Merge branch 'main' of https://github.com/GAM-team/GAM

Co-authored-by: jay0lee <4623536+jay0lee@users.noreply.github.com>

.github/workflows/build.yml

@@ -23,7 +23,7 @@ defaults:
 
 env:
   SCRATCH_COUNTER: 14
-  OPENSSL_CONFIG_OPTS: no-fips --api=3.0.0
+  OPENSSL_CONFIG_OPTS: no-fips --api=3.0.0 no-docs no-tls1 no-tls1_1 no-dtls no-comp no-srp no-psk no-nextprotoneg no-weak-ssl-ciphers no-idea no-seed no-camellia no-sm2 no-sm3 no-sm4 no-rc2 no-rc4 no-rc5 no-md2 no-md4 no-cast no-des no-shared -fPIC no-tests -O3
   OPENSSL_INSTALL_PATH: ${{ github.workspace }}/bin/ssl
   OPENSSL_SOURCE_PATH: ${{ github.workspace }}/src/openssl
   PYTHON_INSTALL_PATH: ${{ github.workspace }}/bin/python
@@ -156,6 +156,7 @@ jobs:
         with:
           workload_identity_provider: projects/297925809119/locations/global/workloadIdentityPools/gha-pool/providers/gha-provider
           service_account: github-actions-testing-for-gam@gam-project-wyo-lub-ivl.iam.gserviceaccount.com
+          access_token_scopes: https://www.googleapis.com/auth/iam
 
       - name: Cache multiple paths
         if: matrix.goal == 'build'
@@ -164,7 +165,7 @@ jobs:
         with:
           path: |
             cache.tar.xz
-          key: gam-${{ matrix.jid }}-20260227
+          key: gam-${{ matrix.jid }}-20260508
 
       - name: Untar Cache archive
         if: matrix.goal == 'build' && steps.cache-python-ssl.outputs.cache-hit == 'true'
@@ -199,6 +200,9 @@ jobs:
               echo "arch=${RUNNER_ARCH}" >> $GITHUB_ENV
               ;;
           esac
+          # calculate with python because date on MacOS is just stupid
+          DEPS_CUTOFF=$(python3 -c "from datetime import datetime, timedelta, timezone; print((datetime.now(timezone.utc) - timedelta(days=14)).strftime('%Y-%m-%dT00:00:00Z'))")
+          echo "DEPS_CUTOFF=${DEPS_CUTOFF}" >> $GITHUB_ENV
           echo "JID=${JID}" >> $GITHUB_ENV
           echo "freethreaded=${freethreaded}" >> $GITHUB_ENV
           if "$freethreaded"; then
@@ -277,6 +281,8 @@ jobs:
           echo "We are running on ${RUNNER_OS}"
           LD_LIBRARY_PATH="${OPENSSL_INSTALL_PATH}/lib:${PYTHON_INSTALL_PATH}/lib:/usr/local/lib"
           if [[ "${RUNNER_OS}" == "macOS" ]]; then
+            export CFLAGS="-O3 -pipe"
+            export LDFLAGS="-Wl,-dead_strip"
             MAKE=make
             MAKEOPT="-j$(sysctl -n hw.logicalcpu)"
             PERL=perl
@@ -285,6 +291,8 @@ jobs:
             echo "We are running on and targetting MacOS ${MACOSX_DEPLOYMENT_TARGET}"
             echo "PYTHON=${PYTHON_INSTALL_PATH}/bin/python3" >> $GITHUB_ENV
           elif [[ "${RUNNER_OS}" == "Linux" ]]; then
+            export CFLAGS="-O3 -pipe"
+            export LDFLAGS="-Wl,--strip-all"
             MAKE=make
             MAKEOPT="-j$(nproc)"
             PERL=perl
@@ -311,6 +319,8 @@ jobs:
           echo "LD_LIBRARY_PATH=${LD_LIBRARY_PATH}" >> $GITHUB_ENV
           echo "MAKE=${MAKE}" >> $GITHUB_ENV
           echo "MAKEOPT=${MAKEOPT}" >> $GITHUB_ENV
+          echo "CFLAGS=${CFLAGS}" >> $GITHUB_ENV
+          echo "LDFLAGS=${LDFLAGS}" >> $GITHUB_ENV
           echo "PERL=${PERL}" >> $GITHUB_ENV
           echo "PYEXTERNALS_PATH=${PYEXTERNALS_PATH}" >> $GITHUB_ENV
 
@@ -335,12 +345,15 @@ jobs:
         if: matrix.goal == 'build' && steps.cache-python-ssl.outputs.cache-hit != 'true'
         run: |
           cd "${OPENSSL_SOURCE_PATH}"
-          #if ([ "$RUNNER_OS" == "Windows" ] && [ "$RUNNER_ARCH" == "ARM64" ]); then
-            # https://github.com/openssl/openssl/issues/26239
-            export CFLAGS=-DNO_INTERLOCKEDOR64
-          #fi
           # --libdir=lib is needed so Python can find OpenSSL libraries
+          # Python doesn't like OpenSSL 4.0 with ASM on Linux arm64
+          # disable for now
+          if ([ "$RUNNER_OS" == "Linux" ] && [ "$RUNNER_ARCH" == "ARM64" ]); then
+            "${PERL}" ./Configure --libdir=lib --prefix="${OPENSSL_INSTALL_PATH}" no-asm $OPENSSL_CONFIG_OPTS
+          else
             "${PERL}" ./Configure --libdir=lib --prefix="${OPENSSL_INSTALL_PATH}" $OPENSSL_CONFIG_OPTS
+          fi
+            
 
       - name: Rename GNU link on Windows
         if: matrix.goal == 'build' && runner.os == 'Windows' && steps.cache-python-ssl.outputs.cache-hit != 'true'
@@ -352,10 +365,6 @@ jobs:
         if: matrix.goal == 'build' && steps.cache-python-ssl.outputs.cache-hit != 'true'
         run: |
           cd "${OPENSSL_SOURCE_PATH}"
-          # TODO: remove this once https://github.com/openssl/openssl/issues/26239 is fixed.
-          if ([ "$RUNNER_OS" == "Windows" ] && [ "$RUNNER_ARCH" == "ARM64" ]); then
-            export CFLAGS=-DNO_INTERLOCKEDOR64
-          fi
           $MAKE "$MAKEOPT"
 
       - name: Install OpenSSL
@@ -364,20 +373,23 @@ jobs:
           cd "${OPENSSL_SOURCE_PATH}"
           # install_sw saves us ages processing man pages :-)
           $MAKE install_sw
+          #if [[ "${RUNNER_OS}" != "Windows" ]]; then
+          #  echo "LDFLAGS=-L${OPENSSL_INSTALL_PATH}/lib" >> $GITHUB_ENV
+          #fi
+          #echo "CRYPTOGRAPHY_SUPPRESS_LINK_FLAGS=1" >> $GITHUB_ENV
+          #case $RUNNER_ARCH in
+          #  X64)
+          #    echo "CFLAGS=-I${OPENSSL_INSTALL_PATH}/include ${CFLAGS}" >> $GITHUB_ENV
+          #    echo "ARCHFLAGS=-arch x86_64" >> $GITHUB_ENV
+          #    ;;
+          #  ARM64)
+          #    echo "CFLAGS=-I${OPENSSL_INSTALL_PATH}/include ${CFLAGS}" >> $GITHUB_ENV
+          #    echo "ARCHFLAGS=-arch arm64" >> $GITHUB_ENV
+          #    ;;
+          #esac
           if [[ "${RUNNER_OS}" != "Windows" ]]; then
-            echo "LDFLAGS=-L${OPENSSL_INSTALL_PATH}/lib" >> $GITHUB_ENV
+            strip "${OPENSSL_INSTALL_PATH}/bin/openssl"
           fi
-          echo "CRYPTOGRAPHY_SUPPRESS_LINK_FLAGS=1" >> $GITHUB_ENV
-          case $RUNNER_ARCH in
-            X64)
-              echo "CFLAGS=-I${OPENSSL_INSTALL_PATH}/include ${CFLAGS}" >> $GITHUB_ENV
-              echo "ARCHFLAGS=-arch x86_64" >> $GITHUB_ENV
-              ;;
-            ARM64)
-              echo "CFLAGS=-I${OPENSSL_INSTALL_PATH}/include ${CFLAGS}" >> $GITHUB_ENV
-              echo "ARCHFLAGS=-arch arm64" >> $GITHUB_ENV
-              ;;
-          esac
 
       - name: Run OpenSSL
         if: matrix.goal == 'build'
@@ -393,6 +405,9 @@ jobs:
           cd "${PYTHON_SOURCE_PATH}"
           export LATEST_STABLE_TAG=$(git tag --list | grep -v a | grep -v rc | grep -v b | sort -Vr | head -n1)
           git checkout "${LATEST_STABLE_TAG}"
+          # Temp Python 3.14 patch to work with OpenSSL 4
+          # Python 3.15 in Oct 2026 should support 4 OOB
+          patch -p1 < "${GITHUB_WORKSPACE}/src/tools/py314-ossl4.diff"
           export COMPILED_PYTHON_VERSION=${LATEST_STABLE_TAG:1} # Trim the "v" prefix
           echo "COMPILED_PYTHON_VERSION=${COMPILED_PYTHON_VERSION}" >> $GITHUB_ENV
 
@@ -405,7 +420,9 @@ jobs:
                       --enable-shared \
                       --with-ensurepip=upgrade \
                       --enable-optimizations \
-                      --with-lto || : # exit 0
+                      --with-lto \
+                      --disable-test-modules \
+                      --without-doc-strings || : # exit 0
           cat config.log
 
       - name: Windows Get External Python deps
@@ -452,8 +469,10 @@ jobs:
         shell: powershell
         run: |
           cd "${env:PYTHON_SOURCE_PATH}"
-          # We need out custom openssl.props which uses OpenSSL 3 DLL names
+          # We need our custom openssl.props which uses OpenSSL 3 DLL names
           Copy-Item -Path "${env:GITHUB_WORKSPACE}\src\tools\openssl.props" -Destination PCBuild\ -Verbose
+          # We need our custom _hashlib.vcxproj
+          Copy-Item -Path "${env:GITHUB_WORKSPACE}\src\tools\_hashlib.vcxproj" -Destination PCBuild\ -Verbose
           if (${env:RUNNER_ARCH} -eq "X64") {
             $env:arch = "x64"
             #PCBuild\build.bat -c Release -p $env:arch --pgo
@@ -480,6 +499,7 @@ jobs:
           cd "${PYTHON_SOURCE_PATH}"
           $MAKE altinstall
           $MAKE bininstall
+          strip "${PYTHON_INSTALL_PATH}/bin/python3"
           export PATH="${PATH}:${PYTHON_INSTALL_PATH}/bin"
           echo "PATH=${PATH}" >> $GITHUB_ENV
           echo "PATH: ${PATH}"
@@ -489,19 +509,19 @@ jobs:
           "${PYTHON}" -VV
           "${PYTHON}" -c "import ssl; print(f'Using {ssl.OPENSSL_VERSION}')"
 
-      - name: Create and use Python venv
+      - name: Create and use Python .venv
         run: |
           cd "$GITHUB_WORKSPACE"
           curl -o get-pip.py https://bootstrap.pypa.io/get-pip.py
           "$PYTHON" get-pip.py
-          "$PYTHON" -m venv venv
+          "$PYTHON" -m venv .venv
           if [[ "$RUNNER_OS" == "Windows" ]]; then
             # pyscard seems to build outside venv but not in it.
             # build it so it's cached.
-            "$PYTHON" -m pip install --upgrade --force-reinstall pyscard
+            "$PYTHON" -m pip install --upgrade pyscard
-            export PYTHON="${GITHUB_WORKSPACE}/venv/scripts/python.exe"
+            export PYTHON="${GITHUB_WORKSPACE}/.venv/scripts/python.exe"
           else
-            export PYTHON="${GITHUB_WORKSPACE}/venv/bin/python3"
+            export PYTHON="${GITHUB_WORKSPACE}/.venv/bin/python3"
           fi
           echo "PYTHON=${PYTHON}" >> $GITHUB_ENV
           if [[ "$ACTIONS_GOAL" == "test" ]]; then
@@ -509,31 +529,22 @@ jobs:
             echo "gam=${gam}" >> $GITHUB_ENV
           fi
 
-      - name: Upgrade pip, wheel, etc
+      #- name: Upgrade pip, wheel, etc
-        run: |
+      #  run: |
-          curl $curl_retry -O https://bootstrap.pypa.io/get-pip.py
+      #    curl $curl_retry -O https://bootstrap.pypa.io/get-pip.py
-          "$PYTHON" get-pip.py
+      #    "$PYTHON" get-pip.py
-          "$PYTHON" -m pip install --upgrade pip
+      #    "$PYTHON" -m pip install --upgrade pip
-          "$PYTHON" -m pip install --upgrade wheel
+      #    "$PYTHON" -m pip install --upgrade wheel
-          "$PYTHON" -m pip install --upgrade setuptools
+      #    "$PYTHON" -m pip install --upgrade setuptools
-          "$PYTHON" -m pip install --upgrade importlib-metadata
+      #    "$PYTHON" -m pip install --upgrade importlib-metadata
-          "$PYTHON" -m pip install --upgrade setuptools-scm
+      #    "$PYTHON" -m pip install --upgrade setuptools-scm
-          "$PYTHON" -m pip install --upgrade packaging
+      #    "$PYTHON" -m pip install --upgrade packaging
-          "$PYTHON" -m pip list
+      #    "$PYTHON" -m pip list
 
       - name: Install pip requirements
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          echo "before anything..."
-          "$PYTHON" -m pip list
-          echo "--info--"
-          "$PYTHON" -m pip cache info
-          echo "--list--"
-          "$PYTHON" -m pip cache list
-          echo "--pip debug verbose--"
-          "$PYTHON" -m pip debug --verbose
-          echo "--------"
           if ([ "$RUNNER_OS" == "Windows" ] && [ "$RUNNER_ARCH" == "ARM64" ]); then
             # custom cryptography wheel for win arm64 since the project doesn't provide one:
             # https://github.com/pyca/cryptography/issues/14293
@@ -541,24 +552,12 @@ jobs:
             "$PYTHON" -m pip install cryptography-*.whl
           fi
           "$PYTHON" -m pip install -vvv --upgrade ..[yubikey]
-          echo "after everything..."
-          "$PYTHON" -m pip list
 
       - name: Install PyInstaller
         if: matrix.goal == 'build'
         run: |
-          #git clone https://github.com/pyinstaller/pyinstaller.git
+          # Install latest version of PyInstaller *that's 2 weeks old*
-          #cd pyinstaller
+          # Calculate the exact timestamp for 14 days ago
-          #export latest_release=$(git tag --list | grep -v dev | grep -v rc | sort -Vr | head -n1)
-          #git checkout "${latest_release}"
-          # git checkout "v6.9.0"
-          # remove pre-compiled bootloaders so we fail if bootloader compile fails
-          #rm -rvf PyInstaller/bootloader/*-*/*
-          #cd bootloader
-          #"${PYTHON}" ./waf all
-          #cd ..
-          #echo "---- Installing PyInstaller ----"
-          #"${PYTHON}" -m pip install .
           "$PYTHON" -m pip install --upgrade pyinstaller
 
       - name: Build GAM with PyInstaller
@@ -625,10 +624,9 @@ jobs:
           sudo apt-get -qq --yes update
           # arm64 needs to build a wheel and needs scons to build
           sudo apt-get -qq --yes install scons
-          "${PYTHON}" -m pip install --upgrade patchelf-wrapper
+          "$PYTHON" -m pip install --upgrade patchelf-wrapper
-          # "${PYTHON}" -m pip install --upgrade staticx
+          "$PYTHON" -m pip install --upgrade typing_extensions
-          # install latest github src for staticx
+          "$PYTHON" -m pip install --upgrade staticx
-          "${PYTHON}" -m pip install --upgrade "git+https://github.com/JonathonReinhart/staticx"
 
       - name: Make StaticX GAM build
         if: matrix.staticx == 'yes'
@@ -672,20 +670,6 @@ jobs:
           echo "GAM Version ${GAMVERSION}"
           echo "GAMVERSION=${GAMVERSION}" >> $GITHUB_ENV
 
-      - name: Initialize Windows Desktop Shell
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: |
-          Write-Host "Checking for Windows Explorer shell..."
-          if (-not (Get-Process -Name explorer -ErrorAction SilentlyContinue)) {
-              Write-Host "Explorer not found. Booting the desktop shell..."
-              Start-Process explorer.exe
-              # Give the desktop a few seconds to fully render the taskbar
-              Start-Sleep -Seconds 10 
-          } else {
-              Write-Host "Explorer is already running."
-          }
-
       - name: Install NPM deps
         if: runner.os == 'Windows'
         run: |
@@ -698,8 +682,8 @@ jobs:
         if: runner.os == 'Windows'
         shell: pwsh
         run: |
-          #$url = "https://files.certum.eu/software/SimplySignDesktop/Windows/9.3.4.72/SimplySignDesktop-9.3.4.72-64-bit-en.msi"
+          #$url = "https://files.certum.eu/software/SimplySignDesktop/Windows/9.4.2.86/SimplySignDesktop-9.4.2.86-64-bit-en.msi"
-          $url = "https://www.files.certum.eu/software/SimplySignDesktop/Windows/9.4.0.84/SimplySignDesktop-9.4.0.84-64-bit-en.msi"
+          $url = "https://files.certum.eu/software/SimplySignDesktop/Windows/9.4.3.90/SimplySignDesktop-9.4.3.90-64-bit-en.msi"
           $file = "SimplySignDesktop.msi"
           Invoke-WebRequest $url -OutFile $file
           $log = "install.log" 
@@ -708,6 +692,15 @@ jobs:
           $procMain.WaitForExit() 
           $procLog.Kill()
 
+      - name: Run SSD directly
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          Write-Host "Running SSD..."
+          & "C:\\Program Files\\Certum\\SimplySign Desktop\\SimplySignDesktop.exe"
+          Start-Sleep -Seconds 10
+          & "C:\\Program Files\\Certum\\SimplySign Desktop\\SimplySignDesktop.exe"
+
       - name: Login to Certum
         if: runner.os == 'Windows'
         shell: pwsh
@@ -716,18 +709,20 @@ jobs:
         run: |
           write-host "running SimplySignDesktop login..."
           node tools/ssd.mjs --log-level warn
+          Get-ChildItem -Path $env:GITHUB_WORKSPACE
           write-host "sleeping during login..."
           Start-Sleep 10
 
-      - name: Archive png artifacts
+#      - name: Archive artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
+#        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
-        if: runner.os == 'Windows'
+#        if: runner.os == 'Windows'
-        with:
+#        with:
-          archive: true
+#          archive: true
-          name: images-${{ matrix.os }}
+#          name: images-${{ matrix.os }}
-          if-no-files-found: ignore
+#          if-no-files-found: ignore
-          path: |
+#          path: |
-            *.png
+#            ${{ github.workspace }}/*.png
+#            ${{ github.workspace }}/*.log
 
       - name: Sign gam.exe
         if: runner.os == 'Windows'
@@ -928,6 +923,8 @@ jobs:
           run_gam csv ./resources.csv gam delete resource ~resourceId
           run_gam config csv_output_row_filter "buildingId:regex:^gha_test_${JID}_" redirect csv ./buildings.csv print buildings
           run_gam csv ./buildings.csv gam delete building ~buildingId
+          run_gam config csv_output_row_filter "displayName:regex:^El\ Goog\ gha_test_${JID}_" redirect csv ./ssoprofiles.csv print inboundssoprofiles
+          run_gam csv ./ssoprofiles.csv gam delete inboundssoprofile "id:~~name~~"
 
           echo "Creating OrgUnit ${newou}"
           run_gam create ou "${newou}"
@@ -938,14 +935,16 @@ jobs:
           done
           driveid=$($gam user $gam_user add shareddrive "${newbase}" returnidonly)
           echo "Created shared drive ${driveid}"
-          run_gam create user $newuser firstname GHA lastname $JID displayname "Github Actions ${JID}" password random recoveryphone 12125121110 recoveryemail jay0lee@gmail.com gha.jid $JID languages en+,en-GB- ou "${newou}"
+          run_gam create user $newuser firstname GHA lastname $JID displayname "Github Actions ${JID}" password uniquerandom recoveryphone 12125121110 recoveryemail jay0lee@gmail.com gha.jid $JID languages en+,en-GB- ou "$newou"
-          run_gam user $newuser add license workspaceenterpriseplus
           run_gam user $newuser update photo https://dummyimage.com/98x98/000/fff.jpg
           run_gam user $newuser get photo
           run_gam user $newuser delete photo
           run_gam create alias $newalias user $newuser
           run_gam create group $newgroup name "GHA $JID group" description "This is a description" isarchived true
           run_gam user $gam_user sendemail recipient dev-null@pdl.jaylee.us subject "test message $newbase" message "GHA test message"
+          run_gam user $newuser add license workspaceenterpriseplus
+          run_gam update user $newuser ou root # GAM synonym for / root OU 
+          run_gam update user $newuser ou "$newou"
           run_gam config enable_dasa false save
           # don't expose policy output
           run_gam show policies > policies.csv

.github/workflows/upgrade_deps.yml

@@ -0,0 +1,144 @@
+name: Daily Dependency Pinning (2-Week Buffer)
+
+on:
+  schedule:
+    # Runs every day at midnight UTC
+    - cron: '0 0 * * *'
+  workflow_dispatch: # Allows you to trigger it manually from the UI
+
+jobs:
+  pin-deps:
+    runs-on: ubuntu-slim
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: '3.14'
+
+      - name: Calculate and pin two-week old stable versions
+        shell: python
+        run: |
+          import json
+          import urllib.request
+          import re
+          import tomllib
+          from datetime import datetime, timedelta, timezone
+          from pathlib import Path
+
+          toml_path = Path("pyproject.toml")
+          if not toml_path.exists():
+              print("pyproject.toml not found!")
+              exit(1)
+
+          content = toml_path.read_text(encoding="utf-8")
+          parsed_toml = tomllib.loads(content)
+          
+          target_deps = set()
+          
+          # Standard [project.dependencies]
+          target_deps.update(parsed_toml.get("project", {}).get("dependencies", []))
+          
+          # Optional [project.optional-dependencies]
+          for deps in parsed_toml.get("project", {}).get("optional-dependencies", {}).values():
+              target_deps.update(deps)
+              
+          # Dev [dependency-groups] (uv / PEP 735 standard)
+          for deps in parsed_toml.get("dependency-groups", {}).values():
+              if isinstance(deps, list):
+                  for d in deps:
+                      if isinstance(d, str):
+                          target_deps.add(d)
+
+          if not target_deps:
+              print("No dependencies found to process.")
+              exit(0)
+
+          updates = {}
+          two_weeks_ago = datetime.now(timezone.utc) - timedelta(days=14)
+          print(f"Evaluating dependencies against cutoff date: {two_weeks_ago.isoformat()}")
+
+          for dep in target_deps:
+              # Isolate base package name (e.g., "yubikey-manager>=5.6.1" -> "yubikey-manager")
+              pkg_name = re.split(r'[<>=!~;\s]', dep)[0].strip()
+              
+              # Preserve environment markers if they exist
+              marker = ""
+              if ";" in dep:
+                  marker = " ; " + dep.split(";", 1)[1].strip()
+
+              print(f"Fetching PyPI data for: {pkg_name}")
+              try:
+                  url = f"https://pypi.org/pypi/{pkg_name}/json"
+                  req = urllib.request.Request(url, headers={'User-Agent': 'GAM-CI-Script'})
+                  with urllib.request.urlopen(req) as response:
+                      data = json.loads(response.read().decode())
+                  
+                  valid_versions = []
+                  for ver, files in data.get("releases", {}).items():
+                      if not files:
+                          continue
+                      
+                      upload_time_str = files[0].get("upload_time_iso_8601")
+                      if not upload_time_str:
+                          continue
+                      
+                      if upload_time_str.endswith('Z'):
+                          upload_time_str = upload_time_str[:-1] + '+00:00'
+                      
+                      upload_time = datetime.fromisoformat(upload_time_str)
+                      
+                      # Filter: Must be older than 2 weeks and not a pre-release
+                      if upload_time <= two_weeks_ago and not any(x in ver.lower() for x in ['a', 'b', 'rc', 'dev']):
+                          valid_versions.append((upload_time, ver))
+                  
+                  if valid_versions:
+                      # Sort by upload time descending to get the newest valid option
+                      valid_versions.sort(key=lambda x: x[0], reverse=True)
+                      target_version = valid_versions[0][1]
+                      
+                      pinned_dep = f"{pkg_name}=={target_version}{marker}"
+                      if pinned_dep != dep:
+                          updates[dep] = pinned_dep
+                          print(f"  -> Pinning: '{dep}' => '{pinned_dep}'")
+                      else:
+                          print(f"  -> Already pinned correctly to {target_version}")
+                  else:
+                      print(f"  -> No valid historical versions found.")
+                      
+              except urllib.error.HTTPError as e:
+                  print(f"  -> Package not found on PyPI or HTTP error: {e}")
+              except Exception as e:
+                  print(f"  -> Error processing {pkg_name}: {e}")
+
+          # 3. Replace the strings safely in the original file content
+          new_content = content
+          for old_dep, new_dep in updates.items():
+              # Regex targets the exact string inside either single or double quotes
+              # Using a lambda replacement ensures we don't trip over escape sequences in the new string
+              escaped_old = re.escape(old_dep)
+              pattern = r'([\'"])' + escaped_old + r'\1'
+              new_content = re.sub(pattern, lambda m: m.group(1) + new_dep + m.group(1), new_content)
+
+          # Write changes back to pyproject.toml
+          if content != new_content:
+              toml_path.write_text(new_content, encoding="utf-8")
+              print("\npyproject.toml updated successfully.")
+          else:
+              print("\nNo updates required.")
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "chore: upgrade PyPi deps"
+          title: "Upgrade PyPi deps"
+          body: "Automated scan checking PyPI for package versions at least 2 weeks old."
+          branch: sys-deps-upgrade
+          force: false # Standard push, plays nice with rulesets

README.md

@@ -16,7 +16,7 @@ this will download GAM, install it and start setup.
 
