@chance722/dsh-inbox 0.1.0

package/lib/types/cli.d.ts

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+/**
+ * `dsh-inbox init` — the install that is not a paragraph of instructions.
+ *
+ * Installing this plugin by hand is three steps in three places, and the third
+ * is the one everybody forgets: the panel works as soon as the plugin is in the
+ * profile, but the *assistant* only sees `inbox_search` / `inbox_get` once the
+ * plugin is also in the session's **agent preset**. A README that says "now copy
+ * the standard preset into ~/.dsh/.agent-presets and append two lines" is a
+ * README that half its readers will skim past — so this does it.
+ *
+ * What it does, in order, and it is safe to run twice:
+ *   0. with `--create-profile`, create a missing profile first (off by default:
+ *      a typo in a profile name should say so, not conjure a profile)
+ *   1. `dsh plugin --profile <profile> add <package>` (pnpm is idempotent)
+ *   2. copy the shipped `standard` preset into `<DSH_HOME>/.agent-presets/<id>`
+ *      and append this plugin's row to its composition
+ *   3. point the user-level default preset at it (backing the settings file up
+ *      first, because that file is the user's, not ours)
+ *
+ * The copy is the user's to edit afterwards: re-running adds the row when it is
+ * missing, and otherwise leaves the file alone — the one exception being that
+ * row's package name, which is ours to keep pointing at the real package (see
+ * `PRESET_ROW_PATTERN`).
+ */
+/** What one pass over a preset composition had to do to our row. */
+export interface PresetRowOutcome {
+    /** The text to write back; identical to the input when nothing changed. */
+    body: string;
+    change: 'added' | 'unchanged' | 'renamed';
+    /** The package the row used to point at, when it was renamed. */
+    from?: string;
+}
+/**
+ * Make sure the composition carries our row — once, pointing at the real package.
+ *
+ * @param body - the preset's `agent.cordis.yml` text.
+ * @returns the text to write, and what had to happen.
+ */
+export declare function ensurePresetRow(body: string): PresetRowOutcome;
+export interface Options {
+    profile: string;
+    preset: string;
+    source: string;
+    defaultPreset: boolean;
+    /** Create the profile when it is missing, instead of refusing. */
+    createProfile: boolean;
+}
+export declare function parse(argv: readonly string[]): Options | undefined;

package/lib/types/client/card.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The conversation cards for `inbox_search` and `inbox_get`.
+ *
+ * Cards are derived from the raw tool-call block (the model-facing result), not
+ * from any host-side presentation intent — so what the reader sees is exactly
+ * what the model saw, with two local touches: URLs become links, and
+ * `[attachment:<id>]` markers become thumbnails fetched from the panel's own
+ * attachment route. The second one is deliberate: the picture is rendered here,
+ * on this machine, and never became part of the conversation.
+ */
+import React from 'react';
+import { type InboxRpcResult } from '../shared/panel-wire.js';
+/**
+ * `id: <uuid>` — how the tool results name a record.
+ *
+ * Exported because it is the whole of the "click a record and go look at it"
+ * feature on this side: the button is only as reliable as finding the id in the
+ * text the model was shown.
+ */
+export declare const RECORD_ID: RegExp;
+/** Every record id in one tool result, in the order they appear. */
+export declare function recordIdsIn(text: string): string[];
+/** The slice of the tool-call block a card needs. */
+interface CardBlock {
+    text?: unknown;
+    content?: unknown;
+    isError?: unknown;
+}
+/** Owner props this card uses; the rest of the share is not needed here. */
+export interface ToolCardProps {
+    toolName: string;
+    block: CardBlock;
+}
+/**
+ * The card both tools share: a titled, monospace-ish rendering of the result
+ * with links and thumbnails.
+ *
+ * @param props - the tool call identity and its settled block.
+ * @returns the card element.
+ */
+export declare function InboxToolCard({ toolName, block }: ToolCardProps): React.ReactElement;
+/** Register both cards on the keyed tool view slot. */
+export declare function registerToolCards(slots: {
+    inject: (name: string, run: () => unknown) => unknown;
+    register: (options: {
+        name: string;
+        key: string;
+    }, component: unknown) => unknown;
+}): void;
+/** The panel answers with this envelope; kept here for the shared shape. */
+export type PanelAnswer = InboxRpcResult<unknown>;
+export {};

