mask2 | g[i];
           h3[0] = (h3[0] | h3[1] << 13) & 65535;
           h3[1] = (h3[1] >>> 3 | h3[2] << 10) & 65535;
           h3[2] = (h3[2] >>> 6 | h3[3] << 7) & 65535;
@@ -36669,7 +36669,7 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
   }
   function encode10(data, alphabet4, bitsPerChar) {
     const pad2 = alphabet4[alphabet4.length - 1] === "=";
-    const mask = (1 << bitsPerChar) - 1;
+    const mask2 = (1 << bitsPerChar) - 1;
     let out = "";
     let bits = 0;
     let buffer6 = 0;
@@ -36678,11 +36678,11 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
       bits += 8;
       while (bits > bitsPerChar) {
         bits -= bitsPerChar;
-        out += alphabet4[mask & buffer6 >> bits];
+        out += alphabet4[mask2 & buffer6 >> bits];
       }
     }
     if (bits !== 0) {
-      out += alphabet4[mask & buffer6 << bitsPerChar - bits];
+      out += alphabet4[mask2 & buffer6 << bitsPerChar - bits];
     }
     if (pad2) {
       while ((out.length * bitsPerChar & 7) !== 0) {
@@ -38978,18 +38978,18 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -41706,18 +41706,18 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -43635,18 +43635,18 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -45169,18 +45169,18 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -66360,8 +66360,8 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
           const view = new DataView(localKadId.buffer, localKadId.byteOffset, localKadId.byteLength);
           const localPrefix = view.getUint16(0, false);
           const toggledLocalPrefix = localPrefix ^ 32768 >> targetCommonPrefixLength;
-          const mask = 65535 << 16 - (targetCommonPrefixLength + 1);
-          const targetPrefix = toggledLocalPrefix & mask | randomPrefix & ~mask;
+          const mask2 = 65535 << 16 - (targetCommonPrefixLength + 1);
+          const targetPrefix = toggledLocalPrefix & mask2 | randomPrefix & ~mask2;
           const keyPrefix3 = generated_prefix_list_browser_default[targetPrefix];
           const keyBuffer = new ArrayBuffer(34);
           const keyView = new DataView(keyBuffer, 0, keyBuffer.byteLength);
@@ -67641,18 +67641,18 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -75209,18 +75209,18 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -81244,7 +81244,7 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
     let carry = 0;
     let pos = 0;
     const max = powers[from6];
-    const mask = powers[to] - 1;
+    const mask2 = powers[to] - 1;
     const res = [];
     for (const n of data) {
       anumber6(n);
@@ -81255,13 +81255,13 @@ ${[...listenStats.errors.entries()].map(([addr, err2]) => {
         throw new Error(`convertRadix2: carry overflow pos=${pos} from=${from6}`);
       pos += from6;
       for (; pos >= to; pos -= to)
-        res.push((carry >> pos - to & mask) >>> 0);
+        res.push((carry >> pos - to & mask2) >>> 0);
       const pow = powers[pos];
       if (pow === void 0)
         throw new Error("invalid carry");
       carry &= pow - 1;
     }
-    carry = carry << to - pos & mask;
+    carry = carry << to - pos & mask2;
     if (!padding2 && pos >= from6)
       throw new Error("Excess padding");
     if (!padding2 && carry > 0)
@@ -84769,13 +84769,13 @@ zoo`.split("\n");
     const windows = Math.ceil(scalarBits2 / W2) + 1;
     const windowSize = 2 ** (W2 - 1);
     const maxNumber = 2 ** W2;
-    const mask = bitMask2(W2);
+    const mask2 = bitMask2(W2);
     const shiftBy = BigInt(W2);
-    return { windows, windowSize, mask, maxNumber, shiftBy };
+    return { windows, windowSize, mask: mask2, maxNumber, shiftBy };
   }
   function calcOffsets2(n, window2, wOpts) {
-    const { windowSize, mask, maxNumber, shiftBy } = wOpts;
-    let wbits = Number(n & mask);
+    const { windowSize, mask: mask2, maxNumber, shiftBy } = wOpts;
+    let wbits = Number(n & mask2);
     let nextN = n >> shiftBy;
     if (wbits > windowSize) {
       wbits -= maxNumber;
@@ -87666,6 +87666,406 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
     }
   });
 
+  // src/agents/contacts/grant-payload.ts
+  function canonicalGrantPayload(g) {
+    return JSON.stringify({
+      grantId: g.grantId,
+      identityId: g.identityId,
+      ownerDid: g.ownerDid,
+      level: g.level,
+      channels: g.channels,
+      contactScope: g.contactScope,
+      taskScope: g.taskScope,
+      contentScope: g.contentScope,
+      replyWakeAllowed: g.replyWakeAllowed,
+      autoSend: g.autoSend,
+      sensitiveContentAllowed: g.sensitiveContentAllowed,
+      newRecipientAllowed: g.newRecipientAllowed,
+      grantedAt: g.grantedAt,
+      grantedBy: g.grantedBy,
+      grantedVia: g.grantedVia,
+      deviceIds: [...g.deviceIds].sort(),
+      status: g.status,
+      revokedAt: g.revokedAt || "",
+      grantVersion: g.grantVersion
+    });
+  }
+  function canonicalRevocationPayload(r) {
+    return JSON.stringify({ grantId: r.grantId, grantVersion: r.grantVersion, revokedAt: r.revokedAt, by: r.by });
+  }
+  function presetForChoice(choice) {
+    const base6 = { channels: "both", replyWakeAllowed: true, autoSend: true, newRecipientAllowed: false };
+    switch (choice) {
+      case "task_once":
+        return { ...base6, level: "task_once", contactScope: "verified_contacts", taskScope: "current_goal", contentScope: "normal", autoSend: false, sensitiveContentAllowed: false };
+      case "persistent":
+        return { ...base6, level: "persistent", contactScope: "verified_contacts", taskScope: "all_future_goals", contentScope: "normal", sensitiveContentAllowed: false };
+      case "full_contact_access":
+        return { ...base6, level: "full_contact_access", contactScope: "all_contacts", taskScope: "all_future_goals", contentScope: "sensitive", sensitiveContentAllowed: true };
+    }
+  }
+  var init_grant_payload = __esm({
+    "src/agents/contacts/grant-payload.ts"() {
+      "use strict";
+    }
+  });
+
+  // src/web/mobile-contacts.ts
+  var mobile_contacts_exports = {};
+  __export(mobile_contacts_exports, {
+    authorizeFromPhone: () => authorizeFromPhone,
+    bindFromPhone: () => bindFromPhone,
+    buildPhoneCard: () => buildPhoneCard,
+    decideApprovalFromPhone: () => decideApprovalFromPhone,
+    ed25519Available: () => ed25519Available,
+    flushQueuedGrants: () => flushQueuedGrants,
+    loadCapabilityCopy: () => loadCapabilityCopy,
+    loadFromDesktop: () => loadFromDesktop,
+    loadOrCreateDeviceKey: () => loadOrCreateDeviceKey,
+    pendingQueue: () => pendingQueue,
+    registerDeviceOnDesktop: () => registerDeviceOnDesktop,
+    revokeFromPhone: () => revokeFromPhone,
+    saveCapabilityCopy: () => saveCapabilityCopy,
+    sha256HexOf: () => sha256HexOf,
+    signGrantOnDevice: () => signGrantOnDevice,
+    signPayloadOnDevice: () => signPayloadOnDevice,
+    signPayloadWithMaterial: () => signPayloadWithMaterial,
+    signRevocationOnDevice: () => signRevocationOnDevice,
+    verifyFromPhone: () => verifyFromPhone
+  });
+  function ed25519Available(c) {
+    const cobj = cryptoOf(c);
+    if (!cobj?.subtle) return false;
+    try {
+      const alg = { name: "Ed25519" };
+      return typeof cobj.subtle.importKey === "function" && !!alg;
+    } catch {
+      return false;
+    }
+  }
+  function bytesOf(s2) {
+    const src4 = new TextEncoder().encode(s2);
+    const out = new Uint8Array(new ArrayBuffer(src4.byteLength));
+    out.set(src4);
+    return out;
+  }
+  function b64(buf) {
+    const arr = new Uint8Array(buf);
+    let out = "";
+    for (let i = 0; i < arr.length; i++) out += String.fromCharCode(arr[i]);
+    return btoa(out);
+  }
+  function pemFromSpki(spki) {
+    const b = b64(spki).replace(/(.{64})/g, "$1\n").trim();
+    return `-----BEGIN PUBLIC KEY-----
+${b}
+-----END PUBLIC KEY-----
+`;
+  }
+  async function sha256Hex(c, text) {
+    const d2 = await c.subtle.digest("SHA-256", bytesOf(text));
+    return [...new Uint8Array(d2)].map((x) => x.toString(16).padStart(2, "0")).join("");
+  }
+  async function loadOrCreateDeviceKey(storage2, c) {
+    const cobj = cryptoOf(c);
+    if (!cobj?.subtle) throw new Error("device_signing_unavailable: \u672C\u673A\u6CA1\u6709 WebCrypto");
+    const raw = storage2.getItem(K_DEVICE);
+    if (raw) {
+      try {
+        const parsed = JSON.parse(raw);
+        if (parsed?.privateKeyJwk && parsed?.publicKeyPem && parsed?.deviceId) return parsed;
+      } catch {
+      }
+    }
+    let pair;
+    try {
+      pair = await cobj.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
+    } catch (err2) {
+      throw new Error(`device_signing_unavailable: ${String(err2?.message || err2)}`);
+    }
+    const publicKeyPem = pemFromSpki(await cobj.subtle.exportKey("spki", pair.publicKey));
+    const privateKeyJwk = await cobj.subtle.exportKey("jwk", pair.privateKey);
+    const deviceId = `dev-${(await sha256Hex(cobj, publicKeyPem)).slice(0, 12)}`;
+    const material = { deviceId, publicKeyPem, privateKeyJwk };
+    storage2.setItem(K_DEVICE, JSON.stringify(material));
+    return material;
+  }
+  async function signGrantOnDevice(grant, storage2, c) {
+    return signPayloadOnDevice(canonicalGrantPayload(grant), storage2, c);
+  }
+  async function signRevocationOnDevice(rev, storage2, c) {
+    return signPayloadOnDevice(canonicalRevocationPayload(rev), storage2, c);
+  }
+  async function signPayloadOnDevice(payload, storage2, c) {
+    const cobj = cryptoOf(c);
+    if (!cobj?.subtle) throw new Error("device_signing_unavailable: \u672C\u673A\u6CA1\u6709 WebCrypto");
+    const material = await loadOrCreateDeviceKey(storage2, cobj);
+    const key = await cobj.subtle.importKey("jwk", material.privateKeyJwk, { name: "Ed25519" }, false, ["sign"]);
+    const bytes = bytesOf(String(payload ?? ""));
+    const sig = await cobj.subtle.sign({ name: "Ed25519" }, key, bytes);
+    return { deviceId: material.deviceId, alg: "ed25519", payloadHash: await sha256Hex(cobj, String(payload ?? "")), sig: b64(sig) };
+  }
+  async function sha256HexOf(text, c) {
+    const cobj = cryptoOf(c);
+    if (!cobj?.subtle) throw new Error("device_signing_unavailable: \u672C\u673A\u6CA1\u6709 WebCrypto");
+    return sha256Hex(cobj, String(text ?? ""));
+  }
+  async function signPayloadWithMaterial(payload, material, c) {
+    const cobj = cryptoOf(c);
+    if (!cobj?.subtle) throw new Error("device_signing_unavailable: \u672C\u673A\u6CA1\u6709 WebCrypto");
+    const key = await cobj.subtle.importKey("jwk", material.privateKeyJwk, { name: "Ed25519" }, false, ["sign"]);
+    const sig = await cobj.subtle.sign({ name: "Ed25519" }, key, bytesOf(String(payload ?? "")));
+    return { deviceId: material.deviceId, alg: "ed25519", payloadHash: await sha256Hex(cobj, String(payload ?? "")), sig: b64(sig) };
+  }
+  async function post(base6, path, body, f) {
+    const res = await f(`${String(base6).replace(/\/+$/, "")}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body ?? {})
+    });
+    let json = null;
+    try {
+      json = await res.json();
+    } catch {
+    }
+    return { status: res.status, json };
+  }
+  async function get(base6, path, f) {
+    const res = await f(`${String(base6).replace(/\/+$/, "")}${path}`);
+    let json = null;
+    try {
+      json = await res.json();
+    } catch {
+    }
+    return { status: res.status, json };
+  }
+  async function registerDeviceOnDesktop(base6, storage2, opts = {}) {
+    const f = opts.fetchImpl || fetch;
+    const dev = await loadOrCreateDeviceKey(storage2, opts.cryptoObj);
+    const r = await post(base6, "/api/contacts/devices", { deviceId: dev.deviceId, publicKeyPem: dev.publicKeyPem, label: opts.label || "\u624B\u673A" }, f);
+    if (r.status !== 200 || !r.json?.ok) return { ok: false, error: `\u684C\u9762\u672A\u63A5\u53D7\u8BBE\u5907\u767B\u8BB0: ${r.json?.error || r.status}`, data: dev };
+    return { ok: true, data: dev };
+  }
+  function saveCapabilityCopy(storage2, items) {
+    const clean8 = (items || []).map((c) => ({
+      contactId: String(c.contactId || ""),
+      kind: c.kind,
+      displayValue: String(c.displayValue || ""),
+      verificationStatus: String(c.verificationStatus || ""),
+      capabilities: [...c.capabilities || []],
+      provider: c.provider ? String(c.provider) : void 0,
+      state: c.state ? String(c.state) : void 0
+    }));
+    storage2.setItem(K_CAPS, JSON.stringify(clean8));
+  }
+  function loadCapabilityCopy(storage2) {
+    try {
+      const v = JSON.parse(storage2.getItem(K_CAPS) || "[]");
+      return Array.isArray(v) ? v : [];
+    } catch {
+      return [];
+    }
+  }
+  function pendingQueue(storage2) {
+    try {
+      const v = JSON.parse(storage2.getItem(K_QUEUE) || "[]");
+      return Array.isArray(v) ? v : [];
+    } catch {
+      return [];
+    }
+  }
+  function setQueue(storage2, q) {
+    storage2.setItem(K_QUEUE, JSON.stringify(q.slice(-20)));
+  }
+  async function flushQueuedGrants(base6, storage2, opts = {}) {
+    const f = opts.fetchImpl || fetch;
+    const q = pendingQueue(storage2);
+    const keep = [];
+    const results = [];
+    let sent = 0, failed = 0;
+    for (const item of q) {
+      try {
+        const r = await post(base6, "/api/contacts/grants/sync", { grant: { ...item.grant, signature: item.signature } }, f);
+        if (r.status === 200 && r.json?.ok) {
+          sent++;
+          results.push({ grantId: item.grant.grantId, ok: true });
+          continue;
+        }
+        failed++;
+        keep.push(item);
+        results.push({ grantId: item.grant.grantId, ok: false, error: r.json?.code || r.status });
+      } catch {
+        failed++;
+        keep.push(item);
+        results.push({ grantId: item.grant.grantId, ok: false, error: "network" });
+      }
+    }
+    setQueue(storage2, keep);
+    return { sent, failed, results };
+  }
+  async function authorizeFromPhone(input) {
+    const c = cryptoOf(input.cryptoObj);
+    if (!ed25519Available(c || void 0)) {
+      return { ok: false, error: "device_signing_unavailable: \u672C\u673A WebView \u4E0D\u652F\u6301 Ed25519 \u8BBE\u5907\u7B7E\u540D \u2014\u2014 \u8BF7\u5728\u684C\u9762\u7AEF\u6388\u6743 (\u6216\u5347\u7EA7\u7CFB\u7EDF WebView)" };
+    }
+    const dev = await loadOrCreateDeviceKey(input.storage, c);
+    const preset = presetForChoice(input.choice);
+    const grant = {
+      grantId: `gr-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`,
+      identityId: input.identityId || `sid-phone-${dev.deviceId.slice(-6)}`,
+      ownerDid: input.ownerDid,
+      ...preset,
+      grantedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      grantedBy: input.grantedBy || "leo",
+      grantedVia: "mobile",
+      deviceIds: [dev.deviceId],
+      status: "active",
+      grantVersion: 1
+    };
+    const signature = await signGrantOnDevice(grant, input.storage, c);
+    const f = input.fetchImpl || fetch;
+    const reg = await registerDeviceOnDesktop(input.base, input.storage, { fetchImpl: f, cryptoObj: c }).catch(() => ({ ok: false }));
+    if (!reg.ok) {
+      const q2 = pendingQueue(input.storage);
+      q2.push({ grant, signature, queuedAt: (/* @__PURE__ */ new Date()).toISOString() });
+      setQueue(input.storage, q2);
+      return {
+        ok: false,
+        queued: true,
+        error: `\u684C\u9762\u6682\u4E0D\u53EF\u8FBE \u2192 \u6388\u6743\u5DF2\u5B58\u5728\u624B\u673A, \u5F85\u684C\u9762\u5728\u7EBF\u65F6\u81EA\u52A8\u540C\u6B65 (${reg.error || "offline"})`,
+        data: { grantId: grant.grantId, level: grant.level, signature },
+        note: "\u684C\u9762\u4E0D\u5728\u7EBF\u65F6\u4E0D\u5047\u88C5\u5DF2\u751F\u6548: \u6388\u6743\u5728\u672C\u5730\u961F\u5217\u91CC, \u684C\u9762\u4E00\u4E0A\u7EBF\u5C31\u8865\u540C\u6B65"
+      };
+    }
+    const r = await post(input.base, "/api/contacts/grants/sync", { grant: { ...grant, signature } }, f);
+    if (r.status === 200 && r.json?.ok) {
+      return { ok: true, data: { grantId: grant.grantId, level: grant.level, signature }, note: "\u684C\u9762\u5DF2\u9A8C\u7B7E\u63A5\u53D7" };
+    }
+    const q = pendingQueue(input.storage);
+    q.push({ grant, signature, queuedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    setQueue(input.storage, q);
+    return {
+      ok: false,
+      queued: true,
+      error: `\u684C\u9762\u62D2\u7EDD/\u672A\u63A5\u53D7: ${r.json?.code || r.json?.reason || r.status}`,
+      data: { grantId: grant.grantId, level: grant.level, signature },
+      note: "\u5DF2\u4FDD\u5B58\u5728\u624B\u673A\u672C\u5730\u961F\u5217 (\u4E0D\u4F1A\u56E0\u4E3A\u5931\u8D25\u5C31\u5F53\u6210\u5DF2\u6388\u6743)"
+    };
+  }
+  async function revokeFromPhone(opts) {
+    const c = cryptoOf(opts.cryptoObj);
+    if (!ed25519Available(c || void 0)) return { ok: false, error: "device_signing_unavailable: \u672C\u673A\u4E0D\u652F\u6301\u8BBE\u5907\u7B7E\u540D, \u64A4\u9500\u9700\u5728\u684C\u9762\u7AEF\u8FDB\u884C" };
+    const revokedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const payload = { grantId: opts.grantId, grantVersion: opts.version || 1, revokedAt, by: "mobile" };
+    const signature = await signRevocationOnDevice(payload, opts.storage, c);
+    const f = opts.fetchImpl || fetch;
+    const r = await post(opts.base, "/api/contacts/grants/revoke-sync", { grantId: opts.grantId, by: "mobile", reason: opts.reason, version: payload.grantVersion, revokedAt, signature }, f);
+    if (r.status === 200 && r.json?.ok) return { ok: true, data: { grantId: opts.grantId }, note: "\u684C\u9762\u5DF2\u9A8C\u7B7E\u5E76\u7ACB\u5373\u5931\u6548" };
+    return { ok: false, error: `\u64A4\u9500\u672A\u9001\u8FBE: ${r.json?.code || r.json?.error || r.status}`, note: "\u684C\u9762\u4E0D\u5728\u7EBF\u65F6\u64A4\u9500**\u4E0D\u4F1A**\u88AB\u5F53\u4F5C\u5DF2\u5B8C\u6210 \u2014\u2014 \u8BF7\u5728\u684C\u9762\u5728\u7EBF\u540E\u91CD\u8BD5 (\u6216\u684C\u9762\u7AEF\u64A4\u9500)" };
+  }
+  async function loadFromDesktop(base6, storage2, opts = {}) {
+    const f = opts.fetchImpl || fetch;
+    if (!base6) {
+      const caps = loadCapabilityCopy(storage2);
+      return {
+        ok: false,
+        error: "desktop_offline",
+        data: { contacts: caps, grants: [], effective: "\u684C\u9762\u4E0D\u5728\u7EBF (\u663E\u793A\u624B\u673A\u672C\u5730\u526F\u672C)", approvals: [], waiting: [] },
+        note: "\u4EE5\u4E0B\u662F\u4F60\u624B\u673A\u4E0A\u4FDD\u5B58\u7684\u80FD\u529B\u526F\u672C (\u4E0D\u662F\u684C\u9762\u5B9E\u65F6\u72B6\u6001)"
+      };
+    }
+    try {
+      const a = await get(base6, "/api/contacts", f);
+      const b = await get(base6, "/api/contacts/grants", f);
+      if (a.status !== 200 && b.status !== 200) return { ok: false, error: `desktop_http_${a.status || b.status}` };
+      const view = {
+        contacts: a.json?.contacts || [],
+        grants: b.json?.grants || [],
+        effective: b.json?.effective || "",
+        approvals: a.json?.approvals || [],
+        waiting: a.json?.waiting || []
+      };
+      saveCapabilityCopy(storage2, (view.contacts || []).filter((c) => c.capabilities?.includes("send")).map((c) => ({
+        contactId: c.contactId,
+        kind: c.kind,
+        displayValue: c.displayValue,
+        verificationStatus: c.status,
+        capabilities: c.capabilities,
+        provider: c.provider,
+        state: c.status
+      })));
+      return { ok: true, data: view };
+    } catch (err2) {
+      const caps = loadCapabilityCopy(storage2);
+      return {
+        ok: false,
+        error: "desktop_offline",
+        data: { contacts: caps, grants: [], effective: "\u684C\u9762\u4E0D\u5728\u7EBF (\u663E\u793A\u624B\u673A\u672C\u5730\u526F\u672C)", approvals: [], waiting: [] },
+        note: `\u8FDE\u4E0D\u4E0A\u684C\u9762 (${String(err2?.message || err2).slice(0, 60)}) \u2014\u2014 \u663E\u793A\u672C\u5730\u526F\u672C`
+      };
+    }
+  }
+  async function bindFromPhone(base6, opts, storage2, f) {
+    const impl = f || fetch;
+    if (!base6) return { ok: false, error: "desktop_offline: \u7ED1\u5B9A\u9700\u8981\u684C\u9762\u7AEF\u5728\u7EBF (\u684C\u9762\u8D1F\u8D23\u843D\u76D8\u4E0E\u9A8C\u8BC1\u7801\u901A\u9053)" };
+    const r = await post(base6, "/api/contacts/bind", { kind: opts.kind, value: opts.value, region: opts.region }, impl);
+    if (r.status === 200 && r.json?.ok) return { ok: true, data: r.json };
+    return { ok: false, error: r.json?.error || `HTTP ${r.status}` };
+  }
+  async function verifyFromPhone(base6, opts, storage2, f) {
+    const impl = f || fetch;
+    if (!base6) return { ok: false, error: "desktop_offline: \u9A8C\u8BC1\u9700\u8981\u684C\u9762\u7AEF\u5728\u7EBF" };
+    const r = await post(base6, "/api/contacts/verify", { contactId: opts.contactId, challengeId: opts.challengeId, code: opts.code }, impl);
+    if (r.status === 200 && r.json?.ok) return { ok: true, data: r.json };
+    return { ok: false, error: r.json?.error || `HTTP ${r.status}` };
+  }
+  async function decideApprovalFromPhone(base6, opts, f) {
+    const impl = f || fetch;
+    if (!base6) return { ok: false, error: "desktop_offline: \u6279\u51C6\u9700\u8981\u684C\u9762\u7AEF\u5728\u7EBF (\u624B\u673A\u4E0D\u5728\u7EBF\u65F6\u4E0D\u4F1A\u5047\u88C5\u5DF2\u6279\u51C6)" };
+    const r = await post(base6, `/api/contacts/approvals/${encodeURIComponent(opts.consentId)}/${opts.action}`, { by: "leo", via: "mobile", body: opts.body, reason: opts.reason }, impl);
+    if (r.status === 200 && r.json?.ok) return { ok: true, data: r.json };
+    return { ok: false, error: r.json?.error || `HTTP ${r.status}` };
+  }
+  function buildPhoneCard(view, opts) {
+    return {
+      title: "\u8BA9 Bolloon \u4EE3\u8868\u4F60\u8054\u7CFB\u5916\u90E8\u7684\u4EBA",
+      effective: view?.effective || opts.offline || "\u672A\u77E5",
+      contacts: (view?.contacts || []).map((c) => ({
+        displayValue: c.displayValue || "",
+        kind: c.kind || "",
+        state: c.status || c.verificationStatus || "",
+        label: c.capabilities?.includes("send") ? "\u53EF\u8054\u7CFB" : "\u4E0D\u53EF\u8054\u7CFB"
+      })),
+      approvals: (view?.approvals || []).map((a) => ({
+        consentId: a.consentId,
+        contactName: a.contactName,
+        channel: a.channel,
+        subject: a.subject,
+        bodyPreview: a.bodyPreview || "",
+        reason: a.reason,
+        reallySent: !!a.reallySent
+      })),
+      choices: [
+        { id: "task_once", label: "\u4EC5\u672C\u6B21\u4EFB\u52A1" },
+        { id: "persistent", label: "\u957F\u671F\u4F7F\u7528 (\u63A8\u8350)" },
+        { id: "full_contact_access", label: "\u5B8C\u5168\u6388\u6743\u8054\u7CFB\u65B9\u5F0F\u80FD\u529B" }
+      ],
+      willNotGet: ["\u8BFB\u53D6\u5168\u90E8\u90AE\u7BB1", "\u8BFB\u53D6\u901A\u8BAF\u5F55", "\u7FA4\u53D1\u6D88\u606F", "\u81EA\u52A8\u652F\u4ED8/\u8F6C\u8D26", "\u4EE3\u8868\u4F60\u7B7E\u7F72\u5408\u540C", "\u62FF\u5230\u624B\u673A\u53F7/\u90AE\u7BB1\u660E\u6587"],
+      deviceSigning: opts.deviceSigning
+    };
+  }
+  var K_DEVICE, K_QUEUE, K_CAPS, cryptoOf;
+  var init_mobile_contacts = __esm({
+    "src/web/mobile-contacts.ts"() {
+      "use strict";
+      init_grant_payload();
+      K_DEVICE = "bolloon.contacts.device.v1";
+      K_QUEUE = "bolloon.contacts.queue.v1";
+      K_CAPS = "bolloon.contacts.capabilities.v1";
+      cryptoOf = (c) => c || globalThis.crypto || null;
+    }
+  });
+
   // src/web/mobile-social.ts
   var mobile_social_exports = {};
   __export(mobile_social_exports, {
@@ -88980,7 +89380,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
   });
 
   // node_modules/viem/_esm/utils/encoding/toHex.js
-  function toHex(value2, opts = {}) {
+  function toHex2(value2, opts = {}) {
     if (typeof value2 === "number" || typeof value2 === "bigint")
       return numberToHex(value2, opts);
     if (typeof value2 === "string") {
@@ -90103,13 +90503,13 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
     const windows = Math.ceil(scalarBits2 / W2) + 1;
     const windowSize = 2 ** (W2 - 1);
     const maxNumber = 2 ** W2;
-    const mask = bitMask3(W2);
+    const mask2 = bitMask3(W2);
     const shiftBy = BigInt(W2);
-    return { windows, windowSize, mask, maxNumber, shiftBy };
+    return { windows, windowSize, mask: mask2, maxNumber, shiftBy };
   }
   function calcOffsets3(n, window2, wOpts) {
-    const { windowSize, mask, maxNumber, shiftBy } = wOpts;
-    let wbits = Number(n & mask);
+    const { windowSize, mask: mask2, maxNumber, shiftBy } = wOpts;
+    let wbits = Number(n & mask2);
     let nextN = n >> shiftBy;
     if (wbits > windowSize) {
       wbits -= maxNumber;
@@ -91555,7 +91955,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
     const bytes = keccak_2562(isHex(value2, { strict: false }) ? toBytes3(value2) : value2);
     if (to === "bytes")
       return bytes;
-    return toHex(bytes);
