Ensure share command family matches target type. Classic share-* must not target NSF UIDs, and nsf-share-* must not target classic share

Initialize email sender with configuration. Args: config: EmailConfig object Raises: ValueError: If

Apply the selected theme and save preferences

Build a Permissions protobuf for share/update — single source of truth.

Resolve (password, used_existing) per cp-rotation-skip-feat: existing_password → rotation.password_complexity → DEFAULT_COMPLEXITY.

Scan running Docker containers for one with Guacamole DB env vars. Returns the container name, or raises CommandError if none found.

Dispatch a GatewayAction to the gateway and return the response.

Generic method to display results in table or JSON format.

Send an empty sync to the given PamEndpoints; expect a clean 200 (proto).

Download and decrypt all recordings in parallel, fetching keys from vault cache.

Execute a function with consistent error handling

Extract database-specific settings from pamSettings.connection (record JSON).

In headless/service mode, persistent login often needs a follow-up prompt (password, SSO, 2FA, device approval) that cannot be answered. Log once

Get the record key for a PAM config record.

Load configuration from YAML file.

Create a mock TypedRecord with an optional identityProviderUid custom field.

Create a real vault.TypedField.

Check that *secret_tags* (a plain dict) satisfies every (key, value) pair in *required_tags*. Azure and GCP both return tags/labels a

Point tunnel_registry_dir at tmp for the duration of a test.

Wrap _post_request_to_router with progressive backoff on 429 / throttle errors. Non-throttle errors propagate immediately. Final retry's exception

Rewrite folder_path roots to match actual shared folder names. Needed when edit.py adds a #N dedup suffix to the project folder, maki

Run execute() with Azure internals mocked. *secret_meta*: list of {'name', 'tags'} dicts. *value_map*: name → secret value

True when AD context is set AND existing_password is NOT — gates the rm-create-user push-to-target route. See SECURITY_ARCHITECTURE.md.

True when rotation: present and rotate_on_provision is not False.

Print interactive prompt text to stderr so it's always visible and never pollutes stdout.

Stop the TOTP auto-refresh timer

Convert a base64url-encoded UID string to bytes; empty/None -> empty bytes.

Validate email section and check for email config existence.

Validate rotation section (schedule/on_demand, complexity, flags).

Clean up temporary files. Args: temp_files: List of temporary file paths to clean up

Convert conversationId to messageId format (replace + with -, / with _)

Create legacy blueprint for synchronous command execution.

Creates subfolder inside parent folder: either `user folder`, `shared folder` or `shared folder folder`. If `parent_uid == ""` then c

Return the RecordKind for a PVWA payload.

Encode a Guacamole instruction to send to the server. Args: opcode: Instruction opcode *args: Instruction ar

Extract and sort devices from API response.

Fetch audit events with pagination support. This function handles pagination for both raw and span/consolidated reports, making it suita

Fetch all vault users. Excludes component users (CPM, PSM, etc.).

Format timeout as instance of timedelta for output to console timeout_delta(timedelta): Timeout setting as instance of timedelta. Returns str

Generate ca_users_to_provision.csv content from unmatched identities. Returns CSV as a string (no file I/O — caller writes to file/attachment

Get configuration format based on existing files.

Return record UIDs directly associated with a folder.

Find the highest DAGEdge version of all edge types. :param head_uid: :return: