[DeterminedExecution]

• 825 new cmdlets cover the REST areas. Existing cmdlets only gain parameter sets or parameters; existing parameters keep their names, positions, Mandatory and aliases. No breaking changes: Get-TssSecretPasswordStatus now reads the published route with the same parameters and output (CHANGELOG General Updates). The New-TssSession Platform login changes are split out of this PR.
• REST coverage goes from 228 to 1,151 of 1,327 verb+route rows (86.7 percent). Exported commands go from 262 to 1,087.
• Every new cmdlet has full help, a doc page and a Pester shape test (29,794 passing, 0 failing). Live checks on on-prem and cloud had 0 failures. Start-TssUpgrade was dropped: on a multi-node farm its wait could end on another node's status.
• Test-TssPlatformIntegration and Get-TssPlatformCompatibilityLevel stay in this PR. Small fixes to existing cmdlets are under Bug Fixes in the CHANGELOG.

Review changes

Your 2026-10-19 review, one commit per finding (69c4d8f to 766602b):

• Platform sign-in for New-TssSession moved to its own branch (1a714f2). Its PR follows once the live test is done.
• 1. Dropped New-TssActiveDirectoryDomain, Search-TssActiveDirectoryDomain and Start-TssActiveDirectorySync. The six new Directory cmdlets now use the DirectoryService noun (Get-/Set-TssDirectoryServiceConfiguration, Get-TssDirectoryServiceConfigurationAudit, Get-TssDirectoryServiceDomainStub, Search-TssDirectoryServiceSyncLog, Set-TssDirectoryServiceDomain), and class DirectoryDomain is now DirectoryServiceDomain. The legacy routes moved into existing cmdlets: Search-TssDirectoryServiceDomain -SearchText (GET active-directory/domains, fills DistinguishedName and SiteId; the default set returns both empty) and Start-TssDirectoryServiceSync -PassThru.
• 2. New/Update/Remove-TssAdvancedConfigurationSetting show your warning text, ask to continue, then ShouldProcess. -Force skips the prompts; -WhatIf sends nothing.
• 3. Set-TssDatabaseConfiguration warns the change is per web node and the session must point at that node.
• 4. Set-TssPlatformConfiguration, Set-TssPlatformUserMapping, Reset-TssPlatformUserMapping, Enable-TssUnifiedMode and Set-TssUnifiedModeStatus warn the change can cut off Platform access. Invoke-TssPlatformProvision dropped.
• 5. Start-TssSecretKeyRotation, Stop-TssSecretKeyRotation, Start-TssMekRotation, Restart-TssMekRotation and Update-TssKeyManagement warn a bad or interrupted change can leave secrets unreadable.
• 6. Dropped the 9 PBA cmdlets (PBA is deprecated).
• 7. Anchored the 20 v1 to v2/v3 ApiUrl rewrites to the end of the URL. tests/Module.ApiUrlRewrite.Tests.ps1 fails on a new unanchored ApiUrl -replace with a literal pattern, except in Search-TssConfigurationBackupLog and Search-TssSystemLog (pre-existing). It does not check .Replace() calls.
• 8. Get-TssSecretPasswordStatus reads only the published route GET v1/secrets/secret-detail/{id}/password-status. -RestApi and the internal route are gone. Parameters and output match 0.62.1.

The 14 guarded cmdlets share one private helper, Confirm-TssDangerousOperation. Each has Pester tests for -Force, -WhatIf, the prompt, and nothing sent without -Force. The guard, -SearchText and -PassThru have Pester coverage only, no live runs yet.

Added after review

• abd9dd3 docs: the CHANGELOG 0.63.0 section opens with General Updates, led by the Search-TssDirectoryServiceDomain output change. Get-TssSecretPasswordStatus moved there from Breaking Changes, since its parameters and output are unchanged.
• f57c3d5 fix (Module import is about 3.5x slower in 0.63.0-alpha1 (30 s vs 8 s) #486): the release ships one psm1 with every function inlined instead of dot-sourcing 1,084 files at import. Cold import drops from about 26 s to about 1.1 s with the same 1,087 commands and parameter signatures. build.functions.ps1 adds Merge-ModuleFunction, which build.ps1 and build-release-only.ps1 call while staging. It fails the build if a function file would behave differently once inlined. tests/Module.FunctionInlining.Tests.ps1 adds 10 tests. Error positions now point at the psm1, and a #region functions/ marker names the source file.

