True when AD context is set AND existing_password is NOT — gates the rm-create-user push-to-target route. See SECURITY_ARCHITECTURE.md.

True when rotation: present and rotate_on_provision is not False.

Print interactive prompt text to stderr so it's always visible and never pollutes stdout.

Stop the TOTP auto-refresh timer

Convert a base64url-encoded UID string to bytes; empty/None -> empty bytes.

Validate email section and check for email config existence.

Validate rotation section (schedule/on_demand, complexity, flags).

Clean up temporary files. Args: temp_files: List of temporary file paths to clean up

Convert conversationId to messageId format (replace + with -, / with _)

Create legacy blueprint for synchronous command execution.

Creates subfolder inside parent folder: either `user folder`, `shared folder` or `shared folder folder`. If `parent_uid == ""` then c

Return the RecordKind for a PVWA payload.

Encode a Guacamole instruction to send to the server. Args: opcode: Instruction opcode *args: Instruction ar

Extract and sort devices from API response.

Fetch audit events with pagination support. This function handles pagination for both raw and span/consolidated reports, making it suita

Fetch all vault users. Excludes component users (CPM, PSM, etc.).

Format timeout as instance of timedelta for output to console timeout_delta(timedelta): Timeout setting as instance of timedelta. Returns str

Generate ca_users_to_provision.csv content from unmatched identities. Returns CSV as a string (no file I/O — caller writes to file/attachment

Get configuration format based on existing files.

Find the highest DAGEdge version of all edge types. :param head_uid: :return:

True when settings are absent or match the vault empty/default template.

True when *value* looks like a Keeper UID (not a display name).

Return True when *folder_uid* is a Nested Share Folder.

Parse expiration time string into timedelta

Read command with support for line continuation using backslash.

Read configuration parameter from service config file.

Reads an item from a stream and returns it as a string of bytes.

Resolve a folder name, path, or UID to a Nested Share Folder UID. Delegates to the service layer's ``resolve_folder_identifier`` to avoid dup

Rewrite known noisy server validation messages in place on each response dict.

Remove passwords from import JSON for safe --output without --include-credentials.

Remove the registry file for a tunnel (defaults to current PID).

Remove a tunnel session by tube_id (thread-safe)

True when stored rotation schedule matches PAM config default (Web Vault parity).

Validate domain name format. Args: domain: Domain name to validate require_tld: If True, requires a

Admin roles prompt for confirmation on --add-role. Service Mode cannot answer that prompt, so require -f/--force (same pattern as tra

Validate file path to prevent directory traversal attacks. Args: file_path (str): Path to validate base_dir (str, option

Initialize a TunnelError. Args: message: Description of the tunnel error. code: Optional Guacamole status co

Reconstruct the CLI command from kwargs, redacting secrets.