@chance722/dsh-inbox 0.2.6 → 0.2.8

package/lib/index.js

@@ -3,7 +3,7 @@ import { defineTool as defineTool2 } from "@deepseek-ai/dsh-tools";
 
 // src/shared/constants.ts
 var PACKAGE_NAME = "@chance722/dsh-inbox";
-var VERSION = true ? "0.2.6" : "0.0.0-dev";
+var VERSION = true ? "0.2.8" : "0.0.0-dev";
 var DEFAULT_USER_AGENT = "dsh-inbox";
 
 // src/shared/vocabulary.ts
@@ -1251,8 +1251,13 @@ function isNewer(entry, lastPullAt) {
   if (Number.isNaN(seen) || Number.isNaN(remote)) return true;
   return remote > seen;
 }
+function isFolder(path, dropFolder) {
+  if (path.endsWith("/")) return true;
+  return dropFolder.length > 0 && path.replace(/\/+$/, "") === dropFolder;
+}
 async function ingestFrom(vault, source, attachments, syncRoot3 = syncRootFor(void 0), elsewhere = { roots: [] }) {
   const lastPullAt = vault.global.sync.lastPullAt;
+  const dropFolder = syncRoot3.endsWith("/sync") ? syncRoot3.slice(0, -"/sync".length) : "";
   let entries;
   try {
     entries = await source.list();
@@ -1267,6 +1272,7 @@ async function ingestFrom(vault, source, attachments, syncRoot3 = syncRootFor(vo
   let skippedSync = 0;
   let skippedOlder = 0;
   let skippedForeign = 0;
+  let skippedFolders = 0;
   let remoteRecords = 0;
   let remoteAttachments = 0;
   const foreignSyncRoots = new Set(elsewhere.roots);
@@ -1295,6 +1301,11 @@ async function ingestFrom(vault, source, attachments, syncRoot3 = syncRootFor(vo
       else if (folder === "attachments" && !name3.endsWith(".meta.json")) remoteAttachments += 1;
       continue;
     }
+    if (isFolder(entry.path, dropFolder)) {
+      skipped += 1;
+      skippedFolders += 1;
+      continue;
+    }
     if (!isNewer(entry, lastPullAt)) {
       skipped += 1;
       skippedOlder += 1;
@@ -1358,6 +1369,7 @@ async function ingestFrom(vault, source, attachments, syncRoot3 = syncRootFor(vo
     skippedSync,
     skippedOlder,
     skippedForeign,
+    skippedFolders,
     remoteRecords,
     remoteAttachments,
     syncRoot: syncRoot3,
@@ -1489,18 +1501,32 @@ function wins(remote, local) {
   if (Number.isNaN(incoming) || Number.isNaN(current)) return false;
   return incoming > current;
 }
+function newerThanPurge(vault, remote) {
+  const purged = vault.purgedAt(remote.id);
+  if (purged === void 0) return true;
+  return Date.parse(remote.updatedAt) > Date.parse(purged);
+}
 async function mergeOnce(vault, tree, prefix, admit) {
   const failures = [];
   let merged = 0;
   let added = 0;
   let deletions = 0;
+  let purged = 0;
   let kept = 0;
   let attachments = 0;
   let objects;
   try {
     objects = await tree.list(`${prefix}/items/`);
   } catch (error) {
-    return { merged: 0, added: 0, deletions: 0, kept: 0, attachments: 0, failures: [`\u5217\u8FDC\u7AEF\u540C\u6B65\u76EE\u5F55\u5931\u8D25\uFF1A${reasonOf(error)}`] };
+    return {
+      merged: 0,
+      added: 0,
+      deletions: 0,
+      purged: 0,
+      kept: 0,
+      attachments: 0,
+      failures: [`\u5217\u8FDC\u7AEF\u540C\u6B65\u76EE\u5F55\u5931\u8D25\uFF1A${reasonOf(error)}`]
+    };
   }
   const wanted = /* @__PURE__ */ new Map();
   const bytesAt = /* @__PURE__ */ new Map();
@@ -1524,6 +1550,10 @@ async function mergeOnce(vault, tree, prefix, admit) {
         continue;
       }
       const local = vault.get(remote.id);
+      if (local === void 0 && !newerThanPurge(vault, remote)) {
+        purged += 1;
+        continue;
+      }
       if (!wins(remote, local)) {
         kept += 1;
         continue;
@@ -1566,7 +1596,7 @@ async function mergeOnce(vault, tree, prefix, admit) {
       failures.push(`\u9644\u4EF6 ${attachmentId}\uFF1A${reasonOf(error)}`);
     }
   }
