[n13]

Why

npmjs.com only renders the README, and the auto-generated GitHub Release notes for v1.0.0 list PR titles that no longer describe the final change (the PR title said "default to transfer_keep_alive"; the released API makes keepAlive required with no default). A maintained changelog gives integrators one accurate place to read what changed, inside the package and on GitHub.

What changes

• CHANGELOG.md in Keep-a-Changelog style: a full 1.0.0 entry (breaking keepAlive, hedged signatures, ML-DSA-65, the node-reported blockHash fix, the immortal-era warning, docs) and short entries for 0.3.1 back to 0.1.0.
• package.json files includes CHANGELOG.md, so it ships in the tarball from the next release (verified with npm pack --dry-run; test/package.test.js passes).
• README gains a "Changelog" section linking to the file and to GitHub Releases.

No code changes.

[n13]

Reviewer model: GPT-6.1 Sol

Verdict (advisory): Approve

Reviewed the complete diff from 9fb2c2f to dd1fa6dfa651ecb0b1a7607e652d7fb6e2446e74. No blocking findings. The changelog matches the released signing APIs and release history, including the required keepAlive choice, hedged signatures, ML-DSA-65, and node-reported mortal-era block hashes. The package change adds the changelog without removing any runtime files from the allowlist.

Validation:

• Local git diff --check: passed.
• Local npm pack --dry-run --json: confirmed CHANGELOG.md is included (3,409 bytes), alongside the README and package metadata.
• CI at the reviewed head: passed npm test, including 10 Rust tests, the wasm/TypeScript build, and 20 JavaScript tests, including the runtime packaging test.
• The full suite was not repeated locally: the installed wasm-pack executable fails with bad CPU type in executable. Local changelog packaging validation and the successful CI results are separate evidence.

Posted as an advisory comment because the authenticated account authored this PR.