aspera-cli 4.10.0 → 4.11.0

data/README.md

@@ -1,10 +1,13 @@
 # Command Line Interface for IBM Aspera products
+<!-- markdownlint-disable MD033 MD003 MD053 -->
 
 [comment1]: # (Do not edit this README.md, edit docs/README.erb.md, for details, read docs/README.md)
 
-Version : 4.10.0
+##
 
-Laurent/2016-2022
+Version : 4.11.0
+
+Laurent/2016-2023
 
 This gem provides the `ascli` Command Line Interface to IBM Aspera software.
 
@@ -14,9 +17,11 @@ Ruby Gem: [https://rubygems.org/gems/aspera-cli](https://rubygems.org/gems/asper
 
 Ruby Doc: [https://www.rubydoc.info/gems/aspera-cli](https://www.rubydoc.info/gems/aspera-cli)
 
-Minimum required Ruby version: >= 2.4. Deprecation notice: the minimum will be 2.7 in a future version.
+Minimum required Ruby version: >= 2.4.
+
+> **Deprecation notice**: the minimum Ruby version will be 2.7 in a future version.
 
-[Aspera APIs on IBM developer](https://developer.ibm.com/?size=30&q=aspera&DWContentType[0]=APIs)
+[Aspera APIs on IBM developer](https://developer.ibm.com/?size=30&q=aspera&DWContentType[0]=APIs&sort=title_asc)
 [Link 2](https://developer.ibm.com/apis/catalog/?search=aspera)
 
 Release notes: see [CHANGELOG.md](CHANGELOG.md)
@@ -46,7 +51,7 @@ So it is designed for:
 - A configuration file (config.yaml)
 - Advanced command line options
 - cURL (for REST calls)
-- Aspera transfer (ascp)
+- Aspera transfer (`ascp`)
 
 If the need is to perform operations programmatically in languages such as: C, Go, Python, nodejs, ... then it is better to directly use [Aspera APIs](https://ibm.biz/aspera_api)
 
@@ -63,7 +68,6 @@ In examples, command line operations are shown using a shell such: `bash` or `zs
 
 Command line parameters in examples beginning with `my_`, like `my_param_value` are user-provided value and not fixed value commands.
 
-
 ## Quick Start
 
 This section guides you from installation, first use and advanced use.
@@ -77,7 +81,7 @@ ascli --version
 ```
 
 ```bash
-4.10.0
+4.11.0
 ```
 
 ### First use
@@ -127,7 +131,7 @@ ascli config preset set default server myserver
 ```
 
 ```output
-updated: default&rarr;server to myserver
+updated: default &rarr; server to myserver
 ```
 
 ```bash
@@ -158,7 +162,7 @@ ascli server download /aspera-test-dir-large/200MB
 ```
 
 ```output
-Time: 00:00:02 ========================================================================================================== 100% 100 Mbps Time: 00:00:00
+Time: 00:00:02 =========================================================== 100% 100 Mbps Time: 00:00:00
 complete
 ```
 
@@ -174,9 +178,13 @@ It is possible to install *either* directly on the host operating system (Linux,
 
 The direct installation is recommended and consists in installing:
 
-- [Ruby](#ruby) (version: >= 2.4. Deprecation notice: the minimum will be 2.7 in a future version)
+- [Ruby](#ruby)
 - [aspera-cli](#the_gem)
-- [Aspera SDK (ascp)](#fasp_prot)
+- [Aspera SDK (`ascp`)](#fasp_prot)
+
+Ruby version: >= 2.4.
+
+> **Deprecation notice**: the minimum Ruby version will be 2.7 in a future version.
 
 The following sections provide information on the various installation methods.
 
@@ -184,33 +192,114 @@ An internet connection is required for the installation. If you don't have inter
 
 ### Docker container
 
-This method installs a docker image that contains: Ruby, `ascli` and the FASP SDK.
+The image is: [martinlaurent/ascli](https://hub.docker.com/r/martinlaurent/ascli).
+The container contains: Ruby, `ascli` and the Aspera Transfer SDK.
+To use the container, ensure that you have `docker` (or `podman`) installed.
 
-The image is: <https://hub.docker.com/r/martinlaurent/ascli>.
-It is built from this [Dockerfile](Dockerfile).
+```bash
+docker --version
+```
 
-Ensure that you have `docker` (or `podman`) installed.
+**Wanna start quickly ?** With an interactive shell ? Execute this:
 
 ```bash
-docker --version
+docker run --tty --interactive --entrypoint bash martinlaurent/ascli:latest
+```
+
+Then, execute individual `ascli` commands such as:
+
+```bash
+ascli conf init
+ascli conf preset overview
+ascli conf ascp info
+ascli server ls /
+```
+
+That is simple, but there are limitations:
+
+- Everything happens in the container
+- Any generated file in the container will be lost on container (shell) exit. Including configuration files and downloaded files.
+- No possibility to upload files located on the host system
+
+The container image is built from this [Dockerfile](Dockerfile): the entry point is `ascli` and the default command is `help`.
+
+The container can also be execute for individual commands like this: (add `ascli` commands and options at the end of the command line, e.g. `-v` to display the version)
+
+```bash
+docker run --rm --tty --interactive martinlaurent/ascli:latest
+```
+
+For more convenience, you may define a shell alias:
+
+```bash
+alias ascli='docker run --rm --tty --interactive martinlaurent/ascli:latest'
+```
+
+Then, you can execute the container like a local command:
+
+```bash
+ascli -v
+```
+
+```text
+4.11.0
+```
+
+In order to keep persistency of configuration on the host,
+you should mount your user's config folder to the container.
+To enable write access, a possibility is to run as `root` in the container (and set the default configuration folder to `/home/cliuser/.aspera/ascli`).
+Add options:
+
+```bash
+--user root --env ASCLI_HOME=/home/cliuser/.aspera/ascli --volume $HOME/.aspera/ascli:/home/cliuser/.aspera/ascli
+```
+
+> **Note:** if you are using a `podman machine`, e.g. on Macos , make sure that the folder is also shared between the VM and the host, so that sharing is: container &rarr; VM &rarr; Host: `podman machine init ... --volume="/Users:/Users"`
+
+As shown in the quick start, if you prefer to keep a running container with a shell and `ascli` available,
+you can change the entry point, add option:
+
+```bash
+--entrypoint bash
+```
+
+You may also probably want that files downloaded in the container are in fact placed on the host.
+In this case you need also to mount the shared transfer folder:
+
+```bash
+--volume $HOME/xferdir:/xferfiles
 ```
 
-Download the script [`dascli`](../examples/dascli) from [the GIT repo](https://raw.githubusercontent.com/IBM/aspera-cli/main/examples/dascli) :
+> **Note:** ascli is run inside the container, so transfers are also executed inside the container and do not have access to host storage by default.
 
-> If you have installed `ascli`, the script `dascli` can also be found: `cp $(ascli conf gem path)/../examples/dascli ascli`
+And if you want all the above, simply use all the options:
 
-Note that ascli is run inside the container, so transfers are also executed inside the container and do not have access to host storage by default.
+```bash
+alias asclish="docker run --rm --tty --interactive --user root --env ASCLI_HOME=/home/cliuser/.aspera/ascli --volume $HOME/.aspera/ascli:/home/cliuser/.aspera/ascli --volume $HOME/xferdir:/xferfiles --entrypoint bash martinlaurent/ascli:latest"
+```
+
+```bash
+export xferdir=$HOME/xferdir
+mkdir -p $xferdir
+chmod -R 777 $xferdir
+mkdir -p $HOME/.aspera/ascli
+asclish
+```
 
-Some environment variables can be set to alter the behaviour of the script:
+A convenience sample script is also provided: download the script [`dascli`](../examples/dascli) from [the GIT repo](https://raw.githubusercontent.com/IBM/aspera-cli/main/examples/dascli) :
 
-| env var     | description                        | default                  | example                  |
-|-------------|------------------------------------|--------------------------|--------------------------|
-| ASCLI__HOME  | configuration folder (persistency) | `$HOME/.aspera/ascli` | `$HOME/.ascliconfig`     |
-| docker_args | additional options to `docker`     | &lt;empty&gt;            | `--volume /Users:/Users` |
-| image       | container image name               | martinlaurent/ascli      |                          |
-| version     | container image version            | latest                   | `4.8.0.pre`              |
+> **Note:** If you have installed `ascli`, the script `dascli` can also be found: `cp $(ascli conf gem path)/../examples/dascli ascli`
 
-The wrapping script maps the folder `$ASCLI__HOME` on host to `/home/cliuser/.aspera/ascli` in the container.
+Some environment variables can be set for this script to adapt its behaviour:
+
+| env var      | description                        | default                  | example                  |
+|--------------|------------------------------------|--------------------------|--------------------------|
+| ASCLI_HOME | configuration folder (persistency) | `$HOME/.aspera/ascli` | `$HOME/.ascliconfig`     |
+| docker_args  | additional options to `docker`     | &lt;empty&gt;            | `--volume /Users:/Users` |
+| image        | container image name               | martinlaurent/ascli      |                          |
+| version      | container image version            | latest                   | `4.8.0.pre`              |
+
+The wrapping script maps the folder `$ASCLI_HOME` on host to `/home/cliuser/.aspera/ascli` in the container.
 (value expected in the container).
 This allows having persistent configuration on the host.
 
@@ -221,21 +310,18 @@ Example of use:
 ```bash
 curl -o ascli https://raw.githubusercontent.com/IBM/aspera-cli/main/examples/dascli
 chmod a+x ascli
-export ASCLI__HOME=$HOME/.ascliconf
-mkdir -p $ASCLI__HOME
-chmod -R 777 $ASCLI__HOME
 export xferdir=$HOME/xferdir
 mkdir -p $xferdir
 chmod -R 777 $xferdir
-export docker_args="--volume $xferdir:/xferfolder"
+export docker_args="--volume $xferdir:/xferfiles"
 
 ./ascli conf init
 
-touch $xferdir/samplefile
-./ascli server upload /xferfolder/samplefile --to-folder=/Upload
+echo 'Local file to transfer' > $xferdir/samplefile.txt
+./ascli server upload /xferfiles/samplefile.txt --to-folder=/Upload
 ```
 
-> The local file (`samplefile`) is specified relative to storage view from container (`/xferfolder`) mapped to the host folder `$HOME/xferdir`
+> **Note:** The local file (`samplefile.txt`) is specified relative to storage view from container (`/xferfiles`) mapped to the host folder `$HOME/xferdir`
 
 ### <a id="ruby"></a>Ruby
 
@@ -243,7 +329,9 @@ Use this method to install on the native host.
 
 A ruby interpreter is required to run the tool or to use the gem and tool.
 
-Required Ruby version: >= 2.4. Deprecation notice: the minimum will be 2.7 in a future version.
+Required Ruby version: >= 2.4.
+
+> **Deprecation notice**: the minimum Ruby version will be 2.7 in a future version.
 
 *Ruby can be installed using any method* : rpm, yum, dnf, rvm, brew, windows installer, ... .
 
@@ -251,7 +339,7 @@ Refer to the following sections for a proposed method for specific operating sys
 
 The recommended installation method is `rvm` for systems with "bash-like" shell (Linux, macOS, Windows with cygwin, etc...).
 If the generic install is not suitable (e.g. Windows, no cygwin), you can use one of OS-specific install method.
-If you have a simpler better way to install Ruby : use it ! (version: >= 2.4. Deprecation notice: the minimum will be 2.7 in a future version)
+If you have a simpler better way to install Ruby : use it !
 
 #### Generic: RVM: single user installation (not root)
 
@@ -318,7 +406,7 @@ Install Latest stable Ruby:
 - Download the latest Ruby installer **with devkit**. (Msys2 is needed to install some native extensions, such as `grpc`)
 - Execute the installer which installs by default in: `C:\RubyVV-x64` (VV is the version number)
 - At the end of the installation procedure, the Msys2 installer is automatically executed, select option 3 (msys and mingw)
-- for the installation of 
+
 #### macOS: pre-installed or `brew`
 
 macOS 10.13+ (High Sierra) comes with a recent Ruby. So you can use it directly. You will need to install aspera-cli using `sudo` :
@@ -337,15 +425,20 @@ brew install ruby
 
 If your Linux distribution provides a standard ruby package, you can use it provided that the version is compatible (check at beginning of section).
 
-Example: Centos 8 Stream
+Example: RHEL 8 and 9: basic installation
+
+```bash
+yum module install ruby:3.1
+```
+
+Example: RHEL 8, Centos 8 Stream: with extensions to compile native gems
 
 ```bash
 yum install make automake gcc gcc-c++ kernel-devel
 yum install redhat-rpm-config
 dnf module reset ruby
-dnf module enable ruby:3.0
-dnf module -y install ruby:3.0/common
-gem install aspera-cli
+dnf module enable ruby:3.1
+dnf module -y install ruby:3.1/common
 ```
 
 Other examples:
@@ -398,7 +491,7 @@ If you already have a Java JVM on your system (`java`), it is possible to use `j
 
 <https://www.jruby.org/download>
 
-Note that using jruby the startup time is longer than the native ruby, but transfer speed is not impacted (executed by `ascp` binary).
+> **Note:** Using jruby the startup time is longer than the native ruby, but the transfer speed is not impacted (executed by `ascp` binary).
 
 ### <a id="the_gem"></a>`aspera-cli` gem
 
@@ -427,7 +520,7 @@ ascli conf check_update
 Most file transfers will be done using the FASP protocol, using `ascp`.
 Only two additional files are required to perform an Aspera Transfer, which are part of Aspera SDK:
 
-- ascp
+- `ascp`
 - aspera-license (in same folder, or ../etc)
 
 This can be installed either be installing an Aspera transfer software, or using an embedded command:
@@ -467,7 +560,8 @@ Use of a local client ([`direct`](#agt_direct) transfer agent) is one of them, b
 
 ### <a id="offline_install"></a>Installation in air gapped environment
 
-Note that currently no pre-packaged version exist yet.
+> **Note:** no pre-packaged version is provided.
+
 A method to build one is provided here:
 
 The procedure:
@@ -528,7 +622,7 @@ The `aspera-cli` Gem provides a command line interface (CLI) which interacts wit
 - Supports most Aspera server products (on-premise and SaaS)
 - Any command line options (products URL, credentials or any option) can be provided on command line, in configuration file, in env var, in files
 - Supports Commands, Option values and Parameters shortcuts
-- FASP [Transfer Agents](#agents) can be: local ascp, or Connect Client, or any transfer node
+- FASP [Transfer Agents](#agents) can be: local `ascp`, or Connect Client, or any transfer node
 - Transfer parameters can be altered by modification of [*transfer-spec*](#transferspec), this includes requiring multi-session
 - Allows transfers from products to products, essentially at node level (using the node transfer agent)
 - Supports FaspStream creation (using Node API)
@@ -551,7 +645,7 @@ Not all `ascli` features are fully documented here, the user may explore command
 
 If you want to use `ascp` directly as a command line, refer to IBM Aspera documentation of either [Desktop Client](https://www.ibm.com/docs/en/asdc), [Endpoint](https://www.ibm.com/docs/en/ahte) or [Transfer Server](https://www.ibm.com/docs/en/ahts) where [a section on `ascp` can be found](https://www.ibm.com/docs/en/ahts/4.4?topic=linux-ascp-transferring-from-command-line).
 
-Using `ascli` with plugin `server` for command line gives advantages over ascp:
+Using `ascli` with plugin `server` for command line gives advantages over `ascp`:
 
 - automatic resume on error
 - configuration file
@@ -604,7 +698,8 @@ ERROR: Argument: unprocessed values: ["2", "3"]
 ```
 
 `config echo` displays the value of the first argument using Ruby syntax: it surrounds a string with `"` and add `\` before special characters.
-Note that it gets its value after shell command line parsing and `ascli` extended value parsing.
+
+> **Note:** It gets its value after shell command line parsing and `ascli` extended value parsing.
 
 In the following examples (using a POSIX shell, such as `bash`), several sample commands are provided when equivalent.
 For all example, most of special character handling is not specific to `ascli`: It depoends on the underlying syntax: shell , JSON, etc...
@@ -613,7 +708,7 @@ Depending on the case, a different `format` is used to display the actual value.
 For example, in the simple string `Hello World`, the space character is special for the shell, so it must be escaped so that a single value is represented.
 
 Double quotes are processed by the shell to create a single string argument.
-For POSIX shells, single quotes can also be used in this case, or protext the special character ` ` (space) with a backslash.
+For POSIX shells, single quotes can also be used in this case, or protext the special character ` ` (space) with a backslash. <!-- markdownlint-disable-line -->
 
 ```bash
 ascli conf echo "Hello World" --format=text
@@ -628,8 +723,9 @@ Hello World
 #### Using a shell variable, parsed by shell, in an extended value
 
 To be evaluated by shell, the shell variable must not be in single quotes.
-Note we use a simple variable here: the variable is not necessarily an environment variable.
-Even if the variable contains spaces it makes only one argument to `ascli` because word parsing is made before variable expansion by shell. 
+Even if the variable contains spaces it makes only one argument to `ascli` because word parsing is made before variable expansion by shell.
+
+> **Note:** we use a simple variable here: the variable is not necessarily an environment variable.
 
 ```bash
 MYVAR="Hello World"
@@ -787,7 +883,7 @@ ascli config echo -- --sample
 "--sample"
 ```
 
-Note that here, `--sample` is taken as an argument, and not as an option, due to `--`.
+> **Note:** Here, `--sample` is taken as an argument, and not as an option, due to `--`.
 
