Improve device query validation

Validate device queries
2026-06-04 06:11:39 +00:00 · 2026-05-18 19:01:57 -07:00 · 2026-05-18 17:38:49 -07:00 · 2026-05-18 16:56:56 -07:00 · 2026-05-18 19:16:05 -04:00 · 2026-05-18 15:07:12 -07:00
35 changed files with 1291 additions and 391 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -165,7 +165,7 @@ jobs:
        with:
          path: |
            cache.tar.xz
-          key: gam-${{ matrix.jid }}-20260416
+          key: gam-${{ matrix.jid }}-20260508

      - name: Untar Cache archive
        if: matrix.goal == 'build' && steps.cache-python-ssl.outputs.cache-hit == 'true'
@@ -199,7 +199,10 @@ jobs:
            *)
              echo "arch=${RUNNER_ARCH}" >> $GITHUB_ENV
              ;;
-          esac 
+          esac
+          # calculate with python because date on MacOS is just stupid
+          DEPS_CUTOFF=$(python3 -c "from datetime import datetime, timedelta, timezone; print((datetime.now(timezone.utc) - timedelta(days=14)).strftime('%Y-%m-%dT00:00:00Z'))")
+          echo "DEPS_CUTOFF=${DEPS_CUTOFF}" >> $GITHUB_ENV
          echo "JID=${JID}" >> $GITHUB_ENV
          echo "freethreaded=${freethreaded}" >> $GITHUB_ENV
          if "$freethreaded"; then
@@ -506,19 +509,19 @@ jobs:
          "${PYTHON}" -VV
          "${PYTHON}" -c "import ssl; print(f'Using {ssl.OPENSSL_VERSION}')"

-      - name: Create and use Python venv
+      - name: Create and use Python .venv
        run: |
          cd "$GITHUB_WORKSPACE"
          curl -o get-pip.py https://bootstrap.pypa.io/get-pip.py
          "$PYTHON" get-pip.py
-          "$PYTHON" -m venv venv
+          "$PYTHON" -m venv .venv
          if [[ "$RUNNER_OS" == "Windows" ]]; then
            # pyscard seems to build outside venv but not in it.
            # build it so it's cached.
-            "$PYTHON" -m pip install --upgrade --force-reinstall pyscard
-            export PYTHON="${GITHUB_WORKSPACE}/venv/scripts/python.exe"
+            "$PYTHON" -m pip install --upgrade pyscard
+            export PYTHON="${GITHUB_WORKSPACE}/.venv/scripts/python.exe"
          else
-            export PYTHON="${GITHUB_WORKSPACE}/venv/bin/python3"
+            export PYTHON="${GITHUB_WORKSPACE}/.venv/bin/python3"
          fi
          echo "PYTHON=${PYTHON}" >> $GITHUB_ENV
          if [[ "$ACTIONS_GOAL" == "test" ]]; then
@@ -526,31 +529,22 @@ jobs:
            echo "gam=${gam}" >> $GITHUB_ENV
          fi

-      - name: Upgrade pip, wheel, etc
-        run: |
-          curl $curl_retry -O https://bootstrap.pypa.io/get-pip.py
-          "$PYTHON" get-pip.py
-          "$PYTHON" -m pip install --upgrade pip
-          "$PYTHON" -m pip install --upgrade wheel
-          "$PYTHON" -m pip install --upgrade setuptools
-          "$PYTHON" -m pip install --upgrade importlib-metadata
-          "$PYTHON" -m pip install --upgrade setuptools-scm
-          "$PYTHON" -m pip install --upgrade packaging
-          "$PYTHON" -m pip list
+      #- name: Upgrade pip, wheel, etc
+      #  run: |
+      #    curl $curl_retry -O https://bootstrap.pypa.io/get-pip.py
+      #    "$PYTHON" get-pip.py
+      #    "$PYTHON" -m pip install --upgrade pip
+      #    "$PYTHON" -m pip install --upgrade wheel
+      #    "$PYTHON" -m pip install --upgrade setuptools
+      #    "$PYTHON" -m pip install --upgrade importlib-metadata
+      #    "$PYTHON" -m pip install --upgrade setuptools-scm
+      #    "$PYTHON" -m pip install --upgrade packaging
+      #    "$PYTHON" -m pip list

      - name: Install pip requirements
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
-          echo "before anything..."
-          "$PYTHON" -m pip list
-          echo "--info--"
-          "$PYTHON" -m pip cache info
-          echo "--list--"
-          "$PYTHON" -m pip cache list
-          echo "--pip debug verbose--"
-          "$PYTHON" -m pip debug --verbose
-          echo "--------"
          if ([ "$RUNNER_OS" == "Windows" ] && [ "$RUNNER_ARCH" == "ARM64" ]); then
            # custom cryptography wheel for win arm64 since the project doesn't provide one:
            # https://github.com/pyca/cryptography/issues/14293
@@ -558,24 +552,12 @@ jobs:
            "$PYTHON" -m pip install cryptography-*.whl
          fi
          "$PYTHON" -m pip install -vvv --upgrade ..[yubikey]
-          echo "after everything..."
-          "$PYTHON" -m pip list

      - name: Install PyInstaller
        if: matrix.goal == 'build'
        run: |
-          #git clone https://github.com/pyinstaller/pyinstaller.git
-          #cd pyinstaller
-          #export latest_release=$(git tag --list | grep -v dev | grep -v rc | sort -Vr | head -n1)
-          #git checkout "${latest_release}"
-          # git checkout "v6.9.0"
-          # remove pre-compiled bootloaders so we fail if bootloader compile fails
-          #rm -rvf PyInstaller/bootloader/*-*/*
-          #cd bootloader
-          #"${PYTHON}" ./waf all
-          #cd ..
-          #echo "---- Installing PyInstaller ----"
-          #"${PYTHON}" -m pip install .
+          # Install latest version of PyInstaller *that's 2 weeks old*
+          # Calculate the exact timestamp for 14 days ago
          "$PYTHON" -m pip install --upgrade pyinstaller

      - name: Build GAM with PyInstaller
@@ -642,10 +624,9 @@ jobs:
          sudo apt-get -qq --yes update
          # arm64 needs to build a wheel and needs scons to build
          sudo apt-get -qq --yes install scons
-          "${PYTHON}" -m pip install --upgrade patchelf-wrapper
-          # "${PYTHON}" -m pip install --upgrade staticx
-          # install latest github src for staticx
-          "${PYTHON}" -m pip install --upgrade "git+https://github.com/JonathonReinhart/staticx"
+          "$PYTHON" -m pip install --upgrade patchelf-wrapper
+          "$PYTHON" -m pip install --upgrade typing_extensions
+          "$PYTHON" -m pip install --upgrade staticx

      - name: Make StaticX GAM build
        if: matrix.staticx == 'yes'
@@ -689,20 +670,6 @@ jobs:
          echo "GAM Version ${GAMVERSION}"
          echo "GAMVERSION=${GAMVERSION}" >> $GITHUB_ENV

-      - name: Initialize Windows Desktop Shell
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: |
-          Write-Host "Checking for Windows Explorer shell..."
-          if (-not (Get-Process -Name explorer -ErrorAction SilentlyContinue)) {
-              Write-Host "Explorer not found. Booting the desktop shell..."
-              Start-Process explorer.exe
-              # Give the desktop a few seconds to fully render the taskbar
-              Start-Sleep -Seconds 10 
-          } else {
-              Write-Host "Explorer is already running."
-          }
-
      - name: Install NPM deps
        if: runner.os == 'Windows'
        run: |
@@ -715,8 +682,8 @@ jobs:
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
-          #$url = "https://files.certum.eu/software/SimplySignDesktop/Windows/9.3.4.72/SimplySignDesktop-9.3.4.72-64-bit-en.msi"
-          $url = "https://www.files.certum.eu/software/SimplySignDesktop/Windows/9.4.0.84/SimplySignDesktop-9.4.0.84-64-bit-en.msi"
+          #$url = "https://files.certum.eu/software/SimplySignDesktop/Windows/9.4.2.86/SimplySignDesktop-9.4.2.86-64-bit-en.msi"
+          $url = "https://files.certum.eu/software/SimplySignDesktop/Windows/9.4.3.90/SimplySignDesktop-9.4.3.90-64-bit-en.msi"
          $file = "SimplySignDesktop.msi"
          Invoke-WebRequest $url -OutFile $file
          $log = "install.log" 
@@ -725,6 +692,15 @@ jobs:
          $procMain.WaitForExit() 
          $procLog.Kill()

+      - name: Run SSD directly
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          Write-Host "Running SSD..."
+          & "C:\\Program Files\\Certum\\SimplySign Desktop\\SimplySignDesktop.exe"
+          Start-Sleep -Seconds 10
+          & "C:\\Program Files\\Certum\\SimplySign Desktop\\SimplySignDesktop.exe"
+
      - name: Login to Certum
        if: runner.os == 'Windows'
        shell: pwsh
@@ -733,10 +709,11 @@ jobs:
        run: |
          write-host "running SimplySignDesktop login..."
          node tools/ssd.mjs --log-level warn
+          Get-ChildItem -Path $env:GITHUB_WORKSPACE
          write-host "sleeping during login..."
          Start-Sleep 10

-      - name: Archive png artifacts
+      - name: Archive artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
        if: runner.os == 'Windows'
        with:
@@ -744,7 +721,8 @@ jobs:
          name: images-${{ matrix.os }}
          if-no-files-found: ignore
          path: |
-            *.png
+            ${{ github.workspace }}/*.png
+            ${{ github.workspace }}/*.log

      - name: Sign gam.exe
        if: runner.os == 'Windows'
--- a/.github/workflows/upgrade_deps.yml
+++ b/.github/workflows/upgrade_deps.yml
@@ -0,0 +1,144 @@
+name: Daily Dependency Pinning (2-Week Buffer)
+
+on:
+  schedule:
+    # Runs every day at midnight UTC
+    - cron: '0 0 * * *'
+  workflow_dispatch: # Allows you to trigger it manually from the UI
+
+jobs:
+  pin-deps:
+    runs-on: ubuntu-slim
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: '3.14'
+
+      - name: Calculate and pin two-week old stable versions
+        shell: python
+        run: |
+          import json
+          import urllib.request
+          import re
+          import tomllib
+          from datetime import datetime, timedelta, timezone
+          from pathlib import Path
+
+          toml_path = Path("pyproject.toml")
+          if not toml_path.exists():
+              print("pyproject.toml not found!")
+              exit(1)
+
+          content = toml_path.read_text(encoding="utf-8")
+          parsed_toml = tomllib.loads(content)
+          
+          target_deps = set()
+          
+          # Standard [project.dependencies]
+          target_deps.update(parsed_toml.get("project", {}).get("dependencies", []))
+          
+          # Optional [project.optional-dependencies]
+          for deps in parsed_toml.get("project", {}).get("optional-dependencies", {}).values():
+              target_deps.update(deps)
+              
+          # Dev [dependency-groups] (uv / PEP 735 standard)
+          for deps in parsed_toml.get("dependency-groups", {}).values():
+              if isinstance(deps, list):
+                  for d in deps:
+                      if isinstance(d, str):
+                          target_deps.add(d)
+
+          if not target_deps:
+              print("No dependencies found to process.")
+              exit(0)
+
+          updates = {}
+          two_weeks_ago = datetime.now(timezone.utc) - timedelta(days=14)
+          print(f"Evaluating dependencies against cutoff date: {two_weeks_ago.isoformat()}")
+
+          for dep in target_deps:
+              # Isolate base package name (e.g., "yubikey-manager>=5.6.1" -> "yubikey-manager")
+              pkg_name = re.split(r'[<>=!~;\s]', dep)[0].strip()
+              
+              # Preserve environment markers if they exist
+              marker = ""
+              if ";" in dep:
+                  marker = " ; " + dep.split(";", 1)[1].strip()
+
+              print(f"Fetching PyPI data for: {pkg_name}")
+              try:
+                  url = f"https://pypi.org/pypi/{pkg_name}/json"
+                  req = urllib.request.Request(url, headers={'User-Agent': 'GAM-CI-Script'})
+                  with urllib.request.urlopen(req) as response:
+                      data = json.loads(response.read().decode())
+                  
+                  valid_versions = []
+                  for ver, files in data.get("releases", {}).items():
+                      if not files:
+                          continue
+                      
+                      upload_time_str = files[0].get("upload_time_iso_8601")
+                      if not upload_time_str:
+                          continue
+                      
+                      if upload_time_str.endswith('Z'):
+                          upload_time_str = upload_time_str[:-1] + '+00:00'
+                      
+                      upload_time = datetime.fromisoformat(upload_time_str)
+                      
+                      # Filter: Must be older than 2 weeks and not a pre-release
+                      if upload_time <= two_weeks_ago and not any(x in ver.lower() for x in ['a', 'b', 'rc', 'dev']):
+                          valid_versions.append((upload_time, ver))
+                  
+                  if valid_versions:
+                      # Sort by upload time descending to get the newest valid option
+                      valid_versions.sort(key=lambda x: x[0], reverse=True)
+                      target_version = valid_versions[0][1]
+                      
+                      pinned_dep = f"{pkg_name}=={target_version}{marker}"
+                      if pinned_dep != dep:
+                          updates[dep] = pinned_dep
+                          print(f"  -> Pinning: '{dep}' => '{pinned_dep}'")
+                      else:
+                          print(f"  -> Already pinned correctly to {target_version}")
+                  else:
+                      print(f"  -> No valid historical versions found.")
+                      
+              except urllib.error.HTTPError as e:
+                  print(f"  -> Package not found on PyPI or HTTP error: {e}")
+              except Exception as e:
+                  print(f"  -> Error processing {pkg_name}: {e}")
+
+          # 3. Replace the strings safely in the original file content
+          new_content = content
+          for old_dep, new_dep in updates.items():
+              # Regex targets the exact string inside either single or double quotes
+              # Using a lambda replacement ensures we don't trip over escape sequences in the new string
+              escaped_old = re.escape(old_dep)
+              pattern = r'([\'"])' + escaped_old + r'\1'
+              new_content = re.sub(pattern, lambda m: m.group(1) + new_dep + m.group(1), new_content)
+
+          # Write changes back to pyproject.toml
+          if content != new_content:
+              toml_path.write_text(new_content, encoding="utf-8")
+              print("\npyproject.toml updated successfully.")
+          else:
+              print("\nNo updates required.")
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "chore: upgrade PyPi deps"
+          title: "Upgrade PyPi deps"
+          body: "Automated scan checking PyPI for package versions at least 2 weeks old."
+          branch: sys-deps-upgrade
+          force: false # Standard push, plays nice with rulesets
--- a/dep-overrides.txt
+++ b/dep-overrides.txt
@@ -0,0 +1,6 @@
+# overrides uv.lock to force newer dependencies
+# when old deps are vulnerable. These should be set
+# to expire after 2 weeks when the fixed version will
+# be automatically picked up anyway.
+# Format: package_requirement | MM/DD/YYYY
+urllib3>=2.7.0 | 05/22/2026
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,26 +4,24 @@ dynamic = [
    "version",
 ]
 authors = [
-    { name="Jay Lee", email="jay0lee@gmail.com" },
-    { name="Ross Scroggs", email="Ross.Scroggs@gmail.com" },
+    { name = "Jay Lee", email = "jay0lee@gmail.com" },
+    { name = "Ross Scroggs", email = "Ross.Scroggs@gmail.com" },
 ]
-# notice that yubikey-manager remains optional further down since it is less command and adds
-#significant compile dependencies.
 dependencies = [
-    "arrow>=1.3.0",
-    "chardet==5.2.0",
-    "cryptography>=46.0.5",
-    "distro; sys_platform=='linux'",
-    "filelock>=3.18.0",
-    "google-api-python-client>=2.167.0",
-    "google-auth-httplib2>=0.2.0",
-    "google-auth-oauthlib>=1.2.2",
-    "google-auth>=2.39.0",
-    "httplib2>=0.31.0",
-    "lxml>=5.4.0",
-    "passlib>=1.7.4",
-    "pathvalidate>=3.2.3",
-    "pysocks>=1.7.1",
+    "arrow==1.4.0",
+    "chardet==7.4.3",
+    "cryptography==47.0.0",
+    "distro==1.9.0 ; sys_platform=='linux'",
+    "filelock==3.29.0",
+    "google-api-python-client==2.195.0",
+    "google-auth-httplib2==0.3.1",
+    "google-auth-oauthlib==1.3.1",
+    "google-auth==2.50.0",
+    "httplib2==0.31.2",
+    "lxml==6.1.0",
+    "passlib==1.7.4",
+    "pathvalidate==3.3.1",
+    "pysocks==1.7.1",
 ]
 description = "CLI tool to manage Google Workspace"
 readme = "README.md"
@@ -38,11 +36,17 @@ classifiers = [
    "Programming Language :: Python :: 3.14",
    "Operating System :: OS Independent",
 ]
-license = {text = "Apache License (2.0)"}
-license-files = ["LICEN[CS]E*"]
+license-files = [
+    "LICEN[CS]E*",
+]
+
+[project.license]
+text = "Apache License (2.0)"

