True when settings are absent or match the vault empty/default template.

Load record metadata from cache, falling back to the v3 details API. Returns a dict with keys: ``title``, ``type``, ``fields``, ``notes``

Parse expiration time string into timedelta

Read command with support for line continuation using backslash.

Read configuration parameter from service config file.

Reads an item from a stream and returns it as a string of bytes.

Resolve a folder name, path, or UID to a Nested Share Folder UID. Delegates to the service layer's ``resolve_folder_identifier`` to avoid dup

Keep only SailPoint-allowed commands; always drop banned ones. Also ensures the full SailPoint allowlist is present so required

Rewrite known noisy server validation messages in place on each response dict.

Remove passwords from import JSON for safe --output without --include-credentials.

Remove the registry file for a tunnel (defaults to current PID).

Remove a tunnel session by tube_id (thread-safe)

Update a PAM record via NSF v3 API or classic record_management.

True when stored rotation schedule matches PAM config default (Web Vault parity).

Validate command list against available Keeper Commander commands.

Validate domain name format. Args: domain: Domain name to validate require_tld: If True, requires a

Admin roles prompt for confirmation on --add-role. Service Mode cannot answer that prompt, so require -f/--force (same pattern as tra

Validate file path to prevent directory traversal attacks. Args: file_path (str): Path to validate base_dir (str, option

Initialize a TunnelError. Args: message: Description of the tunnel error. code: Optional Guacamole status co

Reconstruct the CLI command from kwargs, redacting secrets.

Patch the response-builder so we can assert on outbound SharedRecord protos.

Close the shell pane and return to normal view

Coerce enforcement values to int. Server-side enforcement payloads sometimes serialize numeric fields as strings. Returns None if the value c

Converts on/off/default|any to True/False/None

Create AD user via Gateway's rm-create-user action (KC-1035). Sends the create-user action to the PAM Gateway which calls Ac

Discover shared folder names from an existing PAM config's KSM app. Returns (resources_folder_name, users_folder_name) or (None, None).

Display folder details with clickable fields for copy-on-click

Display data in JSON format.

Encrypt a string value with the record key, return base64.

Extract Kubernetes-specific settings from pamSettings.connection (record JSON).

Extract SSH-specific settings from pamSettings.connection (record JSON).

TTL (seconds) for the (host, endpoint) feature-disabled cache. Default 300s (5 min). `KEEPER_DAG_LB_FEATURE_CACHE_TTL=0` disables caching ent

Get a Docker container's IP address from its network settings. Returns the first non-empty IP, or '' if unavailable.

Return the appropriate icon for a folder based on its type and sharing status. Icon mapping (matches Keeper desktop client): - Lega

Return the plaintext AES record key for a record UID, or None if not cached.

Get record output using Commander's get command (cached for performance)

Clear module DPI cache when the TTL has expired.

Whether KEEPER_DAG_LB_FALLBACK env var opts INTO legacy fallback. **Default OFF (strict mode)** — the mature Layer-B endpoints (`configure_re

Build a minimal RouterRotationInfo mock.

Mock for the underlying Connection that discovery_common uses.

Return structured NSF folder share perms and a compact text suffix. Owner is listed under ``users`` with permission ``OW`` (not a separate label)

NSF record share perms → structured data + compact text. Uses warmed ``nested_share_record_share_cache``. Direct (non-inherited) accessors wi

Match Commander argparse append flags (one value per flag): --add-role R1 --add-role=R1

Interactive gateway selection. Returns PAM config UID or None. Flow: --gateway <uid/name> → find matching gateway, find its config

Validate inputs and resolve record_key + config_uid. Returns (record_key, config_uid) or None on failure. Shared by the new and legacy paths so b

Run execute() with AWS internals mocked. *secret_meta* is a list of {'name', 'tags'} dicts (the normalised format returned b

True if logger name is from Rust/webrtc/turn so we treat its messages as DEBUG-only.

Send multiple ICE candidates in a single HTTP POST. The gateway already iterates ``for candidate in ice_candidates`` inside ``WebRTCS

Press modifiers, press+release main key, release modifiers (remote TTY paste).

Setup the folder tree structure with records as children

Share PAM User record directly to a user's vault (KC-1035). Uses ShareRecordCommand to grant vault-to-vault access. The recipient

Store DPI and refresh cache timestamp.

Update the user and device info displays in the search bar area

Validate delivery section (KC-1035: direct vault sharing).