-  return { merged, added, deletions, kept, attachments, failures };
+  return { merged, added, deletions, purged, kept, attachments, failures };
 }
 function extensionOfName(path) {
   return /\.([A-Za-z0-9]{1,8})$/.exec(nameOf2(path))?.[1]?.toLowerCase() ?? "bin";
@@ -1579,7 +1609,9 @@ async function mergeRemote(ctx, vault, attachments, extraRoots = []) {
   const prefix = syncRoot(settings);
   try {
     const tree = settings.protocol === "s3" ? await s3Tree(ctx, settings) : await webdavTree(ctx, settings);
-    if (tree === void 0) return { merged: 0, added: 0, deletions: 0, kept: 0, attachments: 0, failures: [] };
+    if (tree === void 0) {
+      return { merged: 0, added: 0, deletions: 0, purged: 0, kept: 0, attachments: 0, failures: [] };
+    }
     const admit = admitWith(attachments);
     const outcome = await mergeOnce(vault, tree, prefix, admit);
     for (const root of extraRoots) {
@@ -1588,13 +1620,22 @@ async function mergeRemote(ctx, vault, attachments, extraRoots = []) {
       outcome.merged += extra.merged;
       outcome.added += extra.added;
       outcome.deletions += extra.deletions;
+      outcome.purged += extra.purged;
       outcome.kept += extra.kept;
       outcome.attachments += extra.attachments;
       outcome.failures.push(...extra.failures);
     }
     return outcome;
   } catch (error) {
-    return { merged: 0, added: 0, deletions: 0, kept: 0, attachments: 0, failures: [reasonOf(error)] };
+    return {
+      merged: 0,
+      added: 0,
+      deletions: 0,
+      purged: 0,
+      kept: 0,
+      attachments: 0,
+      failures: [reasonOf(error)]
+    };
   }
 }
 function admitWith(store) {
@@ -1702,6 +1743,7 @@ async function withMerge(ctx, vault, attachments, pulled) {
     merged: outcome.merged,
     added: outcome.added,
     deletions: outcome.deletions,
+    ...outcome.purged === 0 ? {} : { purged: outcome.purged },
     kept: outcome.kept,
     attachments: outcome.attachments,
     failed: pulled.failed + outcome.failures.length,
@@ -2466,6 +2508,12 @@ var attachmentSchema = z3.object({
   /** Present when the medium identifies the bytes by digest. */
   sha256: z3.string().optional()
 });
+var graveSchema = z3.object({
+  /** The record's own key, repeated inside the document (see `attachments`). */
+  id: z3.string().min(1),
+  /** When the user emptied it out of the bin. */
+  purgedAt: timestamp
+});
 var vaultGlobalSchema = z3.object({
   sync: z3.object({
     lastPullAt: z3.string().optional(),
@@ -2518,9 +2566,17 @@ var vaultSpec = defineDomain({
    * Version 7 adds `sync.lastPushAt`: the cursor that keeps a push to "what
    * changed since last time" instead of re-uploading the vault on every pass.
    * A `global` field, so no record shape changes at all.
+   *
+   * Version 8 adds the `graves` table: one row per record the user emptied out
+   * of the bin. A purge leaves no local row, so the merge had nothing to
+   * outrank the cloud's copy with — with 「同时合并别的同步目录」 on, the older
+   * tree in the same bucket filed all thirteen of them back into the bin on
+   * every restart (measured 2026-09-21). A new table, so no record shape
+   * changes; an older vault simply has no graves, and there is nothing to
+   * protect until the next purge.
    */
-  version: 7,
-  compatibleVersions: [1, 2, 3, 4, 5, 6],
+  version: 8,
+  compatibleVersions: [1, 2, 3, 4, 5, 6, 7],
   layout: "per-record",
   global: {
     schema: vaultGlobalSchema,
@@ -2528,7 +2584,8 @@ var vaultSpec = defineDomain({
   },
   tables: {
     items: domainTable(itemSchema),
-    attachments: domainTable(attachmentSchema)
+    attachments: domainTable(attachmentSchema),
+    graves: domainTable(graveSchema)
   }
 });
 