 Options can be optional or mandatory, with or without (hardcoded) default value. Options can be placed anywhere on command line and evaluated in order.
 
@@ -873,7 +969,7 @@ ascli aoc admin res user list --fields=name,email,ats_admin --query=@json:'{"sor
 :...............................:..................................:...........:
 ```
 
-Note that `select` filters selected elements from the result of API calls, while the `query` parameters gives filtering parameters to the API when listing elements.
+> **Note:** `select` filters selected elements from the result of API calls, while the `query` parameters gives filtering parameters to the API when listing elements.
 
 #### Verbosity of output
 
@@ -923,7 +1019,7 @@ The following "readers" are supported (returns value in []):
 - @path:PATH   : [String] performs path expansion (prefix `~/` is replaced with the users home folder), e.g. `--config-file=@path:~/sample_config.yml`
 - @env:ENVVAR  : [String] read from a named env var, e.g.--password=@env:MYPASSVAR
 - @stdin:      : [String] read from stdin (no value on right)
-- @preset:NAME : [Hash] get whole option preset value by name. Subvalues can also be used using `.` as separator. e.g. foo.bar is conf[foo][bar]
+- @preset:NAME : [Hash] get whole option preset value by name. Subvalues can also be used using `.` as separator. e.g. `foo.bar` is `conf[foo][bar]`
 
 In addition it is possible to decode a value, using one or multiple decoders :
 
@@ -985,7 +1081,7 @@ ascli config echo @incps:@json:'{"hello":true,"incps":["config"]}'
 {"version"=>"0.9", "hello"=>true}
 ```
 
-Note that `@incps:@json:'{"incps":["config"]}'` or `@incps:@ruby:'{"incps"=>["config"]}'` is equivalent to: `@preset:config`
+> **Note:** `@incps:@json:'{"incps":["config"]}'` or `@incps:@ruby:'{"incps"=>["config"]}'` are equivalent to: `@preset:config`
 
 ### <a id="native"></a>Structured Value
 
@@ -1097,6 +1193,8 @@ If necessary, the configuration file can opened in a text editor with:
 ascli config open
 ```
 
+> **Note:** this starts the editor specified by env var `EDITOR` if defined.
+
 Older format for commands are still supported:
 
 ```bash
@@ -1115,7 +1213,7 @@ This preset name is reserved and contains an array of key-value , where the key
 
 When a plugin is invoked, the preset associated with the name of the plugin is loaded, unless the option --no-default (or -N) is used.
 
-Note that special plugin name: `config` can be associated with a preset that is loaded initially, typically used for default values.
+> **Note:** Special plugin name: `config` can be associated with a preset that is loaded initially, typically used for default values.
 
 Operations on this preset are done using regular `config` operations:
 
@@ -1131,9 +1229,9 @@ ascli config preset get default _plugin_name_
 "_default_preset_for_plugin_"
 ```
 
-#### <a id="lplugconf"></a>Special Plugin: config
+#### <a id="config"></a>Plugin: `config`: CLI Configuration
 
-Plugin `config` (not to be confused with Option preset config) is used to configure `ascli` but it also contains global options.
+Plugin `config` is used to configure `ascli` and also contains global options.
 
 When `ascli` starts, it looks for the `default` Option preset and if there is a value for `config`, if so, it loads the option values for any plugin used.
 
@@ -1347,7 +1445,7 @@ The vault is used with options `vault` and `vault_password`.
 
 `vault_password` specifies the password for the vault.
 Although it can be specified on command line, for security reason you can hide the value.
-For example it can be specified on command line like this:
+For example it can be securely specified on command line like this:
 
 ```bash
 export ASCLI_VAULT_PASSWORD
@@ -1356,7 +1454,7 @@ read -s ASCLI_VAULT_PASSWORD
 
 #### Vault: System keychain
 
-> **macOS only**
+> **Note:** **macOS only**
 
 It is possible to manage secrets in macOS keychain (only read supported currently).
 
@@ -1372,7 +1470,7 @@ It is possible to store and use secrets encrypted in a file.
 --vault=@json:'{"type":"file","name":"vault.bin"}'
 ```
 
-`name` is the file path, absolute or relative to the config folder `ASCLI__HOME`.
+`name` is the file path, absolute or relative to the config folder `ASCLI_HOME`.
 
 #### Vault: Operations
 
@@ -1395,6 +1493,24 @@ When a secret is needed by a sub command, the command can search for existing co
 
 The lookup is done by comparing the service URL and username (or access key).
 
+#### Securing passwords and secrets
+
+A passwords can be saved in clear in a [option preset](#lprt) together with other account information (URL, username, etc...).
+Example:
+
+```bash
+`ascli` conf preset update myconf --url=... --username=... --password=...
+```
+
+For a more secure storage one can do:
+
+```bash
+`ascli` conf preset update myconf --url=... --username=... --password=@val:@vault:myconf.password
+`ascli` conf vault create myconf @json:'{"password":"__value_here__"}'
+```
+
+> **Note:** use `@val:` in front of `@vault:` so that the extended value is not evaluated.
+
 ### <a id="private_key"></a>Private Key
 
 Some applications allow the user to be authenticated using a private key (Server, AoC, Faspex5, ...).
@@ -1545,7 +1661,7 @@ Available loggers: `stdout`, `stderr`, `syslog`.
 
 Available levels: `debug`, `info`, `warn`, `error`.
 
-Note that when using the `direct` agent (`ascp`), additional transfer logs can be activated using `ascp` option `EX_ascp_args`, see [`direct`](#agt_direct).
+> **Note:** When using the `direct` agent (`ascp`), additional transfer logs can be activated using `ascp` option `EX_ascp_args`, see [`direct`](#agt_direct).
 
 Examples:
 
@@ -1625,7 +1741,7 @@ There are two possibilities to define an HTTP proxy to be used when Ruby HTTP is
 The `http_proxy` environment variable (**lower case**, preferred) can be set to the URL of the proxy, e.g. `http://myproxy.org.net:3128`.
 Refer to [Ruby findproxy](https://rubyapi.org/3.0/o/uri/generic#method-i-find_proxy).
 
-> Note: Ruby expects a URL and `myproxy.org.net:3128` alone is **not** accepted.
+> **Note:** Ruby expects a URL and `myproxy.org.net:3128` alone is **not** accepted.
 
 ```bash
 export http_proxy=http://proxy.example.com:3128
@@ -1689,7 +1805,7 @@ To specify a FASP proxy (forward), set the [*transfer-spec*](#transferspec) para
 
 The `config` plugin also allows specification for the use of a local FASP client. It provides the following commands for `ascp` subcommand:
 
-- `show` : shows the path of ascp used
+- `show` : shows the path of `ascp` used
 - `use` : list,download connect client versions available on internet
 - `products` : list Aspera transfer products available locally
 - `connect` : list,download connect client versions available on internet
@@ -1718,9 +1834,9 @@ ascli config ascp info
 
 #### Selection of `ascp` location for [`direct`](#agt_direct) agent
 
-By default, `ascli` uses any found local product with ascp, including SDK.
+By default, `ascli` uses any found local product with `ascp`, including SDK.
 
-To temporarily use an alternate ascp path use option `ascp_path` (`--ascp-path=`)
+To temporarily use an alternate `ascp` path use option `ascp_path` (`--ascp-path=`)
 
 For a permanent change, the command `config ascp use` sets the same parameter for the global default.
 
@@ -1771,11 +1887,11 @@ ascli config ascp products list
 
 #### Selection of local client for `ascp` for [`direct`](#agt_direct) agent
 
-If no ascp is selected, this is equivalent to using option: `--use-product=FIRST`.
+If no `ascp` is selected, this is equivalent to using option: `--use-product=FIRST`.
 
-Using the option use_product finds the ascp binary of the selected product.
+Using the option use_product finds the `ascp` binary of the selected product.
 
-To permanently use the ascp of a product:
+To permanently use the `ascp` of a product:
 
 ```bash
 ascli config ascp products use 'Aspera Connect'
@@ -1821,7 +1937,7 @@ ascli config ascp connect version 'Aspera Connect for Mac Intel' download enclos
 ```
 
 ```output
-Time: 00:00:02 ======================================================================= 100% 27766 KB/sec Time: 00:00:02
+Time: 00:00:02 =========================================================== 100% 27766 KB/sec Time: 00:00:02
 Downloaded: IBMAsperaConnectInstaller-3.11.2.63.dmg
 ```
 
@@ -1840,15 +1956,15 @@ There are currently 3 agents:
 - [`httpgw`](#agt_httpgw) : use of an Aspera HTTP Gateway
 - [`trsdk`](#agt_trsdk) : use of Aspera Transfer SDK
 
-Note that all transfer operation are seen from the point of view of the agent.
-For instance, a node agent making an "upload", or "package send" operation,
+> **Note:** All transfer operations are seen from the point of view of the agent.
+For example, a node agent executing an "upload", or "package send" operation
 will effectively push files to the related server from the agent node.
 
-`ascli` standardizes on the use of a [*transfer-spec*](#transferspec) instead of *raw* ascp options to provide parameters for a transfer session, as a common method for those three Transfer Agents.
+`ascli` standardizes on the use of a [*transfer-spec*](#transferspec) instead of *native* `ascp` options to provide parameters for a transfer session, as a common method for those three Transfer Agents.
 
 #### <a id="agt_direct"></a>Direct
 
-The `direct` agent directly executes a local ascp.
+The `direct` agent directly executes a local `ascp`.
 This is the default agent for `ascli`.
 This is equivalent to option `--transfer=direct`.
 `ascli` will detect locally installed Aspera products, including SDK, and use `ascp` from that component.
@@ -1856,18 +1972,17 @@ Refer to section [FASP](#client).
 
 The `transfer_info` option accepts the following optional parameters to control multi-session, Web Socket Session and Resume policy:
 
-<table>
-<tr><th>Name</th><th>Type</th><th>Description</th></tr>
-<tr><td>wss</td><td>Bool</td><td>Web Socket Session<br/>Enable use of web socket session in case it is available<br/>Default: false</td></tr>
-<tr><td>spawn_timeout_sec</td><td>Float</td><td>Multi session<br/>Verification time that ascp is running<br/>Default: 3</td></tr>
-<tr><td>spawn_delay_sec</td><td>Float</td><td>Multi session<br/>Delay between startup of sessions<br/>Default: 2</td></tr>
-<tr><td>multi_incr_udp</td><td>Bool</td><td>Multi Session<br/>Increment UDP port on multi-session<br/>If true, each session will have a different UDP port starting at `fasp_port` (or default 33001)<br/>Else, each session will use `fasp_port` (or `ascp` default)<br/>Default: true</td></tr>
-<tr><td>resume</td><td>Hash</td><td>Resume<br/>parameters<br/>See below</td></tr>
-<tr><td>resume.iter_max</td><td>int</td><td>Resume<br/>Max number of retry on error<br/>Default: 7</td></tr>
-<tr><td>resume.sleep_initial</td><td>int</td><td>Resume<br/>First Sleep before retry<br/>Default: 2</td></tr>
-<tr><td>resume.sleep_factor</td><td>int</td><td>Resume<br/>Multiplier of sleep period between attempts<br/>Default: 2</td></tr>
-<tr><td>resume.sleep_max</td><td>int</td><td>Resume<br/>Default: 60</td></tr>
-</table>
+| Name                 | Type  | Description |
+|----------------------|-------|-------------|
+| wss                  | Bool  | Web Socket Session<br/>Enable use of web socket session in case it is available<br/>Default: true |
+| spawn_timeout_sec    | Float | Multi session<br/>Verification time that `ascp` is running<br/>Default: 3 |
+| spawn_delay_sec      | Float | Multi session<br/>Delay between startup of sessions<br/>Default: 2 |
+| multi_incr_udp       | Bool  | Multi Session<br/>Increment UDP port on multi-session<br/>If true, each session will have a different UDP port starting at `fasp_port` (or default 33001)<br/>Else, each session will use `fasp_port` (or `ascp` default)<br/>Default: true |
+| resume               | Hash  | Resume<br/>parameters<br/>See below |
+| resume.iter_max      | int   | Resume<br/>Max number of retry on error<br/>Default: 7 |
+| resume.sleep_initial | int   | Resume<br/>First Sleep before retry<br/>Default: 2 |
+| resume.sleep_factor  | int   | Resume<br/>Multiplier of sleep period between attempts<br/>Default: 2 |
+| resume.sleep_max     | int   | Resume<br/>Default: 60 |
 
 In case of transfer interruption, the agent will **resume** a transfer up to `iter_max` time.
 Sleep between iterations is:
@@ -1890,15 +2005,15 @@ ascli ... --transfer-info=@json:'{"wss":true,"resume":{"iter_max":20}}'
 ascli ... --transfer-info=@json:'{"spawn_delay_sec":2.5,"multi_incr_udp":false}'
 ```
 
-Note that the `direct` agent supports additional `transfer_spec` parameters starting with `EX_` (extended).
+> **Note:** The `direct` agent supports additional `transfer_spec` parameters starting with `EX_` (extended).
 In particular the field, `EX_ascp_args` which is a list of additional command line options to `ascp`.
 
-This can be useful to activate logging using option `-L` of ascp.
+This can be useful to activate logging using option `-L` of `ascp`.
 For example the option `--ts=@json:'{"EX_ascp_args":["-DDL-"]}'` will activate debug level 2 for `ascp` (`DD`), and display those logs on the terminal (`-`).
 This is useful if the transfer fails.
-To store ascp logs in file `aspera-scp-transfer.log` in a folder, use `--ts=@json:'{"EX_ascp_args":["-L","/path/to/folder"]}'`.
+To store `ascp` logs in file `aspera-scp-transfer.log` in a folder, use `--ts=@json:'{"EX_ascp_args":["-L","/path/to/folder"]}'`.
 
-> Implementation note: when transfer agent [`direct`](#agt_direct) is used, the list of files to transfer is provided to `ascp` using either `--file-list` or `--file-pair-list` and a file list (or pair) file generated in a temporary folder. (unless `--file-list` or `--file-pair-list` is provided in option `ts` in `EX_ascp_args`).
+> **Note:** Implementation note: when transfer agent [`direct`](#agt_direct) is used, the list of files to transfer is provided to `ascp` using either `--file-list` or `--file-pair-list` and a file list (or pair) file generated in a temporary folder. (unless `--file-list` or `--file-pair-list` is provided in option `ts` in `EX_ascp_args`).
 
 In addition to standard methods described in section [File List](#file_list), it is possible to specify the list of file using those additional methods:
 
@@ -1914,11 +2029,22 @@ In addition to standard methods described in section [File List](#file_list), it
 --sources=@ts --ts=@json:'{"EX_ascp_args":["--file-list","myfilelist"]}'
 ```
 
-> File lists is shown here, there are also similar options for file pair lists.
+> **Note:** File lists is shown here, there are also similar options for file pair lists.
+>
+> **Note:** Those 2 additional methods avoid the creation of a copy of the file list: if the standard options `--sources=@lines:@file:... --src-type=...` are used, then the file is list read and parsed, and a new file list is created in a temporary folder.
+>
+> **Note:** Those methods have limitations: they apply **only** to the [`direct`](#agt_direct) transfer agent (i.e. local `ascp`) and not for Aspera on Cloud.
 
-> Those 2 additional methods avoid the creation of a copy of the file list: if the standard options `--sources=@lines:@file:... --src-type=...` are used, then the file is list read and parsed, and a new file list is created in a temporary folder.
+In addition to special transfer spec parameter `EX_ascp_args`, it is possible to provide the same `ascp` options using option `ascp_opts` of `ascli`.
+This option expects an `Array`, which can be conveniently provided with extended syntax `@list:`
+
+```bash
+ascli server download /aspera-test-dir-large/200MB --ascp-opts=@list:' -l 10m -k 3'
+```
 
-> Those methods have limitations: they apply **only** to the [`direct`](#agt_direct) transfer agent (i.e. local `ascp`) and not for Aspera on Cloud.
+> **Note:** Using `@list:`, the use of quotes and leading character "space" here is important: The `@list:` expects a single string which must not be parsed by the shell (so protected with quotes) and the leading space is the separator character.
+>
+> **Note:** The option `ascp_opts` are appended to `EX_ascp_args` if present.
 
