@tiangong-lca/cli 0.0.33 → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) TianGong LCA contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -14,18 +14,34 @@ whenToUpdate:
 checkPaths:
   - README.md
   - package.json
+  - pnpm-workspace.yaml
+  - pnpm-lock.yaml
   - bin/**
   - src/cli.ts
   - src/main.ts
+  - src/lib/auth-identity-receipt.ts
   - src/lib/lca-release.ts
+  - scripts/run-auth-identity-production-case.ts
+  - test/auth-identity*.test.ts
   - test/lca-release*.test.ts
-lastReviewedAt: 2026-07-23
-lastReviewedCommit: 5c90ddd60328748ab6d8d89717e59dcaeca8cde7
+lastReviewedAt: 2026-08-25
+lastReviewedCommit: 47b44c65cf4bf27070fa1057e672c6ef2b2e54f3
+lastReviewedNote: 'Reviewed for Issue #230: identifies 0.1.1 as the public auth-receipt release on exact Node 24.19.0 with cryptographic Sigstore and isolated pnpm verification.'
 ---
 
 # TianGong LCA CLI
 
-Package: `@tiangong-lca/cli` Executable: `tiangong-lca` Node: `24.x`
+Package: `@tiangong-lca/cli` Executable: `tiangong-lca` Current package version: `0.1.1` Node: `24.19.0`
+
+Repository development is single-track on pnpm `11.23.0` and TypeScript `7.0.2`. The published package remains a clean, package-manager-neutral consumer artifact: it contains runtime files only, not pnpm, TypeScript, Oxlint, tests, source-only tooling, or repository lockfiles.
+
+Review note, 2026-08-25: Issue #224 migrates repository development and release automation to the sole root `pnpm-workspace.yaml` / `pnpm-lock.yaml`, TypeScript 7.0.2, and type-aware Oxlint on Node 24. The feature change deliberately keeps version 0.0.33. A separate release-only PR should prepare 0.1.0 after the toolchain change merges and its full package/coverage/release gates pass.
+
+Review note, 2026-08-25: Issue #226 publishes that 0.1.0 compatibility boundary after merged PR #225. Version metadata and public release evidence advance to 0.1.0; the runtime JavaScript/assets surface, command behavior, Node 24 runtime, pnpm/TypeScript 7 development baseline, native pnpm Trusted Publishing/provenance, and exact released-commit workspace handoff remain unchanged from the reviewed feature delivery.
+
+Review note, 2026-08-25: Issue #228 implements `auth identity-receipt` as a bounded read-only current-user proof. It checks expected project intent before session work, verifies the live user through `/auth/v1/user`, allows one auth-refresh replay after 401/403, and emits an exact-key canonical receipt without API keys, tokens, full email addresses, session paths, or credential-derived fingerprints. Production callers must pass both expected assertions and accept only `assertions.mode="intent-bound"`.
+
+Review note, 2026-08-25: Issue #230 publishes the merged identity receipt as `@tiangong-lca/cli@0.1.1`. Runtime logic and published dependencies remain unchanged; the sole pnpm lock changes only for exact dev-only `sigstore@5.0.0`. Local metadata, engines, and every workflow converge on Node 24.19.0. Release automation asserts actual platform/architecture across the reusable four-platform pre-tag matrix and provides `pnpm release:verify-published` for cryptographic Fulcio/CT/Rekor provenance, registry signatures, actual tarball integrity, isolated user/global package-manager configuration, exact pnpm 11.23.0, and credential-free bin/ESM/CJS consumer proof.
 
 Review note, 2026-07-12: `dataset maintenance plan/apply/verify` provides current-user RLS-scoped exact-row maintenance with immutable plans, explicit approval, per-action logs, platform audit correlation, and independent readback. `merge-support-aliases` now runs only in `target_mode=owner_draft`: source/target support and all changed rows stay private `state_code=0`; publication is a separate future workflow.
 
@@ -47,20 +63,24 @@ Review note, 2026-07-24: CLI 0.0.32 adds bounded execution-contract concurrency
 
 Review note, 2026-07-24: CLI 0.0.33 adds an explicit `dataset maintenance apply --max-parallel 1..8` profile for large owner-draft flow convergence. It accepts only unique flow delete-only plans with zero frozen and fresh visible-process inbound references, persists `PREPARED` and `DISPATCHED` before each protected RPC, requires exact absent readback for `COMMITTED`, never automatically replays success or UNKNOWN, and continues independent rows.
 
+Review note, 2026-07-25: The complete RLS-visible process fence now paginates in the strict `(id, version)` primary-key order. It still has no `user_id` filter and retains exact-count completeness, while avoiding a redundant owner/state sort before any deletion can dispatch.
+
+Review note, 2026-07-25: Bounded flow deletion can instead accept an explicitly SHA-approved, at-most-30-minute-old SELECT-only proof covering all process rows. The proof binds the exact project, actor, plan, ordered delete targets, and contiguous target chunks and must report zero inbound edges and zero P0/P1 findings. The CLI validates it before approval or dispatch and never executes the proof SQL itself; omitting the flags preserves the live RLS-visible scan.
+
 ## Run
 
 One-off published run:
 
 ```bash
-npm exec --yes --package=@tiangong-lca/cli@latest -- tiangong-lca --help
-npm exec --yes --package=@tiangong-lca/cli@latest -- tiangong-lca doctor
-npm exec --yes --package=@tiangong-lca/cli@latest -- tiangong-lca flow --help
+pnpm dlx @tiangong-lca/cli@latest --help
+pnpm dlx @tiangong-lca/cli@latest doctor
+pnpm dlx @tiangong-lca/cli@latest flow --help
 ```
 
