aspera-cli 4.27.5 → 4.28.0

data/lib/aspera/cli/options.schema.yaml

@@ -29,6 +29,98 @@ components:
           type: boolean
           description: Show passwords and secrets in logs.
           default: false
+    UiOptions:
+      type: object
+      description: >-
+        User interface: how URLs to open, secrets and files are presented to the user.
+        A plain value, e.g. `--ui=terminal`, is the `mode`.
+      additionalProperties: false
+      properties:
+        mode:
+          type: string
+          description: >-
+            `auto`: `browser` on Windows and macOS, or if env var `DISPLAY` is set, else `terminal`.
+            `terminal`: URLs and files to open are displayed on terminal, and secrets are entered on terminal.
+            `browser`: a browser opens URLs, secrets are entered on a web page, and a text editor opens files.
+            `text` is an alias for `terminal`, and `graphical` is an alias for `browser`.
+          enum:
+            - auto
+            - terminal
+            - browser
+            - text
+            - graphical
+          default: auto
+        command:
+          type: array
+          description: >-
+            Command that opens a URL, instead of the system default.
+            First item is the executable, then its arguments. The URL is added as last argument.
+            When set, it is used to open URLs, whatever the `mode`.
+          items:
+            type: string
+    SecurityOptions:
+      type: object
+      description: >-
+        Restrictions of the features that access local resources or execute code.
+        On the command line, the default level is `low`.
+        In MCP server mode, the default level is `high`, and commands of the client cannot change the security options.
+      additionalProperties: false
+      properties:
+        level:
+          type: string
+          description: >-
+            `low`: no restriction.
+            `medium`: `@file:` reads only files in `allowed_paths`, `@ruby:`, `@uri:` and `@env:` are refused.
+            `high`: `@ruby:`, `@file:`, `@uri:` and `@env:` are refused.
+          enum:
+            - low
+            - medium
+            - high
+        allowed_paths:
+          type: array
+          description: >-
+            With level `medium`: files and folders that `@file:` can read.
+            A symbolic link leading outside of them is refused.
+          items:
+            type: string
+    TempOptions:
+      type: object
+      description: >-
+        Temporary files.
+        A plain value, e.g. `--temp=/tmp`, is the `folder`.
+      additionalProperties: false
+      properties:
+        folder:
+          type: string
+          description: >-
+            Folder for temporary files, e.g. certificate for WSS transfers, logs of `transferd`.
+            `@sys`: temporary folder of the system for the current user (Ruby `Etc.systmpdir`).
+            `@env`: from environment variables, e.g. `TMPDIR` (Ruby `Dir.tmpdir`).
+          default: '@sys'
+        clean:
+          type: boolean
+          description: >-
+            Delete temporary files created by the command when it ends.
+            `false` keeps them, e.g. for debugging.
+            Files left by previous commands are still deleted according to `expiry`.
+          default: true
+        expiry:
+          oneOf:
+            - type: string
+            - type: number
+              minimum: 0
+            - type: boolean
+              enum:
+                - false
+          description: >-
+            Age after which file lists of `ascp` left by previous commands (e.g. interrupted) are deleted, when a command starts.
+            They are in folder `filelists` of the main folder (option `home`).
+            A duration, e.g. `5d`, `12h`, `1w`, `1h 30m`, `1d 02:00:00`, a plain number is seconds.
+            `false` or `null` (`@none:`): never delete them.
+            `0`: delete all of them, including file lists of transfers in progress in other executions of ascli.
+            Such a transfer fails if `ascp` reads its file list again: next session of a multi-session transfer, or resume after an error.
+            Use `0` only when no other transfer is in progress, not in a permanent configuration.
+          default: 5d
     McpServerOptions:
       type: object
       description: MCP server configuration for the `mcp server` command.
@@ -51,14 +143,60 @@ components:
           type: integer
           description: Maximum JSON frame size for stdio transport.
           default: 4194304
+        url:
+          type: string
+          description: >-
+            Address and port the HTTP transport listens on, without path.