+    return toHex2(bytes);
   }
   var init_keccak256 = __esm({
     "node_modules/viem/_esm/utils/hash/keccak256.js"() {
@@ -92241,9 +92641,9 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
       const { chainId, nonce, ...signature } = authorization;
       const contractAddress = authorization.address;
       serializedAuthorizationList.push([
-        chainId ? toHex(chainId) : "0x",
+        chainId ? toHex2(chainId) : "0x",
         contractAddress,
-        nonce ? toHex(nonce) : "0x",
+        nonce ? toHex2(nonce) : "0x",
         ...toYParitySignatureArray({}, signature)
       ]);
     }
@@ -92309,7 +92709,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
     const bytes = sha2568(isHex(value2, { strict: false }) ? toBytes3(value2) : value2);
     if (to === "bytes")
       return bytes;
-    return toHex(bytes);
+    return toHex2(bytes);
   }
   var init_sha2562 = __esm({
     "node_modules/viem/_esm/utils/hash/sha256.js"() {
@@ -93758,7 +94158,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
     return encodeAbiParameters(encodedTypes, encodedValues);
   }
   function hashType({ primaryType, types }) {
-    const encodedHashType = toHex(encodeType({ primaryType, types }));
+    const encodedHashType = toHex2(encodeType({ primaryType, types }));
     return keccak256(encodedHashType);
   }
   function encodeType({ primaryType, types }) {
@@ -93793,7 +94193,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
     if (type === "bytes")
       return [{ type: "bytes32" }, keccak256(value2)];
     if (type === "string")
-      return [{ type: "bytes32" }, keccak256(toHex(value2))];
+      return [{ type: "bytes32" }, keccak256(toHex2(value2))];
     if (type.lastIndexOf("]") === type.length - 1) {
       const parsedType = type.slice(0, type.lastIndexOf("["));
       const typeValuePairs = value2.map((item) => encodeField({
@@ -93838,7 +94238,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
   // node_modules/viem/_esm/accounts/privateKeyToAccount.js
   function privateKeyToAccount(privateKey, options2 = {}) {
     const { nonceManager } = options2;
-    const publicKey2 = toHex(secp256k13.getPublicKey(privateKey.slice(2), false));
+    const publicKey2 = toHex2(secp256k13.getPublicKey(privateKey.slice(2), false));
     const address = publicKeyToAddress(publicKey2);
     const account = toAccount({
       address,
@@ -94318,7 +94718,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
     } else {
       for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);
     }
-    return toHex(bytes);
+    return toHex2(bytes);
   }
   function bytesToBase64(bytes) {
     let out = "";
@@ -94569,7 +94969,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
     }
   }
   function deriveTokenId(agentId, serviceName) {
-    return BigInt(keccak256(toHex(`${agentId}:${serviceName}`)));
+    return BigInt(keccak256(toHex2(`${agentId}:${serviceName}`)));
   }
   async function registerServiceOnChain(params) {
     try {
@@ -95154,10 +95554,10 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
         let f = G;
         const pow_2_w = 2 ** W;
         const maxNum = pow_2_w;
-        const mask = big(pow_2_w - 1);
+        const mask2 = big(pow_2_w - 1);
         const shiftBy = big(W);
         for (let w2 = 0; w2 < pwindows; w2++) {
-          let wbits = Number(n & mask);
+          let wbits = Number(n & mask2);
           n >>= shiftBy;
           if (wbits > pwindowSize) {
             wbits -= maxNum;
@@ -96895,11 +97295,11 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
   function toToken6(data, pos, prefix, length20, options2) {
     const totLength = prefix + length20;
     assertEnoughData2(data, pos, totLength);
-    const tok = new Token2(Type2.string, toStr2(data, pos + prefix, pos + totLength), totLength);
+    const tok2 = new Token2(Type2.string, toStr2(data, pos + prefix, pos + totLength), totLength);
     if (options2.retainStringBytes === true) {
-      tok.byteValue = data.slice(pos + prefix, pos + totLength);
+      tok2.byteValue = data.slice(pos + prefix, pos + totLength);
     }
-    return tok;
+    return tok2;
   }
   function decodeStringCompact2(data, pos, minor, options2) {
     return toToken6(data, pos, 1, minor, options2);
@@ -98382,7 +98782,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
   }
   function encode15(data, alphabet4, bitsPerChar) {
     const pad2 = alphabet4[alphabet4.length - 1] === "=";
-    const mask = (1 << bitsPerChar) - 1;
+    const mask2 = (1 << bitsPerChar) - 1;
     let out = "";
     let bits = 0;
     let buffer6 = 0;
@@ -98391,11 +98791,11 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
       bits += 8;
       while (bits > bitsPerChar) {
         bits -= bitsPerChar;
-        out += alphabet4[mask & buffer6 >> bits];
+        out += alphabet4[mask2 & buffer6 >> bits];
       }
     }
     if (bits !== 0) {
-      out += alphabet4[mask & buffer6 << bitsPerChar - bits];
+      out += alphabet4[mask2 & buffer6 << bitsPerChar - bits];
     }
     if (pad2) {
       while ((out.length * bitsPerChar & 7) !== 0) {
@@ -99216,7 +99616,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
     computeCid: () => computeCid,
     createIpfsClient: () => createIpfsClient,
     createMemoryStorage: () => createMemoryStorage,
-    defaultStorage: () => defaultStorage2,
+    defaultStorage: () => defaultStorage3,
     getIpfsConfig: () => getIpfsConfig,
     ipfsCacheGet: () => ipfsCacheGet,
     ipfsCacheSet: () => ipfsCacheSet,
@@ -99247,7 +99647,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
       }
     };
   }
-  function defaultStorage2() {
+  function defaultStorage3() {
     try {
       if (typeof localStorage !== "undefined" && localStorage) {
         const probe = "__bolloon_ipfs_probe__";
@@ -99317,7 +99717,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
       }
     }
   }
-  function getIpfsConfig(storage2 = defaultStorage2()) {
+  function getIpfsConfig(storage2 = defaultStorage3()) {
     const base6 = { mode: "public", gateways: [...DEFAULT_GATEWAYS] };
     try {
       const raw = storage2.getItem(IPFS_CONFIG_KEY);
@@ -99336,7 +99736,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
       return base6;
     }
   }
-  function setIpfsConfig(cfg, storage2 = defaultStorage2()) {
+  function setIpfsConfig(cfg, storage2 = defaultStorage3()) {
     try {
       if (cfg.mode !== void 0 && !VALID_MODES.includes(cfg.mode)) {
         return { ok: false, error: `\u975E\u6CD5 mode: ${String(cfg.mode)} (\u5E94\u4E3A public|remote|pinata)` };
@@ -99384,7 +99784,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
     }
     return kept;
   }
-  function ipfsCacheGet(cid, storage2 = defaultStorage2()) {
+  function ipfsCacheGet(cid, storage2 = defaultStorage3()) {
     try {
       const key = normalizeCid(cid);
       if (!key) return null;
@@ -99404,7 +99804,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
       return null;
     }
   }
-  function ipfsCacheSet(cid, text, storage2 = defaultStorage2()) {
+  function ipfsCacheSet(cid, text, storage2 = defaultStorage3()) {
     try {
       const key = normalizeCid(cid);
       if (!key) return { ok: false, error: "cid \u4E0D\u80FD\u4E3A\u7A7A" };
@@ -99488,7 +99888,7 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
   async function ipfsFetch(cid, opts = {}) {
     const key = normalizeCid(cid);
     if (!key) return { ok: false, error: "cid \u4E0D\u80FD\u4E3A\u7A7A" };
-    const storage2 = opts.storage ?? defaultStorage2();
+    const storage2 = opts.storage ?? defaultStorage3();
     const useCache = opts.useCache !== false;
     if (useCache) {
       const cached = ipfsCacheGet(key, storage2);
@@ -100794,8 +101194,8 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
   }
   function encodeInteger2(value2) {
     const contents = new Uint8ArrayList10();
-    const mask = 128;
-    const positive2 = (value2.subarray()[0] & mask) === mask;
+    const mask2 = 128;
+    const positive2 = (value2.subarray()[0] & mask2) === mask2;
     if (positive2) {
       contents.append(Uint8Array.from([0]));
     }
@@ -100952,18 +101352,18 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -103864,18 +104264,18 @@ ${r.steps.map((s3) => `${s3.ok ? "\u2713" : "\u2717"} ${s3.step}: ${s3.note}`).j
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -114756,18 +115156,18 @@ ${values.join("\n")}` : `${blockName} :`;
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -117096,18 +117496,18 @@ ${values.join("\n")}` : `${blockName} :`;
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -122983,7 +123383,7 @@ ${values.join("\n")}` : `${blockName} :`;
   // node_modules/process/browser.js
   var require_browser4 = __commonJS({
     "node_modules/process/browser.js"(exports, module) {
-      var process = module.exports = {};
+      var process2 = module.exports = {};
       var cachedSetTimeout;
       var cachedClearTimeout;
       function defaultSetTimout() {
@@ -123088,7 +123488,7 @@ ${values.join("\n")}` : `${blockName} :`;
         draining = false;
         runClearTimeout(timeout);
       }
-      process.nextTick = function(fun) {
+      process2.nextTick = function(fun) {
         var args = new Array(arguments.length - 1);
         if (arguments.length > 1) {
           for (var i = 1; i < arguments.length; i++) {
@@ -123107,36 +123507,36 @@ ${values.join("\n")}` : `${blockName} :`;
       Item.prototype.run = function() {
         this.fun.apply(null, this.array);
       };
-      process.title = "browser";
-      process.browser = true;
-      process.env = {};
-      process.argv = [];
-      process.version = "";
-      process.versions = {};
+      process2.title = "browser";
+      process2.browser = true;
+      process2.env = {};
+      process2.argv = [];
+      process2.version = "";
+      process2.versions = {};
       function noop16() {
       }
-      process.on = noop16;
-      process.addListener = noop16;
-      process.once = noop16;
-      process.off = noop16;
-      process.removeListener = noop16;
-      process.removeAllListeners = noop16;
-      process.emit = noop16;
-      process.prependListener = noop16;
-      process.prependOnceListener = noop16;
-      process.listeners = function(name10) {
+      process2.on = noop16;
+      process2.addListener = noop16;
+      process2.once = noop16;
+      process2.off = noop16;
+      process2.removeListener = noop16;
+      process2.removeAllListeners = noop16;
+      process2.emit = noop16;
+      process2.prependListener = noop16;
+      process2.prependOnceListener = noop16;
+      process2.listeners = function(name10) {
         return [];
       };
-      process.binding = function(name10) {
+      process2.binding = function(name10) {
         throw new Error("process.binding is not supported");
       };
-      process.cwd = function() {
+      process2.cwd = function() {
         return "/";
       };
-      process.chdir = function(dir) {
+      process2.chdir = function(dir) {
         throw new Error("process.chdir is not supported");
       };
-      process.umask = function() {
+      process2.umask = function() {
         return 0;
       };
     }
@@ -123355,7 +123755,7 @@ ${values.join("\n")}` : `${blockName} :`;
   var require_end_of_stream = __commonJS({
     "node_modules/@libp2p/http-utils/node_modules/readable-stream/lib/internal/streams/end-of-stream.js"(exports, module) {
       "use strict";
-      var process = require_browser4();
+      var process2 = require_browser4();
       var { AbortError: AbortError6, codes } = require_errors();
       var { ERR_INVALID_ARG_TYPE, ERR_STREAM_PREMATURE_CLOSE } = codes;
       var { kEmptyObject, once } = require_util();
@@ -123491,17 +123891,17 @@ ${values.join("\n")}` : `${blockName} :`;
         }
         stream.on("close", onclose);
         if (closed) {
-          process.nextTick(onclose);
+          process2.nextTick(onclose);
         } else if (wState !== null && wState !== void 0 && wState.errorEmitted || rState !== null && rState !== void 0 && rState.errorEmitted) {
           if (!willEmitClose) {
-            process.nextTick(onclosed);
+            process2.nextTick(onclosed);
           }
         } else if (!readable && (!willEmitClose || isReadable(stream)) && (writableFinished || isWritable(stream) === false)) {
-          process.nextTick(onclosed);
+          process2.nextTick(onclosed);
         } else if (!writable && (!willEmitClose || isWritable(stream)) && (readableFinished || isReadable(stream) === false)) {
-          process.nextTick(onclosed);
+          process2.nextTick(onclosed);
         } else if (rState && stream.req && stream.aborted) {
-          process.nextTick(onclosed);
+          process2.nextTick(onclosed);
         }
         const cleanup = () => {
           callback = nop;
@@ -123529,7 +123929,7 @@ ${values.join("\n")}` : `${blockName} :`;
             );
           };
           if (options2.signal.aborted) {
-            process.nextTick(abort);
+            process2.nextTick(abort);
           } else {
             addAbortListener = addAbortListener || require_util().addAbortListener;
             const disposable = addAbortListener(options2.signal, abort);
@@ -123556,7 +123956,7 @@ ${values.join("\n")}` : `${blockName} :`;
             );
           };
           if (options2.signal.aborted) {
-            process.nextTick(abort);
+            process2.nextTick(abort);
           } else {
             addAbortListener = addAbortListener || require_util().addAbortListener;
             const disposable = addAbortListener(options2.signal, abort);
@@ -123569,7 +123969,7 @@ ${values.join("\n")}` : `${blockName} :`;
         }
         const resolverFn = (...args) => {
           if (!isAborted) {
-            process.nextTick(() => callback.apply(stream, args));
+            process2.nextTick(() => callback.apply(stream, args));
           }
         };
         PromisePrototypeThen(stream[kIsClosedPromise].promise, resolverFn, resolverFn);
@@ -123607,7 +124007,7 @@ ${values.join("\n")}` : `${blockName} :`;
   var require_destroy = __commonJS({
     "node_modules/@libp2p/http-utils/node_modules/readable-stream/lib/internal/streams/destroy.js"(exports, module) {
       "use strict";
-      var process = require_browser4();
+      var process2 = require_browser4();
       var {
         aggregateTwoErrors,
         codes: { ERR_MULTIPLE_CALLBACK },
@@ -123674,9 +124074,9 @@ ${values.join("\n")}` : `${blockName} :`;
             cb(err3);
           }
           if (err3) {
-            process.nextTick(emitErrorCloseNT, self2, err3);
+            process2.nextTick(emitErrorCloseNT, self2, err3);
           } else {
-            process.nextTick(emitCloseNT, self2);
+            process2.nextTick(emitCloseNT, self2);
           }
         }
         try {
@@ -123761,7 +124161,7 @@ ${values.join("\n")}` : `${blockName} :`;
             r.errored = err2;
           }
           if (sync) {
-            process.nextTick(emitErrorNT, stream, err2);
+            process2.nextTick(emitErrorNT, stream, err2);
           } else {
             emitErrorNT(stream, err2);
           }
@@ -123783,7 +124183,7 @@ ${values.join("\n")}` : `${blockName} :`;
         if (stream.listenerCount(kConstruct) > 1) {
           return;
         }
-        process.nextTick(constructNT, stream);
+        process2.nextTick(constructNT, stream);
       }
       function constructNT(stream) {
         let called = false;
@@ -123807,15 +124207,15 @@ ${values.join("\n")}` : `${blockName} :`;
           } else if (err2) {
             errorOrDestroy(stream, err2, true);
           } else {
-            process.nextTick(emitConstructNT, stream);
+            process2.nextTick(emitConstructNT, stream);
           }
         }
         try {
           stream._construct((err2) => {
-            process.nextTick(onConstruct, err2);
+            process2.nextTick(onConstruct, err2);
           });
         } catch (err2) {
-          process.nextTick(onConstruct, err2);
+          process2.nextTick(onConstruct, err2);
         }
       }
       function emitConstructNT(stream) {
@@ -123829,7 +124229,7 @@ ${values.join("\n")}` : `${blockName} :`;
       }
       function emitErrorCloseLegacy(stream, err2) {
         stream.emit("error", err2);
-        process.nextTick(emitCloseLegacy, stream);
+        process2.nextTick(emitCloseLegacy, stream);
       }
       function destroyer(stream, err2) {
         if (!stream || isDestroyed(stream)) {
@@ -123850,9 +124250,9 @@ ${values.join("\n")}` : `${blockName} :`;
         } else if (typeof stream.close === "function") {
           stream.close();
         } else if (err2) {
-          process.nextTick(emitErrorCloseLegacy, stream, err2);
+          process2.nextTick(emitErrorCloseLegacy, stream, err2);
         } else {
-          process.nextTick(emitCloseLegacy, stream);
+          process2.nextTick(emitCloseLegacy, stream);
         }
         if (!stream.destroyed) {
           stream[kIsDestroyed] = true;
@@ -124494,7 +124894,7 @@ ${values.join("\n")}` : `${blockName} :`;
   var require_from = __commonJS({
     "node_modules/@libp2p/http-utils/node_modules/readable-stream/lib/internal/streams/from.js"(exports, module) {
       "use strict";
-      var process = require_browser4();
+      var process2 = require_browser4();
       var { PromisePrototypeThen, SymbolAsyncIterator, SymbolIterator } = require_primordials();
       var { Buffer: Buffer2 } = require_buffer();
       var { ERR_INVALID_ARG_TYPE, ERR_STREAM_NULL_VALUES } = require_errors().codes;
@@ -124536,9 +124936,9 @@ ${values.join("\n")}` : `${blockName} :`;
         readable._destroy = function(error, cb) {
           PromisePrototypeThen(
             close(error),
-            () => process.nextTick(cb, error),
+            () => process2.nextTick(cb, error),
             // nextTick is here in case cb throws
-            (e) => process.nextTick(cb, e || error)
+            (e) => process2.nextTick(cb, e || error)
           );
         };
         async function close(error) {
@@ -124589,7 +124989,7 @@ ${values.join("\n")}` : `${blockName} :`;
   var require_readable = __commonJS({
     "node_modules/@libp2p/http-utils/node_modules/readable-stream/lib/internal/streams/readable.js"(exports, module) {
       "use strict";
-      var process = require_browser4();
+      var process2 = require_browser4();
       var {
         ArrayPrototypeIndexOf,
         NumberIsInteger,
@@ -124974,7 +125374,7 @@ ${values.join("\n")}` : `${blockName} :`;
         if (!state2.emittedReadable) {
           debug("emitReadable", state2.flowing);
           state2.emittedReadable = true;
-          process.nextTick(emitReadable_, stream);
+          process2.nextTick(emitReadable_, stream);
         }
       }
       function emitReadable_(stream) {
@@ -124990,7 +125390,7 @@ ${values.join("\n")}` : `${blockName} :`;
       function maybeReadMore(stream, state2) {
         if (!state2.readingMore && state2.constructed) {
           state2.readingMore = true;
-          process.nextTick(maybeReadMore_, stream, state2);
+          process2.nextTick(maybeReadMore_, stream, state2);
         }
       }
       function maybeReadMore_(stream, state2) {
@@ -125017,9 +125417,9 @@ ${values.join("\n")}` : `${blockName} :`;
         }
         state2.pipes.push(dest);
         debug("pipe count=%d opts=%j", state2.pipes.length, pipeOpts);
-        const doEnd = (!pipeOpts || pipeOpts.end !== false) && dest !== process.stdout && dest !== process.stderr;
+        const doEnd = (!pipeOpts || pipeOpts.end !== false) && dest !== process2.stdout && dest !== process2.stderr;
         const endFn = doEnd ? onend : unpipe;
-        if (state2.endEmitted) process.nextTick(endFn);
+        if (state2.endEmitted) process2.nextTick(endFn);
         else src4.once("end", endFn);
         dest.on("unpipe", onunpipe);
         function onunpipe(readable, unpipeInfo) {
@@ -125169,7 +125569,7 @@ ${values.join("\n")}` : `${blockName} :`;
             if (state2.length) {
               emitReadable(this);
             } else if (!state2.reading) {
-              process.nextTick(nReadingNextTick, this);
+              process2.nextTick(nReadingNextTick, this);
             }
           }
         }
@@ -125179,7 +125579,7 @@ ${values.join("\n")}` : `${blockName} :`;
       Readable.prototype.removeListener = function(ev, fn) {
         const res = Stream.prototype.removeListener.call(this, ev, fn);
         if (ev === "readable") {
-          process.nextTick(updateReadableListening, this);
+          process2.nextTick(updateReadableListening, this);
         }
         return res;
       };
@@ -125187,7 +125587,7 @@ ${values.join("\n")}` : `${blockName} :`;
       Readable.prototype.removeAllListeners = function(ev) {
         const res = Stream.prototype.removeAllListeners.apply(this, arguments);
         if (ev === "readable" || ev === void 0) {
-          process.nextTick(updateReadableListening, this);
+          process2.nextTick(updateReadableListening, this);
         }
         return res;
       };
@@ -125219,7 +125619,7 @@ ${values.join("\n")}` : `${blockName} :`;
       function resume(stream, state2) {
         if (!state2.resumeScheduled) {
           state2.resumeScheduled = true;
-          process.nextTick(resume_, stream, state2);
+          process2.nextTick(resume_, stream, state2);
         }
       }
       function resume_(stream, state2) {
@@ -125496,7 +125896,7 @@ ${values.join("\n")}` : `${blockName} :`;
         debug("endReadable", state2.endEmitted);
         if (!state2.endEmitted) {
           state2.ended = true;
-          process.nextTick(endReadableNT, state2, stream);
+          process2.nextTick(endReadableNT, state2, stream);
         }
       }
       function endReadableNT(state2, stream) {
@@ -125505,7 +125905,7 @@ ${values.join("\n")}` : `${blockName} :`;
           state2.endEmitted = true;
           stream.emit("end");
           if (stream.writable && stream.allowHalfOpen === false) {
-            process.nextTick(endWritableNT, stream);
+            process2.nextTick(endWritableNT, stream);
           } else if (state2.autoDestroy) {
             const wState = stream._writableState;
             const autoDestroy = !wState || wState.autoDestroy && // We don't expect the writable to ever 'finish'
@@ -125555,7 +125955,7 @@ ${values.join("\n")}` : `${blockName} :`;
   var require_writable = __commonJS({
     "node_modules/@libp2p/http-utils/node_modules/readable-stream/lib/internal/streams/writable.js"(exports, module) {
       "use strict";
-      var process = require_browser4();
+      var process2 = require_browser4();
       var {
         ArrayPrototypeSlice,
         Error: Error2,
@@ -125708,7 +126108,7 @@ ${values.join("\n")}` : `${blockName} :`;
           err2 = new ERR_STREAM_DESTROYED("write");
         }
         if (err2) {
-          process.nextTick(cb, err2);
+          process2.nextTick(cb, err2);
           errorOrDestroy(stream, err2, true);
           return err2;
         }
@@ -125798,7 +126198,7 @@ ${values.join("\n")}` : `${blockName} :`;
             stream._readableState.errored = er;
           }
           if (sync) {
-            process.nextTick(onwriteError, stream, state2, er, cb);
+            process2.nextTick(onwriteError, stream, state2, er, cb);
           } else {
             onwriteError(stream, state2, er, cb);
           }
@@ -125816,7 +126216,7 @@ ${values.join("\n")}` : `${blockName} :`;
                 stream,
                 state: state2
               };
-              process.nextTick(afterWriteTick, state2.afterWriteTickInfo);
+              process2.nextTick(afterWriteTick, state2.afterWriteTickInfo);
             }
           } else {
             afterWrite(stream, state2, 1, cb);
@@ -125953,7 +126353,7 @@ ${values.join("\n")}` : `${blockName} :`;
         }
         if (typeof cb === "function") {
           if (err2 || state2.finished) {
-            process.nextTick(cb, err2);
+            process2.nextTick(cb, err2);
           } else {
             state2[kOnFinished].push(cb);
           }
@@ -125982,7 +126382,7 @@ ${values.join("\n")}` : `${blockName} :`;
             state2.prefinished = true;
             stream.emit("prefinish");
             state2.pendingcb++;
-            process.nextTick(finish, stream, state2);
+            process2.nextTick(finish, stream, state2);
           }
         }
         state2.sync = true;
@@ -126011,7 +126411,7 @@ ${values.join("\n")}` : `${blockName} :`;
           if (state2.pendingcb === 0) {
             if (sync) {
               state2.pendingcb++;
-              process.nextTick(
+              process2.nextTick(
                 (stream2, state3) => {
                   if (needFinish(state3)) {
