@tiangong-lca/cli 0.0.24 → 0.0.26

package/dist/src/cli.js

@@ -56,6 +56,9 @@ import { runDatasetClassificationApply, runDatasetClassificationAudit, runDatase
 import { runDatasetMaintenanceClearAccount, } from './lib/dataset-maintenance-clear-account.js';
 import { runDatasetMaintenancePlan } from './lib/dataset-maintenance-plan.js';
 import { runDatasetMaintenanceApply } from './lib/dataset-maintenance-apply.js';
+import { freezeDatasetMaintenanceProtected } from './lib/dataset-maintenance-protected-freeze.js';
+import { runDatasetMaintenanceProtected } from './lib/dataset-maintenance-protected-run.js';
+import { sealDatasetMaintenanceProtectedApproval } from './lib/dataset-maintenance-protected-seal.js';
 import { runDatasetMaintenanceVerify } from './lib/dataset-maintenance-verify.js';
 import { runDatasetSourceUploadAttachments, } from './lib/dataset-source-upload-attachments.js';
 function renderMainHelp(dotEnvStatus) {
@@ -131,6 +134,8 @@ Examples:
   tiangong-lca dataset references rewrite --input ./rows.jsonl --from flow:<old-id>@<old-version> --to flow:<new-id>@<new-version> --out-dir /abs/path/to/dataset-rewrite
   tiangong-lca dataset maintenance clear-account --out-dir /abs/path/to/account-clear --json
   tiangong-lca dataset maintenance plan --scope ./maintenance-scope.json --operation merge-support-aliases --out-dir /abs/path/to/dataset-maintenance
+  tiangong-lca dataset maintenance freeze-protected --plan ./maintenance-plan.json --toolchain-evidence ./toolchain.json --expected-project-ref <production-ref> --confirm bafudata@126.com --out-dir /abs/path/to/protected-freeze
+  tiangong-lca dataset maintenance run-protected --plan ./maintenance-plan.json --freeze ./protected-execution-seal.json --approval ./protected-approval.json --out-dir /abs/path/to/protected-run --status-only
   tiangong-lca lifecyclemodel auto-build --input ./lifecyclemodel-auto-build.request.json --out-dir /abs/path/to/lifecyclemodel-run
   tiangong-lca lifecyclemodel validate-build --run-dir /abs/path/to/lifecyclemodel-run
   tiangong-lca lifecyclemodel publish-build --run-dir /abs/path/to/lifecyclemodel-run
@@ -283,6 +288,9 @@ Implemented Subcommands:
   maintenance clear-account Dry-run or clear current authenticated account-owned dataset rows through RLS
   maintenance plan    Build an immutable, RLS-visible row-level maintenance plan
   maintenance apply   Execute an explicitly approved maintenance plan through current-user RLS
+  maintenance freeze-protected Read and freeze one exact production owner-draft plan without admitting or mutating it
+  maintenance seal-protected-approval Record byte-exact human approval entirely offline
+  maintenance run-protected Run or inspect one sealed, one-shot production maintenance execution
   maintenance verify  Read back affected rows and references against the immutable plan
 
 Examples:
@@ -310,21 +318,31 @@ Examples:
   tiangong-lca dataset references refresh-remote --input ./rows.jsonl --out ./rows.refreshed.jsonl --out-dir ./dataset-reference-refresh --help
   tiangong-lca dataset maintenance clear-account --out-dir ./account-clear --json --help
   tiangong-lca dataset maintenance plan --scope ./maintenance-scope.json --operation merge-support-aliases --out-dir ./dataset-maintenance --help
+  tiangong-lca dataset maintenance freeze-protected --help
+  tiangong-lca dataset maintenance seal-protected-approval --help
+  tiangong-lca dataset maintenance run-protected --help
 `.trim();
 }
 function renderDatasetMaintenanceHelp() {
     return `Usage:
-  tiangong-lca dataset maintenance <clear-account|plan|apply|verify> [options]
+  tiangong-lca dataset maintenance <clear-account|plan|apply|freeze-protected|seal-protected-approval|run-protected|verify> [options]
 
 Actions:
   clear-account Dry-run or delete current authenticated account-owned lifecyclemodels, processes, flows, sources, and contacts.
   plan    Build an immutable maintenance plan from a scope manifest, visible remote snapshot, dependency impact report, and intended operation.
