Escape HTML-significant characters and strip control/ANSI sequences for safe use in prompt_toolkit HTML().

Build a PAMRecording proto with sensible defaults.

Validate command inputs - can be overridden by subclasses.

Sync, load, apply updater, write. Retries on stale revision so concurrent writers merge against the latest remote state instead of ov

Return a mock params object with a record_cache entry.

Parse a secret string into name/value pairs. Supported formats (in priority order): 1. JSON object -> {"key": "value", ..

Mock the shared input-resolution helper so each test starts from a known good state.

Connect a vertex to another vertex (as the owner). This will create an edge between this vertex and the passed in vertex. Th

Remove the process information file.

Override notify to use faster timeout (default 1.5s instead of 5s)

Build a TypedRecord from a title and a dict of field name/value pairs. Field mapping rules: - 'note' / 'notes' keys are writ

Get a single vertex by its UID only. Unlike get_vertex, this never falls back to path or name matching, so it can never rais

Merge CLI --set/--unset operations into KeeperAI DAG settings. Returns ``(settings_dict, warnings)`` where ``warnings`` is a list of user-facing

Get a list of vertices that this vertex belongs to :return:

Retrieve the unencrypted folder key from nested_share_folders or subfolder_cache.

Map Master Policy to PAM config settings. Returns ``(pam_config_updates, unmapped_items)``.

Returns folder_path for use in pam_data extend JSON. Deduplicates colliding names with #N suffix (e.g. 'Safe #2').

Print a success message

Set or clear the launch credential (and optionally the admin) for a resource via a single Layer-B configure_resource round-trip.

Validate that required dependencies for an email provider are installed. This function checks if dependencies are available WITHOUT creating

Load and parse YAML configuration from base64-encoded string. Supports standard RFC 4648 base64 encoding. The input should be the ba

Construct a TunnelDAG-shaped object directly (bypassing __init__) and populate just the attributes that `set_launch_credentials` touches.

Check if dependencies for a provider are available. Args: provider: Provider name (smtp, ses, sendgrid, gmail-oauth, microsoft-oauth

Load process information from .env file.

Resolve a username template using user data fields. Supported variables: {first_name} - Full first name (e.g., "Felipe") {last

Send a message through the tunnel. All messages are guaranteed to be received in the order sent. Args: *element

Create a resource record (pamMachine/pamDatabase/pamDirectory/pamRemoteBrowser). ``trafficEncryptionSeed`` is intentionally omitted - it is p

Build the endpoint on the remote site. This method will attempt to fix slashes. :param action: :param endpoint:

Flag records with incomplete KCM source data. Moves incomplete resources/users to an 'Incomplete (KCM Source)' subfolder and adds a '

Helper to stop event propagation.

Context manager that standardises exception handling for commands. CommandError passes through unchanged; every other exception is wrapped in

Make an empty UserAcl that contains all the default values for the attributes.

Get data edge If the index is None or 0, the latest data edge will be returned. A positive and negative, non-zero, index wil

Return True when *record_uid* is a Nested Share Folder (v3) record.

If the username is a UPN, email, netbios\\username, break it apart into user and domain/netbios.

Create a pamUser record and return its UID. ``distinguished_name`` is required to rotate a directory (LDAP/AD) user - kdnrm modifies

Coerce the named sub-fields of a pamSettings / pamRemoteBrowserSettings entry to dicts, in place. Discovery and the Web Vault may publish ``c

Side-effect for record_management.add_record_to_folder (pb_only path). Appends the record to *captured* and returns a real RecordAdd whose

GET with automatic retry on HTTP 429 (rate limit). Redirects disabled.

Iterate *secrets* (list of dicts with at minimum 'name' and 'tags'), apply all filters, then create Keeper records via batched API ca

Get the Controller UID that has access to the configuration UID Retrieves a keeper.pam_controller record, from given configuration_uid provid

Remove CyberArk system/internal safes from the list. System safes (VaultInternal, PVWAConfig, etc.) don't contain user-managed accounts and s