Return True when a PAM record lives in NSF caches or an NSF folder.

Return True if name fits within the enterprise name length limit; otherwise warn and return False.

Exempt = record owner OR on approver list. Pass `config` to skip a round-trip. Transport failures fail closed (non-exempt).

Yield record UIDs from classic and Nested Shared Folder caches.

Load email template from resources directory. Args: template_name: Name of template file (default: onboarding.html) Returns:

Create WebAuthn credential using Touch ID

Map a CyberArk safe member to a Keeper shared folder permission entry. Returns dict with: name, member_type ('user'|'team'), permissions dict

Normalize host for duplicate local bind detection (best-effort). Only handles common aliases; ``0.0.0.0`` vs ``127.0.0.1`` conflicts are caug

Normalize root folder UIDs to a consistent ``'root'`` or empty string.

Print a completion message

Print a step indicator

Process project data (JSON)

Default-deny y/n reader.

Refresh the entire display from the screen buffer

Dummy update to the LINK edge (resource -> PAM config) so LINK is the latest edge to config, not KEY. JIT/AI add a KEY edge for encryption; i

Re-add the meta DATA edge with the same content so meta becomes the latest (highest version) and appears on top. Call after writing jit_setti

Write a JSON file for an active tunnel so other processes can see it. Uses atomic write (temp file + rename) so readers never see partial data.

Register a tunnel session by tube_id (thread-safe)

Context manager for registry key handling

Render a DomainAliasResponse as text or JSON. When status_messages is None the response is treated as a listing (domain + alias only)

Resolve device identifiers to device tokens and return device info for success messages.

Run probe batches to measure server response characteristics. Sends 3 single-record probe batches with decreasing delays (10s, 5s, 2s)

Keep local NSF caches consistent right after folder creation.

Update the record linking ACL with control_services

Call tube_registry.set_remote_description and parse/store remote keeper-pam-webrtc version when is_answer=True. Ensures version is always par

Save KeeperAI settings on a PAM resource. Primary path: POSTs the encrypted settings to krouter's `/api/user/configure_resource` (Layer-

Start a tunnel using Rust WebRTC with trickle ICE via HTTP POST and WebSocket responses. This function uses a global WebSocket architecture

Snapshot current stdin termios after a successful restore (read-back from kernel). Prefer this over :func:`stash_stdin_termios_attrs_for_pos

Stop the handler and optionally send disconnect to guacd. Args: skip_disconnect: If True, skip sending disconnect instru

Send termination to a tunnel process. Returns True if a signal was sent. On Unix, sends SIGTERM for graceful shutdown (target cleans registry/Web

Generate a graphviz Gigraph in DOT format that is marked up. :param graph_format: :param show_hex_uid: :param show_v

Coerce CyberArk boolean-ish values (true/false/Yes/No/1/0) to bool.

Decrypts data using the symmetric key

Return (and create) the tunnel session registry directory.

Update OAuth tokens in email config record after automatic refresh. This function is called by OAuth email providers (GmailOAuthProvider,

Update an existing direct share. Role changes use ``updateSharingPermissions``. Positive expirations use revoke then create (two requests) b

Update the time of last activity. Used on server interaction and class initialization.

Validate team UIDs via RecordResolver.validate_team (which checks both team_cache and enterprise.teams). Raises CommandError on first unknown

Reject ``--rotate-on-expiration`` unless granting with a positive expiry.

Block until the request completes; only returns to its owner.