feat(sdk): P3.4 @insignia/iios-inbox-web + kernel-client inbox REST

RestClient.listInboxItems/patchInboxItem + InboxItem type; iios-inbox-web
InboxProvider + useInbox (poll + snooze/done/reopen). Boundary allowlist extended.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-kernel-client/src/rest.ts

@@ -1,5 +1,5 @@
 import type { IngestInteractionRequest } from '@insignia/iios-contracts';
-import type { Message } from './types';
+import type { Message, InboxItem, InboxState } from './types';
 
 export interface RestConfig {
   serviceUrl: string;
@@ -40,6 +40,23 @@ export class RestClient {
     return (await r.json()) as Message;
   }
 
+  async listInboxItems(state?: InboxState): Promise<InboxItem[]> {
+    const q = state ? `?state=${encodeURIComponent(state)}` : '';
+    const r = await fetch(this.url(`/v1/inbox/items${q}`), { headers: this.headers() });
+    if (!r.ok) throw new Error(`listInboxItems ${r.status}`);
+    return (await r.json()) as InboxItem[];
+  }
+
+  async patchInboxItem(id: string, body: { state: InboxState; reason?: string }): Promise<InboxItem> {
+    const r = await fetch(this.url(`/v1/inbox/items/${id}`), {
+      method: 'PATCH',
+      headers: this.headers(),
+      body: JSON.stringify(body),
+    });
+    if (!r.ok) throw new Error(`patchInboxItem ${r.status}`);
+    return (await r.json()) as InboxItem;
+  }
+
   async ingest(body: IngestInteractionRequest, idempotencyKey: string): Promise<unknown> {
     const r = await fetch(this.url('/v1/interactions/ingest'), {
       method: 'POST',

packages/iios-kernel-client/src/types.ts

@@ -32,6 +32,23 @@ export interface MessageEvents {
   typing: (e: TypingEvent) => void;
 }
 
+export type InboxState = 'OPEN' | 'SNOOZED' | 'DONE' | 'ARCHIVED' | 'CANCELLED' | 'STALE';
+
+export interface InboxItem {
+  id: string;
+  ownerActorId: string;
+  kind: string;
+  state: InboxState;
+  title: string;
+  summary?: string | null;
+  priority: string;
+  threadId?: string | null;
+  sourceInteractionId?: string | null;
+  traceId?: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
 /** Minimal socket surface so the facade can be unit-tested with a fake. */
 export interface SocketLike {
   on(event: string, handler: (...args: unknown[]) => void): unknown;