Per area

Live cells = cmdlet x target (12.3 on-prem, Secret Server Cloud, Platform-connected vault). 62 not-applicable cells not counted.

Area	Wave	Scope	New cmdlets	Extended	Live PASS	OWED	FAIL
auth	1	Platform integration probes	2	0	6	0	0
area-1	1	Unlimited admin	2	0	6	0	0
area-2	1	Custom lists	3	0	9	0	0
area-3	1	Reports	17	2	60	0	0
area-4	1	Proxy core	23	0	59	10	0
area-5	1	Template editing, MUST	24	2	78	0	0
area-6	1	Upgrade	15	0	4	11	0
area-7	1	Template editing, FULL	14	0	42	0	0
area-8	2	SSH adjuncts	33	0	73	26	0
w2-secrets	2	Secrets	27	1	70	14	0
w2-secrets-2	2	Secrets	23	2	61	14	0
w2-users	2	Users	25	3	68	16	0
w2-teams	2	Teams	14	0	42	0	0
w2-groups	2	Groups	12	0	36	0	0
w2-roles	2	Roles	10	0	30	0	0
w2-folders	2	Folders	6	0	18	0	0
w2-permissions	2	Secret / folder permissions	6	0	16	2	0
w2-rpc	2	RPC / dependencies	17	0	44	7	0
w2-rpc-2	2	RPC / dependencies	14	2	42	3	0
w2-heartbeat	2	Heartbeat	3	0	5	2	0
w2-engines	2	Distributed engines / sites / nodes	17	0	27	12	0
w2-launchers	2	Launchers config	26	0	64	14	0
w2-event-pipelines	2	Event pipelines	27	1	84	0	0
w2-password-reqs	2	Password reqs / char sets	11	0	33	0	0
w2-secret-policies	2	Secret policies	2	0	6	0	0
w2-metadata	2	Metadata	4	1	24	0	0
w2-ip-restrictions	2	IP restrictions	3	0	8	1	0
w2-scripts	2	Scripts	8	0	24	0	0
w3-config	3	Config / settings (other)	24	1	64	3	0
w3-config-2	3	Config / settings (other)	26	0	54	14	0
w3-config-3	3	Config / settings (other)	26	0	67	11	0
w3-discovery	3	Discovery	24	0	47	25	0
w3-discovery-2	3	Discovery	27	0	55	26	0
w3-discovery-3	3	Discovery	26	1	81	3	0
w3-inbox	3	Inbox / notifications / subscriptions	25	0	75	0	0
w3-inbox-2	3	Inbox / notifications / subscriptions	24	0	71	1	0
w3-platform-admin	3	Platform admin / migration	22	0	33	33	0
w3-platform-admin-2	3	Platform admin / migration	23	0	33	36	0
w3-external-vaults	3	External vaults / DSV	18	0	48	6	0
w3-external-vaults-2	3	External vaults / DSV	17	0	45	6	0
w3-access-requests	3	Access requests / workflows / dual control	30	0	64	26	0
w3-auth-clients	3	Auth / SDK / app clients / tokens	24	0	70	2	0
w3-diagnostics	3	Diagnostics / logs / audits	20	0	22	38	0
w3-session-recording	3	Session recording	19	0	30	27	0
w3-directory-services	3	Directory services	13	2	37	2	0
w3-dr	3	DR / replication	11	0	25	8	0
w3-key-management	3	Key management / HSM	8	0	15	9	0
w3-dashboard	3	Dashboard	10	0	30	0	0
w3-ticket-systems	3	Ticket systems	8	0	24	0	0
w3-licenses	3	Licenses	1	0	3	0	0
w3-bulk-ops	3	Bulk operations	11	0	29	4	0
Total			825	18	2061	412	0

OWED 412: no test environment, license, server-wide state with no safe undo, cloud-only, sign-in or account step declined, other. The 13 removed cmdlets (9 PBA, 3 ActiveDirectory, Invoke-TssPlatformProvision) are not in the counts.
Start-TssUpgrade (area-6) was dropped after QA (multi-node wait defect) and is not counted.

