@chance722/dsh-inbox 0.1.0

package/lib/types/host/crypto/secret-box.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The box a credential's text is kept in.
+ *
+ * Nothing here decides *when* to seal — that is the vault's job (`vault.ts`) —
+ * this module is only the arithmetic: derive a key from a password, seal a
+ * string, open it again, and say clearly when the envelope is not ours.
+ *
+ * Deliberate choices:
+ * - **scrypt**, not a plain hash: a master password is a person's password, and
+ *   the cost of guessing it has to be paid per attempt.
+ * - **AES-256-GCM**, not CBC: a credential whose bytes were altered should fail
+ *   to open, loudly, rather than decrypt into plausible garbage.
+ * - the envelope names its own version, so a later format can be read *and*
+ *   told apart from this one.
+ */
+/** Work factors, recorded beside the salt so a future change can still open old boxes. */
+export interface KdfParams {
+    n: number;
+    r: number;
+    p: number;
+}
+/**
+ * 2^15 · r8 · p1: ~100ms and ~33MB on the development machine — slow enough to
+ * be a speed bump for a guesser, fast enough that unlocking does not feel broken.
+ */
+export declare const DEFAULT_KDF: KdfParams;
+/** A fresh salt, one per master password. */
+export declare function newSalt(): Buffer;
+/**
+ * Derive the sealing key from a master password.
+ *
+ * The password is normalised first: the same characters typed on another
+ * keyboard (or pasted from a password manager) must derive the same key.
+ *
+ * @param password - what the user typed.
+ * @param salt - the salt stored beside the KDF parameters.
+ * @param kdf - the recorded work factors.
+ * @returns the 32-byte key.
+ */
+export declare function deriveKey(password: string, salt: Buffer, kdf?: KdfParams): Buffer;
+/**
+ * Seal one string.
+ *
+ * @param key - a key from {@link deriveKey}.
+ * @param plaintext - what must not be readable on disk.
+ * @returns the envelope to store: `v1:iv:tag:ciphertext`, all base64.
+ */
+export declare function seal(key: Buffer, plaintext: string): string;
+/**
+ * Open one envelope.
+ *
+ * Every way of failing — a wrong password, a truncated field, a tampered byte —
+ * comes back as `undefined`. Callers cannot tell them apart, and should not:
+ * the only useful question is "can this be read with the key I have".
+ *
+ * @param key - a key from {@link deriveKey}.
+ * @param envelope - what {@link seal} returned.
+ * @returns the plaintext, or undefined when this key cannot open it.
+ */
+export declare function open(key: Buffer, envelope: string): string | undefined;

package/lib/types/host/index.d.ts

@@ -0,0 +1,21 @@
+import type { Context } from '@deepseek-ai/cordis';
+/** Stable Cordis plugin name for the host half. */
+export declare const name = "dsh-inbox";
+/** Tool registry, command surface, and the storage domain form we persist through. */
+export declare const inject: string[];
+/**
+ * Claim the vault and publish the tools.
+ *
+ * Loading is asynchronous while `apply` is not, so the handle arrives later:
+ * every caller reads whatever is open at call time, and reports the failure
+ * instead of pretending the vault is empty when it is not.
+ *
+ * The claim goes through `./vault/lease.js` because dsh loads this plugin twice
+ * in one process (profile bundle + agent preset) while the storage domain
+ * allows a single open per name — the second instance used to fail with
+ * `domain 'dsh_inbox' is already open` and every tool it published answered
+ * 「仓库没有打开」. The first instance owns the vault; the rest borrow it.
+ *
+ * @param ctx - host plugin context carrying the tool registry and storage.
+ */
+export declare function apply(ctx: Context): void;

