feat(node): add TypeScript sibling project for npm-based install

Introduces @kuns/claude-mailbox under node/, a wire-compatible TypeScript
port of the .NET daemon that distributes via the public Gitea npm registry.
The .NET project stays in src/ClaudeMailbox/ untouched; users pick whichever
flavor they prefer.

- node/ project: fastify + @modelcontextprotocol/sdk StreamableHTTPServerTransport
  + better-sqlite3, schema and wire surface match the C# version (port 47822,
  X-Mailbox header, MCP tool names, snake_case SQLite columns)
- Cross-platform autostart: Scheduled Task (Win, no admin) / Windows Service
  (Win, --service) / launchd (mac) / systemd --user (linux)
- 9/9 vitest tests pass; end-to-end /health + send/check round-trip verified
- CI split: existing ci.yml/release.yml renamed to *-dotnet.yml with path
  filters, new ci-node.yml and release-node.yml publish to Gitea npm registry
- install.ps1 / install.sh bootstrap one-liners at repo root; homebrew/
  contains a tap formula template
- README install section reordered: npm path primary, dotnet publish secondary

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

node/tests/db.test.ts

@@ -0,0 +1,94 @@
+import { describe, it, expect, afterEach, beforeEach } from "vitest";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { MailboxStore } from "../src/db.js";
+
+let dir: string;
+let dbPath: string;
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "claude-mailbox-test-"));
+  dbPath = join(dir, "test.db");
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe("schema", () => {
+  it("creates fresh tables and is idempotent on re-open", () => {
+    const a = new MailboxStore(dbPath);
+    a.upsertMailbox("alice");
+    a.close();
+
+    const b = new MailboxStore(dbPath);
+    const list = b.listMailboxes();
+    expect(list.map((m) => m.name)).toEqual(["alice"]);
+    b.close();
+  });
+});
+
+describe("send / peek / check round-trip", () => {
+  it("delivers a message exactly once", () => {
+    const store = new MailboxStore(dbPath);
+    try {
+      const result = store.send("alice", "bob", "hello bob");
+      expect(result.id).toBeGreaterThan(0);
+
+      const peek1 = store.peek("bob");
+      expect(peek1.pending).toBe(1);
+      expect(peek1.oldestAt).toBeInstanceOf(Date);
+
+      const pulled = store.checkInbox("bob");
+      expect(pulled).toHaveLength(1);
+      expect(pulled[0]!.from_mailbox).toBe("alice");
+      expect(pulled[0]!.body).toBe("hello bob");
+
+      const peek2 = store.peek("bob");
+      expect(peek2.pending).toBe(0);
+      expect(peek2.oldestAt).toBeNull();
+
+      const empty = store.checkInbox("bob");
+      expect(empty).toEqual([]);
+    } finally {
+      store.close();
+    }
+  });
+
+  it("checkInbox returns all pending in order and marks them delivered atomically", () => {
+    const store = new MailboxStore(dbPath);
+    try {
+      for (let i = 0; i < 10; i++) {
+        store.send("alice", "bob", `msg ${i}`);
+      }
+      const first = store.checkInbox("bob");
+      expect(first).toHaveLength(10);
+      expect(first.map((m) => m.body)).toEqual(
+        Array.from({ length: 10 }, (_, i) => `msg ${i}`),
+      );
+      const second = store.checkInbox("bob");
+      expect(second).toEqual([]);
+    } finally {
+      store.close();
+    }
+  });
+});
+
+describe("listMailboxes", () => {
+  it("returns mailboxes alphabetically with pendingForYou for the caller", () => {
+    const store = new MailboxStore(dbPath);
+    try {
+      store.send("alice", "bob", "x");
+      store.send("alice", "bob", "y");
+      store.send("carol", "bob", "z");
+
+      const fromBob = store.listMailboxes("bob");
+      expect(fromBob.map((m) => m.name)).toEqual(["alice", "bob", "carol"]);
+      const bobRow = fromBob.find((m) => m.name === "bob");
+      expect(bobRow?.pendingForYou).toBe(3);
+    } finally {
+      store.close();
+    }
+  });
+});

