Create KSM app or return existing one

Create PAM User record. Args: config: Validated configuration password: Generated password param

Phase 1: Create PAM project skeleton (folders, KSM app, gateway, PAM config) without records. Returns (config_uid, gateway_token) whe

Create registration response

Create shared folder or return existing one

Create data to be signed for WebAuthn

Create platform-specific storage handler

Create an import report record with copyable fields and the full report as a file attachment. Placed at the project's top-level folde

Create temporary directory for KSM config with proper fallback. Returns: str: Path to created directory, or None if failed

Decode base64 config and save to file. Args: base64_input (str): Base64-encoded JSON config config_path (str): Path wher

Decrypt DATA edges At this point, all the vertex should have an encrypted key. This key is used to decrypt the DATA edge's c

Decrypt KEY/ACL edges Part one is to decrypt the KEY and ACL edges. To decrypt the edge, we need to walk up the edges until

Decrypt Nested Share Folder folder and record keys.

Decrypt all Nested Share Folder record keys, trying multiple sources.

Decrypt record data using the record key and store data_json.

Pick the default generation separator matching Vault / PowerCommander.

Delete AD user via Gateway for rollback (KC-1035).

Handle delete all with --all flag.

Delete a single batch of objects.

Delete biometric authentication flag for user

Handle range deletion with --from and --to parameters.

Delete all empty user folders after records have been deleted. Args: params: KeeperParams instance

Delete any existing config.json attachments to prevent duplicates

Generic batch deletion handler for records.

Delete a path-scoped self-loop DATA edge via GSE_DELETION (vault ``createDeletionEvent``). Returns: True if a DELETION edge was written,

Handle single target deletion.

Detect if the escape buffer contains a known escape sequence. Returns: X11 keysym if sequence is recognized and complete

This method will find the directory in the Infrastructure graph or in the Vault. If the domain contains more than one DC, the domain

Disable the specific passkey stored for this device

Disable a specific passkey by credential ID

Display admin devices in a compact table format.

Display credentials in table format

Display folder/shared folder as JSON with clickable values

Display JSON view with clickable string values, syntax highlighting, masking passwords

Render a Nested Share Folder ``parent_uid`` for display.

Display deletion summary.

Display user devices in a compact table format.

Actual restoration — runs on the grace-period timer thread.

Return whether a domain text kwarg should be applied to the record. pam config new only sets non-empty values; omitted or empty strings are s

Download cloudflared binary if not available. Returns path to cloudflared binary.

Draw text at specified position in screen buffer

Remove at most one leading and at most one trailing ``\\n\\n`` pair (each -> single ``\\n``). ``_collapse_adjacent_lf_pairs`` already handle

Encrypt data using ECIES with HKDF key derivation. This implements ECIES (Elliptic Curve Integrated Encryption Scheme) using: - SECP256R

Return ``[{"Username", "Email"}]`` for users eligible for Keeper provisioning.

Ensure folder exists, create if needed (creating nested folders level by level). Args: folder_path: Folder path (e.g., "

Ensure the SDP offer advertises the same max-message-size attribute as Web Vault. Args: sdp_offer: Original SDP offer string returne

Return ``(team_names, role_names, user_status)`` already in the enterprise. ``team_names`` / ``role_names`` are sets of lowercase names; ``us

True if any of the load-bearing fields differ between two entries.

Map an ANSI escape sequence (without leading ESC) to an X11 keysym.

Apply permission changes in batched REST calls (up to 200 per request). ``updates`` use ``updateSharingPermissions`` (modify a direct share);

Execute the specified command. Args: args: Parsed command line arguments Returns: bool: True if successful,

Execute vim-style command (e.g., :20 to go to line 20) or open shell with command

Execute the actual deletion of alerts and return count of successfully deleted alerts.

Execute the actual deletion after pre_delete.

Handle `search <pattern> --device`: resolve Gateway(s), print info + bound PAM Configs.

Worker function that executes the command and returns the result.

Internal method to run SuperShell

Execute view all alerts functionality.

Execute view single alert functionality.

Expand ``@existing`` / ``@current`` into all users and teams currently on the folder, excluding the caller. Mirrors legacy behaviour (

Extract assertion response from various result types

Extract base64-encoded client data

Attempt to return edge content as a serialisable value. For most edges the DAG's built-in decryption (decrypt=True default) is sufficient and