+            Use `https://` for TLS, with `cert` and `key`.
+          default: http://127.0.0.1:3000
+        cert:
+          $ref: "#/components/schemas/WebServerOptions/properties/cert"
+        key:
+          $ref: "#/components/schemas/WebServerOptions/properties/key"
+        chain:
+          $ref: "#/components/schemas/WebServerOptions/properties/chain"
         port:
           type: integer
-          description: TCP port for HTTP transport.
-          default: 3000
+          description: "Deprecated: use `url`. TCP port for HTTP transport."
         bind:
           type: string
-          description: Bind address for HTTP transport.
-          default: 127.0.0.1
+          description: "Deprecated: use `url`. Bind address for HTTP transport."
+        public_url:
+          type: string
+          description: >-
+            URL of the server for clients, used in OAuth metadata and in the URL of secret pages (`@secret:`), for example `http://myhost:3000`.
+
+            Default: built from `url`. Mandatory with `oauth` when `url` has host `0.0.0.0` or `::`.
+        auth_token:
+          type: string
+          description: >-
+            Bearer token required in the `Authorization` header of HTTP requests.
+            It is also the access code asked on the secret pages (`@secret:`), and on the consent page with `oauth`.
+
+            If not set, HTTP requests are not authenticated.
+            Mandatory when the host of `url` or `public_url` is not loopback.
+            Generate it with `openssl rand -hex 32`: a weak token is refused (see `auth_token_min_bits`).
+        auth_token_min_bits:
+          type: integer
+          minimum: 0
+          default: 80
+          description: >-
+            Minimum estimated strength of `auth_token`, in bits (log2 of the number of guesses to find it).
+            The strength is estimated with gem `zxcvbn` if installed, else with a built-in estimate
+            that detects repeats, sequences, keyboard rows, words and years.
+            `0` disables the check.
+        oauth:
+          type: boolean
+          description: Enable OAuth 2.0 PKCE flow with dynamic client registration.
+          default: false
+        oauth_access_token_ttl:
+          type: integer
+          description: OAuth access token lifetime in seconds.
+          default: 3600
+        oauth_refresh_token_ttl:
+          type: integer
+          description: OAuth refresh token lifetime in seconds.
+          default: 2592000
         stateless:
           type: boolean
           description: Run HTTP transport in stateless mode.
@@ -419,7 +557,8 @@ components:
           enum: [system]
         name:
           type: string
-          description: Name of the keychain to use.
+          description: Name of the keychain to use (file `<name>.keychain-db` in the keychain search list).
+          default: ascli
     VaultOnePasswordOptions:
       type: object
       description: 1Password secret store (Connect REST API or CLI).
@@ -518,8 +657,9 @@ components:
           default: false
         double:
           type: boolean
-          description: Use double vertical resolution via half-block characters.
-          default: true
+          description: >-
+            Use double vertical resolution via half-block characters (Unicode).
+            Default is `true` if the terminal supports Unicode (see `utf8`).
         font_ratio:
           type: number
           format: float
@@ -647,11 +787,24 @@ components:
             Username expected from clients in HTTP Basic authentication.
             Set together with `password`.
             When not set, requests are accepted without authentication.
+            Mandatory when `url` is not a loopback address (`localhost`, `127.0.0.0/8`, `::1`).
           example: node_user
         password:
           type: string
-          description: Password expected from clients in HTTP Basic authentication, for the above `username`.
+          description: >-
+            Password expected from clients in HTTP Basic authentication, for the above `username`.
+            Generate it with `openssl rand -hex 32`: a weak password is refused (see `password_min_bits`).
           example: my_password
+        password_min_bits:
+          type: integer
+          minimum: 0
+          default: 80
+          description: >-
+            Minimum estimated strength of `password`, in bits (log2 of the number of guesses to find it).
+            The strength is estimated with gem `zxcvbn` if installed, else with a built-in estimate
+            that detects repeats, sequences, keyboard rows, words and years.
