Validate email configuration completeness. Returns: List of validation error messages (empty if valid)

Format elements into a Guacamole instruction.

Generate secure random password using Commander's built-in generator. This is a critical security feature. Commander generates passw

Check if host is a local/private address (no SSL warning needed). Only trusts literal IP addresses and 'localhost'. Does NOT resolve

Return milliseconds. Raises CommandError on invalid/non-positive value. Delegates to WorkflowFormatter.parse_duration; adds a None -> default-

Rollback created records on critical failure. Cleans up partially-created resources when provisioning fails at a critical st

Send Guacamole data back to gateway via Rust. Uses send_handler_data() which routes through the WebRTC channel.

Build the pam project import JSON from mapped records.

Convert bytes to a URL-safe base64 encoded string. Args: b (bytes): The bytes to be encoded. Returns: str: The URL-safe

Find email config record by name. Args: params: KeeperParams session name: Name of email configuration Returns:

Resolve an SSO service provider by ID or name from enterprise data.

Format seconds as 'Xm Ys'. Handles negative, inf, nan.

GET helper that surfaces connection errors as a graceful warning instead of a stack trace. Returns the ``requests.Response`` on success, or `

Map CyberArk permission booleans to Keeper shared folder permissions. Returns dict with keys: manage_users, manage_records, can_edit, can_sha

Parse a RecordSharing.Status protobuf into a result dict.

Parse timeout input to return instance of timedelta timeout_input(str): String to parse for one or more integer values followed by time unit name

Record a completed batch and adapt parameters if needed. Throttle detection is purely timing-based: if the batch took more than THROT

Return server-assigned rotation revision from cache, syncing when missing (not sequential). NSF rotations may not yet arrive via sync_down into `

Remove any dynamically mounted clickable field widgets

Helper to encode YAML string to base64.

Build a DAG with a mocked connection so we can assert sync wiring. Skips real load — caller invokes _sync_legacy / _sync_per_graph directly.

Validate that the PVWA host is not targeting internal/private addresses (SSRF protection).

Build structured post-import report matching the spec.

Connect to the Guacamole server. Args: data: Arbitrary connection data to send during handshake. Raises:

Create default configuration structure.

Log storage operation errors consistently

Raise ``CommandError`` if *folder_uid* is not a Nested Share Folder.

Get the user ACL from the record linking graph.

Retrieve the unencrypted record key from nested_share_records or record_cache.

Load a vault record from classic cache, NSF cache, or NSF record data.

Create a real RestApiContext with QRC disabled to simplify mocking.

Create a minimal ApiRequestPayload for execute_rest.

Parse ``--expire-at`` / ``--expire-in`` into a millisecond timestamp. Returns *None* if neither argument is provided, or ``-1`` for ``'never'``.

Remove ANSI color codes from text

Sync full or partial data down to the client

Validate port number

Construct a TunnelDAG without going through __init__ (which needs network setup).

Clean KCM autofill-configuration JSON for Keeper RBI. Keeper RBI uses the same JSON array format as KCM/Guacamole: [{"page": "*.exa

Generate dry-run report showing what would be created. PII (names, emails) are partially masked for security. The value of a

Instantiate `cls`, force the lazy `dag` property, return the kwargs passed to the patched `DAG(...)` constructor.

Build a serialized GraphSyncMultiResult. per_stream: list of (stream_id bytes, sync_point int, has_more bool, data_items

Capture stdout from a JSON-mode dry-run; return parsed JSON.

Raise ``CommandError`` when *result['success']* is falsy. Standardises the ``if not result['success']: raise ...`` pattern that appears in al

Detect if an account is part of a dual-account/rotational group. CyberArk dual accounts have VirtualUserName and/or GroupPlatformID in their

Populate context using the configuration UID. From the configuration record, get the gateway from the settings.