 ## Windows
 
-Download the MSI Installer from the [GitHub Releases] page. Install the MSI and you'll be prompted to setup GAM.
+Download the EXE Installer from the [GitHub Releases] page. Run it and you'll be prompted to setup GAM.
 
 ## Use your own Python
 If you'd prefer to install GAM as a Python package you can install with pip:

dep-overrides.txt

@@ -0,0 +1,6 @@
+# overrides uv.lock to force newer dependencies
+# when old deps are vulnerable. These should be set
+# to expire after 2 weeks when the fixed version will
+# be automatically picked up anyway.
+# Format: package_requirement | MM/DD/YYYY
+urllib3>=2.7.0 | 05/22/2026

pyproject.toml

@@ -4,26 +4,24 @@ dynamic = [
     "version",
 ]
 authors = [
-    { name="Jay Lee", email="jay0lee@gmail.com" },
+    { name = "Jay Lee", email = "jay0lee@gmail.com" },
-    { name="Ross Scroggs", email="Ross.Scroggs@gmail.com" },
+    { name = "Ross Scroggs", email = "Ross.Scroggs@gmail.com" },
 ]
-# notice that yubikey-manager remains optional further down since it is less command and adds
-#significant compile dependencies.
 dependencies = [
-    "arrow>=1.3.0",
+    "arrow==1.4.0",
-    "chardet==5.2.0",
+    "chardet==7.4.3",
-    "cryptography>=46.0.5",
+    "cryptography==47.0.0",
-    "distro; sys_platform=='linux'",
+    "distro==1.9.0 ; sys_platform=='linux'",
-    "filelock>=3.18.0",
+    "filelock==3.29.0",
-    "google-api-python-client>=2.167.0",
+    "google-api-python-client==2.195.0",
-    "google-auth-httplib2>=0.2.0",
+    "google-auth-httplib2==0.3.1",
-    "google-auth-oauthlib>=1.2.2",
+    "google-auth-oauthlib==1.3.1",
-    "google-auth>=2.39.0",
+    "google-auth==2.50.0",
-    "httplib2>=0.31.0",
+    "httplib2==0.31.2",
-    "lxml>=5.4.0",
+    "lxml==6.1.0",
-    "passlib>=1.7.4",
+    "passlib==1.7.4",
-    "pathvalidate>=3.2.3",
+    "pathvalidate==3.3.1",
-    "pysocks>=1.7.1",
+    "pysocks==1.7.1",
 ]
 description = "CLI tool to manage Google Workspace"
 readme = "README.md"
@@ -38,11 +36,17 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
     "Operating System :: OS Independent",
 ]
-license = {text = "Apache License (2.0)"}
+license-files = [
-license-files = ["LICEN[CS]E*"]
+    "LICEN[CS]E*",
+]
+
+[project.license]
+text = "Apache License (2.0)"
 
 [project.optional-dependencies]
-yubikey = ["yubikey-manager>=5.6.1"]
+yubikey = [
+    "yubikey-manager==5.9.1",
+]
 
 [project.scripts]
 gam = "gam.__main__:main"
@@ -57,7 +61,9 @@ Chat = "https://git.io/gam-chat"
 path = "src/gam/__init__.py"
 
 [tool.hatch.build.targets.wheel]
-packages = ["src/gam"]
+packages = [
+    "src/gam",
+]
 
 [build-system]
 requires = [

src/GamCommands.txt

@@ -260,6 +260,7 @@ If an item contains spaces, it should be surrounded by ".
         4tb | drive4tb | googledrivestorage4tb | Google-Drive-storage-4TB |
         8tb | drive8tb | googledrivestorage8tb | Google-Drive-storage-8TB |
         16tb | drive16tb | googledrivestorage16tb | Google-Drive-storage-16TB |
+        aiexpandedaccess | 1010470009 | AI Expanded Access |
         aimeetingsandmessaging | 1010470007 | AI Meetings and Messaging |
         aisecurity | 1010470006 | AI Security |
         appsheetcore | 1010380001 | AppSheet Core |
@@ -278,7 +279,7 @@ If an item contains spaces, it should be surrounded by ".
         gaiproedu | geminiedu | 1010470004 | Google AI Pro for Education |
         geminibiz | 1010470003 | Gemini Business |
         geminiedupremium| 1010470005 | Gemini Education Premium |
-        geminient| duetai | 1010470001 | Gemini Enterprise |
+        geminient| duetai | 1010470001 | Gemini Enterprise - Legacy |
         geminiultra | 1010470008 | Google AI Ultra for Business |
         gsuitebasic | gafb | gafw | basic | Google-Apps-For-Business |
         gsuitebusiness | gau | gsb | unlimited | Google-Apps-Unlimited |
@@ -915,6 +916,8 @@ Specify a collection of Users by directly specifying them or by specifying items
 
 <UserTypeEntity> ::=
         (all users|users_na|users_arch|users_ns|users_susp|users_arch_or_susp|users_na_ns|users_ns_susp)|
+        (all guests|guests_ns|guests_susp|guests_ns_susp)|
+        (all users_and_guests|users_and_guests_ns|users_and_guests_susp|users_and_guests_ns_susp)|
         (user <UserItem>)|
         (users <UserList>)|
         (oauthuser)
@@ -1350,9 +1353,12 @@ verify
 ## File Redirection
 
 If the pattern {{Section}} appears in <FileName>, it will be replaced with the name of the current section.
-For redirect csv, the optional arguments must appear in the order shown.
+
+For redirect csv, the optional arguments can be specfified in any order but `todrive <ToDriveAttribute>*`
+must be last.
+
 <Redirect> ::=
-        redirect csv <FileName> [multiprocess] [append] [noheader] [charset <Charset>]
+        redirect csv <FileName> [delayopen] multiprocess] [append] [noheader] [charset <Charset>]
                      [columndelimiter <Character>] [quotechar <Character>] [noescapechar [<Boolean>]]
                      [sortheaders <StringList>] [timestampcolumn <String>] [transpose [<Bopolean>]]
                      [todrive <ToDriveAttribute>*] |
@@ -1714,6 +1720,7 @@ gam calendar <CalendarEntity> printacl [todrive <ToDriveAttribute>*]
 
 <EventMatchProperty> ::=
         (matchfield attendees <EmailAddressEntity>)|
+        (matchfield attendeesorganizer <Boolean> <EmailAddressEntity>)|
         (matchfield attendeesonlydomainlist <DomainNameList>)|
         (matchfield attendeesdomainlist <DomainNameList>)|
         (matchfield attendeesnotdomainlist <DomainNameList>)|
@@ -2462,9 +2469,9 @@ gam print chromehistory releases [todrive <ToDriveAttribute>*]
         pre_provisioned_reenable
 
 gam update cros <CrOSEntity> action <CrOSAction> [acknowledge_device_touch_requirement]
-        [actionbatchsize <Integer>]
+        [actionbatchsize <Integer>] [maxtodeprov <Integer>]
 gam <CrOSTypeEntity> update action <CrOSAction> [acknowledge_device_touch_requirement]
-        [actionbatchsize <Integer>]
+        [actionbatchsize <Integer>] [maxtodeprov <Integer>]
 
 <CrOSCommand>
         reboot|
@@ -3161,6 +3168,7 @@ gam <UserTypeEntity> show contactdelegates [shownames] [csv]
         name|
         owneremail|
         ownerid|
+        ownername|
         room|
         section|
         students|
@@ -3274,16 +3282,16 @@ gam courses <CourseEntity> sync teachers [addonly|removeonly] [makefirstteachero
 gam courses <CourseEntity> sync students [addonly|removeonly] <UserTypeEntity>
 
 gam info course <CourseID> [owneraccess]
-        [owneremail] [alias|aliases] [show all|students|teachers] [countsonly]
+        [owneremail] [ownername] [alias|aliases] [show all|students|teachers] [countsonly]
         [fields <CourseFieldNameList>] [skipfields <CourseFieldNameList>]
         [formatjson]
 gam info courses <CourseEntity> [owneraccess]
-        [owneremail] [alias|aliases] [show all|students|teachers] [countsonly]
+        [owneremail] [ownername] [alias|aliases] [show all|students|teachers] [countsonly]
         [fields <CourseFieldNameList>] [skipfields <CourseFieldNameList>]
         [formatjson]
 gam print courses [todrive <ToDriveAttribute>*]
         (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] [states <CourseStateList>])
-        [owneremail] [owneremailmatchpattern <REMatchPattern>]
+        [owneremail] [owneremailmatchpattern <REMatchPattern>] [ownername]
         [alias|aliases|aliasesincolumns [delimiter <Character>]]
         [show all|students|teachers] [countsonly]
         [timefilter creationtime|updatetime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
@@ -3397,14 +3405,16 @@ gam print course-announcements [todrive <ToDriveAttribute>*]
         (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] states <CourseStateList>])
         (announcementids <CourseAnnouncementIDEntity>)|((announcementstates <CourseAnnouncementStateList>)*
         (orderby <CourseAnnouncementOrderByFieldName> [ascending|descending])*)
-        [showcreatoremails|creatoremail] [fields <CourseAnnouncementFieldNameList>]
+        [showcreatoremails|creatoremail] [showcreatornames|creatorname]
+        [fields <CourseAnnouncementFieldNameList>]
         [timefilter creationtime|updatetime|scheduledtime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
         [countsonly] [formatjson [quotechar <Character>]]
 gam print course-materials [todrive <ToDriveAttribute>*]
         (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] states <CourseStateList>])
         (materialids <CourseMaterialIDEntity>)|((materialstates <CourseMaterialStateList>)*
         (orderby <CourseMaterialOrderByFieldName> [ascending|descending])*)
-        [showcreatoremails|creatoremail] [showtopicnames] [fields <CourseMaterialFieldNameList>]
+        [showcreatoremails|creatoremail] [showcreatornames|creatorname] [showtopicnames]
+        [fields <CourseMaterialFieldNameList>]
         [timefilter creationtime|updatetime|scheduledtime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
         [oneitemperrow]
         [countsonly] [formatjson [quotechar <Character>]]
@@ -3425,7 +3435,8 @@ gam print course-works [todrive <ToDriveAttribute>*]
         (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] states <CourseStateList>])
         (workids <CourseWorkIDEntity>)|((workstates <CourseWorkStateList>)*
         (orderby <CourseWorkOrderByFieldName> [ascending|descending])*)
-        [showcreatoremails|creatoremail] [showtopicnames] [fields <CourseWorkFieldNameList>]
+        [showcreatoremails|creatoremail] [showcreatornames|creatorname] [showtopicnames]
+        [fields <CourseWorkFieldNameList>]
         [showstudentsaslist [<Boolean>]] [delimiter <Character>]
         [timefilter creationtime|updatetime|scheduledtime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
         [oneitemperrow]
@@ -3513,13 +3524,6 @@ gam print guardian|guardians [todrive <ToDriveAttribute>*] [accepted|invitations
         [showstudentemails]
         [formatjson [quotechar <Character>]]
 
-# Business Profile Accounts
-
-gam show businessprofileaccounts
-        [type locationgroup|organization|personal|usergroup]
-gam print businessprofileaccounts [todrive <ToDriveAttribute>*]
-        [type locationgroup|organization|personal|usergroup]
-
 # Classroom User Profiles
 
 gam <UserTypeEntity> print classroomprofile [todrive <ToDriveAttribute>*]
@@ -3832,6 +3836,7 @@ gam audit monitor list <EmailAddress>
         (sendmessagedenynotification <Boolean>)|
         (spammoderationlevel allow|moderate|silently_moderate|reject)|
         (whocanadd all_members_can_add|all_managers_can_add|all_owners_can_add|none_can_add)|
+        (whocanaddexternalmembers only_owners_can_add_external_members|end_users_can_add_external_members)|
         (whocancontactowner anyone_can_contact|all_in_domain_can_contact|all_members_can_contact|all_managers_can_contact|all_owners_can_contact)|
         (whocanjoin anyone_can_join|all_in_domain_can_join|invited_can_join|can_request_to_join)|
         (whocanleavegroup all_members_can_leave|all_managers_can_leave|all_owners_can_leave|none_can_leave)|
@@ -3889,7 +3894,10 @@ gam audit monitor list <EmailAddress>
 gam create|add group <EmailAddress>
         [copyfrom <GroupItem>] <GroupAttribute>*
         [verifynotinvitable]
+        [recentdeleteretries <Integer>] [recentdeleteretrydelay <Integer>]
+        [verifycreationretries <Integer>] [verifycreationinitialdelay <Integer>] [verifycreationretrydelay <Integer>]
 gam update group|groups <GroupEntity> [email <EmailAddress>]
+        [updateprimaryemail <RESearchPattern> <RESubstitution>]
         [copyfrom <GroupItem>] <GroupAttribute>*
         [security|makesecuritygroup]
         [admincreated <Boolean>]
@@ -3960,6 +3968,7 @@ gam delete group|groups <GroupEntity> [noactionifalias]
         spammoderationlevel|
         whocanaddreferences|
         whocanadd|
+        whocanaddexternalmembers|
         whocanapprovemessages|
         whocanassigntopics|
         whocanassistcontent|
@@ -4117,6 +4126,7 @@ gam create cigroup <EmailAddress>
         [security|makesecuritygroup] [locked]
         [dynamic <QueryDynamicGroup>]
 gam update cigroup <GroupEntity> [copyfrom <GroupItem>] <GroupAttribute>
+        [updateprimaryemail <RESearchPattern> <RESubstitution>]
         [security|makesecuritygroup|
          dynamicsecurity|makedynamicsecuritygroup|
          lockedsecurity|makelockedsecuritygroup]
@@ -5208,7 +5218,6 @@ gam create|add permissions <SharedDriveEntityAdmin> <DriveFilePermissionEntity>
         <PermissionMatch>* [<PermissionMatchAction>]
 gam delete permissions <SharedDriveEntityAdmin> <DriveFilePermissionIDEntity>
         <PermissionMatch>* [<PermissionMatchAction>]
-        [enforceexpansiveaccess [<Boolean>]]
 
 In these commands, you specify an administrator and then indicate that you want domain administrator access with the adminaccess option.
 
@@ -5222,11 +5231,9 @@ gam <UserTypeEntity> create|add drivefileacl <SharedDriveEntityAdmin>
         adminaccess
 gam <UserTypeEntity> update drivefileacl <SharedDriveEntityAdmin> <DriveFilePermissionIDorEmail>
         (role <DriveFileACLRole>) [expires|expiration <Time>] [removeexpiration [<Boolean>]]
-        [enforceexpansiveaccess [<Boolean>]]
         [showtitles] [nodetails|(csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]])]
         adminaccess
 gam <UserTypeEntity> delete drivefileacl <SharedDriveEntityAdmin> <DriveFilePermissionIDorEmail>
-        [enforceexpansiveaccess [<Boolean>]]
         [showtitles] adminaccess
 gam <UserTypeEntity> info drivefileacl <SharedDriveEntityAdmin> <DriveFilePermissionIDorEmail> adminaccess
         [showtitles]
@@ -5252,7 +5259,6 @@ gam <UserTypeEntity> create|add permissions <SharedDriveEntityAdmin> <DriveFileP
         <PermissionMatch>* [<PermissionMatchAction>]
 gam <UserTypeEntity> delete permissions <SharedDriveEntityAdmin> <DriveFilePermissionIDEntity> adminaccess
         <PermissionMatch>* [<PermissionMatchAction>]
-        [enforceexpansiveaccess [<Boolean>]]
 
 In these commands, the Google administrator named in oauth2.txt is used.
 
@@ -5494,6 +5500,7 @@ gam print vaultcounts [todrive <ToDriveAttributes>*]
         [excludedrafts <Boolean>]
         [<JSONData>]
         [wait <Integer>]
+        [include_suspended_zeros [<Boolean>]]
 gam print vaultcounts [todrive <ToDriveAttributes>*]
         matter <MatterItem> operation <String> [wait <Integer>]
 
@@ -5764,7 +5771,7 @@ gam download storagefile <StorageBucketObjectName>
         (language clear|<LanguageList>)|
         (lastname|familyname <String>)|
         (note clear|([text_html|text_plain] <UserNoteContent))|
-        (ou|org|orgunitpath <OrgUnitPath>|<OrgUnitID>)
+        (ou|org|orgunitpath <OrgUnitPath>|<OrgUnitID>|root)
         (password (random [<Integer>])|(uniquerandom [<Integer>])|
                    blocklogin|
                    prompt|uniqueprompt|
@@ -6101,6 +6108,13 @@ gam <UserTypeEntity> show backupcodes|verificationcodes
 gam <UserTypeEntity> print backupcodes|verificationcodes [todrive <ToDriveAttribute>*]
         [delimiter <Character>] [countsonly]
 
+# Users - Business Profile Accounts
+
+gam <UserTypeEntity> show businessprofileaccounts
+        [type locationgroup|organization|personal|usergroup]
+gam <UserTypeEntity> print businessprofileaccounts [todrive <ToDriveAttribute>*]
+        [type locationgroup|organization|personal|usergroup]
+
 # Users - Calendars
 
