0.11.0

🎉 Highlights

This release brings Entra ID Phase 2 with auth-code + PKCE and Microsoft Graph, adds Service Bus message sessions, lands Cosmos DB TTL and scoped ADLS SAS authorization, and continues the cross-repo convergence with the floci-aws baseline. Also lands release parity infrastructure matching the floci-aws 1.6.0 pattern.

🔐 Entra ID Phase 2: auth-code + PKCE + Microsoft Graph

Entra ID moves to Phase 2 (#143), adding the authorization-code + PKCE grant flow and a Microsoft Graph slice. Combined with the OIDC token issuance from 0.7.0 and Managed Identity from 0.9.0, the Azure identity stack is now genuinely complete for local testing:

• Machine-to-machine auth (Managed Identity + IMDS)
• OIDC token issuance
• User-facing auth flows (auth-code + PKCE)
• Microsoft Graph API surface

Applications that authenticate users via Entra ID and query Graph for profile or organization data can now complete their flows locally, without a real Azure tenant.

🚌 Service Bus: message sessions

Message sessions support lands (#190). Real Service Bus patterns using session-based ordering — one of the most-requested Service Bus features for enterprise messaging — now work locally. Combined with the subscription rules and topic filters from 0.10.0, Service Bus covers the fan-out, filtering, and session-based ordering patterns real workloads use.

🗃️ Cosmos DB: TTL + ETag conditions + correlated EXISTS

Three coordinated Cosmos DB improvements:

• Container DefaultTimeToLive (TTL) with per-document overrides (#141)
• Item ETag conditions enforced for optimistic concurrency (#167)
• Correlated EXISTS queries evaluated correctly (#168)

Between these and the custom indexing policies from 0.10.0, Cosmos DB conformance is meaningfully better for real-world workloads.

🔒 Scoped ADLS SAS authorization

Scoped ADLS SAS authorization is now enforced (#158). Applications relying on SAS tokens to grant scoped access — a common pattern for secure inter-service data sharing — now behave correctly.

🔄 Cross-repo convergence continues

Four convergence PRs align floci-az with the floci-aws baseline 0142dc4:

• DNS and TLS clusters (#177)
• Docker cluster (#178)
• Storage cluster (#180)

Matches the same convergence work done in floci-gcp 0.6.0. Groundwork for the shared floci-core extraction across the emulator family.

🚀 Release infrastructure

Release parity, one-button release cut, and the -compat image (#188) match the floci-aws 1.6.0 release infrastructure. All three emulators now share consistent release automation.

🪣 Storage conformance pass

Three coordinated storage improvements:

• Service-properties XML served for table, queue, and blob (#134)
• Upload HTTP properties persisted (#166)
• Azure SQL image replaced after Microsoft retired the SQL Edge image (#139)

The SQL Edge replacement is particularly worth noting — Microsoft's retirement of the image was blocking new Azure SQL deployments in floci-az, and this restores functionality.

🐘 PostgreSQL: azurerm 3.x and 4.x compatibility

PostgreSQL returns 202 with Location headers so both azurerm 3.x and 4.x Terraform providers apply correctly (#135). Closes a Terraform-provider-version-specific compatibility gap.

🌐 Functions and Entra: quality-of-life

• Functions: deployment packages larger than 20 MB now accepted (#196)
• Entra: EntraStore participates in /_admin/reset (#195), so global reset actually wipes identity state

✨ New Features

Entra ID / Service Bus / Cosmos DB / ADLS

• feat(entra): Entra ID Phase 2 — auth-code + PKCE grant + Microsoft Graph slice by @hectorvent in #143
• feat(servicebus): support message sessions by @hectorvent in #190
• feat(cosmos): container DefaultTimeToLive (TTL) with per-document overrides by @thomhurst in #141
• feat(adls): enforce scoped ADLS SAS authorization by @snazy in #158

Release infrastructure

• feat(release): release parity, one-button release cut, and the -compat image by @hectorvent in #188

🐛 Bug Fixes

Cosmos DB

• fix(cosmos): enforce item ETag conditions by @thomhurst in #167
• fix(cosmos): evaluate correlated EXISTS queries by @thomhurst in #168

Blob / Storage

• fix(blob): persist upload HTTP properties by @hectorvent in #166
• fix(storage): serve service-properties XML for table, queue, and blob by @hectorvent in #134

PostgreSQL / SQL / Functions / Entra

• fix(postgres): answer 202 with Location so azurerm 3.x and 4.x both apply by @Ali-Shaikh in #135
• fix(sql): replace retired Azure SQL Edge image by @hectorvent in #139
• fix(functions): accept deployment packages larger than 20 MB by @hectorvent in #196
• fix(entra): make EntraStore participate in /_admin/reset by @hectorvent in #195

Convergence

• fix(dns, tls): converge DNS and TLS clusters on floci-aws baseline 0142dc4 by @hectorvent in #177
• fix(docker): converge Docker cluster on floci-aws baseline 0142dc4 by @hectorvent in #178
• fix(storage): converge storage cluster on floci-aws baseline 0142dc4 by @hectorvent in #180

Core

• fix(core): omit Content-Type on bodyless error responses by @hectorvent in #185

🚀 Performance

• perf(docker): stop duplicating the native binary into a second image layer by @hectorvent in #187

Full Changelog: 0.10.0...0.11.0