Extract the first non-empty value for a given field type.

Extract file reference UIDs from record fields.

Extract x and y coordinates from EC key

Extract linked record reference UIDs (addressRef, cardRef, etc.).

Load a vault record by UID or title and extract its password.

Extract common fields from record into record_dict.

Return the first 22-char Keeper record UID found anywhere in the message, or None if no such token exists. Matches must be bounded by non-UID

Return all user record UIDs referenced inside a pamSettings dict. Falls back to title-based resolution against ``title_to_uid`` when

Per-endpoint policy: True if this endpoint allows legacy fallback right now. Always-downgrade endpoints return True regardless of env var; others

Helper method to handle fallback from biometric to default authentication

Try several CyberArk Identity endpoints that may surface app sharing info. Returns a dict (possibly empty) of sharing metadata.

Fetch the user's CyberArk Identity folders (a.k.a. Collections).

Internal helper for the get_public_keys + share-objects fallback chain.

Best-effort fetch of per-secured-item sharing details.

Finalize the deletion process.

Finalize registration and report success

Find record by path resolution. If exactly one record matches (any type), returns its UID. If two or more match, filters to

Substring fallback for ``find_record`` — case-insensitive contains match across PAM record titles and any ``host`` / ``pamHostname`` field.

Find record by exact title match. If exactly one record matches (any type), returns its UID. If two or more match, filters t

Find credential using keychain manager

Find an existing NSF folder named *folder_name* whose parent matches *parent_uid*. ``parent_uid=None`` means "root level".

Find devices matching the given identifier.

Return list of PAM Config record summaries bound to the given Gateway UID. PAM Configurations are record version 6 (pamAws/Azure/Gcp/Domain/Netwo

Find a pamUser record with an IdP User ID custom field matching the given username.

Find the appropriate parser method for a command. Returns: str: Method name to call for parsing

Rewrite incorrectly cased acronyms, initialisms, and abbrevations, allowing them to be decamelized correctly. For example, given the string "A

Flag all edges a not modified. :return:

Add notes and move KSM-affected records to dedicated subfolders. Resolved records stay in place but get a note explaining the match.

Clear the console input queue (parity with POSIX tcflush TCIFLUSH).

Return set of folder UIDs under this shared folder (root + all descendants from folder_tree).

Format datetime string to local time.

Format a list of items for display in a table cell, with line limits for PDF.

Format multi-line text for better JSON readability.

Format recipients data for display in a table cell, with limits for PDF.

Render a sharing/access value for display in a Keeper text field.

Convert raw gateway/Azure error messages into user-friendly text.

Resolve the controller (gateway) UID from a PAM configuration UID. Mirrors the second half of ``tunnel_helpers.get_gateway_uid_from_r

Generate a consolidated report showing license consumption across all features

Generate one-time share URL for PAM User. Shares the PAM User directly (not a copy) so the user always sees the current pass

Generate one-time share URL for a record (PAM User). This extracts the core logic from OneTimeShareCreateCommand (keepercomm

Get the past tense verb for the action.

Get advanced security configuration

Return on/off dict for tunneling config, falling back to safe defaults.

Get the path to the Cloudflare tunnel log file.

Get and validate commands configuration

Get and validate config file path

Get the configuration file path based on what exists.

Generate default credential name

Return display DPI on Linux without extra Python dependencies. Tries in order: 1. **X11** — ``Xft.dpi`` from the X resource database (``libX

Return display DPI on Windows via ctypes, cached for the session. Tries GetDpiForSystem (shcore.dll, Windows 8.1+) first, then falls back to

Get encryption configuration

Fetch current domain aliases and return as a set of (domain, alias) tuples.

Extract file UID from file object. Args: file_obj: File object from KSM Returns: str: File UID or None if n

Get format input from user during service creation.

Get the Gateway version from connected controllers list.

Get appropriate headers based on display options.

Get allowed IP configuration

Get denied IP configuration

Return set of all record UIDs in any folder shared to the KSM app.

Detect local IANA timezone via TZ env var (override) or tzlocal (cross-platform).