@tiangong-lca/cli 0.0.28 → 0.0.30

package/dist/src/cli.js

@@ -39,6 +39,7 @@ import { runFlowReviewedPublishData, } from './lib/flow-publish-reviewed-data.js
 import { runFlowBuildAliasMap, } from './lib/flow-build-alias-map.js';
 import { runFlowApplyProcessFlowRepairs, runFlowPlanProcessFlowRepairs, runFlowRegenProduct, runFlowScanProcessFlowRefs, runFlowValidateProcesses, } from './lib/flow-regen-product.js';
 import { executeRemoteCommand, getRemoteCommandHelp } from './lib/remote.js';
+import { LCA_RELEASE_ACTIONS, renderLcaReleaseReport, runLcaRelease, } from './lib/lca-release.js';
 import { runValidation, } from './lib/validation.js';
 import { runDatasetValidate, } from './lib/dataset-validate.js';
 import { runDatasetCurationQueueBuild, runDatasetCurationQueueNext, runDatasetCurationQueueVerify, } from './lib/dataset-curation-queue.js';
@@ -60,6 +61,13 @@ import { freezeDatasetMaintenanceProtected } from './lib/dataset-maintenance-pro
 import { runDatasetMaintenanceProtected } from './lib/dataset-maintenance-protected-run.js';
 import { sealDatasetMaintenanceProtectedApproval } from './lib/dataset-maintenance-protected-seal.js';
 import { runDatasetMaintenanceVerify } from './lib/dataset-maintenance-verify.js';
+import { runFlowIdentityPlanFromFiles } from './lib/dataset-maintenance-flow-identity-command.js';
+import { captureFlowIdentity } from './lib/dataset-maintenance-flow-identity-capture.js';
+import { freezeFlowIdentity } from './lib/dataset-maintenance-flow-identity-freeze.js';
+import { sealFlowIdentityApproval } from './lib/dataset-maintenance-flow-identity-seal.js';
+import { freezeFlowIdentityRecovery, sealFlowIdentityRecoveryApproval, } from './lib/dataset-maintenance-flow-identity-recovery.js';
+import { runFlowIdentity } from './lib/dataset-maintenance-flow-identity-run.js';
+import { verifyFlowIdentity } from './lib/dataset-maintenance-flow-identity-verify.js';
 import { runDatasetSourceUploadAttachments, } from './lib/dataset-source-upload-attachments.js';
 function renderMainHelp(dotEnvStatus) {
     return `TianGong LCA CLI
@@ -80,12 +88,13 @@ Implemented Commands:
   doctor     show environment diagnostics
   search     flow | process | lifecyclemodel
   process    get | list | identity-preflight | build-plan | scope-statistics | dedup-review | auto-build | resume-build | publish-build | complete-required-fields | save-draft | batch-build | refresh-references | verify-rows
-  dataset    contract get | context-pack | classification children/path/audit/apply | curation-queue build/next/verify | import-lca convert | author | patch apply | save-draft | source upload-attachments | validate | verify-remote | bilingual extract/apply/validate | evidence-search plan/run | references rewrite/refresh-remote | maintenance clear-account/plan/apply/verify
+  dataset    contract get | context-pack | classification children/path/audit/apply | curation-queue build/next/verify | import-lca convert | author | patch apply | save-draft | source upload-attachments | validate | verify-remote | bilingual extract/apply/validate | evidence-search plan/run | references rewrite/refresh-remote | maintenance clear-account/plan/apply/verify/flow-identity
   flow       get | list | identity-preflight | build-plan | fetch-rows | materialize-decisions | remediate | publish-version | publish-reviewed-data | build-alias-map | scan-process-flow-refs | plan-process-flow-repairs | apply-process-flow-repairs | regen-product | validate-processes
   lifecyclemodel auto-build | validate-build | publish-build | save-draft | graph | build-resulting-process | publish-resulting-process | orchestrate
   qa         process | flow | lifecyclemodel
   publish    run
   validation run
+  release    prepare | upload | finalize | approve | publish | readback-verify | unpublish | status | current | calculation-bundle | calculation-artifact | artifact-download
   admin      embedding-run
 
 Planned Surface (not implemented yet):
@@ -163,6 +172,8 @@ Examples:
   tiangong-lca qa lifecyclemodel --rows-file ./lifecyclemodels.jsonl --out-dir ./lifecyclemodel-qa
   tiangong-lca publish run --input ./publish-request.json --dry-run
   tiangong-lca validation run --input-dir ./package --engine auto
+  tiangong-lca release status --release-run-id <run-id> --json
+  tiangong-lca release calculation-bundle --package-id <package-id> --output ./calculation-bundle.json
   tiangong-lca admin embedding-run --input ./jobs.json
 
 Environment:
@@ -226,6 +237,58 @@ Runtime note:
   and sends the resolved access token to Edge Functions.