-  apply   Execute or durably admit an approved plan through current-user RLS and platform dataset command paths; never bypass RLS.
+  apply   Execute or durably admit an ordinary approved plan through current-user RLS and platform dataset command paths.
+  freeze-protected Re-read the exact production owner-draft census/support/50 derivatives and generate an unapproved freeze request.
+  seal-protected-approval Record a byte-exact human response into an approval artifact with no authentication or network access.
+  run-protected Run or inspect one sealed production execution with one-shot admission and terminal derivative proof.
   verify  Re-fetch rows, references, or derivative request state and report passed, pending, or failed independently of apply.
 
 Safety:
-  plan and verify are read-only.
+  plan, verify, and freeze-protected are read-only; seal-protected-approval is local-only.
   apply is commit-only and requires --commit, the exact plan SHA-256 via --approve-plan, and the current account email via --confirm.
+  A sealed production merge-support-aliases execution must use run-protected; apply is not its fallback.
+  freeze-protected is production-only and never calls preflight, gate, admission, execution, or mutation RPCs.
+  seal-protected-approval only records the exact human-approved bytes; it never authenticates, connects, or submits execution.
+  run-protected is production-only: authenticated owner context plus server-side actor/user_id/state_code=0 and exact-plan closure fences protect writes; RLS remains a defense on public and independent-read surfaces. It never falls back to dev, a legacy alias RPC, or a second admission POST.
 
 Required Artifact Contract:
   - maintenance-plan.json
@@ -334,13 +352,17 @@ Required Artifact Contract:
   - dry-run-report.json
   - commit-report.json
   - readback-verify-report.json
+  run-protected uses a separate immutable protected-execution seal, submission marker, append-only status ledger, and terminal report.
 
 Examples:
   tiangong-lca dataset maintenance clear-account --out-dir ./account-clear --json
   tiangong-lca dataset maintenance clear-account --commit --confirm user@example.com --out-dir ./account-clear
-  tiangong-lca dataset maintenance plan --scope ./maintenance-scope.json --operation merge-support-aliases --out-dir ./dataset-maintenance
+  tiangong-lca dataset maintenance plan --scope ./maintenance-scope.json --operation repair-references --out-dir ./dataset-maintenance
   tiangong-lca dataset maintenance plan --scope ./derivative-rebuild-scope.json --operation rebuild-derivatives --out-dir ./derivative-rebuild
   tiangong-lca dataset maintenance apply --plan ./dataset-maintenance/maintenance-plan.json --commit --approve-plan <sha256> --confirm user@example.com
+  tiangong-lca dataset maintenance freeze-protected --plan ./maintenance-plan.json --toolchain-evidence ./toolchain.json --expected-project-ref <production-ref> --confirm bafudata@126.com --out-dir ./protected-freeze
+  tiangong-lca dataset maintenance seal-protected-approval --freeze ./protected-freeze/protected-execution-freeze.json --approval-request ./protected-freeze/protected-approval-request.json --human-approval ./human-approval.txt --approve-freeze-file <sha256> --approve-request <sha256> --approve-text <sha256> --confirm bafudata@126.com --approved-at <iso> --out-dir ./protected-approval
+  tiangong-lca dataset maintenance run-protected --plan ./maintenance-plan.json --freeze ./protected-execution-seal.json --approval ./protected-approval.json --out-dir ./protected-run --status-only
   tiangong-lca dataset maintenance verify --plan ./dataset-maintenance/maintenance-plan.json --out-dir ./dataset-maintenance/verify
 `.trim();
 }
@@ -373,6 +395,7 @@ Behavior:
   Commit-only. The command rejects dry-run mode, a missing --commit flag, a plan hash mismatch,
   or a confirmation email that does not match the current authenticated account.
   For rebuild-derivatives, success means guarded admission is queued; it never means derivatives completed.
+  Sealed production merge-support-aliases executions must use run-protected; this command is not a fallback.
 
 Options:
   --plan <file>          Immutable maintenance-plan.json
@@ -386,6 +409,102 @@ Options:
 Outputs include approval-record.json and commit-report.json alongside an append-only action or admission ledger.
