Format record details for TUI display using the 'get' command output

Format timestamp for display with friendly date format

Get valid access token, refreshing if necessary. Returns: Valid access token

Return list of (record_uid, title, record_type, login) for every record in any folder under KSM app.

Get available credentials with consistent error handling

Get Cloudflare configuration

Get the number of vertices that have not been converted to record. This will recurse down the graph. To be counted, the curr

Return direct AT_USER share metadata for *email*, or None.

Determine what sections to show based on kwargs.

Return approximate main-display DPI on macOS via CoreGraphics. Uses ``CGDisplayScreenSize`` (physical size in mm) and ``CGDisplayPixelsWide`` /

Convert event IDs to names.

Extract the user collection logic for reuse in all-features report

Find the connected Gateway UID for a PAM Configuration. Looks up the gateway associated with the specific PAM Config, then verifies i

Extract priority from ICE candidate string to determine send order. ICE candidate priority order (highest to lowest): 1. typ

Get ngrok configuration

Fetch and return the raw secret string for *secret_name*.

Get IDs of selected items.

Get the shell prompt based on current folder context

Return the value of the single non-empty typed field matching field_type. Enforces exactly one non-empty field across both record.fields[] a

Convert user IDs to usernames.

Generate the My Vault welcome screen content with current theme colors

Common error handling for authentication failures

Common error handling for credential creation failures

Handle commands that produce no output but are successful.

Check if user has master password or alternate SSO master password. Args: params: KeeperParams instance

Parse a CyberArk Identity API response, returning its ``Result`` dict.

Initialize SecretsManager with proper error handling. Args: ksm_config_path (str): Path to KSM config file (optional) ks

True when input is on/off/default and resolves to default (remove key).

Return True if *accessor* matches the folder ownerInfo from sync-down.

Check if a field name indicates it contains sensitive data

Heuristically decide whether a CyberArk user dict is a service account. Accepts either the normalised dict produced by :meth:`CyberArkImporte

True when *email* matches the classic shared folder owner from sync-down. Resolution order: 1. ``owner_username`` from sync-down (primary;

Return True if ``email`` looks like a real, non-CyberArk-internal mailbox.

Return normalised secret metadata: [{'name': str, 'tags': {k: v}}]. AWS tags are converted from the native list-of-dicts format

Load device info using the 'this-device' command

Load vault data from params

Load whoami info using the 'whoami' command

Audit log: existing_password was used. Takes only the UID by design; signature is enforced by a structural test to prevent log leakage.

Present the record as a pamUser with rotation configured (ROE-eligible).

Build a minimal project dict matching the structure process_data expects.

Build a successful RouterResponse wire payload.

Open the shell pane, optionally running a command immediately

User-facing message when a share command targets the owner.

True if a PAM connection clipboard flag is enabled; coerces JSON/string booleans.

For PAM machine record types only, return a valid pamSettings.connection.port if set.

Parse a RemoveResult's impact field into a dict — shared logic.

Parse 'record-add' command output to extract record UID, share URL, or handle errors.

Parse 'HH:MM' to HHMM integer (hours*100 + minutes), e.g. '09:00' -> 900, '17:30' -> 1730.

Parse shared-folder permission suffix from ASCII tree (service ``tree``). Emits ``{"default": "...", "teams"?: ..., "users"?: ...}``

Return allowed separators in Vault order (see getPasswordRules.ts).

Perform live search and update tree. Returns count of matching records.

Call set_record_rotation(recordUid=user_uid, noop=False) to permission-check an is_iam_user link write. Raises on permission denial; no fallba

Fill ``project_result['folders']`` with the freshly-created shared folders so the post-import report shows the safe-per- folder layout

Common authentication options preparation

Validate the request body and build the command to execute.

Common credential creation options preparation

Show a user-facing notice for an involuntary remote close. Stays silent for ``normal`` / ``client`` (user-initiated). Called from the inner `

Display folder permissions in a format similar to the legacy get command.

Return identifier for error messages: uid if present, else title, else login (for users).

Get the record from the Vault, normalize it, and return it. Since common code is using this method we want to flatten/abstract the K

Deep-copy JSON and replace password values with [REDACTED].