 <CalendarACLRole> ::= editor|freebusy|freebusyreader|owner|reader|writer
@@ -6531,7 +6545,8 @@ gam <UserTypeEntity> create chatspace
         [description <String>] [guidelines <String>]
         [history <Boolean>]
         [<ChatContent>]
-        [formatjson|returnidonly]
+        [(csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]] (addcsvdata <FieldName> <String>)*) | formatjson | returnidonly]
+
 gam <UserTypeEntity> update chatspace <ChatSpace>
         [restricted|(audience <String>)]|
         ([displayname <String>]
@@ -6971,7 +6986,6 @@ gam <UserTypeEntity> copy drivefile <DriveFileEntity>
         [sendemailifrequired [<Boolean>]]
         [suppressnotselectedmessages [<Boolean>]]
         [verifyorganizer [<Boolean>]]
-        [enforceexpansiveaccess [<Boolean>]]
 
 gam <UserTypeEntity> move drivefile <DriveFileEntity> [newfilename <DriveFileName>]
         [summary [<Boolean>]] [showpermissionmessages [<Boolean>]]
@@ -6996,7 +7010,6 @@ gam <UserTypeEntity> move drivefile <DriveFileEntity> [newfilename <DriveFileNam
         [retainsourcefolders [<Boolean>]]
         [sendemailifrequired [<Boolean>]]
         [verifyorganizer [<Boolean>]]
-        [enforceexpansiveaccess [<Boolean>]]
 
 gam <UserTypeEntity> get document <DriveFileEntity>
         [viewmode default|suggestions_inline|preview_suggestions_accepted|preview_without_suggestions]
@@ -7021,7 +7034,7 @@ gam <UserTypeEntity> untrash drivefile <DriveFileEntity> [shortcutandtarget [<Bo
 
 gam <UserTypeEntity> info drivefile <DriveFileEntity>
         [returnidonly]
-        [filepath|fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [filepath|fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
         [allfields|<DriveFieldName>*|(fields <DriveFieldNameList>)]
         [includepermissionsforview published]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])*
@@ -7103,10 +7116,10 @@ gam <UserTypeEntity> create|add drivefileacl <DriveFileEntity> [adminaccess|asad
         [showtitles] [nodetails|(csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]])]
 gam <UserTypeEntity> update drivefileacl <DriveFileEntity> <DriveFilePermissionIDorEmail>
         (role <DriveFileACLRole>) [expires|expiration <Time>] [removeexpiration [<Boolean>]]
-        [updatesheetprotectedranges [<Boolean>]] [enforceexpansiveaccess [<Boolean>]]
+        [updatesheetprotectedranges [<Boolean>]]
         [showtitles] [nodetails|(csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]])]
 gam <UserTypeEntity> delete drivefileacl <DriveFileEntity> <DriveFilePermissionIDorEmail>
-        [updatesheetprotectedranges [<Boolean>]] [enforceexpansiveaccess [<Boolean>]]
+        [updatesheetprotectedranges [<Boolean>]]
         [showtitles]
 gam <UserTypeEntity> info drivefileacl <DriveFileEntity> <DriveFilePermissionIDorEmail>
         [showtitles]
@@ -7230,7 +7243,6 @@ gam <UserTypeEntity> print filerevisions <DriveFileEntity> [todrive <ToDriveAttr
 
 gam <UserTypeEntity> transfer ownership <DriveFileEntity> <UserItem>
         [<DriveFileParentAttribute>] [includetrashed] [norecursion [<Boolean>]]
-        [enforceexpansiveaccess [<Boolean>]]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])*
         [preview] [filepath] [pathdelimiter <Character>] [buildtree]
         [todrive <ToDriveAttribute>*]
@@ -7239,7 +7251,6 @@ gam <UserTypeEntity> claim ownership <DriveFileEntity>
         [skipids <DriveFileEntity>] [onlyusers|skipusers <UserTypeEntity>] [subdomains <DomainNameEntity>]
         [restricted [<Boolean>]] [writerscanshare|writerscantshare [<Boolean>]]
         [keepuser | (retainrole commenter|reader|writer|editor|fileorganizer|none)] [noretentionmessages]
-        [enforceexpansiveaccess [<Boolean>]]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])*
         [preview] [filepath] [pathdelimiter <Character>] [buildtree]
         [todrive <ToDriveAttribute>*]
@@ -7247,7 +7258,6 @@ gam <UserTypeEntity> claim ownership <DriveFileEntity>
 gam <UserTypeEntity> transfer drive <UserItem> [select <DriveFileEntity>]
         [(targetfolderid <DriveFolderID>)|(targetfoldername <DriveFolderName>)]
         [targetuserfoldername <DriveFolderName>] [targetuserorphansfoldername <DriveFolderName>]
-        [enforceexpansiveaccess [<Boolean>]]
         [mergewithtarget [<Boolean>]]
         [skipids <DriveFileEntity>]
         [keepuser | (retainrole reader|commenter|writer|editor|fileorganizer|none)] [noretentionmessages]
@@ -7505,7 +7515,7 @@ gam <UserTypeEntity> collect orphans
 
 gam <UserTypeEntity> show fileinfo <DriveFileEntity>
         [returnidonly]
-        [filepath|fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [filepath|fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
         [allfields|<DriveFieldName>*|(fields <DriveFieldNameList>)]
         [includepermissionsforview published]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])*
@@ -7519,12 +7529,12 @@ gam <UserTypeEntity> show filepath <DriveFileEntity>
         [returnpathonly]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])*
         [stripcrsfromname]
-        [fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
         [followshortcuts [<Boolean>]]
 gam <UserTypeEntity> print filepath <DriveFileEntity> [todrive <ToDriveAttribute>*]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])*
         [stripcrsfromname] [oneitemperrow]
-        [fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
         [followshortcuts [<Boolean>]]
 
 gam <UserTypeEntity> print filecounts [todrive <ToDriveAttribute>*]
@@ -7627,7 +7637,7 @@ gam <UserTypeEntity> print filelist [todrive <ToDriveAttribute>*]
         [countsonly [summary none|only|plus] [summaryuser <String>]
                     [showsource] [showsize] [showsizeunits] [showmimetypesize]]
         [countsrowfilter]
-        [filepath|fullpath [folderpathonly [<Boolean>]] [pathdelimiter <Character>] [addpathstojson] [showdepth]] [buildtree]
+        [filepath|fullpath [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>] [addpathstojson] [showdepth]] [buildtree]
         [allfields|<DriveFieldName>*|(fields <DriveFieldNameList>)]
         [showdrivename] [showshareddrivepermissions]
         [(showlabels details|ids)|(includelabels <ClassificationLabelIDList>)]
@@ -7665,7 +7675,7 @@ gam <UserTypeEntity> print driveactivity [todrive <ToDriveAttribute>*]
          (drivefilename <DriveFileName>) | (drivefoldername <DriveFolderName>) | (query <QueryDriveFile>)]
         [([start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>])|(range <Date>|<Time> <Date>)|<Time>|
          yesterday|today|thismonth|(previousmonths <Integer>)]
-        [action|actions [not] <DriveActivityActionList>]
+        [action|actions [not] <DriveActivityActionList>] [maxactivities <Number>]
         [consolidationstrategy legacy|none]
         [idmapfile <CSVFileInput> endcsv]
         [stripcrsfromname] [formatjson [quotechar <Character>]]

src/GamUpdate.txt

@@ -1,3 +1,227 @@
+7.43.05
+
+Added option `matchfield attendeesorganizer <Boolean> <EmailAddressEntity>` to `<EventMatchProperty>`
+that is used in commands that process events. The match is true if all of the addresses in `<EmailAddressEntity>`
+are present as attendees in the event and are an organizer or not based on `<Boolean>`.
+
+Added option `max_to_deprov <Integer>` to `gam update cros <CrOSEntity> action <CrOSAction>`
+that is used when `<CrOSAction>` is any of the following:
+```
+deprovision_different_model_replace|
+deprovision_different_model_replacement|
+deprovision_retiring_device|
+deprovision_same_model_replace|
+deprovision_same_model_replacement|
+deprovision_upgrade_transfer
+```
+`max_to_deprov <Integer>` - No deprovisions are processed if the number of devices in `<CrOSEntity>` exceeds `<Integer>`;
+the default value is one; set `<Integer>` to 0 for no limit.
+
+7.43.04
+
+Added option `include_suspended_zeros [<Boolean>]` to `gam print vaultcounts` that causes
+GAM to generate zero count lines for suspended users with zero items as well as non-suspended users.
+
+7.43.03
+
+Added option `parentpathonly [<Boolean>]` to the following commands that causes GAM
+to display only the parent folder names when displaying the path to a file.
+```
+gam <UserTypeEntity> info drivefile ... filepath|fullpath
+gam <UserTypeEntity> show fileinfo ... filepath|fullpath
+gam <UserTypeEntity> print|show filepath
+gam <UserTypeEntity> print filelist ... filepath|fullpath
+```
+
+7.43.02
+
+Added option `maxactivities <Integer>` to `gam <UserTypeEntity> print driveactivity` to limit
+the number of activities displayed; the default is 0, no limit.
+
+7.43.01
+
+Updated `gam info user` and `gam print users` to display guest user attributes: `isGuestUser, guestAccountInfo`
+
+Expanded `<UserTypeEntity>` to allow specification of guest users.
+  * See [Collections of Users](Collections-of-Users)
+
+7.42.00
+
+In versions prior to 7.42.00, when `redirect csv <FileName>` was used, GAM did not open and write `<FileName>`
+until all processing was complete; if `<FileName>` was not accessible, an error was generated
+and no results were saved. Now, `<FileName>` is opened initially to verify accessiblity
+and then written when processing is complete.
+
+In the unlikely event that this causes issues, you can do `redirect csv <FileName> delayopen`
+to get the previous behavior.
+
+7.41.03
+
+Fixed bug in the following:
+Added the following to `<RowValueFilter>` used in CSV input/output row filtering; these are
+synonyms for `count` and `countrange`.
+```
+[(any|all):]number<Operator><Number>|
+[(any|all):]numberrange!=<Number>/<Number>|
+[(any|all):]numberrange=<Number>/<Number>|
+```
+
+7.41.02
+
+Added option `ownername` to `gam info|print courses` to have GAM display the course owners full name;
+there is an extra API call per course to get the name.
+
+Added option `creatorname` to `gam print course-announcements|course-materials|course-works` to have
+GAM display the item creators full name; there is an extra API call per course to get the name.
+
+After creating a group, it may be sometime, e.g. 30-45 seconds, before members can
+successfully be added to the group even though the API reported that the group was created.
+The following options can be used with `gam create group` to verify that the group is actually ready to be updated.
+This will be most useful in scripts that are used to create and then populate groups.
+```
+verifycreationretries <Integer> - Verify group creation, defaults to 0, no verification performed, range 0-20
+verifycreationinitialdelay <Integer> - Number of seconds to delay before first verification performed, defaults to 5, range 0-60
+verifycreationretrydelay <Integer> - Number of seconds to delay between verificaton retries, defaults to 5, range 1-60
+```
+
+If you have a script that deletes a group and then immediately tries to create a new group with the same email address,
+you may run into issues. There seems to be a 30-45 second window after the deletion in which a couple
+of strange errors can occur on the creation: `Resource not found` and `Duplicate`.
+The following options can be used with `gam create group` to handle these errors. This will be most useful
+in scripts that are used to delete and then immediately  recreate groups.
+```
+recentdeleteretries <Integer> - Handle group delete/create errors, defaults to 0, no errors handled, range 0-20
+recentdeleteretrydelay <Integer> - Number of seconds to delay between retries, defaults to 5, range 1-60
+```
+
+Added the following to `<RowValueFilter>` used in CSV input/output row filtering; these are
+synonyms for `count` and `countrange`.
+```
+[(any|all):]number<Operator><Number>|
+[(any|all):]numberrange!=<Number>/<Number>|
+[(any|all):]numberrange=<Number>/<Number>|
+```
+
+7.41.01
+
+Fixed bug in `gam print cigroups members managers owners countsonly totalcount internal external` that caused a trap.
+
+7.41.00
+
+Upgraded to Python 3.14.4 and OpenSSL 4.0.0.
+
+7.40.03
+
+Added option `whocanaddexternalmembers only_owners_can_add_external_members|end_users_can_add_external_members` to `<GroupSettingsAttribute>`.
+It appears that `allowexternalmembers true` must be set in the same command.
+Added option `whocanaddexternalmembers` to `<GroupFieldName>`.
+These options are not in general release as of 2026-04-13; experiment.
+
+7.40.02
+
+Updated `gam info|print cigroups` and `gam print|show cigroup-members` to handle trap caused
+by API returning invalid member data; `preferredMemberKey` with no `id`.
+
+7.40.01
+
+Updated `gam <UserTypeEntity> print filelist|filecounts` to handle the `permissionDetails` subfield
+of the `permissions` field for My Drives; this useful when trying to display permission inheritance.
+An additional API call per file is required to get the `permissionDetails` subfield.
+```
+gam user user@domain.com print filelist fields id,name,mimetype,basicpermissions,permissiondetails oneitemperrow
+gam user user@domain.com print filelist fields id,name,mimetype,basicpermissions,permissiondetails pm inherited false em pmfilter oneitemperrow
+```
+
+7.40.00
+
+Updated `gam print|show businessprofileaccounts` (client access) to
+`gam <UserTypeEntity> print|show businessprofileaccounts` (service account access).
+You'll need to run `gam user user@domain.com update serviceaccount` and
+select `2)  Business Account Management API`.
+
+7.39.08
+
+Fixed bug in `gam oauth create` that caused a trap when `0)  Business Account Management API` was selected.
+
+Upgraded to Python 3.14.4 on macOS and Windows; Linux is still 3.14.3.
+
+7.39.07
+
+Upgraded to OpenSSL 3.6.2.
+
+7.39.06
+
+Fixed bug in `gam version checkrc`.
+
+7.39.05
+
+Added optional argument `preview` to `updateprimaryemail <RegularExpression> <EmailReplacement> [preview]`
+for the following commands that causes GAM to preview, but not perform, primary email address changes.
+This allows verification of the primary email address changes before commiting the changes.
+```
+gam update group <GroupEntity>
+gam update cigroup <GroupEntity>
+gam <UserTypeEntity> update user
+```
+
+7.39.04
+
+Added `updateprimaryemail <RegularExpression> <EmailReplacement>` option to
+`gam update group <GroupEntity>` and `gam update cigroup <GroupEntity>` to allow modifying
+the group's current primary email address.
+For example, to change the domain of a set of groups from the current domain.com to newdomain.com:
+```
+gam update group csvfile Groups.csv:email updateprimaryemail "^(.+)@domain.com$" "\1@newdomain.com"
+```
+
+7.39.03
+
+Added the following options to `gam <UserTypeEntity> create chatspace` that can be used to capture
+space details when creating chat spaces in bulk.
+```
+csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]] (addcsvdata <FieldName> <String>)*
+```
+
+See: https://github.com/GAM-team/GAM/wiki/Users-Chat#bulk-build-chat-spaces
+
+7.39.02
+
+Fixed progress messages for `gam <UserTypeEntity> print filelist` when permissions were being
+displayed/matched for Shared Drives.
+
+7.39.01
+
+Updated `gam <UserTypeEntity> transfer drive <UserItem>` to handle the following error:
+```
+ERROR: 403: cannotDeletePermission - The authenticated user cannot delete the permission.
+```
+
+7.39.00
+
+Deleted variable `enforce_expansive_access` from `gam.cfg` and removed option `enforceexpansiveaccess`
+from the following commands as expansive access is now always enforced by Google on My Drives.
+```
+gam <UserTypeEntity> delete permissions
+gam <UserTypeEntity> delete drivefileacl
+gam <UserTypeEntity> update drivefileacl
+gam <UserTypeEntity> copy drivefile
+gam <UserTypeEntity> move drivefile
+gam <UserTypeEntity> transfer ownership
+gam <UserTypeEntity> claim ownership
+```
+
+7.38.02
+
+Added license SKU `1010470009` for `AI Expanded Access`; abbreviation `aiexpandedaccess`.
+
+Renamed license SKU `1010470001` from `Gemini Enterprise` to `Gemini Enterprise - Legacy`.
+
+7.38.01
+
+Added `root` as a synonym for '/' in command line arguments that specify an OU.
+This is to avoid issues where a stand-alone `/` on the command line may be mis-interpreted
+by the command line interpreter as a reference to the file system root.
+
 7.38.00
 
 Added variable `gcp_org_id` to `gam.cfg` that is used by the following commands;

src/gam.py

@@ -11,5 +11,7 @@ from gam.__main__ import main
 if __name__ == '__main__':
   if platform.system() != 'Linux':
     multiprocessing.freeze_support()
+  # Python 3.14.4 and PyInstaller 6.19.0 don't play nice with Linux forkserver
+  # use spawn everywhere for now.
   multiprocessing.set_start_method('spawn', force=True)
   main()

src/gam/__main__.py

@@ -36,10 +36,13 @@ def main():
 if __name__ == '__main__':
   if getattr(sys, 'frozen', False): # we're frozen:
     multiprocessing.freeze_support()
-  if platform.system() == 'Linux':
+  #if platform.system() == 'Linux':
     # set explictly since it's not default in Python < 3.14, forkserver should
     # be safer than fork and less likely to see bulk command hangs.
-    multiprocessing.set_start_method('forkserver')
+    #multiprocessing.set_start_method('forkserver')
-  else:
+  #else:
+  
+  # Python 3.14.4 and PyInstaller 6.19.0 don't play nice with forkserver
+  # on Linux. For the time being use spawn everywhere.
   multiprocessing.set_start_method('spawn')
   main()

src/gam/gamlib/glaction.py

@@ -134,6 +134,7 @@ class GamAction():
   UNZIP = 'unzi'
   USE = 'use '
   VERIFY = 'vrfy'
+  VERIFYITEMEXISTS = 'vexi'
   WAITFORMAILBOX = 'wamb'
   WATCH = 'watc'
   WIPE = 'wipe'
@@ -253,6 +254,7 @@ class GamAction():
     UPLOAD: ['Uploaded', 'Upload'],
     USE: ['Used', 'Use'],
     VERIFY: ['Verified', 'Verify'],
+    VERIFYITEMEXISTS: ['Verified Item Exists', 'Verify Item Exists'],
     WAITFORMAILBOX: ['Mailbox is Setup', 'Check Mailbox is Setup'],
     WATCH: ['Watched', 'Watch'],
     WIPE: ['Wiped', 'Wipe'],

src/gam/gamlib/glapi.py

@@ -140,7 +140,6 @@ SCOPELESS_APIS = {
 
 # Scopes not in the discovery doc that are still valid for the API.
 EXTRA_SCOPES = {
-  BUSINESSACCOUNTMANAGEMENT: ['https://www.googleapis.com/auth/business.manage'],
   CLOUDRESOURCEMANAGER: ['https://www.googleapis.com/auth/cloudplatformfolders',
                          'https://www.googleapis.com/auth/cloudplatformfolders.readonly',
                          'https://www.googleapis.com/auth/cloudplatformprojects',
@@ -318,10 +317,6 @@ _INFO = {
 READONLY = ['readonly',]
 
 _CLIENT_SCOPES = [
-  {'name': 'Business Account Management API',
-   'api': BUSINESSACCOUNTMANAGEMENT,
-   'offByDefault': True,
-   'scope': EXTRA_SCOPES[BUSINESSACCOUNTMANAGEMENT]},
   {'name': 'Calendar API',
    'api': CALENDAR,
    'subscopes': READONLY,
@@ -568,6 +563,10 @@ _SVCACCT_SCOPES = [
   {'name': 'Analytics Admin API - readonly',
    'api': ANALYTICS_ADMIN,
    'scope': 'https://www.googleapis.com/auth/analytics.readonly'},
+  {'name': 'Business Account Management API',
+   'api': BUSINESSACCOUNTMANAGEMENT,
+   'offByDefault': True,
+   'scope': 'https://www.googleapis.com/auth/business.manage'},
   {'name': 'Calendar API',
    'api': CALENDAR,
    'subscopes': READONLY,

src/gam/gamlib/glcfg.py

@@ -171,8 +171,6 @@ EMAIL_BATCH_SIZE = 'email_batch_size'
 ENABLE_DASA = 'enable_dasa'
 # Enable Cloud Session Reauthentication by borrowing a RAPT token from gcloud command
 ENABLE_GCLOUD_REAUTH = 'enable_gcloud_reauth'
-# Value for enforceExpansiveAccess for commands that delete or update drive file ACLs/permissions.
-ENFORCE_EXPANSIVE_ACCESS = 'enforce_expansive_access'
 # When retrieving lists of calendar events from API, how many should be retrieved in each chunk
 EVENT_MAX_RESULTS = 'event_max_results'
 # Path to extra_args.txt
@@ -398,7 +396,6 @@ Defaults = {
   DEVICE_MAX_RESULTS: '200',
   DOMAIN: '',
   DRIVE_DIR: '',
-  ENFORCE_EXPANSIVE_ACCESS: TRUE,
   DRIVE_MAX_RESULTS: '1000',
   EMAIL_BATCH_SIZE: '50',
   ENABLE_DASA: FALSE,
@@ -573,7 +570,6 @@ VAR_INFO = {
   DEVICE_MAX_RESULTS: {VAR_TYPE: TYPE_INTEGER, VAR_LIMITS: (1, 200)},
   DOMAIN: {VAR_TYPE: TYPE_STRING, VAR_ENVVAR: 'GA_DOMAIN', VAR_LIMITS: (0, None)},
   DRIVE_DIR: {VAR_TYPE: TYPE_DIRECTORY, VAR_ENVVAR: 'GAMDRIVEDIR'},
-  ENFORCE_EXPANSIVE_ACCESS: {VAR_TYPE: TYPE_BOOLEAN},
   DRIVE_MAX_RESULTS: {VAR_TYPE: TYPE_INTEGER, VAR_LIMITS: (1, 1000)},
   EMAIL_BATCH_SIZE: {VAR_TYPE: TYPE_INTEGER, VAR_LIMITS: (1, 100)},
   ENABLE_DASA: {VAR_TYPE: TYPE_BOOLEAN, VAR_SIGFILE: 'enabledasa.txt', VAR_SFFT: (FALSE, TRUE)},