 #### <a id="agt_connect"></a>IBM Aspera Connect Client GUI
 
@@ -1930,13 +2056,12 @@ By specifying option: `--transfer=node`, the CLI will start transfers in an Aspe
 Transfer Server using the Node API, either on a local or remote node.
 Parameters provided in option `transfer_info` are:
 
-<table>
-<tr><th>Name</th><th>Type</th><th>Description</th></tr>
-<tr><td>url</td><td>string</td><td>URL of the node API</br>Mandatory</td></tr>
-<tr><td>username</td><td>string</td><td>node api user or access key</br>Mandatory</td></tr>
-<tr><td>password</td><td>string</td><td>password, secret or bearer token</br>Mandatory</td></tr>
-<tr><td>root_id</td><td>string</td><td>password or secret</br>Mandatory only for bearer token</td></tr>
-</table>
+| Name | Type | Description |
+|------|------|-------------|
+| url | string | URL of the node API</br>Mandatory |
+| username | string | node api user or access key</br>Mandatory |
+| password | string | password, secret or bearer token</br>Mandatory |
+| root_id | string | password or secret</br>Mandatory only for bearer token |
 
 Like any other option, `transfer_info` can get its value from a pre-configured [option preset](#lprt) :
 `--transfer-info=@preset:<psetname>` or be specified using the extended value syntax :
@@ -1952,12 +2077,11 @@ If it possible to send using a HTTP gateway, in case FASP is not allowed.
 
 Parameters provided in option `transfer_info` are:
 
-<table>
-<tr><th>Name</th><th>Type</th><th>Description</th></tr>
-<tr><td>url</td><td>string</td><td>URL of the HTTP GW</br>Mandatory</td></tr>
-<tr><td>upload_bar_refresh_sec</td><td>float</td><td>Refresh rate for upload progress bar</td></tr>
-<tr><td>upload_chunksize</td><td>int</td><td>Size in bytes of chunks for upload</td></tr>
-</table>
+| Name | Type | Description |
+|------|------|-------------|
+| url | string | URL of the HTTP GW</br>Mandatory |
+| upload_bar_refresh_sec | float | Refresh rate for upload progress bar |
+| upload_chunksize | int | Size in bytes of chunks for upload |
 
 Example:
 