Backward compatibility

• Existing parameters keep their names, positions, Mandatory and aliases. 9 cmdlets now name their default set where 0.62.1 had none (Search-TssDirectoryServiceDomain, Get-TssDiscoveryStatus, Search-TssEventPipeline, Export-TssReport, Add-TssSecretTemplateField, Get-TssSecretState, Get-TssUserAudit, Get-TssUserOwner, Lock-TssUser), and 3 declare an extra OutputType for the new switch (Get-TssSecretTemplate, Search-TssEventPipeline, Start-TssDirectoryServiceSync). Shape tests pin positions and Mandatory. Get-TssSecretPasswordStatus keeps its parameters and output but now calls the published route. Search-TssDirectoryServiceDomain output (DomainSummary) gains DistinguishedName and SiteId in every parameter set; the default set returns them empty, so scripts that export or compare whole objects see two new columns.
• Name collisions extend the existing cmdlet additively (new parameter set or new parameter). Each needs your approval:

Existing cmdlet	Wave	Addition
Get-TssSecretTemplate	1	-Detail switch (v2 route)
Add-TssSecretTemplateField	1	Name set (posts a new field)
Export-TssReport	1	download set (CSV)
Get-TssSecretAttachment	2	outfile set
Get-TssSecretField	2	checkout set
Get-TssSecretState	2	flags and flagsV2 sets
Lock-TssUser	2	lockout set
Get-TssUserAudit	2	action set
Get-TssUserOwner	2	owner set
Get-TssSecretPasswordStatus	2	none: reads the published route instead of the internal one (CHANGELOG General Updates)
Search-TssEventPipeline	2	detailed set (-Detailed)
New-TssMetadataField	2	field set
New-TssScript	2	none: not changed on the branch
Search-TssAutoExportStorage	3	-ConfigurationId
Get-TssDiscoveryStatus	3	scanResults, itemMetrics and osMetrics sets
Search-TssDirectoryServiceDomain	3	searchText set (GET active-directory/domains)
Start-TssDirectoryServiceSync	3	-PassThru switch

• Other existing cmdlets touched: Get-TssReportCategory and New-TssSecretDependency (fixes, see CHANGELOG Bug Fixes).

Coverage

Metric	Before (0f6cc71)	After (766602b)
Verb+route rows covered	228/1327 (17.2%)	1151/1327 (86.7%)
Exported commands	262 (259 functions + 3 cmdlets)	1087 (1084 functions + 3 cmdlets)
Pester	5222 passed, 0 failed	29794 passed, 0 failed

Evidence

Scrubbed excerpts from the live QA runs on 12.3 on-prem. <ss-url> = the instance, ids replaced.

Search-TssInboxMessage (inbox): only type 9 returned, equal to raw REST; same on Secret Server Cloud and a Platform vault.

PS> Search-TssInboxMessage -TssSession $session -MessageTypeId 9 -Verbose
VERBOSE: Performing the operation GET <ss-url>/api/v1/inbox/messages/9?take=2147483647

Search-TssUserTeam (users): equal to raw REST; -IncludeGroupMemberships adds the team held through a group.

PS> Search-TssUserTeam -TssSession $session -Id <user-id> -Verbose
VERBOSE: Performing the operation GET <ss-url>/api/v1/users/<user-id>/teams?take=2147483647

Set-TssDirectoryConfiguration (directory services, now Set-TssDirectoryServiceConfiguration): no request sent, stored config unchanged.

PS> Set-TssDirectoryConfiguration -TssSession $session -DaysToKeepOperationalLogs 99 -EnableDirectorySynchronization:$false -WhatIf
What if: Performing the operation "PATCH <ss-url>/api/v1/directory-services/configuration with: { "data": { "daysToKeepOperationalLogs": { "value": 99, "dirty": true }, "enableDirectorySynchronization": { "value": false, "dirty": true } } } " on target "Directory configuration".