 `.trim();
 }
+function renderLcaReleaseHelp() {
+    return `Usage:
+  tiangong-lca release <action> [options]
+
+Workflow actions:
+  prepare              register an immutable publish plan from --input
+  upload               verify four local ZIPs, upload them, and write --output receipt
+  finalize             bind a Release Manifest and uploaded artifact refs from --input
+  approve              create a durable manager approval from --input
+  publish              publish an approved release from --input; credential fingerprint is derived locally
+  readback-verify      record independent artifact readback hashes from --input
+  unpublish            unpublish the current release from --input
+
+Read and download actions:
+  status               read --release-run-id
+  current              read the current public release
+  calculation-bundle   verify/sign bundle manifest and chunks for --package-id; requires --output
+  calculation-artifact download one exact --artifact-path from --package-id; requires --output
+  artifact-download    download one release ZIP by --artifact-id; requires --output
+
+Options:
+  --input <file>           JSON command or upload request
+  --output <path>         Durable JSON receipt/projection or downloaded bytes
+  --release-run-id <uuid> Release run for status
+  --package-id <uuid>     LCIA result package for Calculation Bundle reads
+  --artifact-id <uuid>    Published release artifact to download
+  --artifact-path <path>  Exact path from a Calculation Bundle manifest
+  --force                 Replace an existing output file
+  --dry-run               Validate and print the masked planned request without network writes
+  --json                  Print the stable compact JSON report; otherwise print Summary and Next
+  --api-key <key>         Override TIANGONG_LCA_API_KEY; environment use is preferred
+  --base-url <url>        Override TIANGONG_LCA_API_BASE_URL
+  --timeout-ms <n>        Request timeout in milliseconds (default 60000)
+  -h, --help
+
+Required environment:
+  TIANGONG_LCA_API_BASE_URL
+  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+
+Authorization and safety:
+  The User API key is exchanged for a user session. Database RPCs then check that the live account
+  has data_product_manager. The service-role key never enters this CLI. Large bundle projections,
+  ZIPs, and chunks are written to files and verified against exact byte size and SHA-256.
+
+Examples:
+  tiangong-lca release prepare --input ./release-prepare.json --json
+  tiangong-lca release upload --input ./release-upload.json --output ./upload-receipt.json
+  tiangong-lca release calculation-bundle --package-id 11111111-1111-4111-8111-111111111111 --output ./calculation-bundle.json
+  tiangong-lca release calculation-artifact --package-id 11111111-1111-4111-8111-111111111111 --artifact-path chunks/lci-00000.jsonl.gz --output ./lci-00000.jsonl.gz
+`.trim();
+}
 function renderPublishHelp() {
     return `Usage:
   tiangong-lca publish run --input <file> [options]
@@ -292,6 +355,7 @@ Implemented Subcommands:
   maintenance seal-protected-approval Record byte-exact human approval entirely offline
   maintenance run-protected Run or inspect one sealed, one-shot production maintenance execution
   maintenance verify  Read back affected rows and references against the immutable plan
+  maintenance flow-identity Dedicated Step 3 capture/plan/freeze/approval/serial-run/verify workflow
 
 Examples:
   tiangong-lca dataset contract get --type process --include schema,methodology,ruleset --out-dir ./contract --help
@@ -321,11 +385,12 @@ Examples:
   tiangong-lca dataset maintenance freeze-protected --help
   tiangong-lca dataset maintenance seal-protected-approval --help
   tiangong-lca dataset maintenance run-protected --help
+  tiangong-lca dataset maintenance flow-identity --help
 `.trim();
 }
 function renderDatasetMaintenanceHelp() {
     return `Usage:
-  tiangong-lca dataset maintenance <clear-account|plan|apply|freeze-protected|seal-protected-approval|run-protected|verify> [options]
+  tiangong-lca dataset maintenance <clear-account|plan|apply|freeze-protected|seal-protected-approval|run-protected|verify|flow-identity> [options]
 
 Actions:
   clear-account Dry-run or delete current authenticated account-owned lifecyclemodels, processes, flows, sources, and contacts.
@@ -335,6 +400,7 @@ Actions:
   seal-protected-approval Record a byte-exact human response into an approval artifact with no authentication or network access.
   run-protected Run or inspect one sealed production execution with one-shot admission and terminal derivative proof.
   verify  Re-fetch rows, references, or derivative request state and report passed, pending, or failed independently of apply.
+  flow-identity Run the dedicated Step 3 capture/plan/freeze/seal-approval/serial-run/independent-verify workflow.
 
 Safety:
   plan, verify, and freeze-protected are read-only; seal-protected-approval is local-only.
@@ -343,6 +409,7 @@ Safety:
   freeze-protected is production-only and never calls preflight, gate, admission, execution, or mutation RPCs.
   seal-protected-approval only records the exact human-approved bytes; it never authenticates, connects, or submits execution.
   run-protected is production-only: authenticated owner context plus server-side actor/user_id/state_code=0 and exact-plan closure fences protect writes; RLS remains a defense on public and independent-read surfaces. It never falls back to dev, a legacy alias RPC, or a second admission POST.
+  flow-identity never reuses the Step 2 runner. Process writes are strictly ordinal and ambiguous responses permit read-only recovery, never automatic process replay.
