- 06f9609: feat(cli): first-run golden path. New public
GET /v1/organizationslists the organizations visible to the caller's credential (an org-scopedpbo_key sees exactly its org, a user credential sees memberships with roles).pgbeam auth loginnow verifies the key against the API before storing it (a rejected key fails the login and stores nothing) and resolves the organization automatically, auto-selecting a single org and prompting a pick among several.orgs listshows live organizations with the active one marked (falling back to saved profiles offline) andorgs switchwith no argument lists and picks interactively.auth status/whoamiverify the credential live when online and print the masked key, method, email, and org, degrading gracefully offline;whoami --helpnow shows its own name. Top-levelpgbeam linkandpgbeam unlinkaliases are registered so every hint that references them works, and the project link is discovered by walking ancestor directories like git.policies creategains the write-safety flagsupdatealready had (--write-mode,--approval-mode,--approval-timeout-seconds,--approval-auto-max-rows,--migration-safety,--table-allowlist,--table-denylist). The "No organization set" error now names the exact dashboard location to copy an org ID, themcp --helpexample shows the real.mcp.jsonstanza, andagents mcp-configexplains all three ways to supply credentials when input is missing.
- 31cb990: feat(byoc): self-host enrollment hardening, optional
expires_aton enrollment create/list and a rotate operation that mints a newpbh_token once and atomically invalidates the old one
- d70bf02: Publish and document the Go SDK (
go.pgbeam.com/sdk). The release pipeline now tags the public mirror atv{version}on a sentinel bump sogo get go.pgbeam.com/sdk@vX.Y.Zresolves through the Go module proxy, and the docs now ship a full quickstart plus examples across the agent-gateway surface (agent credentials, policy profiles, approvals, webhooks, audit logs). Merging this changeset's release PR cuts the first tagged SDK version.