dotfill 1.5.1

The optional Entra identity probe now uses Microsoft's MSAL Windows broker
inside dotfill. This removes the encoded PowerShell helper while keeping
sign-in silent and tokens out of logs, API responses, and browser state.

• Built-in client requests use the Microsoft Graph .default scope; configured
  clients continue to request User.Read.
• Timed-out lookups remain limited to one active worker, including after
  configuration changes. Expired work skips further token and Graph requests;
  retries resume after the original worker exits.
• Broker failures have short diagnostics, including guidance when an app
  registration is missing its broker redirect URI.

Validation: 442 tests passed; wheel and source distribution checks, a publishing
dry run, and an isolated wheel installation smoke test passed.

Full changelog: v1.5.0...v1.5.1

dotfill 1.5.0

Added

• Added an opt-in entra identity detector that silently reads the signed-in
  user's email addresses from Microsoft Graph /me through the Windows sign-in
  broker, with optional client_id and tenant settings.
• Added the detector-neutral email_by_domain source and
  entra.email_by_domain, plus per-detector priority.
• Added background identity detection with session caching and retry backoff;
  the dashboard shows pending detection, identity diagnostics, and the
  detector that supplied each value, and refreshes itself when detection
  finishes or a retry is due.

Changed

• Unresolved identities no longer fail state construction. Dependent derived
  variables are reported as unresolved, and service token-page and test URLs
  resolve independently so only the affected action is disabled.
• The Windows AD detector reads the signed-in user's SAM name and UPN without
  contacting a directory, so they survive directory lookup failures.

Fixed

• Windows AD probe timeouts no longer embed the generated probe script in
  diagnostics.
• Identity polling deadlines now expire when detector configuration changes
  behind a stalled lookup, instead of keeping the dashboard polling forever.
• Retry backoff remains capped during long failure streaks without overflowing
  and repeatedly restarting detector probes.

Full Changelog: v1.4.1...v1.5.0

dotfill 1.4.1

Full Changelog: v1.4.0...v1.4.1

dotfill 1.4.0

Added

• Added explicit user-domain LDAP lookup for Windows AD facts, with validated domain hints and a controlled serverless compatibility fallback.
• Added optional wrapper name/version metadata to run_dotfill(...) and the dashboard version display.

Fixed

• Made repeated derived-default requests idempotent and guarded dashboard row actions while a request is in flight.

dotfill 1.3.2

Fixed

• Fixed import mapping table layout so long variable names and target dropdowns stay inside the import wizard background, with horizontal scrolling only when needed.

dotfill 1.3.1

Fixed

• Fixed --env-path <directory> so it resolves to that directory's .env file instead of treating the directory itself as the target file.
• Fixed import wizard status recomputation so manually mapping a source value to an occupied target with the same value shows No change instead of Replace, while imported values remain masked.

dotfill 1.3.0

Full Changelog: v1.2.0...v1.3.0

dotfill 1.2.0

Full Changelog: v1.1.0...v1.2.0

dotfill 1.1.0

Added

• Added a public service icon registry with documented service icon keys.
• Added bundled service icon symbols for server, database, terminal, shield, search, globe, and lock use cases.

Changed

• Unknown configured service icon names now raise config schema errors instead of rendering as blank icons.
• Frontend icon rendering now falls back to the key icon if a bundled SVG symbol is unavailable.

dotfill 1.0.0

Full Changelog: v0.3.0...v1.0.0