 Install the published CLI:
 
 ```bash
-npm install --global @tiangong-lca/cli
+pnpm add --global @tiangong-lca/cli
 tiangong-lca --help
 tiangong-lca doctor
 tiangong-lca flow --help
@@ -69,8 +89,8 @@ tiangong-lca flow --help
 Run from this repository:
 
 ```bash
-npm ci
-npm run build
+pnpm install --frozen-lockfile
+pnpm build
 node ./bin/tiangong-lca.js --help
 ```
 
@@ -99,6 +119,31 @@ TIANGONG_LCA_DISABLE_SESSION_CACHE=false
 TIANGONG_LCA_FORCE_REAUTH=false
 ```
 
+## Auth Identity Receipt
+
+Use the identity receipt before a production-backed case or any later owner-draft write gate:
+
+```text
+tiangong-lca auth identity-receipt --expected-project-ref <project-ref> --expected-user-id <user-id> --json
+```
+
+The command performs no dataset write. It exchanges the normal user API key for a session, checks the canonical Supabase project, and makes a bounded live `GET /auth/v1/user`. A cached token that receives `401` or `403` may be refreshed and retried exactly once; all other transport or response failures are terminal. A valid production guard requires:
+
+- `schema` exactly `tiangong-lca.auth-identity-receipt.v1`;
+- `status: "passed"`, `operation: "current-user-read"`, and `remote_write_mode: "read-only"`;
+- exact expected project/user values with `assertions.mode: "intent-bound"` and `requested_count: 2`;
+- a fresh capture time and a valid recomputed `receipt_scope_sha256`.
+
+Calling without expectations is allowed for discovery but produces `assertions.mode: "observed"`; it is not an authorization guard. The safe display email is masked and must not be used as the account key. The receipt deliberately excludes credentials, full email, session-file details, raw response metadata, and all credential/token/path-derived fingerprints.
+
+For the explicitly authorized local production read case from a validated repository checkout, invoke the narrow TypeScript runner with a new private output directory:
+
+```text
+pnpm case:auth-identity:production -- --env-file <data-foundry-ignored-.env> --expected-project-ref <project-ref> --expected-user-id <user-id> --out-dir <new-private-case-directory>
+```
+
+The runner reads only `TIANGONG_LCA_API_BASE_URL`, `TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY`, and `TIANGONG_LCA_TEST_API_KEY`; the last is mapped to the child process's standard API-key variable. It does not accept an alternate CLI path. The pnpm command first performs a clean TS7 build without the production env. Its plain-Node runner then single-reads source/config/lock and the freshly generated `dist/src/**/*.js`, hashes the source tree, runner, runtime, exact entrypoint, and pnpm lock, and copies those exact built buffers into a private snapshot before exposing the key. It forces reauthentication with session cache disabled, runs only the built snapshot from an exclusively created clean directory with an argv array and `shell:false`, cleans the snapshot before publishing success artifacts, and persists only the parsed receipt and case manifest. POSIX creates the case directory as `0700` and files as `0600`; Windows inherits ACLs from the caller-selected parent, so use a user-restricted parent because mode bits are not an ACL guarantee. The runner never stores raw child stdout/stderr and is intentionally not wired to CI secrets. This receipt is locally hash-verifiable, not server-signed attestation.
+
 ## LCI/LCIA Data Release
 
 The `release` command family is the authenticated transport used by the standalone release control plane. It does not introduce a TIDAS schema variant: result packages reuse the existing Process exchange structure for LCI and the existing Process LCIA result fields, with a LifecycleModel referencing the resulting Process.
@@ -255,7 +300,7 @@ Key outputs under `--out-dir`:
 
 `--candidate-input` is repeatable and accepts JSON, JSONL, or a directory scanned recursively for JSON/JSONL candidate rows. Embedded `candidates` from the request and local-scan candidates are evaluated together. Add `--remote-candidates` when the preflight should also call `process_hybrid_search` or `flow_hybrid_search`; `--remote-query` overrides the target-derived search text and `--remote-limit` caps returned candidate rows. Remote candidate search uses the normal Supabase session env: `TIANGONG_LCA_API_BASE_URL`, `TIANGONG_LCA_API_KEY`, `TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY`, and optional `TIANGONG_LCA_REGION`.
 
-When remote search is enabled, the CLI sends a compact fielded `query` string plus supported edge-search options to `process_hybrid_search` or `flow_hybrid_search`: `filter`, `match_count`, `page_size`, `data_source`, `match_threshold`, `full_text_weight`, `extracted_text_weight`, `semantic_weight`, and `rrf_k`. Request-level `remote_candidate_search.profile_hints` are not sent to the Edge Function. They are applied locally before scoring candidates so Foundry can provide source-derived facts such as flow type, flow property, reference unit, elementary categories, geography, reference-flow names, technology route, and system boundary without polluting the full-text/semantic query.
+When remote search is enabled, the CLI sends a compact fielded `query` string plus supported edge-search options to `process_hybrid_search` or `flow_hybrid_search`: `filter`, `match_count`, `page_size`, `data_source`, `match_threshold`, `lexical_weight`, `semantic_weight`, and `rrf_k`. `lexical_weight` controls the single database-owned `extracted_md` lexical branch. Request-level `remote_candidate_search.profile_hints` are not sent to the Edge Function. They are applied locally before scoring candidates so Foundry can provide source-derived facts such as flow type, flow property, reference unit, elementary categories, geography, reference-flow names, technology route, and system boundary without polluting the full-text/semantic query.
 
