Detect database type from Docker container environment variables. Returns 'mysql' or 'postgresql'.

Return (folder_uid, folder_obj, folder_key) with AES-GCM encrypted data.

Show safes and let user select which to import. Returns comma-separated safe names for apply_safe_filter, or None to import all.

Return whether the client is connected or waiting.

Make API call with consistent error handling.

Build a stand-in for a PAM Configuration TypedRecord whose `pamResources` typed field carries the given resourceRef list.

Minimal KeeperParams stand-in — the helpers only use it to drive the router_helper transport, which is mocked here, so a MagicMock is enough.

Normalize PVWA host — same logic as existing CyberArkImporter (PR #1423). Returns (host, query_params) tuple. Accepted formats:

Generic paginated fetch following nextLink (ark-sdk-python pattern). Follows the server's nextLink URL for subsequent pages instead of

Print a pre-import migration estimate.

Run execute() with GCP internals mocked. *secret_meta*: list of {'name', 'tags'} dicts. *value_map*: name → secret value s

Strip C0/C1 control characters (incl. ESC) from attacker-supplied text.

Validate account section (target system credentials).

Filter safes by --safes (include) and --exclude-safes patterns. Patterns are comma-separated and support glob matching.

Connect the vertex to the root vertex. :param edge_type: The type of edge to use for the connection. :param path: Short tag

Build HTML email for onboarding with one-time share link. Args: share_url: One-time share URL custom_message: Custom message

Aggregate safe member permissions into Keeper shared folder permission format. Merges permissions across all safes — if a user appears in multipl

Check if enforcement is required and handle multi-factor authentication if needed. Uses priority-based authentication:

Build a generator from CLI/$GEN overrides with optional policy defaults.

Raise CommandError when `record_type` is blocked by policy.

Raise ``CommandError`` if *record_uid* is not a Nested Share Record.

Get PAM configuration records. The default it to find all the record version 6 records. If the environment variable `PAM_REC

This method will return the proper connection based on the params passed in. If `ksm` and a KDNRM KSM instance, it will connect using keeper

Get user's public key from cache / enterprise / API. Returns: (public_key_object, use_ecc, user_uid_bytes, needs_invite)

Return True if a process with the given PID is still running.

Load EmailConfig from a Keeper record. Args: params: KeeperParams session record_uid: Record UID Returns: Email

Build a fake HTTP 200 response with empty body.

Remember that (host, endpoint) reported HTTP 404 (endpoint not deployed). Subsequent `is_layer_b_feature_disabled(host, endpoint)` calls return T

Replace legacy server terminology in user-facing error text.

Normalize ``GET .../master-rotation-policy/exceptions/`` payloads. CyberArk ISPSS returns:: { "exceptions": [

Pick which linked account populates Keeper's administrative_credentials slot. CyberArk has three linked-account roles (logon, reconcile, enable)

Resolve linked accounts (logon, reconcile, enable) for an account. Fetches the full account details to get linkedAccounts, then fetches each

Encrypts data using the symmetric key

Ensure resource vertex meta has version >= 1 so vault reads ACL launch credentials.

Validate encryption private key

Validate Ngrok authentication token

Validate rate limiting format