                     finish(stream2, state3);
@@ -126146,7 +126546,7 @@ ${values.join("\n")}` : `${blockName} :`;
       Writable.prototype.destroy = function(err2, cb) {
         const state2 = this._writableState;
         if (!state2.destroyed && (state2.bufferedIndex < state2.buffered.length || state2[kOnFinished].length)) {
-          process.nextTick(errorBuffer, state2);
+          process2.nextTick(errorBuffer, state2);
         }
         destroy.call(this, err2, cb);
         return this;
@@ -126175,7 +126575,7 @@ ${values.join("\n")}` : `${blockName} :`;
   // node_modules/@libp2p/http-utils/node_modules/readable-stream/lib/internal/streams/duplexify.js
   var require_duplexify = __commonJS({
     "node_modules/@libp2p/http-utils/node_modules/readable-stream/lib/internal/streams/duplexify.js"(exports, module) {
-      var process = require_browser4();
+      var process2 = require_browser4();
       var bufferModule = require_buffer();
       var {
         isReadable,
@@ -126288,9 +126688,9 @@ ${values.join("\n")}` : `${blockName} :`;
                 final(async () => {
                   try {
                     await promise;
-                    process.nextTick(cb, null);
+                    process2.nextTick(cb, null);
                   } catch (err2) {
-                    process.nextTick(cb, err2);
+                    process2.nextTick(cb, err2);
                   }
                 });
               },
@@ -126369,7 +126769,7 @@ ${values.join("\n")}` : `${blockName} :`;
               const _promise = promise;
               promise = null;
               const { chunk, done, cb } = await _promise;
-              process.nextTick(cb);
+              process2.nextTick(cb);
               if (done) return;
               if (signal.aborted)
                 throw new AbortError6(void 0, {
@@ -126760,7 +127160,7 @@ ${values.join("\n")}` : `${blockName} :`;
   // node_modules/@libp2p/http-utils/node_modules/readable-stream/lib/internal/streams/pipeline.js
   var require_pipeline = __commonJS({
     "node_modules/@libp2p/http-utils/node_modules/readable-stream/lib/internal/streams/pipeline.js"(exports, module) {
-      var process = require_browser4();
+      var process2 = require_browser4();
       var { ArrayIsArray, Promise: Promise2, SymbolAsyncIterator, SymbolDispose } = require_primordials();
       var eos = require_end_of_stream();
       var { once } = require_util();
@@ -126962,7 +127362,7 @@ ${values.join("\n")}` : `${blockName} :`;
             if (!error) {
               lastStreamCleanup.forEach((fn) => fn());
             }
-            process.nextTick(callback, error, value2);
+            process2.nextTick(callback, error, value2);
           }
         }
         let ret;
@@ -127041,11 +127441,11 @@ ${values.join("\n")}` : `${blockName} :`;
                     if (end) {
                       pt.end();
                     }
-                    process.nextTick(finish);
+                    process2.nextTick(finish);
                   },
                   (err2) => {
                     pt.destroy(err2);
-                    process.nextTick(finish, err2);
+                    process2.nextTick(finish, err2);
                   }
                 );
               } else if (isIterable2(ret, true)) {
@@ -127126,7 +127526,7 @@ ${values.join("\n")}` : `${blockName} :`;
           }
         }
         if (signal !== null && signal !== void 0 && signal.aborted || outerSignal !== null && outerSignal !== void 0 && outerSignal.aborted) {
-          process.nextTick(abort);
+          process2.nextTick(abort);
         }
         return ret;
       }
@@ -127147,7 +127547,7 @@ ${values.join("\n")}` : `${blockName} :`;
           };
           var endFn = endFn2;
           if (isReadableFinished(src4)) {
-            process.nextTick(endFn2);
+            process2.nextTick(endFn2);
           } else {
             src4.once("end", endFn2);
           }
@@ -129350,12 +129750,12 @@ ${values.join("\n")}` : `${blockName} :`;
         type: MESSAGE_TYPES[opcode]
       };
     }
-    let mask;
+    let mask2;
     if (isMasked) {
       if (buf.byteLength < offset + 4) {
         return;
       }
-      mask = buf.subarray(offset, offset + 4);
+      mask2 = buf.subarray(offset, offset + 4);
       offset += 4;
     }
     if (buf.byteLength < offset + length20) {
@@ -129363,8 +129763,8 @@ ${values.join("\n")}` : `${blockName} :`;
     }
     let data = buf.subarray(offset, offset + length20);
     offset += length20;
-    if (mask != null) {
-      data = applyMask(data, mask);
+    if (mask2 != null) {
+      data = applyMask(data, mask2);
     }
     buf.consume(offset);
     return {
@@ -129372,12 +129772,12 @@ ${values.join("\n")}` : `${blockName} :`;
       data
     };
   }
-  function applyMask(data, mask) {
+  function applyMask(data, mask2) {
     let m2 = 0;
     for (let i = 0; i < data.byteLength; i++) {
-      data[i] = data[i] ^ mask[m2];
+      data[i] = data[i] ^ mask2[m2];
       m2++;
-      if (m2 === mask.byteLength) {
+      if (m2 === mask2.byteLength) {
         m2 = 0;
       }
     }
@@ -131917,18 +132317,18 @@ ${values.join("\n")}` : `${blockName} :`;
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -135418,12 +135818,12 @@ ${values.join("\n")}` : `${blockName} :`;
             g[i] &= 8191;
           }
           g[9] -= 1 << 13;
-          let mask = (c ^ 1) - 1;
+          let mask2 = (c ^ 1) - 1;
           for (let i = 0; i < 10; i++)
-            g[i] &= mask;
-          mask = ~mask;
+            g[i] &= mask2;
+          mask2 = ~mask2;
           for (let i = 0; i < 10; i++)
-            h3[i] = h3[i] & mask | g[i];
+            h3[i] = h3[i] & mask2 | g[i];
           h3[0] = (h3[0] | h3[1] << 13) & 65535;
           h3[1] = (h3[1] >>> 3 | h3[2] << 10) & 65535;
           h3[2] = (h3[2] >>> 6 | h3[3] << 7) & 65535;
@@ -136870,18 +137270,18 @@ ${values.join("\n")}` : `${blockName} :`;
          * Zig-zag encodes this long bits
          */
         zzEncode() {
-          const mask = this.hi >> 31;
-          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask) >>> 0;
-          this.lo = (this.lo << 1 ^ mask) >>> 0;
+          const mask2 = this.hi >> 31;
+          this.hi = ((this.hi << 1 | this.lo >>> 31) ^ mask2) >>> 0;
+          this.lo = (this.lo << 1 ^ mask2) >>> 0;
           return this;
         }
         /**
          * Zig-zag decodes this long bits
          */
         zzDecode() {
-          const mask = -(this.lo & 1);
-          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask) >>> 0;
-          this.hi = (this.hi >>> 1 ^ mask) >>> 0;
+          const mask2 = -(this.lo & 1);
+          this.lo = ((this.lo >>> 1 | this.hi << 31) ^ mask2) >>> 0;
+          this.hi = (this.hi >>> 1 ^ mask2) >>> 0;
           return this;
         }
         /**
@@ -139954,11 +140354,11 @@ a=end-of-candidates
   function toToken10(data, pos, prefix, length20, options2) {
     const totLength = prefix + length20;
     assertEnoughData3(data, pos, totLength);
-    const tok = new Token3(Type3.string, toStr3(data, pos + prefix, pos + totLength), totLength);
+    const tok2 = new Token3(Type3.string, toStr3(data, pos + prefix, pos + totLength), totLength);
     if (options2.retainStringBytes === true) {
-      tok.byteValue = data.slice(pos + prefix, pos + totLength);
+      tok2.byteValue = data.slice(pos + prefix, pos + totLength);
     }
-    return tok;
+    return tok2;
   }
   function decodeStringCompact3(data, pos, minor, options2) {
     return toToken10(data, pos, 1, minor, options2);
@@ -142177,11 +142577,11 @@ a=end-of-candidates
   function toToken14(data, pos, prefix, length20, options2) {
     const totLength = prefix + length20;
     assertEnoughData4(data, pos, totLength);
-    const tok = new Token4(Type4.string, toStr4(data, pos + prefix, pos + totLength), totLength);
+    const tok2 = new Token4(Type4.string, toStr4(data, pos + prefix, pos + totLength), totLength);
     if (options2.retainStringBytes === true) {
-      tok.byteValue = data.slice(pos + prefix, pos + totLength);
+      tok2.byteValue = data.slice(pos + prefix, pos + totLength);
     }
-    return tok;
+    return tok2;
   }
   function decodeStringCompact4(data, pos, minor, options2) {
     return toToken14(data, pos, 1, minor, options2);
@@ -148151,11 +148551,11 @@ ${indent}[Error list was empty]`;
   function toToken18(data, pos, prefix, length20, options2) {
     const totLength = prefix + length20;
     assertEnoughData5(data, pos, totLength);
-    const tok = new Token5(Type5.string, toStr5(data, pos + prefix, pos + totLength), totLength);
+    const tok2 = new Token5(Type5.string, toStr5(data, pos + prefix, pos + totLength), totLength);
     if (options2.retainStringBytes === true) {
-      tok.byteValue = data.slice(pos + prefix, pos + totLength);
+      tok2.byteValue = data.slice(pos + prefix, pos + totLength);
     }
-    return tok;
+    return tok2;
   }
   function decodeStringCompact5(data, pos, minor, options2) {
     return toToken18(data, pos, 1, minor, options2);
@@ -150573,14 +150973,14 @@ ${error.stack}` : head;
       return out;
     }
   }
-  function heliaEnabled(storage2 = defaultStorage2()) {
+  function heliaEnabled(storage2 = defaultStorage3()) {
     try {
       return storage2.getItem(HELIA_ENABLED_KEY) === "1";
     } catch {
       return false;
     }
   }
-  function setHeliaEnabled(enabled, storage2 = defaultStorage2()) {
+  function setHeliaEnabled(enabled, storage2 = defaultStorage3()) {
     try {
       storage2.setItem(HELIA_ENABLED_KEY, enabled ? "1" : "0");
       return { ok: true, enabled: !!enabled };
@@ -150926,8 +151326,8 @@ ${error.stack}` : head;
         N3: 40,
         N4: 10
       };
-      exports.isValid = function isValid2(mask) {
-        return mask != null && mask !== "" && !isNaN(mask) && mask >= 0 && mask <= 7;
+      exports.isValid = function isValid2(mask2) {
+        return mask2 != null && mask2 !== "" && !isNaN(mask2) && mask2 >= 0 && mask2 <= 7;
       };
       exports.from = function from6(value2) {
         return exports.isValid(value2) ? parseInt(value2, 10) : void 0;
@@ -151731,8 +152131,8 @@ ${error.stack}` : head;
       var G15 = 1 << 10 | 1 << 8 | 1 << 5 | 1 << 4 | 1 << 2 | 1 << 1 | 1 << 0;
       var G15_MASK = 1 << 14 | 1 << 12 | 1 << 10 | 1 << 4 | 1 << 1;
       var G15_BCH = Utils.getBCHDigit(G15);
-      exports.getEncodedBits = function getEncodedBits(errorCorrectionLevel, mask) {
-        const data = errorCorrectionLevel.bit << 3 | mask;
+      exports.getEncodedBits = function getEncodedBits(errorCorrectionLevel, mask2) {
+        const data = errorCorrectionLevel.bit << 3 | mask2;
         let d2 = data << 10;
         while (Utils.getBCHDigit(d2) - G15_BCH >= 0) {
           d2 ^= G15 << Utils.getBCHDigit(d2) - G15_BCH;
@@ -152459,16 +152859,16 @@ ${error.stack}` : head;
         }
         let errorCorrectionLevel = ECLevel.M;
         let version4;
-        let mask;
+        let mask2;
         if (typeof options2 !== "undefined") {
           errorCorrectionLevel = ECLevel.from(options2.errorCorrectionLevel, ECLevel.M);
           version4 = Version.from(options2.version);
-          mask = MaskPattern.from(options2.maskPattern);
+          mask2 = MaskPattern.from(options2.maskPattern);
           if (options2.toSJISFunc) {
             Utils.setToSJISFunction(options2.toSJISFunc);
           }
         }
-        return createSymbol(data, version4, errorCorrectionLevel, mask);
+        return createSymbol(data, version4, errorCorrectionLevel, mask2);
       };
     }
   });
@@ -153787,8 +154187,8 @@ ${error.stack}` : head;
                       var bitsLeft = 8 - this.bitOffset;
                       var toRead = numBits < bitsLeft ? numBits : bitsLeft;
                       var bitsToNotRead = bitsLeft - toRead;
-                      var mask = 255 >> 8 - toRead << bitsToNotRead;
-                      result = (this.bytes[this.byteOffset] & mask) >> bitsToNotRead;
+                      var mask2 = 255 >> 8 - toRead << bitsToNotRead;
+                      result = (this.bytes[this.byteOffset] & mask2) >> bitsToNotRead;
                       numBits -= toRead;
                       this.bitOffset += toRead;
                       if (this.bitOffset === 8) {
@@ -153804,8 +154204,8 @@ ${error.stack}` : head;
                       }
                       if (numBits > 0) {
                         var bitsToNotRead = 8 - numBits;
-                        var mask = 255 >> bitsToNotRead << bitsToNotRead;
-                        result = result << numBits | (this.bytes[this.byteOffset] & mask) >> bitsToNotRead;
+                        var mask2 = 255 >> bitsToNotRead << bitsToNotRead;
+                        result = result << numBits | (this.bytes[this.byteOffset] & mask2) >> bitsToNotRead;
                         this.bitOffset += numBits;
                       }
                     }
@@ -162923,129 +163323,345 @@ ${error.stack}` : head;
     return result;
   }
 
-  // src/agents/contacts/grant-payload.ts
-  function canonicalGrantPayload(g) {
+  // src/web/mobile-core.ts
+  init_mobile_contacts();
+
+  // src/agents/mobile-task-actions.ts
+  var MOBILE_TASK_ACTION_KINDS = [
+    "group_join",
+    // 入群 (加入一个 OrbitDB 群 store)
+    "group_leave",
+    // 退群
+    "group_create",
+    // 建群 (会自动入群)
+    "announce_publish",
+    // 发布任务公告 (落盘公告 + 向注册表公告 + 记脉冲)
+    "announce_to_group",
+    // 把板上的公告推进群里 (CLI: bolloon task announce)
+    "trail_post"
+    // 过程留痕: 接单/交付/初筛/终审 (CLI: bolloon task post)
+  ];
+  var TASK_ACTION_TTL_MS = 10 * 6e4;
+  var TASK_ACTION_DEFAULT_TTL_MS = 5 * 6e4;
+  var TASK_ACTION_CLOCK_SKEW_MS = 2 * 6e4;
+  function tok(v) {
+    if (v === null || v === void 0) return "-";
+    const s2 = String(v);
+    if (!s2) return "-";
+    return s2.replace(/\r?\n/g, "\\n");
+  }
+  function taskActionContentText(req) {
+    const kind = String(req?.kind ?? "");
+    const base6 = [
+      `kind=${tok(kind)}`,
+      `group=${tok(req?.groupRef)}`,
+      `ann=${tok(req?.announcementId)}`
+    ];
+    if (kind === "announce_publish") {
+      base6.push(`cap=${tok(req?.capability)}`);
+      base6.push(`budget=${tok(req?.budgetHuman)}${req?.currency ? `@${tok(req.currency)}` : ""}`);
+      base6.push(`deadline=${tok(req?.deadline)}`);
+      base6.push(`instruction=${tok(req?.instruction)}`);
+    } else if (kind === "announce_to_group") {
+      base6.push(`criteria=${tok(req?.criteria)}`);
+    } else if (kind === "trail_post") {
+      base6.push(`trail=${tok(req?.trailKind)}`);
+      base6.push(`round=${tok(req?.round)}`);
+      base6.push(`price=${tok(req?.price)}`);
+      base6.push(`hash=${tok(req?.hash)}`);
+      base6.push(`bytes=${tok(req?.bytes)}`);
+      base6.push(`checks=${tok(req?.checks)}`);
+      base6.push(`verdict=${tok(req?.verdict)}`);
+    }
+    return base6.join("\n");
+  }
+  function canonicalTaskActionPayload(a) {
     return JSON.stringify({
-      grantId: g.grantId,
-      identityId: g.identityId,
-      ownerDid: g.ownerDid,
-      level: g.level,
-      channels: g.channels,
-      contactScope: g.contactScope,
-      taskScope: g.taskScope,
-      contentScope: g.contentScope,
-      replyWakeAllowed: g.replyWakeAllowed,
-      autoSend: g.autoSend,
-      sensitiveContentAllowed: g.sensitiveContentAllowed,
-      newRecipientAllowed: g.newRecipientAllowed,
-      grantedAt: g.grantedAt,
-      grantedBy: g.grantedBy,
-      grantedVia: g.grantedVia,
-      deviceIds: [...g.deviceIds].sort(),
-      status: g.status,
-      revokedAt: g.revokedAt || "",
-      grantVersion: g.grantVersion
+      actionId: a.actionId,
+      kind: a.kind,
+      deviceId: a.deviceId,
+      ownerDid: a.ownerDid,
+      targetRef: a.targetRef || "",
+      contentDigest: a.contentDigest,
+      createdAt: a.createdAt,
+      expiresAt: a.expiresAt,
+      grantedBy: a.grantedBy,
+      via: a.via
     });
   }
-  function canonicalRevocationPayload(r) {
-    return JSON.stringify({ grantId: r.grantId, grantVersion: r.grantVersion, revokedAt: r.revokedAt, by: r.by });
-  }
-  function presetForChoice(choice) {
-    const base6 = { channels: "both", replyWakeAllowed: true, autoSend: true, newRecipientAllowed: false };
-    switch (choice) {
-      case "task_once":
-        return { ...base6, level: "task_once", contactScope: "verified_contacts", taskScope: "current_goal", contentScope: "normal", autoSend: false, sensitiveContentAllowed: false };
-      case "persistent":
-        return { ...base6, level: "persistent", contactScope: "verified_contacts", taskScope: "all_future_goals", contentScope: "normal", sensitiveContentAllowed: false };
-      case "full_contact_access":
-        return { ...base6, level: "full_contact_access", contactScope: "all_contacts", taskScope: "all_future_goals", contentScope: "sensitive", sensitiveContentAllowed: true };
-    }
+  function isIso(s2) {
+    return typeof s2 === "string" && s2.length >= 20 && Number.isFinite(Date.parse(s2));
+  }
+  function checkTaskActionFreshness(a, now) {
+    if (!isIso(a?.createdAt) || !isIso(a?.expiresAt)) return { ok: false, reason: "bad_time" };
+    const created = Date.parse(a.createdAt);
+    const expires = Date.parse(a.expiresAt);
+    if (expires - created > TASK_ACTION_TTL_MS) return { ok: false, reason: "ttl_too_long" };
+    if (expires < created) return { ok: false, reason: "bad_time" };
+    if (now > expires) return { ok: false, reason: "expired" };
+    if (now < created - TASK_ACTION_CLOCK_SKEW_MS) return { ok: false, reason: "not_yet_valid" };
+    return { ok: true };
   }
 
-  // src/web/mobile-contacts.ts
-  var K_DEVICE = "bolloon.contacts.device.v1";
-  var K_QUEUE = "bolloon.contacts.queue.v1";
-  var K_CAPS = "bolloon.contacts.capabilities.v1";
-  var cryptoOf = (c) => c || globalThis.crypto || null;
-  function ed25519Available(c) {
-    const cobj = cryptoOf(c);
-    if (!cobj?.subtle) return false;
-    try {
-      const alg = { name: "Ed25519" };
-      return typeof cobj.subtle.importKey === "function" && !!alg;
-    } catch {
-      return false;
-    }
+  // src/agents/task-public-text.ts
+  var PRIVACY_RULES = [
+    { rule: "wallet-address", why: "\u4EE5\u592A\u574A/EVM \u94B1\u5305\u5730\u5740", re: /(?<![0-9a-fA-FxX])0x[0-9a-fA-F]{40}(?![0-9a-fA-F])/ },
+    { rule: "private-key-hex", why: "32 \u5B57\u8282\u79C1\u94A5\u5F62\u6001 (0x + 64 hex)", re: /(?<![0-9a-fA-FxX])0x[0-9a-fA-F]{64}(?![0-9a-fA-F])/ },
+    { rule: "hex-0x-blob", why: "0x \u5F00\u5934\u7684\u5341\u516D\u8FDB\u5236\u5757 (\u7B7E\u540D/\u54C8\u5E0C/\u5BC6\u94A5\u90FD\u957F\u8FD9\u6837, \u7FA4\u91CC\u4E00\u5F8B\u4E0D\u653E\u539F\u6587)", re: /(?<![0-9a-fA-FxX])0x[0-9a-fA-F]{8,}(?![0-9a-fA-F])/ },
+    { rule: "did", why: "\u53BB\u4E2D\u5FC3\u5316\u8EAB\u4EFD DID", re: /did:[a-z0-9]+:[A-Za-z0-9._:%-]{3,}/i },
+    { rule: "peer-id", why: "libp2p peerId (12D3Koo\u2026/Qm\u2026)", re: /12D3Koo[A-Za-z0-9]{8,}|Qm[1-9A-HJ-NP-Za-km-z]{30,}/ },
+    { rule: "multiaddr", why: "libp2p multiaddr \u6216 store \u5730\u5740 (/ip4 /tcp /p2p /orbitdb \u2026)", re: /\/(ip4|ip6|dns|dns4|dns6|tcp|udp|ws|wss|quic|p2p|p2p-circuit|ipfs|orbitdb)(?![A-Za-z0-9])/i },
+    { rule: "orbitdb-link", why: "OrbitDB \u94FE\u63A5 (\u7FA4\u9080\u8BF7\u94FE\u63A5\u672C\u8EAB\u4E5F\u4E0D\u8FDB\u7FA4\u6D88\u606F)", re: /orbitdb:\/\//i },
+    { rule: "ipv4", why: "IPv4 \u5730\u5740", re: /(?<!\d)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?!\d)/ },
+    { rule: "ipv6", why: "IPv6 \u5730\u5740 (\u4E0D\u542B ISO \u65F6\u95F4\u6233)", re: /(?<![0-9A-Za-z])(?:[0-9a-fA-F]{1,4})?::(?:[0-9a-fA-F]{1,4}:){0,6}[0-9a-fA-F]{1,4}(?![0-9A-Za-z])|(?<![0-9A-Za-z:])(?:[0-9a-fA-F]{1,4}:){3,}[0-9a-fA-F]{1,4}(?![0-9A-Za-z])/ },
+    { rule: "pem", why: "PEM \u6750\u6599 (\u79C1\u94A5/\u8BC1\u4E66)", re: /-----BEGIN [A-Z ]*(PRIVATE KEY|CERTIFICATE)/ },
+    { rule: "secret-words", why: "\u79C1\u94A5/\u52A9\u8BB0\u8BCD/\u5BC6\u94A5\u5B57\u6837 (\u6B63\u6587\u91CC\u63D0\u5230\u5373\u505C, \u4EBA\u4E0D\u8BE5\u628A\u5BC6\u94A5\u5199\u8FDB\u7FA4)", re: /(private\s*key|seed\s*phrase|mnemonic|私钥|助记词|密钥材料)/i },
+    { rule: "url", why: "http(s) \u7AEF\u70B9 (\u7AEF\u70B9\u4F1A\u5E26 host/IP \u4E0E\u7528\u9014\u6307\u7EB9)", re: /https?:\/\/\S+/i },
+    { rule: "email", why: "\u90AE\u7BB1\u5730\u5740", re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/ }
+  ];
+  function mask(s2) {
+    const t = String(s2 || "");
+    return t.length <= 4 ? "****" : `${t.slice(0, 4)}\u2026`;
   }
-  function bytesOf(s2) {
-    const src4 = new TextEncoder().encode(s2);
-    const out = new Uint8Array(new ArrayBuffer(src4.byteLength));
-    out.set(src4);
+  function scanPublicText(text) {
+    const t = String(text ?? "");
+    const out = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const r of PRIVACY_RULES) {
+      const m2 = r.re.exec(t);
+      if (!m2) continue;
+      if (seen.has(r.rule)) continue;
+      seen.add(r.rule);
+      out.push({ rule: r.rule, why: r.why, masked: mask(String(m2[0])), chars: String(m2[0]).length });
+    }
     return out;
   }
-  function b64(buf) {
-    const arr = new Uint8Array(buf);
-    let out = "";
-    for (let i = 0; i < arr.length; i++) out += String.fromCharCode(arr[i]);
-    return btoa(out);
-  }
-  function pemFromSpki(spki) {
-    const b = b64(spki).replace(/(.{64})/g, "$1\n").trim();
-    return `-----BEGIN PUBLIC KEY-----
-${b}
------END PUBLIC KEY-----
-`;
+  function requirePublicText(text) {
+    const v = scanPublicText(text);
+    return v.length === 0 ? { ok: true } : { ok: false, violations: v };
+  }
+  var NODE_IDENTITY_RULES = PRIVACY_RULES.filter((r) => r.rule !== "orbitdb-link").map((r) => r.rule === "multiaddr" ? { ...r, re: /\/(ip4|ip6|dns|dns4|dns6|tcp|udp|ws|wss|quic|p2p|p2p-circuit|ipfs)(?![A-Za-z0-9])/i } : r);
+
+  // src/agents/mobile-task-views.ts
+  function shortId(id, n = 12) {
+    const s2 = String(id ?? "").trim();
+    if (!s2) return "";
+    return s2.length <= n ? s2 : `${s2.slice(0, n)}\u2026`;
+  }
+  function isProtocolId(s2) {
+    const v = String(s2 ?? "").trim();
+    return /^ann-[0-9a-f]{8,}$/i.test(v) || /^act-[a-z0-9-]{6,}$/i.test(v) || /^zdpu[0-9a-zA-Z]{8,}$/.test(v) || /^\/orbitdb\//.test(v);
+  }
+  function formatRelative(ms2, lang) {
+    if (ms2 === null || !Number.isFinite(ms2)) return lang === "zh" ? "\u2014" : "\u2014";
+    const past = ms2 >= 0;
+    const abs = Math.abs(ms2);
+    const min = Math.floor(abs / 6e4);
+    const hr = Math.floor(abs / 36e5);
+    const day = Math.floor(abs / 864e5);
+    const unit = day >= 1 ? lang === "zh" ? `${day} \u5929` : `${day} d` : hr >= 1 ? lang === "zh" ? `${hr} \u5C0F\u65F6` : `${hr} h` : min >= 1 ? lang === "zh" ? `${min} \u5206\u949F` : `${min} min` : lang === "zh" ? "\u4E0D\u5230 1 \u5206\u949F" : "under a minute";
+    if (lang === "zh") return past ? `${unit}\u524D` : `${unit}\u540E`;
+    return past ? `${unit} ago` : `in ${unit}`;
+  }
+  var STATUS_LABELS = {
+    open: { zh: "\u53EF\u63A5\u5355", en: "Open for claims" },
+    claimed: { zh: "\u5DF2\u88AB\u63A5\u5355", en: "Claimed" },
+    cancelled: { zh: "\u5DF2\u53D6\u6D88", en: "Cancelled" },
+    unknown: { zh: "\u72B6\u6001\u672A\u77E5", en: "Unknown status" }
+  };
+  function budgetLabelOf(b) {
+    if (!b || typeof b !== "object") return "";
+    const amt = String(b.maxAmount ?? "").trim();
+    if (!amt) return "";
+    return `${amt} ${String(b.currency || "").toUpperCase()}${b.network ? ` \xB7 ${String(b.network)}` : ""}`;
+  }
+  function boardItemOf(e, now) {
+    const dl = Number.isFinite(Number(e?.deadline)) ? Number(e.deadline) : null;
+    const ca = Number.isFinite(Number(e?.createdAt)) ? Number(e.createdAt) : null;
+    const status = String(e?.status || "unknown");
+    return {
+      idShort: shortId(e?.announcementId),
+      ref: String(e?.announcementId || ""),
+      capability: String(e?.capability || ""),
+      status,
+      statusLabel: STATUS_LABELS[status] || STATUS_LABELS.unknown,
+      budgetLabel: budgetLabelOf(e?.budget),
+      deadlineInMs: dl === null ? null : dl - now,
+      createdAtMs: ca,
+      claimCount: Number.isFinite(Number(e?.claimCount)) ? Number(e.claimCount) : 0,
+      preview: e?.instructionPreview ? String(e.instructionPreview).slice(0, 120) : null,
+      remote: !!e?.remote,
+      claimable: !!e?.claimable,
+      signatureVerified: e?.signatureVerified === true ? true : e?.signatureVerified === false ? false : null
+    };
   }
-  async function sha256Hex(c, text) {
-    const d2 = await c.subtle.digest("SHA-256", bytesOf(text));
-    return [...new Uint8Array(d2)].map((x) => x.toString(16).padStart(2, "0")).join("");
+  function buildBoardView(view, now) {
+    const items = (Array.isArray(view?.entries) ? view.entries : []).map((e) => boardItemOf(e, now));