 Exact process exchange fingerprints with matching identity context block duplicate creation, while weaker inventory-only matches still route to manual review. Flow preflight also blocks alias-equivalent flows when type, reference property, unit, and category/CAS evidence match.
 
@@ -270,7 +315,7 @@ tiangong-lca flow build-plan validate --input ./flow-build-plan.json --out-dir .
 tiangong-lca flow build-plan materialize --input ./flow-build-plan.json --out-dir ./flow-build-plan --json
 ```
 
-The minimum plan contract requires an automatic identity decision, EvidenceManifest sources and field bindings, name plan, and the relevant process reference-flow or flow-property fields. Process materialization carries name, quantitative reference, exchange, source evidence, modelling, administrative, and annual supply/production fields from the plan into `processDataSet`; when annual volume source evidence is not explicit, Foundry-facing required-field completion uses the deterministic `9999 missing-data-sentinel/year` value so the schema-required field stays searchable for later database-side curation. Flow materialization carries name, flow type, reference property, source evidence, administrative, and classification fields into `flowDataSet`. `--report-only` keeps exit code `0` while still reporting blockers.
+The minimum plan contract requires an automatic identity decision, EvidenceManifest sources and field bindings, name plan, and the relevant process reference-flow or flow-property fields. Plan-only materialization additionally requires an explicit canonical `classification_path`: continuous level `0..n` objects with exact locked `@classId`/`#text` for process and product/waste flow taxonomies, or `@catId`/`#text` for elementary flows. Label-only, missing, malformed, or taxonomy-spoofed classifications fail before artifact publication. Process materialization carries name, quantitative reference, exchange, source evidence, modelling, administrative, and annual supply/production fields from the plan into `processDataSet`; when annual volume source evidence is not explicit, Foundry-facing required-field completion uses the deterministic `9999 missing-data-sentinel/year` value so the schema-required field stays searchable for later database-side curation. Flow materialization carries name, flow type, reference property, source evidence, administrative, and classification fields into `flowDataSet`. `--report-only` keeps exit code `0` while still reporting blockers.
 
 Key outputs under `--out-dir`:
 
@@ -369,6 +414,7 @@ tiangong-lca dataset classification apply --type location --input ./rows/process
 tiangong-lca dataset curation-queue build --processes ./rows/processes.jsonl --flows ./rows/flows.jsonl --support ./rows/sources.jsonl --out-dir /abs/path/to/curation-queue --json
 tiangong-lca dataset curation-queue next --queue-dir /abs/path/to/curation-queue --type support --json
 tiangong-lca dataset curation-queue verify --queue-dir /abs/path/to/curation-queue --type process --json
+tiangong-lca dataset import-lca convert --input ./external/simapro.csv --output-dir /abs/path/to/imported --from-format simapro-csv --target both --write-mapping --json
 tiangong-lca dataset save-draft --input ./rows.jsonl --type auto --execution-contract ./execution-contract.json --max-parallel 8 --out-dir /abs/path/to/dataset-save-draft --commit --json
 tiangong-lca dataset evidence-search plan --query "中国2026年电力结构数据" --out-dir /abs/path/to/evidence-search --json
 tiangong-lca dataset evidence-search run --input ./evidence-search.request.json --results ./search-results.json --out-dir /abs/path/to/evidence-search --json
@@ -401,13 +447,13 @@ For `qa process`, `--rows-file` accepts either raw process rows as JSON/JSONL or
 
 For `process identity-preflight` and `flow identity-preflight`, canonical TIDAS wrappers are schema-checked when present. Loose target objects are accepted for early planning and produce `schema_validation.status: "not_applicable"` until materialization. Candidate rows can be embedded in the request, loaded from repeatable `--candidate-input` local files/directories, or fetched through explicit `--remote-candidates` hybrid search; `identity-candidate-sources.json` records scanned files, remote endpoints, queries, filters, edge-search options, and row counts. The remote Edge Function receives only search-safe query/options fields; local-only `profile_hints` stay in the preflight target profile and candidate scoring evidence.
 
-For `process build-plan` and `flow build-plan`, canonical payloads embedded in the plan are schema-checked during `materialize`. Plan-only materialization now creates deterministic canonical `processDataSet` / `flowDataSet` wrappers from the build plan and validates them with the TIDAS SDK before reporting `passed`.
+For `process build-plan` and `flow build-plan`, canonical payloads embedded in the plan are schema-checked during `materialize`. Plan-only materialization creates deterministic canonical `processDataSet` / `flowDataSet` wrappers, requires an explicit canonical locked-taxonomy `classification_path`, and validates the result with the TIDAS SDK before reporting `passed`; it never invents taxonomy ids from free-form labels.
 