 [project.optional-dependencies]
-yubikey = ["yubikey-manager>=5.6.1"]
+yubikey = [
+    "yubikey-manager==5.9.1",
+]

 [project.scripts]
 gam = "gam.__main__:main"
@@ -57,7 +61,9 @@ Chat = "https://git.io/gam-chat"
 path = "src/gam/__init__.py"

 [tool.hatch.build.targets.wheel]
-packages = ["src/gam"]
+packages = [
+    "src/gam",
+]

 [build-system]
 requires = [
--- a/src/GamCommands.txt
+++ b/src/GamCommands.txt
@@ -560,9 +560,9 @@ If an item contains spaces, it should be surrounded by ".
        See: https://cloud.google.com/access-context-manager/docs/custom-access-level-spec
 <QueryContact> ::= <String>
        See: https://developers.google.com/google-apps/contacts/v3/reference#contacts-query-parameters-reference
-<QueryCrOS> ::= <String>
+<QueryCrOS> ::= <String>:<String>
        See: https://support.google.com/chrome/a/answer/1698333
-<QueryDevice> ::= <String>
+<QueryDevice> ::= <String>:<String>
        See: https://support.google.com/a/answer/7549103
 <QueryDriveFile> ::= <String>
        See: https://developers.google.com/drive/api/v3/search-files
@@ -575,7 +575,7 @@ If an item contains spaces, it should be surrounded by ".
 <QueryItem> ::= <UniqueID>|<String>
 <QueryMemberRestrictions> ::= <String>
        See: https://cloud.google.com/identity/docs/reference/rest/v1beta1/SecuritySettings#MemberRestriction
-<QueryMobile> ::= <String>
+<QueryMobile> ::= <String>:<String>
        See: https://support.google.com/a/answer/7549103
 <QueryTeamDrive> ::= <String>
        See: https://developers.google.com/drive/api/v3/search-parameters
@@ -916,6 +916,8 @@ Specify a collection of Users by directly specifying them or by specifying items

 <UserTypeEntity> ::=
        (all users|users_na|users_arch|users_ns|users_susp|users_arch_or_susp|users_na_ns|users_ns_susp)|
+        (all guests|guests_ns|guests_susp|guests_ns_susp)|
+        (all users_and_guests|users_and_guests_ns|users_and_guests_susp|users_and_guests_ns_susp)|
        (user <UserItem>)|
        (users <UserList>)|
        (oauthuser)
@@ -1351,9 +1353,12 @@ verify
 ## File Redirection

 If the pattern {{Section}} appears in <FileName>, it will be replaced with the name of the current section.
-For redirect csv, the optional arguments must appear in the order shown.
+
+For redirect csv, the optional arguments can be specfified in any order but `todrive <ToDriveAttribute>*`
+must be last.
+
 <Redirect> ::=
-        redirect csv <FileName> [multiprocess] [append] [noheader] [charset <Charset>]
+        redirect csv <FileName> [delayopen] multiprocess] [append] [noheader] [charset <Charset>]
                     [columndelimiter <Character>] [quotechar <Character>] [noescapechar [<Boolean>]]
                     [sortheaders <StringList>] [timestampcolumn <String>] [transpose [<Bopolean>]]
                     [todrive <ToDriveAttribute>*] |
@@ -1715,6 +1720,7 @@ gam calendar <CalendarEntity> printacl [todrive <ToDriveAttribute>*]

 <EventMatchProperty> ::=
        (matchfield attendees <EmailAddressEntity>)|
+        (matchfield attendeesorganizer <Boolean> <EmailAddressEntity>)|
        (matchfield attendeesonlydomainlist <DomainNameList>)|
        (matchfield attendeesdomainlist <DomainNameList>)|
        (matchfield attendeesnotdomainlist <DomainNameList>)|
@@ -2463,9 +2469,9 @@ gam print chromehistory releases [todrive <ToDriveAttribute>*]
        pre_provisioned_reenable

 gam update cros <CrOSEntity> action <CrOSAction> [acknowledge_device_touch_requirement]
-        [actionbatchsize <Integer>]
+        [actionbatchsize <Integer>] [maxtodeprov <Integer>]
 gam <CrOSTypeEntity> update action <CrOSAction> [acknowledge_device_touch_requirement]
-        [actionbatchsize <Integer>]
+        [actionbatchsize <Integer>] [maxtodeprov <Integer>]

 <CrOSCommand>
        reboot|
@@ -3162,6 +3168,7 @@ gam <UserTypeEntity> show contactdelegates [shownames] [csv]
        name|
        owneremail|
        ownerid|
+        ownername|
        room|
        section|
        students|
@@ -3275,16 +3282,16 @@ gam courses <CourseEntity> sync teachers [addonly|removeonly] [makefirstteachero
 gam courses <CourseEntity> sync students [addonly|removeonly] <UserTypeEntity>

 gam info course <CourseID> [owneraccess]
-        [owneremail] [alias|aliases] [show all|students|teachers] [countsonly]
+        [owneremail] [ownername] [alias|aliases] [show all|students|teachers] [countsonly]
        [fields <CourseFieldNameList>] [skipfields <CourseFieldNameList>]
        [formatjson]
 gam info courses <CourseEntity> [owneraccess]
-        [owneremail] [alias|aliases] [show all|students|teachers] [countsonly]
+        [owneremail] [ownername] [alias|aliases] [show all|students|teachers] [countsonly]
        [fields <CourseFieldNameList>] [skipfields <CourseFieldNameList>]
        [formatjson]
 gam print courses [todrive <ToDriveAttribute>*]
        (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] [states <CourseStateList>])
-        [owneremail] [owneremailmatchpattern <REMatchPattern>]
+        [owneremail] [owneremailmatchpattern <REMatchPattern>] [ownername]
        [alias|aliases|aliasesincolumns [delimiter <Character>]]
        [show all|students|teachers] [countsonly]
        [timefilter creationtime|updatetime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
@@ -3398,14 +3405,16 @@ gam print course-announcements [todrive <ToDriveAttribute>*]
        (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] states <CourseStateList>])
        (announcementids <CourseAnnouncementIDEntity>)|((announcementstates <CourseAnnouncementStateList>)*
        (orderby <CourseAnnouncementOrderByFieldName> [ascending|descending])*)
-        [showcreatoremails|creatoremail] [fields <CourseAnnouncementFieldNameList>]
+        [showcreatoremails|creatoremail] [showcreatornames|creatorname]
+        [fields <CourseAnnouncementFieldNameList>]
        [timefilter creationtime|updatetime|scheduledtime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
        [countsonly] [formatjson [quotechar <Character>]]
 gam print course-materials [todrive <ToDriveAttribute>*]
        (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] states <CourseStateList>])
        (materialids <CourseMaterialIDEntity>)|((materialstates <CourseMaterialStateList>)*
        (orderby <CourseMaterialOrderByFieldName> [ascending|descending])*)
-        [showcreatoremails|creatoremail] [showtopicnames] [fields <CourseMaterialFieldNameList>]
+        [showcreatoremails|creatoremail] [showcreatornames|creatorname] [showtopicnames]
+        [fields <CourseMaterialFieldNameList>]
        [timefilter creationtime|updatetime|scheduledtime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
        [oneitemperrow]
        [countsonly] [formatjson [quotechar <Character>]]
@@ -3426,7 +3435,8 @@ gam print course-works [todrive <ToDriveAttribute>*]
        (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] states <CourseStateList>])
        (workids <CourseWorkIDEntity>)|((workstates <CourseWorkStateList>)*
        (orderby <CourseWorkOrderByFieldName> [ascending|descending])*)
-        [showcreatoremails|creatoremail] [showtopicnames] [fields <CourseWorkFieldNameList>]
+        [showcreatoremails|creatoremail] [showcreatornames|creatorname] [showtopicnames]
+        [fields <CourseWorkFieldNameList>]
        [showstudentsaslist [<Boolean>]] [delimiter <Character>]
        [timefilter creationtime|updatetime|scheduledtime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
        [oneitemperrow]
@@ -3884,6 +3894,8 @@ gam audit monitor list <EmailAddress>
 gam create|add group <EmailAddress>
        [copyfrom <GroupItem>] <GroupAttribute>*
        [verifynotinvitable]
+        [recentdeleteretries <Integer>] [recentdeleteretrydelay <Integer>]
+        [verifycreationretries <Integer>] [verifycreationinitialdelay <Integer>] [verifycreationretrydelay <Integer>]
 gam update group|groups <GroupEntity> [email <EmailAddress>]
        [updateprimaryemail <RESearchPattern> <RESubstitution>]
        [copyfrom <GroupItem>] <GroupAttribute>*
@@ -5488,6 +5500,7 @@ gam print vaultcounts [todrive <ToDriveAttributes>*]
        [excludedrafts <Boolean>]
        [<JSONData>]
        [wait <Integer>]
+        [include_suspended_zeros [<Boolean>]]
 gam print vaultcounts [todrive <ToDriveAttributes>*]
        matter <MatterItem> operation <String> [wait <Integer>]

@@ -7021,7 +7034,7 @@ gam <UserTypeEntity> untrash drivefile <DriveFileEntity> [shortcutandtarget [<Bo

 gam <UserTypeEntity> info drivefile <DriveFileEntity>
        [returnidonly]
-        [filepath|fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [filepath|fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
        [allfields|<DriveFieldName>*|(fields <DriveFieldNameList>)]
        [includepermissionsforview published]
        (orderby <DriveFileOrderByFieldName> [ascending|descending])*
@@ -7502,7 +7515,7 @@ gam <UserTypeEntity> collect orphans

 gam <UserTypeEntity> show fileinfo <DriveFileEntity>
        [returnidonly]
-        [filepath|fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [filepath|fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
        [allfields|<DriveFieldName>*|(fields <DriveFieldNameList>)]
        [includepermissionsforview published]
        (orderby <DriveFileOrderByFieldName> [ascending|descending])*
@@ -7516,12 +7529,12 @@ gam <UserTypeEntity> show filepath <DriveFileEntity>
        [returnpathonly]
        (orderby <DriveFileOrderByFieldName> [ascending|descending])*
        [stripcrsfromname]
-        [fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
        [followshortcuts [<Boolean>]]
 gam <UserTypeEntity> print filepath <DriveFileEntity> [todrive <ToDriveAttribute>*]
        (orderby <DriveFileOrderByFieldName> [ascending|descending])*
        [stripcrsfromname] [oneitemperrow]
-        [fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
        [followshortcuts [<Boolean>]]