@@ -1965,7 +2089,7 @@ Example:
 ascli faspex package recv --id=323 --transfer=httpgw --transfer-info=@json:'{"url":"https://asperagw.example.com:9443/aspera/http-gwy/v1"}'
 ```
 
-> The gateway only supports transfers authorized with a token.
+> **Note:** The gateway only supports transfers authorized with a token.
 
 #### <a id="agt_trsdk"></a>Transfer SDK
 
@@ -2002,7 +2126,7 @@ is described in a [*transfer-spec*](#transferspec) (Transfer Specification), suc
 
 If needed, it is possible to modify or add any of the supported [*transfer-spec*](#transferspec) parameter using the `ts` option. The `ts` option accepts a [Structured Value](#native) containing one or several [*transfer-spec*](#transferspec) parameters. Multiple `ts` options on command line are cumulative.
 
-It is possible to specify ascp options when the `transfer` option is set to [`direct`](#agt_direct) using the special [*transfer-spec*](#transferspec) parameter: `EX_ascp_args`. Example: `--ts=@json:'{"EX_ascp_args":["-l","100m"]}'`. This is especially useful for ascp command line parameters not supported yet in the transfer spec.
+It is possible to specify `ascp` options when the `transfer` option is set to [`direct`](#agt_direct) using the special [*transfer-spec*](#transferspec) parameter: `EX_ascp_args`. Example: `--ts=@json:'{"EX_ascp_args":["-l","100m"]}'`. This is especially useful for `ascp` command line parameters not supported yet in the transfer spec.
 
 The use of a [*transfer-spec*](#transferspec) instead of `ascp` parameters has the advantage of:
 
@@ -2018,8 +2142,8 @@ All standard [*transfer-spec*](#transferspec) parameters can be specified.
 
 References:
 
-- [Aspera Node API Documentation](https://developer.ibm.com/apis/catalog?search=%22aspera%20node%20api%22)&rarr;/opt/transfers
-- [Aspera Transfer SDK Documentation](https://developer.ibm.com/apis/catalog?search=%22aspera%20transfer%20sdk%22)&rarr;Guides&rarr;API Ref&rarr;Transfer Spec V1
+- [Aspera Node API Documentation](https://developer.ibm.com/apis/catalog?search=%22aspera%20node%20api%22) &rarr; /opt/transfers
+- [Aspera Transfer SDK Documentation](https://developer.ibm.com/apis/catalog?search=%22aspera%20transfer%20sdk%22) &rarr; Guides &rarr; API Ref &rarr; Transfer Spec V1
 - [Aspera Connect SDK](https://d3gcli72yxqn2z.cloudfront.net/connect/v4/asperaweb-4.js) &rarr; search `The parameters for starting a transfer.`
 
 Parameters can be displayed with commands:
@@ -2039,91 +2163,91 @@ Columns:
 
 Fields with EX_ prefix are extensions to transfer agent [`direct`](#agt_direct). (only in `ascli`).
 
-<table><tr><th>Field</th><th>Type</th><th>D</th><th>N</th><th>C</th><th>Description</th></tr>
-<tr><td>EX_ascp_args</td><td>array</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Add native command line arguments to ascp</td></tr>
-<tr><td>EX_at_rest_password</td><td>string</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>DEPRECATED: Prefer to use standard parameter: content_protection_password<br/>(env:ASPERA_SCP_FILEPASS)</td></tr>
-<tr><td>EX_file_list</td><td>string</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>source file list</td></tr>
-<tr><td>EX_file_pair_list</td><td>string</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>source file pair list</td></tr>
-<tr><td>EX_http_proxy_url</td><td>string</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Specify the proxy server address used by HTTP Fallback<br/>(-x {string})</td></tr>
-<tr><td>EX_http_transfer_jpeg</td><td>int</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>HTTP transfers as JPEG file<br/>(-j {int})</td></tr>
-<tr><td>EX_license_text</td><td>string</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>License file text override.<br/>By default ascp looks for license file near executable.<br/>(env:ASPERA_SCP_LICENSE)</td></tr>
-<tr><td>EX_no_read</td><td>bool</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>no read source<br/>(--no-read)</td></tr>
-<tr><td>EX_no_write</td><td>bool</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>no write on destination<br/>(--no-write)</td></tr>
-<tr><td>EX_proxy_password</td><td>string</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Password used for Aspera proxy server authentication.<br/>May be overridden by password in URL EX_fasp_proxy_url.<br/>(env:ASPERA_PROXY_PASS)</td></tr>
-<tr><td>EX_ssh_key_paths</td><td>array</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Use public key authentication for SSH and specify the private key file paths<br/>(-i {array})</td></tr>
-<tr><td>apply_local_docroot</td><td>bool</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>(--apply-local-docroot)</td></tr>
-<tr><td>authentication</td><td>string</td><td>&nbsp;</td><td>&nbsp;</td><td>Y</td><td>value=token for SSH bypass keys, else password asked if not provided.</td></tr>
-<tr><td>cipher</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>In transit encryption type.<br/>Allowed values: none, aes-128, aes-192, aes-256, aes-128-cfb, aes-192-cfb, aes-256-cfb, aes-128-gcm, aes-192-gcm, aes-256-gcm<br/>(-c (conversion){enum})</td></tr>
-<tr><td>cipher_allowed</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>returned by node API. Valid literals include "aes-128" and "none".</td></tr>
-<tr><td>content_protection</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>Enable client-side encryption at rest. (CSEAR, content protection)<br/>Allowed values: encrypt, decrypt<br/>(--file-crypt {enum})</td></tr>
-<tr><td>content_protection_password</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>Specifies CSEAR password. (content protection)<br/>(env:ASPERA_SCP_FILEPASS)</td></tr>
-<tr><td>cookie</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>Metadata for transfer specified by application<br/>(env:ASPERA_SCP_COOKIE)</td></tr>
-<tr><td>create_dir</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>Specifies whether to create new directories.<br/>(-d)</td></tr>
-<tr><td>delete_before_transfer</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>Before transfer, delete files that exist at the destination but not at the source.<br/>The source and destination arguments must be directories that have matching names.<br/>Objects on the destination that have the same name but different type or size as objects<br/>on the source are not deleted.<br/>(--delete-before-transfer)</td></tr>
-<tr><td>delete_source</td><td>bool</td><td>Y</td><td>Y</td><td>&nbsp;</td><td>Remove SRC files after transfer success<br/>(--remove-after-transfer)</td></tr>
-<tr><td>destination_root</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>Destination root directory.</td></tr>
-<tr><td>dgram_size</td><td>int</td><td>Y</td><td>Y</td><td>Y</td><td>UDP datagram size in bytes<br/>(-Z {int})</td></tr>
-<tr><td>direction</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>Direction of transfer (on client side)<br/>Allowed values: send, receive<br/>(--mode (conversion){enum})</td></tr>
-<tr><td>exclude_newer_than</td><td>int</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>skip src files with mtime > arg<br/>(--exclude-newer-than {int})</td></tr>
-<tr><td>exclude_older_than</td><td>int</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>skip src files with mtime < arg<br/>(--exclude-older-than {int})</td></tr>
-<tr><td>fasp_port</td><td>int</td><td>Y</td><td>Y</td><td>Y</td><td>Specifies fasp (UDP) port.<br/>(-O {int})</td></tr>
-<tr><td>file_checksum</td><td>string</td><td>Y</td><td>Y</td><td>&nbsp;</td><td>Enable checksum reporting for transferred files by specifying the hash to use.<br/>Allowed values: sha-512, sha-384, sha-256, sha1, md5, none</td></tr>
-<tr><td>http_fallback</td><td>bool<br/>string</td><td>Y</td><td>Y</td><td>Y</td><td>When true(1), attempts to perform an HTTP transfer if a FASP transfer cannot be performed.<br/>(-y (conversion){bool}|{string})</td></tr>
-<tr><td>http_fallback_port</td><td>int</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Specifies http port when no cipher is used<br/>(-t {int})</td></tr>
-<tr><td>https_fallback_port</td><td>int</td><td>Y</td><td>Y</td><td>Y</td><td>Specifies https port when cipher is used<br/>(-t {int})</td></tr>
-<tr><td>lock_min_rate</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>&nbsp;</td></tr>
-<tr><td>lock_min_rate_kbps</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>&nbsp;</td></tr>
-<tr><td>lock_rate_policy</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>&nbsp;</td></tr>
-<tr><td>lock_target_rate</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>&nbsp;</td></tr>
-<tr><td>lock_target_rate_kbps</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>&nbsp;</td></tr>
-<tr><td>min_rate_cap_kbps</td><td>int</td><td>Y</td><td>Y</td><td>Y</td><td>&nbsp;</td></tr>
-<tr><td>min_rate_kbps</td><td>int</td><td>Y</td><td>Y</td><td>Y</td><td>Set the minimum transfer rate in kilobits per second.<br/>(-m {int})</td></tr>
-<tr><td>move_after_transfer</td><td>string</td><td>Y</td><td>Y</td><td>&nbsp;</td><td>The relative path to which the files will be moved after the transfer at the source side. Available as of 3.8.0.<br/>(--move-after-transfer {string})</td></tr>
-<tr><td>multi_session</td><td>int</td><td>Y</td><td>Y</td><td>Y</td><td>Use multi-session transfer. max 128.<br/>Each participant on one host needs an independent UDP (-O) port.<br/>Large files are split between sessions only when transferring with resume_policy=none.<br/></td></tr>
-<tr><td>multi_session_threshold</td><td>int</td><td>Y</td><td>Y</td><td>&nbsp;</td><td>Split files across multiple ascp sessions if their size in bytes is greater than or equal to the specified value.<br/>(0=no file is split)<br/>(--multi-session-threshold {int})</td></tr>
-<tr><td>overwrite</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>Overwrite destination files with the source files of the same name.<br/>Allowed values: never, always, diff, older, diff+older<br/>(--overwrite {enum})</td></tr>
-<tr><td>password</td><td>string</td><td>&nbsp;</td><td>Y</td><td>&nbsp;</td><td>Password for local Windows user when transfer user associated with node api user is not the same as the one running asperanoded.<br/>Allows impersonating the transfer user and have access to resources (e.g. network shares).<br/>Windows only, node api only.</td></tr>
-<tr><td>paths</td><td>array</td><td>Y</td><td>Y</td><td>Y</td><td>Array of path to the source (required) and a path to the destination (optional).</td></tr>
-<tr><td>precalculate_job_size</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>Specifies whether to precalculate the job size.<br/>(--precalculate-job-size)</td></tr>
-<tr><td>preserve_access_time</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>(--preserve-access-time)</td></tr>
-<tr><td>preserve_acls</td><td>string</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Preserve access control lists.<br/>Allowed values: none, native, metafile<br/>(--preserve-acls {enum})</td></tr>
-<tr><td>preserve_creation_time</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>(--preserve-creation-time)</td></tr>
-<tr><td>preserve_file_owner_gid</td><td>bool</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Preserve the group ID for a file owner<br/>(--preserve-file-owner-gid)</td></tr>
-<tr><td>preserve_file_owner_uid</td><td>bool</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Preserve the user ID for a file owner<br/>(--preserve-file-owner-uid)</td></tr>
-<tr><td>preserve_modification_time</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>(--preserve-modification-time)</td></tr>
-<tr><td>preserve_remote_acls</td><td>string</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Preserve remote access control lists.<br/>Allowed values: none, native, metafile<br/>(--remote-preserve-acls {enum})</td></tr>
-<tr><td>preserve_source_access_time</td><td>bool</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Preserve the time logged for when the source file was accessed<br/>(--preserve-source-access-time)</td></tr>
-<tr><td>preserve_times</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>(--preserve-times)</td></tr>
-<tr><td>proxy</td><td>string</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Specify the address of the Aspera high-speed proxy server.<br/>dnat(s)://[user[:password]@]server:port<br/>Default ports for DNAT and DNATS protocols are 9091 and 9092.<br/>Password, if specified here, overrides the value of environment variable ASPERA_PROXY_PASS.<br/>(--proxy {string})</td></tr>
-<tr><td>rate_policy</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>The transfer rate policy to use when sharing bandwidth.<br/>Allowed values: low, fair, high, fixed<br/>(--policy {enum})</td></tr>
-<tr><td>rate_policy_allowed</td><td>string</td><td>&nbsp;</td><td>&nbsp;</td><td>Y</td><td>Specifies most aggressive rate policy that is allowed.<br/>Returned by node API.<br/>Allowed values: low, fair, high, fixed</td></tr>
-<tr><td>remote_host</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>IP or fully qualified domain name of the remote server<br/>(--host {string})</td></tr>
-<tr><td>remote_password</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>SSH session password<br/>(env:ASPERA_SCP_PASS)</td></tr>
-<tr><td>remote_user</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>Remote user. Default value is "xfer" on node or connect.<br/>(--user {string})</td></tr>
-<tr><td>remove_after_transfer</td><td>bool</td><td>Y</td><td>Y</td><td>&nbsp;</td><td>Remove SRC files after transfer success<br/>(--remove-after-transfer)</td></tr>
-<tr><td>remove_empty_directories</td><td>bool</td><td>Y</td><td>Y</td><td>&nbsp;</td><td>Specifies whether to remove empty directories.<br/>(--remove-empty-directories)</td></tr>
-<tr><td>remove_empty_source_directory</td><td>bool</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Remove empty source subdirectories and remove the source directory itself, if empty<br/>(--remove-empty-source-directory)</td></tr>
-<tr><td>remove_skipped</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>Must also have remove_after_transfer set to true, Defaults to false, if true, skipped files will be removed as well.<br/>(--remove-skipped)</td></tr>
-<tr><td>resume_policy</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>If a transfer is interrupted or fails to finish, resume without re-transferring the whole files.<br/>Allowed values: none, attrs, sparse_csum, full_csum<br/>(-k (conversion){enum})</td></tr>
-<tr><td>retry_duration</td><td>string<br/>int</td><td>&nbsp;</td><td>Y</td><td>Y</td><td>Specifies how long to wait before retrying transfer. (e.g. "5min")</td></tr>
-<tr><td>source_root</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>Path to be prepended to each source path.<br/>This is either a conventional path or it can be a URI but only if there is no root defined.<br/>(--source-prefix64 (conversion){string})</td></tr>
-<tr><td>source_root_id</td><td>string</td><td>&nbsp;</td><td>Y</td><td>&nbsp;</td><td>The file ID of the source root directory. Required when using Bearer token auth for the source node.</td></tr>
-<tr><td>src_base</td><td>string</td><td>Y</td><td>Y</td><td>&nbsp;</td><td>Specify the prefix to be stripped off from each source object.<br/>The remaining portion of the source path is kept intact at the destination.<br/>Special care must be taken when used with cloud storage.<br/>(--src-base64 (conversion){string})</td></tr>
-<tr><td>ssh_port</td><td>int</td><td>Y</td><td>Y</td><td>Y</td><td>Specifies SSH (TCP) port. Default: local:22, other:33001<br/>(-P {int})</td></tr>
-<tr><td>ssh_private_key</td><td>string</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>Private key used for SSH authentication.<br/>Shall look like: -----BEGIN RSA PRIV4TE KEY-----\nMII...<br/>Note the JSON encoding: \n for newlines.<br/>(env:ASPERA_SCP_KEY)</td></tr>
-<tr><td>ssh_private_key_passphrase</td><td>string</td><td>Y</td><td>&nbsp;</td><td>&nbsp;</td><td>The passphrase associated with the transfer user's SSH private key. Available as of 3.7.2.<br/>(env:ASPERA_SCP_PASS)</td></tr>
-<tr><td>sshfp</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>Check it against server SSH host key fingerprint<br/>(--check-sshfp {string})</td></tr>
-<tr><td>symlink_policy</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>Handle source side symbolic links<br/>Allowed values: follow, copy, copy+force, skip<br/>(--symbolic-links {enum})</td></tr>
-<tr><td>tags</td><td>hash</td><td>Y</td><td>Y</td><td>Y</td><td>Metadata for transfer as JSON<br/>(--tags64 (conversion){hash})</td></tr>
-<tr><td>target_rate_cap_kbps</td><td>int</td><td>&nbsp;</td><td>&nbsp;</td><td>Y</td><td>Returned by upload/download_setup node API.</td></tr>
-<tr><td>target_rate_kbps</td><td>int</td><td>Y</td><td>Y</td><td>Y</td><td>Specifies desired speed for the transfer.<br/>(-l {int})</td></tr>
-<tr><td>target_rate_percentage</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>&nbsp;</td></tr>
-<tr><td>title</td><td>string</td><td>&nbsp;</td><td>Y</td><td>Y</td><td>Title of the transfer</td></tr>
-<tr><td>token</td><td>string</td><td>Y</td><td>Y</td><td>Y</td><td>Authorization token: Bearer, Basic or ATM (Also arg -W)<br/>(env:ASPERA_SCP_TOKEN)</td></tr>
-<tr><td>use_ascp4</td><td>bool</td><td>Y</td><td>Y</td><td>&nbsp;</td><td>specify version of protocol</td></tr>
-<tr><td>wss_enabled</td><td>bool</td><td>Y</td><td>Y</td><td>Y</td><td>&nbsp;</td></tr>
-<tr><td>wss_port</td><td>int</td><td>Y</td><td>Y</td><td>Y</td><td>TCP port used for websocket service feed.</td></tr>
-</table>
+| Field | Type | D | N | C | Description |
+|-------|------|---|---|---|-------------|
+| EX_ascp_args | array | Y | &nbsp; | &nbsp; | Add native command line arguments to ascp |
+| EX_at_rest_password | string | Y | &nbsp; | &nbsp; | DEPRECATED: Prefer to use standard parameter: content_protection_password<br/>(env:ASPERA_SCP_FILEPASS) |
+| EX_file_list | string | Y | &nbsp; | &nbsp; | source file list |
+| EX_file_pair_list | string | Y | &nbsp; | &nbsp; | source file pair list |
+| EX_http_proxy_url | string | Y | &nbsp; | &nbsp; | Specify the proxy server address used by HTTP Fallback<br/>(-x {string}) |
+| EX_http_transfer_jpeg | int | Y | &nbsp; | &nbsp; | HTTP transfers as JPEG file<br/>(-j {int}) |
+| EX_license_text | string | Y | &nbsp; | &nbsp; | License file text override.<br/>By default ascp looks for license file near executable.<br/>(env:ASPERA_SCP_LICENSE) |
+| EX_no_read | bool | Y | &nbsp; | &nbsp; | no read source<br/>(--no-read) |
+| EX_no_write | bool | Y | &nbsp; | &nbsp; | no write on destination<br/>(--no-write) |
+| EX_proxy_password | string | Y | &nbsp; | &nbsp; | Password used for Aspera proxy server authentication.<br/>May be overridden by password in URL EX_fasp_proxy_url.<br/>(env:ASPERA_PROXY_PASS) |
+| EX_ssh_key_paths | array | Y | &nbsp; | &nbsp; | Use public key authentication for SSH and specify the private key file paths<br/>(-i {array}) |
+| apply_local_docroot | bool | Y | &nbsp; | &nbsp; | (--apply-local-docroot) |
+| authentication | string | &nbsp; | &nbsp; | Y | value=token for SSH bypass keys, else password asked if not provided. |
+| cipher | string | Y | Y | Y | In transit encryption type.<br/>Allowed values: none, aes-128, aes-192, aes-256, aes-128-cfb, aes-192-cfb, aes-256-cfb, aes-128-gcm, aes-192-gcm, aes-256-gcm<br/>(-c (conversion){enum}) |
+| cipher_allowed | string | Y | Y | Y | returned by node API. Valid literals include "aes-128" and "none". |
+| content_protection | string | Y | Y | Y | Enable client-side encryption at rest. (CSEAR, content protection)<br/>Allowed values: encrypt, decrypt<br/>(--file-crypt {enum}) |
+| content_protection_password | string | Y | Y | Y | Specifies CSEAR password. (content protection)<br/>(env:ASPERA_SCP_FILEPASS) |
+| cookie | string | Y | Y | Y | Metadata for transfer specified by application<br/>(env:ASPERA_SCP_COOKIE) |
+| create_dir | bool | Y | Y | Y | Specifies whether to create new directories.<br/>(-d) |
+| delete_before_transfer | bool | Y | Y | Y | Before transfer, delete files that exist at the destination but not at the source.<br/>The source and destination arguments must be directories that have matching names.<br/>Objects on the destination that have the same name but different type or size as objects<br/>on the source are not deleted.<br/>(--delete-before-transfer) |
+| delete_source | bool | Y | Y | &nbsp; | Remove SRC files after transfer success<br/>(--remove-after-transfer) |
+| destination_root | string | Y | Y | Y | Destination root directory. |
+| dgram_size | int | Y | Y | Y | UDP datagram size in bytes<br/>(-Z {int}) |
+| direction | string | Y | Y | Y | Direction of transfer (on client side)<br/>Allowed values: send, receive<br/>(--mode (conversion){enum}) |
+| exclude_newer_than | int | Y | &nbsp; | &nbsp; | skip src files with mtime > arg<br/>(--exclude-newer-than {int}) |
+| exclude_older_than | int | Y | &nbsp; | &nbsp; | skip src files with mtime < arg<br/>(--exclude-older-than {int}) |
+| fasp_port | int | Y | Y | Y | Specifies fasp (UDP) port.<br/>(-O {int}) |
+| file_checksum | string | Y | Y | &nbsp; | Enable checksum reporting for transferred files by specifying the hash to use.<br/>Allowed values: sha-512, sha-384, sha-256, sha1, md5, none |
+| http_fallback | bool<br/>string | Y | Y | Y | When true(1), attempts to perform an HTTP transfer if a FASP transfer cannot be performed.<br/>(-y (conversion){bool}|{string}) |
+| http_fallback_port | int | Y | &nbsp; | &nbsp; | Specifies http port when no cipher is used<br/>(-t {int}) |
+| https_fallback_port | int | Y | Y | Y | Specifies https port when cipher is used<br/>(-t {int}) |
+| lock_min_rate | bool | Y | Y | Y | &nbsp; |
+| lock_min_rate_kbps | bool | Y | Y | Y | &nbsp; |
+| lock_rate_policy | bool | Y | Y | Y | &nbsp; |
+| lock_target_rate | bool | Y | Y | Y | &nbsp; |
+| lock_target_rate_kbps | bool | Y | Y | Y | &nbsp; |
+| min_rate_cap_kbps | int | Y | Y | Y | &nbsp; |
+| min_rate_kbps | int | Y | Y | Y | Set the minimum transfer rate in kilobits per second.<br/>(-m {int}) |
+| move_after_transfer | string | Y | Y | &nbsp; | The relative path to which the files will be moved after the transfer at the source side. Available as of 3.8.0.<br/>(--move-after-transfer {string}) |
+| multi_session | int | Y | Y | Y | Use multi-session transfer. max 128.<br/>Each participant on one host needs an independent UDP (-O) port.<br/>Large files are split between sessions only when transferring with resume_policy=none.<br/> |
+| multi_session_threshold | int | Y | Y | &nbsp; | Split files across multiple ascp sessions if their size in bytes is greater than or equal to the specified value.<br/>(0=no file is split)<br/>(--multi-session-threshold {int}) |
+| overwrite | string | Y | Y | Y | Overwrite destination files with the source files of the same name.<br/>Allowed values: never, always, diff, older, diff+older<br/>(--overwrite {enum}) |
+| password | string | &nbsp; | Y | &nbsp; | Password for local Windows user when transfer user associated with node api user is not the same as the one running asperanoded.<br/>Allows impersonating the transfer user and have access to resources (e.g. network shares).<br/>Windows only, node api only. |
+| paths | array | Y | Y | Y | Array of path to the source (required) and a path to the destination (optional). |
+| precalculate_job_size | bool | Y | Y | Y | Specifies whether to precalculate the job size.<br/>(--precalculate-job-size) |
+| preserve_access_time | bool | Y | Y | Y | (--preserve-access-time) |
+| preserve_acls | string | Y | &nbsp; | &nbsp; | Preserve access control lists.<br/>Allowed values: none, native, metafile<br/>(--preserve-acls {enum}) |
+| preserve_creation_time | bool | Y | Y | Y | (--preserve-creation-time) |
+| preserve_file_owner_gid | bool | Y | &nbsp; | &nbsp; | Preserve the group ID for a file owner<br/>(--preserve-file-owner-gid) |
+| preserve_file_owner_uid | bool | Y | &nbsp; | &nbsp; | Preserve the user ID for a file owner<br/>(--preserve-file-owner-uid) |
+| preserve_modification_time | bool | Y | Y | Y | (--preserve-modification-time) |
+| preserve_remote_acls | string | Y | &nbsp; | &nbsp; | Preserve remote access control lists.<br/>Allowed values: none, native, metafile<br/>(--remote-preserve-acls {enum}) |
+| preserve_source_access_time | bool | Y | &nbsp; | &nbsp; | Preserve the time logged for when the source file was accessed<br/>(--preserve-source-access-time) |
+| preserve_times | bool | Y | Y | Y | (--preserve-times) |
+| proxy | string | Y | &nbsp; | &nbsp; | Specify the address of the Aspera high-speed proxy server.<br/>dnat(s)://[user[:password]@]server:port<br/>Default ports for DNAT and DNATS protocols are 9091 and 9092.<br/>Password, if specified here, overrides the value of environment variable ASPERA_PROXY_PASS.<br/>(--proxy {string}) |
+| rate_policy | string | Y | Y | Y | The transfer rate policy to use when sharing bandwidth.<br/>Allowed values: low, fair, high, fixed<br/>(--policy {enum}) |
+| rate_policy_allowed | string | &nbsp; | &nbsp; | Y | Specifies most aggressive rate policy that is allowed.<br/>Returned by node API.<br/>Allowed values: low, fair, high, fixed |
+| remote_host | string | Y | Y | Y | IP or fully qualified domain name of the remote server<br/>(--host {string}) |
+| remote_password | string | Y | Y | Y | SSH session password<br/>(env:ASPERA_SCP_PASS) |
+| remote_user | string | Y | Y | Y | Remote user. Default value is "xfer" on node or connect.<br/>(--user {string}) |
+| remove_after_transfer | bool | Y | Y | &nbsp; | Remove SRC files after transfer success<br/>(--remove-after-transfer) |
+| remove_empty_directories | bool | Y | Y | &nbsp; | Specifies whether to remove empty directories.<br/>(--remove-empty-directories) |
+| remove_empty_source_directory | bool | Y | &nbsp; | &nbsp; | Remove empty source subdirectories and remove the source directory itself, if empty<br/>(--remove-empty-source-directory) |
+| remove_skipped | bool | Y | Y | Y | Must also have remove_after_transfer set to true, Defaults to false, if true, skipped files will be removed as well.<br/>(--remove-skipped) |
+| resume_policy | string | Y | Y | Y | If a transfer is interrupted or fails to finish, resume without re-transferring the whole files.<br/>Allowed values: none, attrs, sparse_csum, full_csum<br/>(-k (conversion){enum}) |
+| retry_duration | string<br/>int | &nbsp; | Y | Y | Specifies how long to wait before retrying transfer. (e.g. "5min") |
+| source_root | string | Y | Y | Y | Path to be prepended to each source path.<br/>This is either a conventional path or it can be a URI but only if there is no root defined.<br/>(--source-prefix64 (conversion){string}) |
+| source_root_id | string | &nbsp; | Y | &nbsp; | The file ID of the source root directory. Required when using Bearer token auth for the source node. |
+| src_base | string | Y | Y | &nbsp; | Specify the prefix to be stripped off from each source object.<br/>The remaining portion of the source path is kept intact at the destination.<br/>Special care must be taken when used with cloud storage.<br/>(--src-base64 (conversion){string}) |
+| ssh_port | int | Y | Y | Y | Specifies SSH (TCP) port. Default: local:22, other:33001<br/>(-P {int}) |
+| ssh_private_key | string | Y | &nbsp; | &nbsp; | Private key used for SSH authentication.<br/>Shall look like: -----BEGIN RSA PRIV4TE KEY-----&sol;nMII...<br/>Note the JSON encoding: &sol;n for newlines.<br/>(env:ASPERA_SCP_KEY) |
+| ssh_private_key_passphrase | string | Y | &nbsp; | &nbsp; | The passphrase associated with the transfer user's SSH private key. Available as of 3.7.2.<br/>(env:ASPERA_SCP_PASS) |
+| sshfp | string | Y | Y | Y | Check it against server SSH host key fingerprint<br/>(--check-sshfp {string}) |
+| symlink_policy | string | Y | Y | Y | Handle source side symbolic links<br/>Allowed values: follow, copy, copy+force, skip<br/>(--symbolic-links {enum}) |
+| tags | hash | Y | Y | Y | Metadata for transfer as JSON<br/>(--tags64 (conversion){hash}) |
+| target_rate_cap_kbps | int | &nbsp; | &nbsp; | Y | Returned by upload/download_setup node API. |
+| target_rate_kbps | int | Y | Y | Y | Specifies desired speed for the transfer.<br/>(-l {int}) |
+| target_rate_percentage | string | Y | Y | Y | &nbsp; |
+| title | string | &nbsp; | Y | Y | Title of the transfer |
+| token | string | Y | Y | Y | Authorization token: Bearer, Basic or ATM (Also arg -W)<br/>(env:ASPERA_SCP_TOKEN) |
+| use_ascp4 | bool | Y | Y | &nbsp; | specify version of protocol |
+| wss_enabled | bool | Y | Y | Y | &nbsp; |
+| wss_port | int | Y | Y | Y | TCP port used for websocket service feed. |
 
 #### Destination folder for transfers
 
@@ -2167,7 +2291,7 @@ So, by default, the list of files to transfer will be simply specified on the co
 
 - an [Extended Value](#extended) with type **Array of String**
 
-  > Note: extended values can be tested with the command `conf echo`
+  > **Note:** extended values can be tested with the command `conf echo`
 
   Examples:
 
@@ -2215,7 +2339,7 @@ Examples:
 
 The option `src_type` allows specifying if the list specified in option `sources` is a simple file list or if it is a file pair list.
 
-> Note: Option `src_type` is not used if option `sources` is set to `@ts`
+> **Note:** Option `src_type` is not used if option `sources` is set to `@ts`
 
 Supported values for `src_type` are:
 
@@ -2228,11 +2352,11 @@ Example: Source file `200KB.1` is renamed `sample1` on destination:
 ascli server upload --src-type=pair ~/Documents/Samples/200KB.1 /Upload/sample1
 ```
 
-> Note there are some specific rules to specify file list when using "Aspera on Cloud", refer to the AoC plugin section.
+> **Note:** There are some specific rules to specify a file list when using **Aspera on Cloud**, refer to the AoC plugin section.
 
 #### <a id="multisession"></a>Support of multi-session
 
-Multi session, i.e. starting a transfer of a file set using multiple sessions (one ascp process per session) is supported on "direct" and "node" agents, not yet on connect.
+Multi session, i.e. starting a transfer of a file set using multiple sessions (one `ascp` process per session) is supported on "direct" and "node" agents, not yet on connect.
 