 
 Required Artifact Contract:
   - maintenance-plan.json
@@ -364,6 +431,72 @@ Examples:
   tiangong-lca dataset maintenance seal-protected-approval --freeze ./protected-freeze/protected-execution-freeze.json --approval-request ./protected-freeze/protected-approval-request.json --human-approval ./human-approval.txt --approve-freeze-file <sha256> --approve-request <sha256> --approve-text <sha256> --confirm bafudata@126.com --approved-at <iso> --out-dir ./protected-approval
   tiangong-lca dataset maintenance run-protected --plan ./maintenance-plan.json --freeze ./protected-execution-seal.json --approval ./protected-approval.json --out-dir ./protected-run --status-only
   tiangong-lca dataset maintenance verify --plan ./dataset-maintenance/maintenance-plan.json --out-dir ./dataset-maintenance/verify
+  tiangong-lca dataset maintenance flow-identity --help
+`.trim();
+}
+function renderDatasetMaintenanceFlowIdentityHelp() {
+    return `Usage:
+  tiangong-lca dataset maintenance flow-identity <capture|plan|freeze|seal-approval|run|freeze-recovery|seal-recovery-approval|run-recovery|verify> [options]
+
+Actions:
+  capture       Authenticated production census and one database attestation; performs zero scope/preflight/rewrite/finalize calls.
+  plan          Build immutable Step 3 reference-only process templates from an approved v3 review ledger and fresh post-Step2/post-#29 live capture.
+  freeze        Offline-bind one production plan/toolchain/receipt and generate this execution's byte-exact approval request.
+  seal-approval Offline-record byte-exact human approval; performs zero authentication, network, or database calls.
+  run           Create/read one guarded scope, serially submit only its durable next ordinal, then wait read-only for derivative readiness before at most one finalize POST. Ambiguous responses are never retried in the same invocation.
+  freeze-recovery Authenticated read-only scope snapshot that freezes a new exact continuation approval after the prior in-memory permit was lost.
+  seal-recovery-approval Offline-record byte-exact human approval for only that frozen durable-scope baseline.
+  run-recovery  Consume that recovery approval once, obtain a fresh memory-only rotating permit, and continue the same durable scope.
+  verify        Independently re-read the terminal scope, all 305 source rows, public/support rows, exact affected processes, and the complete owner-draft process reference closure.
+
+Plan:
+  --policy <file> --review-ledger <file> --live-capture <file> --out-dir <dir>
+
+Capture:
+  --policy <file> --review-ledger <file> --prerequisites <file> --toolchain-evidence <file>
+  --request-id <uuid> --operation-id <value> --expected-project-ref <ref> --confirm <email>
+  --sdk-version <value> --out-dir <dir>
+  [--page-size <n>] [--read-concurrency <n>] [--timeout-ms <n>]
+
+Freeze:
+  --plan <file> --toolchain-evidence <file> --approved-at <iso> --expected-project-ref <ref> --confirm <email> --out-dir <dir>
+
+Seal approval:
+  --plan <file> --freeze <file> --approval-request <file> --human-approval <file>
+  --approve-freeze-file <sha256> --approve-request <sha256> --approve-text <sha256>
+  --confirm <email> --approved-at <iso> --out-dir <dir>
+
+Run:
+  --plan <file> --freeze <file> --approval <file> --out-dir <dir>
+  (--commit --approve-execution <sha256> --confirm <email> | --status-only)
+  [--wait-seconds <n>] [--poll-ms <n>] [--timeout-ms <n>]
+
+Freeze recovery:
+  --plan <file> --freeze <original-file> --approval <original-file> --run-dir <prior-run-dir>
+  --toolchain-evidence <file> --approved-at <iso> --recovery-reason <reason>
+  --expected-project-ref <ref> --confirm <email> --out-dir <dir> [--timeout-ms <n>]
+
+Seal recovery approval:
+  --recovery-freeze <file> --approval-request <file> --human-approval <file>
+  --approve-freeze-file <sha256> --approve-request <sha256> --approve-text <sha256>
+  --confirm <email> --approved-at <iso> --out-dir <dir>
+
+Run recovery:
+  --plan <file> --freeze <original-file> --approval <original-file> --run-dir <prior-run-dir>
+  --recovery-freeze <file> --recovery-approval <file> --out-dir <dir>
+  --commit --approve-execution <recovery-identity-sha256> --confirm <email>
+  [--wait-seconds <n>] [--poll-ms <n>] [--timeout-ms <n>]
+
+Verify:
+  --plan <file> --freeze <file> --approval <file> --run-dir <dir> --out-dir <dir>
+  [--page-size <n>] [--timeout-ms <n>]
+
+Derivative failure boundary:
+  A failed/stale derivative will never retry a process. This command stops. Any derivative-only compensation requires a separate plan, new freeze, and new exact human approval.
+
+Common:
+  --json
+  -h, --help
 `.trim();
 }
 function renderDatasetMaintenancePlanHelp() {
@@ -812,6 +945,10 @@ Options:
   --out-dir <dir>  Artifact directory
   --commit         Execute remote save-draft writes
   --dry-run        Validate and plan without remote writes (default)
+  --execution-contract <file>
+                   Execute a content-bound ordered owner-draft batch with append-only attempt/readback evidence (requires --commit)
+  --allow-account-local-support
+                   Explicitly permit account-local Unit Group / Flow Property rows in the execution contract
   --json           Print compact JSON
   -h, --help
 
@@ -820,6 +957,7 @@ Outputs written under --out-dir:
   - outputs/dataset-save-draft/progress.jsonl
   - outputs/dataset-save-draft/failures.jsonl
   - outputs/dataset-save-draft/summary.json
+  - $XDG_STATE_HOME/tiangong-lca-cli/execution-ledgers/dataset-save-draft/v1/<owner-scope-sha256>/<action-identity-sha256>.events.jsonl (execution-contract mode; platform state directory fallback applies)
 
 Contract:
   This generic dataset path writes only mutable rows such as contact/source/flow/process. Unit group and flow property rows are reference-only; select existing database rows and rewrite references instead of creating My Data support rows.