+    return {
+      items,
+      localCount: Number(view?.localCount) || 0,
+      remoteCount: Number(view?.remoteCount) || 0,
+      registryReady: view?.registryReady === true,
+      registryError: view?.registryError ? String(view.registryError).slice(0, 160) : null,
+      notes: Array.isArray(view?.notes) ? view.notes.map((n) => String(n)) : [],
+      openCount: items.filter((i) => i.claimable).length
+    };
   }
-  async function loadOrCreateDeviceKey(storage2, c) {
-    const cobj = cryptoOf(c);
-    if (!cobj?.subtle) throw new Error("device_signing_unavailable: \u672C\u673A\u6CA1\u6709 WebCrypto");
-    const raw = storage2.getItem(K_DEVICE);
-    if (raw) {
-      try {
-        const parsed = JSON.parse(raw);
-        if (parsed?.privateKeyJwk && parsed?.publicKeyPem && parsed?.deviceId) return parsed;
-      } catch {
+  var TRAIL_KIND_LABELS = {
+    announce: { zh: "\u516C\u544A", en: "Announce" },
+    claim: { zh: "\u63A5\u5355\u58F0\u660E", en: "Claim" },
+    deliver: { zh: "\u4EA4\u4ED8", en: "Delivery" },
+    screen: { zh: "\u521D\u7B5B\u7ED3\u679C", en: "Screening" },
+    final: { zh: "\u7EC8\u5BA1\u7ED3\u8BBA", en: "Final verdict" }
+  };
+  var INCONSISTENCY_LABELS = {
+    "final-accept-without-delivery": { zh: "\u8BF4\u901A\u8FC7\u4E86, \u4F46\u7FA4\u91CC\u6CA1\u6709\u4EA4\u4ED8\u75D5\u8FF9", en: "Accepted, but no delivery trace in the group" },
+    "screen-without-delivery": { zh: "\u6709\u521D\u7B5B\u7ED3\u679C, \u4F46\u6CA1\u6709\u4EA4\u4ED8\u75D5\u8FF9", en: "Screening exists without a delivery trace" },
+    "claim-without-announce": { zh: "\u6709\u4EBA\u63A5\u5355, \u4F46\u7FA4\u91CC\u6CA1\u6709\u516C\u544A\u75D5\u8FF9", en: "Claim without an announcement trace" },
+    "deliver-without-claim": { zh: "\u6709\u4EA4\u4ED8, \u4F46\u6CA1\u4EBA\u63A5\u8FC7\u5355", en: "Delivery without a claim" },
+    "both-accept-and-reject": { zh: "\u540C\u65F6\u51FA\u73B0\u901A\u8FC7\u548C\u62D2\u7EDD", en: "Both accepted and rejected appear" },
+    "group-message-hit-privacy-rule": { zh: "\u7FA4\u91CC\u6709\u4EBA\u53D1\u4E86\u5E26\u6807\u8BC6\u7B26\u7684\u6D88\u606F (\u5DF2\u906E\u853D, \u4E0D\u5F53\u4E8B\u5B9E\u91C7\u7528)", en: "A group message hit a privacy rule (masked, not used as fact)" }
+  };
+  function buildTrailView(summary) {
+    const entries = (Array.isArray(summary?.entries) ? summary.entries : []).map((e) => {
+      const facts = [];
+      for (const [k, v] of Object.entries(e?.fields || {})) {
+        if (k === "kind") continue;
+        const raw = String(v ?? "");
+        const hit = scanPublicText(raw);
+        if (hit.length) {
+          facts.push({ k: String(k), v: `[\u5DF2\u906E\u853D:${hit[0].rule}]` });
+          continue;
+        }
+        facts.push({ k: String(k), v: k === "id" || isProtocolId(raw) ? shortId(raw) : raw });
       }
-    }
-    let pair;
+      const kind = String(e?.kind || "");
+      return {
+        idShort: shortId(e?.announcementId),
+        kind,
+        kindLabel: TRAIL_KIND_LABELS[kind] || { zh: kind, en: kind },
+        sender: String(e?.sender || "unknown"),
+        atMs: Number.isFinite(Number(e?.at)) ? Number(e.at) : 0,
+        facts
+      };
+    });
+    const inc = (Array.isArray(summary?.inconsistencies) ? summary.inconsistencies : []).map((c) => ({
+      code: String(c),
+      label: INCONSISTENCY_LABELS[String(c)] || { zh: String(c), en: String(c) }
+    }));
+    return {
+      count: Number(summary?.count) || entries.length,
+      byKind: summary?.byKind || {},
+      entries,
+      announcementIdsShort: (Array.isArray(summary?.announcements) ? summary.announcements : []).map((a) => shortId(a)),
+      flags: summary?.flags || {},
+      inconsistencies: inc,
+      redactedCount: Array.isArray(summary?.redacted) ? summary.redacted.length : 0,
+      ignoredMessages: Number(summary?.ignoredMessages) || 0,
+      privacyHits: inc.some((x) => x.code === "group-message-hit-privacy-rule") || Array.isArray(summary?.redacted) && summary.redacted.length > 0
+    };
+  }
+  function buildGroupsView(groups) {
+    return (Array.isArray(groups) ? groups : []).map((g) => ({
+      idShort: shortId(g?.id),
+      name: String(g?.name || ""),
+      joinedAt: String(g?.createdAt || "")
+    }));
+  }
+  function describeTaskActionForConfirm(kind, req) {
+    const lines = [];
+    const push = (k, kEn, v) => {
+      const s2 = String(v ?? "").trim();
+      if (s2 && s2 !== "-") lines.push({ k, kEn, v: s2 });
+    };
+    push("\u7FA4", "group", req?.groupRef ? shortId(req.groupRef, 24) : "");
+    push("\u516C\u544A\u53F7", "announcement", req?.announcementId ? shortId(req.announcementId) : "");
+    push("\u80FD\u529B", "capability", req?.capability);
+    push("\u9884\u7B97", "budget", req?.budgetHuman ? `${req.budgetHuman} ${String(req?.currency || "").toUpperCase()}` : "");
+    push("\u4EFB\u52A1\u6B63\u6587", "instruction", req?.instruction);
+    push("\u622A\u6B62", "deadline", req?.deadline);
+    push("\u9A8C\u6536\u5224\u636E", "criteria", req?.criteria);
+    push("\u671F\u53F7", "round", req?.round);
+    push("\u75D5\u8FF9\u7C7B\u578B", "trail kind", req?.trailKind ? TRAIL_KIND_LABELS[String(req.trailKind)]?.zh || String(req.trailKind) : "");
+    push("\u58F0\u660E\u4EF7\u683C", "declared price", req?.price);
+    push("\u4EA4\u4ED8\u54C8\u5E0C", "delivery hash", req?.hash);
+    push("\u5B57\u8282\u6570", "bytes", req?.bytes);
+    push("\u9010\u6761\u521D\u7B5B", "per-item screen", req?.checks);
+    push("\u7EC8\u5BA1\u7ED3\u8BBA", "final verdict", req?.verdict);
+    const titles = {
+      group_join: { zh: "\u52A0\u5165\u8FD9\u4E2A\u7FA4", en: "Join this group" },
+      group_leave: { zh: "\u9000\u51FA\u8FD9\u4E2A\u7FA4", en: "Leave this group" },
+      group_create: { zh: "\u5EFA\u4E00\u4E2A\u65B0\u7FA4", en: "Create a new group" },
+      announce_publish: { zh: "\u53D1\u5E03\u4EFB\u52A1\u516C\u544A", en: "Publish a task announcement" },
+      announce_to_group: { zh: "\u628A\u8FD9\u671F\u516C\u544A\u53D1\u8FDB\u7FA4", en: "Post this announcement into the group" },
+      trail_post: { zh: "\u5F80\u7FA4\u91CC\u7559\u4E00\u6761\u8FC7\u7A0B\u75D5\u8FF9", en: "Post a process trail entry into the group" }
+    };
+    const t = titles[String(kind)] || { zh: "\u6267\u884C\u8FD9\u4E2A\u52A8\u4F5C", en: "Run this action" };
+    return { titleZh: t.zh, titleEn: t.en, lines };
+  }
+
+  // src/agents/goal-flywheel/types.ts
+  var MUST_NOT_EXPOSE_FIELDS = [
+    "lease",
+    "reducer",
+    "internal_status",
+    "retry_counter",
+    "worker_owner"
+  ];
+
+  // src/agents/goal-flywheel/work-monitor.ts
+  var NO_PROGRESS_FALLBACK_MS = 30 * 60 * 1e3;
+  var DEFAULT_REPORT_GRACE_MS = 60 * 1e3;
+  var DEFAULT_ESCALATION_MS = 10 * 60 * 1e3;
+  var TERMINAL_GOAL_STATES = ["completed", "failed", "abandoned"];
+  var TERMINAL_GOAL_STATUSES = [...TERMINAL_GOAL_STATES];
+
+  // src/agents/mobile-flywheel-view.ts
+  function findInternalFieldLeaks(text) {
+    const t = String(text ?? "");
+    return MUST_NOT_EXPOSE_FIELDS.filter((f) => t.includes(f));
+  }
+
+  // src/web/mobile-tasks.ts
+  init_mobile_contacts();
+  var K_TASKS_HINT = "bolloon.mobile.tasks.hint.v1";
+  function defaultStorage2() {
     try {
-      pair = await cobj.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
-    } catch (err2) {
-      throw new Error(`device_signing_unavailable: ${String(err2?.message || err2)}`);
+      if (typeof localStorage !== "undefined") return localStorage;
+    } catch {
     }
-    const publicKeyPem = pemFromSpki(await cobj.subtle.exportKey("spki", pair.publicKey));
-    const privateKeyJwk = await cobj.subtle.exportKey("jwk", pair.privateKey);
-    const deviceId = `dev-${(await sha256Hex(cobj, publicKeyPem)).slice(0, 12)}`;
-    const material = { deviceId, publicKeyPem, privateKeyJwk };
-    storage2.setItem(K_DEVICE, JSON.stringify(material));
-    return material;
+    const mem2 = /* @__PURE__ */ new Map();
+    return { getItem: (k) => mem2.has(k) ? mem2.get(k) : null, setItem: (k, v) => {
+      mem2.set(k, v);
+    }, removeItem: (k) => {
+      mem2.delete(k);
+    } };
   }
-  async function importPrivate(storage2, c) {
-    const k = await loadOrCreateDeviceKey(storage2, c);
-    return c.subtle.importKey("jwk", k.privateKeyJwk, { name: "Ed25519" }, false, ["sign"]);
+  async function baseOf(deps) {
+    if (deps.base && String(deps.base).trim()) return String(deps.base).replace(/\/+$/, "");
+    try {
+      if (typeof localStorage !== "undefined") {
+        const v = localStorage.getItem("bolloon_desktop_base_url");
+        if (v) return String(v).replace(/\/+$/, "");
+      }
+    } catch {
+    }
+    return "";
   }
-  async function signGrantOnDevice(grant, storage2, c) {
-    const cobj = cryptoOf(c);
-    const key = await importPrivate(storage2, cobj);
-    const payload = canonicalGrantPayload(grant);
-    const sig = await cobj.subtle.sign({ name: "Ed25519" }, key, bytesOf(payload));
-    const dev = await loadOrCreateDeviceKey(storage2, cobj);
-    return { deviceId: dev.deviceId, alg: "ed25519", payloadHash: await sha256Hex(cobj, payload), sig: b64(sig) };
+  function fetchOf(deps) {
+    return deps.fetchImpl || globalThis.fetch;
   }
-  async function signRevocationOnDevice(rev, storage2, c) {
-    const cobj = cryptoOf(c);
-    const key = await importPrivate(storage2, cobj);
-    const payload = canonicalRevocationPayload(rev);
-    const sig = await cobj.subtle.sign({ name: "Ed25519" }, key, bytesOf(payload));
-    const dev = await loadOrCreateDeviceKey(storage2, cobj);
-    return { deviceId: dev.deviceId, alg: "ed25519", payloadHash: await sha256Hex(cobj, payload), sig: b64(sig) };
+  async function getJson(base6, path, f) {
+    const res = await f(`${base6}${path}`);
+    let json = null;
+    try {
+      json = await res.json();
+    } catch {
+    }
+    return { status: res.status, json };
   }
-  async function post(base6, path, body, f) {
-    const res = await f(`${String(base6).replace(/\/+$/, "")}${path}`, {
+  async function postJson(base6, path, body, f) {
+    const res = await f(`${base6}${path}`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(body ?? {})
@@ -163057,232 +163673,1809 @@ ${b}
     }
     return { status: res.status, json };
   }
-  async function get(base6, path, f) {
-    const res = await f(`${String(base6).replace(/\/+$/, "")}${path}`);
-    let json = null;
+  var OFFLINE_NOTE = "\u5730\u5740\u5728 \u6211 \u2192 \u8BBE\u7F6E \u2192 \u7535\u8111\u7AEF\u5730\u5740 \u91CC\u586B; \u624B\u673A\u4E0D\u66FF\u684C\u9762\u8BB0\u8D26";
+  function mapFail(r, what) {
+    const code10 = r.json?.code ? String(r.json.code) : r.status ? `desktop_http_${r.status}` : "desktop_unreachable";
+    return { ok: false, code: code10, error: `${what} \u5931\u8D25: ${r.json?.error || r.json?.message || code10}`, note: OFFLINE_NOTE };
+  }
+  function emptyTaskActionRequest(kind) {
+    return {
+      kind,
+      groupRef: null,
+      announcementId: null,
+      capability: null,
+      instruction: null,
+      budgetHuman: null,
+      currency: null,
+      deadline: null,
+      criteria: null,
+      round: null,
+      price: null,
+      hash: null,
+      bytes: null,
+      checks: null,
+      verdict: null,
+      trailKind: null
+    };
+  }
+  async function signTaskAction(req, deps = {}) {
+    const storage2 = deps.storage || defaultStorage2();
+    const c = deps.cryptoObj || globalThis.crypto;
+    if (!ed25519Available(c)) {
+      return { ok: false, code: "device_signing_unavailable", error: "\u672C\u673A WebView \u4E0D\u652F\u6301 Ed25519 \u8BBE\u5907\u7B7E\u540D \u2014\u2014 \u8BF7\u5728\u684C\u9762\u7AEF\u6267\u884C\u8FD9\u4E2A\u52A8\u4F5C (\u6216\u5347\u7EA7\u7CFB\u7EDF WebView)" };
+    }
+    if (!MOBILE_TASK_ACTION_KINDS.includes(String(req?.kind))) {
+      return { ok: false, code: "unknown_kind", error: `\u672A\u77E5\u52A8\u4F5C: ${String(req?.kind || "")}` };
+    }
+    const text = taskActionContentText(req);
+    if (req.kind === "trail_post" || req.kind === "announce_publish" || req.kind === "announce_to_group") {
+      for (const fieldText of [req.round, req.price, req.criteria, req.checks, req.verdict, req.capability, req.hash]) {
+        if (!fieldText) continue;
+        const gate = requirePublicText(String(fieldText));
+        if (!gate.ok) {
+          return { ok: false, code: "privacy_denied", error: `\u672C\u5730\u9690\u79C1\u95F8\u62E6\u4E0B: ${gate.violations.map((v) => v.rule).join(", ")} (\u7FA4\u91CC/\u516C\u544A\u91CC\u4E0D\u653E\u6807\u8BC6\u7B26)`, violations: gate.violations };
+        }
+      }
+    }
+    const now = deps.now ? deps.now() : Date.now();
+    const ttl = Math.min(Number(deps.ttlMs) || TASK_ACTION_DEFAULT_TTL_MS, TASK_ACTION_DEFAULT_TTL_MS);
+    let contentDigest;
     try {
-      json = await res.json();
+      contentDigest = await sha256HexOf(text, c);
+    } catch (e) {
+      return { ok: false, code: "device_signing_unavailable", error: String(e?.message || e) };
+    }
+    const action = {
+      actionId: `act-${now.toString(36)}-${Math.random().toString(36).slice(2, 8)}`,
+      kind: req.kind,
+      deviceId: "",
+      // 由 signPayloadOnDevice 填 (它知道设备 id)
+      ownerDid: String(deps.ownerDid || "").trim(),
+      targetRef: String(req.groupRef || req.announcementId || ""),
+      contentDigest,
+      createdAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + ttl).toISOString(),
+      grantedBy: deps.grantedBy || "leo",
+      via: "mobile"
+    };
+    let signature;
+    try {
+      const { loadOrCreateDeviceKey: loadOrCreateDeviceKey2, signPayloadWithMaterial: signPayloadWithMaterial2 } = await Promise.resolve().then(() => (init_mobile_contacts(), mobile_contacts_exports));
+      const material = await loadOrCreateDeviceKey2(storage2, c);
+      action.deviceId = material.deviceId;
+      signature = await signPayloadWithMaterial2(canonicalTaskActionPayload(action), material, c);
+      if (signature.deviceId !== action.deviceId) {
+        return { ok: false, code: "device_signing_unavailable", error: "\u8BBE\u5907\u5BC6\u94A5\u4E0D\u4E00\u81F4 (\u7B7E\u540D\u4E0E\u8F7D\u8377\u8BBE\u5907\u5BF9\u4E0D\u4E0A) \u2192 \u4E0D\u53D1\u9001" };
+      }
+      const fresh = checkTaskActionFreshness(action, now);
+      if (!fresh.ok) return { ok: false, code: fresh.reason, error: `\u52A8\u4F5C\u65F6\u6548\u4E0D\u5408\u6CD5: ${fresh.reason}` };
+    } catch (e) {
+      return { ok: false, code: "device_signing_unavailable", error: String(e?.message || e).slice(0, 160) };
+    }
+    return {
+      ok: true,
+      data: { signed: { action, signature }, contentText: text, confirm: describeTaskActionForConfirm(req.kind, req) }
+    };
+  }
+  async function executeTaskAction(req, deps = {}) {
+    const storage2 = deps.storage || defaultStorage2();
+    const base6 = await baseOf(deps);
+    if (!base6) return { ok: false, code: "desktop_offline", error: "\u8FD8\u6CA1\u8BBE\u7F6E\u7535\u8111\u7AEF\u5730\u5740: \u9AD8\u98CE\u9669\u52A8\u4F5C\u5FC5\u987B\u7531\u684C\u9762\u6267\u884C (\u624B\u673A\u7B7E\u4E86\u540D\u4E5F\u8981\u9001\u5230\u684C\u9762)", note: OFFLINE_NOTE };
+    const signed = await signTaskAction(req, { ...deps, storage: storage2 });
+    if (!signed.ok || !signed.data) return { ok: false, code: signed.code, error: signed.error, violations: signed.violations };
+    const f = fetchOf(deps);
+    let r;
+    try {
+      r = await postJson(base6, "/api/mobile/tasks/execute", { request: req, ...signed.data.signed }, f);
+    } catch (e) {
+      return { ok: false, code: "desktop_offline", error: `\u684C\u9762\u4E0D\u53EF\u8FBE: ${String(e?.message || e).slice(0, 120)}`, note: OFFLINE_NOTE };
+    }
+    if (r.status !== 200 || !r.json?.ok) return mapFail(r, "\u6267\u884C");
+    return { ok: true, data: r.json, note: "\u684C\u9762\u5DF2\u9A8C\u7B7E\u5E76\u6267\u884C (\u540C\u4E00\u5957\u5B58\u50A8\u4E0E\u534F\u8BAE)" };
+  }
+  async function previewGroupMessage(req, deps = {}) {
+    const base6 = await baseOf(deps);
+    if (!base6) return { ok: false, code: "desktop_offline", error: "\u9884\u89C8\u9700\u8981\u684C\u9762\u5728\u7EBF (\u7FA4\u6D88\u606F\u7531\u684C\u9762\u7684\u6784\u9020\u5668\u751F\u6210)", note: OFFLINE_NOTE };
+    const c = deps.cryptoObj || globalThis.crypto;
+    let digestPreview = "";
+    try {
+      digestPreview = await sha256HexOf(taskActionContentText(req), c);
     } catch {
+      digestPreview = "";
+    }
+    const f = fetchOf(deps);
+    try {
+      const r = await postJson(base6, "/api/mobile/tasks/preview", { request: req }, f);
+      if (r.status !== 200 || !r.json?.ok) return mapFail(r, "\u9884\u89C8");
+      return { ok: true, data: { text: String(r.json.text || ""), contentText: taskActionContentText(req), digestPreview } };
+    } catch (e) {
+      return { ok: false, code: "desktop_offline", error: `\u684C\u9762\u4E0D\u53EF\u8FBE: ${String(e?.message || e).slice(0, 120)}`, note: OFFLINE_NOTE };
     }
-    return { status: res.status, json };
   }
-  async function registerDeviceOnDesktop(base6, storage2, opts = {}) {
-    const f = opts.fetchImpl || fetch;
-    const dev = await loadOrCreateDeviceKey(storage2, opts.cryptoObj);
-    const r = await post(base6, "/api/contacts/devices", { deviceId: dev.deviceId, publicKeyPem: dev.publicKeyPem, label: opts.label || "\u624B\u673A" }, f);
-    if (r.status !== 200 || !r.json?.ok) return { ok: false, error: `\u684C\u9762\u672A\u63A5\u53D7\u8BBE\u5907\u767B\u8BB0: ${r.json?.error || r.status}`, data: dev };
-    return { ok: true, data: dev };
+  async function listGroups(deps = {}) {
+    const base6 = await baseOf(deps);
+    if (!base6) return { ok: false, code: "desktop_offline", error: "\u770B\u7FA4\u5217\u8868\u9700\u8981\u7535\u8111\u7AEF\u5728\u7EBF (\u7FA4\u5B58\u5728\u4E8E\u684C\u9762\u8282\u70B9\u7684 OrbitDB)", note: OFFLINE_NOTE };
+    try {
+      const r = await getJson(base6, "/api/mobile/tasks/groups", fetchOf(deps));
+      if (r.status !== 200 || !r.json?.ok) return mapFail(r, "\u8BFB\u7FA4\u5217\u8868");
+      return { ok: true, data: buildGroupsView(r.json.groups || []) };
+    } catch (e) {
+      return { ok: false, code: "desktop_offline", error: `\u684C\u9762\u4E0D\u53EF\u8FBE: ${String(e?.message || e).slice(0, 120)}`, note: OFFLINE_NOTE };
+    }
   }
-  function saveCapabilityCopy(storage2, items) {
-    const clean8 = (items || []).map((c) => ({
-      contactId: String(c.contactId || ""),
-      kind: c.kind,
-      displayValue: String(c.displayValue || ""),
-      verificationStatus: String(c.verificationStatus || ""),
-      capabilities: [...c.capabilities || []],
-      provider: c.provider ? String(c.provider) : void 0,
-      state: c.state ? String(c.state) : void 0
-    }));
-    storage2.setItem(K_CAPS, JSON.stringify(clean8));
+  function joinGroup(link, deps = {}) {
+    const req = { ...emptyTaskActionRequest("group_join"), groupRef: String(link || "").trim() };
+    return executeTaskAction(req, deps);
   }
-  function loadCapabilityCopy(storage2) {
+  function leaveGroup(groupRef, deps = {}) {
+    const req = { ...emptyTaskActionRequest("group_leave"), groupRef: String(groupRef || "").trim() };
+    return executeTaskAction(req, deps);
+  }
+  function createGroup(name10, deps = {}) {
+    const req = { ...emptyTaskActionRequest("group_create"), groupRef: String(name10 || "").trim() };
+    return executeTaskAction(req, deps);
+  }
+  async function loadBoard(deps = {}) {
+    const base6 = await baseOf(deps);
+    if (!base6) return { ok: false, code: "desktop_offline", error: "\u770B\u677F\u9700\u8981\u7535\u8111\u7AEF\u5728\u7EBF (\u516C\u544A\u677F\u5728\u684C\u9762\u8282\u70B9\u4E0A)", note: OFFLINE_NOTE };
+    const now = deps.now ? deps.now() : Date.now();
     try {
-      const v = JSON.parse(storage2.getItem(K_CAPS) || "[]");
-      return Array.isArray(v) ? v : [];
+      const r = await getJson(base6, "/api/mobile/tasks/board", fetchOf(deps));
+      if (r.status !== 200 || !r.json?.ok) return mapFail(r, "\u8BFB\u770B\u677F");
+      return { ok: true, data: buildBoardView(r.json, now) };
+    } catch (e) {
+      return { ok: false, code: "desktop_offline", error: `\u684C\u9762\u4E0D\u53EF\u8FBE: ${String(e?.message || e).slice(0, 120)}`, note: OFFLINE_NOTE };
+    }
+  }
+  function publishAnnouncement(input, deps = {}) {
+    const req = {
+      ...emptyTaskActionRequest("announce_publish"),
+      capability: String(input.capability || "").trim(),
+      instruction: String(input.instruction || ""),
+      budgetHuman: String(input.budgetHuman || "").trim(),
+      currency: String(input.currency || "USDC").toUpperCase(),
+      deadline: input.deadline ? String(input.deadline).trim() : null
+    };
+    return executeTaskAction(req, deps);
+  }
+  function announceIntoGroup(input, deps = {}) {
+    const req = {
+      ...emptyTaskActionRequest("announce_to_group"),
+      groupRef: String(input.groupRef || "").trim(),
+      announcementId: String(input.announcementId || "").trim(),
+      round: input.round ? String(input.round) : null,
+      criteria: input.criteria ? String(input.criteria) : null
+    };
+    return executeTaskAction(req, deps);
+  }
+  function postTrail(input, deps = {}) {
+    const req = {
+      ...emptyTaskActionRequest("trail_post"),
+      groupRef: String(input.groupRef || "").trim(),
+      announcementId: String(input.announcementId || "").trim(),
+      round: input.round ? String(input.round) : null,
+      price: input.price ? String(input.price) : null,
+      hash: input.hash ? String(input.hash) : null,
+      bytes: typeof input.bytes === "number" ? input.bytes : null,
+      checks: input.checks ? String(input.checks) : null,
+      verdict: input.verdict ? String(input.verdict) : null,
+      trailKind: input.kind
+    };
+    return executeTaskAction(req, deps);
+  }
+  async function loadTrail(input, deps = {}) {
+    const base6 = await baseOf(deps);
+    if (!base6) return { ok: false, code: "desktop_offline", error: "\u8BFB\u7FA4\u75D5\u8FF9\u9700\u8981\u7535\u8111\u7AEF\u5728\u7EBF", note: OFFLINE_NOTE };
+    const q = new URLSearchParams();
+    q.set("group", String(input.groupRef || "").trim());
+    if (input.announcementId) q.set("announcementId", String(input.announcementId));
+    if (input.limit) q.set("limit", String(input.limit));
+    try {
+      const r = await getJson(base6, `/api/mobile/tasks/trail?${q.toString()}`, fetchOf(deps));
+      if (r.status !== 200 || !r.json?.ok) return mapFail(r, "\u8BFB\u7FA4\u75D5\u8FF9");
+      return { ok: true, data: buildTrailView(r.json.summary || r.json) };
+    } catch (e) {
+      return { ok: false, code: "desktop_offline", error: `\u684C\u9762\u4E0D\u53EF\u8FBE: ${String(e?.message || e).slice(0, 120)}`, note: OFFLINE_NOTE };
+    }
+  }
+  async function loadFlywheel(deps = {}) {
+    const base6 = await baseOf(deps);
+    if (!base6) return { ok: false, code: "desktop_offline", error: "\u770B\u98DE\u8F6E\u8FDB\u5EA6\u9700\u8981\u7535\u8111\u7AEF\u5728\u7EBF (Goal \u8BB0\u5F55\u5728\u684C\u9762\u8282\u70B9\u4E0A)", note: OFFLINE_NOTE };
+    try {
+      const r = await getJson(base6, "/api/mobile/tasks/flywheel", fetchOf(deps));
+      if (r.status !== 200 || !r.json?.ok) return mapFail(r, "\u8BFB\u98DE\u8F6E\u8FDB\u5EA6");
+      const goals = Array.isArray(r.json.goals) ? r.json.goals : [];
+      const leaks = findInternalFieldLeaks(JSON.stringify(goals));
+      if (leaks.length) return { ok: false, code: "view_leak", error: `\u89C6\u56FE\u91CC\u542B\u5185\u90E8\u5B57\u6BB5 (${leaks.join(", ")}) \u2192 \u62D2\u7EDD\u6E32\u67D3` };
+      return { ok: true, data: { goals, hint: r.json.hint ? String(r.json.hint) : null } };
+    } catch (e) {
+      return { ok: false, code: "desktop_offline", error: `\u684C\u9762\u4E0D\u53EF\u8FBE: ${String(e?.message || e).slice(0, 120)}`, note: OFFLINE_NOTE };
+    }
+  }
+  function setTaskHint(text, storage2 = defaultStorage2()) {
+    try {
+      storage2.setItem(K_TASKS_HINT, String(text || "").slice(0, 160));
     } catch {
-      return [];
     }
   }
-  function pendingQueue(storage2) {
+  function getTaskHint(storage2 = defaultStorage2()) {
     try {
-      const v = JSON.parse(storage2.getItem(K_QUEUE) || "[]");
-      return Array.isArray(v) ? v : [];
+      return String(storage2.getItem(K_TASKS_HINT) || "");
     } catch {
-      return [];
+      return "";
     }
   }
-  function setQueue(storage2, q) {
-    storage2.setItem(K_QUEUE, JSON.stringify(q.slice(-20)));
+
+  // src/utils/version-identity.ts
+  var PKG_NAME = "@bolloon/bolloon-agent";
+  var GITHUB_UPSTREAM_SLUG = "logos-42/bolloon";
+  function envValue(key) {
+    try {
+      const cfg = globalThis?.__bolloonUpdateConfig;
