Get and validate port configuration

Get macOS preferences path

Gather project asset UIDs/names for the import report.

Get queue mode configuration

Get rate limiting configuration

Extract record type using multiple approaches.

Get Windows registry key

Find a resource, or user, in the Vault or in the Infrastructure graph. This will return a NormalizedRecord record. This does

Helper method to map role IDs to names

Get rotation info for pamUser records from DAG and rotation cache. NOTE: This method fetches DAG data which makes API calls. This is acceptab

Get RP ID from server authentication options

Extract and sanitize request data for logging (only for JSON POST requests)

Fetch and return the payload of the latest version of a secret. *full_resource_name* is the GCP resource path ``projects/{pr

Fetch and return the value of a single secret.

Securely calculate file hash with proper error handling. Args: file_path (str): Path to file Returns: str:

Get or create Gmail API service.

Get or create ServiceConfig instance.

Determine the actual service URL (ngrok, cloudflare, or localhost) with API version path

Get platform-specific stdin reader.

Get the stored credential ID for this device

Get token expiration configuration

Get user confirmation for unregistering biometric authentication

Get local and directory users for machine. The return values will be a dictionary of record_uid to username. It will first

Get and validate command list from user input.

Get and validate user input with consistent error handling.

Go to specified line number in the tree (1-indexed like vim)

Handle color fill

Handle copy operation (copy screen region)

Handle cursor positioning

Handle error message from server

Handle layer move (not relevant for text terminal)

Handle case where multiple devices match an identifier.

Handle email sending and share link creation after successful rotation.

Handle rectangle drawing (fill with color)

Handle registration errors, including existing credential scenarios

Handle a single event from Rust.

Handle terminal size change

Handle sync instruction - refresh the display

Handle text drawing. Args format: [layer, x, y, text]

True if obj has title set by base.py when missing in JSON. base.py uses: pamUser -> PAM User - {login}; pamMachine -> PAM Machine - {login}; p

Single-byte keystroke blobs must not replace the dedupe anchor (breaks prompt pair logic).

Create of mapping of existing user services to see what was updated. This is the basically graph in dictionary format with the updat

Set up ctypes structures for ReadConsoleInputW.

Initialize platform-specific handler

Attach the content filter to the known leaky loggers AND root. Python's logger filters fire only at the originating logger (filters do NOT re

Interactive selection of credential to update

Show connection groups and let user select which to import. Returns a comma-separated pattern string for _filter_by_groups, or None i

Interactive input for new friendly name

Check if a parsed IP matches a pattern (single IP, CIDR network, or dash-range).

Check if biometric authentication is available for the user. Args: params: KeeperParams instance

True when spec is ``LEVEL.SETTING=VALUE`` (value present after ``=``).

Check if a character code is a high surrogate.

KeeperApiError carries the HTTP status code as `result_code` (or as a leading "404:" in str(err) on older paths).

Check if a character code is a low surrogate.

Check if port is already in use

True if object is a PAM resource (machine, database, directory, remote browser).

Inspired by web vault getAllowRotation (pam-enforcement-selectors.ts:30). Decision matrix: - No enforcement context (None / empty dict / no

Check if vault is completely empty (no records, no folders).

Return the keyring account key from the URL netloc; falls back to 'config' for legacy entries.

Return secret metadata only — no values fetched. Result: [{'name': str, 'tags': Dict[str, str]}] GCP labels (the equivalent

Return secret metadata only — no values fetched. Result: [{'name': str, 'tags': Dict[str, str]}] Disabled secrets are exclud

Load the DAG This will clear the existing graph. It will make web services calls to get the fresh graph, which will return a

Load OAuth credentials from config.

Load email configuration from vault. Args: config_name: Email config name params: KeeperParams session

Load credential from specific service

Load configuration from JSON file.