aspera-cli 4.27.1 → 4.27.3

data/lib/aspera/cli/plugins/node.rb

@@ -12,7 +12,7 @@ require 'aspera/id_generator'
 require 'aspera/api/node'
 require 'aspera/oauth'
 require 'aspera/node_simulator'
-require 'aspera/rest_list'
+require 'aspera/rest/list'
 require 'aspera/assert'
 require 'base64'
 require 'zlib'
@@ -47,7 +47,7 @@ module Aspera
             error = nil
             urls.each do |base_url|
               next unless base_url.match?(%r{^https?://})
-              api = Rest.new(base_url: base_url)
+              api = Rest::Client.new(base_url: base_url)
               test_endpoint = 'ping'
               http = api.read(test_endpoint, ret: :resp)
               next unless http.body.eql?('')
@@ -76,9 +76,9 @@ module Aspera
         option :validator,        description: 'Identifier of validator (optional for central)'
         option :asperabrowserurl, description: 'URL for simple aspera web ui', default: 'https://asperabrowser.mybluemix.net'
         option :node_api,         description: 'Gen4: standard_ports: Use standard FASP ports (true) or get from node API (false). cache: Set to false to force actual file system read',
-          allowed: Hash, handler: {o: Api::Node, m: :api_options}
+          allowed: Hash, on_set: Api::Node.method(:api_options=)
         option :root_id,          description: 'Gen4: File id of top folder when using access key (override AK root id)'
-        option :dynamic_key,      description: 'Private key PEM to use for dynamic key auth', handler: {o: Api::Node, m: :use_dynamic_key}
+        option :dynamic_key,      description: 'Private key PEM to use for dynamic key auth', on_set: Api::Node.method(:use_dynamic_key=)
 
         # @param wizard  [Wizard] The wizard object
         # @param app_url [String] Tested URL
@@ -106,25 +106,21 @@ module Aspera
         # Fields removed in result of search
         SEARCH_REMOVE_FIELDS = %w[basename permissions].freeze
 
-        # Actions in execute_command_gen3
-        COMMANDS_GEN3 = %i[search space mkdir mklink mkfile rename delete ls upload download cat sync transport spec]
-
-        # Shared DSL metadata for Gen3 commands (description:, arguments:, transfer_paths:, aliases:).
-        # Consumed by commands_under(:files) in shares.rb and commands_under %i[source node]) in faspex.rb.
-        # :sync is excluded (intermediate node with sub-commands, handled separately).
-        # action: entries are node-specific and intentionally omitted.
+        # DSL metadata for Gen3 root commands (description:, arguments:, transfer_paths:, aliases:).
+        # :access_keys is skipped (intermediate node declared separately), :sync is declared separately.
+        # action: entries are in GEN3_NODE_ACTIONS, or implicit.
         COMMANDS_GEN3_SPEC = {
-          search:      {description: 'Search for files',             arguments: [{name: :search_root, type: String}]},
-          space:       {description: 'Show space information',       arguments: [{name: :path_list, multiple: true}]},
-          mkdir:       {description: 'Create a folder (Gen3)',       arguments: [{name: :path_list, multiple: true}]},
-          mklink:      {description: 'Create a symbolic link (Gen3)', arguments: [{name: :target, type: String}, {name: :link_path, type: String}]},
-          mkfile:      {description: 'Create a file (Gen3)', arguments: [{name: :file_path, type: String}, {name: :contents, mandatory: false, default: nil}]},
-          rename:      {description: 'Rename a file or folder (Gen3)', arguments: [{name: :path_base, type: String}, {name: :path_src, type: String}, {name: :path_dst, type: String}]},
+          search:      {description: 'Search for files',             arguments: [{name: :path}]},
+          space:       {description: 'Show space information',       arguments: [{name: :paths, multiple: true}]},
+          mkdir:       {description: 'Create a folder (Gen3)',       arguments: [{name: :paths, multiple: true}]},
+          mklink:      {description: 'Create a symbolic link (Gen3)', arguments: [{name: :target}, {name: :link_path}]},
+          mkfile:      {description: 'Create a file (Gen3)', arguments: [{name: :path}, {name: :contents, mandatory: false, default: nil}]},
+          rename:      {description: 'Rename a file or folder (Gen3)', arguments: [{name: :folder}, {name: :source}, {name: :destination}]},
           delete:      {description: 'Delete files or folders (Gen3)', arguments: [{name: :paths, multiple: true}]},
-          ls:          {description: 'List files (Gen3)',            arguments: [{name: :path, type: String}], aliases: [:browse]},
+          ls:          {description: 'List files (Gen3)',            arguments: [{name: :path}], aliases: [:browse]},
           upload:      {description: 'Upload files (Gen3)',          transfer_paths: :send},
           download:    {description: 'Download files (Gen3)',        transfer_paths: :receive},
-          cat:         {description: 'Show file contents (Gen3)',    arguments: [{name: :remote_path, type: String}]},
+          cat:         {description: 'Show file contents (Gen3)',    arguments: [{name: :path}]},
           transport:   {description: 'Show transport parameters'},
           spec:        {description: 'Show transfer spec base'},
           api_details: {description: 'Show API details'},
@@ -136,60 +132,52 @@ module Aspera
           access_keys: {description: 'Manage access keys'}
         }.freeze
 
-        BASE_ACTIONS = (%i[api_details] + COMMANDS_GEN3).freeze
-
-        SPECIAL_ACTIONS = %i[health events info slash license].freeze
-
-        # commands for : `execute_simple_common`: actions used commonly when a node is involved
-        COMMON_ACTIONS = (%i[access_keys] + BASE_ACTIONS + SPECIAL_ACTIONS).freeze
-
-        private_constant :CENTRAL_SOAP_API_TEST, :SEARCH_REMOVE_FIELDS, :BASE_ACTIONS, :SPECIAL_ACTIONS, :COMMON_ACTIONS
+        private_constant :CENTRAL_SOAP_API_TEST, :SEARCH_REMOVE_FIELDS
 
-        # used in aoc
+        # Gen4 read commands also exposed on AoC packages (`aoc packages ls <id>`)
         NODE4_READ_ACTIONS = %i[bearer_token_node node_info ls find].freeze
 
-        # commands for execute_command_gen4
-        COMMANDS_GEN4 = (%i[mkdir mklink mkfile rename delete upload download sync cat show modify permission thumbnail v3] + NODE4_READ_ACTIONS).freeze
-
-        # Shared DSL metadata for all Gen4 commands (description:, arguments:, transfer_paths:, aliases:).
-        # Consumed by commands_under %i[access_keys do]) in node.rb and by aoc.rb.
-        # :sync and :permission are excluded: they are intermediate nodes handled separately.
-        SINGLE_PATH_ARG = [{name: :path, type: String}].freeze
+        # DSL metadata for Gen4 commands under `access_keys do` (description:, arguments:, transfer_paths:, aliases:).
+        # Other plugins expose this sub-tree with `mount:` (aoc, ats).
+        # :sync, :permission and :v3 are excluded: they are intermediate nodes declared separately.
+        SINGLE_PATH_ARG = [{name: :path}].freeze
         COMMANDS_GEN4_SPEC = {
           mkdir:             {description: 'Create folder',                  arguments: SINGLE_PATH_ARG},
           mklink:            {description: 'Create symbolic link',           arguments: SINGLE_PATH_ARG},
-          mkfile:            {description: 'Create file',                    arguments: [{name: :path, type: String}, {name: :contents, mandatory: false, default: nil}]},
-          rename:            {description: 'Rename entry',                   arguments: [{name: :source_path, type: String}, {name: :new_name, type: String}]},
-          delete:            {description: 'Delete entry',                   arguments: [{name: :paths, type: String, bulk: true}]},
+          mkfile:            {description: 'Create file',                    arguments: [{name: :path}, {name: :contents, mandatory: false, default: nil}]},
+          rename:            {description: 'Rename entry',                   arguments: [{name: :source_path}, {name: :new_name}]},
+          delete:            {description: 'Delete entry',                   arguments: [{name: :path, bulk: true}]},
           upload:            {description: 'Upload files',                   transfer_paths: :send},
           download:          {description: 'Download files',                 transfer_paths: :receive},
-          modify:            {description: 'Modify file',                    arguments: [{name: :path, type: String}, {name: :update_value, type: Hash, schema: 'node:components.schemas.files-id-put-request'}]},
+          modify:            {description: 'Modify file',                    arguments: [{name: :path}, {name: :file, type: Hash, schema: 'node:components.schemas.files-id-put-request'}]},
           cat:               {description: 'Show file contents',             arguments: SINGLE_PATH_ARG},
           show:              {description: 'Show file info',                 arguments: SINGLE_PATH_ARG},
           thumbnail:         {description: 'Show file thumbnail',            arguments: SINGLE_PATH_ARG},
           bearer_token_node: {description: 'Show bearer token for file node', arguments: SINGLE_PATH_ARG},
           node_info:         {description: 'Show node info for file',        arguments: SINGLE_PATH_ARG},
           ls:                {description: 'List files',                     arguments: SINGLE_PATH_ARG, aliases: [:browse]},
-          find:              {description: 'Find files',                     arguments: SINGLE_PATH_ARG + FILTER_ARGS},
-          v3:                {description: 'Legacy v3 commands on files'}
+          find:              {description: 'Find files',                     arguments: SINGLE_PATH_ARG + FILTER_ARGS}
         }.freeze
         private_constant :SINGLE_PATH_ARG
 