package/lib/types/host/link-title.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The headline behind a link, fetched from the page itself.
+ *
+ * A pasted article arrives as a URL, and a list of URLs is a list of things you
+ * cannot tell apart — while the page carries a headline that names it perfectly.
+ * Reading `<title>` costs **no model tokens**: it is one plain HTTP GET through
+ * the harness's own web seam (`ctx.web`), which pins public addresses, refuses
+ * private ones, follows only same-origin redirects, and caps both time and size.
+ * It runs after the record is stored, never in front of the paste.
+ *
+ * Three rules keep it honest:
+ * - it never writes `title`. That field is the user's own word, and the
+ *   credentials rule depends on it staying that way (`AGENTS.md` 3); the fetched
+ *   headline lives in `linkTitle` instead;
+ * - it writes nothing when the record already has a name, and nothing when the
+ *   user renamed it while the fetch was in flight;
+ * - it never turns a failure into a problem: a dead link, a slow host or a page
+ *   that is not HTML simply leaves the URL as the name, which is where this
+ *   started.
+ */
+import type { WebFetchResult } from '@deepseek-ai/dsh-web';
+import type { Vault } from './vault/vault.js';
+/** Ceiling on a stored headline. The card clamps far earlier (24 chars + …). */
+export declare const MAX_LINK_TITLE_CHARS = 200;
+/**
+ * The slice of `ctx.web` this module uses.
+ *
+ * Structural on purpose: the service belongs to `@deepseek-ai/dsh-web`, but this
+ * half only ever calls one method of it, and a profile without that seam should
+ * simply not get headlines rather than fail to load.
+ */
+export interface WebFetchSeam {
+    fetch(request: {
+        readonly url: string;
+    }, signal?: AbortSignal): Promise<WebFetchResult>;
+}
+/**
+ * Pull the `<title>` out of an HTML document.
+ *
+ * A regex over the raw text, not a parser: we want one string out of a page we
+ * are never going to render, and pulling an HTML parser into the host half for
+ * that would be a dependency bought for nothing.
+ *
+ * @param html - the decoded document.
+ * @returns the collapsed, decoded headline, or undefined when there is none.
+ */
+export declare function titleFromHtml(html: string): string | undefined;
+/**
+ * Fetch one link's headline and store it, if it is still worth storing.
+ *
+ * The record is re-read here rather than taken from the caller: a caller's copy
+ * is by definition the one from *before* the network, and a record that is
+ * already named (or already gone) must not cost a request at all.
+ *
+ * @param vault - the open vault.
+ * @param id - the record that was just filed.
+ * @param web - `ctx.web`, the harness's own web seam.
+ * @param log - where a miss is explained. Silent failure is undebuggable: the
+ *   user sees a URL where a headline should be and has nowhere to look. Only the
+ *   **host** is logged, never the whole URL — a link can carry a token in its
+ *   query string, and a log file is not the place for one.
+ * @returns the stored headline, or undefined when nothing was stored.
+ */
+export declare function fetchLinkTitle(vault: Vault, id: string, web: WebFetchSeam, log?: (message: string) => void): Promise<string | undefined>;

package/lib/types/host/remote/auto-push.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Pushing by itself, a few seconds after the user stops typing.
+ *
+ * The rule the user asked for: 入库后防抖自动推 — file something, and a moment
+ * later it is in the cloud, without anyone pressing anything. The debounce is
+ * what makes that bearable for the remote and for the user: pasting five things
+ * in a row is *one* push five seconds after the last one, not five pushes.
+ *
+ * Its failures are deliberately quiet. A background nicety must never turn a
+ * successful paste into an error toast, and the panel's 刷新 button reports the
+ * same push when the user presses it — so a broken remote is still visible the
+ * moment anyone looks.
+ */
+import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
+import type { Context } from '@deepseek-ai/cordis';
+import type { Vault } from '../vault/vault.js';
+/** How long the vault stays quiet before it pushes. */
+export declare const AUTO_PUSH_DELAY_MS = 5000;
+/** The real push, injectable so the debounce can be tested without a server. */
+export type PushNow = () => Promise<unknown>;
+/**
+ * Queue a push for a moment from now, replacing any push already queued.
+ *
+ * @param run - what to run; the real one is {@link makeAutoPush}.
+ */
+export declare function scheduleAutoPush(run: PushNow): void;
+/** Forget a queued push; used by tests and by a clean shutdown. */
+export declare function cancelAutoPush(): void;
+/**
+ * The push the debouncer runs, wired to a real vault.
+ *
+ * @param ctx - host context carrying settings and credentials.
+ * @param vault - the open vault.
+ * @param attachments - where attachment bytes live.
+ * @returns a function that pushes once.
+ */
+export declare function makeAutoPush(ctx: Context, vault: () => Vault | undefined, attachments: () => AttachmentStore | undefined): PushNow;

