• v0.3.0 a5a88de046

    v0.3.0
    All checks were successful
    ci / ci (push) Successful in 1m48s
    ci / msrv (push) Successful in 14s
    release-plz / release-plz (push) Successful in 28s
    release-binaries / binaries (push) Successful in 1m41s
    Stable

    tqwewe released this 2026-09-08 22:16:10 +10:00 | 44 commits to main since this release

    Added

    • [breaking] a project declares the deployment credentials it needs, and no surface ever shows one
    • (ui) the console runs a command, and /admin/commands describes every one
    • (ui) the console browses a projector's rows, and a row links back to the events that built it
    • [breaking] an on latest arm runs once per key per batch, and its invocation records the range it folded

    Fixed

    • (ui) the declarations table keeps its columns, a long effect error clips, and a count reads singular at one

    Other

    • two private items are named rather than linked, so rustdoc denies nothing
    • (projector) a completed rebuild logs how long it took

    Added

    • a project declares the deployment credentials it needs with secret NAME, and hekla resolves each
      from [secrets] in hekla.toml ({ env = "..." } or { file = "..." }) or from
      HEKLA_SECRET_<NAME>. hekla serve refuses to start when a required one is unset, naming every
      missing one at once
    • hekla secrets reports every declared credential, where this machine reads it from, and a short
      fingerprint, and exits non-zero when a required one is unset, so it works as a pre-deploy gate
    • hekla plan reports the same, always present in --json, and --replay counts invocations it
      could not replay because an effect reads a credential this machine has not set
    • /admin/system and /admin/schema list the declared credentials beside the keystore: a name, a
      source and a fingerprint, never a value
    • hekla check warns about a declared credential nothing reads, and about a [secrets] entry naming
      no declaration. It never reads the environment, so it stays a CI gate
    • an on latest arm runs once per key per dispatch batch, at the newest matching position in it,
      and the surviving invocation records the range it folded
    • /admin/effects/{name} reports latest_collapsed, the positions folded into another invocation
      since this process started

    Changed

    • [breaking] an effect arm declaring on latest loads and runs, where the previous release
      refused it at load rather than running it as on
    • an effect's in-flight cap counts units of work rather than positions, so a lane's whole backlog
      collapses to one invocation however long it is
    • schema v9 adds effect_invocation.collapsed_from; rows written before it read back as null, which
      is the same answer as an invocation that folded nothing
    • a transport failure's message now names a credential rather than spelling it. ureq writes the url
      it was given into its own error text, and hekla concatenates that onto the wedge message, so a
      webhook whose whole address is the credential used to reach /status, /admin and the logs on the
      first DNS failure
    • heklang 0.5.0
    Downloads