 For `process save-draft`, canonical process payloads are validated locally with `ProcessSchema` before any `--commit` write. Schema-invalid rows remain in `outputs/save-draft-rpc/failures.jsonl` instead of being persisted. Batch import callers should pass `--target-user-id`; the CLI then verifies the current auth session and any visible draft owner before writing, while downstream readback verification still proves the final owner and payload.
 
 For `dataset save-draft --execution-contract`, the JSON contract uses schema `dataset-save-draft-execution-contract.v1` and supplies `execution_id`, `project_ref`, an exact owner (`user_id`, lowercase `email`, `state_code: 0`), and ordered actions. Each action binds `action_id`, `desired_sha256`, `expected_operation` (`insert` or `save_draft`), table/id/version, `before_sha256`, and earlier `dependency_action_ids`. Contract mode requires `--commit`; account-local Unit Group or Flow Property support rows additionally require `--allow-account-local-support`. `--max-parallel` defaults to 1 and is capped at 8. When it is greater than 1, every action through the highest referenced dependency remains serial; only the later table/id/version-unique suffix may overlap. The exact owner token is renewed and checked before each DML dispatch. Attempts and outcomes are stored under the platform user-state directory (`$XDG_STATE_HOME/tiangong-lca-cli` when configured), not beside the contract or report. Any prior terminal or unresolved attempt is read back or retained without re-dispatch; exit status is nonzero unless every action has exact terminal success.
 
-For `dataset maintenance apply`, explicitly passing `--max-parallel 1..8` opts into the destructive flow-convergence profile. It accepts only a non-empty, unique-target, flow delete-only plan whose current and projected reference impacts are both zero. Before dispatch it also completes a fresh SELECT-only scan of every process visible to the owner session and rejects any inbound edge. Each action writes append-only `PREPARED` and `DISPATCHED` evidence before its protected owner-session RPC, then records `COMMITTED` only after exact absent readback. An ambiguous action is read back, marked `UNKNOWN`, and never replayed automatically; independent actions continue. Omit the flag to retain ordinary maintenance apply behavior.
+For `dataset maintenance apply`, explicitly passing `--max-parallel 1..8` opts into the destructive flow-convergence profile. It accepts only a non-empty, unique-target, flow delete-only plan whose current and projected reference impacts are both zero. Before dispatch it completes a fresh SELECT-only scan of every process visible to the owner session and rejects any inbound edge. For a separately governed all-process check, pair `--global-inbound-proof /absolute/proof.json` with `--approve-global-inbound-proof <sha256>`; the proof must be fresh, SELECT-only, complete, zero-inbound, and bound to the exact project, actor, plan, and ordered target set, and it is validated before the live scan is skipped. The CLI never runs raw SQL. Each action writes append-only `PREPARED` and `DISPATCHED` evidence before its protected owner-session RPC, then records `COMMITTED` only after exact absent readback. An ambiguous action is read back, marked `UNKNOWN`, and never replayed automatically; independent actions continue. Omit `--max-parallel` to retain ordinary maintenance apply behavior.
 
 For `flow publish-version`, canonical flow payloads are validated locally with `FlowSchema` before remote visibility planning or writes. The command always writes `flow-publish-version-gate-report.json`; blocked rows are written to the remote-failure JSONL without calling the remote service.
 
@@ -423,6 +469,8 @@ For `dataset validate`, `--type auto` supports mixed support scopes containing c
 
 For `dataset curation-queue build/next/verify`, the CLI owns entity-level Foundry import queue state. `build` writes `outputs/curation-queue-manifest.json`, `outputs/curation-queue-tasks.jsonl`, `outputs/curation-queue-locks.json`, `outputs/curation-queue-blockers.jsonl`, and per-entity `input.jsonl`, `closure.json`, and `entity-run-plan.json`. `next` returns one runnable support/flow/process task based on checkpoint state. `verify` passes only when scoped checkpoints are complete and build blockers are absent. AI authoring must return structured patches or build plans, and remote writes remain gated by deterministic apply, schema/QA, prewrite verify, and readback.
 
+For `dataset import-lca convert`, the CLI delegates all format detection, conversion, validation, bounded spooling, cancellation, and atomic publication to unified Rust `tidas import`; it does not reproduce import logic in TypeScript. Binary selection is `--tidas-bin`, then `TIDAS_BIN`, then `tidas` on PATH. Optional `--tidas-config` maps to native `--config`. Every run first requires a successful `tidas version --format json --progress never` handshake with `tidas.operation-report.v1` and a stable `0.2.x` binary version, then validates the native `tidas.import-execution-report.v1` summary and exact exit-class/code mapping. Native controls include explicit or automatic source format, target, mapping output, process-bundle disablement, warning failure, maximum entry size, memory budget, and queue capacity. The supported release matrix is Linux x86_64/ARM64, macOS Intel/Apple Silicon, and Windows x86_64; Windows ARM64 is unsupported. The npm package includes `assets/import-smoke/simapro.csv` for clean-machine proof but does not bundle a platform binary or require Python.
+