src/gam/gamlib/glclargs.py

@@ -53,6 +53,7 @@ class GamCLArgs():
   ENTITY_DOMAINS_ARCH = 'domains_arch'
   ENTITY_DOMAINS_NS = 'domains_ns'
   ENTITY_DOMAINS_SUSP = 'domains_susp'
+  ENTITY_DOMAINS_NS_SUSP = 'domains_ns_susp'
   ENTITY_DOMAINS_NA_NS = 'domains_na_ns'
   ENTITY_GROUP = 'group'
   ENTITY_GROUP_INDE = 'group_inde'
@@ -60,6 +61,7 @@ class GamCLArgs():
   ENTITY_GROUP_ARCH = 'group_arch'
   ENTITY_GROUP_NS = 'group_ns'
   ENTITY_GROUP_SUSP = 'group_susp'
+  ENTITY_GROUP_NS_SUSP = 'group_ns_susp'
   ENTITY_GROUP_NA_NS = 'group_na_ns'
   ENTITY_GROUPS = 'groups'
   ENTITY_GROUPS_INDE = 'groups_inde'
@@ -67,12 +69,14 @@ class GamCLArgs():
   ENTITY_GROUPS_ARCH = 'groups_arch'
   ENTITY_GROUPS_NS = 'groups_ns'
   ENTITY_GROUPS_SUSP = 'groups_susp'
+  ENTITY_GROUPS_NS_SUSP = 'groups_ns_susp'
   ENTITY_GROUPS_NA_NS = 'groups_na_ns'
   ENTITY_GROUP_USERS = 'group_users'
   ENTITY_GROUP_USERS_NA = 'group_users_na'
   ENTITY_GROUP_USERS_ARCH = 'group_users_arch'
   ENTITY_GROUP_USERS_NS = 'group_users_ns'
   ENTITY_GROUP_USERS_SUSP = 'group_users_susp'
+  ENTITY_GROUP_USERS_NS_SUSP = 'group_users_ns_susp'
   ENTITY_GROUP_USERS_NA_NS = 'group_users_na_ns'
   ENTITY_GROUP_USERS_SELECT = 'group_users_select'
   ENTITY_LICENSES = 'licenses'
@@ -82,24 +86,28 @@ class GamCLArgs():
   ENTITY_OU_ARCH = 'ou_arch'
   ENTITY_OU_NS = 'ou_ns'
   ENTITY_OU_SUSP = 'ou_susp'
+  ENTITY_OU_NS_SUSP = 'ou_ns_susp'
   ENTITY_OU_NA_NS = 'ou_na_ns'
   ENTITY_OU_AND_CHILDREN = 'ou_and_children'
   ENTITY_OU_AND_CHILDREN_NA = 'ou_and_children_na'
   ENTITY_OU_AND_CHILDREN_ARCH = 'ou_and_children_arch'
   ENTITY_OU_AND_CHILDREN_NS = 'ou_and_children_ns'
   ENTITY_OU_AND_CHILDREN_SUSP = 'ou_and_children_susp'
+  ENTITY_OU_AND_CHILDREN_NS_SUSP = 'ou_and_children_ns_susp'
   ENTITY_OU_AND_CHILDREN_NA_NS = 'ou_and_children_na_ns'
   ENTITY_OUS = 'ous'
   ENTITY_OUS_NA = 'ous_na'
   ENTITY_OUS_ARCH = 'ous_arch'
   ENTITY_OUS_NS = 'ous_ns'
   ENTITY_OUS_SUSP = 'ous_susp'
+  ENTITY_OUS_NS_SUSP = 'ous_ns_susp'
   ENTITY_OUS_NA_NS = 'ous_na_ns'
   ENTITY_OUS_AND_CHILDREN = 'ous_and_children'
   ENTITY_OUS_AND_CHILDREN_NA = 'ous_and_children_na'
   ENTITY_OUS_AND_CHILDREN_ARCH = 'ous_and_children_arch'
   ENTITY_OUS_AND_CHILDREN_NS = 'ous_and_children_ns'
   ENTITY_OUS_AND_CHILDREN_SUSP = 'ous_and_children_susp'
+  ENTITY_OUS_AND_CHILDREN_NS_SUSP = 'ous_and_children_ns_susp'
   ENTITY_OUS_AND_CHILDREN_NA_NS = 'ous_and_children_na_ns'
   ENTITY_QUERIES = 'queries'
   ENTITY_QUERY = 'query'
@@ -111,9 +119,17 @@ class GamCLArgs():
   ENTITY_USERS_ARCH = 'users_arch'
   ENTITY_USERS_NS = 'users_ns'
   ENTITY_USERS_SUSP = 'users_susp'
+  ENTITY_USERS_NS_SUSP = 'users_ns_susp'
   ENTITY_USERS_NA_NS = 'users_na_ns'
   ENTITY_USERS_ARCH_OR_SUSP = 'users_arch_or_susp'
-  ENTITY_USERS_NS_SUSP = 'users_ns_susp'
+  ENTITY_USERS_AND_GUESTS  = 'users_and_guests'
+  ENTITY_USERS_AND_GUESTS_NS  = 'users_and_guests_ns'
+  ENTITY_USERS_AND_GUESTS_SUSP  = 'users_and_guests_susp'
+  ENTITY_USERS_AND_GUESTS_NS_SUSP  = 'users_and_guests_ns_susp'
+  ENTITY_GUESTS  = 'guests'
+  ENTITY_GUESTS_NS = 'guests_ns'
+  ENTITY_GUESTS_SUSP = 'guests_susp'
+  ENTITY_GUESTS_NS_SUSP = 'guests_ns_susp'
 #
   BROWSER_ENTITIES = [
     ENTITY_BROWSER,
@@ -150,6 +166,7 @@ class GamCLArgs():
     ENTITY_DOMAINS_ARCH,
     ENTITY_DOMAINS_NS,
     ENTITY_DOMAINS_SUSP,
+    ENTITY_DOMAINS_NS_SUSP,
     ENTITY_DOMAINS_NA_NS,
     ENTITY_GROUP,
     ENTITY_GROUP_INDE,
@@ -157,6 +174,7 @@ class GamCLArgs():
     ENTITY_GROUP_ARCH,
     ENTITY_GROUP_NS,
     ENTITY_GROUP_SUSP,
+    ENTITY_GROUP_NS_SUSP,
     ENTITY_GROUP_NA_NS,
     ENTITY_GROUPS,
     ENTITY_GROUPS_INDE,
@@ -164,12 +182,14 @@ class GamCLArgs():
     ENTITY_GROUPS_ARCH,
     ENTITY_GROUPS_NS,
     ENTITY_GROUPS_SUSP,
+    ENTITY_GROUPS_NS_SUSP,
     ENTITY_GROUPS_NA_NS,
     ENTITY_GROUP_USERS,
     ENTITY_GROUP_USERS_NA,
     ENTITY_GROUP_USERS_ARCH,
     ENTITY_GROUP_USERS_NS,
     ENTITY_GROUP_USERS_SUSP,
+    ENTITY_GROUP_USERS_NS_SUSP,
     ENTITY_GROUP_USERS_NA_NS,
     ENTITY_GROUP_USERS_SELECT,
     ENTITY_LICENSES,
@@ -179,24 +199,28 @@ class GamCLArgs():
     ENTITY_OU_ARCH,
     ENTITY_OU_NS,
     ENTITY_OU_SUSP,
+    ENTITY_OU_NS_SUSP,
     ENTITY_OU_NA_NS,
     ENTITY_OU_AND_CHILDREN,
     ENTITY_OU_AND_CHILDREN_NA,
     ENTITY_OU_AND_CHILDREN_ARCH,
     ENTITY_OU_AND_CHILDREN_NS,
     ENTITY_OU_AND_CHILDREN_SUSP,
+    ENTITY_OU_AND_CHILDREN_NS_SUSP,
     ENTITY_OU_AND_CHILDREN_NA_NS,
     ENTITY_OUS,
     ENTITY_OUS_NA,
     ENTITY_OUS_ARCH,
     ENTITY_OUS_NS,
     ENTITY_OUS_SUSP,
+    ENTITY_OUS_NS_SUSP,
     ENTITY_OUS_NA_NS,
     ENTITY_OUS_AND_CHILDREN,
     ENTITY_OUS_AND_CHILDREN_NA,
     ENTITY_OUS_AND_CHILDREN_ARCH,
     ENTITY_OUS_AND_CHILDREN_NS,
     ENTITY_OUS_AND_CHILDREN_SUSP,
+    ENTITY_OUS_AND_CHILDREN_NS_SUSP,
     ENTITY_OUS_AND_CHILDREN_NA_NS,
     ENTITY_QUERIES,
     ENTITY_QUERY,
@@ -278,48 +302,56 @@ class GamCLArgs():
     'org_arch': ENTITY_OU_ARCH,
     'org_ns': ENTITY_OU_NS,
     'org_susp': ENTITY_OU_SUSP,
+    'org_ns_susp': ENTITY_OU_NS_SUSP,
     'org_na_ns': ENTITY_OU_NA_NS,
     'org_and_child': ENTITY_OU_AND_CHILDREN,
     'org_and_child_na': ENTITY_OU_AND_CHILDREN_NA,
     'org_and_child_arch': ENTITY_OU_AND_CHILDREN_ARCH,
     'org_and_child_ns': ENTITY_OU_AND_CHILDREN_NS,
     'org_and_child_susp': ENTITY_OU_AND_CHILDREN_SUSP,
+    'org_and_child_ns_susp': ENTITY_OU_AND_CHILDREN_NS_SUSP,
     'org_and_child_na_ns': ENTITY_OU_AND_CHILDREN_NA_NS,
     'org_and_children': ENTITY_OU_AND_CHILDREN,
     'org_and_children_na': ENTITY_OU_AND_CHILDREN_NA,
     'org_and_children_arch': ENTITY_OU_AND_CHILDREN_ARCH,
     'org_and_children_ns': ENTITY_OU_AND_CHILDREN_NS,
     'org_and_children_susp': ENTITY_OU_AND_CHILDREN_SUSP,
+    'org_and_children_ns_susp': ENTITY_OU_AND_CHILDREN_NS_SUSP,
     'org_and_children_na_ns': ENTITY_OU_AND_CHILDREN_NA_NS,
     'orgs': ENTITY_OUS,
     'orgs_na': ENTITY_OUS_NA,
     'orgs_arch': ENTITY_OUS_ARCH,
     'orgs_ns': ENTITY_OUS_NS,
     'orgs_susp': ENTITY_OUS_SUSP,
+    'orgs_ns_susp': ENTITY_OUS_NS_SUSP,
     'orgs_na_ns': ENTITY_OUS_NA_NS,
     'orgs_and_child': ENTITY_OUS_AND_CHILDREN,
     'orgs_and_child_na': ENTITY_OUS_AND_CHILDREN_NA,
     'orgs_and_child_arch': ENTITY_OUS_AND_CHILDREN_ARCH,
     'orgs_and_child_ns': ENTITY_OUS_AND_CHILDREN_NS,
     'orgs_and_child_susp': ENTITY_OUS_AND_CHILDREN_SUSP,
+    'orgs_and_child_ns_susp': ENTITY_OUS_AND_CHILDREN_NS_SUSP,
     'orgs_and_child_na_ns': ENTITY_OUS_AND_CHILDREN_NA_NS,
     'orgs_and_children': ENTITY_OUS_AND_CHILDREN,
     'orgs_and_children_na': ENTITY_OUS_AND_CHILDREN_NA,
     'orgs_and_children_arch': ENTITY_OUS_AND_CHILDREN_ARCH,
     'orgs_and_children_ns': ENTITY_OUS_AND_CHILDREN_NS,
     'orgs_and_children_susp': ENTITY_OUS_AND_CHILDREN_SUSP,
+    'orgs_and_children_ns_susp': ENTITY_OUS_AND_CHILDREN_NS_SUSP,
     'orgs_and_children_na_ns': ENTITY_OUS_AND_CHILDREN_NA_NS,
     'ou_and_child': ENTITY_OU_AND_CHILDREN,
     'ou_and_child_na': ENTITY_OU_AND_CHILDREN_NA,
     'ou_and_child_arch': ENTITY_OU_AND_CHILDREN_ARCH,
     'ou_and_child_ns': ENTITY_OU_AND_CHILDREN_NS,
     'ou_and_child_susp': ENTITY_OU_AND_CHILDREN_SUSP,
+    'ou_and_child_ns_susp': ENTITY_OU_AND_CHILDREN_NS_SUSP,
     'ou_and_child_na_ns': ENTITY_OU_AND_CHILDREN_NA_NS,
     'ous_and_child': ENTITY_OUS_AND_CHILDREN,
     'ous_and_child_na': ENTITY_OUS_AND_CHILDREN_NA,
     'ous_and_child_arch': ENTITY_OUS_AND_CHILDREN_ARCH,
     'ous_and_child_ns': ENTITY_OUS_AND_CHILDREN_NS,
     'ous_and_child_susp': ENTITY_OUS_AND_CHILDREN_SUSP,
+    'ous_and_child_ns_susp': ENTITY_OUS_AND_CHILDREN_NS_SUSP,
     'ous_and_child_na_ns': ENTITY_OUS_AND_CHILDREN_NA_NS,
     }
 # CL entity source selectors
@@ -395,9 +427,17 @@ class GamCLArgs():
     ENTITY_USERS_ARCH,
     ENTITY_USERS_NS,
     ENTITY_USERS_SUSP,
+    ENTITY_USERS_NS_SUSP,
     ENTITY_USERS_ARCH_OR_SUSP,
     ENTITY_USERS_NA_NS,
-    ENTITY_USERS_NS_SUSP,
+    ENTITY_USERS_AND_GUESTS,
+    ENTITY_USERS_AND_GUESTS_NS,
+    ENTITY_USERS_AND_GUESTS_SUSP,
+    ENTITY_USERS_AND_GUESTS_NS_SUSP,
+    ENTITY_GUESTS,
+    ENTITY_GUESTS_NS,
+    ENTITY_GUESTS_SUSP,
+    ENTITY_GUESTS_NS_SUSP,
     ]
 #
   ENTITY_ALL_CROS = ENTITY_SELECTOR_ALL+' '+ENTITY_CROS
@@ -406,9 +446,17 @@ class GamCLArgs():
   ENTITY_ALL_USERS_ARCH = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_ARCH
   ENTITY_ALL_USERS_NS = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_NS
   ENTITY_ALL_USERS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_SUSP
+  ENTITY_ALL_USERS_NS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_NS_SUSP
   ENTITY_ALL_USERS_NA_NS = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_NA_NS
   ENTITY_ALL_USERS_ARCH_OR_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_ARCH_OR_SUSP
-  ENTITY_ALL_USERS_NS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_NS_SUSP
+  ENTITY_ALL_USERS_AND_GUESTS = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_AND_GUESTS
+  ENTITY_ALL_USERS_AND_GUESTS_NS = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_AND_GUESTS_NS
+  ENTITY_ALL_USERS_AND_GUESTS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_AND_GUESTS_SUSP
+  ENTITY_ALL_USERS_AND_GUESTS_NS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_AND_GUESTS_NS_SUSP
+  ENTITY_ALL_GUESTS = ENTITY_SELECTOR_ALL+' '+ENTITY_GUESTS
+  ENTITY_ALL_GUESTS_NS = ENTITY_SELECTOR_ALL+' '+ENTITY_GUESTS_NS
+  ENTITY_ALL_GUESTS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_GUESTS_SUSP
+  ENTITY_ALL_GUESTS_NS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_GUESTS_NS_SUSP
 #
   ALL_USER_ENTITY_TYPES = {
     ENTITY_ALL_USERS,
@@ -416,8 +464,16 @@ class GamCLArgs():
     ENTITY_ALL_USERS_ARCH,
     ENTITY_ALL_USERS_NS,
     ENTITY_ALL_USERS_SUSP,
-    ENTITY_ALL_USERS_NA_NS,
     ENTITY_ALL_USERS_NS_SUSP,
+    ENTITY_ALL_USERS_NA_NS,
+    ENTITY_ALL_USERS_AND_GUESTS,
+    ENTITY_ALL_USERS_AND_GUESTS_NS,
+    ENTITY_ALL_USERS_AND_GUESTS_SUSP,
+    ENTITY_ALL_USERS_AND_GUESTS_NS_SUSP,
+    ENTITY_ALL_GUESTS,
+    ENTITY_ALL_GUESTS_NS,
+    ENTITY_ALL_GUESTS_SUSP,
+    ENTITY_ALL_GUESTS_NS_SUSP,
     }
   DOMAIN_ENTITY_TYPES = {
     ENTITY_DOMAINS,
@@ -425,6 +481,7 @@ class GamCLArgs():
     ENTITY_DOMAINS_ARCH,
     ENTITY_DOMAINS_NS,
     ENTITY_DOMAINS_SUSP,
+    ENTITY_DOMAINS_NS_SUSP,
     ENTITY_DOMAINS_NA_NS,
     }
   GROUP_ENTITY_TYPES = {
@@ -433,6 +490,7 @@ class GamCLArgs():
     ENTITY_GROUP_ARCH,
     ENTITY_GROUP_NS,
     ENTITY_GROUP_SUSP,
+    ENTITY_GROUP_NS_SUSP,
     ENTITY_GROUP_NA_NS,
     ENTITY_GROUP_INDE,
     }
@@ -442,6 +500,7 @@ class GamCLArgs():
     ENTITY_GROUPS_ARCH,
     ENTITY_GROUPS_NS,
     ENTITY_GROUPS_SUSP,
+    ENTITY_GROUPS_NS_SUSP,
     ENTITY_GROUPS_NA_NS,
     ENTITY_GROUPS_INDE,
     }
@@ -451,6 +510,7 @@ class GamCLArgs():
     ENTITY_GROUP_USERS_ARCH,
     ENTITY_GROUP_USERS_NS,
     ENTITY_GROUP_USERS_SUSP,
+    ENTITY_GROUP_USERS_NS_SUSP,
     ENTITY_GROUP_USERS_NA_NS,
     ENTITY_GROUP_USERS_SELECT,
     }
@@ -465,6 +525,8 @@ class GamCLArgs():
     ENTITY_OU_AND_CHILDREN_NS,
     ENTITY_OU_SUSP,
     ENTITY_OU_AND_CHILDREN_SUSP,
+    ENTITY_OU_NS_SUSP,
+    ENTITY_OU_AND_CHILDREN_NS_SUSP,
     ENTITY_OU_NA_NS,
     ENTITY_OU_AND_CHILDREN_NA_NS,
     }
@@ -479,6 +541,8 @@ class GamCLArgs():
     ENTITY_OUS_AND_CHILDREN_NS,
     ENTITY_OUS_SUSP,
     ENTITY_OUS_AND_CHILDREN_SUSP,
+    ENTITY_OUS_NS_SUSP,
+    ENTITY_OUS_AND_CHILDREN_NS_SUSP,
     ENTITY_OUS_NA_NS,
     ENTITY_OUS_AND_CHILDREN_NA_NS,
     }
@@ -493,6 +557,8 @@ class GamCLArgs():
     ENTITY_OUS_NS,
     ENTITY_OU_SUSP,
     ENTITY_OUS_SUSP,
+    ENTITY_OU_NS_SUSP,
+    ENTITY_OUS_NS_SUSP,
     ENTITY_OU_NA_NS,
     ENTITY_OUS_NA_NS,
     }
@@ -534,13 +600,21 @@ class GamCLArgs():
     }
 #
   ALL_USERS_QUERY_MAP = {
-    ENTITY_ALL_USERS: 'isSuspended=False',
+    ENTITY_ALL_USERS: 'isSuspended=False isGuest=False',
-    ENTITY_ALL_USERS_NA: 'isArchived=False',
+    ENTITY_ALL_USERS_NA: 'isArchived=False isGuest=False',
-    ENTITY_ALL_USERS_ARCH: 'isArchived=True',
+    ENTITY_ALL_USERS_ARCH: 'isArchived=True isGuest=False',
-    ENTITY_ALL_USERS_NS: 'isSuspended=False',
+    ENTITY_ALL_USERS_NS: 'isSuspended=False isGuest=False',
-    ENTITY_ALL_USERS_SUSP: 'isSuspended=True',
+    ENTITY_ALL_USERS_SUSP: 'isSuspended=True isGuest=False',
-    ENTITY_ALL_USERS_NA_NS: 'isArchived=False isSuspended=False',
+    ENTITY_ALL_USERS_NA_NS: 'isArchived=False isSuspended=False isGuest=False',
-    ENTITY_ALL_USERS_NS_SUSP: None,
+    ENTITY_ALL_USERS_NS_SUSP: 'isGuest=False',
+    ENTITY_ALL_USERS_AND_GUESTS: 'isSuspended=False',
+    ENTITY_ALL_USERS_AND_GUESTS_NS: 'isSuspended=False',
+    ENTITY_ALL_USERS_AND_GUESTS_SUSP: 'isSuspended=True',
+    ENTITY_ALL_USERS_AND_GUESTS_NS_SUSP: None,
+    ENTITY_ALL_GUESTS: 'isSuspended=False isGuest=True',
+    ENTITY_ALL_GUESTS_NS: 'isSuspended=False isGuest=True',
+    ENTITY_ALL_GUESTS_SUSP: 'isSuspended=True isGuest=True',
+    ENTITY_ALL_GUESTS_NS_SUSP: 'isGuest=True',
   }
   DOMAINS_QUERY_MAP = {
     ENTITY_DOMAINS: None,
@@ -548,6 +622,7 @@ class GamCLArgs():
     ENTITY_DOMAINS_ARCH: 'isArchived=True',
     ENTITY_DOMAINS_NS: 'isSuspended=False',
     ENTITY_DOMAINS_SUSP: 'isSuspended=True',
+    ENTITY_DOMAINS_NS_SUSP: None,
     ENTITY_DOMAINS_NA_NS: 'isArchived=False isSuspended=False',
   }
   GROUPS_QUERY_MAP = { #(isArchived, isSuspended)
@@ -559,6 +634,8 @@ class GamCLArgs():
     ENTITY_GROUPS_NS: (None, False),
     ENTITY_GROUP_SUSP: (None, True),
     ENTITY_GROUPS_SUSP: (None, True),
+    ENTITY_GROUP_NS_SUSP: (None, None),
+    ENTITY_GROUPS_NS_SUSP: (None, None),
     ENTITY_GROUP_NA_NS: (False, False),
     ENTITY_GROUPS_NA_NS: (False, False),
   }
@@ -567,6 +644,7 @@ class GamCLArgs():
     ENTITY_GROUP_USERS_ARCH: (True, None),
     ENTITY_GROUP_USERS_NS: (None, False),
     ENTITY_GROUP_USERS_SUSP: (None, True),
+    ENTITY_GROUP_USERS_NS_SUSP: (None, None),
     ENTITY_GROUP_USERS_NA_NS: (False, False),
   }
   OU_QUERY_MAP = { #(isArchived, isSuspended)
@@ -586,6 +664,10 @@ class GamCLArgs():
     ENTITY_OUS_SUSP: (None, True),
     ENTITY_OU_AND_CHILDREN_SUSP: (None, True),
     ENTITY_OUS_AND_CHILDREN_SUSP: (None, True),
+    ENTITY_OU_NS_SUSP: (None, None),
+    ENTITY_OUS_NS_SUSP: (None, None),
+    ENTITY_OU_AND_CHILDREN_NS_SUSP: (None, None),
+    ENTITY_OUS_AND_CHILDREN_NS_SUSP: (None, None),
     ENTITY_OU_NA_NS: (False, False),
     ENTITY_OUS_NA_NS: (False, False),
     ENTITY_OU_AND_CHILDREN_NA_NS: (False, False),
@@ -602,6 +684,14 @@ class GamCLArgs():
     ENTITY_USERS_NA_NS: ENTITY_ALL_USERS_NA_NS,
     ENTITY_USERS_ARCH_OR_SUSP: ENTITY_ALL_USERS_ARCH_OR_SUSP,
     ENTITY_USERS_NS_SUSP: ENTITY_ALL_USERS_NS_SUSP,
+    ENTITY_USERS_AND_GUESTS: ENTITY_ALL_USERS_AND_GUESTS,
+    ENTITY_USERS_AND_GUESTS_NS: ENTITY_ALL_USERS_AND_GUESTS_NS,
+    ENTITY_USERS_AND_GUESTS_SUSP: ENTITY_ALL_USERS_AND_GUESTS_SUSP,
+    ENTITY_USERS_AND_GUESTS_NS_SUSP: ENTITY_ALL_USERS_AND_GUESTS_NS_SUSP,
+    ENTITY_GUESTS: ENTITY_ALL_GUESTS,
+    ENTITY_GUESTS_NS: ENTITY_ALL_GUESTS_NS,
+    ENTITY_GUESTS_SUSP: ENTITY_ALL_GUESTS_SUSP,
+    ENTITY_GUESTS_NS_SUSP: ENTITY_ALL_GUESTS_NS_SUSP,
     }
 # Allowed values for CL source selector datafile, csvkmd
   CROS_ENTITY_SELECTOR_DATAFILE_CSVKMD_SUBTYPES = [
@@ -619,6 +709,7 @@ class GamCLArgs():
     ENTITY_DOMAINS_ARCH,
     ENTITY_DOMAINS_NS,
     ENTITY_DOMAINS_SUSP,
+    ENTITY_DOMAINS_NS_SUSP,
     ENTITY_DOMAINS_NA_NS,
     ENTITY_GROUPS,
     ENTITY_GROUPS_INDE,
@@ -626,12 +717,14 @@ class GamCLArgs():
     ENTITY_GROUPS_ARCH,
     ENTITY_GROUPS_NS,
     ENTITY_GROUPS_SUSP,
+    ENTITY_GROUPS_NS_SUSP,
     ENTITY_GROUPS_NA_NS,
     ENTITY_GROUP_USERS,
     ENTITY_GROUP_USERS_NA,
     ENTITY_GROUP_USERS_ARCH,
     ENTITY_GROUP_USERS_NS,
     ENTITY_GROUP_USERS_SUSP,
+    ENTITY_GROUP_USERS_NS_SUSP,
     ENTITY_GROUP_USERS_NA_NS,
     ENTITY_GROUP_USERS_SELECT,
     ENTITY_OUS,
@@ -639,12 +732,14 @@ class GamCLArgs():
     ENTITY_OUS_ARCH,
     ENTITY_OUS_NS,
     ENTITY_OUS_SUSP,
+    ENTITY_OUS_NS_SUSP,
     ENTITY_OUS_NA_NS,
     ENTITY_OUS_AND_CHILDREN,
     ENTITY_OUS_AND_CHILDREN_NA,
     ENTITY_OUS_AND_CHILDREN_ARCH,
     ENTITY_OUS_AND_CHILDREN_NS,
     ENTITY_OUS_AND_CHILDREN_SUSP,
+    ENTITY_OUS_AND_CHILDREN_NS_SUSP,
     ENTITY_OUS_AND_CHILDREN_NA_NS,
     ENTITY_COURSEPARTICIPANTS,
     ENTITY_STUDENTS,