 gam <UserTypeEntity> print filecounts [todrive <ToDriveAttribute>*]
@@ -7624,7 +7637,7 @@ gam <UserTypeEntity> print filelist [todrive <ToDriveAttribute>*]
        [countsonly [summary none|only|plus] [summaryuser <String>]
                    [showsource] [showsize] [showsizeunits] [showmimetypesize]]
        [countsrowfilter]
-        [filepath|fullpath [folderpathonly [<Boolean>]] [pathdelimiter <Character>] [addpathstojson] [showdepth]] [buildtree]
+        [filepath|fullpath [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>] [addpathstojson] [showdepth]] [buildtree]
        [allfields|<DriveFieldName>*|(fields <DriveFieldNameList>)]
        [showdrivename] [showshareddrivepermissions]
        [(showlabels details|ids)|(includelabels <ClassificationLabelIDList>)]
@@ -7662,7 +7675,7 @@ gam <UserTypeEntity> print driveactivity [todrive <ToDriveAttribute>*]
         (drivefilename <DriveFileName>) | (drivefoldername <DriveFolderName>) | (query <QueryDriveFile>)]
        [([start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>])|(range <Date>|<Time> <Date>)|<Time>|
         yesterday|today|thismonth|(previousmonths <Integer>)]
-        [action|actions [not] <DriveActivityActionList>]
+        [action|actions [not] <DriveActivityActionList>] [maxactivities <Number>]
        [consolidationstrategy legacy|none]
        [idmapfile <CSVFileInput> endcsv]
        [stripcrsfromname] [formatjson [quotechar <Character>]]
--- a/src/GamUpdate.txt
+++ b/src/GamUpdate.txt
@@ -1,3 +1,117 @@
+7.43.07
+
+Improved validation of `<QueryCrOS>`, `<QueryDevice>` and `<QueryMobile>`.
+
+7.43.06
+
+Updated commands that use `<QueryCrOS>`, `<QueryDevice>` or `<QueryMobile>` to validate
+that it is of the form `field:value` and that `value` does not contain a '?'.
+Without validation, Google can return many more devices than are expected.
+
+7.43.05
+
+Added option `matchfield attendeesorganizer <Boolean> <EmailAddressEntity>` to `<EventMatchProperty>`
+that is used in commands that process events. The match is true if all of the addresses in `<EmailAddressEntity>`
+are present as attendees in the event and are an organizer or not based on `<Boolean>`.
+
+Added option `max_to_deprov <Integer>` to `gam update cros <CrOSEntity> action <CrOSAction>`
+that is used when `<CrOSAction>` is any of the following:
+```
+deprovision_different_model_replace|
+deprovision_different_model_replacement|
+deprovision_retiring_device|
+deprovision_same_model_replace|
+deprovision_same_model_replacement|
+deprovision_upgrade_transfer
+```
+`max_to_deprov <Integer>` - No deprovisions are processed if the number of devices in `<CrOSEntity>` exceeds `<Integer>`;
+the default value is one; set `<Integer>` to 0 for no limit.
+
+7.43.04
+
+Added option `include_suspended_zeros [<Boolean>]` to `gam print vaultcounts` that causes
+GAM to generate zero count lines for suspended users with zero items as well as non-suspended users.
+
+7.43.03
+
+Added option `parentpathonly [<Boolean>]` to the following commands that causes GAM
+to display only the parent folder names when displaying the path to a file.
+```
+gam <UserTypeEntity> info drivefile ... filepath|fullpath
+gam <UserTypeEntity> show fileinfo ... filepath|fullpath
+gam <UserTypeEntity> print|show filepath
+gam <UserTypeEntity> print filelist ... filepath|fullpath
+```
+
+7.43.02
+
+Added option `maxactivities <Integer>` to `gam <UserTypeEntity> print driveactivity` to limit
+the number of activities displayed; the default is 0, no limit.
+
+7.43.01
+
+Updated `gam info user` and `gam print users` to display guest user attributes: `isGuestUser, guestAccountInfo`
+
+Expanded `<UserTypeEntity>` to allow specification of guest users.
+  * See [Collections of Users](Collections-of-Users)
+
+7.42.00
+
+In versions prior to 7.42.00, when `redirect csv <FileName>` was used, GAM did not open and write `<FileName>`
+until all processing was complete; if `<FileName>` was not accessible, an error was generated
+and no results were saved. Now, `<FileName>` is opened initially to verify accessiblity
+and then written when processing is complete.
+
+In the unlikely event that this causes issues, you can do `redirect csv <FileName> delayopen`
+to get the previous behavior.
+
+7.41.03
+
+Fixed bug in the following:
+Added the following to `<RowValueFilter>` used in CSV input/output row filtering; these are
+synonyms for `count` and `countrange`.
+```
+[(any|all):]number<Operator><Number>|
+[(any|all):]numberrange!=<Number>/<Number>|
+[(any|all):]numberrange=<Number>/<Number>|
+```
+
+7.41.02
+
+Added option `ownername` to `gam info|print courses` to have GAM display the course owners full name;
+there is an extra API call per course to get the name.
+
+Added option `creatorname` to `gam print course-announcements|course-materials|course-works` to have
+GAM display the item creators full name; there is an extra API call per course to get the name.
+
+After creating a group, it may be sometime, e.g. 30-45 seconds, before members can
+successfully be added to the group even though the API reported that the group was created.
+The following options can be used with `gam create group` to verify that the group is actually ready to be updated.
+This will be most useful in scripts that are used to create and then populate groups.
+```
+verifycreationretries <Integer> - Verify group creation, defaults to 0, no verification performed, range 0-20
+verifycreationinitialdelay <Integer> - Number of seconds to delay before first verification performed, defaults to 5, range 0-60
+verifycreationretrydelay <Integer> - Number of seconds to delay between verificaton retries, defaults to 5, range 1-60
+```
+
+If you have a script that deletes a group and then immediately tries to create a new group with the same email address,
+you may run into issues. There seems to be a 30-45 second window after the deletion in which a couple
+of strange errors can occur on the creation: `Resource not found` and `Duplicate`.
+The following options can be used with `gam create group` to handle these errors. This will be most useful
+in scripts that are used to delete and then immediately  recreate groups.
+```
+recentdeleteretries <Integer> - Handle group delete/create errors, defaults to 0, no errors handled, range 0-20
+recentdeleteretrydelay <Integer> - Number of seconds to delay between retries, defaults to 5, range 1-60
+```
+
+Added the following to `<RowValueFilter>` used in CSV input/output row filtering; these are
+synonyms for `count` and `countrange`.
+```
+[(any|all):]number<Operator><Number>|
+[(any|all):]numberrange!=<Number>/<Number>|
+[(any|all):]numberrange=<Number>/<Number>|
+```
+
 7.41.01

