This method will add items to the bulk_add_records queue to be added by the client. These are items where the rule engine has flagge

Treat denied folder accesses as inaccessible: clear access + cached key.

Store folder access entries grouped by folder UID.

Delete all empty user folders, avoiding shared folders.

Store encrypted folder keys grouped by folder UID.

Store folder ↔ record associations and per-folder record keys.

Store the per-folder sharing state from sync-down. Each ``FolderSharingState`` carries ``shared`` (bool) and ``count`` (number of accessors a

Store base folder objects (encrypted; keys/data decrypted later).

Process a single character (or the first character of a buffered sequence) from stdin and emit the appropriate key event(s).

Process input data, detecting escape sequences and converting them to key events. Args: data: Raw bytes from stdin

This method will walk the user through discovery delta objects. At this point, we only have the delta objects from the graph.

Process Nested Share Folder atomic sync objects and store in caches.

Process a command line from new categorized help output.

Convert raw DAG protobuf entries to dicts and append to the cache.

Store record access entries grouped by record UID.

Store record data blobs (decrypted later in ``_decrypt_*``).

Collect and delete all records, avoiding shared folder records.

Store standalone encrypted record keys grouped by record UID.

Store parent/child record link relationships and surface their keys.

Update each record's effective ``shared`` flag from sharing state.

Store DriveRecord metadata (no encrypted content).

Remove folder ↔ record associations marked as deleted.

Drop folders flagged as removed in this sync batch. Applied after all folder/record additions so removals always win.

Remove link entries that the server marked deleted.

Process a single request. Args: request: The request to process

Drop folder access entries that the server explicitly revoked.

Drop record access entries that the server explicitly revoked.

Process and display results for a specific passkey disable operation

Populate ``params.user_cache`` from Nested Share Folder ``Users`` records.

Drop records that no longer belong to any folder. Without this pass, records removed via folder deletion would still appear in ``nsf-list`` a

Read an ANSI escape sequence from stdin after the leading ESC.

Read and return the content of the log file.

Read one logical key event, emitting VT100 sequences for nav keys.

Fallback when ReadConsoleInput init failed.

If a stash helper ran after restore, re-apply those attrs to stdin.

Drop ``--unset`` specs mirrored by a ``--set`` on the same ``LEVEL.SETTING=VALUE``. Only applies when both sides use the full ``level.setting=val

Reconstruct complete Nested Share Folder entities from atomic objects.

Return True if the record has exactly one non-empty login field and at least one of: - exactly one non-empty password field (fields[] and cus

Return True if the record has exactly one non-empty host/pamHostname field with valid host and port.

Remove existing config.json files from KSM record. Args: secrets_manager: KSM SecretsManager instance secret: KSM secret

Render a dictionary.

Render a list.

Render a primitive value (string, number, bool, null).

Recursively render a JSON value.

Recursively render a JSON value.

Report successful registration

Report the results of the unregister operation

Report the update results to the user

Report the verification results to the user

Resolve a Docker service hostname to a reachable container IP. When the detected hostname is a Docker service name (e.g. 'db'), it is

Resolve ${KEEPER_*} dynamic tokens from KCM vault integration. KCM servers with KSM integration store placeholder tokens (e.g., ${KEE

Prompt for (or read from env) the PVWA hostname / URL.

Resolve the list of safe names to import.

Resolve *segment* to an existing NSF folder UID. UID segments are resolved globally, matching legacy ``mkdir`` path behavior. Name se