Return the record key type if available (legacy AES-CBC vs AES-GCM).

Return status for ``request_id`` only if owned by ``owner_key``.

Retrieve JIT settings from the DAG DATA edge with path 'jit_settings' for a resource. This function checks if JIT settings are stored in a D

Retrieve KeeperAI settings from the DAG DATA edge with path 'ai_settings' for a resource. The settings are stored as encrypted JSON in a DAT

Return terminal size in pixels and DPI for a Guacamole 'size' instruction. Always re-queries the terminal size internally via shutil.get_terminal

Determine UI category based on device properties using rule-based mapping.

Shared KeeperApiError handler for alias commands.

Handle authentication errors with consistent messaging

Initialize routes and queue manager for the Keeper Commander Service.

Check if the given IP address is allowed based on allow/deny lists. Rules: - No lists configured → allow all - Deny list only → allow unl

Check if value is base64-encoded and decode it.

Return ``(eligible, protocol)`` for a `pam launch` candidate. Eligibility: TypedRecord v3, ``record_type`` in :data:`VALID_PAM_RECORD_TYPES`,

Return True when *folder_uid* is a Nested Share Folder.

Return True when a PAM record lives in NSF caches or an NSF folder.

Return True if name fits within the enterprise name length limit; otherwise warn and return False.

Exempt = record owner OR on approver list. Pass `config` to skip a round-trip. Transport failures fail closed (non-exempt).

Load email template from resources directory. Args: template_name: Name of template file (default: onboarding.html) Returns:

Create WebAuthn credential using Touch ID

Map a CyberArk safe member to a Keeper shared folder permission entry. Returns dict with: name, member_type ('user'|'team'), permissions dict

Normalize host for duplicate local bind detection (best-effort). Only handles common aliases; ``0.0.0.0`` vs ``127.0.0.1`` conflicts are caug

Normalize root folder UIDs to a consistent ``'root'`` or empty string.

Print a completion message

Print a warning message

Process project data (JSON)

Default-deny y/n reader.

Refresh the entire display from the screen buffer

Dummy update to the LINK edge (resource -> PAM config) so LINK is the latest edge to config, not KEY. JIT/AI add a KEY edge for encryption; i

Re-add the meta DATA edge with the same content so meta becomes the latest (highest version) and appears on top. Call after writing jit_setti

Write a JSON file for an active tunnel so other processes can see it. Uses atomic write (temp file + rename) so readers never see partial data.

Register a tunnel session by tube_id (thread-safe)

Context manager for registry key handling

Render a DomainAliasResponse as text or JSON. When status_messages is None the response is treated as a listing (domain + alias only)

Resolve device identifiers to device tokens and return device info for success messages.

Run probe batches to measure server response characteristics. Sends 3 single-record probe batches with decreasing delays (10s, 5s, 2s)

Keep local NSF caches consistent right after folder creation.

Update the record linking ACL with control_services