@@ -2599,6 +2656,9 @@ var Vault = class _Vault {
   get attachments() {
     return this.domain.table("attachments");
   }
+  get graves() {
+    return this.domain.table("graves");
+  }
   /** Where the key state stands; what the panel shows and the tools consult. */
   get lockState() {
     return { configured: this.global.master !== void 0, unlocked: this.key !== void 0 };
@@ -2853,16 +2913,26 @@ var Vault = class _Vault {
     });
   }
   /**
-   * Delete one record for good, together with its attachment rows.
+   * Delete one record for good, together with its attachment rows, and leave a
+   * grave behind so nothing that is still in the cloud can file it again.
    *
    * The bytes behind an attachment live in dsh's own store, which never deletes
    * automatically — emptying the recycle bin drops our references, not their
    * objects. A row another record still references is left alone.
    *
+   * The grave is the other half of that sentence, and it is why this is not
+   * called `remove` any more: deleting the row really does take this machine's
+   * copy away, but a copy under a *different* `sync/` tree in the same bucket
+   * survives the purge of our own tree (`../remote/remove.ts` only ever deletes
+   * under this vault's root), and the merge has no local row to outrank it with.
+   * Measured 2026-09-21: thirteen emptied tombstones came back into the bin on
+   * every `dsh` restart. The grave is what makes "gone" stick; it holds the id
+   * and the moment, no content.
+   *
    * @param id - record key.
    * @returns whether the record existed.
    */
-  async remove(id) {
+  async purge(id) {
     const item = this.items.get(id);
     if (item === void 0) return false;
     const stillReferenced = /* @__PURE__ */ new Set();
@@ -2873,7 +2943,18 @@ var Vault = class _Vault {
     for (const attachmentId of item.attachmentIds) {
       if (!stillReferenced.has(attachmentId)) await this.attachments.delete(attachmentId);
     }
-    return this.items.delete(id);
+    await this.items.delete(id);
+    await this.graves.put(id, { id, purgedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return true;
+  }
+  /**
+   * When this id was emptied out of the bin, if it ever was.
+   *
+   * The merge asks this before taking a copy of a record this vault does not
+   * have (see `newerThanPurge` in `../remote/merge.ts`).
+   */
+  purgedAt(id) {
+    return this.graves.get(id)?.purgedAt;
   }
   /**
    * Record an attachment's metadata. The bytes stay in the store named by
@@ -3253,7 +3334,7 @@ async function handlePurge(ctx, vault) {
   }
   let removed = 0;
   for (const item of bin) {
-    if (await vault.remove(item.id)) removed += 1;
+    if (await vault.purge(item.id)) removed += 1;
   }
   const stillReferenced = new Set(
     vault.list({ includeDeleted: true }).flatMap((item) => [...item.attachmentIds])

package/lib/types/client/messages.d.ts

@@ -181,6 +181,7 @@ export declare const zh: {
     'sync.detailPulled': string;
     'sync.detailAdded': string;
     'sync.detailDeleted': string;
+    'sync.detailPurged': string;
     'sync.pullForeignSync': string;
     'sync.detailForeign': string;
     'sync.shortPushed': string;
@@ -444,6 +445,7 @@ export declare const MESSAGES: {
         'sync.detailPulled': string;
         'sync.detailAdded': string;
         'sync.detailDeleted': string;
+        'sync.detailPurged': string;
         'sync.pullForeignSync': string;
         'sync.detailForeign': string;
         'sync.shortPushed': string;

