Normalize PVWA host — same logic as existing CyberArkImporter (PR #1423). Returns (host, query_params) tuple. Accepted formats:

Generic paginated fetch following nextLink (ark-sdk-python pattern). Follows the server's nextLink URL for subsequent pages instead of

Print a pre-import migration estimate.

Run execute() with GCP internals mocked. *secret_meta*: list of {'name', 'tags'} dicts. *value_map*: name → secret value s

Strip C0/C1 control characters (incl. ESC) from attacker-supplied text.

Validate account section (target system credentials).

Filter safes by --safes (include) and --exclude-safes patterns. Patterns are comma-separated and support glob matching.

Connect the vertex to the root vertex. :param edge_type: The type of edge to use for the connection. :param path: Short tag

Build HTML email for onboarding with one-time share link. Args: share_url: One-time share URL custom_message: Custom message

Aggregate safe member permissions into Keeper shared folder permission format. Merges permissions across all safes — if a user appears in multipl

Check if enforcement is required and handle multi-factor authentication if needed. Uses priority-based authentication:

Build a generator from CLI/$GEN overrides with optional policy defaults.

Raise CommandError when `record_type` is blocked by policy.

Raise ``CommandError`` if *record_uid* is not a Nested Share Record.

Get the Nested Share Folder role label for an access entry. Prefers the stored ``access_role_type`` (proto enum int) when available; otherwis

This method will return the proper connection based on the params passed in. If `ksm` and a KDNRM KSM instance, it will connect using keeper

Get user's public key from cache / enterprise / API. Returns: (public_key_object, use_ecc, user_uid_bytes, needs_invite)

Return True if a process with the given PID is still running.

Load EmailConfig from a Keeper record. Args: params: KeeperParams session record_uid: Record UID Returns: Email

Build a fake HTTP 200 response with empty body.

Remember that (host, endpoint) reported HTTP 404 (endpoint not deployed). Subsequent `is_layer_b_feature_disabled(host, endpoint)` calls return T

Replace legacy server terminology in user-facing error text.

Normalize ``GET .../master-rotation-policy/exceptions/`` payloads. CyberArk ISPSS returns:: { "exceptions": [

Pick which linked account populates Keeper's administrative_credentials slot. CyberArk has three linked-account roles (logon, reconcile, enable)

Print a formatted header

Resolve linked accounts (logon, reconcile, enable) for an account. Fetches the full account details to get linkedAccounts, then fetches each

Encrypts data using the symmetric key

Ensure resource vertex meta has version >= 1 so vault reads ACL launch credentials.

Validate encryption private key

Validate Ngrok authentication token

Validate rate limiting format

Initialize email sender with configuration. Args: config: EmailConfig object Raises: ValueError: If

Apply the selected theme and save preferences

Build a Permissions protobuf for share/update — single source of truth.

Resolve (password, used_existing) per cp-rotation-skip-feat: existing_password → rotation.password_complexity → DEFAULT_COMPLEXITY.

Scan running Docker containers for one with Guacamole DB env vars. Returns the container name, or raises CommandError if none found.

Dispatch a GatewayAction to the gateway and return the response.

Generic method to display results in table or JSON format.

Send an empty sync to the given PamEndpoints; expect a clean 200 (proto).

Execute a function with consistent error handling

Extract database-specific settings from pamSettings.connection (record JSON).

In headless/service mode, persistent login often needs a follow-up prompt (password, SSO, 2FA, device approval) that cannot be answered. Log once