 Fixed bug in `gam print cigroups members managers owners countsonly totalcount internal external` that caused a trap.
--- a/src/gam/init.py
+++ b/src/gam/init.py
--- a/src/gam/gamlib/glaction.py
+++ b/src/gam/gamlib/glaction.py
@@ -134,6 +134,7 @@ class GamAction():
  UNZIP = 'unzi'
  USE = 'use '
  VERIFY = 'vrfy'
+  VERIFYITEMEXISTS = 'vexi'
  WAITFORMAILBOX = 'wamb'
  WATCH = 'watc'
  WIPE = 'wipe'
@@ -253,6 +254,7 @@ class GamAction():
    UPLOAD: ['Uploaded', 'Upload'],
    USE: ['Used', 'Use'],
    VERIFY: ['Verified', 'Verify'],
+    VERIFYITEMEXISTS: ['Verified Item Exists', 'Verify Item Exists'],
    WAITFORMAILBOX: ['Mailbox is Setup', 'Check Mailbox is Setup'],
    WATCH: ['Watched', 'Watch'],
    WIPE: ['Wiped', 'Wipe'],
--- a/src/gam/gamlib/glclargs.py
+++ b/src/gam/gamlib/glclargs.py
@@ -53,6 +53,7 @@ class GamCLArgs():
  ENTITY_DOMAINS_ARCH = 'domains_arch'
  ENTITY_DOMAINS_NS = 'domains_ns'
  ENTITY_DOMAINS_SUSP = 'domains_susp'
+  ENTITY_DOMAINS_NS_SUSP = 'domains_ns_susp'
  ENTITY_DOMAINS_NA_NS = 'domains_na_ns'
  ENTITY_GROUP = 'group'
  ENTITY_GROUP_INDE = 'group_inde'
@@ -60,6 +61,7 @@ class GamCLArgs():
  ENTITY_GROUP_ARCH = 'group_arch'
  ENTITY_GROUP_NS = 'group_ns'
  ENTITY_GROUP_SUSP = 'group_susp'
+  ENTITY_GROUP_NS_SUSP = 'group_ns_susp'
  ENTITY_GROUP_NA_NS = 'group_na_ns'
  ENTITY_GROUPS = 'groups'
  ENTITY_GROUPS_INDE = 'groups_inde'
@@ -67,12 +69,14 @@ class GamCLArgs():
  ENTITY_GROUPS_ARCH = 'groups_arch'
  ENTITY_GROUPS_NS = 'groups_ns'
  ENTITY_GROUPS_SUSP = 'groups_susp'
+  ENTITY_GROUPS_NS_SUSP = 'groups_ns_susp'
  ENTITY_GROUPS_NA_NS = 'groups_na_ns'
  ENTITY_GROUP_USERS = 'group_users'
  ENTITY_GROUP_USERS_NA = 'group_users_na'
  ENTITY_GROUP_USERS_ARCH = 'group_users_arch'
  ENTITY_GROUP_USERS_NS = 'group_users_ns'
  ENTITY_GROUP_USERS_SUSP = 'group_users_susp'
+  ENTITY_GROUP_USERS_NS_SUSP = 'group_users_ns_susp'
  ENTITY_GROUP_USERS_NA_NS = 'group_users_na_ns'
  ENTITY_GROUP_USERS_SELECT = 'group_users_select'
  ENTITY_LICENSES = 'licenses'
@@ -82,24 +86,28 @@ class GamCLArgs():
  ENTITY_OU_ARCH = 'ou_arch'
  ENTITY_OU_NS = 'ou_ns'
  ENTITY_OU_SUSP = 'ou_susp'
+  ENTITY_OU_NS_SUSP = 'ou_ns_susp'
  ENTITY_OU_NA_NS = 'ou_na_ns'
  ENTITY_OU_AND_CHILDREN = 'ou_and_children'
  ENTITY_OU_AND_CHILDREN_NA = 'ou_and_children_na'
  ENTITY_OU_AND_CHILDREN_ARCH = 'ou_and_children_arch'
  ENTITY_OU_AND_CHILDREN_NS = 'ou_and_children_ns'
  ENTITY_OU_AND_CHILDREN_SUSP = 'ou_and_children_susp'
+  ENTITY_OU_AND_CHILDREN_NS_SUSP = 'ou_and_children_ns_susp'
  ENTITY_OU_AND_CHILDREN_NA_NS = 'ou_and_children_na_ns'
  ENTITY_OUS = 'ous'
  ENTITY_OUS_NA = 'ous_na'
  ENTITY_OUS_ARCH = 'ous_arch'
  ENTITY_OUS_NS = 'ous_ns'
  ENTITY_OUS_SUSP = 'ous_susp'
+  ENTITY_OUS_NS_SUSP = 'ous_ns_susp'
  ENTITY_OUS_NA_NS = 'ous_na_ns'
  ENTITY_OUS_AND_CHILDREN = 'ous_and_children'
  ENTITY_OUS_AND_CHILDREN_NA = 'ous_and_children_na'
  ENTITY_OUS_AND_CHILDREN_ARCH = 'ous_and_children_arch'
  ENTITY_OUS_AND_CHILDREN_NS = 'ous_and_children_ns'
  ENTITY_OUS_AND_CHILDREN_SUSP = 'ous_and_children_susp'
+  ENTITY_OUS_AND_CHILDREN_NS_SUSP = 'ous_and_children_ns_susp'
  ENTITY_OUS_AND_CHILDREN_NA_NS = 'ous_and_children_na_ns'
  ENTITY_QUERIES = 'queries'
  ENTITY_QUERY = 'query'
@@ -111,9 +119,17 @@ class GamCLArgs():
  ENTITY_USERS_ARCH = 'users_arch'
  ENTITY_USERS_NS = 'users_ns'
  ENTITY_USERS_SUSP = 'users_susp'
+  ENTITY_USERS_NS_SUSP = 'users_ns_susp'
  ENTITY_USERS_NA_NS = 'users_na_ns'
  ENTITY_USERS_ARCH_OR_SUSP = 'users_arch_or_susp'
-  ENTITY_USERS_NS_SUSP = 'users_ns_susp'
+  ENTITY_USERS_AND_GUESTS  = 'users_and_guests'
+  ENTITY_USERS_AND_GUESTS_NS  = 'users_and_guests_ns'
+  ENTITY_USERS_AND_GUESTS_SUSP  = 'users_and_guests_susp'
+  ENTITY_USERS_AND_GUESTS_NS_SUSP  = 'users_and_guests_ns_susp'
+  ENTITY_GUESTS  = 'guests'
+  ENTITY_GUESTS_NS = 'guests_ns'
+  ENTITY_GUESTS_SUSP = 'guests_susp'
+  ENTITY_GUESTS_NS_SUSP = 'guests_ns_susp'
 #
  BROWSER_ENTITIES = [
    ENTITY_BROWSER,
@@ -150,6 +166,7 @@ class GamCLArgs():
    ENTITY_DOMAINS_ARCH,
    ENTITY_DOMAINS_NS,
    ENTITY_DOMAINS_SUSP,
+    ENTITY_DOMAINS_NS_SUSP,
    ENTITY_DOMAINS_NA_NS,
    ENTITY_GROUP,
    ENTITY_GROUP_INDE,
@@ -157,6 +174,7 @@ class GamCLArgs():
    ENTITY_GROUP_ARCH,
    ENTITY_GROUP_NS,
    ENTITY_GROUP_SUSP,
+    ENTITY_GROUP_NS_SUSP,
    ENTITY_GROUP_NA_NS,
    ENTITY_GROUPS,
    ENTITY_GROUPS_INDE,
@@ -164,12 +182,14 @@ class GamCLArgs():
    ENTITY_GROUPS_ARCH,
    ENTITY_GROUPS_NS,
    ENTITY_GROUPS_SUSP,
+    ENTITY_GROUPS_NS_SUSP,
    ENTITY_GROUPS_NA_NS,
    ENTITY_GROUP_USERS,
    ENTITY_GROUP_USERS_NA,
    ENTITY_GROUP_USERS_ARCH,
    ENTITY_GROUP_USERS_NS,
    ENTITY_GROUP_USERS_SUSP,
+    ENTITY_GROUP_USERS_NS_SUSP,
    ENTITY_GROUP_USERS_NA_NS,
    ENTITY_GROUP_USERS_SELECT,
    ENTITY_LICENSES,
@@ -179,24 +199,28 @@ class GamCLArgs():
    ENTITY_OU_ARCH,
    ENTITY_OU_NS,
    ENTITY_OU_SUSP,
+    ENTITY_OU_NS_SUSP,
    ENTITY_OU_NA_NS,
    ENTITY_OU_AND_CHILDREN,
    ENTITY_OU_AND_CHILDREN_NA,
    ENTITY_OU_AND_CHILDREN_ARCH,
    ENTITY_OU_AND_CHILDREN_NS,
    ENTITY_OU_AND_CHILDREN_SUSP,
+    ENTITY_OU_AND_CHILDREN_NS_SUSP,
    ENTITY_OU_AND_CHILDREN_NA_NS,
    ENTITY_OUS,
    ENTITY_OUS_NA,
    ENTITY_OUS_ARCH,
    ENTITY_OUS_NS,
    ENTITY_OUS_SUSP,
+    ENTITY_OUS_NS_SUSP,
    ENTITY_OUS_NA_NS,
    ENTITY_OUS_AND_CHILDREN,
    ENTITY_OUS_AND_CHILDREN_NA,
    ENTITY_OUS_AND_CHILDREN_ARCH,
    ENTITY_OUS_AND_CHILDREN_NS,
    ENTITY_OUS_AND_CHILDREN_SUSP,
+    ENTITY_OUS_AND_CHILDREN_NS_SUSP,
    ENTITY_OUS_AND_CHILDREN_NA_NS,
    ENTITY_QUERIES,
    ENTITY_QUERY,
@@ -278,48 +302,56 @@ class GamCLArgs():
    'org_arch': ENTITY_OU_ARCH,
    'org_ns': ENTITY_OU_NS,
    'org_susp': ENTITY_OU_SUSP,
+    'org_ns_susp': ENTITY_OU_NS_SUSP,
    'org_na_ns': ENTITY_OU_NA_NS,
    'org_and_child': ENTITY_OU_AND_CHILDREN,
    'org_and_child_na': ENTITY_OU_AND_CHILDREN_NA,
    'org_and_child_arch': ENTITY_OU_AND_CHILDREN_ARCH,
    'org_and_child_ns': ENTITY_OU_AND_CHILDREN_NS,
    'org_and_child_susp': ENTITY_OU_AND_CHILDREN_SUSP,
+    'org_and_child_ns_susp': ENTITY_OU_AND_CHILDREN_NS_SUSP,
    'org_and_child_na_ns': ENTITY_OU_AND_CHILDREN_NA_NS,
    'org_and_children': ENTITY_OU_AND_CHILDREN,
    'org_and_children_na': ENTITY_OU_AND_CHILDREN_NA,
    'org_and_children_arch': ENTITY_OU_AND_CHILDREN_ARCH,
    'org_and_children_ns': ENTITY_OU_AND_CHILDREN_NS,
    'org_and_children_susp': ENTITY_OU_AND_CHILDREN_SUSP,
+    'org_and_children_ns_susp': ENTITY_OU_AND_CHILDREN_NS_SUSP,
    'org_and_children_na_ns': ENTITY_OU_AND_CHILDREN_NA_NS,
    'orgs': ENTITY_OUS,
    'orgs_na': ENTITY_OUS_NA,
    'orgs_arch': ENTITY_OUS_ARCH,
    'orgs_ns': ENTITY_OUS_NS,
    'orgs_susp': ENTITY_OUS_SUSP,
+    'orgs_ns_susp': ENTITY_OUS_NS_SUSP,
    'orgs_na_ns': ENTITY_OUS_NA_NS,
    'orgs_and_child': ENTITY_OUS_AND_CHILDREN,
    'orgs_and_child_na': ENTITY_OUS_AND_CHILDREN_NA,
    'orgs_and_child_arch': ENTITY_OUS_AND_CHILDREN_ARCH,
    'orgs_and_child_ns': ENTITY_OUS_AND_CHILDREN_NS,
    'orgs_and_child_susp': ENTITY_OUS_AND_CHILDREN_SUSP,
+    'orgs_and_child_ns_susp': ENTITY_OUS_AND_CHILDREN_NS_SUSP,
    'orgs_and_child_na_ns': ENTITY_OUS_AND_CHILDREN_NA_NS,
    'orgs_and_children': ENTITY_OUS_AND_CHILDREN,
    'orgs_and_children_na': ENTITY_OUS_AND_CHILDREN_NA,
    'orgs_and_children_arch': ENTITY_OUS_AND_CHILDREN_ARCH,
    'orgs_and_children_ns': ENTITY_OUS_AND_CHILDREN_NS,
    'orgs_and_children_susp': ENTITY_OUS_AND_CHILDREN_SUSP,
+    'orgs_and_children_ns_susp': ENTITY_OUS_AND_CHILDREN_NS_SUSP,
    'orgs_and_children_na_ns': ENTITY_OUS_AND_CHILDREN_NA_NS,
    'ou_and_child': ENTITY_OU_AND_CHILDREN,
    'ou_and_child_na': ENTITY_OU_AND_CHILDREN_NA,
    'ou_and_child_arch': ENTITY_OU_AND_CHILDREN_ARCH,
    'ou_and_child_ns': ENTITY_OU_AND_CHILDREN_NS,
    'ou_and_child_susp': ENTITY_OU_AND_CHILDREN_SUSP,
+    'ou_and_child_ns_susp': ENTITY_OU_AND_CHILDREN_NS_SUSP,
    'ou_and_child_na_ns': ENTITY_OU_AND_CHILDREN_NA_NS,
    'ous_and_child': ENTITY_OUS_AND_CHILDREN,
    'ous_and_child_na': ENTITY_OUS_AND_CHILDREN_NA,
    'ous_and_child_arch': ENTITY_OUS_AND_CHILDREN_ARCH,
    'ous_and_child_ns': ENTITY_OUS_AND_CHILDREN_NS,
    'ous_and_child_susp': ENTITY_OUS_AND_CHILDREN_SUSP,
+    'ous_and_child_ns_susp': ENTITY_OUS_AND_CHILDREN_NS_SUSP,
    'ous_and_child_na_ns': ENTITY_OUS_AND_CHILDREN_NA_NS,
    }
 # CL entity source selectors
@@ -395,9 +427,17 @@ class GamCLArgs():
    ENTITY_USERS_ARCH,
    ENTITY_USERS_NS,
    ENTITY_USERS_SUSP,
+    ENTITY_USERS_NS_SUSP,
    ENTITY_USERS_ARCH_OR_SUSP,
    ENTITY_USERS_NA_NS,
-    ENTITY_USERS_NS_SUSP,
+    ENTITY_USERS_AND_GUESTS,
+    ENTITY_USERS_AND_GUESTS_NS,
+    ENTITY_USERS_AND_GUESTS_SUSP,
+    ENTITY_USERS_AND_GUESTS_NS_SUSP,
+    ENTITY_GUESTS,
+    ENTITY_GUESTS_NS,
+    ENTITY_GUESTS_SUSP,
+    ENTITY_GUESTS_NS_SUSP,
    ]
 #
  ENTITY_ALL_CROS = ENTITY_SELECTOR_ALL+' '+ENTITY_CROS
@@ -406,9 +446,17 @@ class GamCLArgs():
  ENTITY_ALL_USERS_ARCH = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_ARCH
  ENTITY_ALL_USERS_NS = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_NS
  ENTITY_ALL_USERS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_SUSP
+  ENTITY_ALL_USERS_NS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_NS_SUSP
  ENTITY_ALL_USERS_NA_NS = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_NA_NS
  ENTITY_ALL_USERS_ARCH_OR_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_ARCH_OR_SUSP
-  ENTITY_ALL_USERS_NS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_NS_SUSP
+  ENTITY_ALL_USERS_AND_GUESTS = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_AND_GUESTS
+  ENTITY_ALL_USERS_AND_GUESTS_NS = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_AND_GUESTS_NS
+  ENTITY_ALL_USERS_AND_GUESTS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_AND_GUESTS_SUSP
+  ENTITY_ALL_USERS_AND_GUESTS_NS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_USERS_AND_GUESTS_NS_SUSP
+  ENTITY_ALL_GUESTS = ENTITY_SELECTOR_ALL+' '+ENTITY_GUESTS
+  ENTITY_ALL_GUESTS_NS = ENTITY_SELECTOR_ALL+' '+ENTITY_GUESTS_NS
+  ENTITY_ALL_GUESTS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_GUESTS_SUSP
+  ENTITY_ALL_GUESTS_NS_SUSP = ENTITY_SELECTOR_ALL+' '+ENTITY_GUESTS_NS_SUSP
 #
  ALL_USER_ENTITY_TYPES = {
    ENTITY_ALL_USERS,
@@ -416,8 +464,16 @@ class GamCLArgs():
    ENTITY_ALL_USERS_ARCH,
    ENTITY_ALL_USERS_NS,
    ENTITY_ALL_USERS_SUSP,
-    ENTITY_ALL_USERS_NA_NS,
    ENTITY_ALL_USERS_NS_SUSP,
+    ENTITY_ALL_USERS_NA_NS,
+    ENTITY_ALL_USERS_AND_GUESTS,
+    ENTITY_ALL_USERS_AND_GUESTS_NS,
+    ENTITY_ALL_USERS_AND_GUESTS_SUSP,
+    ENTITY_ALL_USERS_AND_GUESTS_NS_SUSP,
+    ENTITY_ALL_GUESTS,
+    ENTITY_ALL_GUESTS_NS,
+    ENTITY_ALL_GUESTS_SUSP,
+    ENTITY_ALL_GUESTS_NS_SUSP,
    }
  DOMAIN_ENTITY_TYPES = {
    ENTITY_DOMAINS,
@@ -425,6 +481,7 @@ class GamCLArgs():
    ENTITY_DOMAINS_ARCH,
    ENTITY_DOMAINS_NS,
    ENTITY_DOMAINS_SUSP,
+    ENTITY_DOMAINS_NS_SUSP,
    ENTITY_DOMAINS_NA_NS,
    }
  GROUP_ENTITY_TYPES = {
@@ -433,6 +490,7 @@ class GamCLArgs():
    ENTITY_GROUP_ARCH,
    ENTITY_GROUP_NS,
    ENTITY_GROUP_SUSP,
+    ENTITY_GROUP_NS_SUSP,
    ENTITY_GROUP_NA_NS,
    ENTITY_GROUP_INDE,
    }
@@ -442,6 +500,7 @@ class GamCLArgs():
    ENTITY_GROUPS_ARCH,
    ENTITY_GROUPS_NS,
    ENTITY_GROUPS_SUSP,
+    ENTITY_GROUPS_NS_SUSP,
    ENTITY_GROUPS_NA_NS,
    ENTITY_GROUPS_INDE,
    }
@@ -451,6 +510,7 @@ class GamCLArgs():
    ENTITY_GROUP_USERS_ARCH,
    ENTITY_GROUP_USERS_NS,
    ENTITY_GROUP_USERS_SUSP,
+    ENTITY_GROUP_USERS_NS_SUSP,
    ENTITY_GROUP_USERS_NA_NS,
    ENTITY_GROUP_USERS_SELECT,
    }
@@ -465,6 +525,8 @@ class GamCLArgs():
    ENTITY_OU_AND_CHILDREN_NS,
    ENTITY_OU_SUSP,
    ENTITY_OU_AND_CHILDREN_SUSP,
+    ENTITY_OU_NS_SUSP,
+    ENTITY_OU_AND_CHILDREN_NS_SUSP,
    ENTITY_OU_NA_NS,
    ENTITY_OU_AND_CHILDREN_NA_NS,
    }
@@ -479,6 +541,8 @@ class GamCLArgs():
    ENTITY_OUS_AND_CHILDREN_NS,
    ENTITY_OUS_SUSP,
    ENTITY_OUS_AND_CHILDREN_SUSP,
+    ENTITY_OUS_NS_SUSP,
+    ENTITY_OUS_AND_CHILDREN_NS_SUSP,
    ENTITY_OUS_NA_NS,
    ENTITY_OUS_AND_CHILDREN_NA_NS,
    }
@@ -493,6 +557,8 @@ class GamCLArgs():
    ENTITY_OUS_NS,
    ENTITY_OU_SUSP,
    ENTITY_OUS_SUSP,
+    ENTITY_OU_NS_SUSP,
+    ENTITY_OUS_NS_SUSP,
    ENTITY_OU_NA_NS,
    ENTITY_OUS_NA_NS,
    }
@@ -534,13 +600,21 @@ class GamCLArgs():
    }
 #
  ALL_USERS_QUERY_MAP = {
-    ENTITY_ALL_USERS: 'isSuspended=False',
-    ENTITY_ALL_USERS_NA: 'isArchived=False',
-    ENTITY_ALL_USERS_ARCH: 'isArchived=True',
-    ENTITY_ALL_USERS_NS: 'isSuspended=False',
-    ENTITY_ALL_USERS_SUSP: 'isSuspended=True',
-    ENTITY_ALL_USERS_NA_NS: 'isArchived=False isSuspended=False',
-    ENTITY_ALL_USERS_NS_SUSP: None,
+    ENTITY_ALL_USERS: 'isSuspended=False isGuest=False',
+    ENTITY_ALL_USERS_NA: 'isArchived=False isGuest=False',
+    ENTITY_ALL_USERS_ARCH: 'isArchived=True isGuest=False',
+    ENTITY_ALL_USERS_NS: 'isSuspended=False isGuest=False',
+    ENTITY_ALL_USERS_SUSP: 'isSuspended=True isGuest=False',
+    ENTITY_ALL_USERS_NA_NS: 'isArchived=False isSuspended=False isGuest=False',
+    ENTITY_ALL_USERS_NS_SUSP: 'isGuest=False',
+    ENTITY_ALL_USERS_AND_GUESTS: 'isSuspended=False',
+    ENTITY_ALL_USERS_AND_GUESTS_NS: 'isSuspended=False',
+    ENTITY_ALL_USERS_AND_GUESTS_SUSP: 'isSuspended=True',
+    ENTITY_ALL_USERS_AND_GUESTS_NS_SUSP: None,
+    ENTITY_ALL_GUESTS: 'isSuspended=False isGuest=True',
+    ENTITY_ALL_GUESTS_NS: 'isSuspended=False isGuest=True',
+    ENTITY_ALL_GUESTS_SUSP: 'isSuspended=True isGuest=True',
+    ENTITY_ALL_GUESTS_NS_SUSP: 'isGuest=True',
  }
  DOMAINS_QUERY_MAP = {
    ENTITY_DOMAINS: None,
@@ -548,6 +622,7 @@ class GamCLArgs():
    ENTITY_DOMAINS_ARCH: 'isArchived=True',
    ENTITY_DOMAINS_NS: 'isSuspended=False',
    ENTITY_DOMAINS_SUSP: 'isSuspended=True',
+    ENTITY_DOMAINS_NS_SUSP: None,
    ENTITY_DOMAINS_NA_NS: 'isArchived=False isSuspended=False',
  }
  GROUPS_QUERY_MAP = { #(isArchived, isSuspended)
@@ -559,6 +634,8 @@ class GamCLArgs():
    ENTITY_GROUPS_NS: (None, False),
    ENTITY_GROUP_SUSP: (None, True),
    ENTITY_GROUPS_SUSP: (None, True),
+    ENTITY_GROUP_NS_SUSP: (None, None),
+    ENTITY_GROUPS_NS_SUSP: (None, None),
    ENTITY_GROUP_NA_NS: (False, False),
    ENTITY_GROUPS_NA_NS: (False, False),
  }
@@ -567,6 +644,7 @@ class GamCLArgs():
    ENTITY_GROUP_USERS_ARCH: (True, None),
    ENTITY_GROUP_USERS_NS: (None, False),
    ENTITY_GROUP_USERS_SUSP: (None, True),
+    ENTITY_GROUP_USERS_NS_SUSP: (None, None),
    ENTITY_GROUP_USERS_NA_NS: (False, False),
  }
  OU_QUERY_MAP = { #(isArchived, isSuspended)
@@ -586,6 +664,10 @@ class GamCLArgs():
    ENTITY_OUS_SUSP: (None, True),
    ENTITY_OU_AND_CHILDREN_SUSP: (None, True),
    ENTITY_OUS_AND_CHILDREN_SUSP: (None, True),
+    ENTITY_OU_NS_SUSP: (None, None),
+    ENTITY_OUS_NS_SUSP: (None, None),
+    ENTITY_OU_AND_CHILDREN_NS_SUSP: (None, None),
+    ENTITY_OUS_AND_CHILDREN_NS_SUSP: (None, None),
    ENTITY_OU_NA_NS: (False, False),
    ENTITY_OUS_NA_NS: (False, False),
    ENTITY_OU_AND_CHILDREN_NA_NS: (False, False),
@@ -602,6 +684,14 @@ class GamCLArgs():
    ENTITY_USERS_NA_NS: ENTITY_ALL_USERS_NA_NS,
    ENTITY_USERS_ARCH_OR_SUSP: ENTITY_ALL_USERS_ARCH_OR_SUSP,
    ENTITY_USERS_NS_SUSP: ENTITY_ALL_USERS_NS_SUSP,
+    ENTITY_USERS_AND_GUESTS: ENTITY_ALL_USERS_AND_GUESTS,
+    ENTITY_USERS_AND_GUESTS_NS: ENTITY_ALL_USERS_AND_GUESTS_NS,
+    ENTITY_USERS_AND_GUESTS_SUSP: ENTITY_ALL_USERS_AND_GUESTS_SUSP,
+    ENTITY_USERS_AND_GUESTS_NS_SUSP: ENTITY_ALL_USERS_AND_GUESTS_NS_SUSP,
+    ENTITY_GUESTS: ENTITY_ALL_GUESTS,
+    ENTITY_GUESTS_NS: ENTITY_ALL_GUESTS_NS,
+    ENTITY_GUESTS_SUSP: ENTITY_ALL_GUESTS_SUSP,
+    ENTITY_GUESTS_NS_SUSP: ENTITY_ALL_GUESTS_NS_SUSP,
    }
 # Allowed values for CL source selector datafile, csvkmd
  CROS_ENTITY_SELECTOR_DATAFILE_CSVKMD_SUBTYPES = [
@@ -619,6 +709,7 @@ class GamCLArgs():
    ENTITY_DOMAINS_ARCH,
    ENTITY_DOMAINS_NS,
    ENTITY_DOMAINS_SUSP,
+    ENTITY_DOMAINS_NS_SUSP,
    ENTITY_DOMAINS_NA_NS,
    ENTITY_GROUPS,
    ENTITY_GROUPS_INDE,
@@ -626,12 +717,14 @@ class GamCLArgs():
    ENTITY_GROUPS_ARCH,
    ENTITY_GROUPS_NS,
    ENTITY_GROUPS_SUSP,
+    ENTITY_GROUPS_NS_SUSP,
    ENTITY_GROUPS_NA_NS,
    ENTITY_GROUP_USERS,
    ENTITY_GROUP_USERS_NA,
    ENTITY_GROUP_USERS_ARCH,
    ENTITY_GROUP_USERS_NS,
    ENTITY_GROUP_USERS_SUSP,
+    ENTITY_GROUP_USERS_NS_SUSP,
    ENTITY_GROUP_USERS_NA_NS,
    ENTITY_GROUP_USERS_SELECT,
    ENTITY_OUS,
@@ -639,12 +732,14 @@ class GamCLArgs():
    ENTITY_OUS_ARCH,
    ENTITY_OUS_NS,
    ENTITY_OUS_SUSP,
+    ENTITY_OUS_NS_SUSP,
    ENTITY_OUS_NA_NS,
    ENTITY_OUS_AND_CHILDREN,
    ENTITY_OUS_AND_CHILDREN_NA,
    ENTITY_OUS_AND_CHILDREN_ARCH,
    ENTITY_OUS_AND_CHILDREN_NS,
    ENTITY_OUS_AND_CHILDREN_SUSP,
+    ENTITY_OUS_AND_CHILDREN_NS_SUSP,
    ENTITY_OUS_AND_CHILDREN_NA_NS,
    ENTITY_COURSEPARTICIPANTS,
    ENTITY_STUDENTS,
--- a/src/gam/gamlib/glgapi.py
+++ b/src/gam/gamlib/glgapi.py
@@ -274,7 +274,7 @@ GMAIL_LIST_THROW_REASONS = [FAILED_PRECONDITION, PERMISSION_DENIED, INVALID, INV
 GMAIL_SMIME_THROW_REASONS = [SERVICE_NOT_AVAILABLE, BAD_REQUEST, INVALID_ARGUMENT, FORBIDDEN, NOT_FOUND, PERMISSION_DENIED]
 GROUP_GET_THROW_REASONS = [GROUP_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, BAD_REQUEST, INVALID, SYSTEM_ERROR]
 GROUP_GET_RETRY_REASONS = [INVALID, SYSTEM_ERROR, SERVICE_NOT_AVAILABLE]
-GROUP_CREATE_THROW_REASONS = [DUPLICATE, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, INVALID, INVALID_INPUT]
+GROUP_CREATE_THROW_REASONS = [DUPLICATE, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, INVALID, INVALID_INPUT, RESOURCE_NOT_FOUND]
 GROUP_UPDATE_THROW_REASONS = [GROUP_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, INVALID, INVALID_INPUT]
 GROUP_SETTINGS_THROW_REASONS = [NOT_FOUND, GROUP_NOT_FOUND, DOMAIN_NOT_FOUND, DOMAIN_CANNOT_USE_APIS, FORBIDDEN, SYSTEM_ERROR, PERMISSION_DENIED,
                                INVALID, INVALID_ARGUMENT, INVALID_PARAMETER, INVALID_ATTRIBUTE_VALUE, INVALID_INPUT,
--- a/src/gam/gamlib/glglobals.py
+++ b/src/gam/gamlib/glglobals.py
@@ -131,6 +131,8 @@ GAM_PATH = 'gpth'
 GAM_TYPE = 'gtyp'
 # Shared Service Account HTTP Object
 HTTP_OBJECT = 'http'
+# Are we on Global Compute Engine
+IS_ON_GCE = 'ogce'
 # Length of last Got message
 LAST_GOT_MSG_LEN = 'lgml'
 # License SKUs
@@ -285,6 +287,7 @@ Globals = {
  GAM_PATH: '.',
  GAM_TYPE: '',
  HTTP_OBJECT: None,
+  IS_ON_GCE: False,
  LAST_GOT_MSG_LEN: 0,
  LICENSE_SKUS: [],
  MAKE_BUILDING_ID_NAME_MAP: True,
--- a/src/gam/gamlib/glmsgs.py
+++ b/src/gam/gamlib/glmsgs.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-