 `.trim();
 }
+function renderDatasetMaintenanceFreezeProtectedHelp() {
+    return `Usage:
+  tiangong-lca dataset maintenance freeze-protected --plan <file> --toolchain-evidence <file> --expected-project-ref <ref> --confirm <email> --out-dir <dir> [options]
+
+Behavior:
+  Authenticates directly to the explicitly confirmed production project and re-reads the complete
+  owner-draft account census, six support snapshots, projected reference closure, and the stable
+  23-flow + 27-process derivative snapshot set. It writes a canonical protected freeze and an
+  unapproved byte-exact human approval request. It never emits an approval artifact.
+
+Required:
+  --plan <file>                 Ready owner-draft merge-support-aliases maintenance plan
+  --toolchain-evidence <file>   Canonical released DB/CLI/root-integration evidence
+  --expected-project-ref <ref>  Explicit production Supabase project ref
+  --confirm <email>             Exact authenticated owner email
+  --out-dir <dir>               New private immutable artifact directory
+
+Options:
+  --page-size <n>               Complete account scan page size, 1-5000
+  --timeout-ms <n>              Positive authentication/read timeout in milliseconds
+  --json                        Print compact JSON
+  -h, --help
+
+Remote safety:
+  This command uses only authenticated table reads and cmd_dataset_derivative_rebuild_snapshot.
+  Preflight, gate, admission, execution, save-draft, delete, state change, and all mutation calls are zero.
+`.trim();
+}
+function renderDatasetMaintenanceSealProtectedApprovalHelp() {
+    return `Usage:
+  tiangong-lca dataset maintenance seal-protected-approval --freeze <file> --approval-request <file> --human-approval <file> --approve-freeze-file <sha256> --approve-request <sha256> --approve-text <sha256> --confirm <email> --approved-at <iso> --out-dir <dir> [options]
+
+Behavior:
+  Records a human-provided approval text only when every UTF-8 byte, freeze-file hash, request hash,
+  text hash, account, and canonical timestamp matches the unapproved request. It writes the approval
+  artifact needed by a later, separate run-protected command; it does not submit that execution.
+
+Required:
+  --freeze <file>               Canonical protected freeze generated by freeze-protected
+  --approval-request <file>     Canonical unapproved approval request JSON
+  --human-approval <file>       Human-returned text, read byte-for-byte without trimming
+  --approve-freeze-file <sha256> Explicit SHA-256 of the exact freeze file bytes
+  --approve-request <sha256>    Explicit request identity SHA-256
+  --approve-text <sha256>       Explicit byte-exact approval text SHA-256
+  --confirm <email>             Exact frozen account email
+  --approved-at <iso>           Exact approval-authority timestamp already embedded in the request
+  --out-dir <dir>               New private immutable artifact directory
+
+Options:
+  --json                        Print compact JSON
+  -h, --help
+
+Offline safety:
+  This command receives no environment or HTTP client and performs zero authentication, network,
+  database, preflight, gate, admission, execution, or mutation calls.
+`.trim();
+}
+function renderDatasetMaintenanceRunProtectedHelp() {
+    return `Usage:
+  tiangong-lca dataset maintenance run-protected --plan <file> --freeze <file> --approval <file> --out-dir <dir> --commit --approve-execution <sha256> --confirm <email> [options]
+  tiangong-lca dataset maintenance run-protected --plan <file> --freeze <file> --approval <file> --out-dir <dir> --status-only [options]
+
+Behavior:
+  Runs one sealed, server-dispatched production maintenance execution fenced to the authenticated actor's
+  exact owner-draft target set, or reads durable status through an auth.uid-, actor-, and plan-fenced RPC
+  without admitting work; only the independent table readback uses RLS.
+  Commit and status-only modes are mutually exclusive. The commit path validates the full private
+  before-state, accepts only server-derived gates within the 180-second preflight window, writes an immutable
+  local submission marker, and sends at most one admission POST. After a marker or ambiguous response,
+  use --status-only; the command never retries admission or falls back to dev or the legacy alias RPC.