 For `dataset references rewrite`, `--commit` executes the state-aware save-draft path for patched process and lifecyclemodel rows; without `--commit`, the command only writes local rewrite artifacts.
 
 ## Dataset Maintenance

package/assets/import-smoke/simapro.csv

@@ -0,0 +1,20 @@
+{SimaPro 8.0}
+{processes}
+{CSV separator: Semicolon}
+{Decimal separator: ,}
+
+Process
+
+Process name
+Test process
+
+Products
+my product;kg;0,5;100;not defined;Agricultural;
+
+Materials/fuels
+Soy oil, refined, at plant/kg/RNA;kg;0,2;Undefined;0;0;0;
+
+Emissions to air
+carbon dioxide;low. pop.;kg;1,5;Undefined;0;0;0;
+
+End

package/bin/tiangong-lca.js

@@ -24,7 +24,7 @@ export function resolveInvokedUrl(argv1 = process.argv[1]) {
 export async function runFromBin(argv = process.argv.slice(2), env = process.env) {
   if (!existsSync(entryPath)) {
     throw new Error(
-      "Missing built CLI artifacts at 'dist/src/main.js'. Run 'npm run build' or reinstall dependencies to regenerate dist.",
+      "Missing built CLI artifacts at 'dist/src/main.js'. Run 'pnpm build' or reinstall dependencies to regenerate dist.",
     );
   }
 

package/dist/src/cli.js

@@ -3,6 +3,7 @@ import { buildDoctorReport, readRuntimeEnv } from './lib/env.js';
 import { CliError, toErrorPayload } from './lib/errors.js';
 import { stringifyJson } from './lib/io.js';
 import { loadCliPackageVersion } from './lib/package-version.js';
+import { AUTH_IDENTITY_MAX_TIMEOUT_MS, AUTH_IDENTITY_RECEIPT_SCHEMA, runAuthIdentityReceipt, } from './lib/auth-identity-receipt.js';
 import { runLifecyclemodelAutoBuild, } from './lib/lifecyclemodel-auto-build.js';
 import { runLifecyclemodelBuildResultingProcess, } from './lib/lifecyclemodel-resulting-process.js';
 import { runLifecyclemodelPublishResultingProcess, } from './lib/lifecyclemodel-publish-resulting-process.js';
@@ -86,6 +87,7 @@ Usage:
 Commands:
 Implemented Commands:
   doctor     show environment diagnostics
+  auth       identity-receipt
   search     flow | process | lifecyclemodel
   process    get | list | identity-preflight | build-plan | scope-statistics | dedup-review | auto-build | resume-build | publish-build | complete-required-fields | save-draft | batch-build | refresh-references | verify-rows
   dataset    contract get | context-pack | classification children/path/audit/apply | curation-queue build/next/verify | import-lca convert | author | patch apply | save-draft | source upload-attachments | validate | verify-remote | bilingual extract/apply/validate | evidence-search plan/run | references rewrite/refresh-remote | maintenance clear-account/plan/apply/verify/flow-identity
@@ -105,6 +107,7 @@ Planned commands currently print an explicit "not implemented yet" message and e
 
 Examples:
   tiangong-lca doctor
+  tiangong-lca auth identity-receipt --expected-project-ref <project-ref> --expected-user-id <user-id> --json
   tiangong-lca search flow --input ./request.json
   tiangong-lca search process --input ./request.json --dry-run
   tiangong-lca process get --id <process-id>
@@ -180,6 +183,50 @@ Environment:
   .env loaded: ${dotEnvStatus.loaded ? `yes (${dotEnvStatus.path}, ${dotEnvStatus.count} keys)` : 'no'}
 `.trim();
 }
+function renderAuthHelp() {
+    return `Usage:
+  tiangong-lca auth identity-receipt [options]
+
+Implemented Subcommands:
+  identity-receipt  Live, read-only proof of the authenticated account and Supabase project
+
+Planned Subcommands:
+  whoami | doctor-auth
+
+Use "tiangong-lca auth identity-receipt --help" for the machine-receipt contract.
+`.trim();
+}
+function renderAuthIdentityReceiptHelp() {
+    return `Usage:
+  tiangong-lca auth identity-receipt [options]
+
+Options:
+  --expected-project-ref <ref>  Assert the exact Supabase project before session/network access
+  --expected-user-id <id>       Assert the exact server-verified authenticated user
+  --timeout-ms <n>              Request timeout 1..${AUTH_IDENTITY_MAX_TIMEOUT_MS} ms (default: 10000)
+  --json                        Print compact JSON; default output is pretty JSON
+  -h, --help
+
+Receipt schema:
+  ${AUTH_IDENTITY_RECEIPT_SCHEMA}
+
+Safety:
+  This is a read-only command that performs one live read of /auth/v1/user, with at most one
+  force-refresh retry after a 401 or 403. It never emits API keys, bearer/session
+  tokens, full email addresses, session paths, or credential-derived fingerprints. Production guards
+  must pass both expected assertions and require assertions.mode="intent-bound".
+
+Required env:
+  TIANGONG_LCA_API_BASE_URL
+  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+
+Optional session env:
+  TIANGONG_LCA_SESSION_FILE
+  TIANGONG_LCA_DISABLE_SESSION_CACHE
+  TIANGONG_LCA_FORCE_REAUTH
+`.trim();
+}
 function renderDoctorHelp() {
     return `Usage:
   tiangong-lca doctor [--json]
@@ -335,7 +382,7 @@ Implemented Subcommands:
   curation-queue build Build entity-level AI curation queue artifacts for Foundry imports
   curation-queue next  Return the next runnable support/flow/process queue task
   curation-queue verify Verify queue task checkpoints for a scope
-  import-lca convert  Convert supported external LCA packages through tidas-tools
+  import-lca convert  Import supported external LCA packages through the unified Rust tidas binary
   author              Extract source evidence and prepare TIDAS context packs for AI authoring
   patch apply          Apply AI-authored structured dataset patches deterministically
   save-draft           Save contact/source/support or other canonical dataset rows through the platform dataset command path