 - when agent=node :
 
@@ -2271,7 +2395,7 @@ Example: parameter to download a faspex package and decrypt on the fly
 --ts=@json:'{"content_protection":"decrypt","content_protection_password":"_pass_here_"}'
 ```
 
-Note that up to version 4.6.0, the following parameters should be used for agent `direct`:
+> **Note:** Up to version `ascli` 4.6.0, the following parameters should be used for agent `direct`:
 
 ```javascript
 --ts=@json:'{"EX_ascp_args":["--file-crypt=decrypt"],"EX_at_rest_password":"_secret_here_"}'
@@ -2303,9 +2427,13 @@ Note that up to version 4.6.0, the following parameters should be used for agent
 --ts=@json:'{"precalculate_job_size":true}'
 ```
 
-### <a id="scheduling"></a>Lock for exclusive execution
+### <a id="scheduling"></a>Scheduling
+
+It is useful to configure automated scheduled execution.
+
+#### <a id="locking"></a>Locking for exclusive execution
 
-In some conditions, it may be desirable to ensure that `ascli` is not executed several times in parallel.
+It is also useful to ensure that `ascli` is not executed several times in parallel.
 
 For instance when `ascli` is executed automatically on a schedule basis, one generally desire that a new execution is not started if a previous execution is still running because an on-going operation may last longer than the scheduling period:
 
@@ -2339,6 +2467,18 @@ The first instance will sleep 30 seconds, the second one will immediately exit l
 WARN -- : Another instance is already running (Address already in use - bind(2) for "127.0.0.1" port 12345).
 ```
 
+#### <a id="scheduler"></a>Scheduler
+
+`ascli` does not provide an internal scheduler.
+
+Instead, use the service provided by the Operating system:
+
+- Windows: [Task Scheduler](https://docs.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page)
+- Linux/Unix: [cron](https://www.man7.org/linux/man-pages/man5/crontab.5.html)
+- etc...
+
+Linux also provides `anacron`, if tasks are hourly or daily.
+
 ### "Proven&ccedil;ale"
 
 `ascp`, the underlying executable implementing Aspera file transfer using FASP, has a capability to not only access the local file system (using system's `open`,`read`,`write`,`close` primitives), but also to do the same operations on other data storage such as S3, Hadoop and others. This mechanism is call *PVCL*. Several *PVCL* adapters are available, some are embedded in `ascp`
@@ -2465,7 +2605,7 @@ ascli server upload "faux:///mydir?file=testfile&count=1m&size=0&inc=2&seq=seque
 ```text
 ascli -h
 NAME
-        ascli -- a command line tool for Aspera Applications (v4.10.0)
+        ascli -- a command line tool for Aspera Applications (v4.11.0)
 
 SYNOPSIS
         ascli COMMANDS [OPTIONS] [ARGS]
@@ -2515,7 +2655,6 @@ OPTIONS: global
         --log-level=ENUM             Log level: debug, info, [warn], error, fatal, unknown
         --logger=ENUM                log method: [stderr], stdout, syslog
         --lock-port=VALUE            prevent dual execution of a command, e.g. in cron
-        --query=VALUE                additional filter for API calls (extended value) (some commands)
         --http-options=VALUE         options for http socket (extended value)
         --insecure=ENUM              do not validate HTTPS certificate: no, [yes]
         --once-only=ENUM             process only new items (some commands): [no], yes
@@ -2523,8 +2662,9 @@ OPTIONS: global
         --cache-tokens=ENUM          save and reuse Oauth tokens: no, [yes]
 
 COMMAND: config
-SUBCOMMANDS: list overview id preset open documentation genkey gem plugin flush_tokens echo wizard export_to_cli detect coffee ascp email_test smtp_settings proxy_check folder file check_update initdemo vault
+SUBCOMMANDS: ascp check_update coffee detect documentation echo email_test export_to_cli file flush_tokens folder gem genkey id initdemo list lookup open overview plugin preset proxy_check secure smtp_settings vault wizard
 OPTIONS:
+        --query=VALUE                additional filter for API calls (extended value) (some commands)
         --value=VALUE                extended value for create, update, list filter
         --property=VALUE             name of property to set
         --id=VALUE                   resource identifier (modify,delete,show)
@@ -2552,18 +2692,18 @@ OPTIONS:
         --notif-template=VALUE       Email ERB template for notification of transfers
         --version-check-days=VALUE   Period in days to check new version (zero to disable)
         --plugin-folder=VALUE        Folder where to find additional plugins
-        --ts=VALUE                   override transfer spec values (Hash, use @json: prefix), current={"create_dir"=>true}
-        --local-resume=VALUE         set resume policy (Hash, use @json: prefix), current=
-        --to-folder=VALUE            destination folder for transfered files
-        --sources=VALUE              how list of transfered files is provided (@args,@ts,Array)
-        --src-type=ENUM              type of file list: list, pair
-        --transfer=ENUM              type of transfer agent: direct, node, connect, httpgw, trsdk
-        --transfer-info=VALUE        parameters for transfer agent
-        --progress=ENUM              type of progress bar: none, native, multi
+        --ts=VALUE                   Override transfer spec values (Hash, e.g. use @json: prefix), current={"create_dir"=>true}
+        --to-folder=VALUE            Destination folder for transfered files
+        --sources=VALUE              How list of transfered files is provided (@args,@ts,Array)
+        --ascp-opts=VALUE            Options for ascp in its native format
+        --src-type=ENUM              Type of file list: list, pair
+        --transfer=ENUM              Type of transfer agent: direct, node, connect, httpgw, trsdk
+        --transfer-info=VALUE        Parameters for transfer agent
+        --progress=ENUM              Type of progress bar: none, native, multi
 
 
 COMMAND: shares
-SUBCOMMANDS: health repository admin
+SUBCOMMANDS: admin health repository
 OPTIONS:
         --url=VALUE                  URL of application, e.g. https://org.asperafiles.com
         --username=VALUE             username to log in
@@ -2571,7 +2711,7 @@ OPTIONS:
 
 
 COMMAND: node
-SUBCOMMANDS: postprocess stream transfer cleanup forward access_key watch_folder service async sync central asperabrowser basic_token browse upload download api_details health events space info license mkdir mklink mkfile rename delete search
+SUBCOMMANDS: access_key api_details asperabrowser async basic_token browse central delete download events health info license mkdir mkfile mklink rename search service space stream sync transfer upload watch_folder
 OPTIONS:
         --url=VALUE                  URL of application, e.g. https://org.asperafiles.com
         --username=VALUE             username to log in
@@ -2579,11 +2719,13 @@ OPTIONS:
         --validator=VALUE            identifier of validator (optional for central)
         --asperabrowserurl=VALUE     URL for simple aspera web ui
         --sync-name=VALUE            sync name
+        --path=VALUE                 file or folder path for gen4 operation "file"
         --token-type=ENUM            Type of token used for transfers: aspera, basic, hybrid
+        --default-ports=ENUM         use standard FASP ports or get from node api (gen4): [no], yes
 
 
 COMMAND: orchestrator
-SUBCOMMANDS: health info workflow plugins processes
+SUBCOMMANDS: health info plugins processes workflow
 OPTIONS:
         --url=VALUE                  URL of application, e.g. https://org.asperafiles.com
         --username=VALUE             username to log in
@@ -2612,7 +2754,7 @@ OPTIONS:
 
 
 COMMAND: ats
-SUBCOMMANDS: cluster access_key api_key aws_trust_policy
+SUBCOMMANDS: access_key api_key aws_trust_policy cluster
 OPTIONS:
         --ibm-api-key=VALUE          IBM API key, see https://cloud.ibm.com/iam/apikeys
         --instance=VALUE             ATS instance in ibm cloud
@@ -2624,7 +2766,7 @@ OPTIONS:
 
 
 COMMAND: faspex5
-SUBCOMMANDS: health version user bearer_token package admin
+SUBCOMMANDS: admin bearer_token health package user version
 OPTIONS:
         --url=VALUE                  URL of application, e.g. https://org.asperafiles.com
         --username=VALUE             username to log in
@@ -2632,7 +2774,7 @@ OPTIONS:
         --client-id=VALUE            OAuth client identifier
         --client-secret=VALUE        OAuth client secret
         --redirect-uri=VALUE         OAuth redirect URI for web authentication
-        --auth=ENUM                  OAuth type of authentication: web, jwt, boot
+        --auth=ENUM                  OAuth type of authentication: boot, web, jwt
         --private-key=VALUE          OAuth JWT RSA private key PEM value (prefix file path with @file:)
         --passphrase=VALUE           RSA private key passphrase
 
@@ -2650,7 +2792,7 @@ OPTIONS:
 
 
 COMMAND: faspex
-SUBCOMMANDS: health package source me dropbox v4 address_book login_methods
+SUBCOMMANDS: address_book dropbox health login_methods me package source v4
 OPTIONS:
         --url=VALUE                  URL of application, e.g. https://org.asperafiles.com
         --username=VALUE             username to log in
@@ -2664,7 +2806,7 @@ OPTIONS:
 
 
 COMMAND: preview
-SUBCOMMANDS: scan events trevents check test
+SUBCOMMANDS: check events scan test trevents
 OPTIONS:
         --url=VALUE                  URL of application, e.g. https://org.asperafiles.com
         --username=VALUE             username to log in
@@ -2699,14 +2841,14 @@ OPTIONS:
 
 
 COMMAND: sync
-SUBCOMMANDS: start admin
+SUBCOMMANDS: admin start
 OPTIONS:
-        --parameters=VALUE           extended value for session set definition
-        --session-name=VALUE         name of session to use for admin commands, by default first one
+        --sync-info=VALUE            Information for sync instance and sessions (Hash)
+        --sync-session=VALUE         Name of session to use for admin commands. default: first in parameters
 
 
 COMMAND: aoc
-SUBCOMMANDS: reminder servers bearer_token organization tier_restrictions user packages files admin automation gateway
+SUBCOMMANDS: admin automation bearer_token files gateway organization packages reminder servers tier_restrictions user
 OPTIONS:
         --url=VALUE                  URL of application, e.g. https://org.asperafiles.com
         --username=VALUE             username to log in
@@ -2717,20 +2859,28 @@ OPTIONS:
         --client-secret=VALUE        OAuth API client passcode
         --redirect-uri=VALUE         OAuth API client redirect URI
         --private-key=VALUE          OAuth JWT RSA private key PEM value (prefix file path with @file:)
-        --passphrase=VALUE           RSA private key passphrase
-        --workspace=VALUE            name of workspace
-        --name=VALUE                 resource name
-        --path=VALUE                 file or folder path
-        --link=VALUE                 public link to shared resource
-        --new-user-option=VALUE      new user creation option for unknown package recipients
-        --from-folder=VALUE          share to share source folder
         --scope=VALUE                OAuth scope for AoC API calls
-        --default-ports=ENUM         use standard FASP ports or get from node api: [no], yes
-        --validate-metadata=ENUM     validate shared inbox metadata: [no], yes
+        --passphrase=VALUE           RSA private key passphrase
+        --workspace=VALUE            Name of workspace
+        --name=VALUE                 Resource name (prefer to use keyword name)
+        --link=VALUE                 Public link to shared resource
+        --new-user-option=VALUE      New user creation option for unknown package recipients
+        --from-folder=VALUE          Source folder for Folder-to-Folder transfer
+        --validate-metadata=ENUM     Validate shared inbox metadata: [no], yes
+
+COMMAND: node
+SUBCOMMANDS: access_key api_details asperabrowser async basic_token browse central delete download events health info license mkdir mkfile mklink rename search service space stream sync transfer upload watch_folder
+OPTIONS:
+        --validator=VALUE            identifier of validator (optional for central)
+        --asperabrowserurl=VALUE     URL for simple aspera web ui
+        --sync-name=VALUE            sync name
+        --path=VALUE                 file or folder path for gen4 operation "file"
+        --token-type=ENUM            Type of token used for transfers: aspera, basic, hybrid
+        --default-ports=ENUM         use standard FASP ports or get from node api (gen4): [no], yes
 
 
 COMMAND: server
-SUBCOMMANDS: health download upload browse delete rename ls rm mv du info mkdir cp df md5sum
+SUBCOMMANDS: browse cp delete df download du health info ls md5sum mkdir mv rename rm sync upload
 OPTIONS:
         --url=VALUE                  URL of application, e.g. https://org.asperafiles.com
         --username=VALUE             username to log in
@@ -2740,7 +2890,7 @@ OPTIONS:
 
 
 COMMAND: console
-SUBCOMMANDS: transfer health
+SUBCOMMANDS: health transfer
 OPTIONS:
         --url=VALUE                  URL of application, e.g. https://org.asperafiles.com
         --username=VALUE             username to log in
@@ -2751,7 +2901,7 @@ OPTIONS:
 
 ```
 
-Note that actions and parameter values can be written in short form.
+> **Note:** commands and parameter values can be written in short form.
 
 ### Bulk creation and deletion of resources
 
@@ -2759,7 +2909,7 @@ Bulk creation and deletion of resources are possible using option `bulk` (yes,no
 In that case, the operation expects an Array of Hash instead of a simple Hash using the [Extended Value Syntax](#extended).
 This option is available only for some of the resources: if you need it: try and see if the entities you try to create or delete support this option.
 
-## <a id="aoc"></a>Plugin: Aspera on Cloud
+## <a id="aoc"></a>Plugin: `aoc`: IBM Aspera on Cloud
 
 Aspera on Cloud uses the more advanced Oauth v2 mechanism for authentication (HTTP Basic authentication is not supported).
 
@@ -2802,7 +2952,7 @@ ascli config wizard --value=aoc
 
 ### <a id="aocmanual"></a>Configuration: using manual setup
 
-> If you used the wizard (recommended): skip this section.
+> **Note:** If you used the wizard (recommended): skip this section.
 
 #### Configuration details
 
@@ -2826,12 +2976,12 @@ If you use the built-in client_id and client_secret, skip this and do not set th
 
 Else you can use a specific OAuth API client_id, the first step is to declare `ascli` in Aspera on Cloud using the admin interface.
 
-(official documentation: <https://ibmaspera.com/help/admin/organization/registering_an_api_client> ).
+([AoC documentation: Registering an API Client](https://ibmaspera.com/help/admin/organization/registering_an_api_client) ).
 
 Let's start by a registration with web based authentication (auth=web):
 
 - Open a web browser, log to your instance: e.g. `https://myorg.ibmaspera.com/`
-- Go to Apps&rarr;Admin&rarr;Organization&rarr;Integrations
+- Go to Apps &rarr; Admin &rarr; Organization &rarr; Integrations
 - Click "Create New"
   - Client Name: `ascli`
   - Redirect URIs: `http://localhost:12345`
@@ -2882,7 +3032,7 @@ If you are not using the built-in client_id and secret, JWT needs to be authoriz
 - Graphically
 
   - Open a web browser, log to your instance: `https://myorg.ibmaspera.com/`
-  - Go to Apps&rarr;Admin&rarr;Organization&rarr;Integrations
+  - Go to Apps &rarr; Admin &rarr; Organization &rarr; Integrations
   - Click on the previously created application
   - select tab : "JSON Web Token Auth"
   - Modify options if necessary, for instance: activate both options in section "Settings"
@@ -3055,7 +3205,7 @@ ascli aoc admin res user list --query=@json:'{"member_of_any_workspace":false,"s
 
 Refer to the AoC API for full list of query parameters, or use the browser in developer mode with the web UI.
 
-Note the option `select` can also be used to further refine selection, refer to [section earlier](#option_select).
+> **Note:** The option `select` can also be used to further refine selection, refer to [section earlier](#option_select).
 
 #### <a id="res_select"></a>Selecting a resource
 
@@ -3111,7 +3261,7 @@ If the command returns an error, example:
 
 Well, remove the offending parameters and try again.
 
-Note that some properties that are shown in the web UI, such as membership, are not listed directly in the resource, but instead another resource is created to link a user and its group: `group_membership`
+> **Note:** Some properties that are shown in the web UI, such as membership, are not listed directly in the resource, but instead another resource is created to link a user and its group: `group_membership`
 
 #### Access Key secrets
 
@@ -3167,7 +3317,7 @@ Options:
 - `query` filter (on API call)
 - `notify` send an email as specified by template, this could be places in a file with the `@file` modifier.
 
-Note this must not be executed in less than 5 minutes because the analytics interface accepts only a period of time between 5 minutes and 6 months. The period is [date of previous execution]..[now].
+> **Note:** This must not be executed in less than 5 minutes because the analytics interface accepts only a period of time between 5 minutes and 6 months. The period is [date of previous execution]..[now].
 
 #### Transfer: Using specific transfer ports
 
@@ -3489,7 +3639,8 @@ AoC nodes as actually composed with two related entities:
 
 The web UI allows creation of both entities in one shot.
 For more flexibility, `ascli` allows this in two separate steps.
-Note that when selecting "Use existing access key" in the web UI, this actually skips access key creation (first step).
+
+> **Note:** When selecting "Use existing access key" in the web UI, this actually skips access key creation (first step).
 
 So, for example, the creation of a node using ATS in IBM Cloud looks like (see other example in this manual):
 
@@ -3503,7 +3654,7 @@ So, for example, the creation of a node using ATS in IBM Cloud looks like (see o
 
   Once executed, the access key `id` and `secret`, randomly generated by the node api, is displayed.
   
-  > Note: Once returned by the API, the secret will not be available anymore, so store this preciously. ATS secrets can only be reset by asking to IBM support.
+  > **Note:** Once returned by the API, the secret will not be available anymore, so store this preciously. ATS secrets can only be reset by asking to IBM support.
 