+      if (cfg && cfg[key] !== void 0 && cfg[key] !== null) return String(cfg[key]);
+      const env = typeof process !== "undefined" ? process?.env : null;
+      const v = env ? env[key] : void 0;
+      return v === void 0 || v === null ? void 0 : String(v);
+    } catch {
+      return void 0;
+    }
   }
-  async function flushQueuedGrants(base6, storage2, opts = {}) {
-    const f = opts.fetchImpl || fetch;
-    const q = pendingQueue(storage2);
-    const keep = [];
-    const results = [];
-    let sent = 0, failed = 0;
-    for (const item of q) {
-      try {
-        const r = await post(base6, "/api/contacts/grants/sync", { grant: { ...item.grant, signature: item.signature } }, f);
-        if (r.status === 200 && r.json?.ok) {
-          sent++;
-          results.push({ grantId: item.grant.grantId, ok: true });
-          continue;
-        }
-        failed++;
-        keep.push(item);
-        results.push({ grantId: item.grant.grantId, ok: false, error: r.json?.code || r.status });
-      } catch {
-        failed++;
-        keep.push(item);
-        results.push({ grantId: item.grant.grantId, ok: false, error: "network" });
-      }
+  var NPM_REGISTRY_BASE = (envValue("BOLLOON_NPM_REGISTRY") || "https://registry.npmjs.org").replace(/\/+$/, "");
+  var GITHUB_API_BASE = (envValue("BOLLOON_GITHUB_API") || "https://api.github.com").replace(/\/+$/, "");
+  var DEV_BRANCH = "master";
+  var DEV_REF = `refs/heads/${DEV_BRANCH}`;
+  function resolveUpdateChannel(explicit, env) {
+    const raw = (explicit || (env ? env.BOLLOON_UPDATE_CHANNEL : envValue("BOLLOON_UPDATE_CHANNEL")) || "").trim().toLowerCase();
+    if (raw === "stable" || raw === "beta" || raw === "dev") return raw;
+    return "stable";
+  }
+  function distTagForChannel(channel) {
+    return channel === "beta" ? "beta" : "latest";
+  }
+  function channelKindOf(channel) {
+    return channel === "dev" ? "git-ref" : "semver";
+  }
+  var DEV_IDENTITY_SEP = "+dev.";
+  function devIdentity(baseVersion, sha4) {
+    return `${baseVersionOf(baseVersion)}${DEV_IDENTITY_SEP}${String(sha4).slice(0, 7)}`;
+  }
+  function baseVersionOf(v) {
+    return String(v || "").split(DEV_IDENTITY_SEP)[0].trim();
+  }
+  function isDevIdentity(v) {
+    return String(v || "").includes(DEV_IDENTITY_SEP);
+  }
+  function devShaFromIdentity(v) {
+    if (!isDevIdentity(v)) return null;
+    const sha4 = String(v).split(DEV_IDENTITY_SEP)[1]?.trim();
+    return sha4 ? sha4 : null;
+  }
+  var DEV_CHANNEL_WARNING = "\u26A0\uFE0F dev \u901A\u9053 = GitHub master HEAD \u7684\u5373\u65F6\u5FEB\u7167 (\u672A\u8D70\u53D1\u5E03\u95E8): \u53EF\u80FD\u4E2D\u65AD\u6B63\u5728\u8DD1\u7684 Goal/Run, \u4E14\u4E0D\u4FDD\u8BC1\u53EF\u56DE\u6EDA\u5230\u4E0A\u4E00\u4E2A dev \u7248\u3002";
+  var DEV_BACK_TO_STABLE_HINT_MOBILE = "\u4E00\u952E\u56DE\u7A33\u5B9A\u7248: \u624B\u673A\u7AEF\u300C\u66F4\u65B0\u300D\u9875 \u2192 \u5207\u56DE stable";
+  function parseVersion(v) {
+    const clean8 = String(v || "").trim().replace(/^v/, "").split("-")[0];
+    const parts = clean8.split(".").map((p) => parseInt(p.replace(/\D.*$/, ""), 10));
+    return parts.map((n) => Number.isFinite(n) ? n : 0);
+  }
+  function compareVersions(a, b) {
+    const pa = parseVersion(a);
+    const pb = parseVersion(b);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+      const x = pa[i] ?? 0;
+      const y2 = pb[i] ?? 0;
+      if (x < y2) return -1;
+      if (x > y2) return 1;
     }
-    setQueue(storage2, keep);
-    return { sent, failed, results };
+    return 0;
   }
-  async function authorizeFromPhone(input) {
-    const c = cryptoOf(input.cryptoObj);
-    if (!ed25519Available(c || void 0)) {
-      return { ok: false, error: "device_signing_unavailable: \u672C\u673A WebView \u4E0D\u652F\u6301 Ed25519 \u8BBE\u5907\u7B7E\u540D \u2014\u2014 \u8BF7\u5728\u684C\u9762\u7AEF\u6388\u6743 (\u6216\u5347\u7EA7\u7CFB\u7EDF WebView)" };
+  function isKnownVersion(v) {
+    return !!v && v !== "unknown" && /^\d/.test(String(v).trim().replace(/^v/, ""));
+  }
+  var CHECK_STATUSES = [
+    "up_to_date",
+    // 确认最新
+    "update_available",
+    // 有新版本
+    "check_skipped",
+    // 节流/显式跳过, 结论来自缓存
+    "offline",
+    // 网络不可达 (≠ 最新)
+    "registry_unavailable",
+    // 可达但拿不到有效数据 (5xx / 包不存在 / 无 dist-tags)
+    "local_version_unknown",
+    // 读不到本地版本 (不猜 0.0.0)
+    "unsupported_installation",
+    // 认得出本地版本, 但这种安装方式不支持自动更新
+    "github_unavailable",
+    // GitHub 源不可用 (offline / rate_limited / not_found / http_error)
+    "cross_check_mismatch"
+    // npm 与 GitHub 两个源不一致 → 拒绝更新
+  ];
+  var REFUSED_STATUSES = ["offline", "registry_unavailable", "local_version_unknown", "github_unavailable", "cross_check_mismatch"];
+  function describeSourceIdentity(info) {
+    const src4 = info.installedDevSha ? "dev (GitHub master \u5FEB\u7167)" : "stable (npm registry)";
+    const ident = info.installedDevSha ? `commit ${info.installedDevSha}` : baseVersionOf(info.packageVersion);
+    const back = info.switchableTo ? ` \xB7 \u53EF\u5207\u56DE ${info.switchableTo.channel} (${info.switchableTo.source})` : "";
+    return `\u5F53\u524D\u5B89\u88C5\u6E90: ${src4} \xB7 \u7248\u672C/commit: ${ident} \xB7 \u6BD4\u8F83\u8BED\u4E49: ${info.channelKind}${back}`;
+  }
+
+  // src/utils/dual-source-facts.ts
+  function toGithubReport(r) {
+    if (!r.ok) {
+      return {
+        reachable: false,
+        reason: r.reason,
+        detail: r.detail,
+        retryAt: r.retryAt,
+        headSha: r.facts?.headSha ?? null,
+        ref: r.facts?.ref ?? `refs/heads/${DEV_BRANCH}`,
+        releases: r.facts?.releases.length,
+        tags: r.facts?.tags.length,
+        newestVersion: r.facts ? newestGithubVersion(r.facts) : null,
+        partial: r.facts?.partial,
+        fetchedAt: r.facts?.fetchedAt
+      };
     }
-    const dev = await loadOrCreateDeviceKey(input.storage, c);
-    const preset = presetForChoice(input.choice);
-    const grant = {
-      grantId: `gr-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`,
-      identityId: input.identityId || `sid-phone-${dev.deviceId.slice(-6)}`,
-      ownerDid: input.ownerDid,
-      ...preset,
-      grantedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      grantedBy: input.grantedBy || "leo",
-      grantedVia: "mobile",
-      deviceIds: [dev.deviceId],
-      status: "active",
-      grantVersion: 1
+    return {
+      reachable: true,
+      headSha: r.facts.headSha,
+      ref: r.facts.ref,
+      releases: r.facts.releases.length,
+      tags: r.facts.tags.length,
+      newestVersion: newestGithubVersion(r.facts),
+      partial: r.facts.partial,
+      fetchedAt: r.facts.fetchedAt
     };
-    const signature = await signGrantOnDevice(grant, input.storage, c);
-    const f = input.fetchImpl || fetch;
-    const reg = await registerDeviceOnDesktop(input.base, input.storage, { fetchImpl: f, cryptoObj: c }).catch(() => ({ ok: false }));
-    if (!reg.ok) {
-      const q2 = pendingQueue(input.storage);
-      q2.push({ grant, signature, queuedAt: (/* @__PURE__ */ new Date()).toISOString() });
-      setQueue(input.storage, q2);
+  }
+  function renderGithubReportLine(g) {
+    if (!g) return "GitHub \u6E90: \u672A\u67E5\u8BE2";
+    if (!g.reachable) {
+      const retry = g.retryAt ? `, \u9650\u6D41\u91CD\u8BD5\u65F6\u95F4 ${g.retryAt}` : "";
+      return `GitHub \u6E90: \u4E0D\u53EF\u8FBE \u2014 github_unavailable(${g.reason}) ${g.detail || ""}${retry}`;
+    }
+    return `GitHub \u6E90: \u53EF\u8FBE \xB7 master HEAD ${g.headSha ? g.headSha.slice(0, 7) : "\u672A\u77E5"} \xB7 Release ${g.releases ?? 0} \u4E2A \xB7 Tag ${g.tags ?? 0} \u4E2A \xB7 \u6700\u65B0\u7248\u672C\u6807\u7B7E ${g.newestVersion || "\u65E0"}${g.partial ? " (\u90E8\u5206\u8BF7\u6C42\u5931\u8D25)" : ""}`;
+  }
+  var OFFLINE_CODES = /* @__PURE__ */ new Set(["ENOTFOUND", "EAI_AGAIN", "ECONNREFUSED", "ECONNRESET", "ETIMEDOUT", "EHOSTUNREACH", "ENETUNREACH", "ENETDOWN", "EAI_FAIL", "UND_ERR_CONNECT_TIMEOUT", "CERT_HAS_EXPIRED"]);
+  function collectNetEvidence(err2) {
+    const codes = [];
+    const msgs = [];
+    let cur = err2;
+    for (let depth = 0; cur && depth < 6; depth++) {
+      const inner = Array.isArray(cur.errors) ? cur.errors : [];
+      for (const e of inner) {
+        if (e?.code) codes.push(String(e.code));
+        if (e?.message) msgs.push(String(e.message));
+      }
+      if (cur.code) codes.push(String(cur.code));
+      if (cur.errno) codes.push(String(cur.errno));
+      if (cur.message) msgs.push(String(cur.message));
+      cur = cur.cause;
+    }
+    const code10 = codes.find((c) => OFFLINE_CODES.has(c)) || codes[0] || "";
+    const message16 = msgs.join(" \xB7 ");
+    const offline = codes.some((c) => OFFLINE_CODES.has(c)) || /timeout|timed out|ENOTFOUND|getaddrinfo|network|socket hang up|超时|Failed to fetch|fetch failed|NetworkError|Load failed|ECONNREFUSED|ECONNRESET/i.test(message16);
+    return { code: code10, message: message16, offline };
+  }
+  function classifyGithubError(err2, httpStatus, headers = {}) {
+    const retryAt = headers["x-ratelimit-reset"] ? new Date(Number(headers["x-ratelimit-reset"]) * 1e3).toISOString() : null;
+    const net = collectNetEvidence(err2);
+    if (net.offline) {
+      return { kind: "github_unavailable", reason: "offline", detail: `${net.code || net.message || "\u7F51\u7EDC\u4E0D\u53EF\u8FBE"}`, retryAt: null };
+    }
+    if (httpStatus === 403 || httpStatus === 429) {
+      return { kind: "github_unavailable", reason: "rate_limited", detail: `GitHub \u8FD4\u56DE HTTP ${httpStatus} (\u9650\u6D41/\u6743\u9650)`, retryAt };
+    }
+    if (httpStatus === 404) {
+      return { kind: "github_unavailable", reason: "not_found", detail: `GitHub \u4E0A\u6CA1\u6709 ${GITHUB_UPSTREAM_SLUG} \u7684\u8BE5\u9879\u8BB0\u5F55 (HTTP 404)`, retryAt: null };
+    }
+    if (httpStatus && httpStatus >= 400) {
+      return { kind: "github_unavailable", reason: "http_error", detail: `GitHub \u8FD4\u56DE HTTP ${httpStatus}`, retryAt };
+    }
+    return { kind: "github_unavailable", reason: "http_error", detail: net.code || net.message || "\u672A\u77E5\u9519\u8BEF", retryAt: null };
+  }
+  function classifyRegistryError(err2, httpStatus) {
+    const net = collectNetEvidence(err2);
+    if (net.offline) {
+      return { kind: "offline", detail: `${net.code || net.message || "\u7F51\u7EDC\u4E0D\u53EF\u8FBE"}` };
+    }
+    if (httpStatus && httpStatus >= 500) return { kind: "registry_unavailable", detail: `registry \u8FD4\u56DE HTTP ${httpStatus}` };
+    if (httpStatus === 404) return { kind: "registry_unavailable", detail: `registry \u4E0A\u6CA1\u6709\u8BE5\u5305 (HTTP 404)` };
+    if (httpStatus && httpStatus >= 400) return { kind: "registry_unavailable", detail: `registry \u8FD4\u56DE HTTP ${httpStatus}` };
+    return { kind: "registry_unavailable", detail: net.code || net.message || "\u672A\u77E5\u9519\u8BEF" };
+  }
+  function newestGithubVersion(facts) {
+    const all2 = [...facts.releases, ...facts.tags.map((t) => t.name)].map((n) => String(n).trim().replace(/^v/, "")).filter((n) => /^\d+\.\d+\.\d+/.test(n));
+    if (all2.length === 0) return null;
+    return all2.sort((a, b) => numericCompare(a, b) < 0 ? 1 : -1)[0];
+  }
+  function numericCompare(a, b) {
+    const p = (v) => v.split("-")[0].split(".").map((x) => parseInt(x.replace(/\D.*$/, ""), 10) || 0);
+    const pa = p(a);
+    const pb = p(b);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+      const x = pa[i] ?? 0;
+      const y2 = pb[i] ?? 0;
+      if (x < y2) return -1;
+      if (x > y2) return 1;
+    }
+    return 0;
+  }
+  function hasName(names, v) {
+    const set = new Set(names.map((n) => String(n).trim().replace(/^v/, "")));
+    return set.has(v.replace(/^v/, ""));
+  }
+  function crossCheckStable(registryLatest, facts) {
+    const common = {
+      registryLatest,
+      githubVersion: newestGithubVersion(facts),
+      releases: facts.releases.length,
+      tags: facts.tags.length
+    };
+    if (!registryLatest) {
+      return { ...common, kind: "no_record_at_all", hasTag: false, hasRelease: false, blocking: false, detail: "npm \u6CA1\u6709\u7ED9\u51FA latest, \u65E0\u4ECE\u4EA4\u53C9\u6821\u9A8C" };
+    }
+    const allNames = [...facts.releases, ...facts.tags.map((t) => t.name)];
+    const hasTag = hasName(facts.tags.map((t) => t.name), registryLatest);
+    const hasRelease = hasName(facts.releases, registryLatest);
+    const ghNewest = common.githubVersion;
+    if (ghNewest && numericCompare(ghNewest, registryLatest) > 0) {
       return {
-        ok: false,
-        queued: true,
-        error: `\u684C\u9762\u6682\u4E0D\u53EF\u8FBE \u2192 \u6388\u6743\u5DF2\u5B58\u5728\u624B\u673A, \u5F85\u684C\u9762\u5728\u7EBF\u65F6\u81EA\u52A8\u540C\u6B65 (${reg.error || "offline"})`,
-        data: { grantId: grant.grantId, level: grant.level, signature },
-        note: "\u684C\u9762\u4E0D\u5728\u7EBF\u65F6\u4E0D\u5047\u88C5\u5DF2\u751F\u6548: \u6388\u6743\u5728\u672C\u5730\u961F\u5217\u91CC, \u684C\u9762\u4E00\u4E0A\u7EBF\u5C31\u8865\u540C\u6B65"
+        ...common,
+        kind: "mismatch",
+        hasTag,
+        hasRelease,
+        blocking: true,
+        detail: `GitHub \u4E0A\u6709 ${ghNewest} \u7684\u53D1\u5E03\u8BB0\u5F55, \u4F46 npm registry \u7684 latest \u8FD8\u662F ${registryLatest} \u2014 \u62D2\u7EDD\u6309 GitHub \u7684\u8BB0\u5F55\u5B89\u88C5`
       };
     }
-    const r = await post(input.base, "/api/contacts/grants/sync", { grant: { ...grant, signature } }, f);
-    if (r.status === 200 && r.json?.ok) {
-      return { ok: true, data: { grantId: grant.grantId, level: grant.level, signature }, note: "\u684C\u9762\u5DF2\u9A8C\u7B7E\u63A5\u53D7" };
+    if (hasTag || hasRelease) {
+      return {
+        ...common,
+        kind: "agree",
+        hasTag,
+        hasRelease,
+        blocking: false,
+        detail: `npm latest=${registryLatest} \u5728 GitHub \u4E0A\u6709\u540C\u540D\u8BB0\u5F55 (${hasRelease ? `Release v${registryLatest}` : `Tag v${registryLatest}`}) \u2014 \u4E24\u4E2A\u6E90\u6307\u5411\u540C\u4E00\u7248`
+      };
+    }
+    if (allNames.length === 0) {
+      return {
+        ...common,
+        kind: "no_record_at_all",
+        hasTag: false,
+        hasRelease: false,
+        blocking: false,
+        detail: `GitHub \u4E0A\u6682\u65E0\u4EFB\u4F55 tag / Release (0 \u4E2A) \u2014 \u6682\u65E0\u53EF\u4EA4\u53C9\u6821\u9A8C\u7684\u8BB0\u5F55, npm \u4ECD\u662F\u6743\u5A01 (latest=${registryLatest})`
+      };
     }
-    const q = pendingQueue(input.storage);
-    q.push({ grant, signature, queuedAt: (/* @__PURE__ */ new Date()).toISOString() });
-    setQueue(input.storage, q);
     return {
-      ok: false,
-      queued: true,
-      error: `\u684C\u9762\u62D2\u7EDD/\u672A\u63A5\u53D7: ${r.json?.code || r.json?.reason || r.status}`,
-      data: { grantId: grant.grantId, level: grant.level, signature },
-      note: "\u5DF2\u4FDD\u5B58\u5728\u624B\u673A\u672C\u5730\u961F\u5217 (\u4E0D\u4F1A\u56E0\u4E3A\u5931\u8D25\u5C31\u5F53\u6210\u5DF2\u6388\u6743)"
+      ...common,
+      kind: "missing_record",
+      hasTag,
+      hasRelease,
+      blocking: false,
+      detail: `npm latest=${registryLatest} \u5728 GitHub \u4E0A\u6CA1\u6709\u5BF9\u5E94\u8BB0\u5F55 (GitHub \u6700\u65B0\u7248\u672C\u6807\u7B7E ${ghNewest || "\u65E0"}; Release ${facts.releases.length} \u4E2A / Tag ${facts.tags.length} \u4E2A) \u2014 \u53D1\u5E03\u8BB0\u5F55\u7F3A Tag, \u4E0D\u963B\u585E stable \u66F4\u65B0`
     };
   }
-  async function revokeFromPhone(opts) {
-    const c = cryptoOf(opts.cryptoObj);
-    if (!ed25519Available(c || void 0)) return { ok: false, error: "device_signing_unavailable: \u672C\u673A\u4E0D\u652F\u6301\u8BBE\u5907\u7B7E\u540D, \u64A4\u9500\u9700\u5728\u684C\u9762\u7AEF\u8FDB\u884C" };
-    const revokedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const payload = { grantId: opts.grantId, grantVersion: opts.version || 1, revokedAt, by: "mobile" };
-    const signature = await signRevocationOnDevice(payload, opts.storage, c);
-    const f = opts.fetchImpl || fetch;
-    const r = await post(opts.base, "/api/contacts/grants/revoke-sync", { grantId: opts.grantId, by: "mobile", reason: opts.reason, version: payload.grantVersion, revokedAt, signature }, f);
-    if (r.status === 200 && r.json?.ok) return { ok: true, data: { grantId: opts.grantId }, note: "\u684C\u9762\u5DF2\u9A8C\u7B7E\u5E76\u7ACB\u5373\u5931\u6548" };
-    return { ok: false, error: `\u64A4\u9500\u672A\u9001\u8FBE: ${r.json?.code || r.json?.error || r.status}`, note: "\u684C\u9762\u4E0D\u5728\u7EBF\u65F6\u64A4\u9500**\u4E0D\u4F1A**\u88AB\u5F53\u4F5C\u5DF2\u5B8C\u6210 \u2014\u2014 \u8BF7\u5728\u684C\u9762\u5728\u7EBF\u540E\u91CD\u8BD5 (\u6216\u684C\u9762\u7AEF\u64A4\u9500)" };
+  function compareDevSnapshots(installedSha, headSha, ref = `refs/heads/${DEV_BRANCH}`) {
+    const short = (s2) => s2 ? s2.slice(0, 7) : "\u672A\u77E5";
+    if (!headSha) {
+      return { ref, headSha, installedSha, same: false, behind: false, detail: `${ref} \u7684 HEAD \u8BFB\u4E0D\u5230 \u2014 \u65E0\u6CD5\u5224\u5B9A dev \u5FEB\u7167\u65B0\u65E7` };
+    }
+    if (!installedSha) {
+      return { ref, headSha, installedSha, same: false, behind: false, detail: `\u5F53\u524D\u4E0D\u662F dev \u5FEB\u7167 (stable \u5B89\u88C5) \u2014 \u5207\u5230 dev \u5C06\u5F97\u5230 ${ref} @ ${short(headSha)}` };
+    }
+    const same = installedSha.slice(0, 7) === headSha.slice(0, 7);
+    return {
+      ref,
+      headSha,
+      installedSha,
+      same,
+      behind: !same,
+      detail: same ? `\u5DF2\u662F\u6700\u65B0\u7684 dev \u5FEB\u7167 (${ref} @ ${short(headSha)}) \u2014 \u540C\u4E00\u4E2A commit` : `dev \u5FEB\u7167\u843D\u540E: \u5DF2\u88C5 ${short(installedSha)} \u2192 master HEAD ${short(headSha)} (\u6309 commit sha \u5224\u5B9A, \u4E0D\u770B\u7248\u672C\u53F7)`
+    };
   }
-  async function loadFromDesktop(base6, storage2, opts = {}) {
-    const f = opts.fetchImpl || fetch;
-    if (!base6) {
-      const caps = loadCapabilityCopy(storage2);
+
+  // src/web/mobile-update.ts
+  var MOBILE_WEB_STATUSES = [
+    ...CHECK_STATUSES,
+    "dev_bundle_unavailable",
+    "dev_sha_mismatch",
+    "target_unpublished",
+    "digest_mismatch",
+    "web_bundle_malformed",
+    "decompress_unavailable",
+    "payload_too_large",
+    "native_shell_not_wired"
+  ];
+  var MOBILE_REFUSED_STATUSES = [
+    ...REFUSED_STATUSES,
+    "target_unpublished",
+    "dev_bundle_unavailable",
+    "dev_sha_mismatch",
+    "digest_mismatch",
+    "web_bundle_malformed",
+    "decompress_unavailable",
+    "payload_too_large",
+    "native_shell_not_wired"
+  ];
+  var MOBILE_WEB_REQUIRED_FILES = ["mobile.html", "mobile.js", "mobile-core.js", "mobile.css"];
+  var MOBILE_WEB_JS_FILES = ["mobile.js", "mobile-core.js", "a2ui-client.js"];
+  var MOBILE_MAX_PAYLOAD_BYTES = 80 * 1024 * 1024;
+  var WEB_LAYOUT = {
+    current: "current",
+    staging: "staging",
+    previous: "previous",
+    state: "state.json"
+  };
+  function joinRel(...parts) {
+    return parts.map((p) => String(p).replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+  }
+  function createMemoryWebStore(opts = {}) {
+    const files = /* @__PURE__ */ new Map();
+    const dirs = /* @__PURE__ */ new Set([""]);
+    const norm = (rel) => joinRel(rel);
+    const isDir = (rel) => dirs.has(norm(rel));
+    return {
+      kind: opts.kind || "memory",
+      rootLabel: opts.rootLabel || "memory://bolloon-web",
+      async list(rel) {
+        const d2 = norm(rel);
+        const out = [];
+        for (const k of files.keys()) {
+          if (d2 === "") {
+            if (!k.includes("/")) out.push(k);
+            continue;
+          }
+          if (k.startsWith(d2 + "/")) {
+            const rest = k.slice(d2.length + 1);
+            if (!rest.includes("/")) out.push(rest);
+          }
+        }
+        return out.sort();
+      },
+      async exists(rel) {
+        const k = norm(rel);
+        return files.has(k) || isDir(k);
+      },
+      async readBytes(rel) {
+        const v = files.get(norm(rel));
+        return v ? v.slice() : null;
+      },
+      async readText(rel) {
+        const v = files.get(norm(rel));
+        return v ? new TextDecoder().decode(v) : null;
+      },
+      async writeBytes(rel, data) {
+        const k = norm(rel);
+        const parts = k.split("/");
+        for (let i = 1; i < parts.length; i++) dirs.add(parts.slice(0, i).join("/"));
+        files.set(k, data.slice ? data.slice() : data);
+      },
+      async remove(rel) {
+        const k = norm(rel);
+        for (const key of Array.from(files.keys())) if (key === k || key.startsWith(k + "/")) files.delete(key);
+        for (const d2 of Array.from(dirs)) if (d2 === k || d2.startsWith(k + "/")) dirs.delete(d2);
+      },
+      async rename(from6, to) {
+        const f = norm(from6);
+        const t = norm(to);
+        const moves = [];
+        for (const key of Array.from(files.keys())) {
+          if (key === f) moves.push({ from: key, to: t });
+          else if (key.startsWith(f + "/")) moves.push({ from: key, to: t + key.slice(f.length) });
+        }
+        await this.remove(t);
+        for (const m2 of moves) {
+          const v = files.get(m2.from);
+          files.delete(m2.from);
+          const parts = m2.to.split("/");
+          for (let i = 1; i < parts.length; i++) dirs.add(parts.slice(0, i).join("/"));
+          files.set(m2.to, v);
+        }
+        dirs.delete(f);
+        dirs.add(t);
+      },
+      baseUrl() {
+        return opts.baseUrl ?? null;
+      }
+    };
+  }
+  function createCapacitorWebStore(plugin, opts = {}) {
+    const directory = opts.directory ?? "DATA";
+    const basePath = (opts.basePath || "bolloon-web").replace(/^\/+|\/+$/g, "");
+    const full = (rel) => joinRel(basePath, rel);
+    const b64ToBytes2 = (b642) => {
+      if (typeof atob === "function") {
+        const bin = atob(b642);
+        const out = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+        return out;
+      }
+      return new Uint8Array(Buffer.from(b642, "base64"));
+    };
+    const bytesToB642 = (data) => {
+      let bin = "";
+      for (let i = 0; i < data.length; i++) bin += String.fromCharCode(data[i]);
+      if (typeof btoa === "function") return btoa(bin);
+      return Buffer.from(data).toString("base64");
+    };
+    return {
+      kind: "capacitor-fs",
+      rootLabel: `${String(directory)}:${basePath}`,
+      async list(rel) {
+        try {
+          const r = await plugin.readdir({ path: full(rel), directory });
+          return (r?.files || []).filter((f) => f?.type !== "directory").map((f) => String(f.name)).sort();
+        } catch {
+          return [];
+        }
+      },
+      async exists(rel) {
+        try {
+          await plugin.stat({ path: full(rel), directory });
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      async readBytes(rel) {
+        try {
+          const r = await plugin.readFile({ path: full(rel), directory });
+          const data = String(r?.data || "");
+          return data ? b64ToBytes2(data) : null;
+        } catch {
+          return null;
+        }
+      },
+      async readText(rel) {
+        try {
+          const r = await plugin.readFile({ path: full(rel), directory, encoding: "utf8" });
+          return r?.data === void 0 ? null : String(r.data);
+        } catch {
+          return null;
+        }
+      },
+      async writeBytes(rel, data) {
+        const path = full(rel);
+        const parts = full(rel).split("/");
+        for (let i = 1; i < parts.length; i++) {
+          try {
+            await plugin.mkdir({ path: parts.slice(0, i).join("/"), directory, recursive: true });
+          } catch {
+          }
+        }
+        await plugin.writeFile({ path, data: bytesToB642(data), directory });
+      },
+      async remove(rel) {
+        try {
+          await plugin.rmdir({ path: full(rel), directory, recursive: true });
+          return;
+        } catch {
+        }
+        try {
+          await plugin.rmdir({ path: full(rel), directory });
+        } catch {
+        }
+      },
+      async rename(from6, to) {
+        try {
+          await plugin.rmdir({ path: full(to), directory, recursive: true });
+        } catch {
+        }
+        await plugin.rename({ from: full(from6), to: full(to), directory, toDirectory: directory });
+      },
+      baseUrl() {
+        return opts.baseUrl ?? null;
+      }
+    };
+  }
+  async function gunzipBytes(data) {
+    const DS = globalThis.DecompressionStream;
+    if (typeof DS !== "function") return null;
+    try {
+      const stream = new globalThis.Blob([data]).stream().pipeThrough(new DS("gzip"));
+      const buf = await new Response(stream).arrayBuffer();
+      return new Uint8Array(buf);
