diff --git a/app/config/architecture-inventory.json b/app/config/architecture-inventory.json
index d81168f..e725ad6 100644
--- a/app/config/architecture-inventory.json
+++ b/app/config/architecture-inventory.json
@@ -461,8 +461,8 @@
     },
     {
       "path": "frontend/index.html",
-      "bytes": 47131,
-      "lines": 646
+      "bytes": 47871,
+      "lines": 661
     },
     {
       "path": "backend/features/screener/catalog.py",
diff --git a/app/frontend/m/index.html b/app/frontend/m/index.html
index 8592acf..63c6916 100644
--- a/app/frontend/m/index.html
+++ b/app/frontend/m/index.html
@@ -36,6 +36,7 @@
     <nav id="m-tabbar" class="m-tabbar" aria-label="主导航" hidden></nav>
   </div>
   <script src="config/nav.config.js"></script>
+  <script src="../shared/api.js"></script>
   <script src="js/api.js"></script>
   <script src="js/session.js"></script>
   <script src="js/router.js"></script>
diff --git a/app/frontend/m/js/api.js b/app/frontend/m/js/api.js
index 75ea210..07237e2 100644
--- a/app/frontend/m/js/api.js
+++ b/app/frontend/m/js/api.js
@@ -1,41 +1,24 @@
 (function (global) {
   "use strict";
 
+  // 手机端 API 薄封装：唯一 fetch 出口收敛到 shared/api.js（XiaobaiAPI）。
+  // 本文件不再直接调用 fetch，仅负责把 CSRF Token 配置进共享出口并转发请求，
+  // 保持既有 MobileAPI.request(url[, method, body]) 调用面不变。
+
   let csrfToken = "";
 
   function setCsrfToken(token) {
     csrfToken = token || "";
-  }
-
-  function requestOptions(method, body) {
-    const normalized = String(method || "GET").toUpperCase();
-    const options = { method: normalized, headers: {} };
-    if (!["GET", "HEAD", "OPTIONS"].includes(normalized) && csrfToken) {
-      options.headers["X-CSRF-Token"] = csrfToken;
-    }
-    if (body !== null && body !== undefined) {
-      options.headers["Content-Type"] = "application/json";
-      options.body = JSON.stringify(body);
-    }
-    return options;
+    global.XiaobaiAPI.configure({
+      csrfToken: function () {
+        return csrfToken;
+      }
+    });
   }
 
   async function request(url, method, body) {
-    const response = await fetch(url, requestOptions(method, body));
-    let payload = {};
-    try {
-      payload = await response.json();
-    } catch (_error) {
-      payload = {};
-    }
-    if (!response.ok || payload.error) {
-      const error = new Error(payload.error || "请求失败");
-      error.status = response.status;
-      error.payload = payload;
-      throw error;
-    }
-    return payload;
+    return global.XiaobaiAPI.request(url, method, body);
   }
 
-  global.MobileAPI = { setCsrfToken, request };
+  global.MobileAPI = { setCsrfToken: setCsrfToken, request: request };
 })(window);