@@ -2167,6 +2305,71 @@ function parseRemoteFlags(args) {
         timeoutMs,
     };
 }
+function parseLcaReleaseFlags(args) {
+    let values;
+    try {
+        ({ values } = parseArgs({
+            args,
+            allowPositionals: false,
+            strict: true,
+            options: {
+                help: { type: 'boolean', short: 'h' },
+                json: { type: 'boolean' },
+                'dry-run': { type: 'boolean' },
+                force: { type: 'boolean' },
+                input: { type: 'string' },
+                output: { type: 'string' },
+                'release-run-id': { type: 'string' },
+                'package-id': { type: 'string' },
+                'artifact-id': { type: 'string' },
+                'artifact-path': { type: 'string' },
+                'api-key': { type: 'string' },
+                'base-url': { type: 'string' },
+                'timeout-ms': { type: 'string' },
+            },
+        }));
+    }
+    catch (error) {
+        throw new CliError(String(error), {
+            code: 'INVALID_ARGS',
+            exitCode: 2,
+        });
+    }
+    const timeoutText = typeof values['timeout-ms'] === 'string' ? values['timeout-ms'] : undefined;
+    const timeoutMs = timeoutText ? Number.parseInt(timeoutText, 10) : 60_000;
+    if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) {
+        throw new CliError('Expected --timeout-ms to be a positive integer.', {
+            code: 'INVALID_TIMEOUT',
+            exitCode: 2,
+        });
+    }
+    const optionalString = (value) => typeof value === 'string' ? value : null;
+    return {
+        help: Boolean(values.help),
+        json: Boolean(values.json),
+        dryRun: Boolean(values['dry-run']),
+        force: Boolean(values.force),
+        inputPath: optionalString(values.input),
+        outputPath: optionalString(values.output),
+        releaseRunId: optionalString(values['release-run-id']),
+        packageId: optionalString(values['package-id']),
+        artifactId: optionalString(values['artifact-id']),
+        artifactPath: optionalString(values['artifact-path']),
+        apiKey: optionalString(values['api-key']),
+        apiBaseUrl: optionalString(values['base-url']),
+        timeoutMs,
+    };
+}
+function requireLcaReleaseAction(value) {
+    if (!LCA_RELEASE_ACTIONS.includes(value)) {
+        throw new CliError(`Unsupported release action: ${value}`, {
+            code: 'LCA_RELEASE_ACTION_UNSUPPORTED',
+            exitCode: 2,
+            details: { actions: LCA_RELEASE_ACTIONS },
+        });
+    }
+    return value;
+}
 function parsePublishFlags(args) {
     let values;
     try {
@@ -2280,6 +2483,7 @@ function parseDatasetSaveDraftFlags(args) {
                 commit: { type: 'boolean' },
                 'dry-run': { type: 'boolean' },
                 'allow-account-local-support': { type: 'boolean' },
+                'execution-contract': { type: 'string' },
             },
         }));
     }
@@ -2303,6 +2507,7 @@ function parseDatasetSaveDraftFlags(args) {
         outDir: typeof values['out-dir'] === 'string' ? values['out-dir'] : null,
         commit: Boolean(values.commit),
         allowReferenceOnlySupport: Boolean(values['allow-account-local-support']),
+        executionContractPath: typeof values['execution-contract'] === 'string' ? values['execution-contract'] : null,
     };
 }
 function parseDatasetSourceUploadAttachmentsFlags(args) {
@@ -3386,6 +3591,95 @@ function parseDatasetMaintenanceProtectedFlags(args) {
         timeoutMs: parseDatasetMaintenancePositiveInteger(values['timeout-ms'], '--timeout-ms'),
     };
 }
+function parseDatasetMaintenanceFlowIdentityFlags(args) {
+    let values;
+    try {
+        ({ values } = parseArgs({
+            args,
+            allowPositionals: false,
+            strict: true,
+            options: {
+                help: { type: 'boolean', short: 'h' },
+                json: { type: 'boolean' },
+                policy: { type: 'string' },
+                'review-ledger': { type: 'string' },
+                prerequisites: { type: 'string' },
+                'live-capture': { type: 'string' },
+                plan: { type: 'string' },
+                'toolchain-evidence': { type: 'string' },
+                'approval-text': { type: 'string' },
+                'expected-project-ref': { type: 'string' },
+                'request-id': { type: 'string' },
+                'operation-id': { type: 'string' },
+                'sdk-version': { type: 'string' },
+                freeze: { type: 'string' },
+                'approval-request': { type: 'string' },
+                'human-approval': { type: 'string' },
+                approval: { type: 'string' },
+                'recovery-freeze': { type: 'string' },
+                'recovery-approval': { type: 'string' },
+                'recovery-reason': { type: 'string' },
+                'approve-freeze-file': { type: 'string' },
+                'approve-request': { type: 'string' },
+                'approve-text': { type: 'string' },
+                'approve-execution': { type: 'string' },
+                confirm: { type: 'string' },
+                'approved-at': { type: 'string' },
+                'out-dir': { type: 'string' },
+                'run-dir': { type: 'string' },
+                commit: { type: 'boolean' },
+                'status-only': { type: 'boolean' },
+                'wait-seconds': { type: 'string' },
+                'poll-ms': { type: 'string' },
