Return True if name fits within the enterprise name length limit; otherwise warn and return False.

Exempt = record owner OR on approver list. Pass `config` to skip a round-trip. Transport failures fail closed (non-exempt).

Load email template from resources directory. Args: template_name: Name of template file (default: onboarding.html) Returns:

Load record metadata from cache, falling back to the v3 details API. Returns a dict with keys: ``title``, ``type``, ``fields``, ``notes``

Create WebAuthn credential using Touch ID

Normalize host for duplicate local bind detection (best-effort). Only handles common aliases; ``0.0.0.0`` vs ``127.0.0.1`` conflicts are caug

Normalize root folder UIDs to a consistent ``'root'`` or empty string.

Parse a FolderAccessResponse into a standard result dict.

Print a completion message

Print a warning message

Process project data (JSON)

Default-deny y/n reader.

Refresh the entire display from the screen buffer

Dummy update to the LINK edge (resource -> PAM config) so LINK is the latest edge to config, not KEY. JIT/AI add a KEY edge for encryption; i

Re-add the meta DATA edge with the same content so meta becomes the latest (highest version) and appears on top. Call after writing jit_setti

Write a JSON file for an active tunnel so other processes can see it. Uses atomic write (temp file + rename) so readers never see partial data.

Register a tunnel session by tube_id (thread-safe)

Context manager for registry key handling

Render a DomainAliasResponse as text or JSON. When status_messages is None the response is treated as a listing (domain + alias only)

Resolve device identifiers to device tokens and return device info for success messages.

Resolve a team name/UID to ``(team_uid_b64, team_uid_bytes)`` or ``None``.

Run probe batches to measure server response characteristics. Sends 3 single-record probe batches with decreasing delays (10s, 5s, 2s)

Update the record linking ACL with control_services

Call tube_registry.set_remote_description and parse/store remote keeper-pam-webrtc version when is_answer=True. Ensures version is always par

Save KeeperAI settings on a PAM resource. Primary path: POSTs the encrypted settings to krouter's `/api/user/configure_resource` (Layer-

Start a tunnel using Rust WebRTC with trickle ICE via HTTP POST and WebSocket responses. This function uses a global WebSocket architecture

Snapshot current stdin termios after a successful restore (read-back from kernel). Prefer this over :func:`stash_stdin_termios_attrs_for_pos

Stop the handler and optionally send disconnect to guacd. Args: skip_disconnect: If True, skip sending disconnect instru

Send termination to a tunnel process. Returns True if a signal was sent. On Unix, sends SIGTERM for graceful shutdown (target cleans registry/Web

Generate a graphviz Gigraph in DOT format that is marked up. :param graph_format: :param show_hex_uid: :param show_v

Decrypts data using the symmetric key

Return (and create) the tunnel session registry directory.

Update OAuth tokens in email config record after automatic refresh. This function is called by OAuth email providers (GmailOAuthProvider,

Update the time of last activity. Used on server interaction and class initialization.

Validate team UIDs via RecordResolver.validate_team (which checks both team_cache and enterprise.teams). Raises CommandError on first unknown

Block until the request completes; only returns to its owner.