-        # commands supported in ATS for COS
+        # Root commands exposed by `cos node` and `shares files` (mount: only:)
         COMMANDS_COS = %i[upload download info access_keys api_details transfer].freeze
-        COMMANDS_SHARES = (BASE_ACTIONS - %i[search]).freeze
+        COMMANDS_SHARES = %i[api_details space mkdir mklink mkfile rename delete ls upload download cat sync transport spec].freeze
         # `browse` display fields for gen4
         GEN4_LS_FIELDS = %w[name type recursive_size size modified_time access_level].freeze
 
-        # @param api [Rest] an existing API object for the Node API
+        # @param api [Rest::Client] an existing API object for the Node API
         def initialize(context:, api: nil)
-          super(context: context, basic_options: api.nil?)
-          return if context.only_manual?
-          @api_node =
-            if !api.nil?
-              # this can be Api::Node or Rest (Shares)
-              api
-            elsif OAuth::Factory.bearer_auth?(options.get_option(:password, mandatory: true))
+          super(context: context)
+          # Api::Node or Rest::Client (Shares), when provided by the host plugin
+          @api_node = api
+        end
+
+        # Node API: provided by the host plugin, or built from CLI options on first use.
+        # @return [Api::Node, Rest::Client]
+        def api_node
+          @api_node ||=
+            if OAuth::Factory.bearer_auth?(options.get_option(:password, mandatory: true))
               # info is provided like node_info of aoc
               Api::Node.new(
                 base_url: options.get_option(:url, mandatory: true),
@@ -213,9 +201,10 @@ module Aspera
         def browse_gen3(path)
           folders_to_process = path
           folders_to_process = [folders_to_process]
+          # not a URL query: merged into the POST body of files/browse
           query = options.get_option(:query) || {}
           # special parameter: max number of entries in result
-          max_items = query.delete(RestList::MAX_ITEMS)
+          max_items = query.delete(Rest::List::MAX_ITEMS)
           # special parameter: recursive browsing
           recursive = query.delete('recursive')
           # special parameter: only return one entry for the path, even if folder
@@ -233,7 +222,7 @@ module Aspera
             total_count = nil
             loop do
               # example: send_result={'items'=>[{'file'=>"filename1","permissions"=>[{'name'=>'read'},{'name'=>'write'}]}]}
-              response = @api_node.create('files/browse', query)
+              response = api_node.create('files/browse', query)
               # 'file','symbolic_link'
               return Result::SingleObject.new(response['self']) if !Node.gen3_entry_folder?(response['self']) || only_path
               items = response['items']
@@ -251,13 +240,13 @@ module Aspera
               break if all_items.count >= total_count
               offset += items.count
               query['skip'] = offset
-              RestParameters.instance.spinner_cb.call(all_items.count)
+              Rest::Parameters.instance.spinner_cb.call(all_items.count)
             end
             query.delete('skip')
           end
           return Result::ObjectList.new(all_items)
         ensure
-          RestParameters.instance.spinner_cb.call(action: :success)
+          Rest::Parameters.instance.spinner_cb.call(action: :success)
         end
 
         # Create async transfer spec request from direction and folders
@@ -299,20 +288,9 @@ module Aspera
           if (m = Parser.percent_selector(path))
             Aspera.assert_values(m[:field], ['id'], type: BadArgument) { 'file id' }
             val = m[:value]
-            return Api::NodeFileId.new(@api_node, val.nil? || val.empty? ? top_file_id : val)
-          end
-          @api_node.resolve_api_fid(top_file_id, path)
-        end
-
-        # Legacy helper: resolve a NodeFileId by reading path from the CLI argument stream.
-        # Used only by setup_access_key_do_permission and action_access_keys_do_permission
-        # (intermediate nodes whose path cannot yet be injected via execute_leaf).
-        def apifid_from_next_arg(top_file_id)
-          file_path = options.instance_identifier(description: 'path or %id:<id> or %id:') do |attribute, value|
-            Aspera.assert_values(attribute, ['id'], type: BadArgument) { 'file id' }
-            return Api::NodeFileId.new(@api_node, value.nil? || value.empty? ? top_file_id : value)
+            return Api::NodeFileId.new(api_node, val.nil? || val.empty? ? top_file_id : val)
           end
-          @api_node.resolve_api_fid(top_file_id, file_path)
+          api_node.resolve_api_fid(top_file_id, path)
         end
 
         # Search /async by name
@@ -322,8 +300,8 @@ module Aspera
         # @raise [Cli::BadArgument] if no such sync, or not by name
         def async_lookup(field, value)
           Aspera.assert_values(field, ['name'], type: Cli::BadArgument) { 'search field' }
-          async_ids = @api_node.read('async/list')['sync_ids']
-          summaries = @api_node.create('async/summary', {'syncs' => async_ids})['sync_summaries']
+          async_ids = api_node.read('async/list')['sync_ids']
+          summaries = api_node.create('async/summary', {'syncs' => async_ids})['sync_summaries']
           selected = summaries.find { |s| s['name'].eql?(value) }
           raise Cli::BadIdentifier.new('sync', value, field: field) if selected.nil?
           return selected['snid']
@@ -335,7 +313,7 @@ module Aspera
         # @return [String] the resolved access key id
         def lookup_access_key_self_id(field, value, **)
           Aspera.assert(field.eql?('id') && value.eql?('self'), type: BadArgument) { 'only selector: %id:self' }
-          @api_node.read('access_keys/self')['id']
+          api_node.read('access_keys/self')['id']
         end
 
