Return Guacamole handshake DPI for *pixel_mode*. Must stay aligned with :func:`approximate_pixels` cell metrics: - ``guacd`` → :data:`_GUACD

Extract Telnet-specific settings from pamSettings.connection (record JSON).

Find the PAM config UID associated with a gateway.

Get the past tense verb for the action.

Extract (hostName, port) from a record's pamHostname or host typed fields. Requires a non-empty hostName on exactly one such field. Port com

Find the launch credential UID for a PAM record using the DAG. When a pamMachine record has both administrative credentials and launch crede

Return list of (record_uid, title, record_type, login) for records in folder_uid. record_type from record for autodetect (e.g. pamUser, pamMachine

Get secret by UID first, then by title as fallback. Args: secrets_manager: Initialized SecretsManager instance record_id

Handle service shutdown.

Check if any operations were successful.

Return True if *access* belongs to the currently logged-in user. Matches by ``username`` first (the populated case after a successful user-ca

Check if a record should be displayed in normal folder structure. Excludes file attachments, linked records, and Secrets Manager app records.

Return True if *url* refers to the OS-native keychain backend.

Validate password complexity format: length,upper,lower,digit,special

Validate share URL expiry format. Valid formats: <number>d (days), <number>h (hours), <number>mi (minutes) Examples: 7d, 24h

Check if a record is a valid PAM record type. Args: params: KeeperParams instance record_uid: Record UID to

Yield every TypedField from both record.fields and record.custom.

Prepare a record to be added. :param record_prepare_func: Function to call to prepare a record to be created. :param bulk_ad

Print pre-import summary with folder hierarchy for user review.

Render a primitive key-value pair.

Send a request, scoping private-CA TLS warning suppression per call.

Return the effective pixel mode, consulting env when *pixel_mode* is None. Unknown strings (including env typos) become :data:`DEFAULT_PIXEL_MODE

Send a key press and release event. Args: keysym: X11 keysym value

Set a value in a nested dict using a dotted key path.

Set the client state, firing onstatechange if changed. Args: state: The new client state.

Show updated device list after an action.

Best-effort call to a CyberArk Identity endpoint that may or may not be available on a given tenant.

Get the resource vertex for this user vertex that handles rotation. using the user's record UID.

Attach the standard five filter arguments to *parser*.

Build DAG resource meta payload in v1 format so vault uses ACL is_launch_credential for launch. Returns dict: {"version": <int>, "allowedSett

Pre-launch workflow gate: validate, auto-handle no_workflow/needs_action/ready_to_start, prompt for MFA, and return flow UID + lease expiry. With

Cleanup resources

Test helper — wipe the (host, endpoint) cache.

Clean up resources held by this Infrastructure instance. Releases the DAG instance and connection to prevent memory leaks.

Simple confirmation through user input msg(str): Message expecting a yes or no answer Returns True if answer is "yes" and False otherwise.

Create a generator that satisfies the given password complexity enforcement policy.

Create a new output stream. Returns: A new OutputStream with an allocated index.

Convert a string, dict, or list of dicts to snake case. :param str_or_iter: A string or iterable. :type str_or_iter: Union[list, dict,

Guesses AES cipher (EBC or CBD) from the length of the plain data.

Decodes a hex encoded string into raw bytes.

Return unique specs in first-seen order and warnings for duplicate CLI options. ``option_label`` is shown in warnings (e.g. ``--set/-s``).

Detect the connection protocol from a PAM record. All machine types (pamMachine, pamDirectory, pamDatabase) allow any connection type (s

Encrypt record_key with encryption_key; returns (ciphertext, key_type).