Build minimal RecordMetadata for removal (only UID needed).

Simulate the schema-building loop in prepare_record_add_or_update.

Build a Commander Connection with crypto bypassed for end-to-end URL assertions.

Enforce a folder permission for the current user. Behaviour: * If the cache has no access entries for *folder_uid* at all, skip the

Enforce a record permission for the current user. Same fail-closed semantics as :func:`_check_folder_permission`.

Normalize *mode_value* to ``kcm`` or ``guacd``; unknown/empty → :data:`DEFAULT_PIXEL_MODE`.

Compute optimal batch parameters from probe results. The API rate limit is global (~50 calls before HTTP 403 on EU). Batch sizes are

Return the base64url-encoded account UID for the current session, or ''.

Display Secrets Manager application details

Return Guacamole handshake DPI for *pixel_mode*. Must stay aligned with :func:`approximate_pixels` cell metrics: - ``guacd`` → :data:`_GUACD

Produce a CNAPP queue payload byte string the way the Encrypter would so we can exercise `_decrypt_cnapp_payload` end-to-end without mocking AES-G

Extract Telnet-specific settings from pamSettings.connection (record JSON).

Shared GET helper for the ``/api/platforms/{id}/<suffix>/`` family.

Find the PAM config UID associated with a gateway.

Return UIDs of every project wrapper user-folder under ``PAM Environments`` whose name matches ``project_name`` (or ``project_name #N`

Get the past tense verb for the action.

Extract (hostName, port) from a record's pamHostname or host typed fields. Requires a non-empty hostName on exactly one such field. Port com

Find the launch credential UID for a PAM record using the DAG. When a pamMachine record has both administrative credentials and launch crede

Return list of (record_uid, title, record_type, login) for records in folder_uid.

Get secret by UID first, then by title as fallback. Args: secrets_manager: Initialized SecretsManager instance record_id

Handle service shutdown.

Check if any operations were successful.

Return True if *access* belongs to the currently logged-in user. Matches by ``username`` first (the populated case after a successful user-ca

Check if a record should be displayed in normal folder structure. Excludes file attachments, linked records, and Secrets Manager app records.

Return True if *url* refers to the OS-native keychain backend.

Validate password complexity format: length,upper,lower,digit,special

Validate share URL expiry format. Valid formats: <number>d (days), <number>h (hours), <number>mi (minutes) Examples: 7d, 24h

Check if a record is a valid PAM record type. Args: params: KeeperParams instance record_uid: Record UID to

Yield every TypedField from both record.fields and record.custom.

Port of Admin Console getKSMBillingCycle (yearly/enterprise path). Returns (min_epoch_sec, max_epoch_sec) for the current billing cycle, or No

List safes with details for --list-safes output.

Prepare a record to be added. :param record_prepare_func: Function to call to prepare a record to be created. :param bulk_ad

Print pre-import summary with folder hierarchy for user review.

Backward-compatible alias for tests and external callers.

Render a primitive key-value pair.

Send a request, scoping private-CA TLS warning suppression per call.

Return the effective pixel mode, consulting env when *pixel_mode* is None. Unknown strings (including env typos) become :data:`DEFAULT_PIXEL_MODE

Send a key press and release event. Args: keysym: X11 keysym value

Mirror Console checkDateChangeRisk: set month (0-based) + year, clamping day to month length.

Set a value in a nested dict using a dotted key path.

Set the client state, firing onstatechange if changed. Args: state: The new client state.

Show updated device list after an action.

Best-effort call to a CyberArk Identity endpoint that may or may not be available on a given tenant.

Get the resource vertex for this user vertex that handles rotation. using the user's record UID.

Attach the standard five filter arguments to *parser*.

Build the pam project extend JSON (pam_data only).

Build DAG resource meta payload in v1 format so vault uses ACL is_launch_credential for launch. Returns dict: {"version": <int>, "allowedSett

Pre-launch workflow gate: validate, auto-handle no_workflow/needs_action/ready_to_start, prompt for MFA, and return flow UID + lease expiry. With