package/lib/types/host/remote/merge.d.ts

@@ -59,6 +59,16 @@ export interface MergeOutcome {
      * 2026-09-21, after merging an abandoned tree whose copies mostly overlapped).
      */
     added: number;
+    /**
+     * Copies of records this vault **emptied out of the bin** — left alone, on
+     * purpose, because a purge is not a deletion to be argued with.
+     *
+     * Counted apart from {@link kept}: "the cloud has a copy you already have" and
+     * "the cloud has a copy of something you threw away" are different sentences,
+     * and only the second one answers "so why did the emptied records stay empty
+     * this time?" (2026-09-21).
+     */
+    purged: number;
     /** Records the remote had and this machine already had, newer or equal. */
     kept: number;
     /** Attachment objects pulled down (bytes plus their row). */

package/lib/types/host/vault/spec.d.ts

@@ -67,6 +67,31 @@ export declare const attachmentSchema: z.ZodObject<{
     height: z.ZodOptional<z.ZodNumber>;
     sha256: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * One grave: the id the user emptied out of the recycle bin, and when.
+ *
+ * Emptying the bin is not "deleted" — it is *gone*, and a copy of the record
+ * living somewhere else (another `sync/` tree in the same bucket, a device that
+ * has not pulled the tombstone yet) must not be able to file it back in.
+ * `updatedAt` cannot express that on its own: the merge compares the incoming
+ * copy against the local one, and after a purge there is no local row at all,
+ * so any copy won. That is measured, not theoretical — thirteen tombstones came
+ * back into the bin on every restart (2026-09-21).
+ *
+ * It carries an id and a time and nothing else: no text, no note, no
+ * attachment. What the row buys is the one comparison the merge needs — a copy
+ * **at or before** this moment is dead, a copy strictly newer still wins, the
+ * same way it does for a record that was never deleted.
+ *
+ * Nothing ever collects these, and that is deliberate rather than an oversight:
+ * a grave that has been pruned is a hole reopened — the copy it was holding out
+ * is exactly as old as it was, and the next pull takes it. One row per emptied
+ * record, six fields of JSON, for as long as the vault lives.
+ */
+export declare const graveSchema: z.ZodObject<{
+    id: z.ZodString;
+    purgedAt: z.ZodString;
+}, z.core.$strip>;
 /**
  * One global slot per domain. Sync state lives here because it belongs to the
  * vault as a whole, not to any item; M6 fills it in.
@@ -96,6 +121,7 @@ export declare const vaultGlobalSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type Item = z.infer<typeof itemSchema>;
 export type Attachment = z.infer<typeof attachmentSchema>;
+export type Grave = z.infer<typeof graveSchema>;
 export type VaultGlobal = z.infer<typeof vaultGlobalSchema>;
 /**
  * Domain name doubles as the backend unit name: `<DSH_HOME>/storages/dsh_inbox/…`.
@@ -122,6 +148,14 @@ export declare const vaultSpec: {
      * Version 7 adds `sync.lastPushAt`: the cursor that keeps a push to "what
      * changed since last time" instead of re-uploading the vault on every pass.
      * A `global` field, so no record shape changes at all.
+     *
+     * Version 8 adds the `graves` table: one row per record the user emptied out
+     * of the bin. A purge leaves no local row, so the merge had nothing to
+     * outrank the cloud's copy with — with 「同时合并别的同步目录」 on, the older
+     * tree in the same bucket filed all thirteen of them back into the bin on
+     * every restart (measured 2026-09-21). A new table, so no record shape
+     * changes; an older vault simply has no graves, and there is nothing to
+     * protect until the next purge.
      */
     version: number;
     compatibleVersions: number[];
@@ -188,6 +222,10 @@ export declare const vaultSpec: {
             height?: number | undefined;
             sha256?: string | undefined;
         }>;
+        graves: import("@deepseek-ai/dsh-storage-domain").DomainTableSpec<string, {
+            id: string;
+            purgedAt: string;
+        }>;
     };
 };
 export type VaultSpec = typeof vaultSpec;

