Convert a PKCS#12 bundle to a temporary PEM cert+key pair for ``requests``. ``requests`` does not accept ``.p12``/``.pfx`` files directly — i

Load available platform handlers

Load a pamUser/login record and return a plain dict, or None on failure.

Load and parse YAML configuration file. Args: file_path: Path to YAML file Returns: Parsed configur

Check if a token looks like a filename with proper validation.

Real vault.TypedRecord v6 for a PAM configuration.

Return a MagicMock that walks like a DAG for the lazy property body. `has_graph` is set so that RecordLink / Rules don't try to add bootstrap

Build the KCM-shaped vault state (PR #1942 import output).

Return an os-keychain URL with the netloc derived from a SHA-256 hash of the config path.

Factory that creates a parser with shared defaults and error overrides.

Real vault.TypedRecord v3 for a PAM resource.

Real vault.TypedRecord v3 for a pamUser.

Mark vertices as deleted. Check each vertex to see if there is any non-DELETION edge connecting to another vertex. If there

Recursively mask password/secret/passphrase values in JSON object for display

Fully redact PII for security in dry-run output. All PII (names, emails, etc.) are replaced with [REDACTED] to prevent expos

Prompt for / load a P12 client cert when targeting a self-hosted PVWA.

Return the Keeper permission ``name`` for a CyberArk safe member.

Migrate items from the old user service graph to the PAM graph.

Encapsulate using ML-KEM-1024. Returns: (shared_secret, ciphertext)

Normalize a value for comparison (sort lists so ordering doesn't matter).

Notify the gateway/router that a WebRTC session should be closed. This mirrors the gateway's own POST to /api/device/connect_state so that

Handle connection_closed event from Rust. This is sent when the gateway/guacd closes the connection.

Handle connection_opened event from Rust. This is sent when the Gateway has acknowledged the OpenConnection request and the

Handle data event from Rust. This contains pure Guacamole protocol data (no channel prefix). The Rust layer has already stri

Open a WebRTC tunnel for terminal/Guacamole connection. This function adapts start_rust_tunnel for terminal protocols by: - Using the pr

Rows of newline padding: max(current size, session start size). Session start printed ``session_start_rows`` newlines; if the user shrinks t

Parse pamSettings.connection.fontSize to int, or None if unset or not parseable as an integer size.

Parse 'get' command output.

Parse a 'host:port' or '[ipv6]:port' string into (host, port). Supported formats: - IPv4 / hostname: 192.168.1.1:22 or server.examp

Parse a single instruction from text format. Format: length.value,length.value,... Example: "4.sync,8.12345678" -> sync inst

Parse commands that primarily use logging.info() for output.

Parse 'ls' command output into structured format.

Parse 'mkdir' command output to extract folder UID, path, and name.

Split *folder_path* into a list of segment names.

Parse comma-separated [target:perm1,perm2] segments from tree share lines.

Parse shared-folder permission suffix from a tree line into structured fields. CLI format (from folder.formatted_tree): (default:...

Returns dict with keys: all, with_attachments, without_attachments, skipped_not_owned.

Perform the actual biometric registration

Render a numbered list of candidates and prompt for selection. On non-TTY stdin, prints the list once and returns None — caller surfa

Heuristic when guacr/gateway uses a non-STDOUT pipe name for TTY bytes (e.g. PAM clipboard flags). Require text/* and exclude STDIN. Only use

Poll until state is no longer 'waiting' or timeout. Returns None on timeout/cancel/error.

Fresh terminal row count at call time (handles resize since session start).

Padding newlines: see ``_padding_line_count`` and launch.py pre-session clear.

Prepare registration data and options

Preprocess response by cleaning ANSI codes and determining source. Returns: tuple: (cleaned_response_str, is_from_log_out

Return the CyberArk user-group names that would become Keeper Teams/Roles. Read-only preview helper that honors the same ``_CYBERARK_GROUPS``

Print available connection groups with resource counts.

Print next steps for deployment

Display record permissions in a format similar to the legacy get command.