-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -312,6 +312,7 @@ INVALID_ALIAS = 'Invalid Alias'
 INVALID_ATTENDEE_CHANGE = 'Invalid attendee change "{0}"'
 INVALID_CHARSET = 'Invalid charset "{0}"'
 INVALID_DATE_TIME_RANGE = '{0} {1} must be greater than/equal to {2} {3}'
+INVALID_DEVICE_QUERY = 'Invalid {0} query "{1}"; it must be if the form "field:value" and must not contain a "?"'
 INVALID_EMOJI_NAME = '{0} does not match pattern :[0-9a-z_-]:'
 INVALID_ENTITY = 'Invalid {0}, {1}'
 INVALID_EVENT_TIMERANGE = '{0} {1} must be less than {2}'
@@ -474,6 +475,7 @@ REASON_ONLY_VALID_WITH_CONTENTRESTRICTIONS_READONLY_TRUE = 'reason only valid wi
 REAUTHENTICATION_IS_NEEDED = 'Reauthentication is needed, please run\n\ngam oauth create'
 RECOMMEND_RUNNING_GAM_ROTATE_SAKEY = 'Recommend running "gam rotate sakey" to get a new key\n'
 REFUSING_TO_DEPROVISION_DEVICES = 'Refusing to deprovision {0} devices because acknowledge_device_touch_requirement not specified.\nDeprovisioning a device means the device will have to be physically wiped and re-enrolled to be managed by your domain again.\nThis requires physical access to the device and is very time consuming to perform for each device.\nPlease add "acknowledge_device_touch_requirement" to the GAM command if you understand this and wish to proceed with the deprovision.\nPlease also be aware that deprovisioning can have an effect on your device license count.\nSee https://support.google.com/chrome/a/answer/3523633 for full details.'
+REFUSING_TO_DEPROVISION_N_DEVICES = 'Refusing to deprovision {0} devices due to maxtodepov {1}.\nSpecify "maxtodeprov 0" to deprovision all {0} devices'
 REPLY_TO_CUSTOM_REQUIRES_EMAIL_ADDRESS = 'replyto REPLY_TO_CUSTOM requires customReplyTo <EmailAddress>'
 REQUEST_COMPLETED_NO_FILES = 'Request completed but no results/files were returned, try requesting again'
 REQUEST_NOT_COMPLETE = 'Request needs to be completed before downloading, current status is: {0}'
--- a/src/gam/gamlib/gluprop.py
+++ b/src/gam/gamlib/gluprop.py
@@ -117,6 +117,8 @@ PROPERTIES = {
    {CLASS: PC_STRING, TITLE: 'Full Name',},
  'displayName':
    {CLASS: PC_STRING, TITLE: 'Display Name',},
+  'primaryGuestEmail':
+    {CLASS: PC_STRING, TITLE: 'Primary Guest Email',},
  'languages':
    {CLASS: PC_LANGUAGES, TITLE: 'Languages',},
  'languageCode':
@@ -131,6 +133,8 @@ PROPERTIES = {
    {CLASS: PC_BOOLEAN, TITLE: 'Is a Super Admin',},
  'isDelegatedAdmin':
    {CLASS: PC_BOOLEAN, TITLE: 'Is Delegated Admin',},
+  'isGuestUser':
+    {CLASS: PC_BOOLEAN, TITLE: 'Is a Guest User',},
  'isEnrolledIn2Sv':
    {CLASS: PC_BOOLEAN, TITLE: '2-step enrolled',},
  'isEnforcedIn2Sv':
--- a/src/tools/ssd.mjs
+++ b/src/tools/ssd.mjs
@@ -30,6 +30,9 @@ function minimizeAllWindows() {
 async function takeScreenshot(filename) {
  const workspace = process.env.GITHUB_WORKSPACE || process.cwd();
  const fullPath = path.join(workspace, filename);
+  
+  // Create a temporary script file path
+  const scriptPath = path.join(workspace, `screenshot_${Date.now()}.ps1`);

  const psScript = `
    Add-Type -AssemblyName System.Windows.Forms;
@@ -44,47 +47,101 @@ async function takeScreenshot(filename) {
    $bitmap = New-Object System.Drawing.Bitmap $Screen.Width, $Screen.Height;
    $graphic = [System.Drawing.Graphics]::FromImage($bitmap);
    $graphic.CopyFromScreen($Screen.Left, $Screen.Top, 0, 0, $bitmap.Size);
+    
+    # Save the file (using single quotes safely now)
    $bitmap.Save('${fullPath}');
+    Write-Output "Wrote ${fullPath}";
+    
+    # Specify ItemType to prevent older PS versions from prompting interactively
+    New-Item -Path "${fullPath}.written" -ItemType File | Out-Null;
  `;
  
  try {
-    execSync(`powershell -Command "${psScript}"`);
+    // 1. Write the script to disk
+    fs.writeFileSync(scriptPath, psScript);
+
+    // 2. Execute the file directly, piping stdout/stderr to the Node console
+    execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File "${scriptPath}"`, { 
+        stdio: 'inherit' 
+    });
+    
    console.log(`Saved screenshot: ${fullPath}`);
  } catch (err) {
    console.error(`Failed to save screenshot ${fullPath}:`, err.message);
+  } finally {
+    // 3. Clean up the temp file so it doesn't clutter your CI artifacts
+    if (fs.existsSync(scriptPath)) {
+        fs.unlinkSync(scriptPath);
+    }
  }
 }

-// Fire and forget application launcher
+// Fire and forget application launcher with logging
 function launchSSD() {
+    const workspace = process.env.GITHUB_WORKSPACE || process.cwd();
+    const outLogPath = path.join(workspace, 'ssd_out.log');
+    const errLogPath = path.join(workspace, 'ssd_err.log');
+
+    // Open file descriptors for logging
+    const out = fs.openSync(outLogPath, 'a');
+    const err = fs.openSync(errLogPath, 'a');
+
+    console.log(`Launching SSD... Logging stdout to ${outLogPath} and stderr to ${errLogPath}`);
+
    const child = spawn('C:\\Program Files\\Certum\\SimplySign Desktop\\SimplySignDesktop.exe', [], {
-        detached: true,       
-        stdio: 'ignore'       
+        detached: true,
+        // stdio array: [stdin, stdout, stderr]
+        // We ignore stdin, and pipe stdout/stderr to our files
+        stdio: ['ignore', out, err]
    });
-    child.unref();            
+
+    // Catch immediate errors (e.g., file not found, permission denied)
+    child.on('error', (error) => {
+        console.error('Failed to spawn SimplySign Desktop:', error.message);
+    });
+
+    // Unreference the child so the parent script can exit
+    child.unref();
 }

 async function runSSD() {
-    await takeScreenshot('001.png');
-    minimizeAllWindows();
-    await sleep(2000);
-    await takeScreenshot('002.png');
-    sendKeys('{ESC}');
-    await sleep(2000);
-    await takeScreenshot('003.png');
-    //sendKeys('{ESC}');
-    //await sleep(2000);
-    //await takeScreenshot('004.png');
-    //sendKeys('{ESC}');
-    //await sleep(2000);
-    //await takeScreenshot('005.png');
-    //sendKeys('%{F4}');
-    //await sleep(2000);
-    //await takeScreenshot('006.png');
-    //sendKeys('%{F4}');
-    //await sleep(2000);
-    //await takeScreenshot('007.png');
+    const runner_arch =  process.env.RUNNER_ARCH;
+    if ( runner_arch === "ARM64" ) {
+          console.log('Running on ARM64. Tabbing through OOBE...');
+          await sleep(3000);
+          await takeScreenshot('oob1.png');
+          
+          // Page 1: Tab through the toggles to reach the "Next" button
+          for (let i = 0; i < 7; i++) {
+              sendKeys('{TAB}');
+              await sleep(200);
+          }
+          sendKeys('{ENTER}');
+          console.log('Clicked Next');
+          
+          await sleep(3000); 
+          await takeScreenshot('ooob2.png');

+          // Page 2: Tab through the remaining toggles to reach the "Accept" button
+          for (let i = 0; i < 7; i++) {
+              sendKeys('{TAB}');
+              await sleep(200);
+          }
+          sendKeys('{ENTER}');
+          console.log('Clicked Accept');
+          
+          await sleep(3000);
+          await takeScreenshot('oob3.png');
+
+           sendKeys('{ESC}');
+          console.log('Escaped start menu');
+          
+          await sleep(3000);
+          await takeScreenshot('oob4.png');
+
+        } else {
+          console.log('NOT running on ARM64');
+        }
    // Re-execute SSD to open login dialog
    launchSSD();
    await sleep(3000);
--- a/wiki/Authorization.md
+++ b/wiki/Authorization.md
@@ -315,6 +315,9 @@ You can optionally specify the type of service account key with `algorithm|local
 Use `nokey` if you do not want a service account key created for the project.