         # Search /asyncs by name
@@ -345,8 +323,8 @@ module Aspera
         # @raise [Cli::BadArgument] if no such sync, or not by name
         def ssync_lookup(field, value)
           Aspera.assert_values(field, ['name'], type: Cli::BadArgument) { 'search field' }
-          @api_node.read('asyncs')['ids'].each do |id|
-            sync_info = @api_node.read("asyncs/#{id}")['configuration']
+          api_node.read('asyncs')['ids'].each do |id|
+            sync_info = api_node.read("asyncs/#{id}")['configuration']
             # name is unique, so we can return
             return id if sync_info[field].eql?(value)
           end
@@ -359,17 +337,16 @@ module Aspera
         # :sync is declared separately (intermediate node with sub-commands).
         GEN3_NODE_ACTIONS = {
           ls:          ->(path:, **) { browse_gen3(path) },
-          transport:   ->(**) { Result::SingleObject.new(@api_node.transport_params) },
-          spec:        ->(**) { Result::SingleObject.new(@api_node.base_spec, fields: Formatter.all_but(Transfer::Spec::SPECIFIC)) },
-          api_details: ->(**) { Result::SingleObject.new({base_url: @api_node.base_url}.merge(@api_node.params)) },
-          events:      ->(**) { Result::ObjectList.new(@api_node.read('events', query_read_delete(schema: Schema::Registry.query_params(Schema::Registry::NODE, 'events'))), fields: ->(f) { !f.start_with?('data') }) },
-          info:        ->(**) { Result::SingleObject.new(@api_node.read('info')) },
-          slash:       ->(**) { Result::SingleObject.new(@api_node.read('')) },
-          license:     ->(**) { Result::SingleObject.new(@api_node.read('license')) }
+          transport:   ->(**) { Result::SingleObject.new(api_node.transport_params) },
+          spec:        ->(**) { Result::SingleObject.new(api_node.base_spec, fields: Formatter.all_but(*Transfer::Spec::SPECIFIC)) },
+          api_details: ->(**) { Result::SingleObject.new({base_url: api_node.base_url}.merge(api_node.params)) },
+          events:      ->(**) { Result::ObjectList.new(api_node.read('events', query_read_delete(schema: Schema::Registry.query_params(Schema::Registry::NODE, 'events'))), fields: ->(f) { !f.start_with?('data') }) },
+          info:        ->(**) { Result::SingleObject.new(api_node.read('info')) },
+          slash:       ->(**) { Result::SingleObject.new(api_node.read('')) },
+          license:     ->(**) { Result::SingleObject.new(api_node.read('license')) }
         }.freeze
         private_constant :GEN3_NODE_ACTIONS
         COMMANDS_GEN3_SPEC.each do |cmd, spec|
-          next if cmd.eql?(:sync)        # intermediate node with sub-commands
           next if cmd.eql?(:access_keys) # intermediate node declared separately below
           action = GEN3_NODE_ACTIONS[cmd]
           command cmd, **spec, **(action ? {action: action} : {})
@@ -389,9 +366,9 @@ module Aspera
             arguments: [{name: :access_key_id, type: :identifier}],
             setup: :setup_access_key_do
           command :set_bearer_key, description: 'Set bearer key on access key',
-            arguments: [{name: :access_key_id}, {name: :bearer_key_pem, type: String}]
+            arguments: [{name: :access_key_id, type: :identifier}, {name: :bearer_key_pem}]
           crud_commands entity: 'access_keys',
-            api:            :@api_node,
+            api:            :api_node,
 