package/lib/types/client/dock.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The vault's second home: a tab in the right dock, next to the conversation.
+ *
+ * A tab type is registered in two stages — the type itself into
+ * `ctx.sidebarRightTabs`, its body into the keyed `sidebar.right.pane.tab` seat
+ * under the same `id` — and opened by kind through `ctx.sidebarRight.openTab`.
+ * That is the documented third-party path (`ui-sidebar-documentpreview` is the
+ * shipped proof), not a private door.
+ *
+ * The dock is a *convenience*, not a source of truth: it fetches the newest
+ * records itself and shows them; every action still lives in the panel. It also
+ * has to survive compositions with no right dock at all (a headless profile has
+ * no browser), so `registerInboxDock` does nothing when the services are absent.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Type discriminator: what `openTab` names. */
+export declare const DOCK_KIND = "inbox-vault";
+/** Also the tab-type id and the key its body registers under. */
+export declare const DOCK_TAB_ID = "@chance722/dsh-inbox";
+/**
+ * A caller that can reveal the tab — optionally focused on one record.
+ *
+ * It cannot be used from the inbox panel: the dock belongs to the *session*
+ * surface, and showing the panel unmounts that surface — calling `openTab` from
+ * there fails with `sidebarRight: no session surface is mounted` (measured).
+ * Whoever opens it has to be standing in a conversation — which is exactly where
+ * a conversation card is, so `card.tsx` is the caller that matters: click a
+ * record the assistant mentioned and the dock opens on it.
+ *
+ * @param id - the record to focus; omitted opens the tab on its usual list.
+ */
+export declare let openVaultDock: ((id?: string) => void) | undefined;
+/**
+ * Which record the tab was opened on, and how many times it has been navigated.
+ *
+ * Pulled out of the component so the reading can be tested: the shape is the
+ * platform's, not ours, and getting it wrong is silent — the dock falls back to
+ * its list and 「打开 ↗」 looks like it does nothing.
+ *
+ * @param info - whatever the tab-information hook answered, untyped on purpose.
+ * @returns the record id when the opener named one, plus the navigation revision.
+ */
+export declare function dockFocusOf(info: unknown): {
+    id?: string;
+    revision: number;
+};
+/**
+ * Register the tab type and its body.
+ *
+ * @param ctx - the browser plugin context.
+ */
+export declare function registerInboxDock(ctx: Context): void;

package/lib/types/client/heading.d.ts

@@ -0,0 +1,54 @@
+/**
+ * What a record is *called* on screen, in one place.
+ *
+ * Both surfaces that name a record — the panel's list and the conversation-side
+ * dock — have to obey the same red line (`AGENTS.md` 3: 账密类列表脱敏), and two
+ * copies of that rule are two chances to leak: the dock printed a credential's
+ * `preview`, which is the first line of the secret itself.
+ *
+ * It is also the only place that decides what a record with *no* name of its own
+ * is called: an uploaded photo used to render as 「（无标题）」 even though the
+ * file name had been stored all along (`attachmentName`).
+ *
+ * Presentation only, and browser-side only: it reads `EntrySummary` and returns
+ * strings. Nothing here may import a host module.
+ */
+import type { EntrySummary } from '../shared/panel-wire.js';
+/**
+ * How much of a credential's description rides along in its heading.
+ *
+ * The heading is ellipsised by CSS on top of this; the cap is what keeps a
+ * 300-character note out of the title slot at all, so the line still reads as a
+ * name rather than as a paragraph.
+ */
+export declare const NOTE_IN_HEADING_CHARS = 24;
+/** True when this record's own text must never be printed outside the detail. */
+export declare function isSecret(entry: EntrySummary): boolean;
+/**
+ * The one-line heading a card or a dock row shows.
+ *
+ * The row is the **name**, and only the name: the category glyph beside it
+ * already says what kind of thing this is, so a 「密钥 / 账密（…）」 prefix only ate
+ * the width a name needs. What the name came from, in order: the user's own
+ * word, then the record's own (address, text, file name), then the note.
+ *
+ * The same shape covers a picture or a file, which has no text to be named by:
+ * its file name takes the name slot. A name the user typed into the detail pane
+ * outranks everything.
+ *
+ * @param entry - the record to name.
+ * @returns the heading, clamped to one short line.
+ */
+export declare function headingOf(entry: EntrySummary): string;
+/**
+ * The same heading, plus the note the row no longer shows, for the hover
+ * tooltip.
+ *
+ * The card only ever shows one ellipsised line, so the full text has to be
+ * reachable somewhere short of opening the detail pane — and since the note
+ * left the row itself, the tooltip is where it lives now.
+ *
+ * @param entry - the record to name.
+ * @returns the heading, with the whole note in the parentheses.
+ */
+export declare function headingTooltipOf(entry: EntrySummary): string;