src/gam/gamlib/glgapi.py

@@ -257,10 +257,10 @@ DRIVE3_UPDATE_ACL_THROW_REASONS = [BAD_REQUEST, INVALID_OWNERSHIP_TRANSFER, CANN
                                    CANNOT_UPDATE_PERMISSION,
                                    CANNOT_MODIFY_INHERITED_TEAMDRIVE_PERMISSION, CANNOT_MODIFY_INHERITED_PERMISSION,
                                    FIELD_NOT_WRITABLE, PERMISSION_NOT_FOUND]
-DRIVE3_DELETE_ACL_THROW_REASONS = [BAD_REQUEST, CANNOT_REMOVE_OWNER,
+DRIVE3_DELETE_ACL_THROW_REASONS = [BAD_REQUEST, NOT_FOUND, PERMISSION_NOT_FOUND, CANNOT_REMOVE_OWNER,
                                    CANNOT_MODIFY_INHERITED_TEAMDRIVE_PERMISSION, CANNOT_MODIFY_INHERITED_PERMISSION,
                                    INSUFFICIENT_ADMINISTRATOR_PRIVILEGES, SHARING_RATE_LIMIT_EXCEEDED,
-                                   NOT_FOUND, PERMISSION_NOT_FOUND, CANNOT_DELETE_PERMISSION]
+                                   CANNOT_DELETE_PERMISSION, FILE_NEVER_WRITABLE]
 DRIVE3_MODIFY_LABEL_THROW_REASONS = DRIVE_USER_THROW_REASONS+[FILE_NOT_FOUND, NOT_FOUND, FORBIDDEN, INTERNAL_ERROR,
                                                               FILE_NEVER_WRITABLE, APPLY_LABEL_FORBIDDEN,
                                                               INSUFFICIENT_ADMINISTRATOR_PRIVILEGES, INSUFFICIENT_FILE_PERMISSIONS,
@@ -274,7 +274,7 @@ GMAIL_LIST_THROW_REASONS = [FAILED_PRECONDITION, PERMISSION_DENIED, INVALID, INV
 GMAIL_SMIME_THROW_REASONS = [SERVICE_NOT_AVAILABLE, BAD_REQUEST, INVALID_ARGUMENT, FORBIDDEN, NOT_FOUND, PERMISSION_DENIED]
 GROUP_GET_THROW_REASONS = [GROUP_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, BAD_REQUEST, INVALID, SYSTEM_ERROR]
 GROUP_GET_RETRY_REASONS = [INVALID, SYSTEM_ERROR, SERVICE_NOT_AVAILABLE]
-GROUP_CREATE_THROW_REASONS = [DUPLICATE, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, INVALID, INVALID_INPUT]
+GROUP_CREATE_THROW_REASONS = [DUPLICATE, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, INVALID, INVALID_INPUT, RESOURCE_NOT_FOUND]
 GROUP_UPDATE_THROW_REASONS = [GROUP_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, INVALID, INVALID_INPUT]
 GROUP_SETTINGS_THROW_REASONS = [NOT_FOUND, GROUP_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, SYSTEM_ERROR, PERMISSION_DENIED,
                                 INVALID, INVALID_ARGUMENT, INVALID_PARAMETER, INVALID_ATTRIBUTE_VALUE, INVALID_INPUT,

src/gam/gamlib/glglobals.py

@@ -131,6 +131,8 @@ GAM_PATH = 'gpth'
 GAM_TYPE = 'gtyp'
 # Shared Service Account HTTP Object
 HTTP_OBJECT = 'http'
+# Are we on Global Compute Engine
+IS_ON_GCE = 'ogce'
 # Length of last Got message
 LAST_GOT_MSG_LEN = 'lgml'
 # License SKUs
@@ -285,6 +287,7 @@ Globals = {
   GAM_PATH: '.',
   GAM_TYPE: '',
   HTTP_OBJECT: None,
+  IS_ON_GCE: False,
   LAST_GOT_MSG_LEN: 0,
   LICENSE_SKUS: [],
   MAKE_BUILDING_ID_NAME_MAP: True,

src/gam/gamlib/glmsgs.py

@@ -474,6 +474,7 @@ REASON_ONLY_VALID_WITH_CONTENTRESTRICTIONS_READONLY_TRUE = 'reason only valid wi
 REAUTHENTICATION_IS_NEEDED = 'Reauthentication is needed, please run\n\ngam oauth create'
 RECOMMEND_RUNNING_GAM_ROTATE_SAKEY = 'Recommend running "gam rotate sakey" to get a new key\n'
 REFUSING_TO_DEPROVISION_DEVICES = 'Refusing to deprovision {0} devices because acknowledge_device_touch_requirement not specified.\nDeprovisioning a device means the device will have to be physically wiped and re-enrolled to be managed by your domain again.\nThis requires physical access to the device and is very time consuming to perform for each device.\nPlease add "acknowledge_device_touch_requirement" to the GAM command if you understand this and wish to proceed with the deprovision.\nPlease also be aware that deprovisioning can have an effect on your device license count.\nSee https://support.google.com/chrome/a/answer/3523633 for full details.'
+REFUSING_TO_DEPROVISION_N_DEVICES = 'Refusing to deprovision {0} devices due to maxtodepov {1}.'
 REPLY_TO_CUSTOM_REQUIRES_EMAIL_ADDRESS = 'replyto REPLY_TO_CUSTOM requires customReplyTo <EmailAddress>'
 REQUEST_COMPLETED_NO_FILES = 'Request completed but no results/files were returned, try requesting again'
 REQUEST_NOT_COMPLETE = 'Request needs to be completed before downloading, current status is: {0}'
@@ -534,6 +535,7 @@ UNKNOWN_API_OR_VERSION = 'Unknown Google API or version: ({0}), contact {1}'
 UNRECOVERABLE_ERROR = 'Unrecoverable error'
 UPDATE_ATTENDEE_CHANGES = 'Update attendee changes'
 UPDATE_GAM_TO_64BIT = "You're running a 32-bit version of GAM on a 64-bit version of Windows, upgrade to a windows-x86_64 version of GAM"
+UPDATE_PRIMARY_EMAIL_PREVIEW = 'updateprimaryemail preview: {0}'
 UPDATE_USER_PASSWORD_CHANGE_NOTIFY_MESSAGE = 'The account password for #givenname# #familyname#, #user# has been changed to: #password#\n'
 UPDATE_USER_PASSWORD_CHANGE_NOTIFY_SUBJECT = 'Account #user# password has been changed'
 UPLOAD_CSV_FILE_INTERNAL_ERROR = 'Google reported "{0}" but the file was probably uploaded, check that it has {1} rows'

src/gam/gamlib/glskus.py

@@ -94,7 +94,7 @@ _SKUS = {
   '1010430001': {
     'product': '101043', 'aliases': ['gwas', 'plusstorage'], 'displayName': 'Google Workspace Additional Storage'},
   '1010470001': {
-    'product': '101047', 'aliases': ['geminient', 'duetai'], 'displayName': 'Gemini Enterprise'},
+    'product': '101047', 'aliases': ['geminient', 'duetai'], 'displayName': 'Gemini Enterprise - Legacy'},
   '1010470002': {
     'product': '101047', 'aliases': ['gwlabs', 'workspacelabs'], 'displayName': 'Google Workspace Labs'},
   '1010470003': {
@@ -109,6 +109,8 @@ _SKUS = {
     'product': '101047', 'aliases': ['aimeetingsandmessaging'], 'displayName': 'AI Meetings and Messaging'},
   '1010470008': {
     'product': '101047', 'aliases': ['geminiultra'], 'displayName': 'Google AI Ultra for Business'},
+  '1010470009': {
+    'product': '101047', 'aliases': ['aiexpandedaccess'], 'displayName': 'AI Expanded Access'},
   '1010490001': {
     'product': '101049', 'aliases': ['eeu'], 'displayName': 'Endpoint Education Upgrade'},
   '1010500001': {

src/gam/gamlib/gluprop.py

@@ -117,6 +117,8 @@ PROPERTIES = {
     {CLASS: PC_STRING, TITLE: 'Full Name',},
   'displayName':
     {CLASS: PC_STRING, TITLE: 'Display Name',},
+  'primaryGuestEmail':
+    {CLASS: PC_STRING, TITLE: 'Primary Guest Email',},
   'languages':
     {CLASS: PC_LANGUAGES, TITLE: 'Languages',},
   'languageCode':
@@ -131,6 +133,8 @@ PROPERTIES = {
     {CLASS: PC_BOOLEAN, TITLE: 'Is a Super Admin',},
   'isDelegatedAdmin':
     {CLASS: PC_BOOLEAN, TITLE: 'Is Delegated Admin',},
+  'isGuestUser':
+    {CLASS: PC_BOOLEAN, TITLE: 'Is a Guest User',},
   'isEnrolledIn2Sv':
     {CLASS: PC_BOOLEAN, TITLE: '2-step enrolled',},
   'isEnforcedIn2Sv':

src/tools/_hashlib.vcxproj

@@ -0,0 +1,115 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|ARM">
+      <Configuration>Debug</Configuration>
+      <Platform>ARM</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|ARM64">
+      <Configuration>Debug</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="PGInstrument|ARM">
+      <Configuration>PGInstrument</Configuration>
+      <Platform>ARM</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="PGInstrument|ARM64">
+      <Configuration>PGInstrument</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="PGInstrument|Win32">
+      <Configuration>PGInstrument</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="PGInstrument|x64">
+      <Configuration>PGInstrument</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="PGUpdate|ARM">
+      <Configuration>PGUpdate</Configuration>
+      <Platform>ARM</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="PGUpdate|ARM64">
+      <Configuration>PGUpdate</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="PGUpdate|Win32">
+      <Configuration>PGUpdate</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="PGUpdate|x64">
+      <Configuration>PGUpdate</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|ARM">
+      <Configuration>Release</Configuration>
+      <Platform>ARM</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|ARM64">
+      <Configuration>Release</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{447F05A8-F581-4CAC-A466-5AC7936E207E}</ProjectGuid>
+    <RootNamespace>_hashlib</RootNamespace>
+    <Keyword>Win32Proj</Keyword>
+  </PropertyGroup>
+  <Import Project="python.props" />
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <CharacterSet>NotSet</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <PropertyGroup>
+    <TargetExt>$(PyStdlibPydExt)</TargetExt>
+  </PropertyGroup>
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+    <Import Project="pyproject.props" />
+    <Import Project="openssl.props" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup>
+    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
+  </PropertyGroup>
+  <ItemDefinitionGroup>
+    <Link>
+      <AdditionalDependencies>ws2_32.lib;crypt32.lib;advapi32.lib;user32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="..\Modules\_hashopenssl.c" />
+  </ItemGroup>
+  <ItemGroup>
+    <ResourceCompile Include="..\PC\python_nt.rc" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="pythoncore.vcxproj">
+      <Project>{cf7ac3d1-e2df-41d2-bea6-1e2556cdea26}</Project>
+      <ReferenceOutputAssembly>false</ReferenceOutputAssembly>
+    </ProjectReference>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

src/tools/openssl.props

@@ -15,12 +15,14 @@
     <_DLLSuffix Condition="$(Platform) == 'ARM64'">$(_DLLSuffix)-arm64</_DLLSuffix>
     <_DLLSuffix Condition="$(Platform) == 'x64'">$(_DLLSuffix)-x64</_DLLSuffix>
   </PropertyGroup>
+  <!-- GAM Static Build: Disable missing DLL/PDB copy
   <ItemGroup>
     <_SSLDLL Include="$(opensslOutDir)\libcrypto$(_DLLSuffix).dll" />
     <_SSLDLL Include="$(opensslOutDir)\libcrypto$(_DLLSuffix).pdb" />
     <_SSLDLL Include="$(opensslOutDir)\libssl$(_DLLSuffix).dll" />
     <_SSLDLL Include="$(opensslOutDir)\libssl$(_DLLSuffix).pdb" />
   </ItemGroup>
+  -->
   <Target Name="_CopySSLDLL" Inputs="@(_SSLDLL)" Outputs="@(_SSLDLL->'$(OutDir)%(Filename)%(Extension)')" AfterTargets="Build">
     <Copy SourceFiles="@(_SSLDLL)" DestinationFolder="$(OutDir)" />
   </Target>

src/tools/py314-ossl4.diff

@@ -0,0 +1,67 @@
+diff --git a/Modules/_ssl.c b/Modules/_ssl.c
+index 1235eff72f7..f68e34b7560 100644
+--- a/Modules/_ssl.c
++++ b/Modules/_ssl.c
+@@ -134,6 +134,17 @@ static void _PySSLFixErrno(void) {
+ #error Unsupported OpenSSL version
+ #endif
+
++#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
++#  define OPENSSL_NO_SSL3
++#  define OPENSSL_NO_TLS1
++#  define OPENSSL_NO_TLS1_1
++#  define OPENSSL_NO_TLS1_2
++#  define OPENSSL_NO_SSL3_METHOD
++#  define OPENSSL_NO_TLS1_METHOD
++#  define OPENSSL_NO_TLS1_1_METHOD
++#  define OPENSSL_NO_TLS1_2_METHOD
++#endif
++
+ /* OpenSSL API 1.1.0+ does not include version methods */
+ #ifndef OPENSSL_NO_SSL3_METHOD
+ extern const SSL_METHOD *SSLv3_method(void);
+@@ -1133,7 +1144,7 @@ _asn1obj2py(_sslmodulestate *state, const ASN1_OBJECT *name, int no_name)
+
+ static PyObject *
+ _create_tuple_for_attribute(_sslmodulestate *state,
+-                            ASN1_OBJECT *name, ASN1_STRING *value)
++                            const ASN1_OBJECT *name, const ASN1_STRING *value)
+ {
+     Py_ssize_t buflen;
+     PyObject *pyattr;
+@@ -1162,16 +1173,16 @@ _create_tuple_for_attribute(_sslmodulestate *state,
+ }
+
+ static PyObject *
+-_create_tuple_for_X509_NAME (_sslmodulestate *state, X509_NAME *xname)
++_create_tuple_for_X509_NAME (_sslmodulestate *state, const X509_NAME *xname)
+ {
+     PyObject *dn = NULL;    /* tuple which represents the "distinguished name" */
+     PyObject *rdn = NULL;   /* tuple to hold a "relative distinguished name" */
+     PyObject *rdnt;
+     PyObject *attr = NULL;   /* tuple to hold an attribute */
+     int entry_count = X509_NAME_entry_count(xname);
+-    X509_NAME_ENTRY *entry;
+-    ASN1_OBJECT *name;
+-    ASN1_STRING *value;
++    const X509_NAME_ENTRY *entry;
++    const ASN1_OBJECT *name;
++    const ASN1_STRING *value;
+     int index_counter;
+     int rdn_level = -1;
+     int retcode;
+@@ -6506,9 +6517,15 @@ sslmodule_init_constants(PyObject *m)
+     ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
+     ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
+     ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
++#ifndef OPENSSL_NO_TLS1
+     ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
++#endif
++#ifndef OPENSSL_NO_TLS1_1
+     ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
++#endif
++#ifndef OPENSSL_NO_TLS1_2
+     ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
++#endif
+
+ #define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1

src/tools/ssd.mjs

@@ -31,6 +31,9 @@ async function takeScreenshot(filename) {
   const workspace = process.env.GITHUB_WORKSPACE || process.cwd();
   const fullPath = path.join(workspace, filename);
   
+  // Create a temporary script file path
+  const scriptPath = path.join(workspace, `screenshot_${Date.now()}.ps1`);
+
   const psScript = `
     Add-Type -AssemblyName System.Windows.Forms;
     Add-Type -AssemblyName System.Drawing;
@@ -44,47 +47,101 @@ async function takeScreenshot(filename) {
     $bitmap = New-Object System.Drawing.Bitmap $Screen.Width, $Screen.Height;
     $graphic = [System.Drawing.Graphics]::FromImage($bitmap);
     $graphic.CopyFromScreen($Screen.Left, $Screen.Top, 0, 0, $bitmap.Size);
+    
+    # Save the file (using single quotes safely now)
     $bitmap.Save('${fullPath}');
+    Write-Output "Wrote ${fullPath}";
+    
+    # Specify ItemType to prevent older PS versions from prompting interactively
+    New-Item -Path "${fullPath}.written" -ItemType File | Out-Null;
   `;
   
   try {
-    execSync(`powershell -Command "${psScript}"`);
+    // 1. Write the script to disk
+    fs.writeFileSync(scriptPath, psScript);
+
+    // 2. Execute the file directly, piping stdout/stderr to the Node console
+    execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File "${scriptPath}"`, { 
+        stdio: 'inherit' 
+    });
+    
     console.log(`Saved screenshot: ${fullPath}`);
   } catch (err) {
     console.error(`Failed to save screenshot ${fullPath}:`, err.message);
+  } finally {
+    // 3. Clean up the temp file so it doesn't clutter your CI artifacts
+    if (fs.existsSync(scriptPath)) {
+        fs.unlinkSync(scriptPath);
+    }
   }
 }
 
-// Fire and forget application launcher
+// Fire and forget application launcher with logging
 function launchSSD() {
+    const workspace = process.env.GITHUB_WORKSPACE || process.cwd();
+    const outLogPath = path.join(workspace, 'ssd_out.log');
+    const errLogPath = path.join(workspace, 'ssd_err.log');
+
+    // Open file descriptors for logging
+    const out = fs.openSync(outLogPath, 'a');
+    const err = fs.openSync(errLogPath, 'a');
+
+    console.log(`Launching SSD... Logging stdout to ${outLogPath} and stderr to ${errLogPath}`);
+
     const child = spawn('C:\\Program Files\\Certum\\SimplySign Desktop\\SimplySignDesktop.exe', [], {
         detached: true,
-        stdio: 'ignore'       
+        // stdio array: [stdin, stdout, stderr]
+        // We ignore stdin, and pipe stdout/stderr to our files
+        stdio: ['ignore', out, err]
     });
+
+    // Catch immediate errors (e.g., file not found, permission denied)
+    child.on('error', (error) => {
+        console.error('Failed to spawn SimplySign Desktop:', error.message);
+    });
+
+    // Unreference the child so the parent script can exit
     child.unref();
 }
 
 async function runSSD() {
-    await takeScreenshot('001.png');
+    const runner_arch =  process.env.RUNNER_ARCH;
-    minimizeAllWindows();
+    if ( runner_arch === "ARM64" ) {
-    await sleep(2000);
+          console.log('Running on ARM64. Tabbing through OOBE...');
-    await takeScreenshot('002.png');
+          await sleep(3000);
-    sendKeys('{ESC}');
+          await takeScreenshot('oob1.png');
-    await sleep(2000);
-    await takeScreenshot('003.png');
-    //sendKeys('{ESC}');
-    //await sleep(2000);
-    //await takeScreenshot('004.png');
-    //sendKeys('{ESC}');
-    //await sleep(2000);
-    //await takeScreenshot('005.png');
-    //sendKeys('%{F4}');
-    //await sleep(2000);
-    //await takeScreenshot('006.png');
-    //sendKeys('%{F4}');
-    //await sleep(2000);
-    //await takeScreenshot('007.png');
           
+          // Page 1: Tab through the toggles to reach the "Next" button
+          for (let i = 0; i < 7; i++) {
+              sendKeys('{TAB}');
+              await sleep(200);
+          }
+          sendKeys('{ENTER}');
+          console.log('Clicked Next');
+          
+          await sleep(3000); 
+          await takeScreenshot('ooob2.png');
+
+          // Page 2: Tab through the remaining toggles to reach the "Accept" button
+          for (let i = 0; i < 7; i++) {
+              sendKeys('{TAB}');
+              await sleep(200);
+          }
+          sendKeys('{ENTER}');
+          console.log('Clicked Accept');
+          
+          await sleep(3000);
+          await takeScreenshot('oob3.png');
+
+           sendKeys('{ESC}');
+          console.log('Escaped start menu');
+          
+          await sleep(3000);
+          await takeScreenshot('oob4.png');
+
+        } else {
+          console.log('NOT running on ARM64');
+        }
     // Re-execute SSD to open login dialog
     launchSSD();
     await sleep(3000);

wiki/Authorization.md

@@ -315,6 +315,9 @@ You can optionally specify the type of service account key with `algorithm|local
 Use `nokey` if you do not want a service account key created for the project.
 
 ## Use an existing project for GAM authorization
+
+To use the same GAM project on multiple computers, see: [GAM Configuration](Multiple-Computers)
+
 Use an existing project to create and download two files: `client_secrets.json` for the Client and `oauth2service.json` for the Service Account.
 
 ### Default values

wiki/CSV-Input-Filtering.md

@@ -60,6 +60,9 @@ These filters can be used alone or in conjunction with the `matchfield|skipfield
         [(any|all):]notdata:<DataSelector>|
         [(any|all):]notregex:<RESearchPattern>|
         [(any|all):]notregexcs:<RESearchPattern>|
+        [(any|all):]number<Operator><Number>|
+        [(any|all):]numberrange!=<Number>/<Number>|
+        [(any|all):]numberrange=<Number>/<Number>|
         [(any|all):]regex:<RESearchPattern>|
         [(any|all):]regexcs:<RESearchPattern>|
         [(any|all):]text<Operator><String>|

wiki/CSV-Output-Filtering.md

@@ -68,6 +68,9 @@ on all platforms.
         [(any|all):]notdata:<DataSelector>
         [(any|all):]notregex:<RESearchPattern>|
         [(any|all):]notregexcs:<RESearchPattern>|
+        [(any|all):]number<Operator><Number>|
+        [(any|all):]numberrange!=<Number>/<Number>|
+        [(any|all):]numberrange=<Number>/<Number>|
         [(any|all):]regex:<RESearchPattern>|
         [(any|all):]regexcs:<RESearchPattern>|
         [(any|all):]text<Operator><String>|

wiki/ChromeOS-Devices.md

@@ -428,7 +428,7 @@ See https://support.google.com/chrome/a/answer/3523633 for full details.
 Thanks to Jay for most of the following.
 
 Send a remote command to the managed Chrome OS device. It's important to note that the device must be in a proper state to accept the command or an error may be returned.
-For example, the `reboot`, `set_volume` and `take_a_screenshot` commands only work if the device is configured in auto-start kiosk app mode.
+For example, the `set_volume` and `take_a_screenshot` commands only work if the device is configured in auto-start kiosk app mode.
 
