Automated Credential Provisioning Command This command orchestrates the following operations: 1. Parse and validate YAML configuration

Exception raised with failed Keeper API request

Raised when krouter responds with a non-OK `RouterResponseCode`. Carries `.response_code` (int) and `.response_code_name` (str) so callers ca

Custom exception for validation errors

Email configuration for sending emails via various providers. Stored as Keeper records (login type) with encrypted credentials. See ADR

Builds folder hierarchy from KCM connection groups.

Global storage of data during the session

Track provisioning state for rollback on critical failure.

Probe-based adaptive batch throttler for Keeper API imports. Sends small probe batches before the real import to measure server response time

Create a graph of the infrastructure. The first run will create a full graph since the vertices do not exist. Further discovery run will

Main email sender class that routes to appropriate provider. Usage: config = EmailConfig(...) sender = EmailSender(config)

Connects to a KCM/Guacamole database and extracts connection data.

Applies kcm_mappings.json transformations to raw KCM connection data.

Mock device group for testing.

Mixin for cloud-to-Keeper secret import commands. Provides secret-string parsing, Keeper record building, filter evaluation, and the mai

SMTP email provider implementation. Supports standard SMTP with TLS/SSL for Gmail, Office 365, and other SMTP servers.

Mock device response for testing.

Create a Nested Share Record, matching ``record-add`` behaviour.

Animated spinner that runs in a background thread

Map when a user's password is rotated, which machine services need to also be changed. In Windows, services, scheduled tasks, iis pool, etc.

Mock device object for testing.

Create a Nested Share Folder using the v3 API.

Remove a KCM-imported project: shared folders, records, gateway, KSM app. Usage: pam project kcm-cleanup --name "KCM-Import-20260404-2035

Selection state for SuperShell. Tracks what record or folder is currently selected, and preserves pre-search selection for restoration.

Command to start the service.

Raised when input validation fails.

Centralized biometric capability detection

Statistics for deletion operations.

Guacamole input stream for receiving data from the server. Attributes: client: The client that owns this stream. index: The

Server responded with something we don't understand

Mock admin device response for testing.

Manage record sharing using grant/update/revoke actions.

Update a Nested Share Record.

Something went wrong with the network

Monotonic checkpoints for ``pam launch`` / tunnel open (debug or PAM_CONNECT_TIMING=1). Usage: tc = PamConnectTiming('pam-launch:webrtc-t