Get the Nested Share Folder role label for an access entry. Prefers the stored ``access_role_type`` (proto enum int) when available; otherwis

Get the user ACL from the record linking graph.

Get or create the tube registry instance, storing it on params for reuse

Fetch the active or specified configuration for a service provider.

Get a tunnel session by tube_id (thread-safe)

Read registry files. Optionally remove dead or corrupt entries. Returns a list of dicts for tunnels whose owning process is still alive.

Try to match a CyberArk group to a Keeper team. Returns the matched Keeper team name or None if not found.

Parse CLI spec ``LEVEL``, ``LEVEL.SETTING``, or ``LEVEL.SETTING=VALUE``. Returns (level, setting_or_none, value_or_none). ``value_or_none``

Parse a FolderAccessResponse into a standard result dict.

Print a formatted header

Print a warning message

Safely copy text to clipboard, handling missing clipboard on remote/headless systems. Returns: (True, "") on success (False, erro

Pre-import validation. Returns list of warning strings.

Walk the vertices using the path and return the vertex starting at root vertex. :param path: An array of path string, or string wher

Build a Connection where header construction runs but no real crypto is needed. Uses the deprecated `encrypted_transmission_key`/`encrypted_sessi

Compute batch sizes and delay to avoid API throttling. API call costs per record (measured via instrumentation): External user: ~

Detect database type from Docker container environment variables. Returns 'mysql' or 'postgresql'.

Dispatch a GatewayAction to the gateway and return the response.

Return (folder_uid, folder_obj, folder_key) with AES-GCM encrypted data.

Return whether the client is connected or waiting.

Make API call with consistent error handling.

Build a stand-in for a PAM Configuration TypedRecord whose `pamResources` typed field carries the given resourceRef list.

Minimal KeeperParams stand-in — the helpers only use it to drive the router_helper transport, which is mocked here, so a MagicMock is enough.

Normalize PVWA host — same logic as existing CyberArkImporter (PR #1423). Returns (host, query_params) tuple. Accepted formats:

Generic paginated fetch following nextLink (ark-sdk-python pattern). Follows the server's nextLink URL for subsequent pages instead of

Print a pre-import migration estimate.

Run execute() with GCP internals mocked. *secret_meta*: list of {'name', 'tags'} dicts. *value_map*: name → secret value s

Validate account section (target system credentials).

Filter safes by --safes (include) and --exclude-safes patterns. Patterns are comma-separated and support glob matching.

Connect the vertex to the root vertex. :param edge_type: The type of edge to use for the connection. :param path: Short tag

Build HTML email for onboarding with one-time share link. Args: share_url: One-time share URL custom_message: Custom message

Aggregate safe member permissions into Keeper shared folder permission format. Merges permissions across all safes — if a user appears in multipl

True when the user currently has allow_configure_workflow_settings. When refresh=True, reloads account summary first so a mid-session policy revo

Check if enforcement is required and handle multi-factor authentication if needed. Uses priority-based authentication:

Build a generator from CLI/$GEN overrides with optional policy defaults.

Raise CommandError when `record_type` is blocked by policy.

Raise ``CommandError`` if *record_uid* is not a Nested Share Record.