Install-TssUpgrade (upgrade): no request sent, request body kept out of the What if text.

PS> Install-TssUpgrade -TssSession $session -ImpersonationCredential $cred -WhatIf
What if: Performing the operation "POST <ss-url>/api/v1/upgrade/install (request body not shown: it carries sensitive values)" on target "Upgrade".

Closes #486
Refs #481

-- Claude Code

[jagger]

Request: split the Platform authentication commit into its own PR

Could you move 7a999c8b ("feat: add Delinea Platform authentication to New-TssSession") into a separate PR against dev, and drop it from this one?

Why

Platform sign-in is the foundation for Platform support, and it needs to be reviewed and live-tested on its own before the REST coverage builds on it. For v1 of Platform support we need service-user and interactive-user sign-in to work reliably, plus token refresh and unification detection (see #481). That's easier to get right in a small PR than inside a 3,652-file one.

It splits cleanly

• 7a999c8b is the first commit on the branch and is self-contained: 27 files covering New-TssSession, Close-TssSession, Session.cs, PlatformVaultTrust.ps1, the verbose redaction in GetTssInvocationCmdlet.cs, Get-TssPlatformVault, Test-TssPlatformIntegration, Get-TssPlatformCompatibilityLevel, their classes, docs and tests.
• Nothing else in this PR reads the new session properties or calls Get-TssPlatformVault / PlatformVaultTrust.
• The only later commit that touches those files is ec1e3420, which adds one line to docs/commands/platform/readme.md.
• git cherry-pick 7a999c8b onto current dev applies with no conflicts.

What the new PR needs on top of the commit

1. FunctionsToExport entries for the three new functions (the manifest is regenerated later in 5c95468a).
2. A CHANGELOG entry (the 0.63.0 entry lives in ec1e3420).
3. Get-TssPlatformConfiguration and its PlatformConfiguration class from 6f369e03, since unification detection builds on /api/v1/configuration/platform (details in FR: warn when cmdlets are impacted by Platform unification on platform-connected SaaS tenants (users, groups, roles, secret/folder ACLs) #481).

Order

Merge the authentication PR first, then rebase this PR onto it with 7a999c8b dropped. The Platform-vault live QA here ran on Platform sessions, so it depends on that code.

Items for the authentication PR

• Service user: live test with a real service user, on Secret Server Cloud and on an on-prem vault behind Platform (-AllowedVaultHost), including the failure paths.
• Interactive user sign-in: not in the current commit. Needed for v1, ideally a browser sign-in that also covers federated users and MFA.
• Token refresh: today only a service user with -AutoRefresh can refresh, and only when the script calls SessionRefresh(). v1 should refresh in the request path. -AccessToken with a non-JWT token leaves TimeOfDeath unset, so the TTL checks are wrong. Close-TssSession doesn't revoke the token.
• Unification detection: see FR: warn when cmdlets are impacted by Platform unification on platform-connected SaaS tenants (users, groups, roles, secret/folder ACLs) #481.
• Review notes on the current New-TssSession code:
  • The required Get-TssVersion call for Platform sessions runs before $tss_ignoreversioncheck is checked, so a vault with version numbers hidden could fail session creation outright.
  • VaultId and VaultType stay empty when -SecretServer is passed.
  • -Credential -SecretServer never calls the vault broker, so nothing confirms the vault belongs to that tenant until Get-TssVersion succeeds.
  • devsecretservercloud.com ships in the vault trust list; is that intended?

[jagger]

Review findings

These are on top of the split request above. Each one is checked against the PR head (0d1f0212).

Shared pattern for dangerous operations (findings 2 to 5)

None of the cmdlets in findings 2 to 5 has a -Force parameter. Some set ConfirmImpact = 'High' and some only have the default (Medium). High alone isn't enough: -Confirm:$false or $ConfirmPreference = 'None' skips the prompt silently.