+                'page-size': { type: 'string' },
+                'read-concurrency': { type: 'string' },
+                'timeout-ms': { type: 'string' },
+            },
+        }));
+    }
+    catch (error) {
+        throw new CliError(String(error), { code: 'INVALID_ARGS', exitCode: 2 });
+    }
+    const valueRecord = values;
+    const string = (name) => typeof valueRecord[name] === 'string' ? String(valueRecord[name]) : '';
+    return {
+        help: Boolean(values.help),
+        json: Boolean(values.json),
+        policyPath: string('policy'),
+        reviewLedgerPath: string('review-ledger'),
+        prerequisitesPath: string('prerequisites'),
+        liveCapturePath: string('live-capture'),
+        planPath: string('plan'),
+        toolchainEvidencePath: string('toolchain-evidence'),
+        approvalTextPath: string('approval-text'),
+        expectedProjectRef: string('expected-project-ref'),
+        requestId: string('request-id'),
+        operationId: string('operation-id'),
+        sdkVersion: string('sdk-version'),
+        freezePath: string('freeze'),
+        approvalRequestPath: string('approval-request'),
+        humanApprovalPath: string('human-approval'),
+        approvalPath: string('approval'),
+        recoveryFreezePath: string('recovery-freeze'),
+        recoveryApprovalPath: string('recovery-approval'),
+        recoveryReason: string('recovery-reason'),
+        approveFreezeFile: string('approve-freeze-file'),
+        approveRequest: string('approve-request'),
+        approveText: string('approve-text'),
+        approveExecution: string('approve-execution'),
+        confirm: string('confirm'),
+        approvedAtUtc: string('approved-at'),
+        outDir: string('out-dir'),
+        runDir: string('run-dir'),
+        commit: Boolean(values.commit),
+        statusOnly: Boolean(values['status-only']),
+        waitSeconds: parseDatasetMaintenanceNonNegativeInteger(values['wait-seconds'], '--wait-seconds'),
+        pollMs: parseDatasetMaintenancePositiveInteger(values['poll-ms'], '--poll-ms'),
+        pageSize: parseDatasetMaintenancePositiveInteger(values['page-size'], '--page-size'),
+        readConcurrency: parseDatasetMaintenancePositiveInteger(values['read-concurrency'], '--read-concurrency'),
+        timeoutMs: parseDatasetMaintenancePositiveInteger(values['timeout-ms'], '--timeout-ms'),
+    };
+}
 function parseDatasetMaintenanceVerifyFlags(args) {
     let values;
     try {
@@ -5100,6 +5394,7 @@ export async function executeCli(argv, deps) {
         const { flags, command, subcommand, commandArgs } = parseCommandLine(argv);
         const publishImpl = deps.runPublishImpl ?? runPublish;
         const validationImpl = deps.runValidationImpl ?? runValidation;
+        const lcaReleaseImpl = deps.runLcaReleaseImpl ?? runLcaRelease;
         const lifecyclemodelAutoBuildImpl = deps.runLifecyclemodelAutoBuildImpl ?? runLifecyclemodelAutoBuild;
         const lifecyclemodelBuildImpl = deps.runLifecyclemodelBuildResultingProcessImpl ?? runLifecyclemodelBuildResultingProcess;
         const lifecyclemodelPublishImpl = deps.runLifecyclemodelPublishResultingProcessImpl ?? runLifecyclemodelPublishResultingProcess;
@@ -5169,6 +5464,14 @@ export async function executeCli(argv, deps) {
         const datasetMaintenanceProtectedImpl = deps.runDatasetMaintenanceProtectedImpl ?? runDatasetMaintenanceProtected;
         const datasetMaintenanceProtectedApprovalSealImpl = deps.sealDatasetMaintenanceProtectedApprovalImpl ?? sealDatasetMaintenanceProtectedApproval;
         const datasetMaintenanceVerifyImpl = deps.runDatasetMaintenanceVerifyImpl ?? runDatasetMaintenanceVerify;
+        const flowIdentityPlanImpl = deps.runFlowIdentityPlanFromFilesImpl ?? runFlowIdentityPlanFromFiles;
+        const flowIdentityCaptureImpl = deps.captureFlowIdentityImpl ?? captureFlowIdentity;
+        const flowIdentityFreezeImpl = deps.freezeFlowIdentityImpl ?? freezeFlowIdentity;
+        const flowIdentityApprovalSealImpl = deps.sealFlowIdentityApprovalImpl ?? sealFlowIdentityApproval;
+        const flowIdentityRecoveryFreezeImpl = deps.freezeFlowIdentityRecoveryImpl ?? freezeFlowIdentityRecovery;
+        const flowIdentityRecoveryApprovalSealImpl = deps.sealFlowIdentityRecoveryApprovalImpl ?? sealFlowIdentityRecoveryApproval;
+        const flowIdentityRunImpl = deps.runFlowIdentityImpl ?? runFlowIdentity;
+        const flowIdentityVerifyImpl = deps.verifyFlowIdentityImpl ?? verifyFlowIdentity;
         const datasetSourceUploadAttachmentsImpl = deps.runDatasetSourceUploadAttachmentsImpl ?? runDatasetSourceUploadAttachments;
         if (flags.version) {
             return { exitCode: 0, stdout: `${loadCliPackageVersion(import.meta.url)}\n`, stderr: '' };
@@ -5554,11 +5857,12 @@ export async function executeCli(argv, deps) {
                 outDir: datasetFlags.outDir,
                 commit: datasetFlags.commit,
                 allowReferenceOnlySupport: datasetFlags.allowReferenceOnlySupport,
+                executionContractPath: datasetFlags.executionContractPath,
                 env: deps.env,
                 fetchImpl: deps.fetchImpl,
             });
             return {
-                exitCode: report.status === 'completed_with_failures' ? 1 : 0,
+                exitCode: report.status === 'completed' ? 0 : 1,
                 stdout: stringifyJson(report, datasetFlags.json),
                 stderr: '',
             };
@@ -5753,6 +6057,215 @@ export async function executeCli(argv, deps) {
             if (!action || action === '--help' || action === '-h') {