package/lib/types/host/remote/merge.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Bringing other devices' records into this one.
+ *
+ * The rules are the user's (2026-09-20): a conflict is settled by `updatedAt` —
+ * **newer wins, no conflict copies** — deletes travel as tombstones, and what
+ * the push wrote is the source of truth, not the `.txt` beside it (a rendered
+ * view has no fields to compare).
+ *
+ * The objects under `sync/` are ours, which is exactly why the *drop folder*
+ * pull skips that whole tree — but "ours" does not mean "written by this
+ * machine". A record this device has never seen is simply a local miss.
+ */
+import type { Vault } from '../vault/vault.js';
+import { type AttachmentStore } from '@deepseek-ai/dsh-attachment';
+import type { Context } from '@deepseek-ai/cordis';
+/** The merge's admission callbacks, named so the wiring below reads plainly. */
+type Admit = {
+    image: (bytes: Uint8Array, mime: string, name: string) => Promise<{
+        storeId: string;
+    } | undefined>;
+    file: (bytes: Uint8Array, name: string) => Promise<{
+        storeId: string;
+    } | undefined>;
+};
+/** One object in the vault's own tree on the remote. */
+export interface SyncObject {
+    path: string;
+    lastModified?: string;
+}
+/**
+ * The slice of a remote this module reads.
+ *
+ * Both protocols can answer these two questions (S3 by prefix, WebDAV by
+ * `PROPFIND`), and keeping the seam this thin is what lets the merge be tested
+ * without either of them.
+ */
+export interface SyncTree {
+    list(prefix: string): Promise<SyncObject[]>;
+    read(path: string): Promise<Uint8Array>;
+}
+/** What one merge did. */
+export interface MergeOutcome {
+    /** Records that were new here, or overwritten because the remote was newer. */
+    merged: number;
+    /** Records the remote had and this machine already had, newer or equal. */
+    kept: number;
+    /** Attachment objects pulled down (bytes plus their row). */
+    attachments: number;
+    /** Things that went wrong, one line each. */
+    failures: string[];
+}
+/**
+ * Pull other devices' records out of `sync/` and settle them against the local
+ * vault, then fetch whatever attachment bytes those records need.
+ *
+ * @param vault - the open vault.
+ * @param tree - the remote, as two questions.
+ * @param prefix - the sync root inside the configured directory.
+ * @param admit - how bytes become a local attachment (the harness's own
+ *   admission, so a pulled image is validated exactly like a pasted one).
+ * @returns what happened, including the lines worth showing.
+ */
+export declare function mergeOnce(vault: Vault, tree: SyncTree, prefix: string, admit: {
+    image: Admit['image'];
+    file: Admit['file'];
+}): Promise<MergeOutcome>;
+/**
+ * The merge, wired for real: read the configuration, build a tree over `sync/`,
+ * and hand it to {@link mergeOnce}.
+ *
+ * Called by every pull the product has (startup, the panel's refresh, 立即同步) so
+ * "another device's records show up" does not depend on which button you press.
+ *
+ * @param ctx - host context carrying settings and credentials.
+ * @param vault - the open vault.
+ * @param attachments - where attachment bytes go.
+ * @returns the counts and the lines worth showing; never throws.
+ */
+export declare function mergeRemote(ctx: Context, vault: Vault, attachments: AttachmentStore): Promise<MergeOutcome>;
+export {};