package/lib/types/host/vault/vault.d.ts

@@ -96,6 +96,7 @@ export declare class Vault {
     private migrateOnce;
     private get items();
     private get attachments();
+    private get graves();
     /** Where the key state stands; what the panel shows and the tools consult. */
     get lockState(): VaultLockState;
     /**
@@ -211,16 +212,33 @@ export declare class Vault {
     /** Undo a soft delete. */
     restore(id: string): Promise<Item>;
     /**
-     * Delete one record for good, together with its attachment rows.
+     * Delete one record for good, together with its attachment rows, and leave a
+     * grave behind so nothing that is still in the cloud can file it again.
      *
      * The bytes behind an attachment live in dsh's own store, which never deletes
      * automatically — emptying the recycle bin drops our references, not their
      * objects. A row another record still references is left alone.
      *
+     * The grave is the other half of that sentence, and it is why this is not
+     * called `remove` any more: deleting the row really does take this machine's
+     * copy away, but a copy under a *different* `sync/` tree in the same bucket
+     * survives the purge of our own tree (`../remote/remove.ts` only ever deletes
+     * under this vault's root), and the merge has no local row to outrank it with.
+     * Measured 2026-09-21: thirteen emptied tombstones came back into the bin on
+     * every `dsh` restart. The grave is what makes "gone" stick; it holds the id
+     * and the moment, no content.
+     *
      * @param id - record key.
      * @returns whether the record existed.
      */
-    remove(id: string): Promise<boolean>;
+    purge(id: string): Promise<boolean>;
+    /**
+     * When this id was emptied out of the bin, if it ever was.
+     *
+     * The merge asks this before taking a copy of a record this vault does not
+     * have (see `newerThanPurge` in `../remote/merge.ts`).
+     */
+    purgedAt(id: string): string | undefined;
     /**
      * Record an attachment's metadata. The bytes stay in the store named by
      * `storeId`; this row is our own index over them, keyed by a generated id

package/lib/types/shared/panel-wire.d.ts

@@ -92,8 +92,10 @@ export interface WebdavSettings {
      * cloud drive": a machine that used to sync somewhere else leaves its records
      * behind, and they come back (asked 2026-09-21, 19 records). Merging settles
      * per record by `id` + `updatedAt`, so an older tree cannot overwrite a newer
-     * copy — but it *can* bring back a record that was purged here, because a
-     * purge leaves nothing local to outrank it.
+     * copy — and a record the user **emptied out of the bin** stays gone: the
+     * grave that `purge` leaves is the thing such a copy cannot outrank (it used
+     * to, and thirteen emptied tombstones came back into the bin on every restart
+     * — measured 2026-09-21).
      */
     adoptForeignRoots: boolean;
     username: string;
@@ -175,6 +177,15 @@ export interface PullResult {
     merged?: number;
     /** How many of {@link merged} were ids this vault did not have at all. */
     added?: number;
+    /**
+     * Copies the cloud still holds of records this vault **emptied out of the bin**.
+     *
+     * Not taken in, on purpose: `purge` leaves a grave, and a copy that is not
+     * *newer* than it does not come back (see `graves` in `src/host/vault/spec.ts`).
+     * Reported because a reader who just emptied the bin is owed the sight of the
+     * older tree trying and being refused.
+     */
+    purged?: number;
     /** How many of {@link merged} were deletions (they land in the recycle bin). */
     deletions?: number;
     /** Attachment objects the merge had to fetch and admit locally. */
@@ -200,6 +211,18 @@ export interface PullResult {
     skippedSync?: number;
     /** How many of {@link skipped} were older than the last pull's cursor. */
     skippedOlder?: number;
+    /**
+     * How many of {@link skipped} were **folders**, not files.
+     *
+     * S3 has no folders, so a folder the user made in the cloud console is a
+     * placeholder object whose key ends with `/` — and the listing hands the drop
+     * folder's own placeholder back like any other object. Reading one is not a
+     * file read: 数据胶囊 answers `HTTP 500 {"msg":"未知运行时异常"}`, which the
+     * panel showed as `失败 1：inbox：取对象失败：HTTP 500 …` on every refresh,
+     * because a failed entry pins the pull cursor (measured 2026-09-21). They are
+     * skipped by shape now; the count is here for whoever is debugging a listing.
+     */
+    skippedFolders?: number;
     /**
      * How many of {@link skipped} sat under a `…/sync/` prefix that is **not**
      * ours — another machine syncing under a different directory.