                 return { exitCode: 0, stdout: `${renderDatasetMaintenanceHelp()}\n`, stderr: '' };
             }
+            if (action === 'flow-identity') {
+                const flowAction = commandArgs[1] ?? '';
+                if (!flowAction || flowAction === '--help' || flowAction === '-h') {
+                    return {
+                        exitCode: 0,
+                        stdout: `${renderDatasetMaintenanceFlowIdentityHelp()}\n`,
+                        stderr: '',
+                    };
+                }
+                const datasetFlags = parseDatasetMaintenanceFlowIdentityFlags(commandArgs.slice(2));
+                if (datasetFlags.help) {
+                    return {
+                        exitCode: 0,
+                        stdout: `${renderDatasetMaintenanceFlowIdentityHelp()}\n`,
+                        stderr: '',
+                    };
+                }
+                const required = (value, flag) => {
+                    if (!value) {
+                        throw new CliError(`dataset maintenance flow-identity ${flowAction} requires ${flag}.`, {
+                            code: 'DATASET_FLOW_IDENTITY_ARGUMENT_REQUIRED',
+                            exitCode: 2,
+                        });
+                    }
+                    return value;
+                };
+                if (flowAction === 'capture') {
+                    const report = await flowIdentityCaptureImpl({
+                        policyPath: required(datasetFlags.policyPath, '--policy'),
+                        reviewLedgerPath: required(datasetFlags.reviewLedgerPath, '--review-ledger'),
+                        prerequisitesPath: required(datasetFlags.prerequisitesPath, '--prerequisites'),
+                        toolchainEvidencePath: required(datasetFlags.toolchainEvidencePath, '--toolchain-evidence'),
+                        requestId: required(datasetFlags.requestId, '--request-id'),
+                        operationId: required(datasetFlags.operationId, '--operation-id'),
+                        expectedProjectRef: required(datasetFlags.expectedProjectRef, '--expected-project-ref'),
+                        confirm: required(datasetFlags.confirm, '--confirm'),
+                        cliVersion: loadCliPackageVersion(import.meta.url),
+                        sdkVersion: required(datasetFlags.sdkVersion, '--sdk-version'),
+                        outDir: required(datasetFlags.outDir, '--out-dir'),
+                        pageSize: datasetFlags.pageSize,
+                        readConcurrency: datasetFlags.readConcurrency,
+                        timeoutMs: datasetFlags.timeoutMs,
+                        env: deps.env,
+                        fetchImpl: deps.fetchImpl,
+                    });
+                    return { exitCode: 0, stdout: stringifyJson(report, datasetFlags.json), stderr: '' };
+                }
+                if (flowAction === 'plan') {
+                    const plan = await flowIdentityPlanImpl({
+                        policyPath: required(datasetFlags.policyPath, '--policy'),
+                        reviewLedgerPath: required(datasetFlags.reviewLedgerPath, '--review-ledger'),
+                        liveCapturePath: required(datasetFlags.liveCapturePath, '--live-capture'),
+                        outDir: required(datasetFlags.outDir, '--out-dir'),
+                    });
+                    return { exitCode: 0, stdout: stringifyJson(plan, datasetFlags.json), stderr: '' };
+                }
+                if (flowAction === 'freeze') {
+                    const report = await flowIdentityFreezeImpl({
+                        planPath: required(datasetFlags.planPath, '--plan'),
+                        toolchainEvidencePath: required(datasetFlags.toolchainEvidencePath, '--toolchain-evidence'),
+                        approvedAtUtc: required(datasetFlags.approvedAtUtc, '--approved-at'),
+                        expectedProjectRef: required(datasetFlags.expectedProjectRef, '--expected-project-ref'),
+                        confirm: required(datasetFlags.confirm, '--confirm'),
+                        cliVersion: loadCliPackageVersion(import.meta.url),
+                        outDir: required(datasetFlags.outDir, '--out-dir'),
+                    });
+                    return { exitCode: 0, stdout: stringifyJson(report, datasetFlags.json), stderr: '' };
+                }
+                if (flowAction === 'seal-approval') {
+                    const report = await flowIdentityApprovalSealImpl({
+                        planPath: required(datasetFlags.planPath, '--plan'),
+                        freezePath: required(datasetFlags.freezePath, '--freeze'),
+                        approvalRequestPath: required(datasetFlags.approvalRequestPath, '--approval-request'),
+                        humanApprovalPath: required(datasetFlags.humanApprovalPath, '--human-approval'),
+                        approveFreezeFile: required(datasetFlags.approveFreezeFile, '--approve-freeze-file'),
+                        approveRequest: required(datasetFlags.approveRequest, '--approve-request'),
+                        approveText: required(datasetFlags.approveText, '--approve-text'),
+                        confirm: required(datasetFlags.confirm, '--confirm'),
+                        approvedAtUtc: required(datasetFlags.approvedAtUtc, '--approved-at'),
+                        outDir: required(datasetFlags.outDir, '--out-dir'),
+                    });