Please add one private helper (for example Confirm-TssDangerousOperation, in the style of Write-TssInternalNote) and use it in every cmdlet listed below:

[CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'High')]
param(
    # ...
    [switch] $Force
)
# ...
Write-Warning $dangerMessage
if ($Force -or $PSCmdlet.ShouldContinue($dangerMessage, 'OK to proceed?')) {
    if ($PSCmdlet.ShouldProcess($target, $action)) {
        # send the request
    }
}

• ShouldContinue always prompts, so unattended automation has to pass -Force on purpose.
• -WhatIf still works through ShouldProcess.
• Each cmdlet's help should say why it's dangerous.

1. Directory services: duplicates and naming

New-TssActiveDirectoryDomain, Search-TssActiveDirectoryDomain and Start-TssActiveDirectorySync call the legacy active-directory/* routes. The feature covers non-AD domains: the UI was renamed to Directory Services, but the API internals weren't. The module already covers these operations on the current routes:

New in this PR	Already on dev
New-TssActiveDirectoryDomain: POST active-directory/domains	New-TssDirectoryService: POST directory-services/domains
Search-TssActiveDirectoryDomain: GET active-directory/domains	Search-TssDirectoryServiceDomain: GET directory-services/domains
Start-TssActiveDirectorySync: POST active-directory/synchronize	Start-TssDirectoryServiceSync: POST directory-services/synchronization-now

Ask:

• Drop the three ActiveDirectory cmdlets. If a legacy route offers something the directory-services route doesn't, add it as a parameter set on the existing cmdlet instead.
• Use the existing singular DirectoryService noun for the new directory services cmdlets:

Current name	Rename to
Set-TssDirectoryDomain	Set-TssDirectoryServiceDomain
Get-TssDirectoryDomainStub	Get-TssDirectoryServiceDomainStub
Get-TssDirectoryConfiguration	Get-TssDirectoryServiceConfiguration
Set-TssDirectoryConfiguration	Set-TssDirectoryServiceConfiguration
Get-TssDirectoryConfigurationAudit	Get-TssDirectoryServiceConfigurationAudit
Search-TssDirectorySyncLog	Search-TssDirectoryServiceSyncLog

2. Advanced configuration settings are support-only

Cmdlets: New-, Update- and Remove-TssAdvancedConfigurationSetting. Today they have the default (Medium) confirm impact, no prompt and no -Force.

Ask: every change writes this warning, word for word, and then requires "OK to proceed" or -Force:

These settings are only to be updated by Delinea Support. Modifying them will have a major impact on Secret Server

3. Database configuration is per node

Cmdlet: Set-TssDatabaseConfiguration. It already has ConfirmImpact = 'High', but no -Force. The database configuration is a per-node setting: through a load-balanced URL the change lands on whichever node answers.

Ask:

• Warn that the change applies only to the node that receives the request, and that the session must point directly at that node.
• Use the shared pattern.
• Ideally, compare the session host with the web nodes and refuse a load-balanced address unless -Force is passed.
• The help for Get-TssDatabaseConfiguration should say the result comes from the node that answered.

4. Platform configuration and related Platform changes are dangerous

Changes here can cause you to lose access to the Delinea Platform.

Ask: use the shared pattern, with a warning that says this, on:

Cmdlet	Today
Set-TssPlatformConfiguration (can set UsePlatformSettings, which switches unified mode)	Medium, no -Force
Enable-TssUnifiedMode	High, no -Force
Set-TssUnifiedModeStatus	Medium, no -Force
Invoke-TssPlatformProvision	High, no -Force
Reset-TssPlatformUserMapping	High, no -Force
Set-TssPlatformUserMapping	Medium, no -Force

5. Secret key rotation, key management and MEK rotation are dangerous

Ask: use the shared pattern (approval or -Force) on:

Cmdlet	Today
Start-TssSecretKeyRotation	High, no -Force
Stop-TssSecretKeyRotation	Medium, no -Force
Update-TssKeyManagement	High, no -Force
Start-TssMekRotation	High, no -Force
Restart-TssMekRotation	High, no -Force

6. PBA is deprecated

Ask: remove the 9 pba-configuration cmdlets, along with their classes, docs, tests and manifest entries:

• Clear-TssPbaChallenge
• Confirm-TssPbaPair
• Get-TssPbaConfiguration
• Get-TssPbaImportStatus
• Import-TssPbaHistory
• Search-TssPbaChallenge
• Sync-TssPbaMetadata
• Test-TssPbaConnection
• Update-TssPbaConfiguration

Also drop the w3-pba row from the coverage table.

