Parse a secret string into name/value pairs. Supported formats (in priority order): 1. JSON object -> {"key": "value", ..

Mock the shared input-resolution helper so each test starts from a known good state.

Connect a vertex to another vertex (as the owner). This will create an edge between this vertex and the passed in vertex. Th

Override notify to use faster timeout (default 1.5s instead of 5s)

Build a TypedRecord from a title and a dict of field name/value pairs. Field mapping rules: - 'note' / 'notes' keys are writ

Get a single vertex by its UID only. Unlike get_vertex, this never falls back to path or name matching, so it can never rais

Merge CLI --set/--unset operations into KeeperAI DAG settings. Returns ``(settings_dict, warnings)`` where ``warnings`` is a list of user-facing

Get a list of vertices that this vertex belongs to :return:

Remove the process information file.

Set or clear the launch credential (and optionally the admin) for a resource via a single Layer-B configure_resource round-trip.

Validate that required dependencies for an email provider are installed. This function checks if dependencies are available WITHOUT creating

Load and parse YAML configuration from base64-encoded string. Supports standard RFC 4648 base64 encoding. The input should be the ba

Construct a TunnelDAG-shaped object directly (bypassing __init__) and populate just the attributes that `set_launch_credentials` touches.

Check if dependencies for a provider are available. Args: provider: Provider name (smtp, ses, sendgrid, gmail-oauth, microsoft-oauth

Retrieve the unencrypted folder key from nested_share_folders or subfolder_cache.

Print a success message

Resolve a username template using user data fields. Supported variables: {first_name} - Full first name (e.g., "Felipe") {last

Send a message through the tunnel. All messages are guaranteed to be received in the order sent. Args: *element

Create a resource record (pamMachine/pamDatabase/pamDirectory/pamRemoteBrowser). ``trafficEncryptionSeed`` is intentionally omitted - it is p

Build the endpoint on the remote site. This method will attempt to fix slashes. :param action: :param endpoint:

Flag records with incomplete KCM source data. Moves incomplete resources/users to an 'Incomplete (KCM Source)' subfolder and adds a '

Helper to stop event propagation.

Context manager that standardises exception handling for commands. CommandError passes through unchanged; every other exception is wrapped in

Make an empty UserAcl that contains all the default values for the attributes.

Get data edge If the index is None or 0, the latest data edge will be returned. A positive and negative, non-zero, index wil

Return True when *record_uid* is a Nested Share Folder (v3) record.

If the username is a UPN, email, netbios\\username, break it apart into user and domain/netbios.

Create a pamUser record and return its UID. ``distinguished_name`` is required to rotate a directory (LDAP/AD) user - kdnrm modifies

Coerce the named sub-fields of a pamSettings / pamRemoteBrowserSettings entry to dicts, in place. Discovery and the Web Vault may publish ``c

Side-effect for record_management.add_record_to_folder (pb_only path). Appends the record to *captured* and returns a real RecordAdd whose

Iterate *secrets* (list of dicts with at minimum 'name' and 'tags'), apply all filters, then create Keeper records via batched API ca

Find an open port in the range [start_port, end_port]. The default range is from 49,152 to 65,535, which are the "ephemeral ports" or "dynami

Does this vertex have the passed in vertex? :return: True if request vertex belongs to this vertex. False if it doe

Minimal KeeperParams mock — these validator tests must not trigger vault/api lookups, so the configs avoid directory_uid / delivery.share_to.

Resolve the Identity Provider config UID from a PAM configuration. Reads the 'identityProviderUid' custom text field on the PAM config record.

Validate email configuration completeness. Returns: List of validation error messages (empty if valid)

Format elements into a Guacamole instruction.

Generate secure random password using Commander's built-in generator. This is a critical security feature. Commander generates passw

Check if host is a local/private address (no SSL warning needed). Only trusts literal IP addresses and 'localhost'. Does NOT resolve

Return milliseconds. Raises CommandError on invalid/non-positive value. Delegates to WorkflowFormatter.parse_duration; adds a None -> default-

Rollback created records on critical failure. Cleans up partially-created resources when provisioning fails at a critical st

Send Guacamole data back to gateway via Rust. Uses send_handler_data() which routes through the WebRTC channel.

Convert bytes to a URL-safe base64 encoded string. Args: b (bytes): The bytes to be encoded. Returns: str: The URL-safe