@@ -537,6 +584,8 @@ Options:
   --confirm <email>      Current authenticated account email
   --timeout-ms <n>       Request timeout in milliseconds
   --max-parallel <1-8>   Opt into bounded flow delete-only execution with durable dispatch ledger
+  --global-inbound-proof <file> Absolute path to a fresh all-process SELECT-only zero-inbound proof
+  --approve-global-inbound-proof <sha256> Exact SHA-256 of --global-inbound-proof; requires --max-parallel
   --json                 Print compact JSON
   -h, --help
 
@@ -833,30 +882,33 @@ function renderDatasetImportLcaHelp() {
 
 Options:
   --input <path>          Source file, directory, or package to import
-  --output-dir <dir>      Output directory for generated package and reports
+  --output-dir <dir>      Output directory atomically published by tidas
   --from-format <format>  auto, ecospold1, ecospold2, openlca-jsonld, openlca-process-xlsx, simapro-csv, ilcd
   --target <target>       tidas | ilcd | both (default: tidas)
-  --report <file>         Conversion report path (default: <output-dir>/conversion-report.json)
-  --mapping-dir <dir>     Optional custom mapping/reference data directory
-  --language <lang>       Default language for generated text (default: en)
-  --validation-jobs <n>   Parallel validation jobs passed to tidas-tools (default: 1)
-  --process-bundles       Write per-process dependency bundles (default: enabled by tidas-tools)
-  --process-bundles-dir <dir>
-                           Custom per-process bundle directory (default: <output-dir>/process-bundles)
+  --report <file>         Persist the native operation report atomically instead of using tidas stdout
+  --write-mapping         Write deterministic mapping.csv.gz
   --no-process-bundles    Disable per-process dependency bundle generation
-  --detect-only           Only detect the input format and write the report
   --fail-on-warning       Return non-zero when converter warnings are present
-  --python <bin>          Python executable (default: python3)
-  --tidas-tools-dir <dir> Explicit tidas-tools checkout path
+  --max-entry-mib <n>     Maximum source-entry size in MiB (tidas default: 128)
+  --memory-budget-mib <n> Maximum accounted in-flight memory in MiB (tidas default: 512)
+  --queue-capacity <n>    Maximum items in each bounded queue (tidas default: 256)
+  --tidas-bin <path>      Rust tidas executable (default: TIDAS_BIN, then tidas on PATH)
+  --tidas-config <path>   Explicit tidas config file (otherwise TIDAS_CONFIG is honored)
   --json                  Print compact JSON
   -h, --help
 
 Outputs written under --output-dir:
-  - conversion-report.json
-  - tidas/ when target includes TIDAS and not detect-only
-  - ilcd/ when target includes ILCD and not detect-only
-  - process-bundles/ when not detect-only and process bundles are enabled
-  - outputs/import-lca-report.json
+  - import-report.json and issues.jsonl
+  - tidas/ when target includes TIDAS
+  - ilcd/ when target includes ILCD
+  - process-bundles/ by default
+  - mapping.csv.gz when --write-mapping is used
+
+Runtime contract:
+  - Linux x86_64/ARM64, macOS Intel/Apple Silicon, and Windows x86_64 are supported.
+  - Windows ARM64 is unsupported.
+  - The binary must report tidas.operation-report.v1 and a stable 0.2.x version.
+  - Import publication, cancellation cleanup, and domain validation remain owned by Rust tidas.
 `.trim();
 }
 function renderDatasetAuthorHelp() {
@@ -2264,6 +2316,59 @@ function parseDoctorFlags(args) {
         json: Boolean(values.json),
     };
 }
+function parseAuthIdentityReceiptFlags(args) {
+    let parsed;
+    try {
+        parsed = parseArgs({
+            args,
+            allowPositionals: false,
+            strict: true,
+            tokens: true,
+            options: {
+                help: { type: 'boolean', short: 'h' },
+                json: { type: 'boolean' },
+                'expected-project-ref': { type: 'string' },
+                'expected-user-id': { type: 'string' },
+                'timeout-ms': { type: 'string' },
+            },
+        });
+    }
+    catch (error) {
+        throw new CliError(String(error), {
+            code: 'INVALID_ARGS',
+            exitCode: 2,
+        });
+    }
+    const tokens = parsed.tokens;
+    for (const optionName of ['expected-project-ref', 'expected-user-id', 'timeout-ms']) {
+        const occurrences = tokens.filter((entry) => entry.kind === 'option' && entry.name === optionName).length;
+        if (occurrences > 1) {
+            throw new CliError(`Option --${optionName} may be provided only once.`, {
+                code: 'INVALID_ARGS',
+                exitCode: 2,
+            });
+        }
+    }
+    const timeoutText = typeof parsed.values['timeout-ms'] === 'string' ? parsed.values['timeout-ms'] : undefined;
+    const timeoutMs = timeoutText === undefined ? 10_000 : Number(timeoutText);
+    if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > AUTH_IDENTITY_MAX_TIMEOUT_MS) {
+        throw new CliError(`Expected --timeout-ms to be an integer between 1 and ${AUTH_IDENTITY_MAX_TIMEOUT_MS}.`, {
+            code: 'INVALID_TIMEOUT',
+            exitCode: 2,
+        });
+    }
+    return {
+        help: Boolean(parsed.values.help),
+        json: Boolean(parsed.values.json),
+        expectedProjectRef: typeof parsed.values['expected-project-ref'] === 'string'
+            ? parsed.values['expected-project-ref']
