v0.5.0

Features

• Added bounded create-only migration workflows for all five component profiles introduced in this release:
  • Email fragments selected by exact typed API name with fresh destination content keys and API names, restricted to the evidenced dependency-free root/section/empty-column shape.
  • Images exported with the explicit --experimental-media opt-in and strict workspace package v2, then imported with --image-map and command contract v2.
  • Web fragments with exact Data Graph prerequisite mappings.
  • Landing-page templates with explicit typed CMS dependencies, Data Graph mappings, and a bounded title fallback when exact API-name lookup returns no match.
  • Landing pages with evidenced image dependencies and exact Data Graph prerequisites.
• Added one-or-many image mapping support. Each map row selects one exact cms/image; multiple rows are validated first and then created sequentially. The exact identity map covers contentKey, apiName, title, and urlName, with explicit preserve, fresh, or server-generated strategies where supported.
• Added image binary transport and multipart CREATE support for GIF, JPEG, PNG, and WebP, including strict media descriptor/file bijection, SHA-256 and MD5 evidence, normalized filenames, metadata readback, and canonical variant verification.
• Added explicit CMS dependency and Data Graph resolution for component workflows. Resolution is destination-workspace scoped, type-qualified, and fail-closed; API-name lookup is primary, while configured targetTitle fallback is used only after an exact API-name query succeeds with zero matches and itself resolves uniquely.
• Expanded sf cms info --json to advertise workspace package v2, import contract v2, experimental media export, bounded email-fragment creation, and image creation capabilities.

Safety and CLI contracts

• All new import profiles are create-only: no update fallback, overwrite, upsert, publication, activation, send, broad deletion, rollback, or automatic retry was added.
• Dry runs validate complete package integrity and destination prerequisites without mutation. Apply requires the explicit --apply flag and a new --report-dir.
• Apply rechecks content-key/API-name availability and all CMS/Data Graph prerequisites immediately before each sequential CREATE, closing the preflight-to-mutation TOCTOU window as far as the supported APIs allow.
• Durable workspace-import-run.json reporting records pending operations before transport, prerequisite resolution, deterministic request identities and hashes, returned IDs, and terminal states. Ambiguous transport or report persistence leaves ownership uncertain and blocks blind retry.
• Added mutually exclusive CLI map flags and frozen contract requirements: --email-fragment-map, --image-map, --web-fragment-map, --landing-page-template-map, and --landing-page-map; image import requires --contract-version 2, while the bounded component profiles remain on contract v1.
• Single-workspace image binaries require --experimental-media; bulk export remains JSON-only and cannot enable media transport.

Bugfixes

• Tightened image content-key validation to the canonical MC plus 26 base32-character form for preserved and fresh keys.
• Fixed image multipart filenames by adding the MIME-appropriate extension when absent and rejecting extensions that conflict with the declared media type.
• Corrected destination missing-content-key handling discovered during live image acceptance. The transport now accepts the evidenced JSforce statusless missing-key error shape while still requiring exact status/message evidence and rejecting unrelated or malformed failures.
• Strengthened canonical image readback checks so apply verifies returned identity, workspace, content type, Draft state, authoring metadata, and the exact variant associated with the created image.
• Addressed migration review findings across component profiles, including stricter exact-key map validation, fail-closed prerequisite handling, title-fallback boundaries, sequential prevalidation, and reporting completeness.

Testing and review closure

• Added comprehensive command, contract, service, and transport coverage for email fragments, image export/import, multipart uploads, web fragments, landing-page templates, and landing pages.
• Added regression coverage for statusless JSforce missing-key responses, exact missing-key status handling, canonical image keys, filename normalization, one/many image plans, TOCTOU rechecks, readback validation, Data Graph resolution, CMS dependency resolution, and title fallback.
• Closed the Phase 4 migration review with focused fixes and a full release verification pass: registry-only lockfile validation, clean install, zero-warning lint, build, full tests, and package validation.

Dependencies and release preparation

• Refreshed the registry-only package-lock.json and applied the non-breaking changes available through npm audit fix --no-workspaces.
• Remaining audit findings are transitive within the Salesforce CLI development dependency tree and require upstream or breaking dependency changes; no forced downgrade was applied.

Full Changelog: v0.4.0...v0.5.0