 - Create the AoC node entity
 
@@ -3523,9 +3674,10 @@ Creation of a node with a self-managed node is similar, but the command `aoc adm
 
 ### List of files to transfer
 
-Source files are provided as a list with the `sources` option. Refer to section [File list](#file_list)
+Source files are provided as a list with the `sources` option.
+Refer to section [File list](#file_list)
 
-Note the special case when the source files are located on "Aspera on Cloud" (i.e. using access keys and the `file id` API).
+> **Note:** A special case is when the source files are located on **Aspera on Cloud** (i.e. using access keys and the `file id` API).
 
 Source files are located on "Aspera on cloud", when :
 
@@ -3644,19 +3796,28 @@ ascli aoc packages recv --id=ALL --once-only=yes --lock-port=12345
 - `--once-only=yes` keeps memory of any downloaded package in persistency files located in the configuration folder
 - `--lock-port=12345` ensures that only one instance is started at the same time, to avoid running two downloads in parallel
 
-Typically, one would execute this command on a regular basis, using the method of your choice:
-
-- Windows: [Task Scheduler](https://docs.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page)
-- Linux/Unix: [cron](https://www.man7.org/linux/man-pages/man5/crontab.5.html)
-- etc...
+Typically, one would execute this command on a regular basis, using the method of your choice: see [Scheduler](#scheduler).
 
 ### Files
 
-Folder sharing app.
+The Files application presents a **Home** folder to users in a given workspace.
+Files located here are either user's files, or shared folders.
 
 #### Download Files
 
-Download of files is straightforward using command: `aoc files download`
+The general download command is:
+
+```bash
+ascli aoc files download <source folder path> <source filename 1> ...
+```
+
+I.e. the first argument is the source folder, and the following arguments are the source file names in this folder.
+
+If a single file or folder is to be downloaded, then a single argument can be provided.
+
+```bash
+ascli aoc files download <single file path>
+```
 
 #### Shared folders
 
@@ -3774,18 +3935,17 @@ cat my_file_list.txt | ascli aoc admin res node --name='my node name' --secret='
 ### AoC sample commands
 
 ```bash
-aoc -N remind --username=my_aoc_user_email
-aoc -N servers
 aoc admin analytics transfers --query=@json:'{"status":"completed","direction":"receive"}' --notif-to=my_recipient_email --notif-template=@ruby:'%Q{From: <%=from_name%> <<%=from_email%>>\nTo: <<%=to%>>\nSubject: <%=ev["files_completed"]%> files received\n\n<%=ev.to_yaml%>}'
 aoc admin ats access_key create --cloud=aws --region=my_aws_bucket_region --params=@json:'{"id":"ak_aws","name":"my test key AWS","storage":{"type":"aws_s3","bucket":"my_aws_bucket_name","credentials":{"access_key_id":"my_aws_bucket_key","secret_access_key":"my_aws_bucket_secret"},"path":"/"}}'
-aoc admin ats access_key create --cloud=softlayer --region=my_icos_bucket_region --params=@json:'{"id":"akibmcloud","secret":"somesecret","name":"my test key","storage":{"type":"ibm-s3","bucket":"my_icos_bucket_name","credentials":{"access_key_id":"my_icos_bucket_key","secret_access_key":"my_icos_bucket_secret"},"path":"/"}}'
-aoc admin ats access_key delete akibmcloud
+aoc admin ats access_key create --cloud=softlayer --region=my_icos_bucket_region --params=@json:'{"id":"ak1ibmcloud","secret":"somesecret","name":"my test key","storage":{"type":"ibm-s3","bucket":"my_icos_bucket_name","credentials":{"access_key_id":"my_icos_bucket_key","secret_access_key":"my_icos_bucket_secret"},"path":"/"}}'
+aoc admin ats access_key delete ak1ibmcloud
 aoc admin ats access_key list --fields=name,id
-aoc admin ats access_key node akibmcloud --secret=somesecret browse /
+aoc admin ats access_key node ak1ibmcloud --secret=somesecret browse /
 aoc admin ats cluster clouds
 aoc admin ats cluster list
 aoc admin ats cluster show --cloud=aws --region=eu-west-1
 aoc admin ats cluster show 1f412ae7-869a-445c-9c05-02ad16813be2
+aoc admin auth_providers list
 aoc admin res application list
 aoc admin res client list
 aoc admin res client_access_key list
@@ -3806,14 +3966,15 @@ aoc admin res self show
 aoc admin res short_link list
 aoc admin res user list
 aoc admin res workspace_membership list
-aoc admin resource node --name=my_aoc_ak_name --secret=my_aoc_ak_secret v3 access_key create --value=@json:'{"id":"testsub1","storage":{"path":"/folder1"}}'
-aoc admin resource node --name=my_aoc_ak_name --secret=my_aoc_ak_secret v3 events
-aoc admin resource node --name=my_aoc_ak_name --secret=my_aoc_ak_secret v4 browse /
-aoc admin resource node --name=my_aoc_ak_name --secret=my_aoc_ak_secret v4 delete /folder1
-aoc admin resource node --name=my_aoc_ak_name --secret=my_aoc_ak_secret v4 mkdir /folder1
-aoc admin resource node v3 name my_aoc_ak_name --secret=my_aoc_ak_secret access_key delete testsub1
+aoc admin resource node --name=my_aoc_ak_name --secret=my_aoc_ak_secret do browse /
+aoc admin resource node --name=my_aoc_ak_name --secret=my_aoc_ak_secret do delete /folder1
+aoc admin resource node --name=my_aoc_ak_name --secret=my_aoc_ak_secret do mkdir /folder1
+aoc admin resource node --name=my_aoc_ak_name --secret=my_aoc_ak_secret do v3 access_key create --value=@json:'{"id":"testsub1","storage":{"path":"/folder1"}}'
+aoc admin resource node --name=my_aoc_ak_name --secret=my_aoc_ak_secret do v3 events
+aoc admin resource node do name my_aoc_ak_name --secret=my_aoc_ak_secret v3 access_key delete testsub1
 aoc admin resource workspace list
 aoc admin resource workspace_membership list --fields=ALL --query=@json:'{"page":1,"per_page":50,"embed":"member","inherited":false,"workspace_id":11363,"sort":"name"}'
+aoc admin subscription
 aoc automation workflow action my_wf_id create --value=@json:'{"name":"toto"}'
 aoc automation workflow create --value=@json:'{"name":"test_workflow"}'
 aoc automation workflow delete my_wf_id
@@ -3825,10 +3986,11 @@ aoc faspex
 aoc files bearer /
 aoc files bearer_token_node / --cache-tokens=no
 aoc files browse /
-aoc files browse / -N --link=my_aoc_publink_folder
+aoc files browse / --link=my_aoc_publink_folder
 aoc files delete /testsrc
 aoc files download --transfer=connect /200KB.1
-aoc files file permission --path=/ascli_test list
+aoc files file modify --path=my_aoc_test_folder
+aoc files file permission --path=my_aoc_test_folder list
 aoc files file show --path=/200KB.1
 aoc files file show my_file_id
 aoc files find / --value='\.partial$'
@@ -3838,12 +4000,14 @@ aoc files rename /somefolder testdst
 aoc files short_link create --to-folder=/testdst --value=private
 aoc files short_link create --to-folder=/testdst --value=public
 aoc files short_link list --value=@json:'{"purpose":"shared_folder_auth_link"}'
+aoc files sync admin status --to-folder=/testdst --sync-info=@json:'{"sessions":[{"name":"s2","direction":"pull","local_dir":"syncdir","reset":true}]}'
+aoc files sync start --to-folder=/testdst --sync-info=@json:'{"sessions":[{"name":"s2","direction":"pull","local_dir":"syncdir","reset":true}]}'
 aoc files transfer --from-folder=/testsrc --to-folder=/testdst testfile.bin
+aoc files upload --to-folder=/ testfile.bin --link=my_aoc_publink_folder
 aoc files upload --to-folder=/testsrc testfile.bin
-aoc files upload -N --to-folder=/ testfile.bin --link=my_aoc_publink_folder
 aoc files upload Test.pdf --transfer=node --transfer-info=@json:@stdin:
 aoc files v3 info
-aoc org -N --link=my_aoc_publink_recv_from_aocuser
+aoc org --link=my_aoc_publink_recv_from_aocuser
 aoc organization
 aoc packages browse "my_package_id" /contents
 aoc packages list
@@ -3852,19 +4016,21 @@ aoc packages recv "my_package_id" --to-folder=.
 aoc packages recv ALL --to-folder=. --once-only=yes --lock-port=12345
 aoc packages send --value=@json:'{"name":"Important files delivery","recipients":["my_email_external_user"]}' --new-user-option=@json:'{"package_contact":true}' testfile.bin
 aoc packages send --value=@json:'{"name":"Important files delivery","recipients":["my_email_internal_user"],"note":"my note"}' testfile.bin
+aoc packages send --value=@json:'{"name":"Important files delivery"}' testfile.bin --link=my_aoc_publink_send_aoc_user --password=my_aoc_publink_send_use_pass
+aoc packages send --value=@json:'{"name":"Important files delivery"}' testfile.bin --link=my_aoc_publink_send_shd_inbox
 aoc packages send --workspace="my_aoc_shbx_ws" --value=@json:'{"name":"Important files delivery","recipients":["my_aoc_shbx_name"],"metadata":[{"input_type":"single-text","name":"Project Id","values":["123"]},{"input_type":"single-dropdown","name":"Type","values":["Opt2"]},{"input_type":"multiple-checkbox","name":"CheckThose","values":["Check1","Check2"]},{"input_type":"date","name":"Optional Date","values":["2021-01-13T15:02:00.000Z"]}]}' testfile.bin
 aoc packages send --workspace="my_aoc_shbx_ws" --value=@json:'{"name":"Important files delivery","recipients":["my_aoc_shbx_name"],"metadata":{"Project Id":"456","Type":"Opt2","CheckThose":["Check1","Check2"],"Optional Date":"2021-01-13T15:02:00.000Z"}}' testfile.bin
 aoc packages send --workspace="my_aoc_shbx_ws" --value=@json:'{"name":"Important files delivery","recipients":["my_aoc_shbx_name"]}' testfile.bin
-aoc packages send -N --value=@json:'{"name":"Important files delivery"}' testfile.bin --link=my_aoc_publink_send_aoc_user --password=my_aoc_publink_send_use_pass
-aoc packages send -N --value=@json:'{"name":"Important files delivery"}' testfile.bin --link=my_aoc_publink_send_shd_inbox
 aoc packages shared_inboxes list
+aoc remind --username=my_aoc_user_email
+aoc servers
 aoc user profile modify @json:'{"name":"dummy change"}'
 aoc user profile show
 aoc user workspaces current
 aoc user workspaces list
 ```
 
-## <a id="ats"></a>Plugin: Aspera Transfer Service
+## <a id="ats"></a>Plugin: `ats`: IBM Aspera Transfer Service
 
 ATS is usable either :
 
@@ -3985,13 +4151,15 @@ The parameters provided to ATS for access key creation are the ones of [ATS API]
 ### ATS sample commands
 
 ```bash
-ats access_key cluster akibmcloud --secret=somesecret
+ats access_key cluster ak2ibmcloud --secret=somesecret
 ats access_key create --cloud=aws --region=my_aws_bucket_region --params=@json:'{"id":"ak_aws","name":"my test key AWS","storage":{"type":"aws_s3","bucket":"my_aws_bucket_name","credentials":{"access_key_id":"my_aws_bucket_key","secret_access_key":"my_aws_bucket_secret"},"path":"/"}}'
-ats access_key create --cloud=softlayer --region=my_icos_bucket_region --params=@json:'{"id":"akibmcloud","secret":"somesecret","name":"my test key","storage":{"type":"ibm-s3","bucket":"my_icos_bucket_name","credentials":{"access_key_id":"my_icos_bucket_key","secret_access_key":"my_icos_bucket_secret"},"path":"/"}}'
+ats access_key create --cloud=softlayer --region=my_icos_bucket_region --params=@json:'{"id":"ak2ibmcloud","secret":"somesecret","name":"my test key","storage":{"type":"ibm-s3","bucket":"my_icos_bucket_name","credentials":{"access_key_id":"my_icos_bucket_key","secret_access_key":"my_icos_bucket_secret"},"path":"/"}}'
+ats access_key delete ak2ibmcloud
 ats access_key delete ak_aws
-ats access_key delete akibmcloud
+ats access_key entitlement ak2ibmcloud
 ats access_key list --fields=name,id
-ats access_key node akibmcloud browse / --secret=somesecret
+ats access_key node ak2ibmcloud browse / --secret=somesecret
+ats access_key show ak2ibmcloud
 ats api_key create
 ats api_key instances
 ats api_key list
@@ -4001,17 +4169,21 @@ ats cluster show --cloud=aws --region=eu-west-1
 ats cluster show 1f412ae7-869a-445c-9c05-02ad16813be2
 ```
 
-## Plugin: IBM Aspera High Speed Transfer Server (transfer)
+## <a id="server"></a>Plugin: `server`: IBM Aspera High Speed Transfer Server (SSH)
 
-This plugin uses SSH as a session protocol (using commands `ascp` and `ascmd`) and does not use the node API.
+The `server` plugin is used for operations on Aspera HSTS using SSH authentication.
 It is the legacy way of accessing an Aspera Server, often used for server to server transfers.
-Modern mode is to use the node API and transfer tokens.
+An SSH session is established, authenticated with either a password or an SSH private key,
+then commands `ascp` (for transfers) and `ascmd` (for file operations) are executed.
+
+> **Note:** The URL to be provided is usually: `ssh://_server_address_:33001`
 
 ### Server sample commands
 
 ```bash
-server -N -Ptst_server_bykey -Plocal_user br /
+server br /
 server browse /
+server browse NEW_SERVER_FOLDER/testfile.bin
 server browse folder_1/target_hot
 server cp NEW_SERVER_FOLDER/testfile.bin folder_1/200KB.2
 server delete NEW_SERVER_FOLDER
@@ -4027,34 +4199,39 @@ server md5sum NEW_SERVER_FOLDER/testfile.bin
 server mkdir NEW_SERVER_FOLDER --logger=stdout
 server mkdir folder_1/target_hot
 server mv folder_1/200KB.2 folder_1/to.delete
+server sync admin status --sync-info=@json:'{"name":"sync2","local":{"path":"syncdir"}}'
+server sync admin status --sync-session=mysync --sync-info=@json:'{"sessions":[{"name":"mysync","local_dir":"syncdir"}]}'
+server sync start --sync-info=@json:'{"name":"sync2","local":{"path":"syncdir"},"remote":{"path":"'"NEW_SERVER_FOLDER"'"},"reset":true,"quiet":false}'
+server sync start --sync-info=@json:'{"sessions":[{"name":"mysync","direction":"pull","remote_dir":"'"NEW_SERVER_FOLDER"'","local_dir":"syncdir","reset":true}]}'
 server upload --sources=@ts --ts=@json:'{"EX_ascp_args":["--file-list","'"filelist.txt"'"]}' --to-folder=NEW_SERVER_FOLDER 
 server upload --sources=@ts --ts=@json:'{"EX_ascp_args":["--file-pair-list","'"filepairlist.txt"'"]}'
 server upload --sources=@ts --ts=@json:'{"EX_file_list":"'"filelist.txt"'"}' --to-folder=NEW_SERVER_FOLDER
 server upload --sources=@ts --ts=@json:'{"EX_file_pair_list":"'"filepairlist.txt"'"}'
 server upload --sources=@ts --ts=@json:'{"paths":[{"source":"testfile.bin","destination":"NEW_SERVER_FOLDER/othername"}]}'
 server upload --src-type=pair --sources=@json:'["testfile.bin","NEW_SERVER_FOLDER/othername"]'
-server upload --src-type=pair testfile.bin NEW_SERVER_FOLDER/othername --notif-to=my_recipient_email
+server upload --src-type=pair testfile.bin NEW_SERVER_FOLDER/othername --notif-to=my_recipient_email --ascp-opts=@list:' -l 10m'
 server upload --src-type=pair testfile.bin folder_1/with_options --ts=@json:'{"cipher":"aes-192-gcm","content_protection":"encrypt","content_protection_password":"_secret_here_","cookie":"biscuit","create_dir":true,"delete_before_transfer":false,"delete_source":false,"exclude_newer_than":1,"exclude_older_than":10000,"fasp_port":33001,"http_fallback":false,"multi_session":0,"overwrite":"diff+older","precalculate_job_size":true,"preserve_access_time":true,"preserve_creation_time":true,"rate_policy":"fair","resume_policy":"sparse_csum","symlink_policy":"follow"}'
 server upload --to-folder=folder_1/target_hot --lock-port=12345 --ts=@json:'{"EX_ascp_args":["--remove-after-transfer","--remove-empty-directories","--exclude-newer-than=-8","--src-base","source_hot"]}' source_hot
-server upload testfile.bin --to-folder=NEW_SERVER_FOLDER --ts=@json:'{"multi_session":3,"multi_session_threshold":1,"resume_policy":"none","target_rate_kbps":1500}' --transfer-info=@json:'{"spawn_delay_sec":2.5}' --progress=multi
+server upload testfile.bin --to-folder=NEW_SERVER_FOLDER --ts=@json:'{"multi_session":3,"multi_session_threshold":1,"resume_policy":"none","target_rate_kbps":1500}' --transfer-info=@json:'{"spawn_delay_sec":2.5,"multi_incr_udp":false}' --progress=multi
 ```
 
 ### Authentication on Server with SSH session
 
-If SSH is the session control protocol (i.e. not WSS), then following session authentication methods are supported:
+If SSH is the session protocol (by default i.e. not WSS), then following session authentication methods are supported:
 
-- SSH password
-- SSH keys (Multiple SSH key paths can be provided.)
+- `password`: SSH password
+- `ssh_keys`: SSH keys (Multiple SSH key paths can be provided.)
 