             body_component: Schema::Registry::NODE,
             lookup:         :lookup_access_key_self_id
@@ -401,7 +378,10 @@ module Aspera
           COMMANDS_GEN4_SPEC.each do |cmd, spec|
             command cmd, **spec
           end
-          command :permission, description: 'Manage permissions', setup: :setup_access_key_do_permission
+          command :v3, description: 'Legacy v3 commands on files', mount: {plugin: self, instance: :v3_node_plugin}
+          command :permission, description: 'Manage permissions',
+            arguments: [{name: :path, description: 'Path, or %id:<file id>, or %id: for root'}],
+            setup: :setup_access_key_do_permission
           command :sync, description: 'Synchronize folders'
           commands_under :sync do
             Sync::Operations::DIRECTIONS.each do |dir|
@@ -414,22 +394,34 @@ module Aspera
         commands_under %i[access_keys do permission] do
           command :list,   description: 'List permissions on a file'
           command :show,   description: 'Show a permission',
-            arguments: [{name: :perm_id, type: :identifier}],
-            action: ->(apifid:, perm_id:, **) { Result::SingleObject.new(apifid.node_api.read("permissions/#{perm_id}")) }
+            arguments: [{name: :permission_id, type: :identifier}],
+            action: ->(apifid:, permission_id:, **) { Result::SingleObject.new(apifid.node_api.read("permissions/#{permission_id}")) }
           command :create, description: 'Create a permission',
-            arguments: [{name: :data, type: Hash, schema: 'node:components.schemas.permissions-post-request'}]
-          command :modify, description: 'Modify a permission',
-            arguments: [{name: :perm_id, type: :identifier}, {name: :data, type: Hash, schema: 'node:components.schemas.permissions-id-put-request'}]
+            arguments: [{name: :permission, type: Hash, schema: 'node:components.schemas.permissions-post-request'}]
+          command(
+            :modify, description: 'Modify a permission',
+            arguments: [{name: :permission_id, type: :identifier}, {name: :permission, type: Hash, schema: 'node:components.schemas.permissions-id-put-request'}],
+            action: lambda do |permission:, apifid:, permission_id:, **|
+              apifid.node_api.update("permissions/#{permission_id}", permission)
+              Result::Status.new('Updated')
+            end
+          )
           command :delete, description: 'Delete permissions',
-            arguments: [{name: :perm_id, bulk: true}]
+            arguments: [{name: :permission_id, type: :identifier, bulk: true}]
         end
         # async (legacy /async)
-        commands_under :async, description: 'synchronization (legacy /async)' do
-          command :list,      description: 'List async sync IDs', action: -> { Result::ValueList.new(@api_node.read('async/list')['sync_ids']) }
+        commands_under :async, description: 'Manage legacy synchronizations (/async)' do
+          command :list,      description: 'List async sync IDs', action: ->(**) { Result::ValueList.new(api_node.read('async/list')['sync_ids']) }
           command :show,      description: 'Show async summary',
             arguments: [{name: :async_id, type: :identifier, lookup: :async_lookup}]
-          command :delete,    description: 'Delete async',
-            arguments: [{name: :async_id, type: :identifier, lookup: :async_lookup}]
+          command(
+            :delete, description: 'Delete async',
+            arguments: [{name: :async_id, type: :identifier, lookup: :async_lookup}],
+            action: lambda do |async_id:, **|
+              async_ids = async_id.eql?(SpecialValues::ALL) ? api_node.read('async/list')['sync_ids'] : [async_id]
+              Result::SingleObject.new(api_node.create('async/delete', {'syncs' => async_ids}))
+            end
+          )
           command :bandwidth, description: 'Show async bandwidth',
             arguments: [{name: :async_id, type: :identifier, lookup: :async_lookup}]
           command :files,     description: 'List async files',
@@ -438,93 +430,138 @@ module Aspera
             arguments: [{name: :async_id, type: :identifier, lookup: :async_lookup}]
         end
         # ssync (/asyncs)
-        # command :ssync, description: 'Manage sync operations (/asyncs)'
-        commands_under :ssync, description: 'synchronization (/asyncs)' do
+        commands_under :ssync, description: 'Manage synchronizations (/asyncs)' do
           crud_commands entity: 'asyncs',
-            api: :@api_node,
+            name: 'sync session',
+            id_name: :ssync_id,
+            api: :api_node,
             operations: %i[create list show delete],
             items_key: 'ids',
             lookup: :ssync_lookup
-          command :start, description: 'Start a sync',
-            arguments: [{name: :ssync_id, type: :identifier, lookup: :ssync_lookup}],
-            action: :action_ssync_start
-          command :stop, description: 'Stop a sync',
-            arguments: [{name: :ssync_id, type: :identifier, lookup: :ssync_lookup}],
-            action: :action_ssync_stop
+          command(
+            :start, description: 'Start a sync', arguments: [{name: :ssync_id, type: :identifier, lookup: :ssync_lookup}],
+            action: lambda do |ssync_id:, **|
+              api_node.call(operation: 'POST', subpath: "asyncs/#{ssync_id}/start", content_type: Mime::TEXT, body: '', ret: :resp).body
+              Result::Status.new('Done')
+            end
+          )
+          command(
+            :stop, description: 'Stop a sync', arguments: [{name: :ssync_id, type: :identifier, lookup: :ssync_lookup}],
+            action: lambda do |ssync_id:, **|
+              api_node.call(operation: 'POST', subpath: "asyncs/#{ssync_id}/stop", content_type: Mime::TEXT, body: '', ret: :resp).body
+              Result::Status.new('Done')
+            end
+          )
           command :bandwidth, description: 'Show sync bandwidth',
             arguments: [{name: :ssync_id, type: :identifier, lookup: :ssync_lookup}],
-            action: ->(ssync_id:, **) { Result::SingleObject.new(@api_node.read("asyncs/#{ssync_id}/bandwidth", options.get_option(:query) || {})) }
+            action: ->(ssync_id:, **) { Result::SingleObject.new(api_node.read("asyncs/#{ssync_id}/bandwidth", query_read_delete(default: {}))) }
           command :counters, description: 'Show sync counters',
             arguments: [{name: :ssync_id, type: :identifier, lookup: :ssync_lookup}],
-            action: ->(ssync_id:, **) { Result::SingleObject.new(@api_node.read("asyncs/#{ssync_id}/counters", options.get_option(:query) || {})) }
+            action: ->(ssync_id:, **) { Result::SingleObject.new(api_node.read("asyncs/#{ssync_id}/counters", query_read_delete(default: {}))) }
           command :files, description: 'List sync files',
             arguments: [{name: :ssync_id, type: :identifier, lookup: :ssync_lookup}],
-            action: ->(ssync_id:, **) { Result::SingleObject.new(@api_node.read("asyncs/#{ssync_id}/files", options.get_option(:query) || {})) }
+            action: ->(ssync_id:, **) { Result::SingleObject.new(api_node.read("asyncs/#{ssync_id}/files", query_read_delete(default: {}))) }
           command :state, description: 'Show sync state',
             arguments: [{name: :ssync_id, type: :identifier, lookup: :ssync_lookup}],
-            action: ->(ssync_id:, **) { Result::SingleObject.new(@api_node.read("asyncs/#{ssync_id}/state")) }
+            action: ->(ssync_id:, **) { Result::SingleObject.new(api_node.read("asyncs/#{ssync_id}/state")) }
           command :summary, description: 'Show sync summary',
             arguments: [{name: :ssync_id, type: :identifier, lookup: :ssync_lookup}],
-            action: ->(ssync_id:, **) { Result::SingleObject.new(@api_node.read("asyncs/#{ssync_id}/summary")) }
+            action: ->(ssync_id:, **) { Result::SingleObject.new(api_node.read("asyncs/#{ssync_id}/summary")) }
         end
         # stream
         command :stream, description: 'Manage stream operations'
         commands_under :stream do
-          command :list,   description: 'List streams', action: -> { Result::ObjectList.new(@api_node.read('ops/transfers', query_read_delete), fields: %w[id status]) }
+          command :list,   description: 'List streams', action: ->(**) { Result::ObjectList.new(api_node.read('ops/transfers', query_read_delete), fields: %w[id status]) }
           command :create, description: 'Create a stream',
-            arguments: [{name: :data, type: Hash, schema: 'node:components.schemas.transferPostRequest'}],
-            action: ->(data:, **) { Result::SingleObject.new(@api_node.create('streams', data)) }
+            arguments: [{name: :stream, type: Hash, schema: 'node:components.schemas.transferPostRequest'}],
+            action: ->(stream:, **) { Result::SingleObject.new(api_node.create('streams', stream)) }
           command :show,   description: 'Show a stream',
             arguments: [{name: :transfer_id, type: :identifier}],
-            action: ->(transfer_id:, **) { Result::SingleObject.new(@api_node.read("ops/transfers/#{transfer_id}")) }
+            action: ->(transfer_id:, **) { Result::SingleObject.new(api_node.read("ops/transfers/#{transfer_id}")) }
           command :modify, description: 'Modify a stream',
-            arguments: [{name: :transfer_id, type: :identifier}, {name: :data, type: Hash, schema: 'node:components.schemas.transferPutRequest'}],
-            action: ->(data:, transfer_id:, **) { Result::SingleObject.new(@api_node.update("streams/#{transfer_id}", data)) }
+            arguments: [{name: :transfer_id, type: :identifier}, {name: :stream, type: Hash, schema: 'node:components.schemas.transferPutRequest'}],
+            action: ->(stream:, transfer_id:, **) { Result::SingleObject.new(api_node.update("streams/#{transfer_id}", stream)) }
           command :cancel, description: 'Cancel a stream',
             arguments: [{name: :transfer_id, type: :identifier}],
-            action: ->(transfer_id:, **) { Result::SingleObject.new(@api_node.cancel("streams/#{transfer_id}")) }
+            action: ->(transfer_id:, **) { Result::SingleObject.new(api_node.cancel("streams/#{transfer_id}")) }
         end
         # transfer
         command :transfer, description: 'Manage transfer operations'
         commands_under :transfer do
           command :list, description: 'List transfers'
-          command :cancel, description: 'Cancel a transfer',
-            arguments: [{name: :transfer_id, type: :identifier}]
+          command(
+            :cancel, description: 'Cancel a transfer',
+            arguments: [{name: :transfer_id, type: :identifier}],
+            action: lambda do |transfer_id:, **|
+              api_node.cancel("ops/transfers/#{transfer_id}")
+              Result::Status.new('Cancelled')
+            end
+          )
           command :show, description: 'Show a transfer',
             arguments: [{name: :transfer_id, type: :identifier}],
-            action: ->(transfer_id:, **) { Result::SingleObject.new(@api_node.read("ops/transfers/#{transfer_id}")) }
-          command :modify,            description: 'Modify a transfer',
-            arguments: [{name: :transfer_id, type: :identifier}, {name: :update_value, type: Hash, schema: 'node:components.schemas.transferPutRequest'}]
+            action: ->(transfer_id:, **) { Result::SingleObject.new(api_node.read("ops/transfers/#{transfer_id}")) }
+          command(
+            :modify, description: 'Modify a transfer',
+            arguments: [{name: :transfer_id, type: :identifier}, {name: :transfer, type: Hash, schema: 'node:components.schemas.transferPutRequest'}],
+            action: lambda do |transfer:, transfer_id:, **|
+              api_node.update("ops/transfers/#{transfer_id}", transfer)
+              Result::Status.new('Modified')
+            end
+          )
           command :bandwidth_average, description: 'Show average bandwidth per period'
           command :sessions,          description: 'List transfer sessions'
         end
         # service
         command :service, description: 'Manage services'
         commands_under :service do
-          command :list,   description: 'List services', action: -> { Result::ObjectList.new(@api_node.read('rund/services')['services']) }
-          command :create, description: 'Create a service',
-            arguments: [{name: :creation_data, type: Hash}]
-          command :delete, description: 'Delete a service',
-            arguments: [{name: :service_id, type: :identifier}]
+          command :list, description: 'List services', action: ->(**) { Result::ObjectList.new(api_node.read('rund/services')['services']) }
+          command(
+            :create, description: 'Create a service',
+            arguments: [{name: :service, type: Hash}],
+            action: lambda do |service:, **|
+              resp = api_node.create('rund/services', service)
+              Result::Status.new("#{resp['id']} created")
+            end
+          )
+          command(
+            :delete, description: 'Delete a service',
+            arguments: [{name: :service_id, type: :identifier}],
+            action: lambda do |service_id:, **|
+              api_node.delete("rund/services/#{service_id}")
+              Result::Status.new("#{service_id} deleted")
+            end
+          )
         end
         # watch_folder
         command :watch_folder, description: 'Manage watch folders', setup: :setup_watch_folder
         commands_under :watch_folder do
           command :create, description: 'Create a watch folder',
-            arguments: [{name: :data, type: Hash}],
-            action: ->(data:, **) { Result::Status.new("#{@api_node.create('v3/watchfolders', data)['id']} created") }
+            arguments: [{name: :watch_folder, type: Hash}],
+            action: ->(watch_folder:, **) { Result::Status.new("#{api_node.create('v3/watchfolders', watch_folder)['id']} created") }
           command :list,   description: 'List watch folders',
-            action: -> { Result::ValueList.new(@api_node.read('v3/watchfolders', query_read_delete)['ids']) }
+            action: ->(**) { Result::ValueList.new(api_node.read('v3/watchfolders', query_read_delete)['ids']) }
           command :show,   description: 'Show a watch folder',
             arguments: [{name: :watch_folder_id, type: :identifier}],
-            action: ->(watch_folder_id:, **) { Result::SingleObject.new(@api_node.read("v3/watchfolders/#{watch_folder_id}")) }
-          command :modify, description: 'Modify a watch folder',
-            arguments: [{name: :watch_folder_id, type: :identifier}, {name: :data, type: Hash}]
-          command :delete, description: 'Delete a watch folder',
-            arguments: [{name: :watch_folder_id, type: :identifier}]
-          command :state,  description: 'Show watch folder state',
+            action: ->(watch_folder_id:, **) { Result::SingleObject.new(api_node.read("v3/watchfolders/#{watch_folder_id}")) }
+          command(
+            :modify, description: 'Modify a watch folder',
+            arguments: [{name: :watch_folder_id, type: :identifier}, {name: :watch_folder, type: Hash}],
+            action: lambda do |watch_folder:, watch_folder_id:, **|
+              api_node.update("v3/watchfolders/#{watch_folder_id}", watch_folder)
+              Result::Status.new("#{watch_folder_id} updated")
+            end
+          )
+          command(
+            :delete, description: 'Delete a watch folder',
+            arguments: [{name: :watch_folder_id, type: :identifier}],
+            action: lambda do |watch_folder_id:, **|
+              api_node.delete("v3/watchfolders/#{watch_folder_id}")
+              Result::Status.new("#{watch_folder_id} deleted")
+            end
+          )
+          command :state, description: 'Show watch folder state',
             arguments: [{name: :watch_folder_id, type: :identifier}],
-            action: ->(watch_folder_id:, **) { Result::SingleObject.new(@api_node.read("v3/watchfolders/#{watch_folder_id}/state")) }
+            action: ->(watch_folder_id:, **) { Result::SingleObject.new(api_node.read("v3/watchfolders/#{watch_folder_id}/state")) }
         end
         # central
         command :central, description: 'Query Central service'
@@ -534,19 +571,26 @@ module Aspera
         end
         commands_under %i[central session] do
           command :list, description: 'List sessions',
-            arguments: [{name: :request_data, type: Hash, mandatory: false, default: nil}]
+            arguments: [{name: :criteria, type: Hash, mandatory: false, default: nil}]
         end
         commands_under %i[central file] do
           command :list,   description: 'List file transfers',
-            arguments: [{name: :request_data, type: Hash, mandatory: false, default: nil}]
+            arguments: [{name: :criteria, type: Hash, mandatory: false, default: nil}]
           command :modify, description: 'Modify file transfer validation',
-            arguments: [{name: :request_data, type: Hash, mandatory: false, default: nil}]
+            arguments: [{name: :file, type: Hash, mandatory: false, default: nil}]
         end
         # Standalone leaf commands
         command :asperabrowser, description: 'Open Aspera browser'
-        command :basic_token,   description: 'Generate basic auth token', action: -> { Result::Text.new(Rest.basic_authorization(options.get_option(:username, mandatory: true), options.get_option(:password, mandatory: true))) }
-        command :bearer_token, description: 'Generate bearer token',
-          arguments: [{name: :private_key_pem, type: String}, {name: :user_group_id, type: Hash, schema: 'opts:components.schemas.NodeBearerTokenOptions'}]
+        command :basic_token,   description: 'Generate basic auth token', action: ->(**) { Result::Text.new(Rest.basic_authorization(options.get_option(:username, mandatory: true), options.get_option(:password, mandatory: true))) }
+        command(
+          :bearer_token, description: 'Generate bearer token',
+          arguments: [{name: :private_key_pem}, {name: :token, type: Hash, schema: 'opts:components.schemas.NodeBearerTokenOptions'}],
+          action: lambda do |private_key_pem:, token:, **|
+            private_key = OpenSSL::PKey::RSA.new(private_key_pem)
+            access_key  = options.get_option(:username, mandatory: true)
+            Result::Text.new(Api::Node.bearer_token(payload: token, access_key: access_key, private_key: private_key))
+          end
+        )
         command :simulator,     description: 'Start node simulator',
           arguments: [{name: :parameters, type: Hash, mandatory: false, default: {}, schema: 'opts:components.schemas.NodeSimulatorOptions'}]
         command :telemetry,     description: 'Report telemetry to external system',
@@ -557,15 +601,16 @@ module Aspera
         def action_delete(paths:, **)
           # TODO: add query for recursive
           paths_to_delete = Array(paths)
-          resp = @api_node.create('files/delete', {paths: paths_to_delete.map { |i| {'path' => i.start_with?('/') ? i : "/#{i}"} }})
+          resp = api_node.create('files/delete', {paths: paths_to_delete.map { |i| {'path' => i.start_with?('/') ? i : "/#{i}"} }})
           cli_result_from_paths_response(resp, 'file deleted')
         end
 