 The `wipe_users` and `remote_powerwash` commands will erase all user data on the device and the `remote_powerwash` command will require that the device is physically reconnected to the
 WiFi network and re-enrolled before it can be managed again. These commands require the `doit` argument so that the admin confirms the potential loss of user data and management.

wiki/Classroom-Courses.md

@@ -131,6 +131,7 @@ gam user user@domain.com check|update serviceaccount
         name|
         owneremail|
         ownerid|
+        ownername|
         room|
         section|
         teacherfolder|
@@ -431,14 +432,16 @@ gam courses <CourseEntity> update topic <CourseTopicIDEntity> <CourseTopic>
 
 ## Display courses
 ```
-gam info course <CourseID> [owneremail] [alias|aliases] [show all|students|teachers] [countsonly]
+gam info course <CourseID>
+        [owneremail] [ownername] [alias|aliases] [show all|students|teachers] [countsonly]
         [fields <CourseFieldNameList>] [skipfields <CourseFieldNameList>] [formatjson]
-gam info courses <CourseEntity> [owneremail] [alias|aliases] [show all|students|teachers] [countsonly]
+gam info courses <CourseEntity>
+        [owneremail] [ownername] [alias|aliases] [show all|students|teachers] [countsonly]
         [fields <CourseFieldNameList>] [skipfields <CourseFieldNameList>] [formatjson]
 
 gam print courses [todrive <ToDriveAttribute>*]
         (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] [states <CourseStateList>])
-        [owneremail] [owneremailmatchpattern <REMatchPattern>]
+        [owneremail] [owneremailmatchpattern <REMatchPattern>] [ownername]
         [alias|aliases|aliasesincolumns [delimiter <Character>]]
         [show all|students|teachers] [countsonly]
         [timefilter creationtime|updatetime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
@@ -471,7 +474,9 @@ To get information about courses created/updated within a particular time frame,
 For the filter to apply, `timefilter` and at least one of `start|starttime` and `end|endtime` must be specified.
 
 By default, all basic course fields are displayed; use the following options to modify the output.
-* `owneremail` - Display course owner email; requires an additional API call per course.
+* `owneremail` - Display course owner email.
+* `ownername` - Display course owner name.
+    * These options require an additional API call per course.
 * `alias|aliases` - Display course aliases; all aliases are in the single column `Aliases` separated by a delimiter; requires an additional API call per course.
     * `delimiter <Character>` - Delimiter between aliases with `print` command.
 * `aliasesincolumn` - Display course aliases; the `Aliases` column contains the number of aliases and `Aliases.0`, `Aliases.1`, ... contain the individual aliases; requires an additional API call per course.
@@ -525,7 +530,8 @@ gam print course-announcements [todrive <ToDriveAttribute>*]
         (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] states <CourseStateList>])
         (courseannouncementids <CourseAnnouncementIDEntity>)|(announcementstates <CourseAnnouncementStateList>)*
         (orderby <CourseAnnouncementOrderByFieldName> [ascending|descending])*)
-        [creatoremail] [fields <CourseAnnouncementFieldNameList>]
+        [showcreatoremails|creatoremail] [showcreatornames|creatorname]
+        [fields <CourseAnnouncementFieldNameList>]
         [timefilter creationtime|updatetime|scheduledtime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
         [countsonly] [formatjson [quotechar <Character>]]
 ```
@@ -553,7 +559,10 @@ To get information about course announcements created/updated/scheduled within a
 For the filter to apply, `timefilter` and at least one of `start|starttime` and `end|endtime` must be specified.
 
 By default, all course announcement fields are displayed; use the following options to modify the output.
-* `creatoremail` - Display course announcement creator email; requires an additional API call per course announcement.
+* `creatoremail` - Display course announcement creator email.
+* `creatorname` - Display course announcement creator name.
+    * These options require an additional API call per course.
+* `alias|aliases` - Display course aliases; all aliases are in the single column `Aliases` separated by a delimiter; requires an additional API call per course.
 * `fields <CourseAnnouncementFieldNameList>` - Select specific fields to display.
 
 Use the `countsonly` option to display the number of announcements in a course but not their details.
@@ -573,7 +582,8 @@ gam print course-materials [todrive <ToDriveAttribute>*]
         (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] states <CourseStateList>])
         (materialids <CourseMaterialIDEntity>)|(materialstates <CourseMaterialStateList>)*
         (orderby <CourseMaterialOrderByFieldName> [ascending|descending])*)
-        [showcreatoremails|creatoremail] [showtopicnames] [fields <CourseMaterialFieldNameList>]
+        [showcreatoremails|creatoremail] [showcreatornames|creatorname] [showtopicnames]
+        [fields <CourseMaterialFieldNameList>]
         [timefilter creationtime|updatetime|scheduledtime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
         [oneitemperrow]
         [countsonly] [formatjson [quotechar <Character>]]
@@ -602,8 +612,10 @@ By default, all published course materials for a course are displayed; use the f
 * `materialsstates <CourseMaterialsStateList>` - Display course materials with any of the specified states.
 
 By default, all course materials fields are displayed; use the following options to modify the output.
-* `showcreatoremails` - Display course materials creator email; requires an additional API call per course materials.
+* `showcreatoremails|creatoremail` - Display course materials creator email.
-* `showtopicnames` - Display topic names; requires and additional API call per course.
+* `showcreatornames|creatorname` - Display course materials creator name.
+    * These options require an additional API call per course.
+* `showtopicnames` - Display topic names; requires an additional API call per course.
 * `fields <CourseMaterialsFieldNameList>` - Select specific fields to display.
 
 With `print course-materials`, the materials selected for display are all output on one row/line as a repeating item with the other course fields.
@@ -669,7 +681,8 @@ gam print course-work [todrive <ToDriveAttribute>*]
         (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] states <CourseStateList>])
         (workids <CourseWorkIDEntity>)|(workstates <CourseWorkStateList>)*
         (orderby <CourseWorkOrderByFieldName> [ascending|descending])*)
-        [showcreatoremails] [showtopicnames] [fields <CourseWorkFieldNameList>]
+        [showcreatoremails|creatoremail] [showcreatornames|creatorname] [showtopicnames]
+        [fields <CourseWorkFieldNameList>]
         [showstudentsaslist [<Boolean>]] [delimiter <Character>]
         [timefilter creationtime|updatetime|scheduledtime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
         [oneitemperrow]
@@ -699,8 +712,10 @@ By default, all published course work for a course is displayed; use the followi
 * `workstates <CourseWorkStateList>` - Display course work with any of the specified states.
 
 By default, all course work fields are displayed; use the following options to modify the output.
-* `showcreatoremails` - Display course work creator email; requires an additional API call per course work.
+* `showcreatoremails|creatoremail` - Display course materials creator email.
-* `showtopicnames` - Display topic names; requires and additional API call per course.
+* `showcreatornames|creatorname` - Display course materials creator name.
+    * These options require an additional API call per course.
+* `showtopicnames` - Display topic names; requires an additional API call per course.
 * `fields <CourseWorkFieldNameList>` - Select specific fields to display.
 
 By default, when course work is assigned to individual students, the student IDs are displayed in multiple indexed columns.

wiki/Cloud-Identity-Groups.md

@@ -1,10 +1,11 @@
 # Cloud Identity Groups
 - [API documentation](#api-documentation)
 - [Query documentation](#query-documentation)
-- [Python Regular Expressions](Python-Regular-Expressions) Match function
+- [Python Regular Expressions](Python-Regular-Expressions) Match function and Search function
 - [Notes](#Notes)
 - [Definitions](#definitions)
 - [Manage groups](#manage-groups)
+- [Update a group's primary email address](#update-a-groups-primary-email-address)
 - [Display information about individual groups](#display-information-about-individual-groups)
 - [Display information about multiple groups](#display-information-about-multiple-groups)
 - [Display group counts](#display-group-counts)
@@ -75,12 +76,14 @@ and Cloud Identity Premium accounts.
 <RESubstitution> ::= <String>>
 
 <GroupSettingsAttribute> ::=
+        (accesstype public|team|announcementonly|restricted)|
         (allowexternalmembers <Boolean>)|
         (allowwebposting <Boolean>)|
         (archiveonly <Boolean>)|
         (customfootertext <String>)|
         (customreplyto <EmailAddress>)|
         (defaultmessagedenynotificationtext <String>)|
+        (defaultsender self|group)|
         (description <String>)|
         (enablecollaborativeinbox|collaborative <Boolean>)|
         (includeinglobaladdresslist|gal <Boolean>)|
@@ -94,7 +97,8 @@ and Cloud Identity Premium accounts.
         (sendmessagedenynotification <Boolean>)|
         (spammoderationlevel allow|moderate|silently_moderate|reject)|
         (whocanadd all_members_can_add|all_managers_can_add|all_owners_can_add|none_can_add)|
-        (whocancontactowner anyone_can_contact|all_in_domain_can_contact|all_members_can_contact|all_managers_can_contact)|
+        (whocanaddexternalmembers only_owners_can_add_external_members|end_users_can_add_external_members)|
+        (whocancontactowner anyone_can_contact|all_in_domain_can_contact|all_members_can_contact|all_managers_can_contact|all_owners_can_contact)|
         (whocanjoin anyone_can_join|all_in_domain_can_join|invited_can_join|can_request_to_join)|
         (whocanleavegroup all_members_can_leave|all_managers_can_leave|all_owners_can_leave|none_can_leave)|
         (whocanpostmessage none_can_post|all_managers_can_post|all_members_can_post|all_owners_can_post|all_in_domain_can_post|anyone_can_post)|
@@ -138,7 +142,7 @@ and Cloud Identity Premium accounts.
 <GroupAttribute> ::=
         <JSONData>|
         <GroupSettingsAttribute>|
-        (whocandiscovergroup allmemberscandiscover|allindomaincandiscover|anyonecandiscover)|
+        (whocandiscovergroup all_members_can_discover|all_in_domain_can_discover|anyone_can_discover)|
         (whocanassistcontent all_members|owners_and_managers|managers_only|owners_only|none)|
         (whocanmoderatecontent all_members|owners_and_managers|owners_only|none)|
         (whocanmoderatemembers all_members|owners_and_managers|owners_only|none)|
@@ -181,6 +185,7 @@ and Cloud Identity Premium accounts.
         spammoderationlevel|
         whocanaddreferences|
         whocanadd|
+        whocanaddexternalmembers|
         whocanapprovemessages|
         whocanassigntopics|
         whocanassistcontent|
@@ -239,6 +244,7 @@ gam create cigroup <EmailAddress>
         [security|makesecuritygroup] [locked]
         [dynamic <QueryDynamicGroup>]
 gam update cigroup <GroupEntity> [copyfrom <GroupItem>] <GroupAttribute>
+        [updateprimaryemail <RESearchPattern> <RESubstitution> [preview]]
         [security|makesecuritygroup|
          dynamicsecurity|makedynamicsecuritygroup|
          lockedsecurity|makelockedsecuritygroup]
@@ -259,6 +265,22 @@ You can update a group to restrict its membership with the `memberrestrictions <
 
 The `makeowner` option makes the administrator in `oauth2.txt` the initial owner of the group.
 
+## Update a group's primary email address
+You can simply update a group's primary email address with the `email` option.
+```
+gam update cigroup groupold@domain.com email groupnew@domain.com
+```
+The `updateprimaryemail <RESearchPattern> <RESubstitution> [preview]` option allows modification several group's
+current primary email address. For example, to change the domain of a set of groups from the current domain.com to newdomain.com,
+make a CSV file Groups.csv with a column `email` that contains the group email addresses that are to be changed.
+You can list all groups with: `gam redirect csv ./Groups.csv print cigroups`
+```
+gam update cigroup csvfile Groups.csv:email updateprimaryemail "^(.+)@domain.com$" "\1@newdomain.com"
+```
+The `preview` option allows verification of the primary email address changes before commiting the changes.
+
+If the group's current primary email address does not match the <REMatchPattern> then no modification is made.
+
 ## Display information about individual groups
 This command displays information as an indented list of keys and values.
 ```

wiki/Cloud-Identity-Policies.md

@@ -12,13 +12,13 @@
 
 ## Notes
 To use these commands you must update your client access authentication.
-You'll enter 20r to turn on the Cloud Identity Policy scope; then continue
+You'll enter 23 or 23r to turn on the Cloud Identity Policy scope; then continue
 with authentication.
 ```
 gam oauth delete
 gam oauth create
 ...
-[R] 20)  Cloud Identity - Policy (supports readonly)
+[R] 23)  Cloud Identity - Policy (supports readonly)
 ```
 You must enable access to policies in the GCP cloud console.
 
@@ -67,7 +67,7 @@ Select policies::
 * `settings/<String>` - A policy setting type, `settings/workspace_marketplace.apps_allowlist`
 * `<String>` - A policy setting type, `workspace_marketplace.apps_allowlist`
 
-By default, policy warnings are displayed, use the 'nowarnings` option to suppress their display.
+By default, policy warnings are displayed, use the `nowarnings` option to suppress their display.
 
 By default, additional API calls are made for `settings/workspace_marketplace.apps_allowlist`
 to get the application name for the application ID. Use option `noappnames` to suppress these calls.
@@ -138,6 +138,11 @@ Print all service status policies.
 gam redirect csv ./ServiceStatusPolicies.csv print policies filter "setting.type.matches('.*service_status')"
 ```
 
+Print Drive external sharing policies.
+```
+gam redirect csv ./DriveExternalSharingPolicies.csv print policies filter "setting.type.matches('settings/drive_and_docs.external_sharing')"
+```
+
 Print all polices that apply directly to the OU "/Staff".
 ```
 gam redirect csv ./StaffPolicies.csv print policies ou "^/Staff$"

wiki/Collections-of-Users.md

@@ -3,9 +3,19 @@
 - [Notes](#notes)
 - [Definitions](#definitions)
 - [User Type Entity](#user-type-entity)
+  - [All non-archived Users](#all-non-archived-users)
+  - [All archived Users](#all-archived-Users)
   - [All non-suspended Users](#all-non-suspended-users)
   - [All suspended Users](#all-suspended-Users)
+  - [All archived or suspended Users](#all-archived-or-suspended-users)
+  - [All non-archived and non-suspended Users](#all-non-archived-and-non-suspended-users)
   - [All non-suspended and suspended Users](#all-non-suspended-and-suspended-users)
+  - [All non-suspended Guests](#all-non-suspended-guests)
+  - [All suspended Guests](#all-suspended-Guests)
+  - [All non-suspended and suspended Guests](#all-non-suspended-and-suspended-guests)
+  - [All non-suspended Users and Guests](#all-non-suspended-users-and-guests)
+  - [All suspended Users and Guests](#all-suspended-users-and-guests)
+  - [All non-suspended and suspended Users and Guests](#all-non-suspended-and-suspended-users-and-guests)
   - [A single User](#a-single-user)
   - [A list of Users](#a-list-of-users)
   - [The admin user referenced in oauth2.txt](#the-admin-user-referenced-in-oauth2txt)
@@ -40,6 +50,18 @@
 
 ## Notes
 
+The following items referencing guest users were added to  `<UserTypeEntity>` in version 7.43.00.
+```
+all_guests
+all_guests_ns
+all_guests_susp
+all_guests_ns_susp
+all_users_and_guests
+all_users_and_guests_ns
+all_users_and_guests_susp
+all_users_and_guests_ns_susp
+```
+
 The followig items referencing non-archived/archived users were added to `<UserTypeEntity>` in version 7.22.00.
 ```
 all users_na
@@ -123,6 +145,8 @@ ous_and_children_na_ns
 
 <UserTypeEntity> ::=
         (all users|users_na|users_arch|users_ns|users_susp|users_ns_susp|users_arch_or_susp|users_na_ns)|
+        (all guests|guests_ns|guests_susp|guests_ns_susp)|
+        (all users_and_guests|users_and_guests_ns|users_and_guests_susp|users_and_guests_ns_susp)|
         (user <UserItem>)|
         (users <UserList>)|
         (oauthuser)
@@ -232,6 +256,26 @@ Use these options to select users for GAM commands.
 ## All non-suspended and suspended Users
 * `all users_ns_susp`
 
+## All non-suspended Guests
+* `all guests`
+* `all guests_ns`
+
+## All suspended Guests
+* `all guests_susp`
+
+## All non-suspended and suspended Guests
+* `all guests_ns_susp`
+
+## All non-suspended Users and Guests
+* `all users_and_guests`
+* `all users_and_guests_ns`
+
+## All suspended Users and Guests
+* `all users_and_guests_susp`
+
+## All non-suspended and suspended Users and Guests
+* `all users_and_guests_ns_susp`
+
 ## A single User
 * `user <UserItem>`
 

wiki/Customer.md

@@ -4,6 +4,8 @@
 - [Update customer](#update-customer)
 - [Display customer](#display-customer)
 - [Display instance](#display-instance)
+- [Display Customer ID](#display-customer-id)
+- [Display GCP organization ID](#display-gcp-organization-id)
 
 ## API documentation
 * [Directory API - Customers](https://developers.google.com/admin-sdk/directory/reference/rest/v1/customers)
@@ -45,3 +47,19 @@ gam info instance [formatjson]
 ```
 By default, Gam displays the information as an indented list of keys and values.
 * `formatjson` - Display the fields in JSON format.
+
+## Display Customer ID
+You can get and set the `gam.cfg/customer_id` value with these commands:
+```
+$ gam info customerid             
+C78abc9de
+$ gam config customer_id C78abc9de save
+```
+## Display GCP organization ID
+You can get and set the `gam.cfg/gcp_org_id` value with these commands:
+```
+$ gam info gcporgid             
+organizations/906207637890
+$ gam config gcp_org_id organizations/906207637890 save
+```
+

wiki/GAM7-FAQ.md

@@ -36,13 +36,15 @@ gam version
 Updating from Jay’s GAM to GAM7 may introduce some issues. If your GAM install is critical to your product Google environment you may want to wait for some of the upgrade challenges to be ironed out in the next few weeks. Having said that, GAM stores all of it’s configuration in the GAM install folder so backing up that folder should preserve your old GAM config. For [upgrade instructions see the wiki](https://github.com/GAM-team/GAM/wiki/How-to-upgrade-from-Standard-GAM).
 
 # What does this mean if I’m using Ross’ GAM-ADV?
-GAM7 is effectively the same source as GAMADV-XTD3 with minor changes to point to the [github.com/GAM-team/GAM](http://github.com/GAM-team/GAM) site. On Linux/MacOS you should be able to run:
+GAM7 is effectively the same source as GAMADV-XTD3 with minor changes to point to the [github.com/GAM-team/GAM](http://github.com/GAM-team/GAM) site.
+
+On Linux/MacOS you should be able to run:
 
