EnvChain changelog

# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.1.0] - 2026-05-15

### Added

#### External secret-store providers - New `envchain-providers` crate with adapters for eight external secret stores: HashiCorp Vault (KV v1/v2, token + AppRole, namespace-aware), AWS Secrets Manager (IAM static credentials or default credential chain, JSON-object secret expansion), Azure Key Vault (OAuth2 client credentials with token caching and 429/Retry-After handling), GCP Secret Manager (service account JSON or Application Default Credentials with RS256 JWT exchange), 1Password (Connect server with `op` CLI fallback), Doppler (workspace > project > config), Infisical (project + environment slug), and Bitwarden Secrets Manager (machine-account access token exchange). - One provider per vault: linking a vault to a provider opens a scope picker for the provider's native project/path layer (Doppler project, Vault mount + path, 1Password vault, Infisical workspace, AWS path prefix, Azure vault URL, GCP project + prefix, Bitwarden project). - Live-proxy resolution: secrets resolved on-demand at injection time without local copies. - Two-way sync (pull, push, both) with diff computation, per-key continue-on-error semantics, and a per-key failure report.

#### Environment-aware sync - Provider environments map to EnvChain environment tags via `EnvironmentMapping`. Doppler configs and Infisical environment slugs are first-class native environments; 1Password (tags), Bitwarden, AWS, GCP, Azure, and Vault use documented naming conventions to derive environments. - A single provider link can hydrate many environment-tagged variables in one vault, and mappings are reusable across vaults. - Provider environments are auto-mapped to same-named EnvChain environment tags by default when a link is created; the mapping remains fully editable. - Each link records an EnvChain project tag (`envchain_project_tag`) that determines which local project pulled secrets are filed under. This is kept distinct from the external provider's own project identifier and never conflated.

#### Read-only links - A vault-to-provider link can be marked read-only, restricting it to PULL (cloud -> local) only. PUSH and BOTH sync directions are rejected, and user-initiated item mutations in that vault are blocked locally. The flag is switchable after link creation.

#### Conflict resolution - Bidirectional sync detects per-key, per-environment conflicts using constant-time secret comparison (no value logging). - Per-conflict prompt-driven resolution with Local / Remote / Custom strategies, keyboard navigation (arrow keys, L/R/C shortcuts, Enter), masked value reveals, and an "N of M" live progress counter.

#### Credential storage - Provider auth credentials are storable in either the OS keychain (macOS Security Framework; Windows / Linux backends scaffolded) or the encrypted SQLCipher database, user-selectable per provider link. - All in-memory secret material uses `zeroize::Zeroizing` wrappers; `ProviderCredentials` and `SecretValue` derive `ZeroizeOnDrop`. - Threat-model and per-provider storage-recommendation document at `docs/providers/credential-storage.md`.

#### Tauri bridge - 13 new Tauri commands: `providers_list_kinds`, `provider_authenticate`, `provider_save_creds`, `provider_load_creds`, `provider_delete_creds`, `provider_list_scopes`, `provider_list_environments`, `provider_link_vault`, `provider_get_link`, `provider_unlink_vault`, `provider_resolve_secret`, `provider_plan_sync`, `provider_apply_sync`. All commands gated behind the existing master-unlock + license guards. - Strongly-typed TypeScript bindings and Zod schemas under `src/lib/providers/`. - Four new SQLite migrations: `V002__provider_credentials.sql`, `V003__vault_provider_links.sql`, `V004__provider_link_read_only.sql`, and `V005__provider_link_envchain_project_tag.sql`.

#### Frontend - Four new React components under `src/components/providers/`: provider picker modal, four-step credentials and scope wizard, sync panel, and conflict resolution modal. - Two new Zustand stores: `useProviderLinkStore` (wizard state, link flow) and `useSyncStore` (plan, resolutions, conflict cursor). - Three new oklch design tokens (`--color-conflict`, `--color-conflict-subtle`, `--color-conflict-fg`) with light and dark variants. - UI specification document at `docs/providers/ui-spec.md`. - Accessibility: `aria-checked` on provider tiles, `role="radiogroup"`, focus management on dialog open/close, `aria-live="polite"` on conflict progress, full keyboard navigation in the conflict modal.

#### Testing and CI - 62 Rust unit tests (httpmock fixtures for all eight providers plus sync-engine coverage) and 28 integration tests gated behind `ENVCHAIN_INTEGRATION=1`. - New GitHub Actions workflow `.github/workflows/provider-integration.yml` boots Vault, LocalStack, and Infisical via docker-compose, runs the integration suite, and uploads logs on failure. Marked `continue-on-error: true` for the first iteration. - `crates/providers/tests/docker-compose.yml` and shared test helpers under `crates/providers/tests/common/`. - 299 vitest tests covering the new components, stores, and helpers (test files under `src/tests/providers/`).

### Changed - Workspace, package, and Tauri configuration versions bumped from 1.0.0 to 1.1.0 (`envchain-license` remains independently versioned at 0.1.0). - `ConflictResolutionModal` uses the Tauri-native `ask()` dialog from `@tauri-apps/plugin-dialog` instead of `window.confirm` for the unresolved-close prompt.

---

## [Unreleased]

### Added - Bootstrap repository structure with Tauri 2.10.x + Rust + React 19/Vite/TS - CI workflows for macOS builds, signing, notarization, and release publishing - Workspace structure with app, core, daemon, cli, and license crates - Frontend stubs for main, settings, onboarding, and license windows - Placeholder icons and entitlements configuration

### TODO - Core encryption and database implementation (rust-core-agent) - Frontend UI and window implementation (frontend-agent) - Daemon service for background sync (infra-agent) - CLI command-line interface (cli-agent) - License verification integration (license-agent) - JavaScript and Python SDKs (sdk-agent)

---

> Add notes for each release in the [Unreleased] section above. > When releasing, move [Unreleased] changes to a new [X.Y.Z] section with today's date.

# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Added - Bootstrap repository structure with Tauri 2.10.x + Rust + React 19/Vite/TS - CI workflows for macOS builds, signing, notarization, and release publishing - Workspace structure with app, core, daemon, cli, and license crates - Frontend stubs for main, settings, onboarding, and license windows - Placeholder icons and entitlements configuration

### TODO - Core encryption and database implementation (rust-core-agent) - Frontend UI and window implementation (frontend-agent) - Daemon service for background sync (infra-agent) - CLI command-line interface (cli-agent) - License verification integration (license-agent) - JavaScript and Python SDKs (sdk-agent)

---

> Add notes for each release in the [Unreleased] section above. > When releasing, move [Unreleased] changes to a new [X.Y.Z] section with today's date.