package/lib/types/client/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The browser half: the sidebar entry, the capture box, the filter bar, the
+ * list, and the detail pane.
+ *
+ * Everything the vault knows lives on the host side; this half only renders and
+ * calls the Fetch routes declared in `src/shared/panel-wire.ts`.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Stable Cordis plugin name for the browser half. */
+export declare const name = "dsh-inbox-client";
+/**
+ * `slots` is a hard dependency: without it Cordis runs `apply` before the slot
+ * registry exists and every registration is silently skipped (M0's trap).
+ */
+export declare const inject: string[];
+/**
+ * Register the sidebar switch and the panel it selects.
+ *
+ * Both slots belong to other packages, so each registration waits for the
+ * declaration through `slots.inject` instead of assuming an order.
+ *
+ * @param ctx - browser plugin context carrying the slot registry.
+ */
+export declare function apply(ctx: Context): void;

package/lib/types/client/manual.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The three-minute manual.
+ *
+ * The panel has grown features faster than it has grown explanations — sync,
+ * encryption, naming, the conversation tools — and a user who has to ask "what
+ * does this button do" in chat has already lost. This is the answer that lives
+ * in the product: one screen, scenarios in the order a person meets them, three
+ * lines each at most.
+ *
+ * Deliberately not a reference manual: the help docs are that. This is the part
+ * you read once.
+ */
+import React from 'react';
+/**
+ * The manual, as a dialog.
+ *
+ * @param props - how to close it.
+ * @returns the dialog.
+ */
+export declare function ManualDialog({ onClose }: {
+    onClose: () => void;
+}): React.ReactElement;

package/lib/types/client/scheme.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Which colour scheme the app around this panel is drawn in.
+ *
+ * The panel lives inside someone else's UI and may not assume either theme. It
+ * used to declare `color-scheme: dark` outright — which was a fix for one bug
+ * (a native `<select>` drawn light while the app was dark, so its options were
+ * white on white) and the cause of three worse ones: in a *light* app, `Canvas`
+ * resolves to near-black, so a dialog whose text colour is inherited from the
+ * app became dark-on-dark — the settings sheet that "showed nothing".
+ *
+ * Two ways to find out, in this order:
+ *
+ * 1. **Ask the app.** `color-scheme` is a real CSS property, it inherits, and
+ *    dsh declares it on `document.documentElement` (`<html>`), keeping its token
+ *    variables on `body` — measured 2026-09-20 against the running web app, see
+ *    `docs/help/panel-theme.md`. That declaration is the app's own answer, so it
+ *    beats any guess we could make.
+ * 2. **Read the light.** An app may declare nothing, or declare
+ *    `color-scheme: light dark` to mean "whatever the OS says"; neither says
+ *    which one is on now. The colour the app hands down to our container does: a
+ *    dark app gives light text.
+ *
+ * We deliberately do *not* read our own panel root's `color-scheme`: we set that
+ * property ourselves, so it would only echo our own last guess back at us.
+ */
+/**
+ * The scheme a text colour implies.
+ *
+ * @param cssColor - a computed colour, e.g. `rgb(230, 232, 234)`.
+ * @returns `dark` for light text (a dark app), `light` for dark text.
+ */
+export declare function schemeOfColor(cssColor: string): 'light' | 'dark';
+/**
+ * Decide from both signals, the app's own declaration winning.
+ *
+ * @param declared - the computed `color-scheme` of the document element.
+ * @param inheritedTextColor - the computed text colour our container inherits.
+ * @returns the scheme the panel should declare.
+ */
+export declare function schemeFrom(declared: string, inheritedTextColor: string): 'light' | 'dark';
+/**
+ * Read the scheme off the document element, falling back to inherited text.
+ *
+ * @param element - the panel's own root, whose inherited text colour is read.
+ * @returns the scheme to declare, so native controls match the app.
+ */
+export declare function schemeOf(element: Element | null): 'light' | 'dark';

