Return keyring account key from URL netloc; falls back to 'config' for legacy entries.

Create a typed record via the record-add command; return its UID. Uses dot-notation field specs (``f.login=..``, ``c.pamSettings=$JSON:..``)

Add AD user to groups via Gateway's rm-add-user-to-group action (KC-1035). Args: config: YAML config with account.ad_gro

Send add_workflow_approvers for the given users / teams. Shared by create + add-approver. Caller must de-duplicate. Raises on transport error.

Add the shared filter arguments to a parser.

Add a record to the tree. Records with attachments show 📎 indicator.

Convert legacy username-field/password-field to autofill JSON. Old Guacamole used simple CSS selectors (e.g. 'u', 'passwd') as userna

Set expiration / ROE fields on folder-access TLAProperties.

Apply dynamic CSS based on current theme

Authenticate to a CyberArk PVWA and return session details. Returns ``(pvwa_host, authorization_token, query_params)`` on success, or

Perform Touch ID authentication with proper synchronization

Build a mapping of DNS domain names to NetBIOS names. Returns: Dict mapping DNS names (e.g., 'test.local') to NetBIOS names (e.g.

Build RecordMetadata with encrypted record key and optional TLA.

Build a minimal Permissions proto for revokeSharingPermissions.

Convert character columns/rows into pixel measurements for the Gateway. Uses the pixel mode to select the DPI and pixel formula: - ``'kcm'``

Build FolderData for an update, preserving existing name/color.

Build a PAMRecordingsForUsersRequest from command kwargs.

Return the (url, body_bytes) that requests.request was last called with.

Check if biometric authentication is available

Check if biometric authentication is enabled for user

Return existing role name (for the matching access_type) or None.

Check if platform supports biometric authentication

Classic record share perms → structured data + compact text. Only direct user shares are listed. Shared-folder inheritance is omitted: the tr

Delete every temporary PEM file written by ``_load_p12_client_cert``.

Return set of all folder UIDs (shared folder roots + all descendants) under KSM app.

Model docker-compose interpolation: a literal '$' is written '$$'.

Configure automatic password rotation using PAM rotation command. Uses the existing PAMCreateRecordRotationCommand to set up rotatio

Ask the user to confirm before reading/importing CyberArk data into Keeper. Returns ``True`` to proceed, ``False`` to cancel. The prompt can

Create LocalAuthentication context

Create WebAuthn authenticator data

Create WebAuthn client data

Create PAM User record. Args: config: Validated configuration password: Generated password param

Decrypt record-key-encrypted data from gateway response.

Decrypt a PAM recording file. Wire format (from vault session-recordings-util.ts): [4 bytes big-endian: AD length][AD JSON bytes][0x3B ';']

Display this-device info in the detail panel

Display record details with clickable fields for copy-on-click

Display data in table format - must be implemented by subclasses.

Display whoami info in the detail panel

Download and decrypt one session's recording files (parallel across types).

Encode current attributes to a single integer

Ensure Nested Share Folder caches exist on params, even for older sessions.

Build a RouterResponse with a non-OK responseCode wire payload.

Execute a command asynchronously with loading indicator.

Expire a queued request so the worker will not execute it later.

Return the best available email for a CyberArk user dict, or empty string.

Extract credentials from a linked pamUser record. This function extracts username, password, private key, and passphrase from a pamUser

Filter out biometric and persistent login messages from response.

Return raw enforcement value for `key` across known layouts, or None.

Return the highest-version edge for a self-loop DATA path (any edge type).

Find the appropriate parser method for a command. Returns: str: Method name to call for parsing

Locate the project wrapper user-folder(s) under PAM Environments. Delegates to :class:`CyberArkPAMCleanupCommand` so cleanup / idempo

Check if a folder should be displayed. When no search filter is active, all folders are shown (including empty ones). When searching,

Return the Nested Share Folder role label for a folder accessor. Uses the server-supplied ``role`` (an ``AccessRoleType`` enum name) and