+
+Required in both modes:
+  --plan <file>             Immutable maintenance-plan.json
+  --freeze <file>           Protected production execution seal/freeze artifact
+  --approval <file>         Exact human-approval binding artifact
+  --out-dir <dir>           Private protected-run artifact directory
+
+Commit-only guards:
+  --commit                  Submit the sealed execution exactly once
+  --approve-execution <sha256> Exact approved execution identity SHA-256
+  --confirm <email>         Current authenticated account email
+
+Recovery:
+  --status-only             Read/poll and independently verify the sealed request; never preflight or admit
+
+Options:
+  --wait-seconds <n>        Maximum terminal-status wait in seconds; 0 performs one status read
+  --poll-ms <n>             Positive polling interval in milliseconds; default 10000
+  --page-size <n>           Requested RLS readback page size, 1-5000
+  --timeout-ms <n>          Positive request timeout in milliseconds
+  --json                    Print compact JSON
+  -h, --help
+
+Only a terminal passed proof exits successfully. pending, failed, and indeterminate return non-zero.
+`.trim();
+}
 function renderDatasetMaintenanceVerifyHelp() {
     return `Usage:
   tiangong-lca dataset maintenance verify --plan <file> [options]
@@ -3040,6 +3159,19 @@ function parseDatasetMaintenancePositiveInteger(value, flagName) {
     }
     return Number.parseInt(value.trim(), 10);
 }
+function parseDatasetMaintenanceNonNegativeInteger(value, flagName) {
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    if (!/^\d+$/u.test(value.trim())) {
+        throw new CliError(`${flagName} must be a non-negative integer.`, {
+            code: 'DATASET_MAINTENANCE_INTEGER_INVALID',
+            exitCode: 2,
+            details: { flag: flagName, value },
+        });
+    }
+    return Number.parseInt(value.trim(), 10);
+}
 function parseDatasetMaintenancePlanFlags(args) {
     let values;
     try {
@@ -3126,6 +3258,134 @@ function parseDatasetMaintenanceApplyFlags(args) {
         dryRun: Boolean(values['dry-run']),
     };
 }
+function parseDatasetMaintenanceFreezeProtectedFlags(args) {
+    let values;
+    try {
+        ({ values } = parseArgs({
+            args,
+            allowPositionals: false,
+            strict: true,
+            options: {
+                help: { type: 'boolean', short: 'h' },
+                json: { type: 'boolean' },
+                plan: { type: 'string' },
+                'toolchain-evidence': { type: 'string' },
+                'out-dir': { type: 'string' },
+                'expected-project-ref': { type: 'string' },
+                confirm: { type: 'string' },
+                'page-size': { type: 'string' },
+                'timeout-ms': { type: 'string' },
+            },
+        }));
+    }
+    catch (error) {
+        throw new CliError(String(error), {
+            code: 'INVALID_ARGS',
+            exitCode: 2,
+        });
+    }
+    return {
+        help: Boolean(values.help),
+        json: Boolean(values.json),
+        planPath: typeof values.plan === 'string' ? values.plan : '',
+        toolchainEvidencePath: typeof values['toolchain-evidence'] === 'string' ? values['toolchain-evidence'] : '',
+        outDir: typeof values['out-dir'] === 'string' ? values['out-dir'] : '',
+        expectedProjectRef: typeof values['expected-project-ref'] === 'string' ? values['expected-project-ref'] : '',
+        confirm: typeof values.confirm === 'string' ? values.confirm : '',
+        pageSize: parseDatasetMaintenancePositiveInteger(values['page-size'], '--page-size'),
+        timeoutMs: parseDatasetMaintenancePositiveInteger(values['timeout-ms'], '--timeout-ms'),
+    };
+}
+function parseDatasetMaintenanceSealProtectedApprovalFlags(args) {
+    let values;
+    try {
+        ({ values } = parseArgs({
+            args,
+            allowPositionals: false,
+            strict: true,
+            options: {
+                help: { type: 'boolean', short: 'h' },
+                json: { type: 'boolean' },
+                freeze: { type: 'string' },
+                'approval-request': { type: 'string' },
+                'human-approval': { type: 'string' },
+                'out-dir': { type: 'string' },
+                'approve-freeze-file': { type: 'string' },
+                'approve-request': { type: 'string' },
+                'approve-text': { type: 'string' },
+                confirm: { type: 'string' },
+                'approved-at': { type: 'string' },
+            },
+        }));
+    }
+    catch (error) {
+        throw new CliError(String(error), {
+            code: 'INVALID_ARGS',
+            exitCode: 2,
+        });
+    }
+    return {
+        help: Boolean(values.help),
+        json: Boolean(values.json),
+        freezePath: typeof values.freeze === 'string' ? values.freeze : '',
