Maps CyberArk accounts to KeeperPAM record dicts matching pam project import JSON schema.

Exception raised with failed Keeper API request

Automated Credential Provisioning Command This command orchestrates the following operations: 1. Parse and validate YAML configuration

Raised when krouter responds with a non-OK `RouterResponseCode`. Carries `.response_code` (int) and `.response_code_name` (str) so callers ca

Global storage of data during the session

Probe-based adaptive batch throttler for Keeper API imports. Sends small probe batches before the real import to measure server response time

Handles authentication and API calls to CyberArk PVWA.

Custom exception for validation errors

Email configuration for sending emails via various providers. Stored as Keeper records (login type) with encrypted credentials. See ADR

Builds folder hierarchy from KCM connection groups.

Matches CyberArk vault users and groups to Keeper users and teams. CyberArk users are matched by email (personalDetails.email). CyberArk grou

List PAM session recordings for one or more users, with optional download.

Track provisioning state for rollback on critical failure.

Download and decrypt PAM session recording files. Two modes: --usernames List recordings for those users then download all of them.

Maps CyberArk Safe names to Keeper folder paths with deduplication. Modes: - ``flat`` : returns ``""`` — all records land in the project's

Create a graph of the infrastructure. The first run will create a full graph since the vertices do not exist. Further discovery run will

Main email sender class that routes to appropriate provider. Usage: config = EmailConfig(...) sender = EmailSender(config)

Connects to a KCM/Guacamole database and extracts connection data.

Applies kcm_mappings.json transformations to raw KCM connection data.

Mock device group for testing.

Mixin for cloud-to-Keeper secret import commands. Provides secret-string parsing, Keeper record building, filter evaluation, and the mai

Create a Nested Share Record, matching ``record-add`` behaviour.

Manage record sharing using grant/update/revoke actions.

SMTP email provider implementation. Supports standard SMTP with TLS/SSL for Gmail, Office 365, and other SMTP servers.

Mock device response for testing.

Change the sharing permissions of a Nested Share Folder.

Animated spinner that runs in a background thread

Map when a user's password is rotated, which machine services need to also be changed. In Windows, services, scheduled tasks, iis pool, etc.

Mock device object for testing.

Create a Nested Share Folder using the v3 API.

Remove a KCM-imported project: shared folders, records, gateway, KSM app. Usage: pam project kcm-cleanup --name "KCM-Import-20260404-2035

Selection state for SuperShell. Tracks what record or folder is currently selected, and preserves pre-search selection for restoration.

Command to start the service.

Raised when input validation fails.

Centralized biometric capability detection

Remove a CyberArk-imported project: records, folders, gateway, KSM app.

Statistics for deletion operations.