+            : null,
+        expectedUserId: typeof parsed.values['expected-user-id'] === 'string'
+            ? parsed.values['expected-user-id']
+            : null,
+        timeoutMs,
+    };
+}
 function parseRemoteFlags(args) {
     let values;
     try {
@@ -2854,16 +2959,14 @@ function parseDatasetImportLcaConvertFlags(args) {
                 'from-format': { type: 'string' },
                 target: { type: 'string' },
                 report: { type: 'string' },
-                'mapping-dir': { type: 'string' },
-                language: { type: 'string' },
-                'validation-jobs': { type: 'string' },
-                'process-bundles': { type: 'boolean' },
-                'process-bundles-dir': { type: 'string' },
+                'write-mapping': { type: 'boolean' },
                 'no-process-bundles': { type: 'boolean' },
-                'detect-only': { type: 'boolean' },
                 'fail-on-warning': { type: 'boolean' },
-                python: { type: 'string' },
-                'tidas-tools-dir': { type: 'string' },
+                'max-entry-mib': { type: 'string' },
+                'memory-budget-mib': { type: 'string' },
+                'queue-capacity': { type: 'string' },
+                'tidas-bin': { type: 'string' },
+                'tidas-config': { type: 'string' },
             },
         }));
     }
@@ -2873,25 +2976,9 @@ function parseDatasetImportLcaConvertFlags(args) {
             exitCode: 2,
         });
     }
-    const validationJobs = typeof values['validation-jobs'] === 'string' ? Number(values['validation-jobs']) : undefined;
-    if (validationJobs !== undefined && (!Number.isInteger(validationJobs) || validationJobs < 0)) {
-        throw new CliError('--validation-jobs must be a non-negative integer.', {
-            code: 'DATASET_IMPORT_LCA_VALIDATION_JOBS_INVALID',
-            exitCode: 2,
-        });
-    }
-    if (values['process-bundles'] && values['no-process-bundles']) {
-        throw new CliError('--process-bundles and --no-process-bundles cannot both be set.', {
-            code: 'DATASET_IMPORT_LCA_PROCESS_BUNDLES_INVALID',
-            exitCode: 2,
-        });
-    }
-    if (values['no-process-bundles'] && typeof values['process-bundles-dir'] === 'string') {
-        throw new CliError('--process-bundles-dir cannot be used with --no-process-bundles.', {
-            code: 'DATASET_IMPORT_LCA_PROCESS_BUNDLES_INVALID',
-            exitCode: 2,
-        });
-    }
+    const maxEntryMib = parsePositiveIntegerFlag(values['max-entry-mib'], '--max-entry-mib');
+    const memoryBudgetMib = parsePositiveIntegerFlag(values['memory-budget-mib'], '--memory-budget-mib');
+    const queueCapacity = parsePositiveIntegerFlag(values['queue-capacity'], '--queue-capacity');
     return {
         help: Boolean(values.help),
         json: Boolean(values.json),
@@ -2900,21 +2987,29 @@ function parseDatasetImportLcaConvertFlags(args) {
         fromFormat: typeof values['from-format'] === 'string' ? values['from-format'] : undefined,
         target: typeof values.target === 'string' ? values.target : undefined,
         reportPath: typeof values.report === 'string' ? values.report : undefined,
-        mappingDir: typeof values['mapping-dir'] === 'string' ? values['mapping-dir'] : undefined,
-        language: typeof values.language === 'string' ? values.language : undefined,
-        validationJobs,
-        processBundles: values['no-process-bundles']
-            ? false
-            : values['process-bundles']
-                ? true
-                : undefined,
-        processBundlesDir: typeof values['process-bundles-dir'] === 'string' ? values['process-bundles-dir'] : undefined,
-        detectOnly: Boolean(values['detect-only']),
+        writeMapping: Boolean(values['write-mapping']),
+        processBundles: values['no-process-bundles'] ? false : undefined,
         failOnWarning: Boolean(values['fail-on-warning']),
-        pythonBin: typeof values.python === 'string' ? values.python : undefined,
-        tidasToolsDir: typeof values['tidas-tools-dir'] === 'string' ? values['tidas-tools-dir'] : undefined,
+        maxEntryMib,
+        memoryBudgetMib,
+        queueCapacity,
+        tidasBin: typeof values['tidas-bin'] === 'string' ? values['tidas-bin'] : undefined,
+        tidasConfig: typeof values['tidas-config'] === 'string' ? values['tidas-config'] : undefined,
     };
 }
+function parsePositiveIntegerFlag(value, flag) {
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+        throw new CliError(`${flag} must be a positive integer.`, {
+            code: 'DATASET_IMPORT_LCA_RUNTIME_BOUND_INVALID',
+            exitCode: 2,
+        });
+    }
+    return parsed;
+}
 function parseDatasetAuthorFlags(args) {
     let values;
     try {
@@ -3461,6 +3556,8 @@ function parseDatasetMaintenanceApplyFlags(args) {
                 'timeout-ms': { type: 'string' },
                 'dry-run': { type: 'boolean' },
                 'max-parallel': { type: 'string' },
+                'global-inbound-proof': { type: 'string' },
+                'approve-global-inbound-proof': { type: 'string' },
             },
         }));
     }
@@ -3483,6 +3580,25 @@ function parseDatasetMaintenanceApplyFlags(args) {
             exitCode: 2,
         });
     }
+    const globalInboundProofPath = typeof values['global-inbound-proof'] === 'string' ? values['global-inbound-proof'] : '';