 ```
 bash <(curl -s -S -L https://git.io/gam-install) -l
 ```
 
-To upgrade. On Windows, download the latest MSI from [git.io/gam-releases](http://git.io/gam-releases) and install it to the same path you had GAM-ADV installed.
+On Windows, download the latest EXE installer from [git.io/gam-releases](http://git.io/gam-releases), run it and  install it to the same path you had GAM-ADV installed.
 
 Both GAM7 and GAM-ADV versions use the same configuration file (gam.cfg), and credentials; they are interchangeable.
 

wiki/GamUpdates.md

@@ -10,6 +10,211 @@ Add the `-s` option to the end of the above commands to suppress creating the `g
 
 See [Downloads-Installs-GAM7](https://github.com/GAM-team/GAM/wiki/Downloads-Installs) for Windows or other options, including manual installation
 
+### 7.43.04
+
+Added option `include_suspended_zeros [<Boolean>]` to `gam print vaultcounts` that causes
+GAM to generate zero count lines for suspended users with zero items as well as non-suspended users.
+
+### 7.43.03
+
+Added option `parentpathonly [<Boolean>]` to the following commands that causes GAM
+to display only the parent folder names when displaying the path to a file.
+```
+gam <UserTypeEntity> info drivefile ... filepath|fullpath
+gam <UserTypeEntity> show fileinfo ... filepath|fullpath
+gam <UserTypeEntity> print|show filepath
+gam <UserTypeEntity> print filelist ... filepath|fullpath
+```
+
+### 7.43.02
+
+Added option `maxactivities <Number>` to `gam <UserTypeEntity> print driveactivity` to limit
+the number of activities displayed; the default is 0, no limit.
+
+### 7.43.01
+
+Updated `gam info user` and `gam print users` to display guest user attributes: `isGuestUser, guestAccountInfo`
+
+Expanded `<UserTypeEntity>` to allow specification of guest users.
+  * See [Collections of Users](Collections-of-Users)
+
+### 7.42.00
+
+In versions prior to 7.42.00, when `redirect csv <FileName>` was used, GAM did not open and write `<FileName>`
+until all processing was complete; if `<FileName>` was not accessible, an error was generated
+and no results were saved. Now, `<FileName>` is opened initially to verify accessiblity
+and then written when processing is complete.
+
+In the unlikely event that this causes issues, you can do `redirect csv <FileName> delayopen`
+to get the previous behavior.
+
+### 7.41.03
+
+Fixed bug in the following:
+Added the following to `<RowValueFilter>` used in CSV input/output row filtering; these are
+synonyms for `count` and `countrange`.
+```
+[(any|all):]number<Operator><Number>|
+[(any|all):]numberrange!=<Number>/<Number>|
+[(any|all):]numberrange=<Number>/<Number>|
+```
+
+### 7.41.02
+
+Added option `ownername` to `gam info|print courses` to have GAM display the course owners full name;
+there is an extra API call per course to get the name.
+
+Added option `creatorname` to `gam print course-announcements|course-materials|course-works` to have
+GAM display the item creators full name; there is an extra API call per course to get the name.
+
+After creating a group, it may be sometime, e.g. 30-45 seconds, before members can
+successfully be added to the group even though the API reported that the group was created.
+The following options can be used with `gam create group` to verify that the group is actually ready to be updated.
+This will be most useful in scripts that are used to create and then populate groups.
+```
+verifycreationretries <Integer> - Verify group creation, defaults to 0, no verification performed, range 0-20
+verifycreationinitialdelay <Integer> - Number of seconds to delay before first verification performed, defaults to 5, range 0-60
+verifycreationretrydelay <Integer> - Number of seconds to delay between verificaton retries, defaults to 5, range 1-60
+```
+
+If you have a script that deletes a group and then immediately tries to create a new group with the same email address,
+you may run into issues. There seems to be a 30-45 second window after the deletion in which a couple
+of strange errors can occur on the creation: `Resource not found` and `Duplicate`.
+The following options can be used with `gam create group` to handle these errors. This will be most useful
+in scripts that are used to delete and then immediately recreate groups.
+```
+recentdeleteretries <Integer> - Handle group delete/create errors, defaults to 0, no errors handled, range 0-20
+recentdeleteretrydelay <Integer> - Number of seconds to delay between retries, defaults to 5, range 1-60
+```
+
+Added the following to `<RowValueFilter>` used in CSV input/output row filtering; these are
+synonyms for `count` and `countrange`.
+```
+[(any|all):]number<Operator><Number>|
+[(any|all):]numberrange!=<Number>/<Number>|
+[(any|all):]numberrange=<Number>/<Number>|
+```
+
+### 7.41.01
+
+Fixed bug in `gam print cigroups members managers owners countsonly totalcount internal external` that caused a trap.
+
+### 7.41.00
+
+Upgraded to Python 3.14.4 and OpenSSL 4.0.0.
+
+### 7.40.03
+
+Added option `whocanaddexternalmembers only_owners_can_add_external_members|end_users_can_add_external_members` to `<GroupSettingsAttribute>`.
+It appears that `allowexternalmembers true` must be set in the same command.
+Added option `whocanaddexternalmembers` to `<GroupFieldName>`.
+These options are not in general release as of 2026-04-13; experiment.
+
+### 7.40.02
+
+Updated `gam info|print cigroups` and `gam print|show cigroup-members` to handle trap caused
+by API returning invalid member data; `preferredMemberKey` with no `id`.
+
+### 7.40.01
+
+Updated `gam <UserTypeEntity> print filelist|filecounts` to handle the `permissionDetails` subfield
+of the `permissions` field for My Drives; this useful when trying to display permission inheritance.
+An additional API call per file is required to get the `permissionDetails` subfield.
+```
+gam user user@domain.com print filelist fields id,name,mimetype,basicpermissions,permissiondetails oneitemperrow
+gam user user@domain.com print filelist fields id,name,mimetype,basicpermissions,permissiondetails pm inherited false em pmfilter oneitemperrow
+```
+
+### 7.40.00
+
+Updated `gam print|show businessprofileaccounts` (client access) to
+`gam <UserTypeEntity> print|show businessprofileaccounts` (service account access).
+You'll need to run `gam user user@domain.com update serviceaccount` and
+select `2)  Business Account Management API`.
+
+### 7.39.08
+
+Fixed bug in `gam oauth create` that caused a trap when `0)  Business Account Management API` was selected.
+
+Upgraded to Python 3.14.4 on macOS and Windows; Linux is still 3.14.3.
+
+### 7.39.07
+
+Upgraded to OpenSSL 3.6.2.
+
+### 7.39.06
+
+Fixed bug in `gam version checkrc`.
+
+### 7.39.05
+
+Added optional argument `preview` to `updateprimaryemail <RegularExpression> <EmailReplacement> [preview]`
+for the following commands that causes GAM to preview, but not perform, primary email address changes.
+This allows verification of the primary email address changes before commiting the changes.
+```
+gam update group <GroupEntity>
+gam update cigroup <GroupEntity>
+gam <UserTypeEntity> update user
+```
+
+### 7.39.04
+
+Added `updateprimaryemail <RegularExpression> <EmailReplacement>` option to
+`gam update group <GroupEntity>` and `gam update cigroup <GroupEntity>` to allow modifying
+the group's current primary email address.
+For example, to change the domain of a set of groups from the current domain.com to newdomain.com:
+```
+gam update group csvfile Groups.csv:email updateprimaryemail "^(.+)@domain.com$" "\1@newdomain.com"
+```
+
+### 7.39.03
+
+Added the following options to `gam <UserTypeEntity> create chatspace` that can be used to capture
+space details when creating chat spaces in bulk.
+```
+csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]] (addcsvdata <FieldName> <String>)*
+```
+
+See: https://github.com/GAM-team/GAM/wiki/Users-Chat#bulk-build-chat-spaces
+
+### 7.39.02
+
+Fixed progress messages for `gam <UserTypeEntity> print filelist` when permissions were being
+displayed/matched for Shared Drives.
+
+### 7.39.01
+
+Updated `gam <UserTypeEntity> transfer drive <UserItem>` to handle the following error:
+```
+ERROR: 403: cannotDeletePermission - The authenticated user cannot delete the permission.
+```
+
+### 7.39.00
+
+Deleted variable `enforce_expansive_access` from `gam.cfg` and removed option `enforceexpansiveaccess`
+from the following commands as expansive access is now always enforced by Google on My Drives.
+```
+gam <UserTypeEntity> delete permissions
+gam <UserTypeEntity> delete drivefileacl
+gam <UserTypeEntity> update drivefileacl
+gam <UserTypeEntity> copy drivefile
+gam <UserTypeEntity> move drivefile
+gam <UserTypeEntity> transfer ownership
+gam <UserTypeEntity> claim ownership
+```
+
+### 7.38.02
+
+Added license SKU `1010470009` for `AI Expanded Access`; abbreviation `aiexpandedaccess`.
+
+Renamed license SKU `1010470001` from `Gemini Enterprise` to `Gemini Enterprise - Legacy`.
+
+### 7.38.01
+
+Added `root` as a synonym for '/' in command line arguments that specify an OU.
+This is to avoid issues where a stand-alone `/` on the command line may be mis-interpreted
+by the command line interpreter as a reference to the file system root.
+
 ### 7.38.00
 
 Added variable `gcp_org_id` to `gam.cfg` that is used by the following commands;
@@ -21,13 +226,20 @@ gam create|update|delete caalevel
 gam print|show caalevels
 gam print|show tokens gcpdetails
 ```
-You can get and set the `gcp_org_id` value with these commands:
+You can get and set the `gam.cfg/gcp_org_id` value with these commands:
 ```
 $ gam info gcporgid
 organizations/906207637890
 $ gam config gcp_org_id organizations/906207637890 save
 ```
 
+You can get and set the `gam.cfg/customer_id` value with these commands:
+```
+$ gam info customerid     
+C78abc9de
+$ gam config customer_id C78abc9de save
+```
+
 Added the following options to `gam report <ActivityApplicationName>`.
 ```
 applicationinfofilter <String>

wiki/Groups.md

@@ -1,12 +1,15 @@
 # Groups
 - [API documentation](#api-documentation)
 - [Query documentation](#query-documentation)
-- [Python Regular Expressions](Python-Regular-Expressions) Match function
+- [Python Regular Expressions](Python-Regular-Expressions) Match function and Search function
 - [Definitions](#definitions)
 - [GUI API Group settings mapping](#gui-api-group-settings-mapping)
 - [GUI API Group access type settings mapping](#gui-api-group-access-type-settings-mapping)
 - [whoCanViewMembership and whoCanDiscoverGroup interactions](#whocanviewmembership-and-whocandiscovergroup-interactions)
 - [Manage groups](#manage-groups)
+- [Handle group deletion and immediate recreation](#handle-group-deletion-and-immediate-recreation)
+- [Verify group creation](#verify-group-creation)
+- [Update a group's primary email address](#update-a-groups-primary-email-address)
 - [Update a group's settings with JSON data](#update-a-groups-settings-with-json-data)
 - [Display information about specific groups](#display-information-about-specific-groups)
 - [Display information about selected groups](#display-information-about-selected-groups)
@@ -78,12 +81,13 @@ See [Collections of Items](Collections-of-Items)
         (isarchived <Boolean>)|
         (memberscanpostasthegroup <Boolean>)|
         (messagemoderationlevel moderate_all_messages|moderate_non_members|moderate_new_members|moderate_none)|
-        (name <String>)|
+        (name|displayname <String>)|
         (primarylanguage <Language>)|
         (replyto reply_to_custom|reply_to_sender|reply_to_list|reply_to_owner|reply_to_ignore|reply_to_managers)|
         (sendmessagedenynotification <Boolean>)|
         (spammoderationlevel allow|moderate|silently_moderate|reject)|
         (whocanadd all_members_can_add|all_managers_can_add|all_owners_can_add|none_can_add)|
+        (whocanaddexternalmembers only_owners_can_add_external_members|end_users_can_add_external_members)|
         (whocancontactowner anyone_can_contact|all_in_domain_can_contact|all_members_can_contact|all_managers_can_contact|all_owners_can_contact)|
         (whocanjoin anyone_can_join|all_in_domain_can_join|invited_can_join|can_request_to_join)|
         (whocanleavegroup all_members_can_leave|all_managers_can_leave|all_owners_can_leave|none_can_leave)|
@@ -171,6 +175,7 @@ See [Collections of Items](Collections-of-Items)
         spammoderationlevel|
         whocanaddreferences|
         whocanadd|
+        whocanaddexternalmembers|
         whocanapprovemessages|
         whocanassigntopics|
         whocanassistcontent|
@@ -347,7 +352,10 @@ These commands allow you to create, update and delete groups.
 gam create group <EmailAddress>
         [copyfrom <GroupItem>] <GroupAttribute>*
         [verifynotinvitable]
+        [recentdeleteretries <Integer>] [recentdeleteretrydelay <Integer>]
+        [verifycreationretries <Integer>] [verifycreationinitialdelay <Integer>] [verifycreationretrydelay <Integer>]
 gam update group|groups <GroupEntity> [email <EmailAddress>]
+        [updateprimaryemail <RESearchPattern> <RESubstitution> [preview]]
         [copyfrom <GroupItem>] <GroupAttribute>*
         [makesecuritygroup|security]
         [admincreated <Boolean>]
@@ -363,6 +371,44 @@ You can update a group to a security group with the `makesecuritygroup` option.
 
 When deleting and `noactionifalias` is specified, no action is performed if `<GroupEntity>` specifies an alias rather than a primary email address.
 
+## Handle group deletion and immediate recreation
+If you have a script that deletes a group and then immediately tries to create a new group with the same email address,
+you may run into issues. There seems to be a 30-45 second window after the deletion in which a couple
+of strange errors can occur on the creation: `Resource not found` and `Duplicate`.
+The following options can be used with `gam create group` to handle these errors. This will be most useful
+in scripts that are used to delete and then immediately  recreate groups.
+```
+recentdeleteretries <Integer> - Handle group delete/create errors, defaults to 0, no errors handled, range 0-20
+recentdeleteretrydelay <Integer> - Number of seconds to delay between retries, defaults to 5, range 1-60
+```
+
+## Verify group creation
+After creating a group, it may be sometime, e.g. 30-45 seconds, before members can
+successfully be added to the group even though the API reported that the group was created.
+The following options can be used with `gam create group` to verify that the group is actually ready to be updated.
+This will be most useful in scripts that are used to create and then populate groups.
+```
+verifycreationretries <Integer> - Verify group creation, defaults to 0, no verification performed, range 0-20
+verifycreationinitialdelay <Integer> - Number of seconds to delay before first verification performed, defaults to 5, range 0-60
+verifycreationretrydelay <Integer> - Number of seconds to delay between verificaton retries, defaults to 5, range 1-60
+```
+
+## Update a group's primary email address
+You can simply update a group's primary email address with the `email` option.
+```
+gam update group groupold@domain.com email groupnew@domain.com
+```
+The `updateprimaryemail <RESearchPattern> <RESubstitution> [preview]` option allows modification several group's
+current primary email address. For example, to change the domain of a set of groups from the current domain.com to newdomain.com,
+make a CSV file Groups.csv with a column `email` that contains the group email addresses that are to be changed.
+You can list all groups with: `gam redirect csv ./Groups.csv print groups`
+```
+gam update group csvfile Groups.csv:email updateprimaryemail "^(.+)@domain.com$" "\1@newdomain.com"
+```
+The `preview` option allows verification of the primary email address changes before commiting the changes.
+
+If the group's current primary email address does not match the <REMatchPattern> then no modification is made.
+
 ## Update a group's settings with JSON data
 You can save group settings in JSON format which can simplify updating multiple settings. Suppose you have
 a set of test groups that you will use to experiment with the new group settings coming in May 2019. You

wiki/How-to-Upgrade-Legacy-GAM-to-GAM7.md

@@ -251,10 +251,10 @@ writes the credentials into the file oauth2.txt.
 ```
 gamteam@server:/Users/gamteam$ rm -f /Users/gamteam/GAMConfig/oauth2.txt
 gamteam@server:/Users/gamteam$ gam version
-GAM 7.38.00 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.43.04 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.3 64-bit final
+Python 3.14.4 64-bit final
-macOS Tahoe 26.3.1 arm64
+macOS Tahoe 26.4.1 arm64
 Path: /Users/gamteam/bin/gam7
 Config File: /Users/gamteam/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 
@@ -1034,9 +1034,9 @@ writes the credentials into the file oauth2.txt.
 ```
 C:\>del C:\GAMConfig\oauth2.txt
 C:\>gam version
-GAM 7.38.00 - https://github.com/GAM-team/GAM - pythonsource
+GAM 7.43.04 - https://github.com/GAM-team/GAM - pythonsource
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.3 64-bit final
+Python 3.14.4 64-bit final
 Windows 11 10.0.26200 AMD64
 Path: C:\GAM7
 Config File: C:\GAMConfig\gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com

wiki/Licenses.md

@@ -41,6 +41,7 @@
 
 | License Name | License SKU | Abbreviation  |
 |--------------|-------------|---------------|
+| AI Expanded Access | 1010470009 | aiexpandedaccess |
 | AI Meetings and Messaging | 1010470007 | aimeetingsandmessaging | 
 | AI Security | 1010470006 |  aisecurity |
 | AppSheet Core | 1010380001 | appsheetcore |
@@ -61,7 +62,7 @@
 | G Suite Lite | Google-Apps-Lite | gsuitelite |
 | Gemini Business | 1010470003 | geminibiz
 | Gemini Education Premium | 1010470005 | geminiedupremium |
-| Gemini Enterprise | 1010470001 | geminient | duetai |
+| Gemini Enterprise - Legacy | 1010470001 | geminient | duetai |
 | Google AI Pro for Education | 1010470004 | gaiproedu |
 | Google AI Ultra for Business | 1010470008 | geminiultra |
 | Google Apps Message Security | Google-Apps-For-Postini | postini |
@@ -152,6 +153,7 @@
         4tb | drive4tb | googledrivestorage4tb | Google-Drive-storage-4TB |
         8tb | drive8tb | googledrivestorage8tb | Google-Drive-storage-8TB |
         16tb | drive16tb | googledrivestorage16tb | Google-Drive-storage-16TB |
+        aiexpandedaccess | 1010470009 | AI Expanded Access |
         aimeetingsandmessaging | 1010470007 | AI Meetings and Messaging |
         aisecurity | 1010470006 | AI Security |
         appsheetcore | 1010380001 | AppSheet Core |
@@ -170,7 +172,7 @@
         gaiproedu | geminiedu | 1010470004 | Google AI Pro for Education |
         geminibiz | 1010470003 | Gemini Business |
         geminiedupremium| 1010470005 | Gemini Education Premium |
-        geminient| duetai | 1010470001 | Gemini Enterprise |
+        geminient| duetai | 1010470001 | Gemini Enterprise - Legacy|
         geminiultra | 1010470008 | Google AI Ultra for Business |
         gsuitebasic | gafb | gafw | basic | Google-Apps-For-Business |
         gsuitebusiness | gau | gsb | unlimited | Google-Apps-Unlimited |

wiki/Meta-Commands-and-File-Redirection.md

@@ -119,7 +119,7 @@ You can redirect CSV file output and stdout/stderr output to files. By using red
 You can redirect stdout and stderr to null and stderr can be redirected to stdout.
 ```
 <Redirect> ::=
-        redirect csv <FileName> [multiprocess] [append] [noheader] [charset <Charset>]
+        redirect csv <FileName> [delayopen] [multiprocess] [append] [noheader] [charset <Charset>]
                      [columndelimiter <Character>] [quotechar <Character>] [noescapechar [<Boolean>]]
                      [sortheaders <StringList>] [timestampcolumn <String>] [transpose [<Boolean>]]
                      [todrive <ToDriveAttribute>*] |
@@ -129,12 +129,20 @@ You can redirect stdout and stderr to null and stderr can be redirected to stdou
         redirect stderr null [multiprocess] |
         redirect stderr stdout [multiprocess]
 ```
-For `redirect`, the optional subarguments must appear in the order shown.
+In versions prior to 7.42.00`, the `redirect csv` optional subarguments had to be specified in the order shown.
+Now the arguments can be specified in any order except that `todrive <ToDriveAttribute>*` must still be last.
 
 If `<FileName>` specifies a relative path, the file will be put in the directory specified by `drive_dir` in gam.cfg.
 If `<FileName>` specifies an absolute path, the file will be put in the directory specified.
 Specify `./<FileName>` to put the file in your current working directory.
 
+In versions prior to 7.42.00, when `redirect csv <FileName>` was used, GAM did not open and write `<FileName>`
+until all processing was complete; if `<FileName>` was not accessible, an error was generated and no results were saved.
+Now, `<FileName>` is opened initially to verify accessiblity and then written when processing is complete.
+
+In the unlikely event that this causes issues, you can do `redirect csv <FileName> delayopen`
+to get the previous behavior.
+
 The `multiprocess` subargument allows the multiple subprocesses started by `gam csv` to write intelligently
 to a single redirected CSV/stdout/stderr file. If you don't specify `multiprocess`, each subprocess
 writes `<FileName>` independently; you end up with a single file written by the last subprocess.

wiki/Reseller.md

@@ -44,6 +44,7 @@ Thanks to Duncan Isaksen-Loxton for a script to help manage multiple domains.
         4tb | drive4tb | googledrivestorage4tb | Google-Drive-storage-4TB |
         8tb | drive8tb | googledrivestorage8tb | Google-Drive-storage-8TB |
         16tb | drive16tb | googledrivestorage16tb | Google-Drive-storage-16TB |
+        aiexpandedaccess | 1010470009 | AI Expanded Access |
         aimeetingsandmessaging | 1010470007 | AI Meetings and Messaging |
         aisecurity | 1010470006 | AI Security |
         appsheetcore | 1010380001 | AppSheet Core |
@@ -61,7 +62,7 @@ Thanks to Duncan Isaksen-Loxton for a script to help manage multiple domains.
         geminibiz | 1010470003 | Gemini Business |
         geminiedu | 1010470004 | Gemini Education |
         geminiedupremium| 1010470005 | Gemini Education Premium |
-        geminient| duetai | 1010470001 | Gemini Enterprise |
+        geminient| duetai | 1010470001 | Gemini Enterprise - Legacy |
         gsuitebasic | gafb | gafw | basic | Google-Apps-For-Business |
         gsuitebusiness | gau | gsb | unlimited | Google-Apps-Unlimited |
         gsuitebusinessarchived | gsbau | businessarchived | 1010340002 | Google Workspace Business - Archived User |

wiki/Upgrade-Benefits.md

@@ -132,7 +132,7 @@ See: [Users - Calendars - Transfer](Users-Calendars-Transfer)
 
 GAM7 supports domain shared contacts and user contacts.
 
-See: [Domain Shared Contacts](Contacts)
+See: [Domain Shared Contacts](Domain-SharedContacts)
 
 See: [Users - People - Contacts & Profiles](Users-People-Contacts-Profiles)
 

wiki/Users-Business-Account-Management.md

@@ -9,12 +9,13 @@
 
 
 ## Introduction
-To use these commands you add the 'Business Account Management API' to your project and update client authorization.
+To use these commands you must add the 'Business Account Management API' to your project and update
+service account authorization.
 ```
 gam update project
-gam oauth create
+gam user user@domain.com update serviceaccount
 ...
-[*]  0)  Business Account Management API
+[*]  2)  Business Account Management API
 
 ```
 ## Definitions
@@ -22,13 +23,13 @@ gam oauth create
 
 ## Display Business Profile Accounts
 ```
-gam <UserItem> show businessprofileaccounts
+gam <UserTypeEntity> show businessprofileaccounts
         [type locationgroup|organization|personal|usergroup]
 ```
 Gam displays the information as an indented list of keys and values.
 
 ```
-gam <UserItem> print businessprofileaccounts [todrive <ToDriveAttribute>*]
+gam <UserTypeEntity> print businessprofileaccounts [todrive <ToDriveAttribute>*]
         [type locationgroup|organization|personal|usergroup]
 ```
 Gam displays the information as columns of fields.

wiki/Users-Chat.md

@@ -37,9 +37,6 @@ gam user user@domain.com update serviceaccount
 [*] 11)  Chat API - User Sections (supports readonly)
 
 ```
-`Chat API - User Sections` is in Developer Preview; you must have a the following variables set in `gam.cfg` to use these commands.
-* `developer_preview_apis = chat`
-* `developer_preview_api_key = <String>`
 
 Added `use_chat_admin_access` Boolean variable to `gam.cfg`. 
 ```
@@ -214,16 +211,14 @@ gam <UserTypeEntity> create chatspace
         [members <UserTypeEntity>]
         [displayname <String>]
         [description <String>] [guidelines <String>]
-        [history <Boolean>]
         [<ChatContent>]
         [formatjson|returnidonly]
 ```
 For `type space`, the following apply:
-* `members <UserTypeEntity>` - Optional, can not specify more that 20 users
+* `members <UserTypeEntity>` - Optional, can not specify more than 20 users
 * `displayname <String>` - Required
 * `description <String>` - Optional
 * `guidelines <String>` - Optional
-* `history <Boolean>` - Optional
 * `announcement|collaboration` - Initial permission settings; default is `collaboration`
 
 For `type groupchat`, the following apply:
@@ -231,23 +226,60 @@ For `type groupchat`, the following apply:
 * `displayname <String>` - Ignored
 * `description <String>` - Optional
 * `guidelines <String>` - Optional
-* `history <Boolean>` - Optional
 
 For `type directmessage`, the following apply:
 * `members <UserTypeEntity>` - Required, must specify 1 user
 * `displayname <String>` - Ignored
 * `description <String>` - Ignored
 * `guidelines <String>` - Ignored
-* `history <Boolean>` - Optional
 
 By default, Gam displays the information about the created chatspace as an indented list of keys and values.
 * `formatjson` - Display the fields in JSON format.
 * `returnidonly` - Display the chatspace name only
 
+Alternately, you can display the information about the created chatspace as columns of fields.
+* `csv [todrive <ToDriveAttribute>*]` - Write Chat Space information to a CSV file.
+* `addcsvdata <FieldName> <String>` - Add additional columns of data from the command line to the output
+
+By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
+the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
+When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
+The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
+`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
+
 Use the `<ChatContent>` option to send an initial message to the created chatspace.
 