+            `0` disables the check.
+            A random password of 32 bytes (`openssl rand -hex 32`) is far above the default.
     NodeTelemetryOptions:
       type: object
       description: >-
@@ -713,40 +866,88 @@ components:
         Valid keys are defined by the workflow's input specification.
         Use `orchestrator workflows inputs WORKFLOW_ID` to discover required parameters.
       additionalProperties: true
-    OrchestratorImportWorkflow:
+    OrchestratorWorkflowExport:
       type: object
-      description: Workflow definition to import into Orchestrator.
-      required:
-        - name
+      description: Options of `orchestrator workflows export`.
+      additionalProperties: false
       properties:
-        name:
-          type: string
-          description: Workflow name.
-          example: My Workflow
-        description:
-          type: string
-          description: Workflow description.
-          example: This is a sample workflow
-        workflow_data:
-          type: object
-          description: Complete workflow definition.
+        dependencies:
+          type: boolean
+          description: >-
+            Export the sub-workflows and remote nodes used by the workflow in a package (`.wkf`),
+            saved in the folder given by option `to_folder` (default: current folder), instead of displaying the workflow.
+          default: false
+    OrchestratorWorkflowImport:
+      type: object
+      description: Options of `orchestrator workflows import`.
+      additionalProperties: false
+      properties:
+        folder_id:
+          type: integer
+          description: >-
+            Folder of the new workflow (default: the default folder).
+            The `folder_id` of existing workflows is in `orchestrator workflows list`.
+        publish:
+          type: boolean
+          description: >-
+            Publish the workflow after import.
+            If not set, the server option `publish_api_imported_workflow` decides.
+        link_to_subworkflows:
+          type: boolean
+          description: Link to existing sub-workflows instead of importing those of the package (`.wkf`).
+          default: false
     OrchestratorImportWithConstraints:
       type: object
-      description: Workflow definition to import with constraint resolution mappings.
+      description: >-
+        Import of a workflow file present on the Orchestrator host, as a new workflow or as a new revision of an existing workflow.
+        `orchestrator workflows import` stores each uploaded file in `<run_dir>/workflows/import/`.
+        Conflicts with existing global templates, sub-workflows and remote nodes are resolved by name.
+        Use `orchestrator workflows find_constraints` to list the conflicts, and `orchestrator workflows check_import` to check the file beforehand.
+      additionalProperties: false
       required:
-        - workflow_data
-        - constraints
+        - filename
       properties:
-        workflow_data:
+        filename:
+          type: string
+          description: Path of the workflow file (`.yml` or `.wkf`) on the Orchestrator host.
+          example: /opt/aspera/orchestrator/var/run/orchestrator/workflows/import/my_workflow.yml
+        add_as_revision:
+          type: integer
+          description: >-
+            ID of an existing workflow: the file is imported as a new revision of this workflow (to be published).
+            If not set, a new workflow is created.
+          example: 123
+        subwf_constraints:
           type: object
-          description: Complete workflow definition to import.
-        constraints:
+          description: 'Resolution for each sub-workflow, by name: `Map to the Existing Sub-Workflow`, `Create a new Sub-Workflow with a unique name`, or `Add a new revision to the existing Sub-Workflow`.'
+          additionalProperties:
+            type: string
+            enum:
+              - Map to the Existing Sub-Workflow
+              - Create a new Sub-Workflow with a unique name
+              - Add a new revision to the existing Sub-Workflow
+        action_template_constraints:
           type: object
-          description: Constraint resolution mappings for conflicting resources.
-          example:
-            resource_pools: {}
-            queues: {}
-            monitors: {}
+          description: 'Resolution for each global action template, by name: `Map to the existing Global Template`, `Create a new Global Template with a different name`, or `Override the existing Global Template with this new template`.'
