[ty-everett]

Summary

• modernize @bsv/paymail as a strict Node 22 dual-runtime package with unbundled ESM/CommonJS outputs, module-specific declarations, clean public subpaths, exact-tarball consumer checks, and measured browser budgets
• harden Paymail address and SRV handling, compact Bitcoin Signed Message signatures, timeout and header behavior, request validation/sanitization, safe error responses, and local signature verification before outbound ownership discovery
• restore and export ordinal receive support, align negotiation schemas, fix example transaction flows, and remove embedded example credentials in favor of explicit environment configuration
• consolidate deterministic tests and generated API documentation while making full-source coverage honest
• ratchet repository health from 59 to 54 findings by satisfying the Paymail and Paymail example package profiles

This advances the program tracked in #324. It does not close the tracker.

Compatibility and deployment

• @bsv/paymail remains version 2.4.2; this PR does not publish or tag a release
• supported root and client, capability, router, and errors subpaths are preserved
• the root browser condition excludes Express server code
• the Open BSV License Version 6 remains unchanged and was verified in source manifests and all 30 public package tarballs
• the library continues to impose no CORS or CSP policy: public Paymail services remain accessible by default, with allowlists and credentialed-origin behavior configurable at the host application or edge

Validation

• pnpm health:check — 30 controls pass; 54 ratcheted findings; 0 control errors
• pnpm build
• pnpm lint
• pnpm test — including SDK 5,716 passed / 3 skipped and 6,650 conformance vectors
• pnpm --filter docs-site validate — 95 pages and links pass
• pnpm check-versions
• pnpm audit:security — no known vulnerabilities
• pnpm license:check
• pnpm license:pack-check — 30 public tarballs pass
• node scripts/check-sdk-peer.mjs — 33 manifests pass
• Paymail: formatting, zero-warning lint, strict typecheck, 69 tests across 15 suites
• Paymail coverage: 98.02% statements, 88.63% branches, 98.48% functions, 98.11% lines
• Paymail exact-tarball ESM/CommonJS, publint, declaration, and export checks pass
• Paymail browser contract passes: Vite 484,891 raw / 124,317 gzip / 103,877 Brotli; esbuild 330,540 / 114,258 / 97,161

[codecov]

Codecov Report

❌ Patch coverage is 98.72881% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...mailRouter/paymailRoutes/receiveBeefTransaction.ts	92.85%	0 Missing and 1 partial ⚠️
...lRouter/paymailRoutes/receiveOrdinalTransaction.ts	90.90%	0 Missing and 1 partial ⚠️
.../paymailRouter/paymailRoutes/receiveTransaction.ts	90.90%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
2.2% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Maintainer approval-in-substance by ty-everett for exact head 2e64037a5df006638f3accc0d1d7e022f60b504d.

GitHub does not permit a pull request author to submit an APPROVE review on their own PR, so this comment records the requested maintainer review decision before admin merge. I reviewed the complete diff and verified:

• all required CI checks pass, including build/lint/policy, the full test and coverage matrix, CodeQL, dependency review, Socket, browser/mobile platform checks, docs, conformance, repository health, Codecov patch, and merge gate;
• SonarCloud quality gate passes and the PR API reports 0 open or confirmed new-code issues (the 13 reported on the prior head were resolved);
• Paymail local coverage is 100% of executable source lines across 78 tests, with 97.72% branch coverage;
• package build, example typecheck/lint/format, generated docs lint, exact tarball contract, browser contract, repository health, and pnpm audit --audit-level high all pass;
• no unresolved review threads or requested changes exist;
• the package remains public-service friendly: this change does not impose CORS/CSP policy;
• licensing is intentionally unchanged because the repository-wide Open BSV License v6 work is already complete;
• no package version, npm publication, or release tag is included in this PR.

Decision: approved for squash merge at this exact head.