 ## Use an existing project for GAM authorization
+
+To use the same GAM project on multiple computers, see: [GAM Configuration](Multiple-Computers)
+
 Use an existing project to create and download two files: `client_secrets.json` for the Client and `oauth2service.json` for the Service Account.

 ### Default values
--- a/wiki/Basic-Items.md
+++ b/wiki/Basic-Items.md
@@ -456,9 +456,9 @@
        See: https://cloud.google.com/access-context-manager/docs/custom-access-level-spec
 <QueryContact> ::= <String>
        See: https://developers.google.com/google-apps/contacts/v3/reference#contacts-query-parameters-reference
-<QueryCrOS> ::= <String>
+<QueryCrOS> ::= <String>:<String>
        See: https://support.google.com/chrome/a/answer/1698333
-<QueryDevice> ::= <String>
+<QueryDevice> ::= <String>:<String>
        See: https://support.google.com/a/answer/7549103
 <QueryDriveFile> ::= <String>
        See: https://developers.google.com/drive/api/v3/search-files
@@ -471,7 +471,7 @@
 <QueryItem> ::= <UniqueID>|<String>
 <QueryMemberRestrictions> ::= <String>
        See: https://cloud.google.com/identity/docs/reference/rest/v1beta1/SecuritySettings#MemberRestriction
-<QueryMobile> ::= <String>
+<QueryMobile> ::= <String>:<String>
        See: https://support.google.com/a/answer/7549103
 <QueryTeamDrive> ::= <String>
        See: https://developers.google.com/drive/api/v3/search-parameters
--- a/wiki/CSV-Input-Filtering.md
+++ b/wiki/CSV-Input-Filtering.md
@@ -60,6 +60,9 @@ These filters can be used alone or in conjunction with the `matchfield|skipfield
        [(any|all):]notdata:<DataSelector>|
        [(any|all):]notregex:<RESearchPattern>|
        [(any|all):]notregexcs:<RESearchPattern>|
+        [(any|all):]number<Operator><Number>|
+        [(any|all):]numberrange!=<Number>/<Number>|
+        [(any|all):]numberrange=<Number>/<Number>|
        [(any|all):]regex:<RESearchPattern>|
        [(any|all):]regexcs:<RESearchPattern>|
        [(any|all):]text<Operator><String>|
--- a/wiki/CSV-Output-Filtering.md
+++ b/wiki/CSV-Output-Filtering.md
@@ -68,6 +68,9 @@ on all platforms.
        [(any|all):]notdata:<DataSelector>
        [(any|all):]notregex:<RESearchPattern>|
        [(any|all):]notregexcs:<RESearchPattern>|
+        [(any|all):]number<Operator><Number>|
+        [(any|all):]numberrange!=<Number>/<Number>|
+        [(any|all):]numberrange=<Number>/<Number>|
        [(any|all):]regex:<RESearchPattern>|
        [(any|all):]regexcs:<RESearchPattern>|
        [(any|all):]text<Operator><String>|
--- a/wiki/ChromeOS-Devices.md
+++ b/wiki/ChromeOS-Devices.md
@@ -68,7 +68,8 @@ gam oauth create
 
 ```
 <OrgUnitPath> ::= /|(/<String)+
-<QueryCrOS> ::= <String> See: https://support.google.com/chrome/a/answer/1698333
+<QueryCrOS> ::= <String>:<String>
+        See: https://support.google.com/chrome/a/answer/1698333
 <CommandID> ::= <String>
 <CrOSID> ::= <String>
 <CrOSIDList> ::= "<CrOSID>(,<CrOSID>)*"
@@ -409,11 +410,13 @@ gam update ou csvkmd cros.csv keyfield OU datafield deviceId add croscsvdata dev
        reenable

 gam <CrOSTypeEntity> update action <CrOSAction> [acknowledge_device_touch_requirement]
-        [actionbatchsize <Integer>]
+        [actionbatchsize <Integer>] [maxtodeprov <Integer>]
 ```
 ChromeOS devices are now processed in batches.
 The batch size defaults to 10, the `actionbatchsize <Integer>` option can be used to set a batch size between 10 and 250.

+### Deprovisioning
+
 As deprovisioning ChromeOS devices is not reversible, you must enter `acknowledge_device_touch_requirement`
 when `<CrOSAction>` is `deprovision_same_model_replace`, `deprovision_different_model_replace`,
 `deprovision_retiring_device` or `deprovision_upgrade_transfer`.
@@ -424,6 +427,20 @@ each device. Please also be aware that deprovisioning can have an effect on your

 See https://support.google.com/chrome/a/answer/3523633 for full details.

+Prior to version 7.43.05, all devices in `<CrOSEntity>` would be deprovisioned. When `<CrOSEntity>`
+was derived from an OU, this was desirable. However, if `<CrOSEntity>` was derived from a query,
+more devices than desired may have been deprovisioned. In version 7.43.05 and higher,
+GAM defaults to not deprovisioning devices if the number of devices exceeds one.
+
+The  option `max_to_deprov <Integer>` can be used to verify the number of devices to be deprovisioned;
+no deprovisions are processed if the number of devices in `<CrOSEntity>` exceeds `<Integer>`;
+the default value is one; set `<Number>` to 0 for no limit.
+
+When `<CrOSEntity>` is derived from an OU, set `max_to_deprov 0` and all devices will be deprovisioned.
+
+When `<CrOSEntity>` is derived from a query, e.g., `cros_sn <SerialNumber>`, the default `max_to_deprov 1`
+protects you from accidentally deprovisioning more devices than desired.
+
 ## Send remote commands to ChromeOS devices
 Thanks to Jay for most of the following.

--- a/wiki/Classroom-Courses.md
+++ b/wiki/Classroom-Courses.md
@@ -131,6 +131,7 @@ gam user user@domain.com check|update serviceaccount
        name|
        owneremail|
        ownerid|
+        ownername|
        room|
        section|
        teacherfolder|
@@ -431,14 +432,16 @@ gam courses <CourseEntity> update topic <CourseTopicIDEntity> <CourseTopic>

 ## Display courses
 ```
-gam info course <CourseID> [owneremail] [alias|aliases] [show all|students|teachers] [countsonly]
+gam info course <CourseID>
+        [owneremail] [ownername] [alias|aliases] [show all|students|teachers] [countsonly]
        [fields <CourseFieldNameList>] [skipfields <CourseFieldNameList>] [formatjson]
-gam info courses <CourseEntity> [owneremail] [alias|aliases] [show all|students|teachers] [countsonly]
+gam info courses <CourseEntity>
+        [owneremail] [ownername] [alias|aliases] [show all|students|teachers] [countsonly]
        [fields <CourseFieldNameList>] [skipfields <CourseFieldNameList>] [formatjson]

 gam print courses [todrive <ToDriveAttribute>*]
        (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] [states <CourseStateList>])
-        [owneremail] [owneremailmatchpattern <REMatchPattern>]
+        [owneremail] [owneremailmatchpattern <REMatchPattern>] [ownername]
        [alias|aliases|aliasesincolumns [delimiter <Character>]]
        [show all|students|teachers] [countsonly]
        [timefilter creationtime|updatetime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
@@ -471,7 +474,9 @@ To get information about courses created/updated within a particular time frame,
 For the filter to apply, `timefilter` and at least one of `start|starttime` and `end|endtime` must be specified.

 By default, all basic course fields are displayed; use the following options to modify the output.
-* `owneremail` - Display course owner email; requires an additional API call per course.
+* `owneremail` - Display course owner email.
+* `ownername` - Display course owner name.
+    * These options require an additional API call per course.
 * `alias|aliases` - Display course aliases; all aliases are in the single column `Aliases` separated by a delimiter; requires an additional API call per course.
    * `delimiter <Character>` - Delimiter between aliases with `print` command.
 * `aliasesincolumn` - Display course aliases; the `Aliases` column contains the number of aliases and `Aliases.0`, `Aliases.1`, ... contain the individual aliases; requires an additional API call per course.
@@ -525,7 +530,8 @@ gam print course-announcements [todrive <ToDriveAttribute>*]
        (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] states <CourseStateList>])
        (courseannouncementids <CourseAnnouncementIDEntity>)|(announcementstates <CourseAnnouncementStateList>)*
        (orderby <CourseAnnouncementOrderByFieldName> [ascending|descending])*)
-        [creatoremail] [fields <CourseAnnouncementFieldNameList>]
+        [showcreatoremails|creatoremail] [showcreatornames|creatorname]
+        [fields <CourseAnnouncementFieldNameList>]
        [timefilter creationtime|updatetime|scheduledtime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
        [countsonly] [formatjson [quotechar <Character>]]
 ```
@@ -553,7 +559,10 @@ To get information about course announcements created/updated/scheduled within a
 For the filter to apply, `timefilter` and at least one of `start|starttime` and `end|endtime` must be specified.

 By default, all course announcement fields are displayed; use the following options to modify the output.
-* `creatoremail` - Display course announcement creator email; requires an additional API call per course announcement.
+* `creatoremail` - Display course announcement creator email.
+* `creatorname` - Display course announcement creator name.
+    * These options require an additional API call per course.
+* `alias|aliases` - Display course aliases; all aliases are in the single column `Aliases` separated by a delimiter; requires an additional API call per course.
 * `fields <CourseAnnouncementFieldNameList>` - Select specific fields to display.

 Use the `countsonly` option to display the number of announcements in a course but not their details.
@@ -573,7 +582,8 @@ gam print course-materials [todrive <ToDriveAttribute>*]
        (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] states <CourseStateList>])
        (materialids <CourseMaterialIDEntity>)|(materialstates <CourseMaterialStateList>)*
        (orderby <CourseMaterialOrderByFieldName> [ascending|descending])*)
-        [showcreatoremails|creatoremail] [showtopicnames] [fields <CourseMaterialFieldNameList>]
+        [showcreatoremails|creatoremail] [showcreatornames|creatorname] [showtopicnames]
+        [fields <CourseMaterialFieldNameList>]
        [timefilter creationtime|updatetime|scheduledtime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
        [oneitemperrow]
        [countsonly] [formatjson [quotechar <Character>]]
@@ -602,8 +612,10 @@ By default, all published course materials for a course are displayed; use the f
 * `materialsstates <CourseMaterialsStateList>` - Display course materials with any of the specified states.

 By default, all course materials fields are displayed; use the following options to modify the output.
-* `showcreatoremails` - Display course materials creator email; requires an additional API call per course materials.
-* `showtopicnames` - Display topic names; requires and additional API call per course.
+* `showcreatoremails|creatoremail` - Display course materials creator email.
+* `showcreatornames|creatorname` - Display course materials creator name.
+    * These options require an additional API call per course.
+* `showtopicnames` - Display topic names; requires an additional API call per course.
 * `fields <CourseMaterialsFieldNameList>` - Select specific fields to display.

 With `print course-materials`, the materials selected for display are all output on one row/line as a repeating item with the other course fields.
@@ -669,7 +681,8 @@ gam print course-work [todrive <ToDriveAttribute>*]
        (course|class <CourseEntity>)*|([teacher <UserItem>] [student <UserItem>] states <CourseStateList>])
        (workids <CourseWorkIDEntity>)|(workstates <CourseWorkStateList>)*
        (orderby <CourseWorkOrderByFieldName> [ascending|descending])*)
-        [showcreatoremails] [showtopicnames] [fields <CourseWorkFieldNameList>]
+        [showcreatoremails|creatoremail] [showcreatornames|creatorname] [showtopicnames]
+        [fields <CourseWorkFieldNameList>]
        [showstudentsaslist [<Boolean>]] [delimiter <Character>]
        [timefilter creationtime|updatetime|scheduledtime] [start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>]
        [oneitemperrow]
@@ -699,8 +712,10 @@ By default, all published course work for a course is displayed; use the followi
 * `workstates <CourseWorkStateList>` - Display course work with any of the specified states.

 By default, all course work fields are displayed; use the following options to modify the output.
-* `showcreatoremails` - Display course work creator email; requires an additional API call per course work.
-* `showtopicnames` - Display topic names; requires and additional API call per course.
+* `showcreatoremails|creatoremail` - Display course materials creator email.
+* `showcreatornames|creatorname` - Display course materials creator name.
+    * These options require an additional API call per course.
+* `showtopicnames` - Display topic names; requires an additional API call per course.
 * `fields <CourseWorkFieldNameList>` - Select specific fields to display.

