ckb-session-kit 2.0.0 → 2.1.0

package/CHANGELOG.md

@@ -3,6 +3,38 @@
 This project follows [semantic versioning](https://semver.org/). The session lock is
 deployed on CKB **testnet only**; there is no mainnet deployment yet.
 
+## 2.1.0 (2026-11-05)
+
+### Added
+- `fundInSession` and `sendWithSession`: fund a transaction the app built (its
+  own inputs, typed outputs, cell deps and witnesses) from a session without a
+  recipient, with no wallet prompt. The key cell pays the fee (default 2000
+  shannons/KB, `DEFAULT_FUND_FEE_RATE`, the same on every retry). Refused
+  before signing: a session with an on-chain recipient, an input under the
+  owner's lock (owner mode), an outflow over `maxPerTx`. `sendWithSession`
+  retries only when the node names one of the session's own cells as spent, and
+  rethrows any other refusal (the app's own cell taken, an RBF refusal) for the
+  app's loop. For CrowdCell pledges (CKBuilder-projects#6).
+- `deadInputs` exported, `FundedTransaction`, `FundOptions`,
+  `SendWithSessionOptions` types, and `SessionPolicyError` reasons
+  `"session-has-recipient"`, `"owner-lock-input"`, `"app-tx-shape"`.
+- CKB-VM tests of a session-funded pledge against CrowdCell's live testnet
+  scripts (`scripts/fetch-crowdcell.ts` saves them; not committed), and
+  `npm run smoke:fund-pledge`.
+- `npm run smoke:pool-lag`: how long `get_live_cell(include_tx_pool=true)`
+  still shows a just-spent input live, per answering node (mentor review,
+  tracker #47, 3 Nov). On one node (testnet.ckb.dev) the node that took the
+  send never showed the input live (158 polls); on testnet.ckbapp.dev (two
+  backends) only the other backend did, in 13 of 20 sends, for up to about
+  0.5 s. One kept-alive socket does not pin a backend there. Logs and table in
+  docs/SECURITY-EVIDENCE.md.
+
+### Documentation
+- JoyID is accepted as an owner lock but reviewed from its documentation only:
+  its contract is closed source. README and docs/API.md show how an app refuses
+  JoyID owners itself before `openSession` (no option in the kit; no behaviour
+  change).
+
 ## 2.0.0 (2026-11-03)
 
 ### Upgrading from 1.0.0