Get the record key for a PAM config record.

Load configuration from YAML file.

Create a mock TypedRecord with an optional identityProviderUid custom field.

Create a real vault.TypedField.

Check that *secret_tags* (a plain dict) satisfies every (key, value) pair in *required_tags*. Azure and GCP both return tags/labels a

Point tunnel_registry_dir at tmp for the duration of a test.

Wrap _post_request_to_router with progressive backoff on 429 / throttle errors. Non-throttle errors propagate immediately. Final retry's exception

Rewrite folder_path roots to match actual shared folder names. Needed when edit.py adds a #N dedup suffix to the project folder, maki

Run execute() with Azure internals mocked. *secret_meta*: list of {'name', 'tags'} dicts. *value_map*: name → secret value

True when AD context is set AND existing_password is NOT — gates the rm-create-user push-to-target route. See SECURITY_ARCHITECTURE.md.

True when rotation: present and rotate_on_provision is not False.

Print interactive prompt text to stderr so it's always visible and never pollutes stdout.

Stop the TOTP auto-refresh timer

Convert a base64url-encoded UID string to bytes; empty/None -> empty bytes.

Validate email section and check for email config existence.

Validate rotation section (schedule/on_demand, complexity, flags).

Clean up temporary files. Args: temp_files: List of temporary file paths to clean up

Convert conversationId to messageId format (replace + with -, / with _)

Create legacy blueprint for synchronous command execution.

Creates subfolder inside parent folder: either `user folder`, `shared folder` or `shared folder folder`. If `parent_uid == ""` then c

Return the RecordKind for a PVWA payload.

Encode a Guacamole instruction to send to the server. Args: opcode: Instruction opcode *args: Instruction ar

Extract and sort devices from API response.

Fetch audit events with pagination support. This function handles pagination for both raw and span/consolidated reports, making it suita

Fetch all vault users. Excludes component users (CPM, PSM, etc.).

Format timeout as instance of timedelta for output to console timeout_delta(timedelta): Timeout setting as instance of timedelta. Returns str

Generate ca_users_to_provision.csv content from unmatched identities. Returns CSV as a string (no file I/O — caller writes to file/attachment

Get configuration format based on existing files.

Get PAM configuration records. The default it to find all the record version 6 records. If the environment variable `PAM_REC

Find the highest DAGEdge version of all edge types. :param head_uid: :return:

True when settings are absent or match the vault empty/default template.

Load record metadata from cache, falling back to the v3 details API. Returns a dict with keys: ``title``, ``type``, ``fields``, ``notes``

Parse expiration time string into timedelta

Read command with support for line continuation using backslash.

Read configuration parameter from service config file.

Reads an item from a stream and returns it as a string of bytes.

Resolve a folder name, path, or UID to a Nested Share Folder UID. Delegates to the service layer's ``resolve_folder_identifier`` to avoid dup

Rewrite known noisy server validation messages in place on each response dict.

Remove passwords from import JSON for safe --output without --include-credentials.

Remove the registry file for a tunnel (defaults to current PID).