Find an open port in the range [start_port, end_port]. The default range is from 49,152 to 65,535, which are the "ephemeral ports" or "dynami

Does this vertex have the passed in vertex? :return: True if request vertex belongs to this vertex. False if it doe

Minimal KeeperParams mock — these validator tests must not trigger vault/api lookups, so the configs avoid directory_uid / delivery.share_to.

Try to match a CyberArk user to a Keeper user. Returns the matched Keeper email or None if not found.

Resolve the Identity Provider config UID from a PAM configuration. Reads the 'identityProviderUid' custom text field on the PAM config record.

Sanitize a CyberArk safe name for use as a Keeper folder name. - Strip/replace characters not allowed in folder names - Truncate to MAX_SAFE_

Validate email configuration completeness. Returns: List of validation error messages (empty if valid)

Format elements into a Guacamole instruction.

Generate secure random password using Commander's built-in generator. This is a critical security feature. Commander generates passw

Check if host is a local/private address (no SSL warning needed). Only trusts literal IP addresses and 'localhost'. Does NOT resolve

Return milliseconds. Raises CommandError on invalid/non-positive value. Delegates to WorkflowFormatter.parse_duration; adds a None -> default-

Rollback created records on critical failure. Cleans up partially-created resources when provisioning fails at a critical st

Send Guacamole data back to gateway via Rust. Uses send_handler_data() which routes through the WebRTC channel.

Build the pam project import JSON from mapped records.

Convert bytes to a URL-safe base64 encoded string. Args: b (bytes): The bytes to be encoded. Returns: str: The URL-safe

Find email config record by name. Args: params: KeeperParams session name: Name of email configuration Returns:

Resolve an SSO service provider by ID or name from enterprise data.

Format seconds as 'Xm Ys'. Handles negative, inf, nan.

Get a record dict from nested_share_records or record_cache.

Retrieve the unencrypted record key from nested_share_records or record_cache.

GET helper that surfaces connection errors as a graceful warning instead of a stack trace. Returns the ``requests.Response`` on success, or `

Map CyberArk permission booleans to Keeper shared folder permissions. Returns dict with keys: manage_users, manage_records, can_edit, can_sha

Parse a RecordSharing.Status protobuf into a result dict.

Parse timeout input to return instance of timedelta timeout_input(str): String to parse for one or more integer values followed by time unit name

Record a completed batch and adapt parameters if needed. Throttle detection is purely timing-based: if the batch took more than THROT

Return server-assigned rotation revision from cache, syncing when missing (not sequential). NSF rotations may not yet arrive via sync_down into `

Sync full or partial data down to the client

Remove any dynamically mounted clickable field widgets

Helper to encode YAML string to base64.

Build a DAG with a mocked connection so we can assert sync wiring. Skips real load — caller invokes _sync_legacy / _sync_per_graph directly.

Validate that the PVWA host is not targeting internal/private addresses (SSRF protection).

Build structured post-import report matching the spec.

Connect to the Guacamole server. Args: data: Arbitrary connection data to send during handshake. Raises:

Create default configuration structure.

Log storage operation errors consistently

Raise ``CommandError`` if *folder_uid* is not a Nested Share Folder.

Get the user ACL from the record linking graph.

Create a real RestApiContext with QRC disabled to simplify mocking.

Create a minimal ApiRequestPayload for execute_rest.

Parse ``--expire-at`` / ``--expire-in`` into a millisecond timestamp. Returns *None* if neither argument is provided, or ``-1`` for ``'never'``.

Remove ANSI color codes from text

Validate port number

Construct a TunnelDAG without going through __init__ (which needs network setup).

Clean KCM autofill-configuration JSON for Keeper RBI. Keeper RBI uses the same JSON array format as KCM/Guacamole: [{"page": "*.exa

Generate dry-run report showing what would be created. PII (names, emails) are partially masked for security. The value of a

Instantiate `cls`, force the lazy `dag` property, return the kwargs passed to the patched `DAG(...)` constructor.

Build a serialized GraphSyncMultiResult. per_stream: list of (stream_id bytes, sync_point int, has_more bool, data_items