package/lib/types/host/capture.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Capture rules: what a pasted thing is, how to spot a repeat, and how to file
+ * it. Everything here is deterministic; classification proper (which category a
+ * link or an image belongs to) is M5's job.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { Source } from '../shared/vocabulary.js';
+import { platformOf, type Classification } from './classify/rules.js';
+import type { Attachment, Item } from './vault/spec.js';
+import type { Vault } from './vault/vault.js';
+/**
+ * Decide what a pasted string is.
+ *
+ * A single bare `http(s)` URL is a link; anything else is text. A sentence that
+ * merely contains a URL stays text: the vault must not reinterpret prose.
+ *
+ * @param raw - exactly what was pasted.
+ * @returns the kind, plus url and (when recognised) platform for links.
+ */
+export declare function sniff(raw: string): {
+    kind: 'link' | 'text';
+    url?: string;
+    platform?: string;
+};
+/**
+ * Normalise a link for repeat detection: drop the fragment and the parameters
+ * that only record where a share came from, and unify the host case.
+ *
+ * Deliberately conservative — real identity lives in paths (`/s/<id>`,
+ * `/video/BV…`) and in the parameters we keep.
+ */
+export declare function normalizeLink(raw: string): string;
+/** The outcome of a capture: what was stored, and whether it merged. */
+export interface CaptureOutcome {
+    item: Item;
+    /** True when an existing record absorbed this capture. */
+    merged: boolean;
+    /**
+     * True when the record it absorbed into was sitting in the recycle bin and
+     * has just been taken back out (see `absorb`).
+     */
+    restored: boolean;
+    /** What the rules concluded, so a caller can decide whether to ask a model. */
+    verdict: Classification;
+}
+/**
+ * File a pasted string.
+ *
+ * Repeats merge into the existing record: the vault answers "what have I
+ * stored", not "how many times did I paste".
+ *
+ * @param vault - the open vault.
+ * @param raw - the pasted string.
+ * @param source - which entry point produced it.
+ * @param note - optional description the user supplied.
+ * @returns the stored (or merged) record, and whether it merged.
+ */
+export declare function captureText(vault: Vault, raw: string, source: Source, note?: string): Promise<CaptureOutcome>;
+/** Re-exported so callers do not reach into the rules module for this. */
+export { platformOf };
+/**
+ * Attachment reference as it arrives from the composer's durable blocks.
+ * `id` is the *store's* id, not ours.
+ */
+export type CapturedAttachment = Pick<Attachment, 'mime' | 'bytes'> & {
+    id: string;
+} & Partial<Pick<Attachment, 'filename' | 'width' | 'height' | 'sha256'>>;
+/**
+ * File one durable attachment the composer handed over.
+ *
+ * The bytes stay in dsh's own attachment store (content-addressed, never
+ * auto-deleted); the vault keeps the reference plus what we can show without
+ * reading the bytes back.
+ *
+ * @param vault - the open vault.
+ * @param attachment - the block's attachment reference.
+ * @param source - which entry point produced it.
+ * @param note - optional description the user supplied.
+ * @returns the stored (or merged) record, and whether it merged.
+ */
+export declare function captureImage(vault: Vault, attachment: CapturedAttachment, source: Source, note?: string): Promise<CaptureOutcome>;
+/** What one capture submission carried: free text and/or durable attachments. */
+export interface CapturePayload {
+    text?: string;
+    attachments?: readonly CapturedAttachment[];
+}
+/** Roll-up of one capture submission. */
+export interface CaptureSummary {
+    stored: number;
+    /** Records that absorbed this capture. */
+    merged: number;
+    /**
+     * Of those, the ones that were in the recycle bin and came back out.
+     *
+     * Counted separately because it is the difference between "you already had
+     * this" and "you had deleted this, so I put it back" — the panel says the
+     * second one in its own words.
+     */
+    restored: number;
+}
+/** What a caller may want to do once something is safely stored. */
+export interface CaptureOptions {
+    /** When present, records no rule could judge are handed to the model. */
+    ctx?: Context;
+}
+/**
+ * File one submission from any entry point.
+ *
+ * Order is attachments first, then text, so a note that arrived with the
+ * submission can still be attached to the item it belongs to.
+ *
+ * @param vault - the open vault.
+ * @param payload - the submitted text and attachments.
+ * @param source - which entry point produced them.
+ * @returns how many records were stored and how many merged.
+ */
+export declare function capture(vault: Vault, payload: CapturePayload, source: Source, options?: CaptureOptions): Promise<CaptureSummary>;

