Generate authentication options

Get list of available biometric credentials

Get stored credential ID for user from Windows registry

Get the path corresponding to a folder uid.

Resolve gateway UID for a PAM resource record (pamMachine, etc.). Lookup flow: record_uid -> PAM_LINK DAG -> config_uid -> gateway (controller)

Detect Keeper Commander installation method. Returns: str: 'binary' (PyInstaller frozen), 'pip' (installed via pip), or 'source' (de

Get platform handler for current system

Get a map of all the available plugins. This will first get the latest catalog from the GitHub repo. The catalog will contain the plugin

Return the referenced record cache

Generic function to retrieve settings from a DAG DATA edge with the specified path for a resource. The settings are stored as encrypted JSON

Handle 'no data found' scenarios for different output formats. Args: fmt (str): Output format ('json', 'table', etc.) me

Checks if all attributes (not on skiplist) are None

Check if this config uses OAuth authentication.

Terminates a process by PID without using psutil.

Trigger a clipboard paste to the remote session.

Report status codes from list of folder_pb2.*Response.

Resolve a folder name, path, or UID to a Nested Share Folder UID. Delegates to the service layer's ``resolve_folder_identifier`` to avoid dup

Resolve an email or base64-url UID to raw UID bytes. Lookup order: user_cache → enterprise users → base64 decode. Returns None when the ident

Save configuration to file.

Return rotation schedule list from a PAM configuration defaultRotationSchedule field.

Send email via SMTP. Args: to: Recipient email address subject: Email subject body: Email body

Acknowledge receipt of data on a stream. Args: stream_index: The index of the stream. message: Human-readabl

Save JIT settings on a PAM resource. Primary path: POSTs the encrypted settings to krouter's `/api/user/configure_resource` (Layer-B, pe

Start reading input in a background thread.

Log one line with total elapsed (e.g. at end of tunnel open or command).

Remove an encryption key for a conversation ID (thread-safe)

Validate Cloudflare tunnel token

Validate domain name format and requirements. Returns: tuple: (is_valid, normalized_domain, error_message_or_None)

Warn when $GEN is used with a label like Password= instead of password=.

Helper: run RecordAddCommand field-scaffolding logic directly.

Build minimal RecordMetadata for removal (only UID needed).

Simulate the schema-building loop in prepare_record_add_or_update.

Build a Commander Connection with crypto bypassed for end-to-end URL assertions.

Enforce a folder permission for the current user. Behaviour: * If the cache has no access entries for *folder_uid* at all, skip the

Enforce a record permission for the current user. Same fail-closed semantics as :func:`_check_folder_permission`.

Normalize *mode_value* to ``kcm`` or ``guacd``; unknown/empty → :data:`DEFAULT_PIXEL_MODE`.

Compute optimal batch parameters from probe results. The API rate limit is global (~50 calls before HTTP 403 on EU). Batch sizes are

Return the base64url-encoded account UID for the current session, or ''.

Display Secrets Manager application details