+          additionalProperties:
+            type: string
+            enum:
+              - Map to the existing Global Template
+              - Create a new Global Template with a different name
+              - Override the existing Global Template with this new template
+        remote_node_constraints:
+          type: object
+          description: 'Resolution for each remote node, by name: `Map to the existing Remote Node`, `Create a new Remote Node with a different name`, or `Override the Existing Remote Node with this importing node`.'
+          additionalProperties:
+            type: string
+            enum:
+              - Map to the existing Remote Node
+              - Create a new Remote Node with a different name
+              - Override the Existing Remote Node with this importing node
+        auto_enable_missing_plugins:
+          type: boolean
+          description: Enable the plugins used by the workflow that are not enabled.
+          default: false
     OrchestratorReloadPluginSet:
       type: object
       description: Set of plugins to reload.
@@ -792,8 +993,13 @@ components:
             `ALL` for all fields, `DEF` for default fields.
             Prefix a field name with `-` to exclude it.
         select:
-          type: object
-          description: Select only matching items from a list (field/value filter or lambda).
+          description: >-
+            Select only matching items from a list:
+            `Hash` of field/value, or Ruby lambda (`@ruby:`) returning `true` for items to keep.
+        query:
+          description: >-
+            Filter and reshape an object or list result, before `select` and `fields`:
+            JMESPath expression (https://jmespath.org), or Ruby lambda (`@ruby:`) called with the data and returning the new data.
         table:
           $ref: "#/components/schemas/TableOptions"
         flat:
@@ -808,11 +1014,156 @@ components:
           type: boolean
           description: >-
             Use ANSI colors and styles in terminal output and logs.
-            Default is auto-detected: enabled if both stdout and stderr are terminals and `TERM` is not `dumb`, or if `CLICOLOR_FORCE=1`.
+            Default is auto-detected: disabled if `NO_COLOR` is set or results are written to a file,
+            else enabled if `CLICOLOR_FORCE` is set and not `0`,
+            else enabled if both stdout and stderr are terminals, `TERM` is not `dumb` and `CLICOLOR` is not `0`.
         utf8:
           type: boolean
           description: >-
-            Use Unicode characters in terminal output (e.g. table borders, check marks).
-            Default is auto-detected: enabled if stdout is a terminal and the locale is UTF-8.
+            Use Unicode characters in terminal output (e.g. table borders, check marks, hidden secrets), else ASCII replacements.
+            Default is auto-detected: enabled if stdout is a terminal and the locale is UTF-8, or on Windows, the terminal renders Unicode (e.g. Windows Terminal, VS Code).
         img:
           $ref: "#/components/schemas/ImageOptions"
+    WebServerOptions:
+      type: object
+      description: >-
+        Address and TLS configuration for a local web server (`WebServerSimple`).
+        Used by commands that start an embedded HTTP(S) listener (`faspex5 gateway`,
+        `faspex5 postprocessing`, `aoc gateway`, `node emulator`, …).
+      properties:
+        url:
+          type: string
+          description: >-
+            Address and port the server listens on.
+            Use `https://` with `cert`/`key` for TLS.
+          default: http://localhost:8080
+        cert:
+          type: string
+          description: >-
+            Path to the TLS certificate file.
+            Accepted formats: PEM (`.pem`) or PKCS12 (`.p12` / `.pfx`).
+          example: /path/to/cert.pem
+        key:
+          type: string
+          description: >-
+            Path to the PEM private key file, or the PKCS12 passphrase when `cert` is a `.p12`/`.pfx` file.
+          example: /path/to/key.pem
+        chain:
+          type: string
+          description: Path to the PEM certificate chain file (appended as extra chain certificates).
+          example: /path/to/chain.pem
+    Faspex4GatewayOptions:
+      description: >-
+        Configuration for the Faspex 4 gateway emulator (`faspex5 gateway`, `aoc gateway`).
+        The command starts a local HTTP server that accepts Faspex 4 API calls and translates them
+        to Faspex 5 / AoC API calls.
