v0.3.0

Features

• Add frozen v1 machine contracts for sf cms info, bulk workspace export, and create-only workspace import, including deterministic envelopes, statuses, diagnostics, provenance, and exit codes.
• Add strict all-workspace export preflight, deterministic aggregate results, and opaque external-reference correlation for evidenced CMS content identities.
• Add verified package manifests, exact-byte SHA-256 integrity checks, create-only import planning/application, CMS-owned reference rewriting, and durable mutation journals with ownership-uncertain recovery semantics.
• Document the supported v0.3.0 Salesforce CLI subprocess integration boundary and package contract.

Bugfixes

• Reject workspace export manifests that claim complete while authoritative evidence shows omissions, failed or rejected variants, count inconsistencies, relevant warnings, or unresolved/unsupported references; UNSUPPORTED_WILDCARD alone remains compatible with complete.
• Prevent contradictory manifests from bypassing --allow-partial or reaching org access, and bind source workspace identity across manifest provenance and external references.
• Bind bulk export selection/summary counts and envelope status to authoritative workspace result rows.
• Install and invoke the tested Salesforce CLI from the package dependency while isolating subprocess state so clean CI and local environments exercise the authoritative command boundary reliably.
• Harden workspace resolution, output collision handling, filesystem package validation, redaction, pagination, and import conflict checks.

Chores

• Add authoritative Salesforce CLI subprocess contract tests and expanded contract/service/command coverage.
• Restrict published package contents to compiled runtime files, messages, license, and README; validate that test bypasses and CHANGELOG.md are not shipped.
• Refresh the registry-only lockfile and release metadata for v0.3.0.

Full Changelog: v0.2.0...v0.3.0