make most SealCLI methods private