Pick which linked account populates Keeper's launch_credentials slot. CyberArk PSM uses the logonAccount to establish the initial connection

Print a warning message

Report status codes from list of folder_pb2.*Response.

Resolve a team name/UID to ``(team_uid_b64, team_uid_bytes)`` or ``None``.

Resolve an email or base64-url UID to raw UID bytes. Lookup order: user_cache → enterprise users → base64 decode. Returns None when the ident

Save configuration to file.

Return rotation schedule list from a PAM configuration defaultRotationSchedule field.

Send email via SMTP. Args: to: Recipient email address subject: Email subject body: Email body

Acknowledge receipt of data on a stream. Args: stream_index: The index of the stream. message: Human-readabl

Save JIT settings on a PAM resource. Primary path: POSTs the encrypted settings to krouter's `/api/user/configure_resource` (Layer-B, pe

Start reading input in a background thread.

Log one line with total elapsed (e.g. at end of tunnel open or command).

Remove an encryption key for a conversation ID (thread-safe)

Validate Cloudflare tunnel token

Validate domain name format and requirements. Returns: tuple: (is_valid, normalized_domain, error_message_or_None)

Restrict enterprise-role to admin/privilege ops only. Returns an error message when blocked, or None when allowed (including

Warn when $GEN is used with a label like Password= instead of password=.

Helper: run RecordAddCommand field-scaffolding logic directly.

Build minimal RecordMetadata for removal (only UID needed).

Simulate the schema-building loop in prepare_record_add_or_update.

Build a Commander Connection with crypto bypassed for end-to-end URL assertions.

Enforce a folder permission for the current user. Behaviour: * If the cache has no access entries for *folder_uid* at all, skip the

Enforce a record permission for the current user. Same fail-closed semantics as :func:`_check_folder_permission`.

Return structured classic SF share perms and compact text suffix. Tree text uses a single ``default:`` blob (all default flags). JSON splits

Normalize *mode_value* to ``kcm`` or ``guacd``; unknown/empty → :data:`DEFAULT_PIXEL_MODE`.

Compute optimal batch parameters from probe results. The API rate limit is global (~50 calls before HTTP 403 on EU). Batch sizes are

Return the base64url-encoded account UID for the current session, or ''.

Display Secrets Manager application details

Download, decrypt, and save a single recording file. Returns (filename, bytes_written, error).

Return Guacamole handshake DPI for *pixel_mode*. Must stay aligned with :func:`approximate_pixels` cell metrics: - ``guacd`` → :data:`_GUACD

Produce a CNAPP queue payload byte string the way the Encrypter would so we can exercise `_decrypt_cnapp_payload` end-to-end without mocking AES-G

Extract Telnet-specific settings from pamSettings.connection (record JSON).

Shared GET helper for the ``/api/platforms/{id}/<suffix>/`` family.

Find the PAM config UID associated with a gateway.

Return UIDs of every project wrapper user-folder under ``PAM Environments`` whose name matches ``project_name`` (or ``project_name #N`

Get the past tense verb for the action.

Extract (hostName, port) from a record's pamHostname or host typed fields. Requires a non-empty hostName on exactly one such field. Port com

Find the launch credential UID for a PAM record using the DAG. When a pamMachine record has both administrative credentials and launch crede

Return list of (record_uid, title, record_type, login) for records in folder_uid.

Get secret by UID first, then by title as fallback. Args: secrets_manager: Initialized SecretsManager instance record_id

Handle service shutdown.

Check if any operations were successful.

Return True if *access* belongs to the currently logged-in user. Matches by ``username`` first (the populated case after a successful user-ca

Check if a record should be displayed in normal folder structure. Excludes file attachments, linked records, and Secrets Manager app records.

Return True if *url* refers to the OS-native keychain backend.

Validate password complexity format: length,upper,lower,digit,special

Validate share URL expiry format. Valid formats: <number>d (days), <number>h (hours), <number>mi (minutes) Examples: 7d, 24h

Check if a record is a valid PAM record type. Args: params: KeeperParams instance record_uid: Record UID to

Yield every TypedField from both record.fields and record.custom.

Port of Admin Console getKSMBillingCycle (yearly/enterprise path). Returns (min_epoch_sec, max_epoch_sec) for the current billing cycle, or No

List safes with details for --list-safes output.