-If username is not provided, the default transfer user `xfer` is used.
+If `username` is not provided then the default transfer user `xfer` is used.
 
-If no SSH password or key is provided and a transfer token is provided in transfer spec (option `ts`), then standard SSH bypass keys are used. Example:
+If no SSH password or key is provided and a transfer token is provided in transfer spec (option `ts`), then standard SSH bypass keys are used.
+Example:
 
-```javascript
-ascli server --url=ssh://... --ts=@json:'{"token":"Basic abc123"}'
+```bash
+ascli server --url=ssh://_server_address_:33001 ... --ts=@json:'{"token":"Basic abc123"}'
 ```
 
-> Note: If you need to use the Aspera public keys, then specify an empty token: `--ts=@json:'{"token":""}'` : Aspera public SSH keys will be used, but the protocol will ignore the empty token.
+> **Note:** If you need to use the Aspera public keys, then specify an empty token: `--ts=@json:'{"token":""}'` : Aspera public SSH keys will be used, but the protocol will ignore the empty token.
 
 The value of the `ssh_keys` option can be a single value or an array.
 Each value is a **path** to a private key and is expanded (`~` is replaced with the user's home folder).
@@ -4067,7 +4244,7 @@ ascli server --ssh-keys=@list:,~/.ssh/id_rsa
 ascli server --ssh-keys=@json:'["~/.ssh/id_rsa"]'
 ```
 
-For non-transfer related command (browse, delete), the ruby SSH client library `Net::SSH` is used and provides several options settable using option `ssh_options`.
+For file operation command (browse, delete), the ruby SSH client library `Net::SSH` is used and provides several options settable using option `ssh_options`.
 For a list of SSH client options, refer to the ruby documentation of [Net::SSH](http://net-ssh.github.io/net-ssh/Net/SSH.html).
 
 By default the SSH library expect that a local ssh-agent is running.
@@ -4086,8 +4263,8 @@ ERROR -- net.ssh.authentication.agent: could not connect to ssh-agent: pageant p
 
 This means that you don't have such an SSH agent running, then:
 
-- check env var: `SSH_AGENT_SOCK`
-- check if the SSH key is protected with a passphrase (then, use the `passphrase` SSH option)
+- Check env var: `SSH_AGENT_SOCK`
+- Check if the SSH key is protected with a passphrase (then, use the `passphrase` SSH option)
 - [check the manual](https://net-ssh.github.io/ssh/v1/chapter-2.html#s2)
 - To disable the use of `ssh-agent`, use the option `ssh_options` like this:
 
@@ -4097,7 +4274,17 @@ ascli server --ssh-options=@ruby:'{use_agent: false}' ...
 
 This can also be set as default using a global preset.
 
-### Example
+### Other session channels for `server`
+
+URL schemes `local` and `https` are also supported, mainly for testing purpose.
+(`--url=local:` , `--url=https://...`)
+
+- `local` will execute `ascmd` locally, instead of using a SSH cnnection.
+- `https` will use Web Socket Session: This requires the use of a transfer token. For example a `Basic` token can be used.
+
+As, most of the time, SSH is used, if an `http` scheme is provided without token, the plugin will fallback to SSH and port 33001.
+
+### Examples: `server`
 
 One can test the `server` application using the well known demo server:
 
@@ -4109,7 +4296,7 @@ ascli server download /aspera-test-dir-large/200MB
 
 `initdemo` creates a [option preset](#lprt) `demoserver` and set it as default for plugin `server`.
 
-## Plugin: IBM Aspera High Speed Transfer Server (node)
+## <a id="node"></a>Plugin: `node`: IBM Aspera High Speed Transfer Server Node
 
 This plugin gives access to capabilities provided by HSTS node API.
 
@@ -4129,15 +4316,15 @@ For transfers, it is possible to control how transfer is authorized using option
 
 ```javascript
 {
-  "remote_host": address of node url,
+  "remote_host": "<address of node url>",
   "remote_user": "xfer",
   "ssh_port": 33001,
   "token": "Basic <base 64 encoded user/pass>",
-  "direction": send/receive
+  "direction": "[send|receive]"
 }
 ```
 
-Note that the port is assumed to be the default SSH port `33001` and transfer user is assumed to be `xfer`.
+> **Note:** the port is assumed to be the default Aspera SSH port `33001` and transfer user is assumed to be `xfer`.
 
 ### Central
 
@@ -4224,13 +4411,20 @@ ascli node access_key create --value=@json:'{"id":"eudemo-sedemo","secret":"myst
 ### Node sample commands
 
 ```bash
-node -N -Ptst_node_preview access_key create --value=@json:'{"id":"aoc_1","storage":{"type":"local","path":"/"}}'
-node -N -Ptst_node_preview access_key delete aoc_1
-node -Pnode_srv access_key do my_aoc_ak_name br /
-node -Pnode_srv access_key list
-node -Pnode_srv service create @json:'{"id":"service1","type":"WATCHD","run_as":{"user":"user1"}}'
-node -Pnode_srv service delete service1
-node -Pnode_srv service list
+node access_key create --value=@json:'{"id":"aoc_1","storage":{"type":"local","path":"/"}}'
+node access_key delete aoc_1
+node access_key do my_aoc_ak_name browse /
+node access_key do my_aoc_ak_name delete /folder2
+node access_key do my_aoc_ak_name delete testfile1
+node access_key do my_aoc_ak_name download testfile1 --to-folder=.
+node access_key do my_aoc_ak_name file show --path=/testfile1
+node access_key do my_aoc_ak_name file show 1
+node access_key do my_aoc_ak_name find /
+node access_key do my_aoc_ak_name mkdir /folder1
+node access_key do my_aoc_ak_name node_info /
+node access_key do my_aoc_ak_name rename /folder1 folder2
+node access_key do my_aoc_ak_name upload 'faux:///testfile1?1k' --default_ports=no
+node access_key list
 node api_details
 node async bandwidth 1
 node async counters 1
@@ -4241,7 +4435,7 @@ node async show ALL
 node basic_token
 node browse / -r
 node delete /todelete
-node delete @list:,/todelete,/tdlink,/delfile
+node delete @list:,folder_1/todelete,folder_1/tdlink,folder_1/delfile
 node delete folder_1/10MB.1
 node delete testfile.bin
 node download testfile.bin --to-folder=.
@@ -4249,11 +4443,14 @@ node download testfile.bin --to-folder=. --token-type=hybrid
 node health
 node info --fpac='function FindProxyForURL(url,host){return "DIRECT"}'
 node license
-node mkdir /todelete
-node mkfile /delfile1 "hello world"
-node mklink /todelete /tdlink
-node rename / delfile1 delfile
+node mkdir folder_1/todelete
+node mkfile folder_1/delfile1 "hello world"
+node mklink folder_1/todelete folder_1/tdlink
+node rename folder_1 delfile1 delfile
 node search / --value=@json:'{"sort":"mtime"}'
+node service create @json:'{"id":"service1","type":"WATCHD","run_as":{"user":"user1"}}'
+node service delete service1
+node service list
 node space /
 node sync bandwidth my_syncid
 node sync counters my_syncid
@@ -4273,7 +4470,7 @@ node upload testfile.bin --to-folder=folder_1 --ts=@json:'{"target_rate_cap_kbps
 node upload testfile.bin --to-folder=folder_1 --ts=@json:'{"target_rate_cap_kbps":10000}' --token-type=hybrid
 ```
 
-## Plugin: IBM Aspera Faspex5
+## <a id="faspex5"></a>Plugin: `faspex5`: IBM Aspera Faspex v5
 
 IBM Aspera's newer self-managed application.
 
@@ -4306,7 +4503,7 @@ Then use these options:
 --private-key=@file:.../path/to/key.pem
 ```
 
-> The `private_key` option must contain the PEM value of the private key which can be read from a file using the modifier: `@file:`, e.g. `@file:/path/to/key.pem`.
+> **Note:** The `private_key` option must contain the PEM value of the private key which can be read from a file using the modifier: `@file:`, e.g. `@file:/path/to/key.pem`.
 
 ### Faspex 5 web authentication
 
@@ -4348,12 +4545,13 @@ Most commands are directly REST API calls.
 Parameters to commandsa are carried through option `value`, as extended value.
 Usually using JSON format with prefix `@json:`.
 
-> The API is listed in [Faspex 5 API Reference](https://developer.ibm.com/apis/catalog?search="faspex+5") under **IBM Aspera Faspex API**.
+> **Note:** The API is listed in [Faspex 5 API Reference](https://developer.ibm.com/apis/catalog?search="faspex+5") under **IBM Aspera Faspex API**.
 
 ```bash
 faspex5 admin res accounts list
 faspex5 admin res contacts list
 faspex5 admin res jobs list
+faspex5 admin res metadata_profiles list
 faspex5 admin res node list --value=@json:'{"type":"received","subtype":"mypackages"}'
 faspex5 admin res oauth_clients list
 faspex5 admin res registrations list
@@ -4365,6 +4563,9 @@ faspex5 health
 faspex5 package list --value=@json:'{"mailbox":"inbox","state":["released"]}'
 faspex5 package receive "my_package_id" --to-folder=.  --ts=@json:'{"content_protection_password":"abc123_yo"}'
 faspex5 package send --value=@json:'{"title":"test title","recipients":[{"name":"my_f5_user"}]}' testfile.bin --ts=@json:'{"content_protection_password":"_content_prot_here_"}'
+faspex5 package show "my_package_id"
+faspex5 user profile modify @json:'{"preference":{"connect_disabled":false}}'
+faspex5 user profile show
 ```
 
 Other examples:
@@ -4387,7 +4588,7 @@ ascli faspex5 admin res metadata_profiles create --value=@json:'{"name":"the pro
 ascli faspex5 admin res shared create --value=@json:'{"name":"the shared inbox","metadata_profile_id":1}'
 ```
 
-## Plugin: IBM Aspera Faspex (4.x)
+## <a id="faspex"></a>Plugin: `faspex`: IBM Aspera Faspex v4
 
 Notes:
 
@@ -4570,7 +4771,7 @@ faspex v4 wmembership list
 faspex v4 workgroup list
 ```
 
-## Plugin: IBM Aspera Shares
+## <a id="shares"></a>Plugin: `shares`: IBM Aspera Shares v1
 
 Aspera Shares supports the "node API" for the file transfer part. (Shares 1 and 2)
 
@@ -4578,10 +4779,14 @@ Aspera Shares supports the "node API" for the file transfer part. (Shares 1 and
 
 ```bash
 shares admin share list
+shares admin share list --fields=-status,status_message
 shares admin share user_permissions 1
 shares admin user app_authorizations 1
+shares admin user ldap_import --value=the_name
 shares admin user list
+shares admin user saml_import --value=@json:'{"id":"the_id","name_id":"the_name"}'
 shares admin user share_permissions 1
+shares health
 shares repository browse /
 shares repository delete my_shares_upload/testfile.bin
 shares repository download --to-folder=. my_shares_upload/testfile.bin
@@ -4590,7 +4795,7 @@ shares repository upload --to-folder=my_shares_upload testfile.bin
 shares repository upload --to-folder=my_shares_upload testfile.bin --transfer=httpgw --transfer-info=@json:'{"url":"https://my_http_gw_fqdn/aspera/http-gwy"}'
 ```
 
-## Plugin: Console
+## <a id="console"></a>Plugin: `console`: IBM Aspera Console
 
 ### Console sample commands
 
@@ -4601,11 +4806,12 @@ console transfer smart list
 console transfer smart sub my_job_id @json:'{"source":{"paths":["my_file_name"]},"source_type":"user_selected"}'
 ```
 
-## Plugin: Orchestrator
+## <a id="orchestrator"></a>Plugin: `orchestrator`:IBM Aspera Orchestrator
 
 ### Orchestrator sample commands
 
 ```bash
+orchestrator health
 orchestrator info
 orchestrator plugins
 orchestrator processes
@@ -4619,13 +4825,15 @@ orchestrator workflow status ALL
 orchestrator workflow status my_orch_workflow_id
 ```
 
-## Plugin: IBM Cloud Object Storage
+## <a id="cos"></a>Plugin: `cos`: IBM Cloud Object Storage
 
 The IBM Cloud Object Storage provides the possibility to execute transfers using FASP.
 It uses the same transfer service as Aspera on Cloud, called Aspera Transfer Service (ATS).
 Available ATS regions: [https://status.aspera.io](https://status.aspera.io)
 
-There are two possibilities to provide credentials. If you already have the endpoint, apikey and CRN, use the first method. If you don't have credentials but have access to the IBM Cloud console, then use the second method.
+There are two possibilities to provide credentials.
+If you already have the endpoint, apikey and CRN, use the first method.
+If you don't have credentials but have access to the IBM Cloud console, then use the second method.
 
 ### Using endpoint, apikey and Resource Instance ID (CRN)
 
@@ -4647,9 +4855,17 @@ Then, jump to the transfer example.
 
 ### Using service credential file
 
-If you are the COS administrator and don't have yet the credential: Service credentials are directly created using the IBM cloud web ui. Navigate to:
+If you are the COS administrator and don't have yet the credential:
+Service credentials are directly created using the IBM cloud Console (web UI).
+Navigate to:
 
-Navigation Menu &rarr; Resource List &rarr; Storage &rarr; Cloud Object Storage &rarr; Service Credentials &rarr; &lt;select or create credentials&gt; &rarr; view credentials &rarr; copy
+- &rarr; Navigation Menu
+- &rarr; [Resource List](https://cloud.ibm.com/resources)
+- &rarr; [Storage](https://cloud.ibm.com/objectstorage)
+- &rarr; Select your storage instance
+- &rarr; Service Credentials
+- &rarr; New credentials (Leave default role: Writer, no special options)
+- &rarr; Copy to clipboard
 
 Then save the copied value to a file, e.g. : `$HOME/cos_service_creds.json`
 
@@ -4710,31 +4926,43 @@ ascli cos node info
 ascli cos node upload 'faux:///sample1G?1g'
 ```
 
-Note: we generate a dummy file `sample1G` of size 2GB using the `faux` PVCL (man ascp and section above), but you can of course send a real file by specifying a real file instead.
+Note: we generate a dummy file `sample1G` of size 2GB using the `faux` PVCL (man `ascp` and section above), but you can of course send a real file by specifying a real file instead.
 
 ### COS sample commands
 
 ```bash
-cos -N --bucket=my_icos_bucket_name --endpoint=my_icos_bucket_endpoint --apikey=my_icos_bucket_apikey --crn=my_icos_resource_instance_id node info
-cos -N --bucket=my_icos_bucket_name --region=my_icos_bucket_region --service-credentials=@json:@file:service_creds.json node info
+cos --bucket=my_icos_bucket_name --endpoint=my_icos_bucket_endpoint --apikey=my_icos_bucket_apikey --crn=my_icos_resource_instance_id node info
+cos --bucket=my_icos_bucket_name --region=my_icos_bucket_region --service-credentials=@json:@file:service_creds.json node info
 cos node access_key show self
 cos node download testfile.bin --to-folder=.
 cos node info
 cos node upload testfile.bin
 ```
 
-## Plugin: IBM Aspera Sync
+## <a id="async"></a>Plugin: `async`: IBM Aspera Sync
 
 A basic plugin to start an "async" using `ascli`.
-The main advantage is the possibility to start from ma configuration file, using `ascli` standard options.
+The main advantage over bare `async` command line is the possibility to use a configuration file, using `ascli` standard options.
+
+Also, the `sync` command is also made available through the `server sync` and `aoc files sync` commands.
+In this case, some of the `sync` parameters are fill from parameters of the related plugin.
+
+> **Note:** All `sync` commands require an `async` enabled license and availability of the `async` executable (and `asyncadmin`).
+>
+> **Note:** Two JSON syntax are supported for option `sync_info`.
+> The first is same sync payload as specified on the `async` option `--conf` or in the latest node API, this is the prefered syntax and allows a single session definition.
+> The second (legacy) is specific to `ascli` and allows definition of multiple sync sessions in a single command, although usually only one sync session is defined.
+
+Documentation on Async node API can be found on [IBM Developer Portal](https://developer.ibm.com/apis/catalog?search=%22aspera%20sync%20api%22).
 
 ### Sync sample commands
 
 ```bash
-sync start --parameters=@json:'{"sessions":[{"name":"test","reset":true,"remote_dir":"/sync_test","local_dir":"contents","host":"my_remote_host","tcp_port":33001,"user":"my_remote_user","private_key_path":"my_local_user_key"}]}'
+sync admin status --sync-info=@json:'{"sessions":[{"name":"test","local_dir":"contents"}]}'
+sync start --sync-info=@json:'{"instance":{"quiet":true},"sessions":[{"name":"test","reset":true,"remote_dir":"/sync_test","local_dir":"contents","host":"my_remote_host","tcp_port":33001,"user":"my_remote_user","private_key_paths":["my_local_user_key"]}]}'
 ```
 
-## Plugin: Preview
+## <a id="preview"></a>Plugin: `preview`: Preview generator for AoC
 
 The `preview` generates thumbnails (office, images, video) and video previews on storage for use primarily in the Aspera on Cloud application.
 It uses the **node API** of Aspera HSTS and requires use of Access Keys and it's **storage root**.
@@ -4846,7 +5074,7 @@ The preview generator is run as a user, preferably a regular user (not root). Wh
 
 Like any `ascli` commands, parameters can be passed on command line or using a configuration [option preset](#lprt).  The configuration file must be created with the same user used to run so that it is properly used on runtime.
 
-Note that the `xfer` user has a special protected shell: `aspshell`, so changing identity requires specification of alternate shell:
+The `xfer` user has a special protected shell: `aspshell`, so changing identity requires specification of alternate shell:
 
 ```bash
 su -s /bin/bash - xfer
@@ -4869,11 +5097,11 @@ This shall list the contents of the storage root of the access key.
 
