extractFieldValue extracts a string value from a JSON fields string.

extractHash pulls the hash component out of an "fs:<hash>" key and validates it. We require the canonical 64-char lowercase-hex sha256 form on every p

extractUnknownWorkspaceSlug pulls the slug from a CLI stderr like "workspace 'foo' does not exist" so the envelope can name it. Returns empty string i

fieldString parses an item's fields JSON and returns the string value at key (or "" if absent).

firstLine returns the first line of s with surrounding whitespace trimmed. Useful for collapsing a multi-line Long string into a Summary.

getAPIToken retrieves a single API token by ID.

---- helpers ----

getTokenExpirySettings reads platform settings for token expiry policy.

globalAgents returns the agents that target a stable per-user config file — i.e. everything except CWDBased (project-local) agents. It's the iteration

isPrivateIP returns true if the IP is in a private, reserved, or otherwise non-routable range. It covers loopback (127.0.0.0/8, ::1), RFC1918 (10/8, 1

jsonEqualString compares two JSON strings tolerantly of insignificant whitespace differences that emerge from JSONB ↔ TEXT round-trips.

linkChild wires child -> parent via a `parent` link (the shape GetChildItems / GetChildItemsForParents walk).

listItemLinks issues an in-handler GET against api/v1/workspaces/{ws}/items/{slug}/links and decodes the response into models.ItemLink so the un-* dis

loadJSONConfig reads path as a JSON object. A missing or whitespace-only file is treated as an empty config (so AddPadEntry can populate from scratch

loadSchemaForTest is a test-only wrapper around FindAndCompileSchema that fails the test on error and starts the walk from the test's CWD.

loadTOMLConfig reads path as a TOML document into a map. A missing or whitespace-only file is an empty config. Parse errors on a non-empty file propag

logActivityWithMeta logs activity with optional JSON metadata. For "updated" actions, uses debouncing to coalesce rapid successive saves (e.g., autosa

logActivityWithMetaReturningID is like logActivityWithMeta but returns the activity ID. The ID is either newly created or the coalesced existing activ

logWorkspaceAuditEvent logs a workspace-scoped audit event (e.g. member invited). Best-effort: errors are silently ignored.

mapItemStarred dispatches `pad item starred [--all]`. GET /api/v1/workspaces/{ws}/starred?include_terminal=true when --all is set. Without --all the

mapKeys returns the keys of m, in arbitrary order. Used only by test failure messages where order doesn't matter.

mapRoleCreate dispatches `pad role create <name> [--description ...] [--icon ...] [--tools ...]`. POST /api/v1/workspaces/{ws}/agent-roles with body

mapWebhookCreate dispatches `pad webhook create <url> [--events ...] [--secret ...]`. POST /api/v1/workspaces/{ws}/webhooks with body matching models

mapWorkspaceAuditLog dispatches `pad workspace audit-log [--days N] [--actor X] [--action X] [--limit N]`. GET /api/v1/audit-log (NOT workspace-scope

mapWorkspaceCreate dispatches `pad workspace create <name> [--slug X] [--template X]`. POST /api/v1/workspaces with body {name, slug?, template?} — m

mapWorkspaceInvite dispatches `pad workspace invite <email> [--role X]`. POST /api/v1/workspaces/{ws}/members/invite with body {email, role?}. Defaul

markEventForUnmarkTest is a helper that POSTs stripe-event-processed and returns the processed_at token the response hands back. Keeps the setup of th

mergeActivityMeta combines two activity metadata JSON strings, accumulating the "changes" field. If both contain changes, they are joined with "; ". O

mergeAllowedWorkspaces computes the effective workspace allow-list for an OAuth-authenticated MCP request, OR-merging the two sources described in han

newCloudEmailServer returns a cloud-mode server with a usable base URL and a capturing email sink, bootstrapped with one admin. This is the configurat

newMailSink stands up a fake Maileroo v2 endpoint that records every outgoing email onto a channel, and returns a Sender wired to it. Mirrors the http

BUG-1865: the cloud /mcp transport used to resolve the target workspace from a SINGLE process-global *mcp.WorkspaceState shared across every OAuth use

padTomlURLFor returns the URL to write into .pad.toml for the given client config. Local-mode workspaces get the empty string (the default loopback se

parseItemRef parses "PREFIX-123" into ("PREFIX", 123, true). Returns false if the string is not a valid item ref. Case-insensitive: "task-5", "Task-5"

parseMCPAuditPaging extracts limit + offset from the query string, applying sane caps. Bound limit at 200 — large enough for a "scan the recent audit"

parseMCPRequestBody extracts (tool_name, args_hash) from the JSON-RPC envelope in body. Two cases: - method == "tools/call" → tool_name = params.name

paymentFailedAuditForUser walks the audit log for a given user and returns every payment_failed_email_sent row's parsed metadata. Used by the send-pat

positiveTerminalExpr builds the "this transition is a positive completion" boolean: OR over collections of (st.collection_id = ? AND st.field_key = ?

