Get PAM configuration records. The default it to find all the record version 6 records. If the environment variable `PAM_REC

This method will return the proper connection based on the params passed in. If `ksm` and a KDNRM KSM instance, it will connect using keeper

Return record UIDs directly associated with a folder.

Get user's public key from cache / enterprise / API. Returns: (public_key_object, use_ecc, user_uid_bytes, needs_invite)

Return True if a process with the given PID is still running.

Load EmailConfig from a Keeper record. Args: params: KeeperParams session record_uid: Record UID Returns: Email

Load record metadata from cache, falling back to the v3 details API. Returns a dict with keys: ``title``, ``type``, ``fields``, ``custom`

Build a fake HTTP 200 response with empty body.

Remember that (host, endpoint) reported HTTP 404 (endpoint not deployed). Subsequent `is_layer_b_feature_disabled(host, endpoint)` calls return T

Make an MD5 signature of this ACL. Dictionary keys and list items are sorted so the signature is repeatable regardless of th

Replace legacy server terminology in user-facing error text.

Parse with a Commander parser; None when argparse rejects the argv.

Normalize ``GET .../master-rotation-policy/exceptions/`` payloads. CyberArk ISPSS returns:: { "exceptions": [

Pick which linked account populates Keeper's administrative_credentials slot. CyberArk has three linked-account roles (logon, reconcile, enable)

Validate transfer-user and append ``--target-user`` from config. Non-transfer commands return ``(command, None)``. On valida

Resolve linked accounts (logon, reconcile, enable) for an account. Fetches the full account details to get linkedAccounts, then fetches each

Keep only SailPoint-allowed commands; always drop banned ones. Also ensures the full SailPoint allowlist is present so required

Sanitize sensitive data from debug output.

Encrypts data using the symmetric key

Ensure resource vertex meta has version >= 1 so vault reads ACL launch credentials.

Validate command list against available Keeper Commander commands.

Validate encryption private key

Validate Ngrok authentication token

Validate rate limiting format

Ensure share command family matches target type. Classic share-* must not target NSF UIDs, and nsf-share-* must not target classic share

Initialize email sender with configuration. Args: config: EmailConfig object Raises: ValueError: If

Apply the selected theme and save preferences

Build a Permissions protobuf for share/update — single source of truth.

Resolve (password, used_existing) per cp-rotation-skip-feat: existing_password → rotation.password_complexity → DEFAULT_COMPLEXITY.

Scan running Docker containers for one with Guacamole DB env vars. Returns the container name, or raises CommandError if none found.

Generic method to display results in table or JSON format.

Send an empty sync to the given PamEndpoints; expect a clean 200 (proto).

Download and decrypt all recordings in parallel, fetching keys from vault cache.

Execute a function with consistent error handling

Extract database-specific settings from pamSettings.connection (record JSON).

In headless/service mode, persistent login often needs a follow-up prompt (password, SSO, 2FA, device approval) that cannot be answered. Log once

Get the record key for a PAM config record.

True when record_owner_cache marks the record as owned by this account.

True when the shared folder is owned by the current account.

Load configuration from YAML file.

Create a mock TypedRecord with an optional identityProviderUid custom field.

Check that *secret_tags* (a plain dict) satisfies every (key, value) pair in *required_tags*. Azure and GCP both return tags/labels a

Point tunnel_registry_dir at tmp for the duration of a test.

Wrap _post_request_to_router with progressive backoff on 429 / throttle errors. Non-throttle errors propagate immediately. Final retry's exception

Rewrite folder_path roots to match actual shared folder names. Needed when edit.py adds a #N dedup suffix to the project folder, maki

Run execute() with Azure internals mocked. *secret_meta*: list of {'name', 'tags'} dicts. *value_map*: name → secret value