-        def action_search(search_root:, **)
-          parameters = {'path' => search_root}
+        def action_search(path:, **)
+          parameters = {'path' => path}
+          # not a URL query: merged into the POST body of files/search
           other_options = options.get_option(:query)
           parameters.merge!(other_options) unless other_options.nil?
-          resp = @api_node.create('files/search', parameters)
+          resp = api_node.create('files/search', parameters)
           return Result::Empty.new if resp['items'].empty?
           fields = resp['items'].first.keys.reject { |i| SEARCH_REMOVE_FIELDS.include?(i) }
           formatter.display_item_count(resp['item_count'], resp['total_count'])
@@ -573,32 +618,32 @@ module Aspera
           Result::ObjectList.new(resp['items'], fields: fields)
         end
 
-        def action_space(path_list:, **)
-          path_list = Array(path_list)
-          resp = @api_node.create('space', {'paths' => path_list.map { |i| {path: i} }})
+        def action_space(paths:, **)
+          paths = Array(paths)
+          resp = api_node.create('space', {'paths' => paths.map { |i| {path: i} }})
           Result::ObjectList.new(resp['paths'])
         end
 
-        def action_mkdir(path_list:, **)
-          path_list = Array(path_list)
-          resp = @api_node.create('files/create', {'paths' => path_list.map { |i| {type: :directory, path: i} }})
+        def action_mkdir(paths:, **)
+          paths = Array(paths)
+          resp = api_node.create('files/create', {'paths' => paths.map { |i| {type: :directory, path: i} }})
           cli_result_from_paths_response(resp, 'folder created')
         end
 
         def action_mklink(target:, link_path:, **)
-          resp = @api_node.create('files/create', {'paths' => [{type: :symbolic_link, path: link_path, target: {path: target}}]})
+          resp = api_node.create('files/create', {'paths' => [{type: :symbolic_link, path: link_path, target: {path: target}}]})
           cli_result_from_paths_response(resp, 'link created')
         end
 
-        def action_mkfile(file_path:, contents:, **)
+        def action_mkfile(path:, contents:, **)
           contents64 = contents.nil? ? '' : Base64.strict_encode64(contents)
-          resp = @api_node.create('files/create', {'paths' => [{type: :file, path: file_path, contents: contents64}]})
+          resp = api_node.create('files/create', {'paths' => [{type: :file, path: path, contents: contents64}]})
           cli_result_from_paths_response(resp, 'file created')
         end
 
-        def action_rename(path_base:, path_src:, path_dst:, **)
+        def action_rename(folder:, source:, destination:, **)
           # TODO: multiple ?
-          resp = @api_node.create('files/rename', {'paths' => [{'path' => path_base, 'source' => path_src, 'destination' => path_dst}]})
+          resp = api_node.create('files/rename', {'paths' => [{'path' => folder, 'source' => source, 'destination' => destination}]})
           cli_result_from_paths_response(resp, 'entry moved')
         end
 
@@ -606,8 +651,8 @@ module Aspera
         def sync_gen3_block
           lambda do |direction, local_path, remote_path|
             request_transfer_spec = sync_spec_request(direction, local_path, remote_path)
-            @api_node.add_tspec_info(request_transfer_spec) if @api_node.respond_to?(:add_tspec_info)
-            transfer_spec = @api_node.create(
+            api_node.add_tspec_info(request_transfer_spec) if api_node.respond_to?(:add_tspec_info)
+            transfer_spec = api_node.create(
               'files/sync_setup',
               {transfer_requests: [{transfer_request: request_transfer_spec}]}
             )['transfer_specs'].first['transfer_spec']
@@ -621,42 +666,42 @@ module Aspera
           define_method(:"action_sync_#{dir}") { |path:, sync_info: {}, **| run_sync_transfer(dir, path: path, sync_info: sync_info, &sync_gen3_block) }
         end
 
-        def action_upload
+        def action_upload(**)
           # empty transfer spec for authorization request
           request_transfer_spec = {}
           request_transfer_spec[:paths] = [{destination: transfer.destination_folder(Transfer::Spec::DIRECTION_SEND)}]
           # add fixed parameters if any (for COS)
-          @api_node.add_tspec_info(request_transfer_spec) if @api_node.respond_to?(:add_tspec_info)
+          api_node.add_tspec_info(request_transfer_spec) if api_node.respond_to?(:add_tspec_info)
           Api::Node.add_public_key(request_transfer_spec)
           setup_payload = {transfer_requests: [{transfer_request: request_transfer_spec}]}
-          transfer_spec = @api_node.create('files/upload_setup', setup_payload)['transfer_specs'].first['transfer_spec']
+          transfer_spec = api_node.create('files/upload_setup', setup_payload)['transfer_specs'].first['transfer_spec']
           Api::Node.add_private_key(transfer_spec)
           transfer_spec.delete('paths')
           Runner.result_transfer(transfer.start(transfer_spec))
         end
 