+        approvalRequestPath: typeof values['approval-request'] === 'string' ? values['approval-request'] : '',
+        humanApprovalPath: typeof values['human-approval'] === 'string' ? values['human-approval'] : '',
+        outDir: typeof values['out-dir'] === 'string' ? values['out-dir'] : '',
+        approveFreezeFile: typeof values['approve-freeze-file'] === 'string' ? values['approve-freeze-file'] : '',
+        approveRequest: typeof values['approve-request'] === 'string' ? values['approve-request'] : '',
+        approveText: typeof values['approve-text'] === 'string' ? values['approve-text'] : '',
+        confirm: typeof values.confirm === 'string' ? values.confirm : '',
+        approvedAtUtc: typeof values['approved-at'] === 'string' ? values['approved-at'] : '',
+    };
+}
+function parseDatasetMaintenanceProtectedFlags(args) {
+    let values;
+    try {
+        ({ values } = parseArgs({
+            args,
+            allowPositionals: false,
+            strict: true,
+            options: {
+                help: { type: 'boolean', short: 'h' },
+                json: { type: 'boolean' },
+                plan: { type: 'string' },
+                freeze: { type: 'string' },
+                approval: { type: 'string' },
+                'out-dir': { type: 'string' },
+                commit: { type: 'boolean' },
+                'status-only': { type: 'boolean' },
+                'approve-execution': { type: 'string' },
+                confirm: { type: 'string' },
+                'wait-seconds': { type: 'string' },
+                'poll-ms': { type: 'string' },
+                'page-size': { type: 'string' },
+                'timeout-ms': { type: 'string' },
+            },
+        }));
+    }
+    catch (error) {
+        throw new CliError(String(error), {
+            code: 'INVALID_ARGS',
+            exitCode: 2,
+        });
+    }
+    return {
+        help: Boolean(values.help),
+        json: Boolean(values.json),
+        planPath: typeof values.plan === 'string' ? values.plan : '',
+        freezePath: typeof values.freeze === 'string' ? values.freeze : '',
+        approvalPath: typeof values.approval === 'string' ? values.approval : '',
+        outDir: typeof values['out-dir'] === 'string' ? values['out-dir'] : '',
+        commit: Boolean(values.commit),
+        statusOnly: Boolean(values['status-only']),
+        approveExecution: typeof values['approve-execution'] === 'string' ? values['approve-execution'] : undefined,
+        confirm: typeof values.confirm === 'string' ? values.confirm : undefined,
+        waitSeconds: parseDatasetMaintenanceNonNegativeInteger(values['wait-seconds'], '--wait-seconds'),
+        pollMs: parseDatasetMaintenancePositiveInteger(values['poll-ms'], '--poll-ms'),
+        pageSize: parseDatasetMaintenancePositiveInteger(values['page-size'], '--page-size'),
+        timeoutMs: parseDatasetMaintenancePositiveInteger(values['timeout-ms'], '--timeout-ms'),
+    };
+}
 function parseDatasetMaintenanceVerifyFlags(args) {
     let values;
     try {
@@ -4905,6 +5165,9 @@ export async function executeCli(argv, deps) {
         const datasetMaintenanceClearAccountImpl = deps.runDatasetMaintenanceClearAccountImpl ?? runDatasetMaintenanceClearAccount;
         const datasetMaintenancePlanImpl = deps.runDatasetMaintenancePlanImpl ?? runDatasetMaintenancePlan;
         const datasetMaintenanceApplyImpl = deps.runDatasetMaintenanceApplyImpl ?? runDatasetMaintenanceApply;
+        const datasetMaintenanceProtectedFreezeImpl = deps.freezeDatasetMaintenanceProtectedImpl ?? freezeDatasetMaintenanceProtected;
+        const datasetMaintenanceProtectedImpl = deps.runDatasetMaintenanceProtectedImpl ?? runDatasetMaintenanceProtected;
+        const datasetMaintenanceProtectedApprovalSealImpl = deps.sealDatasetMaintenanceProtectedApprovalImpl ?? sealDatasetMaintenanceProtectedApproval;
         const datasetMaintenanceVerifyImpl = deps.runDatasetMaintenanceVerifyImpl ?? runDatasetMaintenanceVerify;
         const datasetSourceUploadAttachmentsImpl = deps.runDatasetSourceUploadAttachmentsImpl ?? runDatasetSourceUploadAttachments;
         if (flags.version) {
@@ -5617,6 +5880,222 @@ export async function executeCli(argv, deps) {
                     stderr: '',
                 };
             }
+            if (action === 'freeze-protected') {
+                const datasetFlags = parseDatasetMaintenanceFreezeProtectedFlags(commandArgs.slice(1));
+                if (datasetFlags.help) {
+                    return {
+                        exitCode: 0,
+                        stdout: `${renderDatasetMaintenanceFreezeProtectedHelp()}\n`,
+                        stderr: '',
+                    };
+                }
+                if (!datasetFlags.planPath) {
+                    throw new CliError('dataset maintenance freeze-protected requires --plan.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_PLAN_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.toolchainEvidencePath) {