package/package.json

@@ -1,104 +1,104 @@
-{
-  "name": "@chance722/dsh-inbox",
-  "version": "0.2.6",
-  "private": false,
-  "description": "Personal paste inbox for DeepSeek Harness (dsh): capture, classify, browse and retrieve.",
-  "keywords": [
-    "dsh",
-    "dsh-plugin",
-    "deepseek-harness",
-    "inbox",
-    "clipboard",
-    "vault"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Chance722/dsh-inbox.git"
-  },
-  "homepage": "https://github.com/Chance722/dsh-inbox#readme",
-  "bugs": {
-    "url": "https://github.com/Chance722/dsh-inbox/issues"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "type": "module",
-  "license": "MIT",
-  "main": "lib/index.js",
-  "types": "lib/types/host/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/types/host/index.d.ts",
-      "default": "./lib/index.js"
-    },
-    "./client": {
-      "types": "./lib/types/client/index.d.ts",
-      "default": "./lib/client.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib/index.js",
-    "lib/client.js",
-    "lib/cli.js",
-    "cordis.patch.yml",
-    "lib/types/**/*.d.ts"
-  ],
-  "bin": {
-    "dsh-inbox": "./lib/cli.js"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "platform": "web",
-      "inject": [
-        "@deepseek-ai/dsh-client-connection",
-        "@deepseek-ai/dsh-client-ui-layout",
-        "@deepseek-ai/dsh-client-ui-sidebar"
-      ]
-    }
-  },
-  "scripts": {
-    "build": "node scripts/build.mjs && tsc -p tsconfig.build.json",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "prepublishOnly": "npm run build",
-    "dev:status": "node scripts/dev.mjs status",
-    "dev:local": "node scripts/dev.mjs local",
-    "dev:npm": "node scripts/dev.mjs npm"
-  },
-  "dependencies": {
-    "lucide-react": "^1.47.0",
-    "zod": "^4.4.3"
-  },
-  "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-attachment": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-connection": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-commands": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-storage-domain": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-tools": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-web": "^0.1.5-rc.2"
-  },
-  "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-attachment": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-connection": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-commands": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-storage": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-storage-domain": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-storage-json": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-tools": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-web": "0.1.5-rc.2",
-    "@deepseek-ai/schemastery": "3.18.2",
-    "@types/node": "^22.10.0",
-    "@types/react": "~18.3.1",
-    "esbuild": "^0.25.0",
-    "react": "^18.2.0",
-    "typescript": "^5.7.0",
-    "vitest": "^3.0.0",
-    "zod": "^4.4.3"
-  }
-}
+{
+  "name": "@chance722/dsh-inbox",
+  "version": "0.2.8",
+  "private": false,
+  "description": "Personal paste inbox for DeepSeek Harness (dsh): capture, classify, browse and retrieve.",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "inbox",
+    "clipboard",
+    "vault"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Chance722/dsh-inbox.git"
+  },
+  "homepage": "https://github.com/Chance722/dsh-inbox#readme",
+  "bugs": {
+    "url": "https://github.com/Chance722/dsh-inbox/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "license": "MIT",
+  "main": "lib/index.js",
+  "types": "lib/types/host/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/host/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "types": "./lib/types/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/client.js",
+    "lib/cli.js",
+    "cordis.patch.yml",
+    "lib/types/**/*.d.ts"
+  ],
+  "bin": {
+    "dsh-inbox": "./lib/cli.js"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-sidebar"
+      ]
+    }
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs && tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build",
+    "dev:status": "node scripts/dev.mjs status",
+    "dev:local": "node scripts/dev.mjs local",
+    "dev:npm": "node scripts/dev.mjs npm"
+  },
+  "dependencies": {
+    "lucide-react": "^1.47.0",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-attachment": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-connection": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-commands": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-storage-domain": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-web": "^0.1.5-rc.2"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-attachment": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-connection": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-commands": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-storage": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-storage-domain": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-storage-json": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-web": "0.1.5-rc.2",
+    "@deepseek-ai/schemastery": "3.18.2",
+    "@types/node": "^22.10.0",
+    "@types/react": "~18.3.1",
+    "esbuild": "^0.25.0",
+    "react": "^18.2.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0",
+    "zod": "^4.4.3"
+  }
+}