True for ``--flag``, ``-f``, or ``--flag=value`` forms.

Parse commands that primarily use logging.info() for output.

Parse ASCII ``tree`` into the legacy service-mode flat structure. Distinct from ``tree --format=json`` (``_parse_json_format_command``).

Prepare a record to be added. :param record_prepare_func: Function to call to prepare a record to be created. :param bulk_ad

Print pre-import summary with folder hierarchy for user review.

Backward-compatible alias for tests and external callers.

Render a primitive key-value pair.

Send a request, scoping private-CA TLS warning suppression per call.

Return the effective pixel mode, consulting env when *pixel_mode* is None. Unknown strings (including env typos) become :data:`DEFAULT_PIXEL_MODE

Try to resolve a base64-url team UID to a human-readable team name.

Send a key press and release event. Args: keysym: X11 keysym value

Mirror Console checkDateChangeRisk: set month (0-based) + year, clamping day to month length.

Set a value in a nested dict using a dotted key path.

Set the client state, firing onstatechange if changed. Args: state: The new client state.

Show updated device list after an action.

Advance past an unrecognized flag and an optional value token.

Try AES-256-GCM then AES-256-CBC with *sym_key*. Returns plaintext or None.

Best-effort call to a CyberArk Identity endpoint that may or may not be available on a given tenant.

Get the resource vertex for this user vertex that handles rotation. using the user's record UID.

Attach the standard five filter arguments to *parser*.

Build the pam project extend JSON (pam_data only).

Build DAG resource meta payload in v1 format so vault uses ACL is_launch_credential for launch. Returns dict: {"version": <int>, "allowedSett

Pre-launch workflow gate: validate, auto-handle no_workflow/needs_action/ready_to_start, prompt for MFA, and return flow UID + lease expiry. With

Classify a single ``-e/--email`` value as a user or a team. Mirrors the legacy ``share-folder`` resolution exactly: 1. If *recipient* match

Cleanup resources

Test helper — wipe the (host, endpoint) cache.

Clean up resources held by this Infrastructure instance. Releases the DAG instance and connection to prevent memory leaks.

Simple confirmation through user input msg(str): Message expecting a yes or no answer Returns True if answer is "yes" and False otherwise.

Create and configure the Keeper Commander Service.

Create a generator that satisfies the given password complexity enforcement policy.

Create a new output stream. Returns: A new OutputStream with an allocated index.

Create a v6 PAM configuration in *folder_uid* using NSF or classic placement.

Convert CyberArk PasswordChangeDays → Quartz 6-field CRON string. Keeper's rotation engine validates expressions with ``validate_cron

Convert a string, dict, or list of dicts to snake case. :param str_or_iter: A string or iterable. :type str_or_iter: Union[list, dict,

Guesses AES cipher (EBC or CBD) from the length of the plain data.

Decodes a hex encoded string into raw bytes.

Return unique specs in first-seen order and warnings for duplicate CLI options. ``option_label`` is shown in warnings (e.g. ``--set/-s``).

Build a mapping of safeUrlId → sanitized folder name, deduplicating collisions. Returns dict: { safeUrlId: "FolderName" }

Detect the connection protocol from a PAM record. All machine types (pamMachine, pamDirectory, pamDatabase) allow any connection type (s

Encrypt *plaintext_key* using the best available team key. Mirrors legacy ``share-folder``: prefer the team AES key when *prefer_aes* is set,

Encrypt record_key with encryption_key; returns (ciphertext, key_type).

Load params from config if not already loaded.