+                    throw new CliError('dataset maintenance freeze-protected requires --toolchain-evidence.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_TOOLCHAIN_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.expectedProjectRef) {
+                    throw new CliError('dataset maintenance freeze-protected requires --expected-project-ref.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_PROJECT_REF_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.confirm) {
+                    throw new CliError('dataset maintenance freeze-protected requires --confirm.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_CONFIRM_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.outDir) {
+                    throw new CliError('dataset maintenance freeze-protected requires --out-dir.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_OUT_DIR_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                const report = await datasetMaintenanceProtectedFreezeImpl({
+                    planPath: datasetFlags.planPath,
+                    toolchainEvidencePath: datasetFlags.toolchainEvidencePath,
+                    outDir: datasetFlags.outDir,
+                    expectedProjectRef: datasetFlags.expectedProjectRef,
+                    confirm: datasetFlags.confirm,
+                    cliVersion: loadCliPackageVersion(import.meta.url),
+                    pageSize: datasetFlags.pageSize,
+                    timeoutMs: datasetFlags.timeoutMs,
+                    env: deps.env,
+                    fetchImpl: deps.fetchImpl,
+                });
+                return {
+                    exitCode: 0,
+                    stdout: stringifyJson(report, datasetFlags.json),
+                    stderr: '',
+                };
+            }
+            if (action === 'seal-protected-approval') {
+                const datasetFlags = parseDatasetMaintenanceSealProtectedApprovalFlags(commandArgs.slice(1));
+                if (datasetFlags.help) {
+                    return {
+                        exitCode: 0,
+                        stdout: `${renderDatasetMaintenanceSealProtectedApprovalHelp()}\n`,
+                        stderr: '',
+                    };
+                }
+                if (!datasetFlags.freezePath) {
+                    throw new CliError('dataset maintenance seal-protected-approval requires --freeze.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_FREEZE_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.approvalRequestPath) {
+                    throw new CliError('dataset maintenance seal-protected-approval requires --approval-request.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_APPROVAL_REQUEST_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.humanApprovalPath) {
+                    throw new CliError('dataset maintenance seal-protected-approval requires --human-approval.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_HUMAN_APPROVAL_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.approveFreezeFile) {
+                    throw new CliError('dataset maintenance seal-protected-approval requires --approve-freeze-file.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_FREEZE_CONFIRMATION_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.approveRequest) {
+                    throw new CliError('dataset maintenance seal-protected-approval requires --approve-request.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_REQUEST_CONFIRMATION_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.approveText) {
+                    throw new CliError('dataset maintenance seal-protected-approval requires --approve-text.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_TEXT_CONFIRMATION_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.confirm) {
+                    throw new CliError('dataset maintenance seal-protected-approval requires --confirm.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_CONFIRM_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.approvedAtUtc) {
+                    throw new CliError('dataset maintenance seal-protected-approval requires --approved-at.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_APPROVED_AT_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.outDir) {
+                    throw new CliError('dataset maintenance seal-protected-approval requires --out-dir.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_OUT_DIR_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                const report = await datasetMaintenanceProtectedApprovalSealImpl({
+                    freezePath: datasetFlags.freezePath,
+                    approvalRequestPath: datasetFlags.approvalRequestPath,
+                    humanApprovalPath: datasetFlags.humanApprovalPath,
+                    outDir: datasetFlags.outDir,