 By default, when course work is assigned to individual students, the student IDs are displayed in multiple indexed columns.
--- a/wiki/Cloud-Identity-Devices.md
+++ b/wiki/Cloud-Identity-Devices.md
@@ -56,7 +56,7 @@ Use this table to filter/query for specific device types:
 ```
 <AssetTag> ::= <String>
 <AssetTagList> ::= "<AssetTag>(,<AssetTag>)*"
-<QueryDevice> ::= <String>
+<QueryDevice> ::= <String>:<String>
        See: https://support.google.com/a/answer/7549103
 <QueryDeviceList> ::= "<QueryDevice>(,<QueryDevice>)*"
 <DeviceID> ::= devices/<String>
--- a/wiki/Collections-of-Users.md
+++ b/wiki/Collections-of-Users.md
@@ -3,9 +3,19 @@
 - [Notes](#notes)
 - [Definitions](#definitions)
 - [User Type Entity](#user-type-entity)
+  - [All non-archived Users](#all-non-archived-users)
+  - [All archived Users](#all-archived-Users)
  - [All non-suspended Users](#all-non-suspended-users)
  - [All suspended Users](#all-suspended-Users)
+  - [All archived or suspended Users](#all-archived-or-suspended-users)
+  - [All non-archived and non-suspended Users](#all-non-archived-and-non-suspended-users)
  - [All non-suspended and suspended Users](#all-non-suspended-and-suspended-users)
+  - [All non-suspended Guests](#all-non-suspended-guests)
+  - [All suspended Guests](#all-suspended-Guests)
+  - [All non-suspended and suspended Guests](#all-non-suspended-and-suspended-guests)
+  - [All non-suspended Users and Guests](#all-non-suspended-users-and-guests)
+  - [All suspended Users and Guests](#all-suspended-users-and-guests)
+  - [All non-suspended and suspended Users and Guests](#all-non-suspended-and-suspended-users-and-guests)
  - [A single User](#a-single-user)
  - [A list of Users](#a-list-of-users)
  - [The admin user referenced in oauth2.txt](#the-admin-user-referenced-in-oauth2txt)
@@ -40,6 +50,18 @@

 ## Notes

+The following items referencing guest users were added to  `<UserTypeEntity>` in version 7.43.00.
+```
+all_guests
+all_guests_ns
+all_guests_susp
+all_guests_ns_susp
+all_users_and_guests
+all_users_and_guests_ns
+all_users_and_guests_susp
+all_users_and_guests_ns_susp
+```
+
 The followig items referencing non-archived/archived users were added to `<UserTypeEntity>` in version 7.22.00.
 ```
 all users_na
@@ -123,6 +145,8 @@ ous_and_children_na_ns

 <UserTypeEntity> ::=
        (all users|users_na|users_arch|users_ns|users_susp|users_ns_susp|users_arch_or_susp|users_na_ns)|
+        (all guests|guests_ns|guests_susp|guests_ns_susp)|
+        (all users_and_guests|users_and_guests_ns|users_and_guests_susp|users_and_guests_ns_susp)|
        (user <UserItem>)|
        (users <UserList>)|
        (oauthuser)
@@ -232,6 +256,26 @@ Use these options to select users for GAM commands.
 ## All non-suspended and suspended Users
 * `all users_ns_susp`

+## All non-suspended Guests
+* `all guests`
+* `all guests_ns`
+
+## All suspended Guests
+* `all guests_susp`
+
+## All non-suspended and suspended Guests
+* `all guests_ns_susp`
+
+## All non-suspended Users and Guests
+* `all users_and_guests`
+* `all users_and_guests_ns`
+
+## All suspended Users and Guests
+* `all users_and_guests_susp`
+
+## All non-suspended and suspended Users and Guests
+* `all users_and_guests_ns_susp`
+
 ## A single User
 * `user <UserItem>`

--- a/wiki/Domains.md
+++ b/wiki/Domains.md
@@ -37,7 +37,7 @@ gam info domain [<DomainName>]
 gam show domains
        [formatjson]
 ```
-For `info`, if `<DomainName>` is omitted, information about the primary domain will be displayed.
+For `info`, if `<DomainName>` is omitted, customer information about the primary domain will be displayed.

 By default, Gam displays the information as an indented list of keys and values.
 * `formatjson` - Display the fields in JSON format.
--- a/wiki/GamUpdates.md
+++ b/wiki/GamUpdates.md
@@ -10,6 +10,120 @@ Add the `-s` option to the end of the above commands to suppress creating the `g

 See [Downloads-Installs-GAM7](https://github.com/GAM-team/GAM/wiki/Downloads-Installs) for Windows or other options, including manual installation

+### 7.43.07
+
+Improved validation of `<QueryCrOS>`, `<QueryDevice>` and `<QueryMobile>`.
+
+### 7.43.06
+
+Updated commands that use `<QueryCrOS>`, `<QueryDevice>` or `<QueryMobile>` to validate
+that it is of the form `field:value` and that `value` does not contain a '?'.
+Without validation, Google can return many more devices than are expected.
+
+### 7.43.05
+
+Added option `matchfield attendeesorganizer <Boolean> <EmailAddressEntity>` to `<EventMatchProperty>`
+that is used in commands that process events. The match is true if all of the addresses in `<EmailAddressEntity>`
+are present as attendees in the event and are an organizer or not based on `<Boolean>`.
+
+Added option `max_to_deprov <Integer>` to `gam update cros <CrOSEntity> action <CrOSAction>`
+that is used when `<CrOSAction>` is any of the following:
+```
+deprovision_different_model_replace|
+deprovision_different_model_replacement|
+deprovision_retiring_device|
+deprovision_same_model_replace|
+deprovision_same_model_replacement|
+deprovision_upgrade_transfer
+```
+`max_to_deprov <Integer>` - No deprovisions are processed if the number of devices in `<CrOSEntity>` exceeds `<Integer>`;
+the default value is one; set `<Integer>` to 0 for no limit.
+
+### 7.43.04
+
+Added option `include_suspended_zeros [<Boolean>]` to `gam print vaultcounts` that causes
+GAM to generate zero count lines for suspended users with zero items as well as non-suspended users.
+
+### 7.43.03
+
+Added option `parentpathonly [<Boolean>]` to the following commands that causes GAM
+to display only the parent folder names when displaying the path to a file.
+```
+gam <UserTypeEntity> info drivefile ... filepath|fullpath
+gam <UserTypeEntity> show fileinfo ... filepath|fullpath
+gam <UserTypeEntity> print|show filepath
+gam <UserTypeEntity> print filelist ... filepath|fullpath
+```
+
+### 7.43.02
+
+Added option `maxactivities <Integer>` to `gam <UserTypeEntity> print driveactivity` to limit
+the number of activities displayed; the default is 0, no limit.
+
+### 7.43.01
+
+Updated `gam info user` and `gam print users` to display guest user attributes: `isGuestUser, guestAccountInfo`
+
+Expanded `<UserTypeEntity>` to allow specification of guest users.
+  * See [Collections of Users](Collections-of-Users)
+
+### 7.42.00
+
+In versions prior to 7.42.00, when `redirect csv <FileName>` was used, GAM did not open and write `<FileName>`
+until all processing was complete; if `<FileName>` was not accessible, an error was generated
+and no results were saved. Now, `<FileName>` is opened initially to verify accessiblity
+and then written when processing is complete.
+
+In the unlikely event that this causes issues, you can do `redirect csv <FileName> delayopen`
+to get the previous behavior.
+
+### 7.41.03
+
+Fixed bug in the following:
+Added the following to `<RowValueFilter>` used in CSV input/output row filtering; these are
+synonyms for `count` and `countrange`.
+```
+[(any|all):]number<Operator><Number>|
+[(any|all):]numberrange!=<Number>/<Number>|
+[(any|all):]numberrange=<Number>/<Number>|
+```
+
+### 7.41.02
+
+Added option `ownername` to `gam info|print courses` to have GAM display the course owners full name;
+there is an extra API call per course to get the name.
+
+Added option `creatorname` to `gam print course-announcements|course-materials|course-works` to have
+GAM display the item creators full name; there is an extra API call per course to get the name.
+
+After creating a group, it may be sometime, e.g. 30-45 seconds, before members can
+successfully be added to the group even though the API reported that the group was created.
+The following options can be used with `gam create group` to verify that the group is actually ready to be updated.
+This will be most useful in scripts that are used to create and then populate groups.
+```
+verifycreationretries <Integer> - Verify group creation, defaults to 0, no verification performed, range 0-20
+verifycreationinitialdelay <Integer> - Number of seconds to delay before first verification performed, defaults to 5, range 0-60
+verifycreationretrydelay <Integer> - Number of seconds to delay between verificaton retries, defaults to 5, range 1-60
+```
+
+If you have a script that deletes a group and then immediately tries to create a new group with the same email address,
+you may run into issues. There seems to be a 30-45 second window after the deletion in which a couple
+of strange errors can occur on the creation: `Resource not found` and `Duplicate`.
+The following options can be used with `gam create group` to handle these errors. This will be most useful
+in scripts that are used to delete and then immediately recreate groups.
+```
+recentdeleteretries <Integer> - Handle group delete/create errors, defaults to 0, no errors handled, range 0-20
+recentdeleteretrydelay <Integer> - Number of seconds to delay between retries, defaults to 5, range 1-60
+```
+
+Added the following to `<RowValueFilter>` used in CSV input/output row filtering; these are
+synonyms for `count` and `countrange`.
+```
+[(any|all):]number<Operator><Number>|
+[(any|all):]numberrange!=<Number>/<Number>|
+[(any|all):]numberrange=<Number>/<Number>|
+```
+
 ### 7.41.01

 Fixed bug in `gam print cigroups members managers owners countsonly totalcount internal external` that caused a trap.
--- a/wiki/Groups.md
+++ b/wiki/Groups.md
@@ -7,6 +7,8 @@
 - [GUI API Group access type settings mapping](#gui-api-group-access-type-settings-mapping)
 - [whoCanViewMembership and whoCanDiscoverGroup interactions](#whocanviewmembership-and-whocandiscovergroup-interactions)
 - [Manage groups](#manage-groups)
+- [Handle group deletion and immediate recreation](#handle-group-deletion-and-immediate-recreation)
+- [Verify group creation](#verify-group-creation)
 - [Update a group's primary email address](#update-a-groups-primary-email-address)
 - [Update a group's settings with JSON data](#update-a-groups-settings-with-json-data)
 - [Display information about specific groups](#display-information-about-specific-groups)
@@ -350,6 +352,8 @@ These commands allow you to create, update and delete groups.
 gam create group <EmailAddress>
        [copyfrom <GroupItem>] <GroupAttribute>*
        [verifynotinvitable]
+        [recentdeleteretries <Integer>] [recentdeleteretrydelay <Integer>]
+        [verifycreationretries <Integer>] [verifycreationinitialdelay <Integer>] [verifycreationretrydelay <Integer>]
 gam update group|groups <GroupEntity> [email <EmailAddress>]
        [updateprimaryemail <RESearchPattern> <RESubstitution> [preview]]
        [copyfrom <GroupItem>] <GroupAttribute>*
@@ -367,6 +371,28 @@ You can update a group to a security group with the `makesecuritygroup` option.

 When deleting and `noactionifalias` is specified, no action is performed if `<GroupEntity>` specifies an alias rather than a primary email address.

+## Handle group deletion and immediate recreation
+If you have a script that deletes a group and then immediately tries to create a new group with the same email address,
+you may run into issues. There seems to be a 30-45 second window after the deletion in which a couple
+of strange errors can occur on the creation: `Resource not found` and `Duplicate`.
+The following options can be used with `gam create group` to handle these errors. This will be most useful
+in scripts that are used to delete and then immediately  recreate groups.
+```
+recentdeleteretries <Integer> - Handle group delete/create errors, defaults to 0, no errors handled, range 0-20
+recentdeleteretrydelay <Integer> - Number of seconds to delay between retries, defaults to 5, range 1-60
+```
+
+## Verify group creation
+After creating a group, it may be sometime, e.g. 30-45 seconds, before members can
+successfully be added to the group even though the API reported that the group was created.
+The following options can be used with `gam create group` to verify that the group is actually ready to be updated.
+This will be most useful in scripts that are used to create and then populate groups.
+```
+verifycreationretries <Integer> - Verify group creation, defaults to 0, no verification performed, range 0-20
+verifycreationinitialdelay <Integer> - Number of seconds to delay before first verification performed, defaults to 5, range 0-60
+verifycreationretrydelay <Integer> - Number of seconds to delay between verificaton retries, defaults to 5, range 1-60
+```
+
 ## Update a group's primary email address
 You can simply update a group's primary email address with the `email` option.
 ```
--- a/wiki/How-to-Upgrade-Legacy-GAM-to-GAM7.md
+++ b/wiki/How-to-Upgrade-Legacy-GAM-to-GAM7.md
@@ -251,7 +251,7 @@ writes the credentials into the file oauth2.txt.
 ```
 gamteam@server:/Users/gamteam$ rm -f /Users/gamteam/GAMConfig/oauth2.txt
 gamteam@server:/Users/gamteam$ gam version
-GAM 7.41.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.43.07 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.14.4 64-bit final
 macOS Tahoe 26.4.1 arm64
@@ -1034,7 +1034,7 @@ writes the credentials into the file oauth2.txt.
 ```
 C:\>del C:\GAMConfig\oauth2.txt
 C:\>gam version
-GAM 7.41.01 - https://github.com/GAM-team/GAM - pythonsource
+GAM 7.43.07 - https://github.com/GAM-team/GAM - pythonsource
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.14.4 64-bit final
 Windows 11 10.0.26200 AMD64
--- a/wiki/Meta-Commands-and-File-Redirection.md
+++ b/wiki/Meta-Commands-and-File-Redirection.md
@@ -119,7 +119,7 @@ You can redirect CSV file output and stdout/stderr output to files. By using red
 You can redirect stdout and stderr to null and stderr can be redirected to stdout.
 ```
 <Redirect> ::=
-        redirect csv <FileName> [multiprocess] [append] [noheader] [charset <Charset>]
+        redirect csv <FileName> [delayopen] [multiprocess] [append] [noheader] [charset <Charset>]
                     [columndelimiter <Character>] [quotechar <Character>] [noescapechar [<Boolean>]]
                     [sortheaders <StringList>] [timestampcolumn <String>] [transpose [<Boolean>]]
                     [todrive <ToDriveAttribute>*] |
@@ -129,12 +129,20 @@ You can redirect stdout and stderr to null and stderr can be redirected to stdou
        redirect stderr null [multiprocess] |
        redirect stderr stdout [multiprocess]
 ```
-For `redirect`, the optional subarguments must appear in the order shown.
+In versions prior to 7.42.00`, the `redirect csv` optional subarguments had to be specified in the order shown.
+Now the arguments can be specified in any order except that `todrive <ToDriveAttribute>*` must still be last.