printGroupedTemplates prints the visible templates to w, grouped by category in canonical order. Used by `--list-templates` and the "unknown template"

printPostSetupNextStepsHint walks the freshly-bootstrapped admin to the next step that actually does something useful: creating a workspace. The IDEA-

promptAndBootstrap collects admin credentials from the terminal and creates the first admin account via /auth/bootstrap, retrying the password pair on

readPasswordFrom reads a password without echo when stdin is a TTY, and otherwise falls back to reading a line from the supplied bufio.Reader. Caller

reconfigureEmail reads email settings from the platform_settings table and updates (or creates) the email sender. Called after admin settings change.

registerOAuthRoutes mounts the OAuth endpoints on r. Called from setupRouter at the same level as the MCP routes. No-op when either cloud mode is off

removePadEntryTOML deletes mcp_servers.pad while leaving other servers and top-level keys intact. Returns (true, nil) when an entry was removed, (fals

renderUnsubPage writes the unsubscribe status page with a strict CSP. The CSP denies scripts, inline event handlers, iframes, and remote resources out

reportSnapshotAsOf reconstructs the status-distribution and WIP snapshot as they stood at time t, from the status-transition history (PLAN-1628 / TASK

resolveItemRef does a GET /api/v1/workspaces/{ws}/items/{ref} and returns the resolved id+slug. Used by the link dispatchers to translate user-friendl

resolveLimit resolves the limit for a feature using the three-tier resolution: user overrides → DB-stored plan defaults → hardcoded fallback.

resolveReportCollections lists the workspace's collections (optionally filtered to the given slugs) and resolves each one's done field + positive term

rotateSessionsAfterCredentialChange invalidates every existing session for the user (forcing sign-out on all other devices) and then re-issues a fresh

runApplierEcho spawns a goroutine that reads all incoming TextMessage frames on conn, looks for applier_request, and immediately responds with applier

runBrowserSetup drives the browser-based first-admin bootstrap and the CLI authorization in a SINGLE browser handoff. Before printing anything it crea

* Cleanup shared by `onClose` and the paths that bypass it via * `closeSocket()` (which removes the close listener before calling * `ws.close()`):

runHandshake spins up srv against in-memory pipes, drives the MCP client's Initialize, and returns the result + a cleanup that tears the goroutine dow

runHeadlessSetup drives the output layer for `pad auth setup --email …`. It delegates the actual work to doHeadlessBootstrap and then prints the resul

sanitizeVersion makes a build-version string safe as a filename suffix. Build versions can carry spaces/parens (e.g. "1.2.3 (abc1234)"); collapse anyt

scanCollectionDoneFilters consumes rows yielding (id, schema, settings) and resolves each into a collectionDoneFilter. When a collection's schema fai

scanMCPAuditRows is the shared row-decoder for every list method. Pulls out the nullable workspace_id + error_kind into *string, parses the timestamp,

setSessionTimes backdates a session's expires_at (and optionally created_at) so renewal-threshold and absolute-cap paths can be exercised deterministi

shellSplit tokenizes a command line in a POSIX-ish way: whitespace separates tokens, double-quotes group, single-quotes group (no expansion inside), b

shutdown signals the worker to drain + exit. Idempotent.

* Kick off an upload for a single file. Inserts the placeholder * immediately, then races the network. The placeholder's position is * mapped throug

stopTokenReaper signals the loop to exit. Called from Server.Stop(). Safe to call when the loop never started.

sweep walks the map, evicts entries older than ttl, and returns the eviction count. onChange fires once at the end with the new total — single observa

Regression coverage for BUG-1086. The timeline handler previously seeded `beforeID` with the literal byte "\xff" to act as a sentinel that "sorts aft

* Strip a row down to the skinny shape. Defensive: discard `content` * if a caller passed a full `Item` rather than an `ItemIndexRow`. The * destruc

tokenAllowedWorkspaceMatches reports whether the OAuth token's workspace allow-list (set at consent time, TASK-952) permits the given workspace slug.

===================================================================== oauth/authorize — start auth-code flow =========================================

uaBoundSession creates a user + a session bound to a fixed client IP and User-Agent, returning the raw session token. Tests drive requests through doG

uniqueSlugExcluding generates a unique slug, excluding a specific document ID from the collision check. Used during title renames.