+        Clients authenticate with HTTP Basic, as on Faspex 4, when `username` and `password` are set.
+        By default the server binds to loopback; use a routable address only when clients must reach
+        the host from outside: then `username` and `password` are required.
+      allOf:
+        - $ref: "#/components/schemas/WebServerOptions"
+        - type: object
+          # List properties solely to allow them under additionalProperties: false.
+          # Types and descriptions are already defined in WebServerOptions above.
+          additionalProperties: false
+          properties:
+            url: {}
+            cert: {}
+            key: {}
+            chain: {}
+            username:
+              type: string
+              description: >-
+                Username expected from clients in HTTP Basic authentication.
+                Set together with `password`.
+                When not set, requests are accepted without authentication.
+                Mandatory when `url` is not a loopback address (`localhost`, `127.0.0.0/8`, `::1`).
+              example: fx4_user
+            password:
+              type: string
+              description: >-
+                Password expected from clients in HTTP Basic authentication, for the above `username`.
+                Generate it with `openssl rand -hex 32`: a weak password is refused (see `password_min_bits`).
+              example: my_password
+            password_min_bits:
+              type: integer
+              minimum: 0
+              default: 80
+              description: >-
+                Minimum estimated strength of `password`, in bits (log2 of the number of guesses to find it).
+                The strength is estimated with gem `zxcvbn` if installed, else with a built-in estimate
+                that detects repeats, sequences, keyboard rows, words and years.
+                `0` disables the check.
+                A random password of 32 bytes (`openssl rand -hex 32`) is far above the default.
+    Faspex4PostProcOptions:
+      description: >-
+        Configuration for the Faspex 4-style post-processing webhook receiver (`faspex5 postprocessing`).
+        The command starts a local HTTP(S) server that Faspex 5 calls after each package upload.
+        It maps the URL path to a script under `script_folder` and executes it with the values of the
+        webhook JSON body whose key starts with `faspex_` as environment variables.
+        By default the server binds to loopback; use a routable address only when Faspex containers
+        must reach the host: then `secret_token` or `allowed_ips` is required.
+      allOf:
+        - $ref: "#/components/schemas/WebServerOptions"
+        - type: object
+          additionalProperties: false
+          properties:
+            # Listed solely to allow them under additionalProperties: false (defined in WebServerOptions).
+            url: {}
+            cert: {}
+            key: {}
+            chain: {}
+            script_folder:
+              type: string
+              description: >-
+                Folder containing the post-processing scripts.
+                The URL path (after the base path) is appended to this folder to locate the script to execute.
+              default: "."
+              example: /opt/faspex/scripts
+            fail_on_error:
+              type: boolean
+              description: >-
+                When `true`, return HTTP 500 if the script exits with a non-zero status code.
+                When `false` (default), the exit code is reported in the response body but HTTP 200 is returned.
+              default: false
+            timeout_seconds:
+              type: integer
+              minimum: 1
+              description: >-
+                Maximum time in seconds to wait for the script to complete before killing it.
+              default: 60
+            secret_token:
+              type: string
+              minLength: 1
+              description: >-
+                Shared secret for webhook authentication.
+                When set, every incoming request must include `?token=<value>` in the URL;
+                requests without the correct token are rejected with HTTP 401.
+                Configure the Faspex webhook URL as `http://host:port/path/script.sh?token=<value>`.
+                This parameter or `allowed_ips` is required when `url` is not a local address.
+                Generate it with `openssl rand -hex 32`: a weak token is refused (see `secret_token_min_bits`).
+            secret_token_min_bits:
+              type: integer
+              minimum: 0
+              default: 80
+              description: >-
+                Minimum estimated strength of `secret_token`, in bits (log2 of the number of guesses to find it).
+                The strength is estimated with gem `zxcvbn` if installed, else with a built-in estimate
+                that detects repeats, sequences, keyboard rows, words and years.
+                `0` disables the check.
+                A random token of 32 bytes (`openssl rand -hex 32`) is far above the default.