 If `<FileName>` specifies a relative path, the file will be put in the directory specified by `drive_dir` in gam.cfg.
 If `<FileName>` specifies an absolute path, the file will be put in the directory specified.
 Specify `./<FileName>` to put the file in your current working directory.

+In versions prior to 7.42.00, when `redirect csv <FileName>` was used, GAM did not open and write `<FileName>`
+until all processing was complete; if `<FileName>` was not accessible, an error was generated and no results were saved.
+Now, `<FileName>` is opened initially to verify accessiblity and then written when processing is complete.
+
+In the unlikely event that this causes issues, you can do `redirect csv <FileName> delayopen`
+to get the previous behavior.
+
 The `multiprocess` subargument allows the multiple subprocesses started by `gam csv` to write intelligently
 to a single redirected CSV/stdout/stderr file. If you don't specify `multiprocess`, each subprocess
 writes `<FileName>` independently; you end up with a single file written by the last subprocess.
--- a/wiki/Mobile-Devices.md
+++ b/wiki/Mobile-Devices.md
@@ -16,7 +16,7 @@

 ## Definitions
 ```
-<QueryMobile> ::= <String>
+<QueryMobile> ::= <String>:<String>
        See: https://support.google.com/a/answer/7549103
 <QueryMobileList> ::= "<QueryMobile>(,<QueryMobile>)*"
 <ResourceID> ::= <String>
--- a/wiki/Users-Calendars-Events.md
+++ b/wiki/Users-Calendars-Events.md
@@ -277,6 +277,7 @@

 <EventMatchProperty> ::=
        (matchfield attendees <EmailAddressEntity>)|
+        (matchfield attendeesorganizer <Boolean> <EmailAddressEntity>)|
        (matchfield attendeesonlydomainlist <DomainNameList>)|
        (matchfield attendeesdomainlist <DomainNameList>)|
        (matchfield attendeesnotdomainlist <DomainNameList>)|
@@ -460,8 +461,11 @@ The Google Calendar API processes `<EventSelectProperty>*`; you may specify none
 * `singleevents` - Whether to expand recurring events into instances and only return single one-off events and instances of recurring events, but not the underlying recurring events themselves
 * `updatedmin <Time>` - Lower bound for an event's last modification time (as a RFC3339 timestamp) to filter by. When specified, entries deleted since this time will always be included regardless of showdeletedevents

-GAM processes `<EventMatchProperty>*`; you may specify none or multiple properties.
-* `matchfield attendees <EmailAddressEntity>` - All of the attendees in `<EmailAddressEntity>` must be present
+GAM processes `<EventMatchProperty>*`
+; you may specify none or multiple properties.
+* `matchfield attendees <EmailAddressEntity>` - All of the addresses in `<EmailAddressEntity>` must be present as attendees
+* `matchfield attendeesorganizer <Boolean> <EmailAddressEntity>` - All of the addressed  in `<EmailAddressEntity>` must be present
+  as attendees and are an organizer or not based on `<Boolean>`
 * `matchfield attendeesonlydomainlist <DomainNameList>` - All attendee's email addresses must be in a domain in `<DomainNameList>`
  * For example, this lets you look for events with all attendees in your internal domains. You should include `resource.calendar.google.com`
    in `<DomainNameList>` if the events use resources.
--- a/wiki/Users-Drive-Activity-Settings.md
+++ b/wiki/Users-Drive-Activity-Settings.md
@@ -72,7 +72,7 @@ gam <UserTypeEntity> print driveactivity [todrive <ToDriveAttributes>*]
         (query <QueryDriveFile>)]
        [([start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>])|(range <Date>|<Time> <Date)|<Time>|
         yesterday|today|thismonth|(previousmonths <Integer>)]
-        [action|actions [not] <DriveActivityActionList>]
+        [action|actions [not] <DriveActivityActionList>] [maxactivities <Number>]
        [consolidationstrategy legacy|none]
        [idmapfile <FileName>|(gsheet <UserGoogleSheet>) [charset <String>] [columndelimiter <Character>] [noescapechar <Boolean>]  [quotechar <Character>]]
        [stripcrsfromname] [formatjson [quotechar <Character>]]
@@ -99,6 +99,8 @@ Google does the filtering.
 * `action|actions <DriveActivityActionList>` - Only display activities with the specified actions; by default, all actions are displayed
 * `action|actions not <DriveActivityActionList>` - Only display activities without the specified actions; by default, all actions are displayed

+You can limit the number of activities displayed with the `maxactivities <Number>; the default is 0, no limit.
+
 The API only returns a permissionId and user name for each event but no user email address. To get an email address perform the
 following command to generate a file that contains the email address and permissionId for all users. You can substitute for `all users` if desired.
 ```
--- a/wiki/Users-Drive-Copy-Move.md
+++ b/wiki/Users-Drive-Copy-Move.md
@@ -528,7 +528,7 @@ There are two methods for moving a folder from a My Drive to a Shared Drive:
 * GAM
  * The Drive API doesn't allow moving a folder from a My Drive to a Shared Drive; GAM has to recreate the folders on the Shared Drive, thus changing their IDs
  * Files are  simply moved from their existing My Drive folder to the recreated Shared Drive folder; their IDs do not change
-  * Files owmed by users outside of your domain can't be moved
+  * Files owned by users outside of your domain can't be moved

 ## Simple moves by changing parents
 Use this command in the following cases:
--- a/wiki/Users-Drive-Files-Display.md
+++ b/wiki/Users-Drive-Files-Display.md
@@ -425,7 +425,7 @@ Display file details in indented keyword: value format. The two forms are equiva
 ```
 gam <UserTypeEntity> show fileinfo <DriveFileEntity>
        [returnidonly]
-        [filepath|fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [filepath|fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
        [allfields|<DriveFieldName>*|(fields <DriveFieldNameList>)]
        (orderby <DriveFileOrderByFieldName> [ascending|descending])*
        [showdrivename] [showshareddrivepermissions]
@@ -436,7 +436,7 @@ gam <UserTypeEntity> show fileinfo <DriveFileEntity>
        [formatjson]
 gam <UserTypeEntity> info drivefile <DriveFileEntity>
        [returnidonly]
-        [filepath|fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [filepath|fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
        [allfields|<DriveFieldName>*|(fields <DriveFieldNameList>)]
        (orderby <DriveFileOrderByFieldName> [ascending|descending])*
        [showdrivename] [showshareddrivepermissions]
@@ -455,6 +455,7 @@ Use `fullpath` to add additional path information indicating that a file is an O
 By default, the path to a file includes the file name as the last element of the path.
 Use `folderpathonly` to display only the folder names when displaying the path to a file. This folder only path
 an be used in  `gam <UserTypeEntity> create drivefolderpath` to recreate the folder hierarchy.
+Use `parentpathonly` to display only the parent folder names when displaying the path to a file.

 By default, file path components are separated by `/`; use `pathdelimiter <Character>` to use `<Character>` as the separator.

@@ -517,12 +518,12 @@ gam <UserTypeEntity> show filepath <DriveFileEntity>
        [returnpathonly]
        (orderby <DriveFileOrderByFieldName> [ascending|descending])*
        [stripcrsfromname]
-        [folderpathonly [<Boolean>]] [fullpath] [pathdelimiter <Character>]
+        [folderpathonly|parentpathonly [<Boolean>]] [fullpath] [pathdelimiter <Character>]
        [followshortcuts [<Boolean>]]
 gam <UserTypeEntity> print filepath <DriveFileEntity> [todrive <ToDriveAttribute>*]
        (orderby <DriveFileOrderByFieldName> [ascending|descending])*
        [stripcrsfromname] [oneitemperrow]
-        [fullpath] [folderpathonly [<Boolean>]] [pathdelimiter <Character>]
+        [fullpath] [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>]
        [followshortcuts [<Boolean>]]
 ```
 Use `returnpathonly` to display just the file path of the files in `<DriveFileEntity>`.
@@ -532,6 +533,7 @@ Use `fullpath` to add additional path information indicating that a file is an O
 By default, the path to a file includes the file name as the last element of the path.
 Use `folderpathonly` to display only the folder names when displaying the path to a file. This folder only path
 an be used in  `gam <UserTypeEntity> create drivefolderpath` to recreate the folder hierarchy.
+Use `parentpathonly` to display only the parent folder names when displaying the path to a file.

 By default, file path components are separated by `/`; use `pathdelimiter <Character>` to use `<Character>` as the separator.

@@ -1106,7 +1108,7 @@ gam <UserTypeEntity> print|show filelist [todrive <ToDriveAttribute>*]
        [countsonly [summary none|only|plus] [summaryuser <String>]
                    [showsource] [showsize] [showsizeunits] [showmimetypesize]]
        [countsrowfilter]
-        [filepath|fullpath [folderpathonly [<Boolean>]] [pathdelimiter <Character>] [addpathstojson] [showdepth]] [buildtree]
+        [filepath|fullpath [folderpathonly|parentpathonly [<Boolean>]] [pathdelimiter <Character>] [addpathstojson] [showdepth]] [buildtree]
        [allfields|<DriveFieldName>*|(fields <DriveFieldNameList>)]
        [showdrivename] [showshareddrivepermissions]
        [(showlabels details|ids)|(includelabels <ClassificationLabelIDList>)]
@@ -1239,6 +1241,7 @@ JSON data rather than as additional columns
 By default, the path to a file includes the file name as the last element of the path.
 Use `folderpathonly` to display only the folder names when displaying the path to a file. This folder only path
 an be used in  `gam <UserTypeEntity> create drivefolderpath` to recreate the folder hierarchy.
+Use `parentpathonly` to display only the parent folder names when displaying the path to a file.

 By default, file path components are separated by `/`; use `pathdelimiter <Character>` to use `<Character>` as the separator.

--- a/wiki/Users-Meet.md
+++ b/wiki/Users-Meet.md
@@ -91,8 +91,8 @@ gam <UserItem> show meetconferences
        [formatjson]
 ```
 By default, conferences are shown for all of a user's meet spaces. To limit the display use:
-  * `space <MeetSpaceName>` - Display conferences for a specifc space by giving its name
-  * `code <String>` - Display conferences for a specifc space by giving its code
+  * `space <MeetSpaceName>` - Display conferences for a specific space by giving its name
+  * `code <String>` - Display conferences for a specific space by giving its code
  
 By default, Gam displays the information about the meet conferences as an indented list of keys and values.
 * `formatjson` - Display the fields in JSON format.
@@ -103,8 +103,8 @@ gam <UserItem> print meetconferences [todrive <ToDriveAttribute>*]
        [formatjson [quotechar <Character>]]
 ```
 By default, conferences are shown for all of a user's meet spaces. To limit the display use:
-  * `space <MeetSpaceName>` - Display conferences for a specifc space by giving its name
-  * `code <String>` - Display conferences for a specifc space by giving its code
+  * `space <MeetSpaceName>` - Display conferences for a specific space by giving its name
+  * `code <String>` - Display conferences for a specific space by giving its code
  
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
 * `formatjson` - Display the fields in JSON format.
--- a/wiki/Vault-Takeout.md
+++ b/wiki/Vault-Takeout.md
@@ -257,11 +257,17 @@ gam print vaultcounts [todrive <ToDriveAttributes>*]
        [excludedrafts <Boolean>]
        [<JSONData>]
        [wait <Integer>]
+        [include_suspended_zeros [<Boolean>]]
 ```
 Specify the search method, this is optional:
 * `accounts <EmailAddressEntity>` - Search all accounts specified in `<EmailAddressEntity>`
 * `orgunit|org|ou <OrgUnitPath>` - Search all accounts in the OU `<OrgUnitPath>`
-* `everyone|entireorg` - Search for all accounts in the organization
+* `everyone|entireorg` - Search all accounts in the organization
+
+By default, the Vault API doesn't return accounts with zero items; GAM
+generates a zero count line for non-suspended accounts with zero items.
+The `include_suspended_zeros` option causes GAM to generate a zero count line
+for suspended accounts with zero items.

 For `corpus mail|group`, you can specify search terms to limit the search.
 * `terms <String>` - [Vault search](https://support.google.com/vault/answer/2474474)
--- a/wiki/Version-and-Help.md
+++ b/wiki/Version-and-Help.md
@@ -3,7 +3,7 @@
 Print the current version of Gam with details
 ```
 gam version
-GAM 7.41.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.43.07 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.14.4 64-bit final
 macOS Tahoe 26.4.1 arm64
@@ -15,7 +15,7 @@ Time: 2026-02-15T07:51:00-08:00
 Print the current version of Gam with details and time offset information
 ```
 gam version timeoffset
-GAM 7.41.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.43.07 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.14.4 64-bit final
 macOS Tahoe 26.4.1 arm64
@@ -27,7 +27,7 @@ Your system time differs from www.googleapis.com by less than 1 second
 Print the current version of Gam with extended details and SSL information
 ```
 gam version extended
-GAM 7.41.01 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.43.07 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.14.4 64-bit final
 macOS Tahoe 26.4.1 arm64
@@ -68,7 +68,7 @@ MacOS High Sierra 10.13.6 x86_64
 Path: /Users/gamteam/bin/gam7
 Version Check:
  Current: 5.35.08
-   Latest: 7.41.01
+   Latest: 7.43.07
 echo $?
 1
 ```
@@ -76,7 +76,7 @@ echo $?
 Print the current version number without details
 ```
 gam version simple
-7.41.01
+7.43.07
 ```
 In Linux/MacOS you can do:
 ```
@@ -86,7 +86,7 @@ echo $VER
 Print the current version of Gam and address of this Wiki
 ```
 gam help
-GAM 7.41.01 - https://github.com/GAM-team/GAM
+GAM 7.43.07 - https://github.com/GAM-team/GAM
 GAM Team <google-apps-manager@googlegroups.com>
 Python 3.14.4 64-bit final
 macOS Tahoe 26.4.1 arm64