package/lib/types/host/classify/model.d.ts

@@ -0,0 +1,112 @@
+/**
+ * The model fallback: one small call, only when a rule could not decide, always
+ * redacted, always capped.
+ *
+ * Three things this file refuses to do:
+ *   - it never sends an image (the only way to judge an ID document from a
+ *     picture is the picture, and that is exactly what must not leave);
+ *   - it never sends credential text (`redact()` runs first, and a record whose
+ *     rule verdict is already `secret` is never asked about at all);
+ *   - it never overrides the user, or a rule that already decided.
+ *
+ * Spending is capped per local day and persisted in the vault's global slot, so
+ * a restart cannot reset the meter.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { type Category } from '../../shared/vocabulary.js';
+import type { Item } from '../vault/spec.js';
+import type { Vault } from '../vault/vault.js';
+import type { Classification } from './rules.js';
+/** Provider route registered by the shipped DeepSeek adapter. */
+export declare const PROVIDER = "deepseek-official";
+/** The cheap model this vault classifies with. */
+export declare const MODEL = "deepseek-flash";
+/** How much the fallback may spend, and how fast. */
+export interface ModelBudget {
+    /** Calls per local day. */
+    maxCallsPerDay: number;
+    /** Prompt + completion tokens per local day. */
+    maxTokensPerDay: number;
+    /**
+     * Output ceiling for one call. A category word needs almost nothing, but this
+     * model spends tokens thinking first — 64 was enough to get cut off before it
+     * ever answered, so the ceiling has to fit the reasoning too.
+     */
+    maxTokensPerCall: number;
+}
+/**
+ * The thresholds, chosen so a bad day costs pocket change and a runaway loop
+ * cannot happen: 200 calls is far more than a person pastes in a day, and
+ * 100k tokens is a few 分 at flash prices.
+ */
+export declare const DEFAULT_BUDGET: ModelBudget;
+/** Today's spend, as persisted in the vault's global slot. */
+export interface ModelSpend {
+    /** `YYYY-MM-DD` in local time. */
+    day: string;
+    calls: number;
+    tokens: number;
+}
+/** Local calendar day, because the cap is a human's day, not a UTC one. */
+export declare function today(now?: Date): string;
+/** Fresh spend record for a new day. */
+export declare function freshSpend(now?: Date): ModelSpend;
+/** Roll the record over when the day changed. */
+export declare function rollSpend(spend: ModelSpend | undefined, now?: Date): ModelSpend;
+/**
+ * Whether one more call fits the budget.
+ *
+ * @param spend - the rolled-over spend record.
+ * @param budget - the configured caps.
+ * @returns true when a call may be made.
+ */
+export declare function withinBudget(spend: ModelSpend, budget?: ModelBudget): boolean;
+/** Record one finished call. */
+export declare function spendOf(spend: ModelSpend, tokens: number): ModelSpend;
+/**
+ * Whether a verdict is worth a model call.
+ *
+ * Only text and links are ever asked about, and only when no rule decided and
+ * there is enough content to be about something.
+ *
+ * @param verdict - what the rules concluded.
+ * @param item - the stored record.
+ * @param minimumChars - how short a paste is too trivial to classify. Eight,
+ *   because a Chinese note carries a sentence in that many characters ("下周三
+ *   之前把发票报销掉" is eleven) while "收到" is plainly not worth a call.
+ * @returns true when the fallback should run.
+ */
+export declare function shouldAskModel(verdict: Classification, item: Item, minimumChars?: number): boolean;
+/**
+ * Read one category out of whatever the model replied.
+ *
+ * @param answer - the model's text.
+ * @returns the category, or undefined when the reply names none of them.
+ */
+export declare function parseCategory(answer: string): Category | undefined;
+/** What one fallback attempt produced, for the caller to record or ignore. */
+export type FallbackOutcome = {
+    kind: 'applied';
+    category: Category;
+    tokens: number;
+} | {
+    kind: 'skipped';
+    reason: string;
+} | {
+    kind: 'failed';
+    reason: string;
+};
+/**
+ * Ask the model about one record and patch it when the answer is usable.
+ *
+ * Never throws: the caller scheduled this as a background pass, and a failed
+ * classification must leave the rule's verdict exactly as it was.
+ *
+ * @param ctx - host context carrying the model runtime.
+ * @param vault - the open vault.
+ * @param item - the record to classify.
+ * @param verdict - the rule verdict that said `unsure`.
+ * @param budget - caps for the day.
+ * @returns what happened, for logging and tests.
+ */
+export declare function classifyWithModel(ctx: Context, vault: Vault, item: Item, verdict: Classification, budget?: ModelBudget): Promise<FallbackOutcome>;