-        def action_download
+        def action_download(**)
           # empty transfer spec for authorization request
           request_transfer_spec = {}
           request_transfer_spec[:paths] = transfer.ts_source_paths
           # add fixed parameters if any (for COS)
-          @api_node.add_tspec_info(request_transfer_spec) if @api_node.respond_to?(:add_tspec_info)
+          api_node.add_tspec_info(request_transfer_spec) if api_node.respond_to?(:add_tspec_info)
           Api::Node.add_public_key(request_transfer_spec)
           setup_payload = {transfer_requests: [{transfer_request: request_transfer_spec}]}
-          transfer_spec = @api_node.create('files/download_setup', setup_payload)['transfer_specs'].first['transfer_spec']
+          transfer_spec = api_node.create('files/download_setup', setup_payload)['transfer_specs'].first['transfer_spec']
           Api::Node.add_private_key(transfer_spec)
           Runner.result_transfer(transfer.start(transfer_spec))
         end
 
-        def action_cat(remote_path:, **)
-          http = @api_node.read("files/#{URI.encode_www_form_component(remote_path)}/contents", ret: :resp)
+        def action_cat(path:, **)
+          http = api_node.read("files/#{URI.encode_www_form_component(path)}/contents", ret: :resp)
           Result::Text.new(http.body)
         end
 
-        def action_health
+        def action_health(**)
           nagios = Nagios.new
           begin
-            info = @api_node.read('info')
+            info = api_node.read('info')
             nagios.add_ok('node api', 'accessible')
             nagios.check_time_offset(info['current_time'], 'node api')
             nagios.check_product_version('node api', 'entsrv', info['version'])
@@ -664,7 +709,7 @@ module Aspera
             nagios.add_critical('node api', e.to_s)
           end
           begin
-            @api_node.call(
+            api_node.call(
               operation:    'POST',
               subpath:      'services/soap/Transfer-201210',
               content_type: Mime::TEXT,
@@ -681,49 +726,32 @@ module Aspera
 
         # watch_folder setup: inject required API header (avoids "Unable to convert 2016_09_14 configuration")
         def setup_watch_folder(**)
-          @api_node.params[:headers] ||= {}
-          @api_node.params[:headers]['X-aspera-WF-version'] = '2017_10_23'
+          api_node.headers['X-aspera-WF-version'] = '2017_10_23'
           {}
         end
 
-        def action_access_keys_do_permission_modify(data:, apifid:, perm_id:, **)
-          apifid.node_api.update("permissions/#{perm_id}", data)
-          Result::Status.new('Updated')
-        end
-
-        def action_watch_folder_modify(data:, watch_folder_id:, **)
-          @api_node.update("v3/watchfolders/#{watch_folder_id}", data)
-          Result::Status.new("#{watch_folder_id} updated")
-        end
-
-        def action_watch_folder_delete(watch_folder_id:, **)
-          @api_node.delete("v3/watchfolders/#{watch_folder_id}")
-          Result::Status.new("#{watch_folder_id} deleted")
-        end
-
         # access_keys > do - setup: resolve access key and root file id
-        # access_key_id is resolved by execute_leaf (via instance_arg in CommandSpec)
         # @return [Hash] context hash containing :do_root_file_id
         def setup_access_key_do(access_key_id:, **)
           @do_root_file_id = options.get_option(:root_id)
           if @do_root_file_id.nil?
-            ak_info = @api_node.read("access_keys/#{access_key_id}")
-            ak_secret = context.secret_finder.lookup(url: @api_node.base_url, username: ak_info['id'])
+            ak_info = api_node.read("access_keys/#{access_key_id}")
+            ak_secret = context.secret_finder.lookup(url: api_node.base_url, username: ak_info['id'])
             if !access_key_id.eql?('self')
-              Aspera.assert(ak_secret, type: Cli::MissingArgument) { "Please provide secret for #{ak_info['id']} using option: secret or by setting a preset for #{ak_info['id']}@#{@api_node.base_url}." }
-              @api_node.auth_params[:username] = ak_info['id']
-              @api_node.auth_params[:password] = ak_secret
+              Aspera.assert(ak_secret, type: Cli::MissingArgument) { "Please provide secret for #{ak_info['id']} using option: secret or by setting a preset for #{ak_info['id']}@#{api_node.base_url}." }
+              api_node.auth_params[:username] = ak_info['id']
+              api_node.auth_params[:password] = ak_secret
             end
             @do_root_file_id = ak_info['root_file_id']
           end
           {do_root_file_id: @do_root_file_id}
         end
 
-        # access_keys > do > permission - setup: resolve apifid from CLI path argument
-        # (path is read from CLI here as 'permission' is an intermediate node)
+        # access_keys > do > permission - setup: resolve apifid from the path argument of the node
+        # do_root_file_id: comes from ctx (setup_access_key_do, or seed of a mount)
         # @return [Hash] context hash containing :apifid
-        def setup_access_key_do_permission(**)
-          {apifid: apifid_from_next_arg(@do_root_file_id)}
+        def setup_access_key_do_permission(do_root_file_id:, path:, **)
+          {apifid: apifid_from_path(do_root_file_id, path)}
         end
 
         # access_keys > do > ls
@@ -737,7 +765,7 @@ module Aspera
         # access_keys > do > find
         def action_access_keys_do_find(path:, filter: nil, do_root_file_id:, **)
           apifid = apifid_from_path(do_root_file_id, path)
-          Result::ObjectList.new(@api_node.find_files(apifid.file_id, Base.file_matcher(filter)), fields: ['path'])
+          Result::ObjectList.new(api_node.find_files(apifid.file_id, Base.file_matcher(filter)), fields: ['path'])
         end
 
         # access_keys > do > cat
@@ -753,9 +781,9 @@ module Aspera
         end
 
         # access_keys > do > modify
-        def action_access_keys_do_modify(path:, update_value:, do_root_file_id:, **)
+        def action_access_keys_do_modify(path:, file:, do_root_file_id:, **)
           apifid = apifid_from_path(do_root_file_id, path)
-          apifid.node_api.update("files/#{apifid.file_id}", update_value)
+          apifid.node_api.update("files/#{apifid.file_id}", file)
           Result::Status.new('Done')
         end
 
@@ -767,19 +795,19 @@ module Aspera
 
         # access_keys > do > rename
         def action_access_keys_do_rename(source_path:, new_name:, do_root_file_id:, **)
-          apifid = @api_node.resolve_api_fid(do_root_file_id, source_path)
+          apifid = api_node.resolve_api_fid(do_root_file_id, source_path)
           apifid.node_api.update("files/#{apifid.file_id}", {name: new_name})
           Result::Status.new("renamed to #{new_name}")
         end
 
         # access_keys > do > delete
-        def action_access_keys_do_delete(paths:, do_root_file_id:, **)
-          bulk_result(paths, command: :delete, id_result: 'path') do |l_path|
+        def action_access_keys_do_delete(path:, do_root_file_id:, **)
+          bulk_result(path, command: :delete, id_result: 'path') do |l_path|
             apifid = if (m = Parser.percent_selector(l_path))
               Aspera.assert_values(m[:field], ['id'], type: BadIdentifier)
-              Api::NodeFileId.new(@api_node, m[:value])
+              Api::NodeFileId.new(api_node, m[:value])
             else
-              @api_node.resolve_api_fid(do_root_file_id, l_path)
+              api_node.resolve_api_fid(do_root_file_id, l_path)
             end
             apifid.node_api.delete("files/#{apifid.file_id}")
             {'path' => l_path}
@@ -790,7 +818,7 @@ module Aspera
         def sync_gen4_block(do_root_file_id)
           lambda do |direction, _local_path, remote_path|
             ts_direction = direction.eql?(:pull) ? Transfer::Spec::DIRECTION_RECEIVE : Transfer::Spec::DIRECTION_SEND
-            apifid = @api_node.resolve_api_fid(do_root_file_id, remote_path)
+            apifid = api_node.resolve_api_fid(do_root_file_id, remote_path)
             apifid.node_api.transfer_spec_gen4(apifid.file_id, ts_direction)
           end
         end
@@ -803,27 +831,20 @@ module Aspera
 
