Remove an encryption key for a conversation ID (thread-safe)

Validate Cloudflare tunnel token

Validate domain name format and requirements. Returns: tuple: (is_valid, normalized_domain, error_message_or_None)

Restrict enterprise-role to admin/privilege ops only. Uses Commander's ``enterprise_role_parser`` so ``--add-user``, ``--add

Create a root-level shared folder via folder_add (allows duplicate display names). Bypasses FolderMakeCommand/mkdir, which refuses to create

Helper: run RecordAddCommand field-scaffolding logic directly.

Build minimal RecordMetadata for removal (only UID needed).

Simulate the schema-building loop in prepare_record_add_or_update.

Build a Commander Connection with crypto bypassed for end-to-end URL assertions.

Retry *fn* with progressive backoff when the API returns throttled.

Enforce a folder permission for the current user. Behaviour: * If the cache has no access entries for *folder_uid* at all, skip the

Enforce a record permission for the current user. Same fail-closed semantics as :func:`_check_folder_permission`.

Return 'service' or 'interactive' for Privilege Cloud authentication.

Return structured classic SF share perms and compact text suffix. Tree text uses a single ``default:`` blob (all default flags). JSON splits

Normalize *mode_value* to ``kcm`` or ``guacd``; unknown/empty → :data:`DEFAULT_PIXEL_MODE`.

Complete SSO / external IdP authentication after StartAuthentication. Opens the IdP redirect URL in the browser, then either: - pol

Compute optimal batch parameters from probe results. The API rate limit is global (~50 calls before HTTP 403 on EU). Batch sizes are

Create a config record, or reuse an owned one with the same title in the folder.

Create a KSM app, or reuse an owned app with the same title.

Create a shared folder, or reuse one owned by this account with the same name.

Return the base64url-encoded account UID for the current session, or ''.

Decrypt record-key-encrypted data from gateway response.

Display Secrets Manager application details

Download, decrypt, and save a single recording file. Returns (filename, bytes_written, error).

Return Guacamole handshake DPI for *pixel_mode*. Must stay aligned with :func:`approximate_pixels` cell metrics: - ``guacd`` → :data:`_GUACD

Produce a CNAPP queue payload byte string the way the Encrypter would so we can exercise `_decrypt_cnapp_payload` end-to-end without mocking AES-G

Extract Telnet-specific settings from pamSettings.connection (record JSON).

Shared GET helper for the ``/api/platforms/{id}/<suffix>/`` family.

Find the PAM config UID associated with a gateway.

Return an owned shared folder UID with this name, or None.

Return an owned KSM app with this title, or None (ignores non-owned squats).

Return UIDs of every project wrapper user-folder under ``PAM Environments`` whose name matches ``project_name`` (or ``project_name #N`

Get the past tense verb for the action.

Extract (hostName, port) from a record's pamHostname or host typed fields. Requires a non-empty hostName on exactly one such field. Port com

Find the launch credential UID for a PAM record using the DAG. When a pamMachine record has both administrative credentials and launch crede

Return list of (record_uid, title, record_type, login) for records in folder_uid.

Get secret by UID first, then by title as fallback. Args: secrets_manager: Initialized SecretsManager instance record_id

Handle service shutdown.

Check if any operations were successful.

Return True if *access* belongs to the currently logged-in user. Matches by ``username`` first (the populated case after a successful user-ca

Check if a record should be displayed in normal folder structure. Excludes file attachments, linked records, and Secrets Manager app records.

Return True if *url* refers to the OS-native keychain backend.

Validate password complexity format: length,upper,lower,digit,special

Validate share URL expiry format. Valid formats: <number>d (days), <number>h (hours), <number>mi (minutes) Examples: 7d, 24h

Check if a record is a valid PAM record type. Args: params: KeeperParams instance record_uid: Record UID to

Yield every TypedField from both record.fields and record.custom.

Port of Admin Console getKSMBillingCycle (yearly/enterprise path). Returns (min_epoch_sec, max_epoch_sec) for the current billing cycle, or No

List safes with details for --list-safes output.

Normalize a value for comparison (sort lists so ordering doesn't matter).