package/lib/types/host/remote/pull.d.ts

@@ -0,0 +1,60 @@
+/**
+ * One-way ingest, whatever the remote happens to speak.
+ *
+ * The protocol lives behind `RemoteSource`: WebDAV and S3 each know how to list
+ * and read, and everything else — which file is new, what counts as text, how a
+ * repeat is merged, what a failure looks like — happens exactly once, here.
+ * Two copies of that logic would drift, and the drifting copy would be the one
+ * that quietly files something twice.
+ *
+ * Deliberately one-way. Pulling only, never pushing, is what keeps this simple
+ * enough to be trustworthy: there is no merge to get wrong, and the phone never
+ * has to understand the vault.
+ */
+import { type AttachmentStore } from '@deepseek-ai/dsh-attachment';
+import { type PullResult } from '../../shared/panel-wire.js';
+import type { S3Config, S3Deps } from '../s3/client.js';
+import type { Vault } from '../vault/vault.js';
+import { type WebdavDeps } from '../webdav/client.js';
+export type { PullResult } from '../../shared/panel-wire.js';
+/** One thing a remote offers to pull. */
+export interface RemoteEntry {
+    /** Remote path or key; also the display name's source. */
+    path: string;
+    lastModified?: string;
+    contentType?: string;
+}
+/** What the ingest needs from a remote, and nothing more. */
+export interface RemoteSource {
+    list(): Promise<RemoteEntry[]>;
+    read(entry: RemoteEntry): Promise<{
+        bytes: Uint8Array;
+        contentType: string;
+    }>;
+}
+/**
+ * Pull one remote and file everything new.
+ *
+ * Never throws: a remote that is down must not stop the harness from starting,
+ * so every failure becomes a `failed` result the caller can show.
+ *
+ * @param vault - the open vault.
+ * @param source - the protocol-specific read side.
+ * @param attachments - the store that owns pulled bytes.
+ * @returns what happened.
+ */
+export declare function ingestFrom(vault: Vault, source: RemoteSource, attachments: AttachmentStore): Promise<PullResult>;
+/** What the user configures for WebDAV. */
+export interface WebdavConfig {
+    baseUrl: string;
+    directory?: string;
+    username?: string;
+}
+/** Pull over WebDAV. */
+export declare function pullRemote(vault: Vault, config: WebdavConfig, deps: WebdavDeps & {
+    attachments: AttachmentStore;
+}): Promise<PullResult>;
+/** Pull over S3. */
+export declare function pullS3(vault: Vault, config: S3Config, prefix: string, deps: S3Deps & {
+    attachments: AttachmentStore;
+}): Promise<PullResult>;