+    } catch {
+      return null;
+    }
+  }
+  function untarBytes(buf) {
+    const out = [];
+    const td = new TextDecoder();
+    const readStr = (off, len) => {
+      let end = off;
+      while (end < off + len && buf[end] !== 0) end++;
+      return td.decode(buf.subarray(off, end));
+    };
+    const readOctal = (off, len) => {
+      const s2 = readStr(off, len).trim().replace(/\0/g, "");
+      const v = parseInt(s2, 8);
+      return Number.isFinite(v) ? v : 0;
+    };
+    let p = 0;
+    let paxPath = null;
+    while (p + 512 <= buf.length) {
+      const name0 = readStr(p, 100);
+      if (!name0) break;
+      const size2 = readOctal(p + 124, 12);
+      const typeflag = String.fromCharCode(buf[p + 156] || 48);
+      const prefix = readStr(p + 345, 155);
+      const dataStart = p + 512;
+      const dataEnd = dataStart + size2;
+      if (dataEnd > buf.length) break;
+      let name10 = prefix ? `${prefix}/${name0}` : name0;
+      if (typeflag === "x" || typeflag === "g") {
+        const text = td.decode(buf.subarray(dataStart, dataEnd));
+        const m2 = text.match(/\d+ path=([^\n]+)\n/);
+        if (m2) paxPath = m2[1];
+      } else if (typeflag === "L") {
+        paxPath = td.decode(buf.subarray(dataStart, dataEnd)).replace(/\0+$/, "").trim();
+      } else if (typeflag === "0" || typeflag === "\0" || typeflag === "" || typeflag === "0") {
+        if (paxPath) {
+          name10 = paxPath;
+          paxPath = null;
+        }
+        out.push({ path: name10.replace(/^\.\//, ""), data: buf.slice(dataStart, dataEnd) });
+      } else {
+        paxPath = null;
+      }
+      p = dataStart + Math.ceil(size2 / 512) * 512;
+    }
+    return out;
+  }
+  var WEB_PATH_PREFIXES = ["package/dist/web/", "dist/web/", "./dist/web/"];
+  function isWebResourcePath(path) {
+    const p = String(path).replace(/^\.\//, "");
+    for (const pre of WEB_PATH_PREFIXES) {
+      if (p.startsWith(pre)) return { hit: true, rel: p.slice(pre.length) };
+    }
+    return { hit: false, rel: "" };
+  }
+  function pickWebLayer(entries) {
+    const files = [];
+    let snapshot2 = null;
+    const td = new TextDecoder();
+    for (const e of entries) {
+      const p = String(e.path).replace(/^\.\//, "");
+      if (/(^|\/)\.bolloon-dev-snapshot\.json$/.test(p)) {
+        try {
+          snapshot2 = JSON.parse(td.decode(e.data));
+        } catch {
+          snapshot2 = null;
+        }
+        continue;
+      }
+      const w2 = isWebResourcePath(p);
+      if (w2.hit && w2.rel && !w2.rel.endsWith("/")) files.push({ rel: w2.rel, data: e.data });
+    }
+    return { files, snapshot: snapshot2 };
+  }
+  function toHex(buf) {
+    const b = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
+    let s2 = "";
+    for (let i = 0; i < b.length; i++) s2 += b[i].toString(16).padStart(2, "0");
+    return s2;
+  }
+  function normalizeAlgo(a) {
+    const k = String(a || "").toLowerCase().replace(/[^a-z0-9]/g, "");
+    if (k === "sha1") return "SHA-1";
+    if (k === "sha256") return "SHA-256";
+    if (k === "sha512") return "SHA-512";
+    return null;
+  }
+  async function digestHex(data, algo) {
+    const c = globalThis.crypto?.subtle;
+    if (!c) return null;
+    const name10 = normalizeAlgo(algo);
+    if (!name10) return null;
+    try {
+      return toHex(await c.digest(name10, data));
+    } catch {
+      return null;
+    }
+  }
+  function parseSri(integrity) {
+    const s2 = String(integrity || "").trim();
+    const m2 = s2.match(/^(sha512|sha256|sha1)-([A-Za-z0-9+/=]+)/);
+    if (!m2) return null;
+    return { algo: m2[1], b64: m2[2] };
+  }
+  function b64Of(bytes) {
+    let bin = "";
+    for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+    if (typeof btoa === "function") return btoa(bin);
+    return Buffer.from(bytes).toString("base64");
+  }
+  var MOBILE_UPDATE_STATE_SCHEMA = "bolloon-mobile-web/1";
+  function emptyMobileUpdateState() {
+    return {
+      schema: MOBILE_UPDATE_STATE_SCHEMA,
+      currentVersion: null,
+      installedChannel: null,
+      installedDevSha: null,
+      channelPref: null,
+      installedFrom: null,
+      switchableTo: null,
+      lastDevSha: null,
+      devRef: null,
+      devCheckedAt: null,
+      lastCheck: null,
+      lastUpdate: null,
+      lastFailure: null,
+      autoPrepared: null,
+      history: [],
+      needsReload: false
+    };
+  }
+  async function readMobileUpdateState(store) {
+    const base6 = emptyMobileUpdateState();
+    const text = await store.readText(WEB_LAYOUT.state);
+    if (!text) return base6;
+    try {
+      const raw = JSON.parse(text);
+      if (!raw || raw.schema !== MOBILE_UPDATE_STATE_SCHEMA) return base6;
+      return { ...base6, ...raw, history: Array.isArray(raw.history) ? raw.history.slice(0, 20) : [] };
+    } catch {
+      return base6;
+    }
+  }
+  async function writeMobileUpdateState(patch, store) {
+    const cur = await readMobileUpdateState(store);
+    const next = { ...cur, ...patch, schema: MOBILE_UPDATE_STATE_SCHEMA };
+    await store.writeBytes(WEB_LAYOUT.state, new TextEncoder().encode(JSON.stringify(next, null, 2)));
+    return next;
+  }
+  async function fetchJson(url, fetchImpl, timeoutMs = 15e3) {
+    try {
+      const ac = globalThis.AbortController ? new AbortController() : null;
+      const timer = ac ? setTimeout(() => {
+        try {
+          ac.abort();
+        } catch {
+        }
+      }, timeoutMs) : null;
+      const res = await fetchImpl(url, { headers: { Accept: "application/json" }, signal: ac?.signal });
+      const status = Number(res?.status || 0);
+      const text = await res.text();
+      if (timer) clearTimeout(timer);
+      let json = null;
+      try {
+        json = JSON.parse(text);
+      } catch {
+        json = null;
+      }
+      return { ok: status >= 200 && status < 300, status, json, text };
+    } catch (e) {
+      return { ok: false, status: 0, json: null, text: "", err: e };
+    }
+  }
+  async function queryMobileNpmFacts(deps, pkg) {
+    if (deps.npmDoc !== void 0 && deps.npmDoc !== null) return normalizeNpmDoc(deps.npmDoc, null);
+    if (deps.npmDoc === null && deps.githubFacts !== void 0) {
+      return { reachable: false, kind: "offline", detail: "\u6CE8\u5165\u7684 registry \u4E8B\u5B9E\u4E3A null (\u53D7\u63A7\u4E0D\u53EF\u8FBE: offline)", latest: null, distTags: {}, versions: [], dist: null };
+    }
+    const base6 = (deps.registryBase || NPM_REGISTRY_BASE).replace(/\/+$/, "");
+    const url = `${base6}/${encodeURIComponent(pkg).replace("%40", "@")}`;
+    const fetchImpl = deps.fetchImpl || globalThis.fetch?.bind(globalThis);
+    if (!fetchImpl) return { reachable: false, kind: "offline", detail: "\u672C\u673A\u6CA1\u6709 fetch (offline)", latest: null, distTags: {}, versions: [], dist: null };
+    const r = await fetchJson(url, fetchImpl);
+    if (!r.ok) {
+      const cls = classifyRegistryError(r.err || null, r.status || void 0);
+      return { reachable: false, kind: cls.kind, detail: cls.kind === "offline" ? `offline: ${cls.detail}` : `registry_unavailable: ${cls.detail}`, latest: null, distTags: {}, versions: [], dist: null };
+    }
+    if (!r.json) return { reachable: false, kind: "registry_unavailable", detail: "registry_unavailable: registry \u8FD4\u56DE\u4E86\u65E0\u6CD5\u89E3\u6790\u7684\u5185\u5BB9", latest: null, distTags: {}, versions: [], dist: null };
+    return normalizeNpmDoc(r.json, null);
+  }
+  function normalizeNpmDoc(doc, detail) {
+    const distTags = doc?.["dist-tags"] || {};
+    const versions = Object.keys(doc?.versions || {});
+    if (!distTags.latest && versions.length === 0) {
+      return { reachable: false, detail: detail || "registry \u4E0A\u6CA1\u6709\u53EF\u7528\u7248\u672C", latest: null, distTags: {}, versions: [], dist: null };
+    }
+    const latest = distTags.latest || versions[versions.length - 1] || null;
+    const v = latest ? doc?.versions?.[latest] : null;
+    return {
+      reachable: true,
+      latest,
+      distTags,
+      versions,
+      dist: v?.dist ? { tarball: String(v.dist.tarball || ""), shasum: v.dist.shasum ? String(v.dist.shasum) : null, integrity: v.dist.integrity ? String(v.dist.integrity) : null } : null
+    };
+  }
+  async function queryMobileGithubFacts(deps) {
+    if (deps.githubFacts !== void 0 && deps.githubFacts !== null) return deps.githubFacts;
+    if (deps.githubFacts === null) return null;
+    const fetchImpl = deps.fetchImpl || globalThis.fetch?.bind(globalThis);
+    if (!fetchImpl) return null;
+    const base6 = (deps.apiBase || GITHUB_API_BASE).replace(/\/+$/, "");
+    const missing = [];
+    let releases = [];
+    let tags = [];
+    let headSha = null;
+    const failures = [];
+    const note = (e, what) => {
+      missing.push(what);
+      failures.push({ reason: e.reason, detail: `${what}: ${e.detail}`, retryAt: e.retryAt });
+    };
+    const rel = await fetchJson(`${base6}/repos/${GITHUB_UPSTREAM_SLUG}/releases?per_page=100`, fetchImpl);
+    if (rel.ok && Array.isArray(rel.json)) releases = rel.json.map((x) => String(x?.tag_name || "")).filter(Boolean);
+    else note(classifyGithubError(rel.err || null, rel.status || void 0), "releases");
+    const tg = await fetchJson(`${base6}/repos/${GITHUB_UPSTREAM_SLUG}/tags?per_page=100`, fetchImpl);
+    if (tg.ok && Array.isArray(tg.json)) tags = tg.json.map((x) => ({ name: String(x?.name || ""), sha: x?.commit?.sha ? String(x.commit.sha) : null })).filter((t) => t.name);
+    else note(classifyGithubError(tg.err || null, tg.status || void 0), "tags");
+    const hd = await fetchJson(`${base6}/repos/${GITHUB_UPSTREAM_SLUG}/commits/${DEV_BRANCH}`, fetchImpl);
+    if (hd.ok && hd.json?.sha) headSha = String(hd.json.sha);
+    else if (hd.ok) note({ reason: "parse_error", detail: "commits/master \u6CA1\u6709 sha \u5B57\u6BB5", retryAt: null }, "head");
+    else note(classifyGithubError(hd.err || null, hd.status || void 0), "head");
+    const facts = { slug: GITHUB_UPSTREAM_SLUG, ref: DEV_REF, headSha, releases, tags, fetchedAt: (/* @__PURE__ */ new Date()).toISOString(), partial: missing.length > 0, missing };
+    if (failures.length) {
+      const f = failures[0];
+      return { ok: false, kind: "github_unavailable", reason: f.reason, detail: f.detail, retryAt: f.retryAt, facts };
+    }
+    return { ok: true, facts };
+  }
+  async function resolveLocalWebIdentity(deps) {
+    if (deps.localIdentity && isKnownVersion(deps.localIdentity.version)) {
+      const devSha = devShaFromIdentity(deps.localIdentity.version);
+      return { version: String(deps.localIdentity.version), channel: devSha ? "dev" : deps.localIdentity.channel || "stable", source: "shell-injected" };
+    }
+    const st = await readMobileUpdateState(deps.store);
+    if (st.currentVersion && isKnownVersion(st.currentVersion)) {
+      const devSha = devShaFromIdentity(st.currentVersion);
+      return { version: st.currentVersion, channel: devSha ? "dev" : st.installedChannel || "stable", source: "ota-state" };
+    }
+    const url = deps.localIdentityUrl === null ? null : deps.localIdentityUrl || "./bolloon-web.json";
+    const fetchImpl = deps.fetchImpl || globalThis.fetch?.bind(globalThis);
+    if (url && fetchImpl) {
+      const r = await fetchJson(url, fetchImpl, 8e3).catch(() => null);
+      const v = r?.json?.version;
+      if (r?.ok && isKnownVersion(v)) {
+        const devSha = devShaFromIdentity(v);
+        return { version: String(v), channel: devSha ? "dev" : r.json.channel === "dev" ? "dev" : "stable", source: "build-stamp" };
+      }
+    }
+    return null;
+  }
+  function refused(s2) {
+    return MOBILE_REFUSED_STATUSES.includes(s2);
+  }
+  function nativeWired(deps) {
+    if (deps.nativeWritable === true) return true;
+    if (deps.nativeWritable === false) return false;
+    return deps.store.kind === "memory";
+  }
+  function warnFor(channel, wired = true) {
+    const w2 = channelKindOf(channel) === "git-ref" ? [DEV_CHANNEL_WARNING, DEV_BACK_TO_STABLE_HINT_MOBILE] : [];
+    if (!wired) w2.push(NATIVE_CEILING_LINE);
+    return w2;
+  }
+  async function checkMobileUpdate(deps) {
+    const store = deps.store;
+    const now = new Date(deps.now ? deps.now() : Date.now()).toISOString();
+    const local = await resolveLocalWebIdentity(deps);
+    const channel = resolveUpdateChannel(deps.channel);
+    const channelKind = channelKindOf(channel);
+    const base6 = {
+      channel,
+      channelKind,
+      currentVersion: local?.version || "unknown",
+      installedChannel: local ? devShaFromIdentity(local.version) ? "dev" : "stable" : null,
+      installedDevSha: local ? devShaFromIdentity(local.version) : null,
+      latestVersion: null,
+      targetIdentity: null,
+      switchableTo: null,
+      crossCheck: null,
+      github: null,
+      dev: null,
+      sourceFacts: null,
+      targetPublished: null,
+      artifact: null,
+      warnings: warnFor(channel, nativeWired(deps)),
+      checkedAt: now,
+      identityLine: describeSourceIdentity({
+        packageVersion: local?.version || "unknown",
+        installedDevSha: local ? devShaFromIdentity(local.version) : null,
+        switchableTo: null,
+        channelKind
+      }),
+      localIdentitySource: local?.source || null,
+      storeKind: store.kind,
+      nativeWritable: nativeWired(deps),
+      effectiveAfterReload: nativeWired(deps)
+    };
+    if (!local || !isKnownVersion(local.version)) {
+      return { ...base6, status: "local_version_unknown", reason: `\u8BFB\u4E0D\u5230\u672C\u673A web \u5C42\u7684\u7248\u672C\u8EAB\u4EFD (\u58F3\u5C42\u6CE8\u5165 / OTA state / \u6784\u5EFA\u6233 bolloon-web.json \u90FD\u6CA1\u6709) \u2014 \u4E0D\u5224\u65AD\u6709\u6CA1\u6709\u66F4\u65B0` };
+    }
+    const npm = await queryMobileNpmFacts(deps, deps.pkgName || PKG_NAME);
+    const githubRes = await queryMobileGithubFacts(deps);
+    const github = githubRes ? toGithubReport(githubRes) : null;
+    const npmLatest = npm.reachable ? npm.distTags[distTagForChannel(channel)] || npm.latest : null;
+    const sourceFacts = {
+      npm: npm.reachable ? { reachable: true, latest: npmLatest } : { reachable: false, latest: null, detail: npm.detail },
+      github: github ? {
+        reachable: github.reachable,
+        reason: github.reason,
+        detail: github.detail,
+        retryAt: github.retryAt ?? null,
+        ref: github.ref,
+        headSha: github.headSha,
+        newestVersion: github.newestVersion,
+        releases: github.releases,
+        tags: github.tags
+      } : null,
+      crossCheck: null
+    };
+    const switchableTo = base6.installedDevSha ? { channel: "stable", source: "npm", target: npmLatest } : { channel: "dev", source: "github", target: github?.headSha ? github.headSha.slice(0, 7) : null };
+    const identityLine = describeSourceIdentity({
+      packageVersion: local.version,
+      installedDevSha: base6.installedDevSha,
+      switchableTo,
+      channelKind
+    });
+    const withSources = { ...base6, github, sourceFacts, switchableTo, identityLine };
+    if (channelKind === "git-ref") {
+      if (!github || !github.reachable) {
+        const reason = github?.reason || "offline";
+        const detail = github?.detail || (githubRes === null ? "\u672C\u6B21\u672A\u67E5\u8BE2 GitHub \u6E90" : "GitHub \u6E90\u4E0D\u53EF\u8FBE");
+        return {
+          ...withSources,
+          status: "github_unavailable",
+          latestVersion: null,
+          reason: `github_unavailable(${reason}): ${detail} \u2014 dev \u901A\u9053\u53EA\u6709 GitHub \u4E00\u4E2A\u6E90, \u62D2\u7EDD\u5B89\u88C5 (\u4E0D\u56DE\u843D\u5230 stable \u88C5\u4E00\u4E2A npm \u7248\u672C)`
+        };
+      }
+      if (!github.headSha) {
+        return { ...withSources, status: "github_unavailable", latestVersion: null, reason: `github_unavailable(not_found): GitHub \u4E0A\u6CA1\u6709 ${DEV_REF} \u6216\u8BFB\u4E0D\u5230 HEAD \u2014 \u62D2\u7EDD\u5B89\u88C5\u4E00\u4E2A\u8EAB\u4EFD\u4E0D\u660E\u7684\u5FEB\u7167` };
+      }
+      const dev = compareDevSnapshots(base6.installedDevSha, github.headSha, DEV_REF);
+      const targetIdentity = devIdentity(baseVersionOf(local.version), github.headSha);
+      const devBundleUrl = deps.devBundleUrl !== void 0 ? deps.devBundleUrl : envValue("BOLLOON_MOBILE_DEV_BUNDLE_URL");
+      const devBundleSha256 = deps.devBundleSha256 !== void 0 ? deps.devBundleSha256 : envValue("BOLLOON_MOBILE_DEV_BUNDLE_SHA256");
+      const common = { ...withSources, dev, targetIdentity, latestVersion: targetIdentity, sourceFacts: { ...sourceFacts, github: sourceFacts.github } };
+      if (dev.same) {
+        return { ...common, status: "up_to_date", reason: dev.detail };
+      }
+      if (!devBundleUrl || !/\{sha\}/.test(devBundleUrl)) {
+        return {
+          ...common,
+          status: "dev_bundle_unavailable",
+          reason: `dev_bundle_unavailable: dev \u901A\u9053\u7684 web \u5305\u8981\u7531\u6709\u6784\u5EFA\u80FD\u529B\u7684\u4E00\u7AEF\u4EA7\u51FA \u2014\u2014 GitHub master \u7684\u6E90\u7801\u5FEB\u7167\u91CC\u6CA1\u6709 dist/web (dist \u662F\u6784\u5EFA\u4EA7\u7269, \u4E0D\u5728 git \u91CC), \u624B\u673A\u7AEF\u65E0\u6CD5\u73B0\u573A\u6784\u5EFA\u3002\u8BF7\u7528\u684C\u9762\u5BFC\u51FA: npx tsx scripts/build-mobile-web-bundle.ts --channel dev (\u4EA7\u51FA dist/web + .bolloon-dev-snapshot.json \u7684 tar.gz \u4E0E\u540C\u540D .sha256), \u5E76\u628A\u5730\u5740\u914D\u5230\u624B\u673A\u7AEF BOLLOON_MOBILE_DEV_BUNDLE_URL (\u6A21\u677F\u9700\u542B {sha}, {sha} \u4F1A\u88AB\u66FF\u6362\u6210 master HEAD \u7684\u5B8C\u6574 40 \u4F4D sha)\u3002${devBundleUrl ? ` \u5F53\u524D\u914D\u7F6E\u7684\u6A21\u677F\u4E0D\u542B {sha}: ${devBundleUrl}` : " \u5F53\u524D\u6CA1\u6709\u914D\u7F6E dev web \u5305\u5730\u5740\u3002"} stable \u901A\u9053\u4E0D\u53D7\u5F71\u54CD (npm tarball \u81EA\u5E26 dist/web)\u3002`
+        };
+      }
+      const pinned = devBundleSha256 ? String(devBundleSha256).trim().toLowerCase() : null;
+      const url = String(devBundleUrl).replace("{sha}", github.headSha);
       return {
-        ok: false,
-        error: "desktop_offline",
-        data: { contacts: caps, grants: [], effective: "\u684C\u9762\u4E0D\u5728\u7EBF (\u663E\u793A\u624B\u673A\u672C\u5730\u526F\u672C)", approvals: [], waiting: [] },
-        note: "\u4EE5\u4E0B\u662F\u4F60\u624B\u673A\u4E0A\u4FDD\u5B58\u7684\u80FD\u529B\u526F\u672C (\u4E0D\u662F\u684C\u9762\u5B9E\u65F6\u72B6\u6001)"
+        ...common,
+        status: "update_available",
+        targetPublished: true,
+        artifact: {
+          channel: "dev",
+          identity: targetIdentity,
+          source: `github master @ ${github.headSha.slice(0, 7)}`,
+          url,
+          // pin 了才校验载荷摘要; 没 pin 就如实标"没有载荷锚点"(不给虚假的安全感)
+          digest: pinned ? { algo: "sha256", hex: pinned } : null,
+          expectedDevSha: github.headSha,
+          expectedBundleSha256: pinned
+        },
+        reason: `${dev.detail} \xB7 web \u5305\u6765\u81EA ${url} (\u5305\u5185 sha \u5FC5\u987B\u7B49\u4E8E master HEAD, \u5426\u5219\u62D2\u7EDD)` + (pinned ? ` \xB7 \u8F7D\u8377\u6458\u8981\u5DF2 pin (sha256:${pinned.slice(0, 12)}\u2026)` : " \xB7 \u8F7D\u8377\u6458\u8981\u672A pin (dev \u901A\u9053\u56FA\u6709: \u53EA\u6709\u8EAB\u4EFD\u88AB GitHub \u951A\u5B9A)"),
+        warnings: common.warnings.concat(pinned ? [] : [
+          'dev \u8F7D\u8377\u6458\u8981\u672A pin \u21D2 \u53EA\u4FDD\u8BC1"\u8EAB\u4EFD\u662F master HEAD \u7684\u90A3\u4E2A commit", \u4E0D\u4FDD\u8BC1"\u5B57\u8282\u5C31\u662F\u684C\u9762\u6253\u7684\u90A3\u4E00\u4EFD" (\u8981\u5F3A\u6821\u9A8C\u5C31\u628A .sha256 \u6E05\u5355\u7684\u503C\u914D\u5230 BOLLOON_MOBILE_DEV_BUNDLE_SHA256)'
+        ])
       };
     }
-    try {
-      const a = await get(base6, "/api/contacts", f);
-      const b = await get(base6, "/api/contacts/grants", f);
-      if (a.status !== 200 && b.status !== 200) return { ok: false, error: `desktop_http_${a.status || b.status}` };
-      const view = {
-        contacts: a.json?.contacts || [],
-        grants: b.json?.grants || [],
-        effective: b.json?.effective || "",
-        approvals: a.json?.approvals || [],
-        waiting: a.json?.waiting || []
+    if (!npm.reachable) {
+      const detail = npm.detail || "registry \u4E0D\u53EF\u8FBE";
+      const offline = npm.kind === "offline";
+      return {
+        ...withSources,
+        status: offline ? "offline" : "registry_unavailable",
+        latestVersion: null,
+        reason: `${detail}${github ? ` \xB7 ${renderGithubReportLine(github)}` : ""} \u2014 \u4E0D\u80FD\u5224\u5B9A\u4E3A\u6700\u65B0`
+      };
+    }
+    const latest = npmLatest;
+    const facts = githubRes && githubRes.ok ? githubRes.facts : null;
+    const crossCheck = facts ? crossCheckStable(latest, facts) : null;
+    const withCross = {
+      ...withSources,
+      crossCheck,
+      latestVersion: latest,
+      sourceFacts: { ...sourceFacts, crossCheck: crossCheck ? { kind: crossCheck.kind, blocking: crossCheck.blocking, detail: crossCheck.detail } : null }
+    };
+    if (crossCheck?.kind === "mismatch") {
+      return {
+        ...withCross,
+        status: "cross_check_mismatch",
+        reason: `cross_check_mismatch: ${crossCheck.detail} (npm latest=${latest} / GitHub ${crossCheck.githubVersion || "\u65E0\u8BB0\u5F55"})`
       };
-      saveCapabilityCopy(storage2, (view.contacts || []).filter((c) => c.capabilities?.includes("send")).map((c) => ({
-        contactId: c.contactId,
-        kind: c.kind,
-        displayValue: c.displayValue,
-        verificationStatus: c.status,
-        capabilities: c.capabilities,
-        provider: c.provider,
-        state: c.status
-      })));
-      return { ok: true, data: view };
-    } catch (err2) {
-      const caps = loadCapabilityCopy(storage2);
+    }
+    if (isDevIdentity(local.version)) {
+      const target = latest;
+      if (!target || !npm.versions.includes(baseVersionOf(target))) {
+        return { ...withCross, status: "target_unpublished", reason: `target_unpublished: registry \u4E0A\u6CA1\u6709 ${target || "\u76EE\u6807\u7248\u672C"} \u8FD9\u4E2A\u7248\u672C \u2014 \u62D2\u7EDD\u5207\u56DE (\u5F53\u524D dev \u5FEB\u7167 ${local.version} \u539F\u6837\u4FDD\u7559)` };
+      }
+      if (!npm.dist?.tarball) {
+        return { ...withCross, status: "target_unpublished", reason: `target_unpublished: registry \u6CA1\u7ED9\u51FA ${target} \u7684\u4E0B\u8F7D\u5730\u5740 (dist.tarball \u7F3A\u5931) \u2014 \u62D2\u7EDD\u5207\u56DE` };
+      }
+      return {
+        ...withCross,
+        status: "update_available",
+        targetPublished: true,
+        artifact: {
+          channel: "stable",
+          identity: String(target),
+          source: "npm registry (dist-tags.latest)",
+          url: npm.dist.tarball,
+          digest: npm.dist.shasum ? { algo: "sha1", hex: npm.dist.shasum } : npm.dist.integrity ? { algo: "sha512", b64: parseSri(npm.dist.integrity)?.b64 ?? null } : null
+        },
+        reason: `\u5F53\u524D\u88C5\u7684\u662F dev \u5FEB\u7167 ${local.version} \u2192 \u5207\u56DE stable \u7684 ${target} (${DEV_BACK_TO_STABLE_HINT_MOBILE})`
+      };
+    }
+    if (latest && !npm.versions.includes(latest)) {
+      return { ...withCross, status: "target_unpublished", targetPublished: false, reason: `target_unpublished: registry \u7684 dist-tags \u6307\u5230 ${latest}, \u4F46 versions \u91CC\u6CA1\u6709\u8FD9\u4E2A\u7248\u672C \u2014 \u62D2\u7EDD\u66F4\u65B0 (0 \u5B57\u8282\u4E0B\u8F7D)` };
+    }
+    if (latest && compareVersions(baseVersionOf(local.version), latest) < 0) {
+      if (!npm.dist?.tarball) {
+        return { ...withCross, status: "target_unpublished", targetPublished: true, reason: `target_unpublished: registry \u6CA1\u7ED9\u51FA ${latest} \u7684\u4E0B\u8F7D\u5730\u5740 (dist.tarball \u7F3A\u5931) \u2014 \u62D2\u7EDD\u66F4\u65B0` };
+      }
+      return {
+        ...withCross,
+        status: "update_available",
+        targetPublished: true,
+        artifact: {
+          channel: "stable",
+          identity: latest,
+          source: "npm registry (dist-tags.latest)",
+          url: npm.dist.tarball,
+          digest: npm.dist.shasum ? { algo: "sha1", hex: npm.dist.shasum } : npm.dist.integrity ? { algo: "sha512", b64: parseSri(npm.dist.integrity)?.b64 ?? null } : null
+        },
+        reason: `\u5F53\u524D ${local.version} \u2192 \u76EE\u6807 ${latest}${crossCheck ? ` \xB7 \u4EA4\u53C9\u6821\u9A8C: ${crossCheck.kind}` : ""}`
+      };
+    }
+    return { ...withCross, status: "up_to_date", targetPublished: latest ? npm.versions.includes(latest) : null };
+  }
+  async function downloadArtifact(artifact, deps) {
+    const fetchImpl = deps.fetchImpl || globalThis.fetch?.bind(globalThis);