package/lib/types/host/classify/redact.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Masking for anything that would otherwise leave the machine.
+ *
+ * The vault's rule is that credential text never reaches a model. Classification
+ * only needs the *shape* of a message, so the shape is what we keep: labels stay
+ * readable, values become a placeholder of the same rough length.
+ *
+ * Pure and byte-free — no key store, no provider, no side effects.
+ */
+/**
+ * Replace credential values with a fixed-width placeholder.
+ *
+ * @param text - the text that might leave the machine.
+ * @returns the same text with values masked; labels survive.
+ */
+export declare function redact(text: string): string;
+/** Whether a redacted string still carries a recognisable credential shape. */
+export declare function looksRedacted(text: string): boolean;

package/lib/types/host/classify/rules.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The deterministic half of classification.
+ *
+ * Rules decide what they can prove — a platform's media type, a credential by
+ * shape, an ID document by aspect ratio — and say `unsure` about the rest
+ * instead of guessing. That word is the seam a model pass can use later without
+ * ever overriding something the *user* said.
+ *
+ * Nothing here reads bytes or calls anything: every input is text or numbers the
+ * vault already holds, so the whole layer is a pure function and cheap to run at
+ * paste time.
+ */
+import type { Category } from '../../shared/vocabulary.js';
+/** One rule's verdict. */
+export interface Classification {
+    category: Category;
+    /** Set when the rule recognised the host and can name it. */
+    platform?: string;
+    /** `unsure` means "a model could do better", never "this is wrong". */
+    confidence: 'decided' | 'unsure';
+    /** Which rule fired, in Chinese, for the record's tooltip and for debugging. */
+    reason: string;
+    /** Extra tags a rule wants to attach, e.g. a suspected ID document. */
+    tags?: readonly string[];
+}
+/** True when the text carries something that must never be echoed. */
+export declare function findSecret(text: string): string | undefined;
+/** The platform a URL belongs to, or undefined when it is just "somewhere". */
+export declare function platformOf(url: string): string | undefined;
+/**
+ * Classify a link by its host and path.
+ *
+ * @param url - the pasted URL.
+ * @returns the verdict; `unsure` for a host no rule knows.
+ */
+export declare function classifyLink(url: string): Classification;
+/**
+ * Classify a pasted string.
+ *
+ * @param text - exactly what was pasted.
+ * @returns a secret verdict, or `unsure` — plain text rarely proves its own kind.
+ */
+export declare function classifyText(text: string): Classification;
+/**
+ * Classify an image from the dimensions the store already recorded.
+ *
+ * A ratio is evidence, not proof, so a suspected ID document stays `image` and
+ * gains a tag: only the user can promote it to the `document` category, which is
+ * exactly what the product decision asks for. No bytes are read, and nothing is
+ * uploaded to decide this.
+ *
+ * @param dimensions - stored width/height, when known.
+ * @returns the verdict.
+ */
+export declare function classifyImage(dimensions: {
+    width?: number;
+    height?: number;
+}): Classification;

package/lib/types/host/command.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The `/inbox` command: file what the user just typed or attached, without
+ * turning it into a model message.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { Vault } from './vault/vault.js';
+/**
+ * Register `/inbox` against the interactive command surface.
+ *
+ * `recordInput: false` is load-bearing, not tidiness: by default a command's
+ * raw input is written to the session log, and the vault is exactly where
+ * credentials are supposed to go — the payload must live in the vault and
+ * nowhere else (see the credentials rule in AGENTS.md).
+ *
+ * @param ctx - host context; the commands service must be mounted.
+ * @param vault - reads the currently open vault, which may not be open yet.
+ */
+export declare function registerInboxCommand(ctx: Context, vault: () => Vault | undefined): void;