v1.76.7

sluis v1.76.7

Image	ghcr.io/truvity/sluis/sluis:1.76.7
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.76.7
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.76.7
Chart	oci://ghcr.io/truvity/charts/sluis:1.76.7
TypeScript	@truvity/sluis@1.76.7 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.76.7

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.76.7_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.76.7_linux_arm64.zip,
sluis-slack_1.76.7_linux_arm64.zip, sluis-google_1.76.7_linux_arm64.zip,
sluis-cloudflare_1.76.7_linux_arm64.zip and
sluis-backup_1.76.7_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Features

• dbf0a6e: feat(cloudflare): a preset can be on-demand only with store: none (@excavador)
• 667e9f0: feat(sluisctl): cloudflare token and r2 take --no-cache (@excavador)
• 56958c3: feat(deploy): external blobs can mint their credentials from a Cloudflare preset (@excavador)

Other

• 6af755d: style(deploy): wrap long lines in the blob preset code (@excavador)