Walk resource UIDs and collect resources + deduplicated top-level users. Two linking strategies are supported: 1. Standard: ``pam_se

Return the set of lowercase usernames that are service accounts.

Build TemporalAccessFilter from opts. Returns None when no temporal slice is set. startTime / endTime on TimeOfDayRange are HHMM integers (hours*

Map CyberArk username (lowercase) → best available email.

Index every pamUser / login record by lowercased title for title-based linking.

Insert a just-created folder into the local NSF cache so that subsequent segments in the same path can discover it as a parent without

Check if biometrics (face/fingerprint) are enrolled using Windows Runtime API

Check Touch ID using bioutil command

Check if cloudflare tunnel started successfully by examining the log file. Returns (success: bool, error_message: str)

Check for duplicate PAM Users using dual-check approach. Checks: 1. If DN provided: Check entire vault for same DN (prevents

Check for duplicate PAM Users by Distinguished Name (global vault search). Active Directory DNs are unique across the entire AD fore

Check for duplicate PAM Users by username in the target folder. Prevents creating the same username multiple times in the same folde

Return existing role name (for the matching access_type) or None.

Check if credential already exists for this user

Check if Gateway version meets minimum requirement.

Check Touch ID using LocalAuthentication framework

Check log content for success/failure patterns.

Remove ANSI escape codes from text.

Clean config.json by keeping only essential authentication keys

Remove dead or corrupt JSON entries under reg_dir.

Clean up expired and old completed requests.

Clean up failed Cloudflare process.

Clean up local biometric credentials (platform-specific)

Clean up macOS keychain credentials for biometric authentication

Clean up Windows credentials for biometric authentication

Delete the keychain entry for *url* if it exists. Called after switching to file storage.

Convert close reason code to snake_case name. Mirrors ``PyCloseConnectionReason`` in ``keeper-pam-webrtc-rs/src/python/enums.rs``. Co

Convert a JSON-decoded Python value to a plain string suitable for a Keeper text field, preserving semantics rather than using Python's str()

One left-to-right pass: each adjacent ``\\n\\n`` becomes a single ``\\n``. This only merges **pairs** (e.g. four consecutive LFs become two,

Collapse current node if expanded, or go to parent. Stop at root.

Return all non-deleted edges that reference record_uid as head or tail. Inactive edges (active=False) are included - they may represent settings

Build the per-graph entry for record_uid. Returns a dict with zero or more of: "vertex_active": bool - record_uid exists as a vertex in t

Walk folder tree and fill path_to_uid. path_prefix e.g. 'gwapp', tree is shf['folder_tree']. If only_existing, only add when node['uid'] is non-em

Collect records from user folders only, avoiding shared folders.

Recursively collect all string values from a value (str, list, or dict).

Return a list of (label, value) tuples for sharing/access metadata present on the given item dict. ``prefix`` is prepended to labels for neste

Resolve every ``-e`` value into a list of ``(identifier, is_team)`` tuples. Mirrors legacy ``share-folder``: each entry is auto-classified as

Classify every non-owner share into updates, creates, revokes, or skipped. Buckets: - ``updates`` — direct shares whose role diffe

Configure queue enabled setting with user prompt.

Configure run mode with user prompt.

Configure Rust logger levels based on debug mode. Args: current_is_debug: Whether debug mode is currently enabled log_level:

Configure tunneling and TLS with logical flow: 1. If ngrok = yes → Skip cloudflare and TLS (ngrok provides public access with SSL)

Prompt user for confirmation before deleting alerts.

Confirm the update operation

Show warning and get user confirmation.

Map a control character (code < 32) to an X11 keysym.

Return (x_count, y_count, existing_paths_set, new_nodes_list). existing_paths_set = set of full paths that exist (all segments have uid). new_

Create a request to add a user to a team with proper encryption

Create assertion object for verification

Create WebAuthn assertion response

Create authentication response

Create base record structure.

Create client device and return b64 config

Create a config record or return existing one

Create WebAuthn credential response

Create DAG relationship linking PAM User to PAM Config. This establishes the 'belongs_to' relationship that tells the rotati

Create one Keeper Enterprise Role per CyberArk user group. Mirrors the ``enterprise-role --add`` command flow: allocates a fresh ente

Provision Keeper Enterprise users from valid CyberArk users and add them to matching Roles.