         # access_keys > do > upload
         def action_access_keys_do_upload(do_root_file_id:, **)
-          apifid = @api_node.resolve_api_fid(do_root_file_id, transfer.destination_folder(Transfer::Spec::DIRECTION_SEND), true)
+          apifid = api_node.resolve_api_fid(do_root_file_id, transfer.destination_folder(Transfer::Spec::DIRECTION_SEND), true)
           Runner.result_transfer(transfer.start(apifid.node_api.transfer_spec_gen4(apifid.file_id, Transfer::Spec::DIRECTION_SEND)))
         end
 
         # access_keys > do > download
         def action_access_keys_do_download(do_root_file_id:, **)
-          apifid, source_paths = @api_node.resolve_api_fid_paths(do_root_file_id, transfer.ts_source_paths)
+          apifid, source_paths = api_node.resolve_api_fid_paths(do_root_file_id, transfer.ts_source_paths)
           Runner.result_transfer(transfer.start(apifid.node_api.transfer_spec_gen4(apifid.file_id, Transfer::Spec::DIRECTION_RECEIVE, {'paths'=>source_paths})))
         end
 
-        # access_keys > do > permission (intermediate node: re-enter DSL at permission sub-tree)
-        def action_access_keys_do_permission(do_root_file_id:, **)
-          apifid = apifid_from_next_arg(do_root_file_id)
-          dispatch_from_registry(%i[access_keys do permission], {apifid: apifid}, skip_setup: true)
-        end
-
-        # access_keys > do > v3
-        def action_access_keys_do_v3(do_root_file_id:, **)
-          # Build a fresh Node for the v3 root, then let the DSL dispatcher consume the next command.
-          v3_node = Node.new(context: context, api: @api_node.resolve_api_fid(do_root_file_id, '').node_api)
-          v3_node.execute_action
+        # access_keys > do > v3 - mount target: Node plugin on the node hosting the root file
+        # @return [Node]
+        def v3_node_plugin(do_root_file_id:, **)
+          Node.new(context: context, api: api_node.resolve_api_fid(do_root_file_id, '').node_api)
         end
 
         # access_keys > do > node_info / bearer_token_node — shared helper builds the result hash
@@ -861,7 +882,8 @@ module Aspera
         # @param path [String] full path (folder/name)
         def gen4_mk_resolve(top_file_id, path)
           containing_folder_path, new_item = Api::Node.split_folder(path)
-          apifid = @api_node.resolve_api_fid(top_file_id, containing_folder_path, true)
+          apifid = api_node.resolve_api_fid(top_file_id, containing_folder_path, true)
+          # not a URL query: special keys `check` and `target`, rest merged into the POST body
           query = options.get_option(:query)
           check_exists = true
           payload = {name: new_item}
@@ -869,7 +891,7 @@ module Aspera
             check_exists = !query.delete('check').eql?(false)
             target = query.delete('target')
             if target
-              target_apifid = @api_node.resolve_api_fid(top_file_id, target, true)
+              target_apifid = api_node.resolve_api_fid(top_file_id, target, true)
               payload[:target_id] = target_apifid.file_id
             end
             payload.merge!(query.symbolize_keys)
@@ -913,8 +935,8 @@ module Aspera
           Result::ObjectList.new(apifid.node_api.read_with_pages('permissions', list_query))
         end
 
-        def action_access_keys_do_permission_delete(perm_id:, apifid:, **)
-          bulk_result(perm_id, command: :delete) do |one_id|
+        def action_access_keys_do_permission_delete(permission_id:, apifid:, **)
+          bulk_result(permission_id, command: :delete) do |one_id|
             apifid.node_api.delete("permissions/#{one_id}")
             the_app = apifid.node_api.app_info
             the_app&.api&.permissions_send_event(event_data: {}, app_info: the_app, types: ['permission.deleted'])
@@ -922,8 +944,8 @@ module Aspera
           end
         end
 
-        def action_access_keys_do_permission_create(data:, apifid:, **)
-          create_param = data
+        def action_access_keys_do_permission_create(permission:, apifid:, **)
+          create_param = permission
           Aspera.assert(!create_param.key?('file_id'), type: Cli::BadArgument) { 'no file_id' }
           create_param['file_id'] = apifid.file_id
           create_param['access_levels'] = Api::Node::ACCESS_LEVELS unless create_param.key?('access_levels')
@@ -936,36 +958,31 @@ module Aspera
 
         # access_keys > set_bearer_key
         def action_access_keys_set_bearer_key(access_key_id:, bearer_key_pem:, **)
-          access_key_id = @api_node.read('access_keys/self')['id'] if access_key_id.eql?('self')
+          access_key_id = api_node.read('access_keys/self')['id'] if access_key_id.eql?('self')
           key = OpenSSL::PKey.read(bearer_key_pem)
           key = key.public_key if key.private?
-          @api_node.update("access_keys/#{access_key_id}", {token_verification_key: key.to_pem})
+          api_node.update("access_keys/#{access_key_id}", {token_verification_key: key.to_pem})
           Result::Status.new('public key updated')
         end
 
         # async sub-commands: individual handlers
         def action_async_show(async_id:, **)
-          async_ids = @api_node.read('async/list')['sync_ids']
+          async_ids = api_node.read('async/list')['sync_ids']
           if async_id.eql?(SpecialValues::ALL)
-            resp = @api_node.create('async/summary', {'syncs' => async_ids})['sync_summaries']
+            resp = api_node.create('async/summary', {'syncs' => async_ids})['sync_summaries']
             return Result::Empty.new if resp.empty?
             return Result::ObjectList.new(resp, fields: %w[snid name local_dir remote_dir])
           end
           Integer(async_id)
-          resp = @api_node.create('async/summary', {'syncs' => [async_id]})['sync_summaries']
+          resp = api_node.create('async/summary', {'syncs' => [async_id]})['sync_summaries']
           return Result::Empty.new if resp.empty?
           Result::SingleObject.new(resp.first)
         end
 
-        def action_async_delete(async_id:, **)
-          async_ids = async_id.eql?(SpecialValues::ALL) ? @api_node.read('async/list')['sync_ids'] : [async_id]
-          Result::SingleObject.new(@api_node.create('async/delete', {'syncs' => async_ids}))
-        end
-
         def action_async_bandwidth(async_id:, **)
           Integer(async_id)
           post_data = {'syncs' => [async_id], 'seconds' => 100}
-          resp = @api_node.create('async/bandwidth', post_data)
+          resp = api_node.create('async/bandwidth', post_data)
           data = resp['bandwidth_data']
           return Result::Empty.new if data.empty?
           Result::ObjectList.new(data.first[async_id]['data'])
@@ -974,9 +991,10 @@ module Aspera
         def action_async_files(async_id:, **)
           Integer(async_id)
           post_data = {'syncs' => [async_id]}
+          # not a URL query: merged into the POST body of async/files
           filter = options.get_option(:query)
           post_data.merge!(filter) unless filter.nil?
-          resp = @api_node.create('async/files', post_data)
+          resp = api_node.create('async/files', post_data)
           data = resp['sync_files']
           data = data.first[async_id] unless data.empty?
           iteration_data = []
@@ -997,23 +1015,13 @@ module Aspera
 
         def action_async_counters(async_id:, **)
           Integer(async_id)
-          resp = @api_node.create('async/counters', {'syncs' => [async_id]})['sync_counters'].first[async_id].last
+          resp = api_node.create('async/counters', {'syncs' => [async_id]})['sync_counters'].first[async_id].last
           return Result::Empty.new if resp.nil?
           Result::SingleObject.new(resp)
         end
 
