Safely copy text to clipboard, handling missing clipboard on remote/headless systems. Returns: (True, "") on success (False, erro

Pre-import validation. Returns list of warning strings.

Walk the vertices using the path and return the vertex starting at root vertex. :param path: An array of path string, or string wher

Build a Connection where header construction runs but no real crypto is needed. Uses the deprecated `encrypted_transmission_key`/`encrypted_sessi

Compute batch sizes and delay to avoid API throttling. API call costs per record (measured via instrumentation): External user: ~

Detect database type from Docker container environment variables. Returns 'mysql' or 'postgresql'.

Dispatch a GatewayAction to the gateway and return the response.

Return (folder_uid, folder_obj, folder_key) with AES-GCM encrypted data.

Show safes and let user select which to import. Returns comma-separated safe names for apply_safe_filter, or None to import all.

Return whether the client is connected or waiting.

Make API call with consistent error handling.

Build a stand-in for a PAM Configuration TypedRecord whose `pamResources` typed field carries the given resourceRef list.

Minimal KeeperParams stand-in — the helpers only use it to drive the router_helper transport, which is mocked here, so a MagicMock is enough.

Normalize PVWA host — same logic as existing CyberArkImporter (PR #1423). Returns (host, query_params) tuple. Accepted formats:

Generic paginated fetch following nextLink (ark-sdk-python pattern). Follows the server's nextLink URL for subsequent pages instead of

Print a pre-import migration estimate.

Run execute() with GCP internals mocked. *secret_meta*: list of {'name', 'tags'} dicts. *value_map*: name → secret value s

Validate account section (target system credentials).

Filter safes by --safes (include) and --exclude-safes patterns. Patterns are comma-separated and support glob matching.

Connect the vertex to the root vertex. :param edge_type: The type of edge to use for the connection. :param path: Short tag

Build HTML email for onboarding with one-time share link. Args: share_url: One-time share URL custom_message: Custom message

Aggregate safe member permissions into Keeper shared folder permission format. Merges permissions across all safes — if a user appears in multipl

True when the user currently has allow_configure_workflow_settings. When refresh=True, reloads account summary first so a mid-session policy revo

Check if enforcement is required and handle multi-factor authentication if needed. Uses priority-based authentication:

Build a generator from CLI/$GEN overrides with optional policy defaults.

Raise CommandError when `record_type` is blocked by policy.

Raise ``CommandError`` if *record_uid* is not a Nested Share Record.

Get PAM configuration records. The default it to find all the record version 6 records. If the environment variable `PAM_REC

This method will return the proper connection based on the params passed in. If `ksm` and a KDNRM KSM instance, it will connect using keeper

Get user's public key from cache / enterprise / API. Returns: (public_key_object, use_ecc, user_uid_bytes, needs_invite)

Return True if a process with the given PID is still running.

Load EmailConfig from a Keeper record. Args: params: KeeperParams session record_uid: Record UID Returns: Email

Build a fake HTTP 200 response with empty body.

Remember that (host, endpoint) reported HTTP 404 (endpoint not deployed). Subsequent `is_layer_b_feature_disabled(host, endpoint)` calls return T

Make an MD5 signature of this ACL. Dictionary keys and list items are sorted so the signature is repeatable regardless of th

Replace legacy server terminology in user-facing error text.

Parse with a Commander parser; None when argparse rejects the argv.

Normalize ``GET .../master-rotation-policy/exceptions/`` payloads. CyberArk ISPSS returns:: { "exceptions": [

Pick which linked account populates Keeper's administrative_credentials slot. CyberArk has three linked-account roles (logon, reconcile, enable)