+            allowed_ips:
+              description: >-
+                IP address or network (CIDR, e.g. `10.89.0.0/24`), or list of them, allowed to call the listener.
+                Requests from any other source IP are rejected with HTTP 403.
+                When not set, no IP restriction is applied.
+                This parameter or `secret_token` is required when `url` is not a local address.
+              oneOf:
+                - type: string
+                  example: "192.168.1.10"
+                - type: array
+                  items:
+                    type: string
+                  example:
+                    - "192.168.1.10"
+                    - "10.89.0.0/24"

data/lib/aspera/cli/parser.rb

@@ -205,8 +205,9 @@ module Aspera
       # @param validation  [Class, Array, nil] Accepted value type(s) or list of Symbols
       # @param aliases     [Hash] map of aliases: key = alias, value = real value
       # @param default     [Object] default value
+      # @param raw         [Boolean] `true`: value is not evaluated as extended value
       # @return [Object, Array, nil] one value, list or nil (if optional and no default)
-      def get_next_argument(descr, mandatory: true, multiple: false, accept_list: nil, validation: Type::STRING, aliases: nil, default: nil, schema: nil)
+      def get_next_argument(descr, mandatory: true, multiple: false, accept_list: nil, validation: Type::STRING, aliases: nil, default: nil, schema: nil, raw: false)
         ensure_parsed
         Aspera.assert_array_all(accept_list, Symbol) unless accept_list.nil?
         Aspera.assert_hash_all(aliases, Symbol, Symbol) unless aliases.nil?
@@ -215,7 +216,7 @@ module Aspera
         Aspera.assert_array_all(validation, Class) { 'validation' } unless validation.nil?
         descr = "#{descr}#{add_types_info(validation)}"
         result =
-          if !@command_line.pending_arguments.empty? then read_arguments(descr, multiple: multiple, validation: validation, accept_list: accept_list, aliases: aliases)
+          if !@command_line.pending_arguments.empty? then read_arguments(descr, multiple: multiple, validation: validation, accept_list: accept_list, aliases: aliases, raw: raw)
           elsif !default.nil? then default
           elsif mandatory then get_interactive(descr, multiple: multiple, accept_list: accept_list, aliases: aliases, schema: schema)
           end
@@ -353,6 +354,14 @@ module Aspera
         values.include?(@command_line.pending_arguments.first)
       end
 
+      # Check the next pending positional arguments, without consuming them
+      # @param values [Array<String>] values to compare with, in order
+      # @return [Boolean] true if the next pending positional arguments are values
+      def next_arguments?(values)
+        ensure_parsed
+        @command_line.pending_arguments.first(values.length).eql?(values)
+      end
+
       # Check for unprocessed options or arguments error messages
       # @return [Array<String>] list of error messages for unprocessed tokens
       def final_errors
@@ -516,11 +525,11 @@ module Aspera
         " (#{types.map(&:name).join(', ')})"
       end
 
-      # Consume and evaluate positional arguments
+      # Consume positional arguments, and evaluate them unless `raw`
       # @return [Object, Array] one value, or list if `multiple`
-      def read_arguments(descr, multiple:, validation:, accept_list:, aliases:)
+      def read_arguments(descr, multiple:, validation:, accept_list:, aliases:, raw:)
         values = @command_line.shift_arguments(multiple)
-        values = values.map { |v| ExtendedValue.instance.evaluate(v, context: "argument: #{descr}", allowed: validation) }
+        values = values.map { |v| ExtendedValue.instance.evaluate(v, context: "argument: #{descr}", allowed: validation) } unless raw
         # If expecting list and only one arg of type array : it is the list
         values = values.first if multiple && values.length.eql?(1) && values.first.is_a?(Array)
         if accept_list

data/lib/aspera/cli/plugins/aoc.rb

@@ -6,6 +6,7 @@ require 'aspera/cli/plugins/node'
 require 'aspera/cli/plugins/ats'
 require 'aspera/cli/transfer_agent'
 require 'aspera/cli/special_values'
+require 'aspera/environment'
 require 'aspera/cli/wizard'
 require 'aspera/agent/node'
 require 'aspera/transfer/result'
@@ -198,6 +199,7 @@ module Aspera
             }
             preset_value[:password] = options.get_option(:password, mandatory: true) if pub_info['password_protected']
             return {
+              preset_ids:   [],
               preset_value: preset_value,
               test_args:    'organization'
             }
@@ -213,7 +215,7 @@ module Aspera
           private_key_path = wizard.ask_private_key(
             user: wiz_username,
             url: app_url,
-            page: '👤 → Account Settings → Profile → Public Key'
+            page: [Environment.char('👤'), 'Account Settings', 'Profile', 'Public Key']
           )
           client_id = options.get_option(:client_id)
           client_secret = options.get_option(:client_secret)
@@ -227,7 +229,7 @@ module Aspera
             else
               formatter.display_status('Using organization specific client_id.')