+                    approveFreezeFile: datasetFlags.approveFreezeFile,
+                    approveRequest: datasetFlags.approveRequest,
+                    approveText: datasetFlags.approveText,
+                    confirm: datasetFlags.confirm,
+                    approvedAtUtc: datasetFlags.approvedAtUtc,
+                });
+                return {
+                    exitCode: 0,
+                    stdout: stringifyJson(report, datasetFlags.json),
+                    stderr: '',
+                };
+            }
+            if (action === 'run-protected') {
+                const datasetFlags = parseDatasetMaintenanceProtectedFlags(commandArgs.slice(1));
+                if (datasetFlags.help) {
+                    return {
+                        exitCode: 0,
+                        stdout: `${renderDatasetMaintenanceRunProtectedHelp()}\n`,
+                        stderr: '',
+                    };
+                }
+                if (!datasetFlags.planPath) {
+                    throw new CliError('dataset maintenance run-protected requires --plan.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_PLAN_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.freezePath) {
+                    throw new CliError('dataset maintenance run-protected requires --freeze.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_FREEZE_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.approvalPath) {
+                    throw new CliError('dataset maintenance run-protected requires --approval.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_APPROVAL_FILE_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.outDir) {
+                    throw new CliError('dataset maintenance run-protected requires --out-dir.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_OUT_DIR_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (datasetFlags.commit && datasetFlags.statusOnly) {
+                    throw new CliError('Cannot pass both --commit and --status-only.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_MODE_CONFLICT',
+                        exitCode: 2,
+                    });
+                }
+                if (!datasetFlags.commit && !datasetFlags.statusOnly) {
+                    throw new CliError('dataset maintenance run-protected requires either --commit or --status-only.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_MODE_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (datasetFlags.commit && !datasetFlags.approveExecution) {
+                    throw new CliError('dataset maintenance run-protected requires --approve-execution <sha256> with --commit.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_APPROVAL_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                if (datasetFlags.commit && !datasetFlags.confirm) {
+                    throw new CliError('dataset maintenance run-protected requires --confirm <email> with --commit.', {
+                        code: 'DATASET_MAINTENANCE_PROTECTED_CONFIRM_REQUIRED',
+                        exitCode: 2,
+                    });
+                }
+                const report = await datasetMaintenanceProtectedImpl({
+                    planPath: datasetFlags.planPath,
+                    freezePath: datasetFlags.freezePath,
+                    approvalPath: datasetFlags.approvalPath,
+                    outDir: datasetFlags.outDir,
+                    commit: datasetFlags.commit,
+                    statusOnly: datasetFlags.statusOnly,
+                    approveExecution: datasetFlags.approveExecution,
+                    confirm: datasetFlags.confirm,
+                    waitSeconds: datasetFlags.waitSeconds,
+                    pollMs: datasetFlags.pollMs,
+                    pageSize: datasetFlags.pageSize,
+                    timeoutMs: datasetFlags.timeoutMs,
+                    env: deps.env,
+                    fetchImpl: deps.fetchImpl,
+                });
+                return {
+                    exitCode: report.status === 'passed' ? 0 : 1,
+                    stdout: stringifyJson(report, datasetFlags.json),
+                    stderr: '',
+                };
+            }
             if (action === 'verify') {
                 const datasetFlags = parseDatasetMaintenanceVerifyFlags(commandArgs.slice(1));
                 if (datasetFlags.help) {
@@ -5646,7 +6125,7 @@ export async function executeCli(argv, deps) {
                     stderr: '',
                 };
             }
-            throw new CliError("dataset maintenance action must be 'clear-account', 'plan', 'apply', or 'verify'.", {
+            throw new CliError("dataset maintenance action must be 'clear-account', 'plan', 'apply', 'freeze-protected', 'seal-protected-approval', 'run-protected', or 'verify'.", {
                 code: 'DATASET_MAINTENANCE_ACTION_INVALID',
                 exitCode: 2,
             });