Harden and standardize the Message Box stack

[ty-everett]

Summary

This program slice makes the Message Box client and server safer, more predictable, easier to deploy, and conformant with the current ts-stack repository contracts. It also modernizes the client package artifact without changing or publishing either package version.

Part of #324.

What changed

Message Box client

• Modernize the published artifact to a verified tsdown ESM/CJS package with declarations, explicit exports, a minimal file set, strict type/lint/format gates, and reproducible pack checks.
• Add browser composition and raw/gzip/brotli budgets for Vite, esbuild, and UMD consumers while removing the guarded SDK node:https fallback from browser bundles.
• Validate configured and advertised hosts, reject unsafe untrusted overlay advertisements, preserve explicit local/development hosts, and consistently forward explicit deployment hosts through HTTP and WebSocket paths.
• Harden HMAC checks, recipient-specific encryption, batch-send isolation, device and pagination bounds, permission handling, and backward-compatible pagination behavior.
• Preserve the legacy misspelled batch API as deprecated while adding the correctly named API.
• Replace the bundled integration server with an explicit opt-in external integration runner.

Message Box server

• Add /health and /ready endpoints and fail startup cleanly when database migration, Firebase, or WebSocket initialization fails.
• Keep CORS public by default for this public service while supporting configurable allowlists and explicit disablement.
• Validate message, acknowledgement, permission, and device inputs; bound list queries; authenticate acknowledgement ownership; reject token ownership conflicts; and remove fail-open fee behavior.
• Normalize permission scope with a reversible migration and add composite indexes for bounded list queries.
• Simplify the production image to the Node service on port 8080, removing the unused nginx/build indirection.
• Remove unused dependencies/configuration, standardize strict format/type/lint/test scripts, and close the Knex pool on failed initialization.

Contracts and documentation

• Update the Message Box OpenAPI contract, generated TypeScript/Python/Go bindings, package and deployment docs, and repository-health baseline.
• Document the public-default CORS model, pagination and validation contracts, deployment health probes, startup expectations, and opt-in integration workflow.

Compatibility and publication

• @bsv/message-box-client remains at 2.2.2.
• @bsv/messagebox-server remains at 1.1.14 and private.
• No npm package has been published.
• Licensing files and license policy are unchanged by this PR.

Validation

• Client: format, strict typecheck, zero-warning lint, build, verified ESM/CJS pack, browser composition/budgets, 114 unit tests, and coverage (60.3% lines).
• Server: format, strict typecheck, zero-warning lint, build, 95 tests, coverage (44.27% lines), and production/full npm audits with zero findings.
• Repository: pnpm check-versions, pnpm health:check, pnpm build, pnpm test, pnpm lint, pnpm audit:security, and pnpm license:pack-check.
• Contracts/docs: reproducible code generation, documentation validation/build/pre-render, and link validation.
• Final diff: clean whitespace, Message Box-only scope, current exact main base d4c98d06ca24d5e03722079b9e5b31df32ee9b68.

[codecov]

Codecov Report

❌ Patch coverage is 93.86189% with 24 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ssaging/message-box-client/src/MessageBoxClient.ts	90.97%	9 Missing and 15 partials ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.9% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Admin exact-head review attestation for 91f638a: reviewed the Message Box client/server hardening, public-by-default configurable CORS contract, compatibility surface, packaging, documentation/spec/codegen, and the follow-up Sonar/coverage fixes. Local package and full-repository build, test, lint, audit, health, version, codegen, browser, and pack gates passed. GitHub checks are fully green, including both CodeQL analyses, SonarCloud with 0 new open/confirmed issues, Codecov patch at 93.86189%, dependency review, Socket, infrastructure image, conformance, docs, codegen, coverage matrix, and merge gate. There are 0 unresolved review threads. GitHub prohibits an author from formally approving their own PR, so this records the equivalent ty-everett admin review evidence before the authorized admin merge.