+    const maxBytes = deps.maxPayloadBytes ?? MOBILE_MAX_PAYLOAD_BYTES;
+    if (!fetchImpl) return { ok: false, status: "offline", detail: "\u672C\u673A\u6CA1\u6709 fetch, \u65E0\u6CD5\u4E0B\u8F7D", digest: { algo: "", matched: null } };
+    let bytes;
+    try {
+      const res = await fetchImpl(artifact.url, { headers: { Accept: "application/octet-stream, application/gzip, */*" } });
+      const status = Number(res?.status || 0);
+      if (!(status >= 200 && status < 300)) {
+        const cls = classifyGithubError(null, status || void 0);
+        const bucket = cls.reason === "not_found" ? "target_unpublished" : cls.reason === "offline" ? "offline" : "registry_unavailable";
+        return { ok: false, status: bucket, detail: `\u4E0B\u8F7D ${artifact.url} \u5931\u8D25: HTTP ${status || "\u65E0\u54CD\u5E94"} (${cls.reason})`, digest: { algo: "", matched: null } };
+      }
+      const lenHint = Number(res?.headers?.get?.("content-length") || 0);
+      if (lenHint && lenHint > maxBytes) {
+        return { ok: false, status: "payload_too_large", detail: `\u4E0B\u8F7D\u7269 ${(lenHint / 1048576).toFixed(1)} MiB \u8D85\u8FC7\u4E0A\u9650 ${(maxBytes / 1048576).toFixed(0)} MiB \u2014 \u62D2\u7EDD`, digest: { algo: "", matched: null } };
+      }
+      const buf = await res.arrayBuffer();
+      bytes = new Uint8Array(buf);
+      if (bytes.length > maxBytes) {
+        return { ok: false, status: "payload_too_large", detail: `\u4E0B\u8F7D\u7269 ${(bytes.length / 1048576).toFixed(1)} MiB \u8D85\u8FC7\u4E0A\u9650 ${(maxBytes / 1048576).toFixed(0)} MiB \u2014 \u62D2\u7EDD`, digest: { algo: "", matched: null } };
+      }
+    } catch (e) {
+      const cls = classifyGithubError(e);
+      return { ok: false, status: cls.reason === "offline" ? "offline" : "registry_unavailable", detail: `\u4E0B\u8F7D ${artifact.url} \u5931\u8D25: ${cls.detail}`, digest: { algo: "", matched: null } };
+    }
+    if (!artifact.digest) {
+      return { ok: true, detail: "\u8BE5\u6E90\u6CA1\u6709\u63D0\u4F9B\u6458\u8981 (dev web \u5305\u4EE5\u5305\u5185 sha \u4F5C\u4E3A\u8EAB\u4EFD\u6821\u9A8C, \u89C1 dev_sha_mismatch)", bytes, digest: { algo: "", matched: null } };
+    }
+    const algo = artifact.digest.algo;
+    const want = artifact.digest.hex || artifact.digest.b64;
+    if (!want) return { ok: true, detail: "\u58F0\u660E\u7684\u6458\u8981\u4E3A\u7A7A (\u8DF3\u8FC7)", bytes, digest: { algo, matched: null } };
+    let got = null;
+    if (artifact.digest.hex) got = await digestHex(bytes, algo);
+    else {
+      const bytesDigest = await digestHex(bytes, algo);
+      if (bytesDigest) got = null;
+      const h3 = bytesDigest;
+      if (h3) {
+        const pairs = h3.match(/.{2}/g) || [];
+        const arr = new Uint8Array(pairs.map((x) => parseInt(x, 16)));
+        got = b64Of(arr) === artifact.digest.b64 ? artifact.digest.b64 : b64Of(arr);
+      }
+    }
+    const matched = got !== null && got.toLowerCase() === want.toLowerCase();
+    if (!matched) {
       return {
         ok: false,
-        error: "desktop_offline",
-        data: { contacts: caps, grants: [], effective: "\u684C\u9762\u4E0D\u5728\u7EBF (\u663E\u793A\u624B\u673A\u672C\u5730\u526F\u672C)", approvals: [], waiting: [] },
-        note: `\u8FDE\u4E0D\u4E0A\u684C\u9762 (${String(err2?.message || err2).slice(0, 60)}) \u2014\u2014 \u663E\u793A\u672C\u5730\u526F\u672C`
+        status: "digest_mismatch",
+        detail: `digest_mismatch: \u6458\u8981\u5BF9\u4E0D\u4E0A (${algo}) \u2014 \u58F0\u660E ${String(want).slice(0, 24)}\u2026, \u5B9E\u9645 ${String(got).slice(0, 24)}\u2026, \u62D2\u7EDD\u5B89\u88C5`,
+        bytes,
+        digest: { algo, hex: artifact.digest.hex ? got : null, b64: artifact.digest.b64 ? got : null, matched: false }
       };
     }
+    return { ok: true, detail: `\u6458\u8981\u5DF2\u6838\u5BF9 (${algo})`, bytes, digest: { algo, hex: artifact.digest.hex ? got : null, b64: artifact.digest.b64 ? got : null, matched: true } };
   }
-  async function bindFromPhone(base6, opts, storage2, f) {
-    const impl = f || fetch;
-    if (!base6) return { ok: false, error: "desktop_offline: \u7ED1\u5B9A\u9700\u8981\u684C\u9762\u7AEF\u5728\u7EBF (\u684C\u9762\u8D1F\u8D23\u843D\u76D8\u4E0E\u9A8C\u8BC1\u7801\u901A\u9053)" };
-    const r = await post(base6, "/api/contacts/bind", { kind: opts.kind, value: opts.value, region: opts.region }, impl);
-    if (r.status === 200 && r.json?.ok) return { ok: true, data: r.json };
-    return { ok: false, error: r.json?.error || `HTTP ${r.status}` };
+  function scriptRefsOf(html) {
+    const out = [];
+    const re = /<script[^>]*\ssrc=["']([^"']+)["']/gi;
+    let m2;
+    while (m2 = re.exec(html)) out.push(m2[1]);
+    return out;
   }
-  async function verifyFromPhone(base6, opts, storage2, f) {
-    const impl = f || fetch;
-    if (!base6) return { ok: false, error: "desktop_offline: \u9A8C\u8BC1\u9700\u8981\u684C\u9762\u7AEF\u5728\u7EBF" };
-    const r = await post(base6, "/api/contacts/verify", { contactId: opts.contactId, challengeId: opts.challengeId, code: opts.code }, impl);
-    if (r.status === 200 && r.json?.ok) return { ok: true, data: r.json };
-    return { ok: false, error: r.json?.error || `HTTP ${r.status}` };
+  async function verifyWebLayer(store, prefix, opts = {}) {
+    const checks = [];
+    const present = {};
+    for (const f of MOBILE_WEB_REQUIRED_FILES) {
+      const text = await store.readText(joinRel(prefix, f));
+      const bytes = text === null ? await store.readBytes(joinRel(prefix, f)) : null;
+      const size2 = text !== null ? text.length : bytes?.length ?? 0;
+      present[f] = String(text ?? "");
+      checks.push({ name: `\u5FC5\u9700\u6587\u4EF6 ${f}`, ok: size2 > 0, detail: size2 > 0 ? `${size2} \u5B57\u8282` : "\u7F3A\u5931\u6216\u4E3A\u7A7A" });
+    }
+    const html = present["mobile.html"] || "";
+    const refs = scriptRefsOf(html);
+    const refMiss = [];
+    for (const r of refs) {
+      if (/^https?:|^\/\//i.test(r)) continue;
+      const rel = r.replace(/^\.\//, "").split("?")[0];
+      if (!await store.exists(joinRel(prefix, rel))) refMiss.push(r);
+    }
+    checks.push({ name: "mobile.html \u5F15\u7528\u7684\u811A\u672C\u90FD\u5728", ok: refMiss.length === 0, detail: refMiss.length ? `\u7F3A\u5931: ${refMiss.join(", ")}` : `${refs.length} \u4E2A\u5F15\u7528\u90FD\u547D\u4E2D` });
+    const syntaxBad = [];
+    for (const f of MOBILE_WEB_JS_FILES) {
+      const src4 = await store.readText(joinRel(prefix, f));
+      if (src4 === null || src4 === "") continue;
+      try {
+        new Function(src4);
+      } catch (e) {
+        syntaxBad.push(`${f}: ${String(e?.message || e).slice(0, 120)}`);
+      }
+    }
+    checks.push({ name: "JS \u8BED\u6CD5\u81EA\u68C0 (\u771F\u7F16\u8BD1\u4E00\u6B21)", ok: syntaxBad.length === 0, detail: syntaxBad.length ? syntaxBad.join(" | ") : `${MOBILE_WEB_JS_FILES.length} \u4E2A\u6587\u4EF6\u53EF\u7F16\u8BD1` });
+    const structural = checks.every((c) => c.ok);
+    if (!structural) {
+      return { ok: false, mode: "static-only", detail: `\u7ED3\u6784\u4E0E\u8BED\u6CD5\u68C0\u67E5\u672A\u901A\u8FC7: ${checks.filter((c) => !c.ok).map((c) => `${c.name}(${c.detail})`).join("; ")}`, checks };
+    }
+    const base6 = store.baseUrl();
+    if (!base6) {
+      return { ok: true, mode: "static-only", detail: '\u7ED3\u6784 + \u8BED\u6CD5\u901A\u8FC7; \u672C store \u6CA1\u6709\u53EF\u52A0\u8F7D URL \u21D2 \u672A\u505A\u771F\u542F\u52A8\u63A2\u6D4B (\u5982\u5B9E\u6807\u6CE8, \u4E0D\u5F53\u6210"\u5DF2\u9A8C\u8BC1\u80FD\u542F\u52A8")', checks };
+    }
+    if (!hasDom()) {
+      return {
+        ok: true,
+        mode: "static-only",
+        detail: "\u7ED3\u6784 + \u8BED\u6CD5\u901A\u8FC7; \u6709\u53EF\u52A0\u8F7D URL \u4F46\u672C\u73AF\u5883\u6CA1\u6709 DOM (\u975E\u6D4F\u89C8\u5668) \u21D2 \u672A\u505A\u771F\u542F\u52A8\u63A2\u6D4B (\u5982\u5B9E\u6807\u6CE8; \u771F\u63A2\u6D4B\u89C1 scripts/verify-mobile-update-ui.ts)",
+        checks
+      };
+    }
+    const url = `${String(base6).replace(/\/+$/, "")}/${joinRel(prefix, "mobile.html")}`;
+    const probe = await iframeBootProbe(url, opts.bootTimeoutMs ?? 12e3);
+    checks.push({ name: "\u771F\u542F\u52A8\u63A2\u6D4B (iframe \u52A0\u8F7D staged \u8D44\u6E90)", ok: probe.ok, detail: probe.detail });
+    return { ok: probe.ok, mode: "iframe", detail: probe.ok ? `\u771F\u542F\u52A8\u63A2\u6D4B\u901A\u8FC7: ${probe.detail}` : `\u771F\u542F\u52A8\u63A2\u6D4B\u5931\u8D25: ${probe.detail}`, checks };
+  }
+  function hasDom() {
+    const d2 = globalThis.document;
+    return !!(d2 && typeof d2.createElement === "function");
+  }
+  async function iframeBootProbe(url, timeoutMs) {
+    const doc = globalThis.document;
+    if (!doc || typeof doc.createElement !== "function") return { ok: false, detail: "\u6CA1\u6709 DOM, \u65E0\u6CD5\u505A\u542F\u52A8\u63A2\u6D4B" };
+    return await new Promise((resolve) => {
+      let done = false;
+      const frame = doc.createElement("iframe");
+      frame.style.cssText = "position:absolute;left:-9999px;width:430px;height:932px;border:0;";
+      frame.setAttribute("aria-hidden", "true");
+      frame.src = url;
+      const finish = (ok, detail) => {
+        if (done) return;
+        done = true;
+        try {
+          frame.remove();
+        } catch {
+        }
+        resolve({ ok, detail });
+      };
+      const timer = setTimeout(() => {
+        const w2 = (() => {
+          try {
+            return frame.contentWindow;
+          } catch {
+            return null;
+          }
+        })();
+        finish(false, `\u7B49 ${timeoutMs}ms \u672A\u89C1 staged \u8D44\u6E90\u542F\u52A8 (readyState=${w2?.document?.readyState || "\u672A\u77E5"}, BolloonCore=${typeof w2?.BolloonCore})`);
+      }, timeoutMs);
+      frame.onload = () => {
+        let tries = 0;
+        const tick = () => {
+          tries++;
+          let w2 = null;
+          try {
+            w2 = frame.contentWindow;
+          } catch {
+          }
+          const d2 = w2?.document;
+          if (d2 && d2.readyState === "complete" && d2.querySelector && d2.querySelector(".tabbar") && w2.BolloonCore && typeof w2.BolloonCore === "object") {
+            clearTimeout(timer);
+            finish(true, `staged \u8D44\u6E90\u771F\u8D77\u6765\u4E86 (tabbar + BolloonCore, ${tries} \u6B21\u63A2\u6D4B)`);
+            return;
+          }
+          if (tries > 60) {
+            clearTimeout(timer);
+            finish(false, `staged \u8D44\u6E90\u52A0\u8F7D\u5B8C\u4F46\u6CA1\u8D77\u6765 (readyState=${d2?.readyState || "\u672A\u77E5"}, tabbar=${!!d2?.querySelector?.(".tabbar")}, BolloonCore=${typeof w2?.BolloonCore})`);
+            return;
+          }
+          setTimeout(tick, 150);
+        };
+        tick();
+      };
+      frame.onerror = () => {
+        clearTimeout(timer);
+        finish(false, "iframe \u52A0\u8F7D\u5931\u8D25");
+      };
+      try {
+        doc.body.appendChild(frame);
+      } catch (e) {
+        clearTimeout(timer);
+        finish(false, `\u6302\u8F7D iframe \u5931\u8D25: ${e?.message || e}`);
+      }
+    });
   }
-  async function decideApprovalFromPhone(base6, opts, f) {
-    const impl = f || fetch;
-    if (!base6) return { ok: false, error: "desktop_offline: \u6279\u51C6\u9700\u8981\u684C\u9762\u7AEF\u5728\u7EBF (\u624B\u673A\u4E0D\u5728\u7EBF\u65F6\u4E0D\u4F1A\u5047\u88C5\u5DF2\u6279\u51C6)" };
-    const r = await post(base6, `/api/contacts/approvals/${encodeURIComponent(opts.consentId)}/${opts.action}`, { by: "leo", via: "mobile", body: opts.body, reason: opts.reason }, impl);
-    if (r.status === 200 && r.json?.ok) return { ok: true, data: r.json };
-    return { ok: false, error: r.json?.error || `HTTP ${r.status}` };
+  async function prepareMobileUpdate(deps, check) {
+    const store = deps.store;
+    const now = new Date(deps.now ? deps.now() : Date.now()).toISOString();
+    const stage = (s2, detail) => {
+      try {
+        deps.onStage?.(s2, detail);
+      } catch {
+      }
+    };
+    const steps = [];
+    const mark = (s2) => {
+      steps.push(s2);
+    };
+    const r = check || await checkMobileUpdate(deps);
+    const from6 = r.currentVersion;
+    const to = r.artifact?.identity || r.targetIdentity || from6;
+    const fail = async (stageName, status, reason, extra = {}) => {
+      mark(`${stageName}: ${reason}`);
+      await store.remove(WEB_LAYOUT.staging);
+      await writeMobileUpdateState({
+        lastCheck: { at: now, status: r.status, reason: r.reason, channel: r.channel, latestVersion: r.latestVersion },
+        lastFailure: { at: now, stage: stageName, reason },
+        autoPrepared: null
+      }, store);
+      return { ok: false, stage: "failed", failedAt: stageName, status, from: from6, to, reason, steps, fileCount: 0, digest: null, probe: null, skippedDownload: false, ...extra };
+    };
+    if (refused(r.status)) {
+      return fail("blocked", r.status, `\u62D2\u7EDD\u66F4\u65B0 (${r.status}): ${r.reason || "\u6E90\u4E0D\u53EF\u8FBE / \u7248\u672C\u4E0D\u5B58\u5728"}`, { stage: "blocked" });
+    }
+    if (r.status === "up_to_date") {
+      mark(`up_to_date: ${r.reason || "\u5DF2\u662F\u6700\u65B0"}`);
+      return { ok: false, stage: "blocked", status: "up_to_date", from: from6, to, reason: `\u5DF2\u662F\u6700\u65B0 (${from6}), \u65E0\u9700\u66F4\u65B0`, steps, fileCount: 0, digest: null, probe: null, skippedDownload: true };
+    }
+    if (!r.artifact) return fail("planned", "target_unpublished", "\u6CA1\u6709\u53EF\u6267\u884C\u7684\u4E0B\u8F7D\u8BA1\u5212 (artifact \u7F3A\u5931)");
+    const prevState = await readMobileUpdateState(store);
+    if (prevState.autoPrepared?.identity === to && await store.exists(joinRel(WEB_LAYOUT.staging, "mobile.html"))) {
+      mark(`reuse-staging: \u590D\u7528\u5DF2\u51C6\u5907\u5E76\u9A8C\u8BC1\u8FC7\u7684 ${to}`);
+      const probe2 = await verifyWebLayer(store, WEB_LAYOUT.staging, { bootTimeoutMs: deps.bootTimeoutMs });
+      if (probe2.ok) {
+        return { ok: true, stage: "awaiting_human", status: "update_available", from: from6, to, reason: `staging \u91CC\u5DF2\u6709\u9A8C\u8BC1\u8FC7\u7684 ${to} (digest ${prevState.autoPrepared.digest || "\u65E0"}) \u2014 \u7B49\u4EBA\u5DE5\u786E\u8BA4\u5207\u6362`, steps, fileCount: 0, digest: prevState.autoPrepared.digest, probe: probe2, skippedDownload: true };
+      }
+      mark("reuse-staging: \u590D\u7528\u7684 staging \u6CA1\u901A\u8FC7\u9A8C\u8BC1 \u2192 \u91CD\u65B0\u4E0B\u8F7D");
+    }
+    stage("downloading", `${r.artifact.channel} \xB7 ${r.artifact.identity} \u2190 ${r.artifact.url}`);
+    mark(`downloading: ${r.artifact.url}`);
+    const dl = await downloadArtifact(r.artifact, deps);
+    if (!dl.ok || !dl.bytes) {
+      return fail("downloading", dl.status || "registry_unavailable", dl.detail);
+    }
+    stage("downloaded", `\u5DF2\u4E0B\u8F7D ${(dl.bytes.length / 1048576).toFixed(2)} MiB \xB7 ${dl.detail}`);
+    mark(`downloaded: ${(dl.bytes.length / 1048576).toFixed(2)} MiB \xB7 ${dl.detail}`);
+    stage("extracting", "\u89E3\u538B tar.gz \u5E76\u6311\u51FA web \u8D44\u6E90 (dist/web)");
+    const tarBytes = await gunzipBytes(dl.bytes);
+    if (!tarBytes) {
+      return fail(
+        "extracting",
+        "decompress_unavailable",
+        "decompress_unavailable: \u672C\u673A WebView \u6CA1\u6709 DecompressionStream('gzip') \u21D2 \u65E0\u6CD5\u89E3\u5F00 tar.gz \u2014 \u62D2\u7EDD (\u4E0D\u88C5\u534A\u4E2A)\u3002 iOS 16.4+ / Chrome 80+ \u624D\u6709; \u65E7 WebView \u8BF7\u5347\u7EA7\u7CFB\u7EDF\u6216\u8D70\u5546\u5E97\u66F4\u65B0\u6574\u4E2A App\u3002"
+      );
+    }
+    const entries = untarBytes(tarBytes);
+    const { files, snapshot: snapshot2 } = pickWebLayer(entries);
+    if (files.length === 0) {
+      return fail("extracting", "web_bundle_malformed", `web_bundle_malformed: \u5305\u91CC\u6CA1\u6709 dist/web/** \u8D44\u6E90 (tar \u6761\u76EE ${entries.length} \u4E2A) \u2014 \u62D2\u7EDD`);
+    }
+    mark(`extracting: ${files.length} \u4E2A web \u6587\u4EF6, \u5305\u5185 snapshot \u6807\u8BB0 = ${snapshot2 ? `\u6709 (sha ${String(snapshot2.sha || "").slice(0, 7)})` : "\u65E0"}`);
+    if (r.artifact.channel === "dev") {
+      const want = (r.artifact.expectedDevSha || "").slice(0, 7);
+      const got = snapshot2?.sha ? String(snapshot2.sha).slice(0, 7) : null;
+      if (!snapshot2) {
+        return fail("extracting", "dev_sha_mismatch", `dev_sha_mismatch: dev web \u5305\u91CC\u6CA1\u6709 .bolloon-dev-snapshot.json \u21D2 \u65E0\u6CD5\u8BC1\u660E\u5B83\u662F ${want} \u7684\u5FEB\u7167 \u2014 \u62D2\u7EDD`);
+      }
+      if (snapshot2.channel !== "dev") {
+        return fail("extracting", "dev_sha_mismatch", `dev_sha_mismatch: \u5305\u5185 snapshot \u6807\u7684\u662F channel=${snapshot2.channel} (\u4E0D\u662F dev) \u2014 \u62D2\u7EDD`);
+      }
+      if (!got || got !== want) {
+        return fail("extracting", "dev_sha_mismatch", `dev_sha_mismatch: \u5305\u5185 sha=${got || "\u7A7A"} \u2260 GitHub master HEAD ${want} \u2014 \u62D2\u7EDD\u5B89\u88C5\u8EAB\u4EFD\u5BF9\u4E0D\u4E0A\u7684\u5FEB\u7167`);
+      }
+      if (snapshot2.identity && to && String(snapshot2.identity) !== to) {
+        return fail("extracting", "dev_sha_mismatch", `dev_sha_mismatch: \u5305\u5185 identity=${snapshot2.identity} \u4E0E\u76EE\u6807\u8EAB\u4EFD ${to} \u4E0D\u4E00\u81F4 \u2014 \u62D2\u7EDD`);
+      }
+    }
+    await store.remove(WEB_LAYOUT.staging);
+    for (const f of files) await store.writeBytes(joinRel(WEB_LAYOUT.staging, f.rel), f.data);
+    stage("staged", `${files.length} \u4E2A\u6587\u4EF6\u5DF2\u5199\u5165 ${store.rootLabel}/${WEB_LAYOUT.staging}`);
+    mark(`staged: ${files.length} \u4E2A\u6587\u4EF6 \u2192 ${WEB_LAYOUT.staging}`);
+    stage("verifying", "\u9A8C\u8BC1 staging \u80FD\u4E0D\u80FD\u542F\u52A8 (\u7ED3\u6784 + \u8BED\u6CD5 + iframe \u771F\u52A0\u8F7D)");
+    const probe = await verifyWebLayer(store, WEB_LAYOUT.staging, { bootTimeoutMs: deps.bootTimeoutMs });
+    mark(`verifying: ${probe.mode} \u2014 ${probe.detail}`);
+    if (!probe.ok) {
+      return fail("verifying", "web_bundle_malformed", `\u5207\u6362\u524D\u9A8C\u8BC1\u5931\u8D25 (staged \u8D44\u6E90\u8D77\u4E0D\u6765): ${probe.detail}`, { probe });
+    }
+    const digest3 = dl.digest.matched === true ? `${dl.digest.algo}:${dl.digest.hex || dl.digest.b64}` : null;
+    await writeMobileUpdateState({
+      lastCheck: { at: now, status: r.status, reason: r.reason, channel: r.channel, latestVersion: r.latestVersion },
+      autoPrepared: { identity: to, digest: digest3, verifiedAt: now, steps: steps.slice() }
+    }, store);
+    return { ok: true, stage: "awaiting_human", status: "update_available", from: from6, to, reason: `\u5DF2\u51C6\u5907\u5E76\u9A8C\u8BC1 ${to} (\u7B49\u4EBA\u5DE5\u786E\u8BA4\u5207\u6362)`, steps, fileCount: files.length, digest: digest3, probe, skippedDownload: false };
+  }
+  async function applyMobileUpdate(opts) {
+    const started = Date.now();
+    const store = opts.store;
+    const now = new Date(opts.now ? opts.now() : Date.now()).toISOString();
+    const stage = (s2, detail) => {
+      try {
+        opts.onStage?.(s2, detail);
+      } catch {
+      }
+    };
+    const r = await checkMobileUpdate(opts);
+    const from6 = r.currentVersion;
+    const to = r.artifact?.identity || r.targetIdentity || from6;
+    const steps = [];
+    const finish = async (o) => {
+      const out = { ...o, durationMs: Date.now() - started, steps };
+      const hist = [{ at: now, from: out.from, to: out.to, stage: out.stage, reason: out.reason }];
+      const st = await readMobileUpdateState(store);
+      await writeMobileUpdateState({
+        lastUpdate: hist[0],
+        history: [...hist, ...st.history || []].slice(0, 20),
+        lastFailure: out.ok ? null : { at: now, stage: out.failedAt || out.stage, reason: out.reason },
+        needsReload: out.ok ? true : st.needsReload,
+        ...out.ok ? {
+          currentVersion: out.to,
+          installedChannel: r.artifact?.channel || "stable",
+          installedDevSha: devShaFromIdentity(out.to),
+          installedFrom: {
+            channel: r.artifact?.channel || "stable",
+            source: r.artifact?.source || "unknown",
+            url: r.artifact?.url || null,
+            digest: out.digest,
+            digestAlgo: out.digest ? out.digest.split(":")[0] : null,
+            at: now
+          },
+          switchableTo: r.artifact?.channel === "dev" ? { channel: "stable", source: "npm", target: r.sourceFacts?.npm?.latest ?? null } : { channel: "dev", source: "github", target: r.github?.headSha ? r.github.headSha.slice(0, 7) : null },
+          // 从 dev 切回 stable 时, **保留**刚离开的那个 dev 快照 sha: 用户回头想回 dev 时知道上次是哪个
+          ...r.artifact?.channel === "dev" ? { lastDevSha: devShaFromIdentity(out.to), devRef: DEV_REF, devCheckedAt: now } : { lastDevSha: r.installedDevSha || null },
+          autoPrepared: null
+        } : {}
+      }, store);
+      return out;
+    };
+    if (refused(r.status)) {
+      stage("blocked", `\u62D2\u7EDD\u66F4\u65B0 (${r.status})`);
+      return finish({ ok: false, stage: "blocked", status: r.status, from: from6, to, reason: `\u62D2\u7EDD\u66F4\u65B0 (${r.status}): ${r.reason || "\u6E90\u4E0D\u53EF\u8FBE / \u7248\u672C\u4E0D\u5B58\u5728"} \u2014 \u4E00\u4E2A\u5B57\u8282\u90FD\u6CA1\u4E0B\u8F7D, \u4E5F\u6CA1\u52A8 current`, digest: null, probe: null, needsReload: false });
+    }
+    if (!r.artifact) {
+      stage("blocked", "\u6CA1\u6709\u53EF\u6267\u884C\u7684\u66F4\u65B0");
+      return finish({ ok: false, stage: "blocked", status: r.status, from: from6, to, reason: r.status === "up_to_date" ? `\u5DF2\u662F\u6700\u65B0 (${from6})` : `\u6CA1\u6709\u53EF\u6267\u884C\u7684\u66F4\u65B0 (${r.status})`, digest: null, probe: null, needsReload: false });
+    }
+    if (!opts.confirm) {
+      stage("blocked", "\u9700\u8981\u4EBA\u5DE5\u786E\u8BA4");
+      return finish({
+        ok: false,
+        stage: "blocked",
+        status: "update_available",
+        from: from6,
+        to,
+        reason: "human_confirm_required: \u5207\u6362 web \u8D44\u6E90\u5C42\u4F1A\u6362\u6389\u6B63\u5728\u8DD1\u7684\u754C\u9762\u4E0E\u903B\u8F91 \u2014 \u5FC5\u987B\u6709\u4EBA\u5728\u73AF (\u667A\u80FD\u4F53\u53EA\u80FD\u81EA\u52A8\u8DD1\u5230 prepare/verify)",
+        digest: null,
+        probe: null,
+        needsReload: false
+      });
+    }
+    let prep = null;
+    if (opts.reuseStaging) {
+      stage("verifying", "\u590D\u7528 staging \u91CC\u5DF2\u51C6\u5907\u5E76\u9A8C\u8BC1\u8FC7\u7684\u8D44\u6E90");
+      const probe = await verifyWebLayer(store, WEB_LAYOUT.staging, { bootTimeoutMs: opts.bootTimeoutMs });
+      if (probe.ok) {
+        const st = await readMobileUpdateState(store);
+        const identity5 = st.autoPrepared?.identity || to;
+        if (identity5 !== to) {
+          stage("blocked", `staging \u7684\u8EAB\u4EFD ${identity5} \u2260 \u76EE\u6807 ${to}`);
+          return finish({ ok: false, stage: "blocked", status: "web_bundle_malformed", from: from6, to, reason: `staging \u91CC\u51C6\u5907\u7684\u662F ${identity5}, \u4E0E\u672C\u6B21\u76EE\u6807 ${to} \u4E0D\u4E00\u81F4 \u2014 \u62D2\u7EDD\u5207\u6362 (\u5B81\u53EF\u4E0D\u88C5, \u4E0D\u88C5\u9519\u7684)`, digest: null, probe, needsReload: false });
+        }
+        prep = { ok: true, stage: "awaiting_human", status: "update_available", from: from6, to, reason: "\u590D\u7528 staging", steps: st.autoPrepared?.steps || [], fileCount: 0, digest: st.autoPrepared?.digest ?? null, probe, skippedDownload: true };
+        steps.push(...(prep.steps || []).map((s2) => `auto: ${s2}`));
+      }
+    }
+    if (!prep) {
+      const p = await prepareMobileUpdate(opts, r);
+      if (!p.ok) {
+        return finish({ ok: false, stage: p.stage, failedAt: p.failedAt, status: p.status, from: from6, to, reason: p.reason, digest: p.digest, probe: p.probe, needsReload: false });
+      }
+      prep = p;
+      steps.push(...p.steps);
+    }
+    if (!nativeWired(opts)) {
+      stage("blocked", "\u539F\u751F\u58F3\u8FD8\u6CA1\u6307\u5411\u53EF\u5199\u76EE\u5F55 \u2192 \u4E0D\u5207\u6362");
+      steps.push(`native_shell_not_wired: \u8D44\u6E90\u5DF2\u51C6\u5907\u5E76\u9A8C\u8BC1\u8FC7 (${WEB_LAYOUT.staging}), \u4F46\u5F53\u524D\u539F\u751F\u58F3\u4E0D\u4F1A\u52A0\u8F7D\u53EF\u5199\u76EE\u5F55\u91CC\u7684\u8D44\u6E90 \u21D2 \u5207\u6362\u53EA\u4F1A\u628A"\u80FD\u7528\u7684\u65E7\u7248\u672C"\u6362\u6210"\u58F3\u5C42\u52A0\u8F7D\u4E0D\u5230\u7684\u65B0\u7248\u672C" \u2014 \u62D2\u7EDD\u5207\u6362`);
+      return finish({
+        ok: false,
+        stage: "blocked",
+        status: "native_shell_not_wired",
+        from: from6,
+        to,