+    const approveGlobalInboundProof = typeof values['approve-global-inbound-proof'] === 'string'
+        ? values['approve-global-inbound-proof']
+        : '';
+    if (Boolean(globalInboundProofPath) !== Boolean(approveGlobalInboundProof)) {
+        throw new CliError('--global-inbound-proof and --approve-global-inbound-proof must be provided together.', { code: 'INVALID_ARGS', exitCode: 2 });
+    }
+    if (globalInboundProofPath && maxParallel === undefined) {
+        throw new CliError('Global inbound proof flags require --max-parallel.', {
+            code: 'INVALID_ARGS',
+            exitCode: 2,
+        });
+    }
+    if (approveGlobalInboundProof && !/^[0-9a-f]{64}$/u.test(approveGlobalInboundProof)) {
+        throw new CliError('--approve-global-inbound-proof must be a lowercase SHA-256.', {
+            code: 'INVALID_ARGS',
+            exitCode: 2,
+        });
+    }
     return {
         help: Boolean(values.help),
         json: Boolean(values.json),
@@ -3493,6 +3609,8 @@ function parseDatasetMaintenanceApplyFlags(args) {
         timeoutMs: parseDatasetMaintenancePositiveInteger(values['timeout-ms'], '--timeout-ms'),
         dryRun: Boolean(values['dry-run']),
         maxParallel,
+        globalInboundProofPath,
+        approveGlobalInboundProof,
     };
 }
 function parseDatasetMaintenanceFreezeProtectedFlags(args) {
@@ -5424,6 +5542,7 @@ function applyRemoteOverrides(env, overrides) {
 export async function executeCli(argv, deps) {
     try {
         const { flags, command, subcommand, commandArgs } = parseCommandLine(argv);
+        const authIdentityReceiptImpl = deps.runAuthIdentityReceiptImpl ?? runAuthIdentityReceipt;
         const publishImpl = deps.runPublishImpl ?? runPublish;
         const validationImpl = deps.runValidationImpl ?? runValidation;
         const lcaReleaseImpl = deps.runLcaReleaseImpl ?? runLcaRelease;
@@ -5523,6 +5642,35 @@ export async function executeCli(argv, deps) {
                 stderr: '',
             };
         }
+        if (command === 'auth' && !subcommand) {
+            if (commandArgs.length === 0 ||
+                (commandArgs.length === 1 && ['--help', '-h'].includes(commandArgs[0]))) {
+                return { exitCode: 0, stdout: `${renderAuthHelp()}\n`, stderr: '' };
+            }
+            throw new CliError('The auth namespace accepts only -h or --help.', {
+                code: 'INVALID_ARGS',
+                exitCode: 2,
+            });
+        }
+        if (command === 'auth' && subcommand === 'identity-receipt') {
+            const authFlags = parseAuthIdentityReceiptFlags(commandArgs);
+            if (authFlags.help) {
+                return { exitCode: 0, stdout: `${renderAuthIdentityReceiptHelp()}\n`, stderr: '' };
+            }
+            const receipt = await authIdentityReceiptImpl({
+                env: deps.env,
+                fetchImpl: deps.fetchImpl,
+                cliVersion: loadCliPackageVersion(import.meta.url),
+                expectedProjectRef: authFlags.expectedProjectRef,
+                expectedUserId: authFlags.expectedUserId,
+                timeoutMs: authFlags.timeoutMs,
+            });
+            return {
+                exitCode: 0,
+                stdout: stringifyJson(receipt, authFlags.json),
+                stderr: '',
+            };
+        }
         if (command === 'search' && !subcommand && commandArgs.includes('--help')) {
             return { exitCode: 0, stdout: `${renderSearchHelp()}\n`, stderr: '' };
         }
@@ -5757,19 +5905,18 @@ export async function executeCli(argv, deps) {
                 fromFormat: datasetFlags.fromFormat,
                 target: datasetFlags.target,
                 reportPath: datasetFlags.reportPath,
-                mappingDir: datasetFlags.mappingDir,
-                language: datasetFlags.language,
-                validationJobs: datasetFlags.validationJobs,
+                writeMapping: datasetFlags.writeMapping,
                 processBundles: datasetFlags.processBundles,
-                processBundlesDir: datasetFlags.processBundlesDir,
-                detectOnly: datasetFlags.detectOnly,
                 failOnWarning: datasetFlags.failOnWarning,
-                pythonBin: datasetFlags.pythonBin,
-                tidasToolsDir: datasetFlags.tidasToolsDir,
+                maxEntryMib: datasetFlags.maxEntryMib,
+                memoryBudgetMib: datasetFlags.memoryBudgetMib,
+                queueCapacity: datasetFlags.queueCapacity,
+                tidasBin: datasetFlags.tidasBin,
+                tidasConfig: datasetFlags.tidasConfig,
                 env: deps.env,
             });
             return {
-                exitCode: report.status === 'completed' ? 0 : 1,
+                exitCode: report.exit_code,
                 stdout: stringifyJson(report, datasetFlags.json),
                 stderr: '',
             };
@@ -6418,6 +6565,8 @@ export async function executeCli(argv, deps) {
                     confirm: datasetFlags.confirm,
                     timeoutMs: datasetFlags.timeoutMs,
                     maxParallel: datasetFlags.maxParallel,
+                    globalInboundProofPath: datasetFlags.globalInboundProofPath || undefined,
+                    approveGlobalInboundProof: datasetFlags.approveGlobalInboundProof || undefined,
                     env: deps.env,
                     fetchImpl: deps.fetchImpl,
                 });