-        def action_ssync_start(ssync_id:, **)
-          @api_node.call(operation: 'POST', subpath: "asyncs/#{ssync_id}/start", content_type: Mime::TEXT, body: '', ret: :resp).body
-          Result::Status.new('Done')
-        end
-
-        def action_ssync_stop(ssync_id:, **)
-          @api_node.call(operation: 'POST', subpath: "asyncs/#{ssync_id}/stop", content_type: Mime::TEXT, body: '', ret: :resp).body
-          Result::Status.new('Done')
-        end
-
         # transfer sub-commands
-        def action_transfer_list
+        def action_transfer_list(**)
           transfer_filter = query_read_delete(default: {}, schema: Schema::Registry.query_params(Schema::Registry::NODE, 'ops/transfers'))
           iteration_persistency = nil
           if options.get_option(:once_only, mandatory: true)
@@ -1030,13 +1038,13 @@ module Aspera
           else
             Aspera.assert(!transfer_filter.key?('reset'), 'reset only with once_only', type: Cli::BadArgument)
           end
-          transfers_data = @api_node.read_with_paging('ops/transfers', transfer_filter, iteration: iteration_persistency&.data)
+          transfers_data = api_node.read_with_paging('ops/transfers', transfer_filter, iteration: iteration_persistency&.data)
           iteration_persistency&.save
           Result::ObjectList.new(transfers_data, fields: %w[id status start_spec.direction start_spec.remote_user start_spec.remote_host start_spec.destination_path])
         end
 
-        def action_transfer_sessions
-          transfers_data = @api_node.read('ops/transfers', query_read_delete(schema: Schema::Registry.query_params(Schema::Registry::NODE, 'ops/transfers')))
+        def action_transfer_sessions(**)
+          transfers_data = api_node.read('ops/transfers', query_read_delete(schema: Schema::Registry.query_params(Schema::Registry::NODE, 'ops/transfers')))
           sessions = transfers_data.flat_map { |t| t['sessions'] }
           sessions.each do |session|
             SESSION_TIME_FIELDS.each do |what|
@@ -1046,18 +1054,8 @@ module Aspera
           Result::ObjectList.new(sessions, fields: %w[id status start_time end_time target_rate_kbps])
         end
 
-        def action_transfer_cancel(transfer_id:, **)
-          @api_node.cancel("ops/transfers/#{transfer_id}")
-          Result::Status.new('Cancelled')
-        end
-
-        def action_transfer_modify(update_value:, transfer_id:, **)
-          @api_node.update("ops/transfers/#{transfer_id}", update_value)
-          Result::Status.new('Modified')
-        end
-
-        def action_transfer_bandwidth_average
-          transfers_data = @api_node.read('ops/transfers', query_read_delete(schema: Schema::Registry.query_params(Schema::Registry::NODE, 'ops/transfers')))
+        def action_transfer_bandwidth_average(**)
+          transfers_data = api_node.read('ops/transfers', query_read_delete(schema: Schema::Registry.query_params(Schema::Registry::NODE, 'ops/transfers')))
           bandwidth_period = {}
           dir_info = %i[avg_kbps sessions].freeze
           transfers_data.each do |t|
@@ -1086,17 +1084,6 @@ module Aspera
           Result::ObjectList.new(result)
         end
 
-        # service sub-commands
-        def action_service_create(creation_data:, **)
-          resp = @api_node.create('rund/services', creation_data)
-          Result::Status.new("#{resp['id']} created")
-        end
-
-        def action_service_delete(service_id:, **)
-          @api_node.delete("rund/services/#{service_id}")
-          Result::Status.new("#{service_id} deleted")
-        end
-
         # central: shared helper
         def central_validation
           validator_id = options.get_option(:validator)
@@ -1104,35 +1091,35 @@ module Aspera
         end
 
         # central > session > list
-        def action_central_session_list(request_data:, **)
-          request_data ||= {}
+        def action_central_session_list(criteria:, **)
+          criteria ||= {}
           validation = central_validation
-          request_data.deep_merge!({'validation' => validation}) unless validation.nil?
-          resp = @api_node.create('services/rest/transfers/v1/sessions', request_data)
+          criteria.deep_merge!({'validation' => validation}) unless validation.nil?
+          resp = api_node.create('services/rest/transfers/v1/sessions', criteria)
           Result::ObjectList.new(resp['session_info_result']['session_info'], fields: %w[session_uuid status transport direction bytes_transferred])
         end
 
         # central > file > list
-        def action_central_file_list(request_data:, **)
-          request_data ||= {}
+        def action_central_file_list(criteria:, **)
+          criteria ||= {}
           validation = central_validation
-          request_data.deep_merge!({'validation' => validation}) unless validation.nil?
-          resp = @api_node.create('services/rest/transfers/v1/files', request_data)
+          criteria.deep_merge!({'validation' => validation}) unless validation.nil?
+          resp = api_node.create('services/rest/transfers/v1/files', criteria)
           resp = JSON.parse(resp) if resp.is_a?(String)
           Log.dump(:resp, resp)
           Result::ObjectList.new(resp['file_transfer_info_result']['file_transfer_info'], fields: %w[session_uuid file_id status path])
         end
 
         # central > file > modify
-        def action_central_file_modify(request_data:, **)
-          request_data ||= {}
+        def action_central_file_modify(file:, **)
+          file ||= {}
           validation = central_validation
-          request_data.deep_merge!(validation) unless validation.nil?
-          @api_node.update('services/rest/transfers/v1/files', request_data)
+          file.deep_merge!(validation) unless validation.nil?
+          api_node.update('services/rest/transfers/v1/files', file)
           Result::Status.new('updated')
         end
 
-        def action_asperabrowser
+        def action_asperabrowser(**)
           browse_params = {
             'nodeUser' => options.get_option(:username, mandatory: true),
             'nodePW'   => options.get_option(:password, mandatory: true),
@@ -1144,12 +1131,6 @@ module Aspera
           return Result::Status.new('done')
         end
 
-        def action_bearer_token(private_key_pem:, user_group_id:, **)
-          private_key = OpenSSL::PKey::RSA.new(private_key_pem)
-          access_key  = options.get_option(:username, mandatory: true)
-          Result::Text.new(Api::Node.bearer_token(payload: user_group_id, access_key: access_key, private_key: private_key))
-        end
-
         def action_simulator(parameters: {}, **)
           require 'aspera/node_simulator'
           parameters = parameters.symbolize_keys
@@ -1169,8 +1150,8 @@ module Aspera
           parameters[:interval] = 10 unless parameters.key?(:interval)
           parameters[:hostname] = Socket.gethostname unless parameters.key?(:hostname)
           interval = parameters[:interval].to_f
-          Aspera.assert(interval > 0, type: Cli::BadArgument) { 'Interval must be a positive number in seconds' }
-          otel_api = Rest.new(
+          Aspera.assert(interval >= 0, type: Cli::BadArgument) { 'Interval must be a positive number in seconds, or 0 for single shot' }
+          otel_api = Rest::Client.new(
             base_url: "#{parameters[:url]}/v1",
             headers: {
               # 'Authorization'  => "apiToken #{parameters[:key]}",
@@ -1225,7 +1206,7 @@ module Aspera
           }
           loop do
             timestamp = Time.now
-            transfers_data = @api_node.read_with_paging('ops/transfers', {active_only: true})
+            transfers_data = api_node.read_with_paging('ops/transfers', {active_only: true})
             datapoint[:asInt] = transfers_data.length
             datapoint[:timeUnixNano] = timestamp.to_i * 1_000_000_000 + timestamp.nsec
             Log.log.info("#{datapoint[:asInt]} active transfers")
@@ -1236,21 +1217,6 @@ module Aspera
           end
         end
 
-        # Dispatch a Gen3 command that has already been read from the argument stream.
-        # Used when a new Node instance is created by an external plugin (shares, faspex, cos, :v3)
-        # and the command symbol was already consumed before the Node was instantiated.
-        # Re-enters the DSL registry so Proc actions and intermediate nodes (sync, access_keys)
-        # are resolved normally.
-        # Pre-resolved CLI arguments (e.g. path:) can be forwarded via +ctx+ to avoid
-        # re-consuming tokens that were already resolved by the calling plugin's DSL.
-        # @param command [Symbol] command already consumed from the argument stream
-        # @param ctx     [Hash]   pre-resolved context (keyword args forwarded to dispatch)
-        # @return [Object] CLI result
-        def dispatch_v3_command(command, **ctx)
-          Aspera.assert_values(command, COMMANDS_GEN3 + %i[health events info slash license api_details access_keys transfer]) { 'v3 command' }
-          dispatch_from_registry([command], ctx)
-        end
-
         private
 
         # Response has key `paths`.