v0.3.1

Changelog

• 46b3e18 feat(cli): add --batch-idle to flush upload queue during long builds

---

Released by GoReleaser.

v0.3.0

Changelog

• a6257da bump npm audit packages, resolve peer dep errors
• 97afab4 feat(cli): named pins with revision retention
• 8b29117 feat(schema): upstream registry, named pins, detach + provenance columns
• afabcc2 feat(web): /upstreams reordering, duration TTLs, enforced sections, card polish
• 7b16182 feat(web): nix.conf snippet toggles + admin-flagged Nix-default upstreams
• b190ef1 feat(web): rework /upstreams editing UX
• 5c91aa4 feat(web): upstream keys/TTLs in nix.conf snippets; mandatory trust fields
• e30be81 feat(web): upstream trust registry, trust-tier authz, closure-safe removal, named pins, edge coherence
• 05eaf6d feat: OIDC group-claim membership sync module
• f99d50b feat: activation helpers and guards
• 8cdcf94 feat: add groups, group_member, permission_grant tables
• c000aaa feat: add nimbus gc claim namespace to attic JWTs
• 7a5b727 feat: add user.status column (pending/active)
• a8f4eed feat: admin-only GC token scope, restoring least-privilege API-triggered GC
• d72f127 feat: bound token minting by effective access, full bit set
• 612d1ca feat: creator full-control grant; grants follow rename, cleared on destroy
• 3072993 feat: effective-access loader, route guards, audit helper
• babac49 feat: effective-access union, scope bounding, scope options
• 03cad2f feat: enforce effective permissions across admin UI, accept gc claim
• dc05418 feat: grant-based dashboard visibility, admin-only nav, friendly 403 page, hide emails from non-admins
• 30a0674 feat: groups admin UI with membership, OIDC mapping, grants
• 8ddc9a6 feat: pending wall page and activation enforcement
• 2e6c201 feat: per-cache access management on settings page
• e234626 feat: per-user direct grants and membership view
• 4ab3d5f feat: populate user status, auto-activate via OIDC group
• dd7e115 feat: read-only root proxy endpoint with proxy-key re-signing
• 3248757 feat: root-proxy resolution, readable-set logic, proxy keypair
• bd097e8 feat: shared unified-endpoint card with copy fields, on overview + cache pages
• c73755d feat: show unified proxy endpoint + public key on dashboard
• 9323bbb feat: suspend tokens while their owner is deactivated
• a2cdea8 feat: sync OIDC/CF-Access group claims to local groups on login
• 401b031 feat: toast on unauthorized action instead of navigating to the error page
• 52f7cb2 feat: token scope picker bounded by effective permissions
• 6efb40f feat: trusted upstreams — signature verification, TTL-driven revalidation, root fallback, pull-through persistence
• 1de3874 feat: user activation controls on users page
• 7831ed7 fix: OIDC group sync hook never fired — better-auth hook paths are route templates
• a5e71c1 fix: only CF Access sessions route sign-out through the Access logout
• bedc88d fix: poll deployment version so stale tabs reload after deploys
• de148d2 fix: subject ids containing colons were truncated in cache access form
• 25ee76f perf: index root-proxy hash lookups, negative-cache absent paths
• c690582 refactor+feat: permission-layer cleanup, central activation wall, access UX overhaul
• e21f91a refactor: apply simplify review — proxy D1 efficiency, shared guards and metadata
• 45ee09e refactor: shared grant-row helpers with full-control preset
• 85a5e98 refactor: simplify per-cache permissions — drop cc/cq/gc from grant UIs, open cache creation, admin-only GC
• 68f0e25 style(web): consistent max-w-6xl page width; card surfaces on /upstreams

---

Released by GoReleaser.

v0.2.0

Changelog

• e043fd9 add delete token permission
• 80ad5c2 attic-compatible push flags for nix-fast-build
• 7d841f3 auth: add better SSO user link support
• eb6b1f4 auth: generalize SSO providers behind a single registry
• adb6040 batch watch-store, watch-exec
• e59d5c8 better narinfo invalidation
• 65b3c3d build(deps-dev): bump @cloudflare/workers-types in /web (#1)
• 2b68459 build(deps-dev): bump layerchart from 2.0.0-next.48 to 2.0.1 in /web (#2)
• ab0ec1c cleanup CF access logout
• 5d410e8 cleanup narinfo cache response
• 11c28aa cli: env overrides and bare-hostname endpoints
• 86af45b cli: fail fast when pushing without an auth token
• 7568212 cli: ignore missing paths
• 79a385b cli: layer config-shaped env vars via konf
• 2d05420 cli: nix.conf comment safety, parallel chunk uploads, transport tuning
• e5198d0 cli: only watch well-formed store path names
• f2d3bdb client-side fastCDC for large uploads
• 241564f fix vendorHash for konf
• 6cd568e go fix
• 9f78787 implement better worker caching
• 1531c11 logos go brrr
• 01a2ffe raise zstd level to 12, add wasm decompress
• 03fc4bd share .nar CDN across caches
• b866618 show dedup savings on dashboard
• 6a52729 strip client signing keys
• 91e1f99 web: dedup integrity, SQL-native GC, batched uploads, narinfo prefetch
• 0839bbd web: disable narinfo reference prefetch after cold-cache stampede
• 8534c11 web: extend narinfo TTLs now that invalidation is active
• 6e1f6b0 web: negative narinfo caching, push-time warming, D1 read sessions
• aff64b6 web: split attic protocol surface from the cache engine

---

Released by GoReleaser.

v0.1.0

Changelog

• b40ca31 add goreleaser, golangci-lint config
• 73bd71f clanker readme
• 5b1eb88 cli: add watch-exec to run a command and flush pushes on exit
• a3c394c cli: auto-detect browser vs device-code login
• ca7659f cli: nimbus Go client with attic command parity
• 2f5f4ff cli: pin/unpin, gc trigger, retention and upstream configure flags
• 78d4b6d cli: stream NARs via nix-store --dump
• 6dbe5ae fix gitignore, goreleaser config
• 91ba5e0 format
• 79524a9 go fix
• da6fde6 ignore plan dir
• 556b3d8 repo scaffold
• b76da8d restructure: promote the Go module to the repo root
• 459cce3 style: prettier normalization
• 74a0a0f update CI workflows
• 0fbee60 update worker name, add root redirect
• 3ae83bd web: SvelteKit + Cloudflare Workers scaffold
• ebc2177 web: add shadcn-svelte dashboard-01/login-01 components
• 25c4898 web: admin UI
• cbe544c web: attic reference parity and FastCDC chunk dedup
• 20747dc web: attic-compatible binary-cache API with closure-aware GC
• 4f55e04 web: authentication, admin database, host-based request routing
• 0483b01 web: cache configuration and CLI device auth
• 6128a3f web: follow the browser color-scheme preference via media query
• a763805 web: native upload pipeline
• d8ccafd web: pass narinfo/NAR reads through to upstream caches
• af9f924 web: rebrand as nimbus
• 11d86da web: rebuild the app shell and pages on the block components
• a20b704 web: serve the cache API fully natively, drop the ATTIC_API binding
• 68d76f9 web: server-side NAR compression

---

Released by GoReleaser.