Configure rotation settings for one or multiple PAM records. The command accepts either ``--record`` or ``--folder`` to target record

Execute a CLI command and capture output.

Fetch audit events with pagination support. This function handles pagination for both raw and span/consolidated reports, making it suita

Convert collected TOTP parts into otpauth:// URLs.

Return a {uid, path} dict for the first NSF folder containing *record_uid*.

Convert an ``AccessRoleType`` to a Nested Share Folder display role label. Accepts either the proto enum name (``'SHARED_MANAGER'``) or its integ

Get action-specific parser for detailed help.

Get WebAuthn assertion using Touch ID

Get biometric flag for user

POST a stringified JSON object to /api/dag/get_leafs on the KRouter The object is: { vertex: string, graphId: number }

Get device info as a dictionary (for programmatic use)

Get launch credential: resolved UID if uid=True, else string reference (title/login).

Return the list of user UIDs currently flagged is_launch_credential on the resource.

Get the parent record uid. Check the ACL edges for the one where belongs_to is True If there is a LINK edge that leads to th

Retrieve the unencrypted record key from nested_share_records or record_cache.

Return the record key type if available (legacy AES-CBC vs AES-GCM).

Return status for ``request_id`` only if owned by ``owner_key``.

Retrieve JIT settings from the DAG DATA edge with path 'jit_settings' for a resource. This function checks if JIT settings are stored in a D

Retrieve KeeperAI settings from the DAG DATA edge with path 'ai_settings' for a resource. The settings are stored as encrypted JSON in a DAT

Return terminal size in pixels and DPI for a Guacamole 'size' instruction. Always re-queries the terminal size internally via shutil.get_terminal

Determine UI category based on device properties using rule-based mapping.

Grant a user *or team* access to a Nested Share Folder.

Shared KeeperApiError handler for alias commands.

Handle authentication errors with consistent messaging

Initialize routes and queue manager for the Keeper Commander Service.

Check if the given IP address is allowed based on allow/deny lists. Rules: - No lists configured → allow all - Deny list only → allow unl

Check if value is base64-encoded and decode it.

Return ``(eligible, protocol)`` for a `pam launch` candidate. Eligibility: TypedRecord v3, ``record_type`` in :data:`VALID_PAM_RECORD_TYPES`,

Return True when *folder_uid* is a Nested Share Folder.