Build scoped Rider messaging client and patch application dependencies - #81

Summary

• Add scoped messaging client with cached short-lived credentials, pre-expiry refresh, and concurrent issuance sharing.
• Keep permanent API keys off messaging routes; block redirects, use timeouts and sanitized typed errors, never automatically replay messages.
• Forward supported promo/referral/capability registration fields and document SDK compatibility changes.
• Patch Next.js to 16.3.6, MCP SDK to locked 1.32.1, and vulnerable transitive dependencies; align CI and runtime requirement to Node 22.
• Add security-reporting documentation and 28 client tests.

Final dependency review

• Application: 13 reported vulnerable dependency entries before, 0 after.
• Quickstart: 0 before and after.
• Full and production-only npm audits report zero findings as of October 7, 2026.
• SDK has no third-party dependencies; audit findings are not a full security assessment.

Validation

• Clean npm ci on Node 22.
• Full Next.js production build passes with CI-only placeholder configuration.
• 28 client tests and existing cryptographic verification selftest pass.
• AMP, AMP adapter, settle, live-status, host-attestation and attestation-evidence selftests pass. SKIP_LIVE skips the Rider endpoint probe; existing settle selftest still makes an unauthenticated, empty XPay validation request without payment.
• No live messages, payments, npm release or deployment performed.

External check

The Vercel integration on this branch reports an account/deployment block. No attempt was made to bypass the block or change billing. Owner requested merge after review; leave unmerged while any required or unresolved check fails.