+        reason: `native_shell_not_wired: \u624B\u673A App \u7684\u539F\u751F\u58F3\u8FD8\u6307\u5411\u5305\u5185\u8D44\u6E90 (\u6CA1\u6709\u6307\u5411\u53EF\u5199\u76EE\u5F55), \u6240\u4EE5\u8FD9\u6B21\u88C5\u5230 ${to} \u4E0D\u4F1A\u751F\u6548 \u2014 \u5DF2\u5728 ${WEB_LAYOUT.staging} \u51C6\u5907\u597D\u5E76\u901A\u8FC7\u542F\u52A8\u9A8C\u8BC1, \u4F46\u6CA1\u6709\u5207\u6362 current\u3002\u4FEE\u6CD5 (\u4E8C\u9009\u4E00, \u89C1 update-protocol \xA713.4): \u2460 \u628A\u58F3\u5C42 server.url \u6307\u5411\u672C\u673A http \u670D\u52A1\u7684\u53EF\u5199\u76EE\u5F55; \u2461 \u7B49\u539F\u751F\u5C42\u6539\u9020\u968F\u5546\u5E97/\u4FA7\u8F7D\u53D1\u4E00\u6B21\u3002` + NATIVE_CEILING_LINE,
+        digest: prep.digest,
+        probe: prep.probe,
+        needsReload: false
+      });
+    }
+    stage("switching", `\u539F\u5B50\u66FF\u6362: ${WEB_LAYOUT.current} \u2192 ${WEB_LAYOUT.previous}, ${WEB_LAYOUT.staging} \u2192 ${WEB_LAYOUT.current}`);
+    const hadCurrent = await store.exists(joinRel(WEB_LAYOUT.current, "mobile.html"));
+    let backupMade = false;
+    try {
+      const injectAt = opts.failSwitch === true ? "before_backup" : opts.failSwitch;
+      if (injectAt === "before_backup") throw Object.assign(new Error("\u6CE8\u5165\u7684\u5207\u6362\u5931\u8D25 (\u5728\u52A8 current \u4E4B\u524D)"), { injected: true });
+      await store.remove(WEB_LAYOUT.previous);
+      if (hadCurrent) {
+        await store.rename(WEB_LAYOUT.current, WEB_LAYOUT.previous);
+        backupMade = true;
+      }
+      if (injectAt === "after_backup") throw Object.assign(new Error("\u6CE8\u5165\u7684\u5207\u6362\u5931\u8D25 (\u5907\u4EFD\u5DF2\u505A, staging \u672A\u4E0A\u4F4D)"), { injected: true });
+      await store.rename(WEB_LAYOUT.staging, WEB_LAYOUT.current);
+      steps.push(`switching: ${WEB_LAYOUT.current} \u5DF2\u66FF\u6362 (\u65E7\u8D44\u6E90\u4FDD\u7559\u5728 ${WEB_LAYOUT.previous})`);
+    } catch (e) {
+      const reason = String(e?.message || e);
+      let rolled = false;
+      try {
+        await store.remove(WEB_LAYOUT.staging);
+        if (backupMade) {
+          await store.remove(WEB_LAYOUT.current);
+          await store.rename(WEB_LAYOUT.previous, WEB_LAYOUT.current);
+          rolled = true;
+        } else if (hadCurrent) {
+          rolled = false;
+        }
+        const probeAfter = rolled || hadCurrent ? await verifyWebLayer(store, WEB_LAYOUT.current, { bootTimeoutMs: opts.bootTimeoutMs }) : null;
+        steps.push(`rolled_back: ${rolled ? "\u5DF2\u628A previous \u642C\u56DE current" : "current \u672A\u88AB\u6539\u52A8"} \xB7 \u542F\u52A8\u9A8C\u8BC1 ${probeAfter ? probeAfter.ok ? "\u901A\u8FC7" : "\u672A\u901A\u8FC7" : "\u8DF3\u8FC7"}`);
+        stage(rolled ? "rolled_back" : "failed", `${reason}; ${rolled ? "\u5DF2\u56DE\u6EDA\u5230\u65E7\u8D44\u6E90" : "\u65E7\u8D44\u6E90\u672A\u88AB\u6539\u52A8"}`);
+        return finish({
+          ok: false,
+          stage: rolled ? "rolled_back" : "failed",
+          failedAt: "switching",
+          status: "update_available",
+          from: from6,
+          to,
+          reason: `${reason}; ${rolled ? `\u5DF2\u56DE\u6EDA\u5230 ${from6} (\u65E7\u8D44\u6E90\u56DE\u5230 current \u4E14\u9A8C\u8BC1${probeAfter?.ok ? "\u901A\u8FC7" : "\u672A\u901A\u8FC7"})` : "current \u672A\u88AB\u6539\u52A8, \u65E7\u8D44\u6E90\u4ECD\u5728"}`,
+          digest: prep.digest,
+          probe: probeAfter,
+          needsReload: false
+        });
+      } catch (e2) {
+        stage("failed", `${reason}; \u56DE\u6EDA\u8FC7\u7A0B\u51FA\u9519: ${e2?.message || e2}`);
+        return finish({
+          ok: false,
+          stage: "failed",
+          failedAt: "switching",
+          status: "update_available",
+          from: from6,
+          to,
+          reason: `${reason}; \u56DE\u6EDA\u8FC7\u7A0B\u51FA\u9519: ${e2?.message || e2}`,
+          digest: prep.digest,
+          probe: null,
+          needsReload: false
+        });
+      }
+    }
+    stage("verifying", "\u5207\u6362\u540E\u518D\u9A8C\u4E00\u6B21 (\u80FD\u4E0D\u80FD\u542F\u52A8)");
+    const after = await verifyWebLayer(store, WEB_LAYOUT.current, { bootTimeoutMs: opts.bootTimeoutMs });
+    steps.push(`post-switch verify: ${after.mode} \u2014 ${after.detail}`);
+    if (!after.ok) {
+      let rolled = false;
+      try {
+        await store.remove(WEB_LAYOUT.current);
+        if (backupMade) {
+          await store.rename(WEB_LAYOUT.previous, WEB_LAYOUT.current);
+          rolled = true;
+        }
+        stage("rolled_back", `\u5207\u6362\u540E\u9A8C\u8BC1\u5931\u8D25, ${rolled ? "\u5DF2\u56DE\u6EDA" : "\u6CA1\u6709\u53EF\u56DE\u6EDA\u7684\u65E7\u8D44\u6E90"}`);
+      } catch {
+      }
+      return finish({
+        ok: false,
+        stage: rolled ? "rolled_back" : "failed",
+        failedAt: "verifying",
+        status: "update_available",
+        from: from6,
+        to,
+        reason: `\u5207\u6362\u540E\u9A8C\u8BC1\u5931\u8D25: ${after.detail}; ${rolled ? `\u5DF2\u56DE\u6EDA\u5230 ${from6}` : "\u56DE\u6EDA\u5931\u8D25 \u2014 \u9700\u8981\u91CD\u88C5 App"}`,
+        digest: prep.digest,
+        probe: after,
+        needsReload: false
+      });
+    }
+    stage("succeeded", `\u5DF2\u5207\u5230 ${to}`);
+    return finish({ ok: true, stage: "succeeded", status: "update_available", from: from6, to, reason: `\u5DF2\u66F4\u65B0\u5230 ${to} (\u91CD\u542F/\u91CD\u8F7D webview \u540E\u751F\u6548)`, digest: prep.digest, probe: after, needsReload: true });
   }
-  function buildPhoneCard(view, opts) {
-    return {
-      title: "\u8BA9 Bolloon \u4EE3\u8868\u4F60\u8054\u7CFB\u5916\u90E8\u7684\u4EBA",
-      effective: view?.effective || opts.offline || "\u672A\u77E5",
-      contacts: (view?.contacts || []).map((c) => ({
-        displayValue: c.displayValue || "",
-        kind: c.kind || "",
-        state: c.status || c.verificationStatus || "",
-        label: c.capabilities?.includes("send") ? "\u53EF\u8054\u7CFB" : "\u4E0D\u53EF\u8054\u7CFB"
-      })),
-      approvals: (view?.approvals || []).map((a) => ({
-        consentId: a.consentId,
-        contactName: a.contactName,
-        channel: a.channel,
-        subject: a.subject,
-        bodyPreview: a.bodyPreview || "",
-        reason: a.reason,
-        reallySent: !!a.reallySent
-      })),
-      choices: [
-        { id: "task_once", label: "\u4EC5\u672C\u6B21\u4EFB\u52A1" },
-        { id: "persistent", label: "\u957F\u671F\u4F7F\u7528 (\u63A8\u8350)" },
-        { id: "full_contact_access", label: "\u5B8C\u5168\u6388\u6743\u8054\u7CFB\u65B9\u5F0F\u80FD\u529B" }
-      ],
-      willNotGet: ["\u8BFB\u53D6\u5168\u90E8\u90AE\u7BB1", "\u8BFB\u53D6\u901A\u8BAF\u5F55", "\u7FA4\u53D1\u6D88\u606F", "\u81EA\u52A8\u652F\u4ED8/\u8F6C\u8D26", "\u4EE3\u8868\u4F60\u7B7E\u7F72\u5408\u540C", "\u62FF\u5230\u624B\u673A\u53F7/\u90AE\u7BB1\u660E\u6587"],
-      deviceSigning: opts.deviceSigning
+  async function rollbackMobileUpdate(opts) {
+    const store = opts.store;
+    const started = Date.now();
+    const now = new Date(opts.now ? opts.now() : Date.now()).toISOString();
+    const st = await readMobileUpdateState(store);
+    const from6 = st.currentVersion || "unknown";
+    const steps = [];
+    const finish = async (o) => {
+      const out = { ...o, durationMs: Date.now() - started, steps };
+      await writeMobileUpdateState({
+        lastUpdate: { at: now, from: out.from, to: out.to, stage: out.stage, reason: out.reason },
+        history: [{ at: now, from: out.from, to: out.to, stage: out.stage, reason: out.reason }, ...st.history || []].slice(0, 20)
+      }, store);
+      return out;
     };
+    if (!opts.confirm) {
+      return finish({ ok: false, stage: "blocked", status: "update_available", from: from6, to: from6, reason: "human_confirm_required: \u56DE\u6EDA\u4F1A\u6362\u6389\u6B63\u5728\u8DD1\u7684 web \u8D44\u6E90 \u2014 \u5FC5\u987B\u6709\u4EBA\u5728\u73AF", digest: null, probe: null, needsReload: false });
+    }
+    if (!await store.exists(joinRel(WEB_LAYOUT.previous, "mobile.html"))) {
+      return finish({ ok: false, stage: "blocked", status: "web_bundle_malformed", from: from6, to: from6, reason: `\u6CA1\u6709\u53EF\u56DE\u6EDA\u7684\u65E7\u8D44\u6E90 (${WEB_LAYOUT.previous} \u7A7A) \u2014 \u4E0D\u5047\u88C5\u56DE\u6EDA\u8FC7`, digest: null, probe: null, needsReload: false });
+    }
+    const probeBefore = await verifyWebLayer(store, WEB_LAYOUT.previous, { bootTimeoutMs: opts.bootTimeoutMs });
+    steps.push(`previous \u63A2\u6D4B: ${probeBefore.detail}`);
+    if (!probeBefore.ok) {
+      return finish({ ok: false, stage: "blocked", status: "web_bundle_malformed", from: from6, to: from6, reason: `previous \u91CC\u7684\u65E7\u8D44\u6E90\u8D77\u4E0D\u6765 (${probeBefore.detail}) \u2014 \u56DE\u6EDA\u5B83\u53EA\u4F1A\u66F4\u7CDF, \u62D2\u7EDD`, digest: null, probe: probeBefore, needsReload: false });
+    }
+    try {
+      await store.remove(joinRel(WEB_LAYOUT.current, ""));
+      await store.rename(WEB_LAYOUT.previous, WEB_LAYOUT.current);
+    } catch (e) {
+      return finish({ ok: false, stage: "failed", failedAt: "switching", status: "update_available", from: from6, to: from6, reason: `\u56DE\u6EDA\u5931\u8D25: ${e?.message || e}`, digest: null, probe: null, needsReload: false });
+    }
+    const after = await verifyWebLayer(store, WEB_LAYOUT.current, { bootTimeoutMs: opts.bootTimeoutMs });
+    steps.push(`\u56DE\u6EDA\u540E\u63A2\u6D4B: ${after.detail}`);
+    return finish({
+      ok: after.ok,
+      stage: after.ok ? "rolled_back" : "failed",
+      status: "update_available",
+      from: from6,
+      to: from6,
+      reason: after.ok ? `\u5DF2\u56DE\u6EDA\u5230\u4E0A\u4E00\u4E2A\u8D44\u6E90\u5C42 (\u9700\u8981\u91CD\u8F7D webview \u751F\u6548)` : `\u56DE\u6EDA\u540E\u8D44\u6E90\u8D77\u4E0D\u6765: ${after.detail}`,
+      digest: null,
+      probe: after,
+      needsReload: after.ok
+    });
+  }
+  var MOBILE_UPDATE_AGENT_CONTRACT = {
+    schema: "bolloon-mobile-agent-update/1",
+    /** 可以自动做 (只读 + 只在 staging 里写, 不影响正在跑的资源) */
+    autoAllowedSteps: ["check", "prepare", "download", "digest-verify", "extract", "stage", "verify"],
+    /** 必须人在环 (会换掉正在跑的界面与逻辑 ⇒ 代价不对称) */
+    humanRequiredSteps: ["switch", "reload", "rollback", "channel-switch"],
+    preconditions: [
+      "\u672C\u673A web \u5C42\u7684\u8EAB\u4EFD\u53EF\u8BFB (\u58F3\u5C42\u6CE8\u5165 / OTA state / \u6784\u5EFA\u6233 bolloon-web.json \u4E09\u8005\u4E4B\u4E00) \u2014\u2014 \u8BFB\u4E0D\u5230\u5C31 local_version_unknown, \u4E0D\u731C",
+      "\u539F\u751F\u58F3\u5DF2\u6307\u5411\u53EF\u5199\u76EE\u5F55 (native_writable) \u2014\u2014 \u5426\u5219\u8D44\u6E90\u51C6\u5907\u597D\u4E86\u4E5F\u4E0D\u4F1A\u751F\u6548, \u4E00\u5F8B native_shell_not_wired \u5E76\u8BF4\u6E05\u4FEE\u6CD5",
+      "\u8BBE\u5907\u5B58\u50A8\u4F59\u91CF\u591F (\u4E0B\u8F7D\u7269 \u2264 \u4E0A\u9650, \u9ED8\u8BA4 80 MiB) \u2014\u2014 \u8D85\u4E86\u5224 payload_too_large, \u4E0D\u8D4C\u5185\u5B58",
+      "\u672C\u673A WebView \u6709 DecompressionStream('gzip') (iOS 16.4+ / Chrome 80+) \u2014\u2014 \u6CA1\u6709\u5C31 decompress_unavailable",
+      '\u7A33\u5B9A\u7F51\u7EDC: \u6E90\u4E0D\u53EF\u8FBE\u4E00\u5F8B offline / registry_unavailable / github_unavailable(reason) \u62D2\u7EDD, \u4E0D\u9759\u9ED8\u91CD\u8BD5\u5230"\u770B\u8D77\u6765\u6210\u529F"',
+      "\u6458\u8981\u53EF\u6821\u9A8C: npm \u4FA7\u7528 dist.shasum/dist.integrity; dev \u4FA7\u7528\u5305\u5185 .bolloon-dev-snapshot.json \u7684 sha + bundleSha256"
+    ],
+    riskBoundaries: [
+      'iOS \u539F\u751F\u58F3\u5C42**\u4E0D\u80FD\u81EA\u66F4** (App Store \u89C4\u5219) \u21D2 \u4E0D\u627F\u8BFA"iOS \u6574\u4F53\u81EA\u52A8\u66F4\u65B0"; web \u5C42\u80FD\u66F4, \u4E8C\u8FDB\u5236\u8D70\u5546\u5E97/TestFlight',
+      "Android \u4FA7\u8F7D APK \u81EA\u66F4**\u9700\u7528\u6237\u5141\u8BB8\u672A\u77E5\u6765\u6E90** \u21D2 \u5FC5\u987B\u663E\u5F0F\u544A\u77E5 + \u7528\u6237\u5728\u73AF, \u672C\u8F6E\u4E0D\u505A\u9759\u9ED8\u88C5\u5305",
+      '\u5207\u6362\u524D\u5FC5\u987B\u771F\u8DD1\u4E00\u6B21"\u80FD\u4E0D\u80FD\u542F\u52A8"\u63A2\u6D4B (\u7ED3\u6784+\u8BED\u6CD5+iframe), \u63A2\u6D4B\u4E0D\u901A\u8FC7\u4E0D\u8BB8\u5207\u8FDB current',
+      '\u5207\u6362\u5FC5\u987B\u539F\u5B50 (rename) \u4E14\u4FDD\u7559 previous; \u4EFB\u4F55\u4E00\u6B65\u5931\u8D25\u90FD\u8981\u56DE\u5230"\u80FD\u542F\u52A8\u7684\u65E7\u8D44\u6E90"',
+      "dev \u901A\u9053\u4E0D\u4FDD\u8BC1\u53EF\u56DE\u6EDA\u5230\u4E0A\u4E00\u4E2A dev \u7248 (\u4E0E\u684C\u9762\u540C\u4E00\u53E5\u8B66\u544A); \u4E00\u952E\u56DE stable \u59CB\u7EC8\u53EF\u7528",
+      "\u6E90\u4E0D\u53EF\u8FBE/\u7248\u672C\u4E0D\u5B58\u5728/\u4EA4\u53C9\u6821\u9A8C\u4E0D\u4E00\u81F4/\u6458\u8981\u4E0D\u7B26 \u21D2 \u62D2\u7EDD\u5E76\u5206\u7C7B\u8BF4\u6E05, \u7EDD\u4E0D\u9759\u9ED8\u88C5\u56DE\u65E7\u7248\u3001\u7EDD\u4E0D\u5047\u88C5\u6210\u529F"
+    ]
+  };
+  async function autoPrepareMobileUpdate(deps) {
+    return prepareMobileUpdate(deps);
+  }
+  function renderMobileUpdateReport(r, st) {
+    const L2 = [];
+    L2.push(r.identityLine);
+    L2.push(`\u66F4\u65B0\u5C42:     web \u8D44\u6E90\u5C42 (\u754C\u9762\u4E0E\u903B\u8F91: \u5165\u7FA4 / \u53D1\u4EFB\u52A1\u516C\u544A / \u770B\u98DE\u8F6E\u8FDB\u5EA6 / \u6388\u6743\u7B7E\u540D) \xB7 store=${r.storeKind}`);
+    L2.push(`\u80FD\u5207\u56DE:     ${r.switchableTo ? `${r.switchableTo.channel} (${r.switchableTo.source}${r.switchableTo.target ? ` @ ${r.switchableTo.target}` : ""})` : "\u65E0 (\u672A\u77E5\u6765\u6E90)"}`);
+    L2.push(`\u76EE\u6807\u7248\u672C:   ${r.targetIdentity || r.latestVersion || "\u672A\u77E5"}`);
+    L2.push(`\u66F4\u65B0\u901A\u9053:   ${r.channel} (\u6BD4\u8F83\u8BED\u4E49: ${r.channelKind})`);
+    L2.push(renderGithubReportLine(r.github));
+    if (r.crossCheck) L2.push(`\u4EA4\u53C9\u6821\u9A8C:   ${r.crossCheck.kind}${r.crossCheck.blocking ? " (\u963B\u585E)" : ""} \u2014 ${r.crossCheck.detail}`);
+    if (r.dev) L2.push(`dev \u5224\u5B9A:   ${r.dev.detail}`);
+    if (r.sourceFacts?.npm) L2.push(`npm \u6E90:     ${r.sourceFacts.npm.reachable ? `\u53EF\u8FBE (latest=${r.sourceFacts.npm.latest || "\u672A\u77E5"})` : `\u4E0D\u53EF\u8FBE (${r.sourceFacts.npm.detail || "\u672A\u77E5"})`}`);
+    if (st?.installedFrom) L2.push(`\u5F53\u524D\u6765\u6E90:   ${st.installedFrom.channel} \xB7 ${st.installedFrom.source}${st.installedFrom.digest ? ` \xB7 \u6458\u8981 ${st.installedFrom.digest}` : ""}${st.installedFrom.at ? ` \xB7 ${st.installedFrom.at}` : ""}`);
+    if (st?.lastDevSha && r.installedChannel !== "dev") L2.push(`\u4E0A\u6B21 dev:   commit ${st.lastDevSha} (\u5DF2\u5207\u56DE stable)`);
+    L2.push(`\u7ED3\u8BBA:       ${r.status}${refused(r.status) ? " \u2014 \u62D2\u7EDD (\u6CA1\u6709\u5B89\u88C5\u4EFB\u4F55\u4E1C\u897F)" : ""}`);
+    if (r.reason) L2.push(`\u8BF4\u660E:       ${r.reason}`);
+    for (const w2 of r.warnings) L2.push(w2);
+    return L2;
+  }
+  var NATIVE_CEILING_LINE = '\u539F\u751F\u58F3\u5C42\u4E0D\u80FD\u5728\u8FD9\u91CC\u81EA\u66F4: iOS \u53D7 App Store \u89C4\u5219\u9650\u5236 (\u4E8C\u8FDB\u5236\u8D70\u5546\u5E97/TestFlight), Android \u4FA7\u8F7D APK \u81EA\u66F4\u9700\u8981\u4F60\u5141\u8BB8"\u672A\u77E5\u6765\u6E90" \u2014\u2014 \u8FD9\u91CC\u80FD\u81EA\u52A8\u66F4\u65B0\u7684\u662F web \u8D44\u6E90\u5C42 (\u754C\u9762\u4E0E\u903B\u8F91)\u3002';
+  var MOBILE_CHANNEL_KEY = "bolloon.update.channel";
+  function createAutoWebStore() {
+    const injected = globalThis.__bolloonWebStore;
+    if (injected && typeof injected.writeBytes === "function" && typeof injected.rename === "function") return injected;
+    const cap = globalThis.Capacitor;
+    const fs = cap?.Plugins?.Filesystem;
+    if (fs && typeof fs.writeFile === "function") {
+      const base6 = globalThis.__bolloonWebBaseUrl || null;
+      return createCapacitorWebStore(fs, { basePath: "bolloon-web", directory: "DATA", baseUrl: base6 });
+    }
+    return createMemoryWebStore({ kind: "memory", rootLabel: "memory://webview", baseUrl: globalThis.__bolloonWebBaseUrl || null });
+  }
+  function storedMobileChannel() {
+    try {
+      const v = globalThis.localStorage?.getItem?.(MOBILE_CHANNEL_KEY);
+      return v ? String(v) : null;
+    } catch {
+      return null;
+    }
+  }
+  async function setMobileUpdateChannel(channel, store) {
+    const want = String(channel || "").toLowerCase();
+    if (want !== "stable" && want !== "dev") {
+      const cur = storedMobileChannel() || "stable";
+      return { ok: false, channel: cur, detail: `\u672A\u77E5\u901A\u9053 "${channel}" (\u53EA\u6709 stable / dev) \u2014 \u4FDD\u6301 ${cur}` };
+    }
+    const prev = storedMobileChannel();
+    try {
+      globalThis.localStorage?.setItem?.(MOBILE_CHANNEL_KEY, want);
+    } catch {
+    }
+    if (store) await writeMobileUpdateState({ channelPref: want }, store);
+    return { ok: true, channel: want, detail: `\u901A\u9053 ${prev || "stable"} \u2192 ${want} (\u53EA\u6539\u504F\u597D, \u8FD8\u6CA1\u6709\u5B89\u88C5\u4EFB\u4F55\u4E1C\u897F; \u70B9\u300C\u68C0\u67E5\u66F4\u65B0\u300D\u518D\u51B3\u5B9A\u88C5\u4E0D\u88C5)` };
+  }
+  async function reloadMobileWeb() {
+    const cap = globalThis.Capacitor;
+    try {
+      if (cap?.Plugins?.WebView?.reload) {
+        await cap.Plugins.WebView.reload();
+        return { ok: true, how: "capacitor-webview", detail: "\u5DF2\u8BF7\u6C42 WebView \u91CD\u8F7D (\u65B0 web \u8D44\u6E90\u751F\u6548)" };
+      }
+    } catch (e) {
+      return { ok: false, how: "capacitor-webview", detail: `WebView \u91CD\u8F7D\u5931\u8D25: ${String(e?.message || e)} \u2014 \u8BF7\u624B\u52A8\u91CD\u542F App` };
+    }
+    const loc = globalThis.location;
+    if (loc && typeof loc.reload === "function") {
+      loc.reload();
+      return { ok: true, how: "location.reload", detail: "\u5DF2\u91CD\u8F7D\u9875\u9762" };
+    }
+    return { ok: false, how: "none", detail: "\u672C\u73AF\u5883\u6CA1\u6709\u53EF\u91CD\u8F7D\u7684 WebView (\u9A8C\u6536/Node) \u2014 \u672A\u5047\u88C5\u91CD\u8F7D" };
   }
 
   // src/web/mobile-core.ts
+  var __webStore = null;
+  function currentWebStore() {
+    if (!__webStore) __webStore = createAutoWebStore();
+    return __webStore;
+  }
+  function injectedWebIdentity() {
+    const v = globalThis.__bolloonWebIdentity;
+    if (v && typeof v === "object" && typeof v.version === "string" && v.version) {
+      return { version: v.version, channel: v.channel === "dev" ? "dev" : v.channel === "stable" ? "stable" : void 0 };
+    }
+    return null;
+  }
+  function mobileUpdateDeps(opts = {}) {
+    return {
+      // 透传: 壳层/验收可以覆盖 registryBase / apiBase / devBundleUrl / devBundleSha256 / fetchImpl …
+      // (只有 store / 通道 / 身份 / 壳层判据由本层接管 —— 那几项是"设备说了算"的)
+      ...opts,
+      store: currentWebStore(),
+      channel: opts.channel || storedMobileChannel() || void 0,
+      localIdentity: opts.localIdentity !== void 0 ? opts.localIdentity : injectedWebIdentity(),
+      nativeWritable: opts.nativeWritable !== void 0 ? opts.nativeWritable : void 0,
+      onStage: opts.onStage
+    };
+  }
   var busHandlers = /* @__PURE__ */ new Set();
   function busBroadcast(msg) {
     for (const h3 of busHandlers) h3(msg);
@@ -164259,6 +166452,134 @@ ${b}
         return snap && Array.isArray(snap.skills) ? snap.skills : [];
       }
     },
+    /**
+     * 任务协作 (2026-09-25) — 手机与桌面/CLI 共用同一套存储与协议:
+     *   入群 (`task group …`) · 发公告 (`task publish/announce/post`) · 看飞轮进度 (goal-flywheel 冻结类型, 只读)
+     * 四个高风险动作 (入群/退群/建群/发公告/留痕) 一律**先签设备名再由桌面验签执行** —— 手机不自己执行、不记账。
+     * 桌面不可达 → 明确失败 (任务动作**不进离线队列**: 几小时后突然生效的批准比失败更危险)。
+     */
+    tasks: {
+      /** 本机能不能签 (老 WebView 没 Ed25519 → 高风险动作一律拒, 不降级) */
+      deviceSigning() {
+        return ed25519Available();
+      },
+      /** 桌面基址 (拿不到 → null, 不猜) */
+      async desktopBase() {
+        return core.contacts.desktopBase();
+      },
+      deps() {
+        return { storage: core.contacts.storage(), ownerDid: void 0, grantedBy: "leo" };
+      },
+      /** ① 群: 列本机已加入的群 (脱敏, 只给缩短 id/群名/时间) */
+      listGroups: () => listGroups(core.tasks.deps()),
+      /** ① 入群 (高风险: 展示待发内容 → 设备签名 → 桌面验签执行) */
+      joinGroup: (link) => joinGroup(link, core.tasks.deps()),
+      /** ① 退群 (高风险) */
+      leaveGroup: (ref) => leaveGroup(ref, core.tasks.deps()),
+      /** ① 建群 (高风险; 建完自动入群) */
+      createGroup: (name10) => createGroup(name10, core.tasks.deps()),
+      /** ② 看板 (只读; 与 CLI `task board` 同一份事实) */
+      loadBoard: () => loadBoard(core.tasks.deps()),
+      /** ② 发布公告 (高风险) */
+      publishAnnouncement: (input) => publishAnnouncement(input, core.tasks.deps()),
+      /** ② 把公告发进群 (高风险; 预览 → 确认 → 签名) */
+      announceIntoGroup: (input) => announceIntoGroup(input, core.tasks.deps()),
+      /** ② 过程留痕 (高风险: claim/deliver/screen/final) */
+      postTrail: (input) => postTrail(input, core.tasks.deps()),
+      /** ② 读群里的一期痕迹 (只读) */
+      loadTrail: (input) => loadTrail(input, core.tasks.deps()),
+      /** 预览群消息那一行 (由桌面同一个构造器生成) */
+      previewGroupMessage: (req) => previewGroupMessage(req, core.tasks.deps()),
+      /** ③ 飞轮进度 (只读消费 goal-flywheel 冻结类型; 投影在桌面做) */
+      loadFlywheel: () => loadFlywheel(core.tasks.deps()),
+      /** 确认页文案 (展示待发内容) */
+      describeConfirm: (kind, req) => describeTaskActionForConfirm(kind, req),
+      /** 直接执行一个已构造好的请求 (UI 的统一入口: 签名 → 桌面验签执行) */
+      execute: (req) => executeTaskAction(req, core.tasks.deps()),
+      /** 相对时间人话 (毫秒差 → 双语; 只用于写文字节点) */
+      relative: (ms2, lang) => formatRelative(ms2, lang === "en" ? "en" : "zh"),
+      /** id 缩短 (页面上不出现原文) */
+      shorten: (id, n) => shortId(id, n),
+      /** 公开文本红线 (UI 最后一道自检: 渲染前扫一遍, 命中就不显示原文) */
+      scanText: (text) => scanPublicText(String(text ?? "")),
+      /** 构造一个空请求 (UI 填字段用) */
+      emptyRequest: (kind) => emptyTaskActionRequest(kind),
+      /** 最近一条操作提示 */
+      hint() {
+        return getTaskHint(core.contacts.storage());
+      },
+      setHint(text) {
+        setTaskHint(text, core.contacts.storage());
+      }
+    },
+    /**
+     * web 资源层双源 OTA 更新 (2026-09-26, update-protocol §13) — 与桌面 `bolloon update` 同语义:
+     *   ① 身份: stable = npm dist-tag 权威 + GitHub Tag 交叉校验; dev = master `ref` + commit sha, 身份 `<版本>+dev.<sha7>`
+     *   ② 拒绝: 源不可达 / 版本不存在 / 交叉校验不一致 ⇒ **拒绝并说清分类**, 绝不静默装回旧版、绝不假装成功
+     *   ③ 可见: 当前装的是哪个源 / 哪个 sha / 能切回哪个源 (与桌面同措辞)
+     *   ④ 智能体: check/plan/download/verify 可程序调用; **switch / reload / rollback / 切通道必须人确认**
+     *
+     * 天花板 (不许承诺做不到的): iOS 原生壳层**不能自更** (App Store 规则) —— 自更的只是 web 资源层;
+     * 二进制要走商店 / TestFlight。Android 侧载 APK 可自更但要用户允许未知来源 (显式告知 + 人在环)。
+     */
+    update: {
+      /** 结论/阶段枚举与拒绝表 (给 UI 与智能体做判断, 不用猜字符串) */
+      vocabulary() {
+        return {
+          statuses: MOBILE_WEB_STATUSES.slice(),
+          refused: MOBILE_REFUSED_STATUSES.slice(),
+          requiredFiles: MOBILE_WEB_REQUIRED_FILES.slice(),
+          layout: { ...WEB_LAYOUT },
+          nativeCeiling: NATIVE_CEILING_LINE,
+          agentContract: MOBILE_UPDATE_AGENT_CONTRACT
+        };
+      },
+      /** 可写 web 资源目录接上没有 (真机: 原生壳要指向它才生效) */
+      nativeWired() {
+        return nativeWired(mobileUpdateDeps());
+      },
+      /** 当前 web 层的身份/来源/能切回谁 (读 state + 壳层注入的构建戳) */
+      async state() {
+        return readMobileUpdateState(currentWebStore());
+      },
+      async identity() {
+        return resolveLocalWebIdentity(mobileUpdateDeps());
+      },
+      /** 检查两源 (只读, 不下载任何东西) */
+      async check(opts = {}) {
+        return checkMobileUpdate(mobileUpdateDeps(opts));
+      },
+      /** 检查 + 说明 (报告行: 与桌面 `update --status` 同口径) */
+      async report(opts = {}) {
+        const r = await checkMobileUpdate(mobileUpdateDeps(opts));
+        const st = await readMobileUpdateState(currentWebStore());
+        return { result: r, lines: renderMobileUpdateReport(r, st) };
+      },
+      /** 下载 → 解压 → 落 staging → 验证可启动; **不切换** (智能体能自动跑到这一步) */
+      async prepare(opts = {}) {
+        return autoPrepareMobileUpdate(mobileUpdateDeps(opts));
+      },
+      /** 切换 (人在环: 必须 confirm) → 原子替换 + 失败回滚; 成功后提示重载 */
+      async apply(opts = {}) {
+        return applyMobileUpdate({ ...mobileUpdateDeps(opts), confirm: opts.confirm === true, reuseStaging: opts.reuseStaging === true });
+      },
+      /** 回滚到 previous (人在环) */
+      async rollback(opts = {}) {
+        return rollbackMobileUpdate({ ...mobileUpdateDeps(opts), confirm: opts.confirm === true });
+      },
+      /** 切换通道 (stable ↔ dev; 只写偏好, 不装东西) */
+      async setChannel(channel) {
+        return setMobileUpdateChannel(channel, currentWebStore());
+      },
+      /** 当前通道偏好 */
+      channel() {
+        return storedMobileChannel() || "stable";
+      },
+      /** 重载 web 层让新资源生效 (人在环) */
+      async reload() {
+        return reloadMobileWeb();
+      }
+    },
     message: {
       async send({ text, channelId }) {
         if (!text || !channelId) return { ok: false, error: "text \u548C channelId \u5FC5\u586B" };