7. Unanchored versioned URL rewrites

$TssSession.ApiUrl -replace 'v1','v2' is a regex replace over the whole URL, so it rewrites every v1, including one in the host. A vault at https://dev1.example.com would send its requests, with the Bearer token, to dev2.example.com. For Platform sessions the vault URL comes from the vault broker, and the host trust check only runs in New-TssSession, never on the rewritten URL.

Added by this PR:

• 17 -replace 'v1','v2' sites in 15 files:
  • diagnostics/Get-TssDiagnosticAppSetting.ps1:64
  • discovery/New-TssDiscoverySource.ps1:168
  • platform-integration/Get-TssPlatformIntegrationProgress.ps1:59
  • platform-integration/Set-TssPlatformIntegrationStep.ps1:94
  • scripts/Get-TssUserScript.ps1:62
  • scripts/Get-TssUserScriptHistory.ps1:59
  • scripts/New-TssUserScript.ps1:105
  • secrets/Export-TssSecretBulk.ps1:120
  • secrets/Get-TssSecretBulkExport.ps1:75,78,81
  • secrets/Get-TssSecretHasAny.ps1:42
  • secrets/Get-TssSecretSearchTotal.ps1:138
  • secrets/Get-TssSecretState.ps1:79
  • teams/Add-TssTeamMember.ps1:92
  • ticket-systems/Get-TssTicketSystem.ps1:71
  • ticket-systems/Search-TssTicketSystem.ps1:72
• 3 -replace 'v1','v3' sites:
  • secrets/Enable-TssSecret.ps1:60
  • secrets/Update-TssSecretSecurityApproval.ps1:100
  • ticket-systems/Search-TssTicketSystem.ps1:81

Ask:

• Use the anchored -replace '/api/v1$','/api/v2' form that 20 files in this PR already use, or better, a helper that builds the URL from the base.
• Add a Pester check that fails on an unanchored ApiUrl -replace 'v1'.

The two pre-existing sites are tracked in #483.

8. Get-TssSecretPasswordStatus -RestApi

The new -RestApi switch uses the published route secrets/secret-detail/{id}/password-status, but the internal route stays the default. Internal routes are unsupported and can break on any Secret Server release, so use them only when no published route exists.

Ask:

• Make the published route the default.
• Either drop the internal route, or keep it behind an explicit opt-in that warns.
• Call this out as a behavior change.

The other internal-route cmdlets predate this PR and are tracked in #483.

[jagger]

A dev build of this PR is published for validation as 0.63.0-alpha1, built from 766602b with a version stamp on top (5c3a965).

• GitHub prerelease: https://github.com/thycotic-ps/thycotic.secretserver/releases/tag/v0.63.0-alpha1
• PowerShell Gallery prerelease: https://www.powershellgallery.com/packages/Thycotic.SecretServer/0.63.0-alpha1

Install-Module Thycotic.SecretServer -RequiredVersion 0.63.0-alpha1 -AllowPrerelease -Scope CurrentUser

A plain Install-Module or Update-Module still gives 0.62.1. Local Pester run on the alpha build: 29,794 passed, 0 failed.

Please post validation results here: the Secret Server version, on-premises or Cloud, the command, and -Verbose output.