package/lib/types/host/remote/push.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Sending the vault to the remote.
+ *
+ * The rules this implements are the ones the user decided on 2026-09-20:
+ * **only credential bodies travel encrypted** (they are ciphertext on disk
+ * already), everything else goes up as it is; a conflict is settled by writing
+ * what is newer; and the layout is `sync/items/<id>.json` plus
+ * `sync/attachments/<id>` under the configured directory — one file per object,
+ * so "increment" is "whatever got touched since last time".
+ *
+ * Deliberately *not* here yet: deleting remote objects for records the user
+ * emptied out of the bin, and merging what other devices pushed. Those are the
+ * next two steps; this one only ever adds and overwrites.
+ */
+import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
+import type { Context } from '@deepseek-ai/cordis';
+import type { PushResult } from '../../shared/panel-wire.js';
+import type { Attachment, Item } from '../vault/spec.js';
+import type { Vault } from '../vault/vault.js';
+/** What one write to the remote looks like, whichever protocol is configured. */
+type Writer = (path: string, bytes: Uint8Array, contentType: string) => Promise<void>;
+/**
+ * The suffix one attachment should carry.
+ *
+ * The file's *own* name wins when it has one: a `报税表.xlsx` knows what it is
+ * far better than any table here does, and guessing from the media type would
+ * hand back `bin` for every format nobody thought to list. The table is the
+ * fallback, and `bin` the last resort — a name that says "unknown" rather than a
+ * name that lies.
+ *
+ * @param filename - the name the file arrived with, when there is one.
+ * @param mime - its media type.
+ * @returns the extension without the dot.
+ */
+export declare function extensionOf(filename: string | undefined, mime: string): string;
+/**
+ * The object name one attachment gets on the remote.
+ *
+ * `<our id>.<extension>`: the id keeps it unique and idempotent, the extension
+ * keeps it *readable* — a cloud drive with a folder full of extension-less files
+ * cannot preview a photo, cannot open it, and cannot tell you which one is which.
+ * The user asked exactly that question ("我的图片呢？都是 json 文件？"), and a bare
+ * id was the whole reason.
+ *
+ * @param attachmentId - our row id for the attachment.
+ * @param record - the attachment row, for its own name and media type.
+ * @returns the file name to PUT.
+ */
+export declare function attachmentObjectName(attachmentId: string, record: Pick<Attachment, 'mime' | 'filename'>): string;
+/**
+ * The record as a text file a person can open in the cloud drive.
+ *
+ * The JSON beside it is the source of truth — this is a **view**, regenerated on
+ * every push and never read back. It exists because a bucket full of
+ * `{"format":"dsh-inbox-item/1",…}` is a bucket you cannot *use*: you cannot read
+ * the article you saved, you cannot see which photo belongs to which record, and
+ * you cannot tell a note from a link without a JSON viewer.
+ *
+ * A credential's body is the one thing it never contains: it is ciphertext on
+ * this machine and it stays ciphertext on the remote, so the text file says so
+ * instead of pretending the record is empty.
+ *
+ * @param item - the record.
+ * @param attachmentNames - the remote names of its attachments, in order.
+ * @returns the file's text.
+ */
+export declare function renderItemText(item: Item, attachmentNames: readonly string[]): string;
+/**
+ * Push everything that changed since the last push.
+ *
+ * @param ctx - host context carrying settings and credentials.
+ * @param vault - the open vault.
+ * @param attachments - where attachment bytes live.
+ * @returns what happened, including the reasons a caller can show.
+ */
+export declare function pushRemote(ctx: Context, vault: Vault, attachments: AttachmentStore | undefined, 
+/** `all` ignores the cursor and sends everything again — the repair button. */
+options?: {
+    all?: boolean;
+}): Promise<PushResult>;
+/**
+ * The push itself, with the transport injected.
+ *
+ * Split out the same way the pull is (`pullOnce` behind `pullRemote`), and for
+ * the same reason: the interesting rules — what counts as "changed", what
+ * happens when one write of twenty fails, that an attachment is uploaded once
+ * however many records point at it — are worth testing without a server.
+ *
+ * @param vault - the open vault.
+ * @param attachments - where attachment bytes live.
+ * @param writer - one write to the remote.
+ * @param basePath - the sync root inside the configured directory.
+ * @param options - `all` re-sends records the cursor thinks are already up.
+ * @param remover - optional: clears the pre-extension attachment name (see the
+ *   call site), something only a real remote can answer.
+ * @returns what happened.
+ */
+export declare function pushOnce(vault: Vault, attachments: AttachmentStore, writer: Writer, basePath: string, options?: {
+    all?: boolean;
+}, remover?: (path: string) => Promise<void>): Promise<PushResult>;
+export {};

package/lib/types/host/remote/remove.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Deleting on the remote what the user deleted here.
+ *
+ * "Delete" has two very different meanings in this vault, and the merge made the
+ * difference visible: a **soft delete** is a tombstone that travels, so other
+ * devices learn about it; **emptying the recycle bin** is the user saying "gone",
+ * and until this module existed it was only gone locally — the next pull brought
+ * it back from the cloud.
+ *
+ * Deletion is targeted, never a sweep. A blind "delete whatever is not in my
+ * vault" pass would remove another device's objects that this one simply has not
+ * merged yet, which is data loss dressed as housekeeping.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { Attachment } from '../vault/spec.js';
+/** What the caller removed locally, so the same things can go from the cloud. */
+export interface RemovedRecords {
+    /** Record ids that no longer exist locally. */
+    itemIds: readonly string[];
+    /**
+     * Attachment rows that no local record references any more.
+     *
+     * The row itself is needed, not just its id: the object's name carries an
+     * extension derived from the file's own name and media type.
+     */
+    attachments: readonly Attachment[];
+}
+/** What one cleanup did. */
+export interface RemoveOutcome {
+    /** Objects deleted from the remote. */
+    removed: number;
+    /** Things that went wrong, one line each. */
+    failures: string[];
+    /** Set when there is no remote to talk to — not an error, just nothing to do. */
+    skipped?: boolean;
+}
+/**
+ * Remove the remote copies of records the user emptied out of the bin.
+ *
+ * Three objects per record at most: the machine-readable `.json`, the readable
+ * `.txt`, and — for an attachment no other record still points at — its bytes
+ * and its metadata row. The extension-less name is attempted too: objects
+ * written before attachments carried extensions are exactly this shape, and this
+ * is the only pass that will ever clean them up.
+ *
+ * @param ctx - host context carrying settings and credentials.
+ * @param removed - what was just deleted locally.
+ * @returns how many objects went, and what could not.
+ */
+export declare function removeRemoteRecords(ctx: Context, removed: RemovedRecords): Promise<RemoveOutcome>;
+/**
+ * The deletion itself, with the transport injected.
+
+ * Split out the way the push and the merge are, so the naming rule — which
+ * objects one record owns, and that an attachment's pre-extension name is asked
+ * for too — is testable without a server.
+ *
+ * @param writer - one write/remove pair for the configured remote.
+ * @param root - the sync root inside the configured directory.
+ * @param removed - what was just deleted locally.
+ * @returns how many objects went, and what could not.
+ */
+export declare function removeWith(writer: {
+    remove(path: string): Promise<void>;
+}, root: string, removed: RemovedRecords): Promise<RemoveOutcome>;

