Changelog

Reverse-chronological. Breaking changes flagged BREAKING.

2026-05-15 — Private-beta gate ready (off by default)

The proxy at market.pactnetwork.io/v1/<endpoint>/* now ships an admission middleware that checks Authorization: Bearer pact_beta_… against the api_keys table. The middleware is runtime-flagged via system_flags.beta_gate_enabled; the flag defaults to off, so traffic flows through unchanged today. When the flag is flipped on (separate changelog entry on that date), unauthenticated callers will start receiving 403 { "error": "pact_auth_not_in_beta" }.
New intake at pactnetwork.io: a one-minute application form replaces the email-only request flow. We reply within 24 hours. Approved applicants get a pact_beta_… Bearer key, returned once at issuance.
The previous “email/Telegram us to get a key” path still works as a fallback, but the form is the fast path.
Signature verification on /v1/:slug/* still runs after the gate — this is purely an admission layer, not a replacement for verifyPactSignature.
Apply now and we’ll have your key issued before the flip. See Applying for access.

BREAKING for pact pay users. pact pay and pact approve now sign with pay.sh’s active account instead of a separate pact-managed keypair. The CLI reads ~/.config/pay/accounts.yml to find the active account, then shells out to pay account export <name> - to retrieve the keypair (one Keychain auth prompt per session on macOS; ~5 min cache).
Single agent identity: the wallet that pays the merchant is the wallet that holds the pact approve allowance and receives refunds. Fund one wallet, not two.
The bare pact <url> gateway flow is unchanged — still uses the pact-managed wallet at ~/.config/pact/<project>/wallet.json. Only the pact pay and pact approve paths flipped.
Resolution order: PACT_PRIVATE_KEY env var → pay’s active account → throw with message naming both options.
New summary line [pact] wallet: pay/<name> (xxxx…yyyy) shows which pay account signed when a payment was attempted.
The cli_internal_error: "Attempt to debit an account but found no record of a prior credit" failure mode from 0.2.x — caused by the empty pact-managed wallet — is fixed in 0.3.0 because pact approve now debits from pay’s funded account directly.
Migration: if you previously granted an allowance from the pact-managed wallet, pact revoke still works against the legacy wallet (legacy fallback). Re-run pact approve once on 0.3.0 to grant from pay’s account; the old grant becomes inert as soon as you stop topping up the legacy wallet.

Distribution collapsed from a 5-platform native binary matrix (@q3labs/pact-cli-{linux,darwin,windows}-{x64,arm64} ~125 MB total) to one tarball containing a Node-compatible JS bundle at dist/pact.js (~340 kB compressed, ~1.7 MB unpacked).
npm i -g @q3labs/pact-cli now installs one package that runs on any host with Node 18+. No optionalDependencies, no platform sub-packages, no os/cpu pinning.
Built with bun build --target=node --format=esm; bun’s bundler still inlines bundled assets (e.g. SKILL.md via with { type: "text" }) at build time.
Internal: pay-shell.ts swapped Bun.spawn for node:child_process spawn so the bundle runs cleanly under Node. Test injection point added (PayShellFn) — tests don’t touch the real pay binary.

DEFAULT_FACILITATOR_URL corrected from https://facilitator.pact.network (a non-existent domain) to https://facilitator.pactnetwork.io (the brand domain shared with api.*, indexer.*, dashboard.*, market.*).
Effect of the prior typo: every pact pay invocation in 0.2.3–0.2.6 hit ENOTFOUND on the coverage side-call. Coverage was never recorded on the pay.sh path; the upstream call still completed because pay had already settled with the merchant directly. The [pact] summary reported (coverage not recorded: facilitator unreachable — Unable to connect…).
Workaround for anyone still pinned to 0.2.6: export PACT_FACILITATOR_URL=https://facilitator.pactnetwork.io.
0.2.7 was tagged but never published to npm — the publish run hit an unrelated NPM token issue. The fix landed in 0.2.8 alongside the distribution collapse.

Solana program pact-market-pinocchio deployed to mainnet at 5bCJcdWdKLJ7arrMVMFh3z99rQDxV785fnD9XGcr3xwc.
Off-chain stack (public API, indexer, settler) live in pact-network-prod GCP project, region asia-southeast1.
Settler is idle — waiting on on-chain bootstrap.

Renamed and re-scoped the contract layer: Pact Network is the protocol, Pact Market is one curated interface on top.
API path renaming: v1 is the current public surface.

BREAKING: error classification split into client_error and server_error. SDKs that read X-Pact-Classification need to handle the new values.
Settler instructions updated to expect the finer-grained label.

Not tracked here. Anything testnet or demo-only is out of scope for this changelog. Mainnet v1 is the cut.