RFC: Contacts API

Source PR: #17 · docs/rfcs/contacts-api.md · @filvecchiato

Description

A product asks the host to let the user pick a contact. The host renders the picker itself, the user selects one person, and the product receives one opaque 32-byte handle — never the list, a name, or an account.

Motivation

Each user has a different alias and account per context, so the contact list is a private notebook no product can read, and users paste raw keys instead. Sending to a friend needs one recipient the user chose, not the address book.

Requirements

• One method, pick, taking no arguments; the host owns the overlay and draws it from its own chat contacts.
• Outcomes are Picked { handle }, Dismissed and NoContacts; a host with no picker answers Unsupported.
• No permission is requested — the user selecting a contact is the consent.
• The handle is stable per contact across every product and host, keyed on the user's entropy so it cannot be turned back into an account.
• The handle is resolvable, not usable: the core substitutes the account when it builds the transaction.
• Read-only, one contact per call, and hosts keep their own contact schema.

Tasks

• RFC document body
• Implementation — rust-core — written in #17, awaiting review
• Implementation — hosts
  • dotli
  • Desktop
  • iOS — bindings written in #17
  • Android
  • host-cli