v0.4.3

## Release Notes

### Patch Changes

- fc6bc95: Exclude Workspace-admin-only scopes from the "Recommended" scope preset.

  Scopes that require Google Workspace domain-admin access (`apps.*`,
  `cloud-identity.*`, `ediscovery`, `directory.readonly`, `groups`) now return
  `400 invalid_scope` when used by personal `@gmail.com` accounts. These scopes
  are no longer included in the "Recommended" template, preventing login failures
  for non-Workspace users.

  Workspace admins can still select these scopes manually via the "Full Access"
  template or by picking them individually in the scope picker.

  Adds a new `is_workspace_admin_scope()` helper (mirroring the existing
  `is_app_only_scope()`) that centralises this detection logic.

- 2aa6084: docs: Comprehensive README overhaul addressing user feedback.

  Added a Prerequisites section prior to the Quick Start to highlight the optional `gcloud` dependency.
  Expanded the Authentication section with a decision matrix to help users choose the correct authentication path.
  Added prominent warnings about OAuth "testing mode" limitations (the 25-scope cap) and the strict requirement to explicitly add the authorizing account as a "Test user" (#130).
  Added a dedicated Troubleshooting section detailing fixes for common OAuth consent errors, "Access blocked" issues, and `redirect_uri_mismatch` failures.
  Included shell escaping examples for Google Sheets A1 notation (`!`).
  Clarified the `npm` installation rationale and added explicit links to pre-built native binaries on GitHub Releases.

## Install gws 0.4.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-installer.ps1 | iex"
```

### Install prebuilt binaries into your npm project

```sh
npm install @googleworkspace/cli@0.4.3
```

## Download gws 0.4.3

|  File  | Platform | Checksum |
|--------|----------|----------|
| [gws-aarch64-apple-darwin.tar.gz](https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-aarch64-apple-darwin.tar.gz.sha256) |
| [gws-x86_64-apple-darwin.tar.gz](https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-x86_64-apple-darwin.tar.gz.sha256) |
| [gws-x86_64-pc-windows-msvc.tar.gz](https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-x86_64-pc-windows-msvc.tar.gz) | x64 Windows | [checksum](https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-x86_64-pc-windows-msvc.tar.gz.sha256) |
| [gws-aarch64-unknown-linux-gnu.tar.gz](https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [gws-x86_64-unknown-linux-gnu.tar.gz](https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [gws-aarch64-unknown-linux-musl.tar.gz](https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://github.com/googleworkspace/cli/releases/download/v0.4.3/gws-aarch64-unknown-linux-musl.tar.gz.sha256) |

## Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify):
```sh
gh attestation verify <file-path of downloaded artifact> --repo googleworkspace/cli
```

You can also download the attestation from [GitHub](https://github.com/googleworkspace/cli/attestations) and verify against that directly:
```sh
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
```