               formatter.display_status('Please login to your Aspera on Cloud instance.'.red)
-              formatter.display_status('Navigate to: 𓃑  → Admin → Integrations → API Clients')
+              wizard.display_navigation(Environment.char('𓃑'), 'Admin', 'Integrations', 'API Clients')
               formatter.display_status('Check or create in integration:')
               formatter.display_status('- name: cli')
               formatter.display_status("- redirect uri: #{REDIRECT_LOCALHOST}")
@@ -259,6 +261,7 @@ module Aspera
             aoc_api.update("clients/#{options.get_option(:client_id)}", {'jwt_grant_enabled' => true, 'explicit_authorization_required' => false})
           end
           return {
+            preset_ids:   [myself['email'], client_id].compact,
             preset_value: {
               url:           app_url,
               username:      myself['email'],
@@ -805,7 +808,7 @@ module Aspera
         end
         command :automation,        description: 'Manage automation (BETA)', setup: :setup_automation_api
         command :gateway,           description: 'Start AoC Faspex4 gateway',
-          arguments: [{name: :parameters, type: Hash, mandatory: false, default: {}}]
+          arguments: [{name: :parameters, type: Hash, mandatory: false, default: {}, schema: Schema::Registry::GATEWAY_OPTIONS}]
 
         # user sub-commands
         commands_under :user do
@@ -1050,8 +1053,7 @@ module Aspera
           end
           package_data['encryption_at_rest'] = true if transfer.user_transfer_spec['content_protection'].eql?('encrypt')
           created_package = aoc_api.create_package_simple(package_data, option_validate, new_user_option)
-          Runner.result_transfer(transfer.start(created_package[:spec], rest_token: created_package[:node]))
-          return Result::SingleObject.new(created_package[:info])
+          return Runner.result_object_transfer(created_package[:info], transfer.start(created_package[:spec], rest_token: created_package[:node]))
         end
 
         # packages > receive — package_id: from arguments:(:identifier) (or overridden by public_link)
@@ -1608,12 +1610,7 @@ module Aspera
 
         def action_gateway(parameters: {}, **)
           require 'aspera/faspex_gw'
-          parameters = parameters.symbolize_keys
-          uri = URI.parse(parameters.delete(:url) { WebServerSimple::DEFAULT_URL })
-          server = WebServerSimple.new(uri, **parameters.slice(*WebServerSimple::PARAMS))
-          Aspera.assert(parameters.except(*WebServerSimple::PARAMS).empty?) { "unexpected parameters: #{parameters.except(*WebServerSimple::PARAMS).keys}" }
-          server.mount(uri.path, Faspex4GWServlet, aoc_api, aoc_api.workspace_info[:id])
-          server.start
+          Faspex4GWServlet.serve(parameters.symbolize_keys, type: Cli::BadArgument) { [aoc_api, aoc_api.workspace_info[:id]] }
           return Result::Status.new('Gateway terminated')
         end
       end