 By default, details about the chatmessage are displayed.
+* `formatjson` - Display the chat message name in JSON format.
 * `returnidonly` - Display the chatmessage name only
+* `csv` - The column `message.name` is added the CSV file output
+
+### Bulk build chat spaces
+You want to create Chat Spaces for use by users that don't currently have Chat enabled;
+all commands will be run by a super admin.
+
+Make a CSV file NewSpaces.csv with columns: displayName,manager,members
+```
+displayName,manager,members
+Chat 123,user1@domain.com,user1@domain.com user2@domain.com user3@domain.com
+Chat 456,user4@domain.com,user4@domain.com user5@domain.com user6@domain.com
+```
+The manager column specifies the member that will be updated to be a manager.
+
+Create the spaces
+```
+gam redirect csv ./NewSpaceDetails.csv multiprocess csv NewSpaces.csv gam user admin@domain.com create chatspace type space collaboration displayname "~displayName" members "~members" csv addcsvdata manager "~manager"
+```
+
+Update the specified member from ROLE_MEMBER to ROLE_MANAGER
+```
+gam redirect stdout ./UpdateMemberToManager.txt multiprocess redirect stderr stdout csv NewSpaceDetails.csv gam user admin@domain.com update chatmember "~name" role manager user "~manager"
+```
+
+Delete the super admin from the space
+```
+gam redirect stdout ./DeleteAdmin.txt multiprocess redirect stderr stdout csv NewSpaceDetails.csv gam user admin@domain.com delete chatmember "~name" user admin@domain.com
+```
 
 ### Update a user's chat space
 ```

wiki/Users-Drive-Activity-Settings.md

@@ -72,7 +72,7 @@ gam <UserTypeEntity> print driveactivity [todrive <ToDriveAttributes>*]
          (query <QueryDriveFile>)]
         [([start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>])|(range <Date>|<Time> <Date)|<Time>|
          yesterday|today|thismonth|(previousmonths <Integer>)]
-        [action|actions [not] <DriveActivityActionList>]
+        [action|actions [not] <DriveActivityActionList>] [maxactivities <Number>]
         [consolidationstrategy legacy|none]
         [idmapfile <FileName>|(gsheet <UserGoogleSheet>) [charset <String>] [columndelimiter <Character>] [noescapechar <Boolean>]  [quotechar <Character>]]
         [stripcrsfromname] [formatjson [quotechar <Character>]]
@@ -99,6 +99,8 @@ Google does the filtering.
 * `action|actions <DriveActivityActionList>` - Only display activities with the specified actions; by default, all actions are displayed
 * `action|actions not <DriveActivityActionList>` - Only display activities without the specified actions; by default, all actions are displayed
 
+You can limit the number of activities displayed with the `maxactivities <Number>; the default is 0, no limit.
+
 The API only returns a permissionId and user name for each event but no user email address. To get an email address perform the
 following command to generate a file that contains the email address and permissionId for all users. You can substitute for `all users` if desired.
 ```

wiki/Users-Drive-Copy-Move.md

@@ -140,7 +140,6 @@ gam <UserTypeEntity> copy drivefile <DriveFileEntity>
         (mappermissionsdomain <DomainName> <DomainName>)*
         [sendemailifrequired [<Boolean>]]
         [verifyorganizer [<Boolean>]]
-        [enforceexpansiveaccess [<Boolean>]]
 ```
 The files/folders specified by `<DriveFileEntity>` are referred to as `source`, `target` refers to where those files are being copied.
 The files/folders specified by `<DriveFileEntity>` are referred to as `top`; when a folder is being copied recursively, the files/folders that it contains are referred as `sub`.
@@ -529,7 +528,7 @@ There are two methods for moving a folder from a My Drive to a Shared Drive:
 * GAM
   * The Drive API doesn't allow moving a folder from a My Drive to a Shared Drive; GAM has to recreate the folders on the Shared Drive, thus changing their IDs
   * Files are  simply moved from their existing My Drive folder to the recreated Shared Drive folder; their IDs do not change
-  * Files owmed by users outside of your domain can't be moved
+  * Files owned by users outside of your domain can't be moved
 
 ## Simple moves by changing parents
 Use this command in the following cases:
@@ -590,7 +589,6 @@ gam <UserTypeEntity> move drivefile <DriveFileEntity> [newfilename <DriveFileNam
         [retainsourcefolders [<Boolean>]]
         [sendemailifrequired [<Boolean>]]
         [verifyorganizer [<Boolean>]]
-        [enforceexpansiveaccess [<Boolean>]]
 ```
 The files/folders specified by `<DriveFileEntity>` are referred to as `source`, `target` refers to where those files are being moved.
 The files/folders specified by `<DriveFileEntity>` are referred to as `top`; when a folder is being moved, the files/folders that it contains are referred as `sub`.

wiki/Users-Drive-Files-Display.md

@@ -425,7 +425,7 @@ Display file details in indented keyword: value format. The two forms are equiva
 ```
 gam <UserTypeEntity> show fileinfo <DriveFileEntity>
         [returnidonly]
-        [filepath|fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [filepath|fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
         [allfields|<DriveFieldName>*|(fields <DriveFieldNameList>)]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])*
         [showdrivename] [showshareddrivepermissions]
@@ -436,7 +436,7 @@ gam <UserTypeEntity> show fileinfo <DriveFileEntity>
         [formatjson]
 gam <UserTypeEntity> info drivefile <DriveFileEntity>
         [returnidonly]
-        [filepath|fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [filepath|fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
         [allfields|<DriveFieldName>*|(fields <DriveFieldNameList>)]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])*
         [showdrivename] [showshareddrivepermissions]
@@ -455,6 +455,7 @@ Use `fullpath` to add additional path information indicating that a file is an O
 By default, the path to a file includes the file name as the last element of the path.
 Use `folderpathonly` to display only the folder names when displaying the path to a file. This folder only path
 an be used in  `gam <UserTypeEntity> create drivefolderpath` to recreate the folder hierarchy.
+Use `parentpathonly` to display only the parent folder names when displaying the path to a file.
 
 By default, file path components are separated by `/`; use `pathdelimiter <Character>` to use `<Character>` as the separator.
 
@@ -517,12 +518,12 @@ gam <UserTypeEntity> show filepath <DriveFileEntity>
         [returnpathonly]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])*
         [stripcrsfromname]
-        [folderpathonly [<Boolean>]] [fullpath] [pathdelimiter <Character>]
+        [folderpathonly|parentpathonly [<Boolean>]] [fullpath] [pathdelimiter <Character>]
         [followshortcuts [<Boolean>]]
 gam <UserTypeEntity> print filepath <DriveFileEntity> [todrive <ToDriveAttribute>*]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])*
         [stripcrsfromname] [oneitemperrow]
-        [fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
         [followshortcuts [<Boolean>]]
 ```
 Use `returnpathonly` to display just the file path of the files in `<DriveFileEntity>`.
@@ -532,6 +533,7 @@ Use `fullpath` to add additional path information indicating that a file is an O
 By default, the path to a file includes the file name as the last element of the path.
 Use `folderpathonly` to display only the folder names when displaying the path to a file. This folder only path
 an be used in  `gam <UserTypeEntity> create drivefolderpath` to recreate the folder hierarchy.
+Use `parentpathonly` to display only the parent folder names when displaying the path to a file.
 
 By default, file path components are separated by `/`; use `pathdelimiter <Character>` to use `<Character>` as the separator.
 
@@ -1106,7 +1108,7 @@ gam <UserTypeEntity> print|show filelist [todrive <ToDriveAttribute>*]
         [countsonly [summary none|only|plus] [summaryuser <String>]
                     [showsource] [showsize] [showsizeunits] [showmimetypesize]]
         [countsrowfilter]
-        [filepath|fullpath [folderpathonly [<Boolean>]] [pathdelimiter <Character>] [addpathstojson] [showdepth]] [buildtree]
+        [filepath|fullpath [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>] [addpathstojson] [showdepth]] [buildtree]
         [allfields|<DriveFieldName>*|(fields <DriveFieldNameList>)]
         [showdrivename] [showshareddrivepermissions]
         [(showlabels details|ids)|(includelabels <ClassificationLabelIDList>)]
@@ -1239,6 +1241,7 @@ JSON data rather than as additional columns
 By default, the path to a file includes the file name as the last element of the path.
 Use `folderpathonly` to display only the folder names when displaying the path to a file. This folder only path
 an be used in  `gam <UserTypeEntity> create drivefolderpath` to recreate the folder hierarchy.
+Use `parentpathonly` to display only the parent folder names when displaying the path to a file.
 
 By default, file path components are separated by `/`; use `pathdelimiter <Character>` to use `<Character>` as the separator.
 

wiki/Users-Drive-Ownership.md

@@ -61,7 +61,6 @@ Use [Users - Drive - Transfer](Users-Drive-Transfer) for more complex ownership
 ```
 gam <UserTypeEntity> transfer ownership <DriveFileEntity> <UserItem>
         [<DriveFileParentAttribute>] [includetrashed] [norecursion [<Boolean>]]
-        [enforceexpansiveaccess [<Boolean>]]
         (orderby <DriveOrderByFieldName> [ascending|descending])*
         [preview] [filepath] [pathdelimiter <Character>] [buildtree] [todrive <ToDriveAttribute>*]
 ```
@@ -101,7 +100,6 @@ gam <UserTypeEntity> claim ownership <DriveFileEntity>
         [skipids <DriveFileEntity>] [onlyusers|skipusers <UserTypeEntity>] [subdomains <DomainNameEntity>]
         [restricted [<Boolean>]] [writerscanshare|writerscantshare [<Boolean>]]
         [keepuser | (retainrole reader|commenter|writer|editor|none)] [noretentionmessages]
-        [enforceexpansiveaccess [<Boolean>]]
         (orderby <DriveOrderByFieldName> [ascending|descending])*
         [preview] [filepath] [pathdelimiter <Character>] [buildtree] [todrive <ToDriveAttribute>*]
 ```

wiki/Users-Drive-Permissions.md

@@ -220,7 +220,7 @@ By default, when an ACL is created, GAM outputs details of the ACL as indented k
 ```
 gam <UserTypeEntity> update drivefileacl <DriveFileEntity> <DriveFilePermissionIDorEmail>
         (role <DriveFileACLRole>) [expiration <Time>] [removeexpiration [<Boolean>]]
-        [updatesheetprotectedranges [<Boolean>]] [enforceexpansiveaccess [<Boolean>]]
+        [updatesheetprotectedranges [<Boolean>]]
         [showtitles] [nodetails|(csv [todrive <ToDriveAttribute>*] [formatjson [quotechar <Character>]])]
 ```
 There is no change of parents when a new user is updated to be a file's owner.
@@ -236,10 +236,7 @@ The option `updatesheetprotectedranges` only applies to items in `<DriveFileEnti
     * ACLs with role reader or commenter will be removed from existing protected ranges
     * ACLs with role writer or higher will be added to existing protected ranges
 
-`enforceexpansiveaccess` defaults to the value of `gam.cfg/enforce_expansive_access` that controls
+Inherited ACLs can not be updated.
-the ability to update inherited ACLs.
-* False - Inherited ACLs can be updated
-* True = Inherited ACLs can not be updated
 
 By default, the file ID is displayed in the output; to see the file name, use the `showtitles`
 option; this requires an additional API call per file.
@@ -251,7 +248,7 @@ By default, when an ACL is updated, GAM outputs details of the ACL as indented k
 ### Delete
 ```
 gam <UserTypeEntity> delete|del drivefileacl <DriveFileEntity> <DriveFilePermissionIDorEmail>
-        [updatesheetprotectedranges [<Boolean>]] [enforceexpansiveaccess [<Boolean>]]
+        [updatesheetprotectedranges [<Boolean>]]
         [showtitles]
 ```
 The option `updatesheetprotectedranges` only applies to items in `<DriveFileEntity>` that are Google Sheets.
@@ -261,10 +258,7 @@ The option `updatesheetprotectedranges` only applies to items in `<DriveFileEnti
   * Sheet Protected Ranges are updated to reflect the deleted ACL; additional API calls are required.
     * ACLs with any role will be removed from existing protected ranges
 
-`enforceexpansiveaccess` defaults to the value of `gam.cfg/enforce_expansive_access` that controls
+Inherited ACLs can not be deleted.
-the ability to delete inherited ACLs.
-* False - Inherited ACLs can be deleted
-* True = Inherited ACLs can not be deleted
 
 By default, the file ID is displayed in the output; to see the file name, use the `showtitles`
 option; this requires an additional API call per file.
@@ -306,12 +300,8 @@ When adding permissions from JSON data, permissions with `deleted` true are neve
 ```
 gam <UserTypeEntity> delete permissions <DriveFileEntity> <DriveFilePermissionIDEntity>
         <PermissionMatch>* [<PermissionMatchAction>]
-        [enforceexpansiveaccess [<Boolean>]]
 ```
-`enforceexpansiveaccess` defaults to the value of `gam.cfg/enforce_expansive_access` that controls
+Inherited ACLs can not be deleted.
-the ability to delete inherited ACLs.
-* False - Inherited ACLs can be deleted
-* True = Inherited ACLs can not be deleted
 
 When deleting permissions from JSON data, permissions with role `owner` true are never processed.
 

wiki/Users-Drive-Transfer.md

@@ -48,7 +48,6 @@ gam <UserTypeEntity> transfer drive <UserItem> [select <DriveFileEntity>]
         [noretentionmessages]
         [nonowner_retainrole reader|commenter|writer|editor|contentmanager|fileorganizer|current|none]
         [nonowner_targetrole reader|commenter|writer|editor|contentmanager|fileorganizer|current|none|source]
-        [enforceexpansiveaccess [<Boolean>]]
         (orderby <DriveFileOrderByFieldName> [ascending|descending])*
         [preview] [todrive <ToDriveAttribute>*]
 ```

wiki/Users-Meet.md

@@ -91,8 +91,8 @@ gam <UserItem> show meetconferences
         [formatjson]
 ```
 By default, conferences are shown for all of a user's meet spaces. To limit the display use:
-  * `space <MeetSpaceName>` - Display conferences for a specifc space by giving its name
+  * `space <MeetSpaceName>` - Display conferences for a specific space by giving its name
-  * `code <String>` - Display conferences for a specifc space by giving its code
+  * `code <String>` - Display conferences for a specific space by giving its code
   
 By default, Gam displays the information about the meet conferences as an indented list of keys and values.
 * `formatjson` - Display the fields in JSON format.
@@ -103,8 +103,8 @@ gam <UserItem> print meetconferences [todrive <ToDriveAttribute>*]
         [formatjson [quotechar <Character>]]
 ```
 By default, conferences are shown for all of a user's meet spaces. To limit the display use:
-  * `space <MeetSpaceName>` - Display conferences for a specifc space by giving its name
+  * `space <MeetSpaceName>` - Display conferences for a specific space by giving its name
-  * `code <String>` - Display conferences for a specifc space by giving its code
+  * `code <String>` - Display conferences for a specific space by giving its code
   
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.

wiki/Users-Tokens.md

@@ -1,6 +1,6 @@
 # Users - Tokens
 - [API documentation](#api-documentation)
-- [Get Google Cloud organization ID for your workspace](#Get Google Cloud organization ID for your workspace)
+- [Get Google Cloud organization ID for your workspace](#get-google-cloud-organization-id-for-your-workspace)
 - [Definitions](#definitions)
 - [Delete a user's token](#delete-a-users-token)
 - [Display individual user's tokens](#display-individual-users-tokens)

wiki/Users.md

@@ -666,7 +666,7 @@ If the mailbox is setup, a zero return code is returned; if the retries are exha
 ```
 gam update user <UserItem> [ignorenullpassword] <UserAttribute>*
         [verifynotinvitable|alwaysevict] [noactionifalias]
-        [updateprimaryemail <RESearchPattern> <RESubstitution>]
+        [updateprimaryemail <RESearchPattern> <RESubstitution> [preview]]
         [updateoufromgroup <FileName> [charset <Charset>]
             [columndelimiter <Character>] [noescapechar <Boolean>] [quotechar <Character>]
             [fields <FieldNameList>] [keyfield <FieldName>] [datafield <FieldName>]]
@@ -688,7 +688,7 @@ gam update user <UserItem> [ignorenullpassword] <UserAttribute>*
         [logpassword <FileName>]
 gam update users <UserTypeEntity> [ignorenullpassword] <UserAttribute>*
         [verifynotinvitable|alwaysevict] [noactionifalias]
-        [updateprimaryemail <RESearchPattern> <RESubstitution>]
+        [updateprimaryemail <RESearchPattern> <RESubstitution> [preview]]
         [updateoufromgroup <FileName> [charset <Charset>]
             [columndelimiter <Character>] [noescapechar <Boolean>] [quotechar <Character>]
             [fields <FieldNameList>] [keyfield <FieldName>] [datafield <FieldName>]]
@@ -709,7 +709,7 @@ gam update users <UserTypeEntity> [ignorenullpassword] <UserAttribute>*
         [logpassword <FileName>]
 gam <UserTypeEntity> update users [ignorenullpassword] <UserAttribute>*
         [verifynotinvitable|alwaysevict] [noactionifalias]
-        [updateprimaryemail <RESearchPattern>`< <RESubstitution>]
+        [updateprimaryemail <RESearchPattern> <RESubstitution> [preview]]
         [updateoufromgroup <FileName> [charset <Charset>]
             [columndelimiter <Character>] [noescapechar <Boolean>] [quotechar <Character>]
             [fields <FieldNameList>] [keyfield <FieldName>] [datafield <FieldName>]]
@@ -812,16 +812,18 @@ You can simply update a user's primary email address with the `primaryemail` opt
 ```
 gam update user userold@domain.com primaryemail usernew@domain.com
 ```
-The `updateprimaryemail <RESearchPattern> <RESubstitution>` option allows modification of the user's current primary email address.
+The `updateprimaryemail <RESearchPattern> <RESubstitution> [preview]` option allows modification of the user's current primary email address.
 
-For example, to change the domain of a set of users from the current domain to newdomain.com:
+For example, to change the domain of a set of users from the current domain.com to newdomain.com:
 ```
-gam ou /Path/To/Ou update user updateprimaryemail "^(.+)@.*$" "\1@newdomain.com"
+gam ou /Path/To/Ou update user updateprimaryemail "^(.+)@domain.com$" "\1@newdomain.com"
 ```
 To change graduating students email addresses from flastname@domain.com to flastname_grad@domain.com:
 ```
 gam ou /Path/To/Ou update user updateprimaryemail "^(.+)@(.+)$" "\1_grad@\2"
 ```
+The `preview` option allows verification of the primary email address changes before commiting the changes.
+
 If the user's current primary email address does not match the <REMatchPattern> then no modification is made.
 
 ## Update a user's attributes with JSON data

wiki/Vault-Takeout.md

@@ -257,11 +257,17 @@ gam print vaultcounts [todrive <ToDriveAttributes>*]
         [excludedrafts <Boolean>]
         [<JSONData>]
         [wait <Integer>]
+        [include_suspended_zeros [<Boolean>]]
 ```
 Specify the search method, this is optional:
 * `accounts <EmailAddressEntity>` - Search all accounts specified in `<EmailAddressEntity>`
 * `orgunit|org|ou <OrgUnitPath>` - Search all accounts in the OU `<OrgUnitPath>`
-* `everyone|entireorg` - Search for all accounts in the organization
+* `everyone|entireorg` - Search all accounts in the organization
+
+By default, the Vault API doesn't return accounts with zero items; GAM
+generates a zero count line for non-suspended accounts with zero items.
+The `include_suspended_zeros` option causes GAM to generate a zero count line
+for suspended accounts with zero items.
 
 For `corpus mail|group`, you can specify search terms to limit the search.
 * `terms <String>` - [Vault search](https://support.google.com/vault/answer/2474474)

wiki/Version-and-Help.md

@@ -3,10 +3,10 @@
 Print the current version of Gam with details
 ```
 gam version
-GAM 7.38.00 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.43.04 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.3 64-bit final
+Python 3.14.4 64-bit final
-macOS Tahoe 26.3.1 arm64
+macOS Tahoe 26.4.1 arm64
 Path: /Users/gamteam/bin/gam7
 Config File: /Users/gamteam/GamConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 Time: 2026-02-15T07:51:00-08:00
@@ -15,10 +15,10 @@ Time: 2026-02-15T07:51:00-08:00
 Print the current version of Gam with details and time offset information
 ```
 gam version timeoffset
-GAM 7.38.00 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.43.04 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.3 64-bit final
+Python 3.14.4 64-bit final
-macOS Tahoe 26.3.1 arm64
+macOS Tahoe 26.4.1 arm64
 Path: /Users/gamteam/bin/gam7
 Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 Your system time differs from www.googleapis.com by less than 1 second
@@ -27,15 +27,15 @@ Your system time differs from www.googleapis.com by less than 1 second
 Print the current version of Gam with extended details and SSL information
 ```
 gam version extended
-GAM 7.38.00 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.43.04 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.3 64-bit final
+Python 3.14.4 64-bit final
-macOS Tahoe 26.3.1 arm64
+macOS Tahoe 26.4.1 arm64
 Path: /Users/gamteam/bin/gam7
 Config File: /Users/gamteam/GamConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 Time: 2026-02-15T07:51:00-08:00
 Your system time differs from admin.googleapis.com by less than 1 second
-OpenSSL 3.6.1 27 Jan 2026
+OpenSSL 4.0.0 14 Apr 2026
 arrow 1.4.0
 chardet 5.2.0
 cryptography 46.0.5
@@ -68,7 +68,7 @@ MacOS High Sierra 10.13.6 x86_64
 Path: /Users/gamteam/bin/gam7
 Version Check:
   Current: 5.35.08
-   Latest: 7.38.00
+   Latest: 7.43.04
 echo $?
 1
 ```
@@ -76,7 +76,7 @@ echo $?
 Print the current version number without details
 ```
 gam version simple
-7.38.00
+7.43.04
 ```
 In Linux/MacOS you can do:
 ```
@@ -86,10 +86,10 @@ echo $VER
 Print the current version of Gam and address of this Wiki
 ```
 gam help
-GAM 7.38.00 - https://github.com/GAM-team/GAM
+GAM 7.43.04 - https://github.com/GAM-team/GAM
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.3 64-bit final
+Python 3.14.4 64-bit final
-macOS Tahoe 26.3.1 arm64
+macOS Tahoe 26.4.1 arm64
 Path: /Users/gamteam/bin/gam7
 Config File: /Users/gamteam/GamConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 Time: 2026-02-15T07:51:00-08:00

wiki/_Sidebar.md

@@ -70,7 +70,6 @@ Client Access
 * [Administrators](Administrators)
 * [Alert Center](Alert-Center)
 * [Aliases](Aliases)
-* [Business Account Management](Business-Account-Management)
 * [Calendars](Calendars)
 * [Calendars - Access](Calendars-Access)
 * [Calendars - Events](Calendars-Events)
@@ -140,6 +139,7 @@ Special Service Account Access
 
 Service Account Access
 * [Users - Analytics Admin](Users-Analytics-Admin)
+* [Users - Business Account Management](Users-Business-Account-Management)
 * [Users - Calendars](Users-Calendars)
 * [Users - Calendars - Access](Users-Calendars-Access)
 * [Users - Calendars - Events](Users-Calendars-Events)

wiki/gam.cfg.md

@@ -355,17 +355,6 @@ enable_dasa
         admin_email, customer_id and domain must be set when enable_dasa is True,
         customer_id may not be set to my_customer
         Signal file: OldGamPath/enabledasa.txt
-enforce_expansive_access
-        The default value for option `enforceexpansiveaccess` in all commands that delete or update
-        drive file ACLs/permissions.
-        gam <UserTypeEntity> delete permissions
-        gam <UserTypeEntity> delete drivefileacl
-        gam <UserTypeEntity> update drivefileacl
-        gam <UserTypeEntity> copy drivefile
-        gam <UserTypeEntity> move drivefile
-        gam <UserTypeEntity> transfer ownership
-        gam <UserTypeEntity> claim ownership
-        Default: True
 event_max_results
         When retrieving lists of Calendar events from API,
         how many should be retrieved in each API call
@@ -1023,7 +1012,6 @@ drive_max_results = 1000
 email_batch_size = 50
 enable_dasa = false
 enable_gcloud_reauth = false
-enforce_expansive_access = true
 event_max_results = 250
 extra_args = ''
 gmail_cse_incert_dir = ''