Get or create the tube registry instance, storing it on params for reuse

Fetch the active or specified configuration for a service provider.

Get a tunnel session by tube_id (thread-safe)

Read registry files. Optionally remove dead or corrupt entries. Returns a list of dicts for tunnels whose owning process is still alive.

Parse CLI spec ``LEVEL``, ``LEVEL.SETTING``, or ``LEVEL.SETTING=VALUE``. Returns (level, setting_or_none, value_or_none). ``value_or_none``

Parse a RecordSharing.Status protobuf into a result dict.

Safely copy text to clipboard, handling missing clipboard on remote/headless systems. Returns: (True, "") on success (False, erro

Walk the vertices using the path and return the vertex starting at root vertex. :param path: An array of path string, or string wher

Build a Connection where header construction runs but no real crypto is needed. Uses the deprecated `encrypted_transmission_key`/`encrypted_sessi

Compute batch sizes and delay to avoid API throttling. API call costs per record (measured via instrumentation): External user: ~

Detect database type from Docker container environment variables. Returns 'mysql' or 'postgresql'.

Return whether the client is connected or waiting.

Make API call with consistent error handling.

Build a stand-in for a PAM Configuration TypedRecord whose `pamResources` typed field carries the given resourceRef list.

Print a pre-import migration estimate.

Run execute() with GCP internals mocked. *secret_meta*: list of {'name', 'tags'} dicts. *value_map*: name → secret value s

Validate account section (target system credentials).

Connect the vertex to the root vertex. :param edge_type: The type of edge to use for the connection. :param path: Short tag

Build HTML email for onboarding with one-time share link. Args: share_url: One-time share URL custom_message: Custom message

Check if enforcement is required and handle multi-factor authentication if needed. Uses priority-based authentication:

Build a generator from CLI/$GEN overrides with optional policy defaults.

Raise CommandError when `record_type` is blocked by policy.

Raise ``CommandError`` if *record_uid* is not a Nested Share Record.

Get the Nested Share Folder role label for an access entry. Prefers the stored ``access_role_type`` (proto enum int) when available; otherwis

This method will return the proper connection based on the params passed in. If `ksm` and a KDNRM KSM instance, it will connect using keeper

Get user's public key from cache / enterprise / API. Returns: (public_key_object, use_ecc, user_uid_bytes, needs_invite)

Return True if a process with the given PID is still running.

Load EmailConfig from a Keeper record. Args: params: KeeperParams session record_uid: Record UID Returns: Email

Build a fake HTTP 200 response with empty body.

Remember that (host, endpoint) reported HTTP 404 (endpoint not deployed). Subsequent `is_layer_b_feature_disabled(host, endpoint)` calls return T

Print a formatted header

Encrypts data using the symmetric key

Ensure resource vertex meta has version >= 1 so vault reads ACL launch credentials.

Validate encryption private key