🤖 Generated with Claude Code

[jagger]

I pushed two commits to this branch after A/B testing the 0.63.0-alpha1 build against 0.62.1 and 0.62.0 with the SecretServer-Internal scripts on a 12.3 lab.

abd9dd31 docs: CHANGELOG 0.63.0

• Search-TssDirectoryServiceDomain now leads the 0.63.0 section. In 0.63, DomainSummary gains DistinguishedName and SiteId in every parameter set, not only -SearchText. The default filter set returns them empty (an empty string and null). That contradicts the old claim that the default output is unchanged. Scripts that export or compare whole objects now get two extra columns.
• The Get-TssSecretPasswordStatus route change moved from Breaking Changes to General Updates. Its parameters and output are unchanged. Against the lab, both routes returned 200 with identical output.

f57c3d54 fix: ship one psm1 with functions inlined (#486)

• Cold import goes from about 26 s to about 1.1 s. Details and measurements are in Module import is about 3.5x slower in 0.63.0-alpha1 (30 s vs 8 s) #486.
• build.functions.ps1 (new) adds Merge-ModuleFunction. build.ps1 and build-release-only.ps1 call it at the end of stage.
  • It inlines functions/** into the staged psm1 in the loader's order, with a #region functions/<path> marker around each file, and drops the functions folder from the release. src keeps its per-file layout.
  • It parses the merged text once and fails the build, leaving the stage unchanged, if any function file contains:
    • #requires or using
    • script-level blocks or other top-level code
    • more than one function, or a function not named after its file
    • $PSScriptRoot, $PSCommandPath or MyCommand.Path
• tests/Module.FunctionInlining.Tests.ps1 (new) has 10 tests. One inlines a copy of src and checks loader order, folder removal and that the result parses. The rest cover each rejection case.
• Verified with a real build-release-only.ps1 -Configuration Release:
  • The zip has no functions folder.
  • The staged module exports the same 1,087 commands as src, with an identical hash over every parameter's name, type, mandatory flag and position.
  • Lab smoke tests on the staged build passed: session, Get-TssSecret, Search-TssSecretTemplate | Get-TssSecretTemplate, Get-TssSecretPasswordStatus, Get-TssUnlimitedAdmin, the -WhatIf warning path and Get-Help.
• Error positions now point at Thycotic.SecretServer.psm1. The nearest #region marker above the reported line names the source file.

This branch is 3 commits behind dev, including 8af6a42e (InvokeBuild 5.12.2 for PowerShell 7.4+), which the build scripts here need on 7.4 and later. Both commits merge into dev without conflicts.

Not from this PR, but found in the same testing: since 0.62.1, Search-TssSecret emits its whole result as a single Summary[] object (the unary comma). Any Search-TssSecret | ... pipeline sees one item, and @(...) of an empty result has Count 1. That breaks scripts that pinned 0.62.0. I can open a separate issue for it.

[jagger]

0.63.0-rc1 is out as a prerelease on GitHub (https://github.com/thycotic-ps/thycotic.secretserver/releases/tag/v0.63.0-rc1) and the PowerShell Gallery (Install-Module Thycotic.SecretServer -RequiredVersion 0.63.0-rc1 -AllowPrerelease). Barring any reported issues, 0.63.0 releases on November 4.

It's built from this PR's head (f57c3d5) plus these commits on prerelease/0.63.0-rc1:

• fd8a499d Remove-TssUserPii applies the same rules as the UI's Remove PII button (user disabled, has audit history, PII not already removed). Also fixes Get-TssUserAudit per-user, which never sent take= and returned only the first page.
• b7248167 Start-TssSecretChangePassword keeps -NextPassword out of -Verbose and -WhatIf output (Start-TssSecretChangePassword Manual path: SecureString leak + confusing error when -NextPassword supplied without -Type #474, part 1)
• 3c40a95d Rollback snippet verifies the 0.62.0 SHA256 and imports from the right path (docs: rollback snippet in troubleshooting.md should verify SHA256 before importing #478)
• 12f4eaf6 Manifest declares the Core edition only (Stale CompatiblePSEditions = 'Desktop','Core' in manifest contradicts PowerShellVersion = '7.2.11' #468)
• dd925752 / 7ed87e35 Prerelease build support and the rc1 stamp; build.ps1 -GitHubPreTag now accepts alpha, beta and rc
• 7dba00f4 Build scripts run under PowerShell 7.4+ (cherry-picked from dev, 8af6a42)
• 5c59b72d CHANGELOG entries

Could you pull these into the PR so it matches what ships as 0.63.0? I tested the Remove-TssUserPii change live on Secret Server against the staged rc1 module. Cold import on my machine measured 4.9 s, against about 30 s for alpha1.