pi-dispatch v1.3.0

v1.3.0 ships run.secrets (#225) to npm: a trigger can name the secrets one job needs, and the worker resolves them through your own secrets manager on the host, before anything spends. No other job sees them, a wrong reference refuses before a token is minted or a container starts, and the values never touch a log, a record, or the triggers file.

All three packages move together this time, and the receiver is the one to take seriously (#232). A receiver older than 1.2.0 parses a trigger that binds secrets, matches it, and enqueues the job without them: the worker then sees an unarmed job and the container runs with the variables unset on a clean exit. That is a silent no-op, the failure this project is built to refuse. An admin older than 1.3.0 fails the other way, visibly, refusing every trigger write while the file holds a run.secrets entry.

Upgrade action: install worker 1.3.0, receiver 1.2.0 and admin 1.3.0 in the same pass, receiver before you bind the first secret. A fresh /dispatch setup installs the new pins on its own. The version floor is recorded in docs/secrets.md.

Packages: @edgehero/pi-dispatch 1.3.0, @edgehero/pi-dispatch-receiver 1.2.0, @edgehero/pi-dispatch-admin 1.3.0.