+                    return { exitCode: 0, stdout: stringifyJson(report, datasetFlags.json), stderr: '' };
+                }
+                if (flowAction === 'freeze-recovery') {
+                    const recoveryReason = required(datasetFlags.recoveryReason, '--recovery-reason');
+                    if (![
+                        'wrapper_exited_without_permit',
+                        'process_response_ambiguous',
+                        'process_domain_rejected',
+                        'finalize_response_ambiguous',
+                        'derivatives_became_ready_after_wrapper_exit',
+                    ].includes(recoveryReason)) {
+                        throw new CliError('flow-identity recovery reason is not allowed.', {
+                            code: 'DATASET_FLOW_IDENTITY_RECOVERY_REASON_INVALID',
+                            exitCode: 2,
+                        });
+                    }
+                    const report = await flowIdentityRecoveryFreezeImpl({
+                        planPath: required(datasetFlags.planPath, '--plan'),
+                        freezePath: required(datasetFlags.freezePath, '--freeze'),
+                        approvalPath: required(datasetFlags.approvalPath, '--approval'),
+                        runDir: required(datasetFlags.runDir, '--run-dir'),
+                        toolchainEvidencePath: required(datasetFlags.toolchainEvidencePath, '--toolchain-evidence'),
+                        expectedProjectRef: required(datasetFlags.expectedProjectRef, '--expected-project-ref'),
+                        confirm: required(datasetFlags.confirm, '--confirm'),
+                        approvedAtUtc: required(datasetFlags.approvedAtUtc, '--approved-at'),
+                        recoveryReason: recoveryReason,
+                        cliVersion: loadCliPackageVersion(import.meta.url),
+                        outDir: required(datasetFlags.outDir, '--out-dir'),
+                        timeoutMs: datasetFlags.timeoutMs,
+                        env: deps.env,
+                        fetchImpl: deps.fetchImpl,
+                    });
+                    return { exitCode: 0, stdout: stringifyJson(report, datasetFlags.json), stderr: '' };
+                }
+                if (flowAction === 'seal-recovery-approval') {
+                    const report = flowIdentityRecoveryApprovalSealImpl({
+                        recoveryFreezePath: required(datasetFlags.recoveryFreezePath, '--recovery-freeze'),
+                        approvalRequestPath: required(datasetFlags.approvalRequestPath, '--approval-request'),
+                        humanApprovalPath: required(datasetFlags.humanApprovalPath, '--human-approval'),
+                        approveFreezeFile: required(datasetFlags.approveFreezeFile, '--approve-freeze-file'),
+                        approveRequest: required(datasetFlags.approveRequest, '--approve-request'),
+                        approveText: required(datasetFlags.approveText, '--approve-text'),
+                        confirm: required(datasetFlags.confirm, '--confirm'),
+                        approvedAtUtc: required(datasetFlags.approvedAtUtc, '--approved-at'),
+                        outDir: required(datasetFlags.outDir, '--out-dir'),
+                    });
+                    return { exitCode: 0, stdout: stringifyJson(report, datasetFlags.json), stderr: '' };
+                }
+                if (flowAction === 'run-recovery') {
+                    if (!datasetFlags.commit || datasetFlags.statusOnly) {
+                        throw new CliError('flow-identity run-recovery requires --commit only.', {
+                            code: 'DATASET_FLOW_IDENTITY_RECOVERY_RUN_MODE_INVALID',
+                            exitCode: 2,
+                        });
+                    }
+                    const report = await flowIdentityRunImpl({
+                        planPath: required(datasetFlags.planPath, '--plan'),
+                        freezePath: required(datasetFlags.freezePath, '--freeze'),
+                        approvalPath: required(datasetFlags.approvalPath, '--approval'),
+                        recoveryRunDir: required(datasetFlags.runDir, '--run-dir'),
+                        recoveryFreezePath: required(datasetFlags.recoveryFreezePath, '--recovery-freeze'),
+                        recoveryApprovalPath: required(datasetFlags.recoveryApprovalPath, '--recovery-approval'),
+                        outDir: required(datasetFlags.outDir, '--out-dir'),
+                        commit: true,
+                        statusOnly: false,
+                        approveExecution: required(datasetFlags.approveExecution, '--approve-execution'),
+                        confirm: required(datasetFlags.confirm, '--confirm'),
+                        waitSeconds: datasetFlags.waitSeconds,
+                        pollMs: datasetFlags.pollMs,
+                        timeoutMs: datasetFlags.timeoutMs,
+                        env: deps.env,
+                        fetchImpl: deps.fetchImpl,
+                    });
+                    return {
+                        exitCode: report.status === 'passed' ? 0 : 1,
+                        stdout: stringifyJson(report, datasetFlags.json),
+                        stderr: '',
+                    };
+                }
+                if (flowAction === 'run') {
+                    if (datasetFlags.commit === datasetFlags.statusOnly) {
+                        throw new CliError('flow-identity run requires exactly one of --commit or --status-only.', { code: 'DATASET_FLOW_IDENTITY_RUN_MODE_INVALID', exitCode: 2 });
