v1.76.4

sluis v1.76.4

Image	ghcr.io/truvity/sluis/sluis:1.76.4
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.76.4
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.76.4
Chart	oci://ghcr.io/truvity/charts/sluis:1.76.4
TypeScript	@truvity/sluis@1.76.4 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.76.4

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.76.4_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.76.4_linux_arm64.zip,
sluis-slack_1.76.4_linux_arm64.zip, sluis-google_1.76.4_linux_arm64.zip,
sluis-cloudflare_1.76.4_linux_arm64.zip and
sluis-backup_1.76.4_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• ce6070f: feat(policy): compile, the access-model derivation of the policy's tables (@excavador)
• 86e0ee3: feat(edge): cache the public documents at the Cloudflare edge (@excavador)
• f12e891: feat(policy): an empty rung names no lifetime in the compiled policy (@excavador)

Other

• 01883e0: style(policy): index the rung and group loops instead of copying each element (@excavador)