Upload config.json to KSM record, removing existing ones first. Args: ksm_config_path (str): Path to KSM config file (optional)

Validate action name.

Validate a list of alias names and check none equals the domain. Returns a list of normalized alias strings on success, or None if any

Validate API response structure.

Validate device identifier for security and format.

Validate and filter a list of device identifiers.

Validate enterprise user ID.

Validate password as a vault-style passphrase per policy passphrase-* fields.

Reject finite expirations that are less than one minute.

Pre-flight: validate team UIDs in workflow approvers for all resources. Uses RecordResolver.validate_team which checks both team_cache and enterpr

Set stdin console handle to raw mode for ReadConsoleInputW: - Clear ENABLE_PROCESSED_INPUT so Ctrl+C is read as 0x03, not SIGINT. - C

Restore stdin console mode from win_stdin_disable_ctrl_c_process_input.

Build a mock BaseFolderNode.

Compare two Commander version versions and will return: 1 if version 1 is bigger 0 if equal -1 if version 2 is bigger

Access keychain item with authentication

Throttle detected — reduce the offending type's batch size and increase its delay. The other type is left untouched.

Clean batch — potentially increase the current type's throughput.

This is client side check if we should skip prompting the user. The checks are * A directory with the same domain already ha

Add expiration details to the record via interactive prompt.

Add filter data to table for single alert view.

Add recipient data to table for single alert view.

Maps PAM graph allowedSettings to JSON keys matching pam config edit/new flags.

Analyze tunnel log content for success/failure indicators. Returns (success: Optional[bool], error_message: str) - True: Succ

VT sequences to undo common fullscreen TUI state (nano, vim, etc.).

Set expiration / notification fields on a TLAProperties proto.

Attach sharing/access metadata and folder placement to ``record``.

Return a stable identity key for an existing server approver (for reconcile diff). Server may return either user (email) or userId (int). When use

Authenticate with Touch ID and return the credential data

Copy selected text to clipboard if any.

Execute many GET requests using Microsoft Graph JSON batching. Combines up to BATCH_SIZE requests into a single call to /$batch, which

Build a single alert row for the table.

Build encrypted ConnectAs payload for credential passing to gateway. The ConnectAs payload contains user credentials from a pamUser record,

Build a mapping item_key -> list[folder_dict] for every secured item / app that's listed as a member of any folder.

Build connection settings for Guacamole handshake in PythonHandler mode. When guacd sends 'args' instruction requesting connection parameter

Build MSAL confidential client application.

Build pre_delete request from batch of objects.

Parse preview results — works for both record and folder removal.

Build recipient data dictionary.

Make a lookup cache for all the records. This is used to flag discovered items as existing if the record has already been added. Thi