Validate transfer-user and append ``--target-user`` from config. Non-transfer commands return ``(command, None)``. On valida

Resolve linked accounts (logon, reconcile, enable) for an account. Fetches the full account details to get linkedAccounts, then fetches each

Keep only SailPoint-allowed commands; always drop banned ones. Also ensures the full SailPoint allowlist is present so required

Encrypts data using the symmetric key

Update a PAM record via NSF v3 API or classic record_management.

Ensure resource vertex meta has version >= 1 so vault reads ACL launch credentials.

Validate encryption private key

Validate Ngrok authentication token

Validate rate limiting format

Ensure share command family matches target type. Classic share-* must not target NSF UIDs, and nsf-share-* must not target classic share

Initialize email sender with configuration. Args: config: EmailConfig object Raises: ValueError: If

Apply the selected theme and save preferences

Build a Permissions protobuf for share/update — single source of truth.

Resolve (password, used_existing) per cp-rotation-skip-feat: existing_password → rotation.password_complexity → DEFAULT_COMPLEXITY.

Scan running Docker containers for one with Guacamole DB env vars. Returns the container name, or raises CommandError if none found.

Generic method to display results in table or JSON format.

Send an empty sync to the given PamEndpoints; expect a clean 200 (proto).

Download and decrypt all recordings in parallel, fetching keys from vault cache.

Execute a function with consistent error handling

Extract database-specific settings from pamSettings.connection (record JSON).

In headless/service mode, persistent login often needs a follow-up prompt (password, SSO, 2FA, device approval) that cannot be answered. Log once

Get the record key for a PAM config record.

True when record_owner_cache marks the record as owned by this account.

True when the shared folder is owned by the current account.

Load configuration from YAML file.

Create a mock TypedRecord with an optional identityProviderUid custom field.

Create a real vault.TypedField.

Check that *secret_tags* (a plain dict) satisfies every (key, value) pair in *required_tags*. Azure and GCP both return tags/labels a

Point tunnel_registry_dir at tmp for the duration of a test.

Wrap _post_request_to_router with progressive backoff on 429 / throttle errors. Non-throttle errors propagate immediately. Final retry's exception

Rewrite folder_path roots to match actual shared folder names. Needed when edit.py adds a #N dedup suffix to the project folder, maki

Run execute() with Azure internals mocked. *secret_meta*: list of {'name', 'tags'} dicts. *value_map*: name → secret value

True when AD context is set AND existing_password is NOT — gates the rm-create-user push-to-target route. See SECURITY_ARCHITECTURE.md.

True when rotation: present and rotate_on_provision is not False.

Print interactive prompt text to stderr so it's always visible and never pollutes stdout.

Stop the TOTP auto-refresh timer

Convert a base64url-encoded UID string to bytes; empty/None -> empty bytes.

Validate email section and check for email config existence.

Validate rotation section (schedule/on_demand, complexity, flags).

Clean up temporary files. Args: temp_files: List of temporary file paths to clean up

Convert conversationId to messageId format (replace + with -, / with _)

Create legacy blueprint for synchronous command execution.

Creates subfolder inside parent folder: either `user folder`, `shared folder` or `shared folder folder`. If `parent_uid == ""` then c

Return the RecordKind for a PVWA payload.

Encode a Guacamole instruction to send to the server. Args: opcode: Instruction opcode *args: Instruction ar