package/lib/types/host/remote/writer.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The one place that turns settings into "somewhere to put and remove objects".
+ *
+ * Push writes, purge deletes, and both need the same three answers: which
+ * protocol, which credentials, and where the vault's own tree begins. Building
+ * that twice is how the two halves drift — the push root and the merge root
+ * disagreeing by one slash would look exactly like "the other device never sent
+ * anything", and a purge that deleted from a different prefix would leave
+ * everything behind.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { type WebdavSettings } from '../webdav/config.js';
+/** Everything the vault does to the remote. */
+export interface RemoteWriter {
+    write(path: string, bytes: Uint8Array, contentType: string): Promise<void>;
+    remove(path: string): Promise<void>;
+}
+/** Either a usable writer, or the reason there is none. */
+export type RemoteWriterResult = {
+    status: 'ok';
+    writer: RemoteWriter;
+    root: string;
+} | {
+    status: 'unconfigured';
+    reason: string;
+} | {
+    status: 'failed';
+    reason: string;
+};
+/**
+ * Where the vault's own objects live inside the configured directory.
+ *
+ * @param settings - the remote settings.
+ * @returns the path prefix, without a trailing slash.
+ */
+export declare function syncRoot(settings: WebdavSettings): string;
+/**
+ * Build the writer for whatever this profile is configured with.
+ *
+ * @param ctx - host context carrying settings and credentials.
+ * @returns the writer and the sync root, or why there is none.
+ */
+export declare function remoteWriter(ctx: Context): Promise<RemoteWriterResult>;

package/lib/types/host/rpc.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The panel's wire: the browser half submits pasted content, pages the vault,
+ * edits and deletes records, and streams attachment bytes back.
+ *
+ * Transport: exact Fetch routes on the shared `/api` channel. Connection
+ * applies its Host/Origin trust fence **and** the signed browser cookie before
+ * dispatching anything under `/api`, so the vault is exactly as reachable as
+ * the rest of the GUI and no further. A bare `webServer` route would instead
+ * answer any process on the machine and any page that can issue a simple
+ * cross-origin POST — not somewhere to put a vault.
+ *
+ * Attachment bytes never enter the vault domain. They go through dsh's own
+ * attachment store (content-addressed, normalized, never auto-deleted), and the
+ * domain keeps the reference plus the metadata we can show without reading
+ * bytes back.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { type Vault } from './vault/vault.js';
+/** Ceiling on one pasted string, so a runaway paste cannot bloat the domain. */
+export declare const MAX_TEXT_CHARS = 200000;
+/**
+ * Register the panel's endpoints.
+ *
+ * Both services are optional on purpose: a profile without `connection` (the
+ * headless development profiles) still loads this plugin, it just has no panel
+ * and therefore no endpoints to serve.
+ *
+ * Captures are serialised through one promise chain. Repeat detection is a
+ * read-then-write pass over the domain, and the domain only serialises each
+ * individual write — two overlapping submissions of the same link would
+ * otherwise both miss the existing record and store it twice.
+ *
+ * @param ctx - host context; `apply` does not have to await anything.
+ * @param vault - reads the currently open vault, which may not be open yet.
+ */
+export declare function registerInboxRpc(ctx: Context, vault: () => Vault | undefined): void;