node/tests/server.test.ts

@@ -0,0 +1,109 @@
+import { describe, it, expect, afterEach, beforeEach } from "vitest";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { MailboxStore } from "../src/db.js";
+import { buildServer } from "../src/server.js";
+import type { FastifyInstance } from "fastify";
+
+let dir: string;
+let dbPath: string;
+let store: MailboxStore;
+let app: FastifyInstance;
+let baseUrl: string;
+
+beforeEach(async () => {
+  dir = mkdtempSync(join(tmpdir(), "claude-mailbox-srv-"));
+  dbPath = join(dir, "test.db");
+  store = new MailboxStore(dbPath);
+  app = await buildServer({ port: 0, bind: "127.0.0.1", dbPath }, store);
+  await app.listen({ host: "127.0.0.1", port: 0 });
+  const addr = app.server.address();
+  if (!addr || typeof addr === "string") throw new Error("no address");
+  baseUrl = `http://127.0.0.1:${addr.port}`;
+});
+
+afterEach(async () => {
+  await app.close();
+  store.close();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+async function call(
+  method: string,
+  path: string,
+  init: { headers?: Record<string, string>; body?: unknown } = {},
+): Promise<{ status: number; body: unknown }> {
+  const headers: Record<string, string> = { Accept: "application/json", ...(init.headers ?? {}) };
+  let body: string | undefined;
+  if (init.body !== undefined) {
+    headers["Content-Type"] = "application/json";
+    body = JSON.stringify(init.body);
+  }
+  const res = await fetch(`${baseUrl}${path}`, { method, headers, body });
+  const text = await res.text();
+  return { status: res.status, body: text.length ? JSON.parse(text) : null };
+}
+
+describe("REST surface", () => {
+  it("/health is anonymous", async () => {
+    const r = await call("GET", "/health");
+    expect(r.status).toBe(200);
+    expect(r.body).toMatchObject({ status: "ok", dbPath });
+  });
+
+  it("POST /v1/send requires X-Mailbox", async () => {
+    const r = await call("POST", "/v1/send", { body: { to: "bob", body: "hi" } });
+    expect(r.status).toBe(400);
+  });
+
+  it("POST /v1/send → /v1/check-inbox round-trip", async () => {
+    const send = await call("POST", "/v1/send", {
+      headers: { "X-Mailbox": "alice" },
+      body: { to: "bob", body: "hi bob" },
+    });
+    expect(send.status).toBe(200);
+    expect(send.body).toMatchObject({ id: expect.any(Number), queuedAt: expect.any(String) });
+
+    const peek = await call("GET", "/v1/peek?name=bob");
+    expect(peek.status).toBe(200);
+    expect(peek.body).toMatchObject({ pending: 1 });
+
+    const check = await call("POST", "/v1/check-inbox?name=bob", {
+      headers: { "X-Mailbox": "bob" },
+    });
+    expect(check.status).toBe(200);
+    expect(Array.isArray(check.body)).toBe(true);
+    const arr = check.body as Array<{ from: string; body: string }>;
+    expect(arr).toHaveLength(1);
+    expect(arr[0]!.from).toBe("alice");
+    expect(arr[0]!.body).toBe("hi bob");
+
+    const peekAfter = await call("GET", "/v1/peek?name=bob");
+    expect(peekAfter.body).toMatchObject({ pending: 0, oldestAt: null });
+  });
+
+  it("POST /v1/check-inbox rejects mismatched X-Mailbox", async () => {
+    await call("POST", "/v1/send", {
+      headers: { "X-Mailbox": "alice" },
+      body: { to: "bob", body: "x" },
+    });
+    const wrong = await call("POST", "/v1/check-inbox?name=bob", {
+      headers: { "X-Mailbox": "alice" },
+    });
+    expect(wrong.status).toBe(403);
+  });
+
+  it("/v1/list and /v1/peek are anonymous", async () => {
+    await call("POST", "/v1/send", {
+      headers: { "X-Mailbox": "alice" },
+      body: { to: "bob", body: "x" },
+    });
+    const list = await call("GET", "/v1/list");
+    expect(list.status).toBe(200);
+    expect(Array.isArray(list.body)).toBe(true);
+
+    const peek = await call("GET", "/v1/peek?name=bob");
+    expect(peek.status).toBe(200);
+  });
+});