+                    }
+                    if (datasetFlags.commit) {
+                        required(datasetFlags.approveExecution, '--approve-execution');
+                        required(datasetFlags.confirm, '--confirm');
+                    }
+                    const report = await flowIdentityRunImpl({
+                        planPath: required(datasetFlags.planPath, '--plan'),
+                        freezePath: required(datasetFlags.freezePath, '--freeze'),
+                        approvalPath: required(datasetFlags.approvalPath, '--approval'),
+                        outDir: required(datasetFlags.outDir, '--out-dir'),
+                        commit: datasetFlags.commit,
+                        statusOnly: datasetFlags.statusOnly,
+                        approveExecution: datasetFlags.approveExecution || undefined,
+                        confirm: datasetFlags.confirm || undefined,
+                        waitSeconds: datasetFlags.waitSeconds,
+                        pollMs: datasetFlags.pollMs,
+                        timeoutMs: datasetFlags.timeoutMs,
+                        env: deps.env,
+                        fetchImpl: deps.fetchImpl,
+                    });
+                    return {
+                        exitCode: report.status === 'passed' ? 0 : 1,
+                        stdout: stringifyJson(report, datasetFlags.json),
+                        stderr: '',
+                    };
+                }
+                if (flowAction === 'verify') {
+                    const report = await flowIdentityVerifyImpl({
+                        planPath: required(datasetFlags.planPath, '--plan'),
+                        freezePath: required(datasetFlags.freezePath, '--freeze'),
+                        approvalPath: required(datasetFlags.approvalPath, '--approval'),
+                        runDir: required(datasetFlags.runDir, '--run-dir'),
+                        outDir: required(datasetFlags.outDir, '--out-dir'),
+                        pageSize: datasetFlags.pageSize,
+                        timeoutMs: datasetFlags.timeoutMs,
+                        env: deps.env,
+                        fetchImpl: deps.fetchImpl,
+                    });
+                    return {
+                        exitCode: report.status === 'passed' ? 0 : 1,
+                        stdout: stringifyJson(report, datasetFlags.json),
+                        stderr: '',
+                    };
+                }
+                throw new CliError("dataset maintenance flow-identity action must be 'capture', 'plan', 'freeze', 'seal-approval', 'run', 'freeze-recovery', 'seal-recovery-approval', 'run-recovery', or 'verify'.", { code: 'DATASET_FLOW_IDENTITY_ACTION_INVALID', exitCode: 2 });
+            }
             if (action === 'clear-account') {
                 const datasetFlags = parseDatasetMaintenanceClearAccountFlags(commandArgs.slice(1));
                 if (datasetFlags.help) {
@@ -6125,7 +6638,7 @@ export async function executeCli(argv, deps) {
                     stderr: '',
                 };
             }
-            throw new CliError("dataset maintenance action must be 'clear-account', 'plan', 'apply', 'freeze-protected', 'seal-protected-approval', 'run-protected', or 'verify'.", {
+            throw new CliError("dataset maintenance action must be 'clear-account', 'plan', 'apply', 'freeze-protected', 'seal-protected-approval', 'run-protected', 'verify', or 'flow-identity'.", {
                 code: 'DATASET_MAINTENANCE_ACTION_INVALID',
                 exitCode: 2,
             });
@@ -6969,6 +7482,42 @@ export async function executeCli(argv, deps) {
                 stderr: '',
             };
         }
+        if (command === 'release' && !subcommand) {
+            return { exitCode: 0, stdout: `${renderLcaReleaseHelp()}\n`, stderr: '' };
+        }
+        if (command === 'release' && subcommand) {
+            const releaseFlags = parseLcaReleaseFlags(commandArgs);
+            if (releaseFlags.help) {
+                return { exitCode: 0, stdout: `${renderLcaReleaseHelp()}\n`, stderr: '' };
+            }
+            const action = requireLcaReleaseAction(subcommand);
+            const env = { ...deps.env };
+            if (releaseFlags.apiKey !== null) {
+                env.TIANGONG_LCA_API_KEY = releaseFlags.apiKey;
+            }
+            if (releaseFlags.apiBaseUrl !== null) {
+                env.TIANGONG_LCA_API_BASE_URL = releaseFlags.apiBaseUrl;
+            }
+            const report = await lcaReleaseImpl({
+                action,
+                inputPath: releaseFlags.inputPath,
+                outputPath: releaseFlags.outputPath,
+                releaseRunId: releaseFlags.releaseRunId,
+                packageId: releaseFlags.packageId,
+                artifactId: releaseFlags.artifactId,
+                artifactPath: releaseFlags.artifactPath,
+                env,
+                timeoutMs: releaseFlags.timeoutMs,
+                dryRun: releaseFlags.dryRun,
+                force: releaseFlags.force,
+                fetchImpl: deps.fetchImpl,
+            });
+            return {
+                exitCode: 0,
+                stdout: releaseFlags.json ? stringifyJson(report, true) : renderLcaReleaseReport(report),
+                stderr: '',
+            };
+        }
         if (command === 'admin' && !subcommand && commandArgs.includes('--help')) {
             return { exitCode: 0, stdout: `${renderAdminHelp()}\n`, stderr: '' };
         }