0.7.0

🎉 Highlights

This release brings STS downscoped token exchange, lands a substantial GCS conformance pass (preconditions, CORS, metadata, resumable uploads), and adds Firestore write preconditions and transaction conflicts. The one-button release cut infrastructure joins its floci-aws counterpart. Focused release on getting the fundamentals right.

🔐 STS: downscoped token exchange

Downscoped token exchange is now supported (#115). This enables the security-recommended pattern of minting short-lived, permission-limited tokens from broader-scope credentials — commonly used by applications that need to hand off restricted access to lower-trust components. Combined with the generateAccessToken and service account authentication from 0.6.0, floci-gcp's auth story is meaningfully more complete for real-world security patterns.

🪣 GCS conformance pass

Five coordinated GCS improvements land this cycle:

• Object preconditions enforced atomically (#94), so conditional writes behave correctly under concurrent modification
• Bucket CORS configuration enforced on preflight and object reads (#101), unblocking browser-based workloads
• Custom object metadata persisted on upload paths (#120), so metadata set at upload time round-trips as expected
• x-goog-meta headers emitted from the same generation as the downloaded bytes (#123), so metadata and content stay consistent
• Resumable upload chunk handling corrected (#127), continuing the resumable-upload work from 0.4.0

Between these and the earlier resumable/URI-encoding/service-account fixes, GCS behavior is meaningfully closer to real Google Cloud Storage.

🔄 Firestore: preconditions and transaction conflicts

Firestore write preconditions and transaction conflicts are now enforced (#114). Applications using Firestore's optimistic concurrency control — commit-if-not-modified, transactional writes — now behave correctly. Previously, conflicting writes could silently succeed rather than failing with the expected precondition error.

🚀 Release infrastructure

One-button release cut from main (#118), matching the floci-aws 1.6.0 release infrastructure. Cutting a release now requires fewer manual steps, and consistency across the multi-repo family improves.

✨ New Features

• feat(sts): add downscoped token exchange by @snazy in #115
• feat(release): one-button release cut from main by @hectorvent in #118

🐛 Bug Fixes

GCS

• fix(gcs): enforce object preconditions atomically by @electrum in #94
• fix(gcs): enforce the bucket CORS configuration on preflight and object reads by @electrum in #101
• fix(gcs): persist custom object metadata on upload paths by @electrum in #120
• fix(gcs): emit x-goog-meta headers from the same generation as the downloaded bytes by @electrum in #123
• fix(gcs): correct resumable upload chunk handling by @electrum in #127

Firestore

• fix(firestore): enforce write preconditions and transaction conflicts by @electrum in #114

Full Changelog: 0.6.0...0.7.0