 ### Execution
 
-The tool intentionally supports only a "one shot" mode (no infinite loop) in order to avoid having a hanging process or using too many resources (calling REST api too quickly during the scan or event method).
-It needs to be run on a regular basis to create or update preview files. For that use your best
-reliable scheduler. For instance use "CRON" on Linux or Task Scheduler on Windows.
+The tool intentionally supports only a **one shot** mode (no infinite loop) in order to avoid having a hanging process or using too many resources (calling REST api too quickly during the scan or event method).
+It needs to be run on a regular basis to create or update preview files.
+For that use your best reliable scheduler, see [Scheduling](#scheduling).
 
-Typically, for "Access key" access, the system/transfer is `xfer`. So, in order to be consistent have generate the appropriate access rights, the generation process should be run as user `xfer`.
+Typically, for **Access key** access, the system/transfer is `xfer`. So, in order to be consistent have generate the appropriate access rights, the generation process should be run as user `xfer`.
 
 Lets do a one shot test, using the configuration previously created:
 
@@ -4889,12 +5117,12 @@ On subsequent run it reads this file and check that previews are generated for t
 
 ### Configuration for Execution in scheduler
 
-Here is an example of configuration for use with cron on Linux.
-Adapt the scripts to your own preference.
+Here is an example of configuration for use with `cron` on Linux.
+Adapt the scripts to your own needs.
 
 We assume here that a configuration preset was created as shown previously.
 
-Lets first setup a script that will be used in the scheduler and sets up the environment.
+Lets first setup a script that will be used in the scheduler and set up the environment.
 
 Example of startup script `cron_ascli`, which sets the Ruby environment and adds some timeout protection:
 
@@ -4916,7 +5144,7 @@ crontab<<EOF
 EOF
 ```
 
-Note that the logging options are kept in the cronfile instead of conf file to allow execution on command line with output on command line.
+> **Note:** The logging options are kept here in the cronfile instead of conf file to allow execution on command line with output on command line.
 
 ### Candidate detection for creation or update (or deletion)
 
@@ -4997,12 +5225,12 @@ If the `mimemagic` gem complains about missing mime info file:
 - any OS:
 
   - Examine the error message
-  - Download the file: <https://gitlab.freedesktop.org/xdg/shared-mime-info/-/raw/master/data/freedesktop.org.xml.in>
+  - Download the file: [freedesktop.org.xml.in](https://gitlab.freedesktop.org/xdg/shared-mime-info/-/raw/master/data/freedesktop.org.xml.in)
   - move and rename this file to one of the locations expected by mimemagic as specified in the error message
 
 - Windows:
 
-  - Download the file: <https://gitlab.freedesktop.org/xdg/shared-mime-info/-/raw/master/data/freedesktop.org.xml.in>
+  - Download the file: [freedesktop.org.xml.in](https://gitlab.freedesktop.org/xdg/shared-mime-info/-/raw/master/data/freedesktop.org.xml.in)
   - Place this file in the root of Ruby (or elsewhere): `C:\RubyVV-x64\freedesktop.org.xml.in`
   - Set a global variable using `SystemPropertiesAdvanced.exe` or using `cmd` (replace `VV` with version) to the exact path of this file:
 
@@ -5057,17 +5285,17 @@ preview trevents --once-only=yes --skip-types=office --log-level=info
 Aspera CLI can send email, for that setup SMTP configuration. This is done with option `smtp`.
 
 The `smtp` option is a hash table (extended value) with the following fields:
-<table>
-<tr><th>field</th><th>default</th><th>example</th><th>description</th></tr>
-<tr><td>`server`</td><td>-</td><td>smtp.gmail.com</td><td>SMTP server address</td></tr>
-<tr><td>`tls`</td><td>true</td><td>false</td><td>use of TLS</td></tr>
-<tr><td>`port`</td><td>587 for tls<br/>25 else</td><td>587</td><td>port for service</td></tr>
-<tr><td>`domain`</td><td>domain of server</td><td>gmail.com</td><td>email domain of user</td></tr>
-<tr><td>`username`</td><td>-</td><td>john@example.com</td><td>user to authenticate on SMTP server, leave empty for open auth.</td></tr>
-<tr><td>`password`</td><td>-</td><td>MyP@ssword</td><td>password for above username</td></tr>
-<tr><td>`from_email`</td><td>username if defined</td><td>laurent.martin.l@gmail.com</td><td>address used if received replies</td></tr>
-<tr><td>`from_name`</td><td>same as email</td><td>John Wayne</td><td>display name of sender</td></tr>
-</table>
+
+| field        | default             | example                    | description                      |
+|--------------|---------------------|----------------------------|----------------------------------|
+| `server`     | -                   | smtp.gmail.com             | SMTP server address              |
+| `tls`        | true                | false                      | use of TLS                       |
+| `port`       | TLS: 587<br/>25     | 587                        | port for service                 |
+| `domain`     | domain of server    | gmail.com                  | email domain of user             |
+| `username`   | -                   | john@example.com           | user to authenticate on SMTP server, leave empty for open auth. |
+| `password`   | -                   | my_password_here           | password for above username      |
+| `from_email` | username if defined | johnny@example.com         | address used if receiver replies |
+| `from_name`  | same as email       | John Wayne                 | display name of sender           |
 
 ### Example of configuration
 
@@ -5104,9 +5332,9 @@ The template is the full SMTP message, including headers.
 
 The following variables are defined by default:
 
-- from_name
-- from_email
-- to
+- `from_name`
+- `from_email`
+- `to`
 
 Other variables are defined depending on context.
 
@@ -5162,26 +5390,26 @@ The tool expect one single argument: a [*transfer-spec*](#transferspec).
 
 If no argument is provided, it assumes a value of: `@json:@stdin:`, i.e. a JSON formatted [*transfer-spec*](#transferspec) on stdin.
 
-Note that if JSON is the format, one has to specify `@json:` to tell the tool to decode the hash using JSON.
+> **Note:** If JSON is the format, specify `@json:` to tell `ascli` to decode the hash using JSON syntax.
 
 During execution, it generates all low level events, one per line, in JSON format on stdout.
 
-Note that there are special "extended" [*transfer-spec*](#transferspec) parameters supported by `asession`:
+There are special "extended" [*transfer-spec*](#transferspec) parameters supported by `asession`:
 
 - `EX_loglevel` to change log level of the tool
 - `EX_file_list_folder` to set the folder used to store (exclusively, because of garbage collection) generated file lists. By default it is `[system tmp folder]/[username]_asession_filelists`
 
-Note that in addition, many "EX_" [*transfer-spec*](#transferspec) parameters are supported for the [`direct`](#agt_direct) transfer agent (used by `asession`), refer to section [*transfer-spec*](#transferspec).
+> **Note:** In addition, many "EX_" [*transfer-spec*](#transferspec) parameters are supported for the [`direct`](#agt_direct) transfer agent (used by `asession`), refer to section [*transfer-spec*](#transferspec).
 
 ### Comparison of interfaces
 
-<table>
-<tr><th>feature/tool</th><th>asession</th><th>ascp</th><th>FaspManager</th><th>Transfer SDK</th></tr>
-<tr><td>language integration</td><td>any</td><td>any</td><td>C/C++<br/>C#/.net<br/>Go<br/>Python<br/>java<br/></td><td>many</td></tr>
-<tr><td>required additional components to ascp</td><td>Ruby<br/>Aspera</td><td>-</td><td>library<br/>(headers)</td><td>daemon</td></tr>
-<tr><td>startup</td><td>JSON on stdin<br/>(standard APIs:<br/>JSON.generate<br/>Process.spawn)</td><td>command line arguments</td><td>API</td><td>daemon</td></tr>
-<tr><td>events</td><td>JSON on stdout</td><td>none by default<br/>or need to open management port<br/>and proprietary text syntax</td><td>callback</td><td>callback</td></tr>
-<tr><td>platforms</td><td>any with ruby and ascp</td><td>any with ascp (and SDK if compiled)</td><td>any with ascp</td><td>any with ascp and transfer daemon</td></tr></table>
+| feature/tool | asession | `ascp` | FaspManager | Transfer SDK |
+|--------------|----------|--------|-------------|--------------|
+| language integration | any | any | C/C++<br/>C#/.net<br/>Go<br/>Python<br/>java<br/> | many |
+| required additional components to `ascp` | Ruby<br/>Aspera | - | library<br/>(headers) | daemon |
+| startup | JSON on stdin<br/>(standard APIs:<br/>JSON.generate<br/>Process.spawn) | command line arguments | API | daemon |
+| events | JSON on stdout | none by default<br/>or need to open management port<br/>and proprietary text syntax | callback | callback |
+| platforms | any with ruby and `ascp` | any with `ascp` (and SDK if compiled) | any with `ascp` | any with `ascp` and transfer daemon |
 
 ### Simple session
 
@@ -5193,13 +5421,13 @@ Create a file `session.json` with:
 
 Then start the session:
 
-```
+```bash
 asession < session.json
 ```
 
 ### Asynchronous commands and Persistent session
 
-`asession` also supports asynchronous commands (on the management port). Instead of the traditional text protocol as described in ascp manual, the format for commands is: one single line per command, formatted in JSON, where parameters shall be "snake" style, for example: `LongParameter` -&gt; `long_parameter`
+`asession` also supports asynchronous commands (on the management port). Instead of the traditional text protocol as described in `ascp` manual, the format for commands is: one single line per command, formatted in JSON, where parameters shall be "snake" style, for example: `LongParameter` -&gt; `long_parameter`
 
 This is particularly useful for a persistent session ( with the [*transfer-spec*](#transferspec) parameter: `"keepalive":true` )
 
@@ -5266,9 +5494,9 @@ The general idea is to rely on :
 - take advantage of `ascli` configuration capabilities and server side knowledge
 - the OS scheduler for reliability and continuous operation
 
-#### ascp features
+#### `ascp` features
 
-Interesting ascp features are found in its arguments: (see ascp manual):
+Interesting `ascp` features are found in its arguments: (see `ascp` manual):
 
 - `ascp` already takes care of sending only "new" files: option `-k 1,2,3` (`resume_policy`)
 - `ascp` has some options to remove or move files after transfer: `--remove-after-transfer`, `--move-after-transfer`, `--remove-empty-directories` (`remove_after_transfer`, `move_after_transfer`, `remove_empty_directories`)
@@ -5279,14 +5507,15 @@ Note that:
 
 - `ascli` takes transfer parameters exclusively as a [*transfer-spec*](#transferspec), with `--ts` parameter.
 - most, but not all, native `ascp` arguments are available as standard [*transfer-spec*](#transferspec) parameters
-- native ascp arguments can be provided with the [*transfer-spec*](#transferspec) parameter: `EX_ascp_args` (array), only for the [`direct`](#agt_direct) transfer agent (not others, like connect or node)
+- native `ascp` arguments can be provided with the [*transfer-spec*](#transferspec) parameter: `EX_ascp_args` (array), only for the [`direct`](#agt_direct) transfer agent (not others, like connect or node)
 
 #### server side and configuration
 
 Virtually any transfer on a "repository" on a regular basis might emulate a hot folder.
-> file detection is not based on events (inotify, etc...), but on a simple folder scan on source side.
 
-> parameters may be saved in a [option preset](#lprt) and used with `-P`.
+> **Note:** file detection is not based on events (inotify, etc...), but on a simple folder scan on source side.
+>
+> **Note:** parameters may be saved in a [option preset](#lprt) and used with `-P`.
 
 #### Scheduling
 
@@ -5295,7 +5524,7 @@ Refer to section [Scheduling](#scheduling). (on use of option `lock_port`)
 
 ### Example: upload hot folder
 
-```javascript
+```bash
 ascli server upload source_hot --to-folder=/Upload/target_hot --lock-port=12345 --ts=@json:'{"remove_after_transfer":true,"remove_empty_directories":true,"exclude_newer_than:-8,"src_base":"source_hot"}'
 ```
 
@@ -5304,11 +5533,25 @@ Source files are deleted after transfer.
 Growing files will be sent only once they don't grow anymore (based on an 8-second cooloff period).
 If a transfer takes more than the execution period, then the subsequent execution is skipped (`lock_port`) preventing multiple concurrent runs.
 
-### Example: unidirectional synchronization
+### Example: unidirectional synchronization (upload) to server
 
-```javascript
-ascli server upload source_sync --to-folder=/Upload/target_sync --lock-port=12345 --ts=@json:'{"resume_policy":"sparse_csum","exclude_newer_than:-8,"src_base":"source_sync"}'
+```bash
+ascli server upload source_sync --to-folder=/Upload/target_sync --lock-port=12345 --ts=@json:'{"resume_policy":"sparse_csum","exclude_newer_than":-8,"src_base":"source_sync"}'
+```
+
+This can also be used with other folder-based applications: Aspera on Cloud, Shares, Node:
+
+### Example: unidirectional synchronization (download) from Aspera on Cloud Files
+
+```bash
+ascli aoc files download . --to-folder=. --lock-port=12345 --progress=none --display=data \
+--ts=@json:'{"resume_policy":"sparse_csum","target_rate_kbps":50000,"exclude_newer_than":-8,"delete_before_transfer":true}'
 ```
+
+> **Note:** option `delete_before_transfer` will delete files locally, if they are not present on remote side.
+>
+> **Note:** options `progress` and `display` limit output for headless operation (e.g. cron job)
+
 ## Health check and Nagios
 
 Most plugin provide a `health` command that will check the health status of the application. Example:
@@ -5384,11 +5627,11 @@ aoc.read('self')
 
 ## Changes (Release notes)
 
-See <CHANGELOG.md>
+See [CHANGELOG.md](CHANGELOG.md)
 
 ## History
 
-When I joined Aspera, there was only one CLI: `ascp`, which is the implementation of the FASP protocol, but there was no CLI to access the various existing products (Server, Faspex, Shares). Once, Serban (founder) provided a shell script able to create a Faspex Package using Faspex REST API. Since all products relate to file transfers using FASP (ascp), I thought it would be interesting to have a unified CLI for transfers using FASP. Also, because there was already the `ascp` tool, I thought of an extended tool : `eascp.pl` which was accepting all `ascp` options for transfer but was also able to transfer to Faspex and Shares (destination was a kind of URI for the applications).
+When I joined Aspera, there was only one CLI: `ascp`, which is the implementation of the FASP protocol, but there was no CLI to access the various existing products (Server, Faspex, Shares). Once, Serban (founder) provided a shell script able to create a Faspex Package using Faspex REST API. Since all products relate to file transfers using FASP (`ascp`), I thought it would be interesting to have a unified CLI for transfers using FASP. Also, because there was already the `ascp` tool, I thought of an extended tool : `eascp.pl` which was accepting all `ascp` options for transfer but was also able to transfer to Faspex and Shares (destination was a kind of URI for the applications).
 
 There were a few pitfalls:
 
@@ -5399,7 +5642,7 @@ So, it evolved into `ascli`:
 
 - portable: works on platforms supporting `ruby` (and `ascp`)
 - easy to install with the `gem` utility
-- supports transfers with multiple [Transfer Agents](#agents), that&apos;s why transfer parameters moved from ascp command line to [*transfer-spec*](#transferspec) (more reliable , more standard)
+- supports transfers with multiple [Transfer Agents](#agents), that&apos;s why transfer parameters moved from `ascp` command line to [*transfer-spec*](#transferspec) (more reliable , more standard)
 - `ruby` is consistent with other Aspera products
 
 ## Common problems