cliAuthBrowserURL builds the auth-approval URL we print to the user during `pad auth login`. We construct it on the CLI side rather than trusting the

cliAuthScheme picks the URL scheme for the CLI auth link. Precedence: 1. If the request hit this server over TLS (r.TLS != nil) → "https". 2. If a tr

cmdhelpOptions builds the Options struct shared by JSON and markdown emitters. Centralized so both formats see the same dynamic resolver, version meta

coercePlaybookValue converts a raw CLI token into the typed Go value the spec describes. ref/string pass through; number is parsed as float64; enum is

collapseAutosaveBursts walks the newest-first entries and drops a collab-snapshot version when the previous kept entry is also a collab-snapshot versi

collapseChanges takes a "; "-delimited list of "field: old → new" entries and collapses runs of consecutive same-field entries into a single "field: f

collectPlaybookMetadata returns every playbook in the workspace projected down to the metadata shape. Bodies are NOT included. collIDs / itemIDs scop

collectionChildrenProgress is the shared implementation for child-item completion progress across any collection. It enforces the same visibility/gues

configureEmailForTest attaches an email.Sender wired to the given mock endpoint plus a base URL so s.baseURL != "" (the configured check looks at both

consumeBootstrapToken clears the in-memory token and deletes the on-disk file. Called after the first admin is successfully created. Caller MUST hold

contains is a small test helper.

containsAction reports whether a tool's documentation line references the given action. Actions are rendered backtick-quoted in the README table (`cre

contentPreview returns the first non-empty line of the body (markdown stripped of a leading heading marker), truncated to contentPreviewLimit runes wi

copyStrings returns a defensive copy of a string slice so the helper's returned schema cannot mutate the caller's option list.

corsAllowCredentials reports whether the CORS middleware should set Access-Control-Allow-Credentials: true. The current CLI tooling uses Bearer tokens

createItemChecked is the shared item-create core: schema-field validation → workspace-unique-field precheck → persist → optional parent link → activit

createWSWithDeletedAt creates a workspace and stamps its deleted_at to a specific time so the boundary test can inject a deterministic age.

dashboardArrayField pulls a named array out of a decoded dashboard payload, returning a typed []map[string]any so the callers can filter / sort by str

dateBucketSubstr truncates a UTC RFC3339 TEXT timestamp to its day ("hour" → chars 1-13 "YYYY-MM-DDTHH"; otherwise → chars 1-10 "YYYY-MM-DD"). The SUB

deliver sends a webhook, retrying transient failures up to maxDeliveryAttempts with linear backoff, and records the final outcome once via the store.

deriveClaimCodeForBucket is the inner derive — split out so VerifyClaimCode can derive both the current and previous bucket without re-computing the b

deriveTOTPStep returns the TOTP time-step whose generated code equals passcode, searching the same ±1 skew window totp.Validate accepts (in the librar

deriveThumbnails generates thumb-sm and thumb-md variants for the uploaded image identified by parentID. Idempotent and tolerant of every failure mode

Cleanly close the WS, unbind doc/awareness handlers, and * prevent further reconnect attempts. Safe to call more than * once; idempotent.

--- item bulk-update --- dispatchItemBulkUpdate iterates the input's `ref` array and applies --status / --priority via the same read-modify-write sema

doGetWithCookieUA issues a GET with the session cookie, a fixed client IP matching the session binding, and a caller-chosen User-Agent. GET needs no C

doneFieldKeyFromSchemaJSON resolves the done-field key from the raw schema + settings JSON strings (as stored on the collections row). Falls back to "

doneFiltersForWorkspace returns a done-filter per collection in the workspace. Used by cross-collection queries (e.g. agent-role breakdowns) that need

downloadAttachmentToPath streams the attachment into a sibling temp file and atomically renames it onto outPath on success. Shared by `attachment down

drain reads up to n events from ch with a short timeout so a missing/slow event doesn't hang the test.

--- cycle-time / WIP helpers (PLAN-1628 / TASK-1631) --- durationHours returns hours between two RFC3339 timestamps (end-start), clamped at 0. ok is f

effectivePurgeRetention returns the retention window the purge sweeper actually enforces: the SetWorkspacePurgeConfig override when set (PAD_WORKSPACE

effectiveWorkspaceUpdatedAt returns the later of the workspace's own updated_at and the most recent item activity inside it. See BUG-1481 for why item

emitMCPAuditDenied records an audit row for a request that MCPBearerAuth resolved (so we know the user + token identity) but then rejected — currently

encodeSchemaForBody converts a `schema` MCP input value into a JSON-encoded CollectionSchema string suitable for the create-collection HTTP body's `sc

enforceUserPlanLimit checks a user-scoped plan limit and writes a 403 error if the limit is exceeded. Returns true if the operation is allowed. In non

enrichActivities populates ItemTitle, ItemSlug, and CollectionSlug on each activity by looking up the referenced item.

errorServer returns an httptest.Server that answers every request with the given status + API error envelope ({"error":{"code","message"}}), matching

* Escape HTML-significant characters so a user-controlled string can be * safely interpolated into attribute values / text nodes.

expectNoMessage checks that no NON-cursor frame arrives within d. Cursor TextMessage frames (TASK-1319) are drained without failing the assertion — th

extractAllowedWorkspacesFromSessionExtra parses session_data JSON and returns the extracted shape. Defensive: malformed JSON, non-object .extra, non-s

extractPragmas scans the migration text line-by-line and lifts any top-level `PRAGMA ...;` statement out of the body. It returns the lifted pragma sta

extractUpstreamMessage pulls a human-readable message out of an upstream error body. Three return shapes: - Pad's structured envelope ({error:{messag

extractVerifyToken pulls the padver_ token out of a verification email body.

fetchDashboardJSON hits the workspace dashboard endpoint and decodes the response into a generic map[string]any so the dispatcher preserves every fiel

fetchItem retrieves a full models.Item via the api/v1/workspaces/{ws}/items/{ref} surface. Used by the related / implemented-by dispatchers which need

filenameFromContentDisposition extracts the filename token from a Content-Disposition header value (e.g. `attachment; filename="foo.pad.md"`). Returns

findCatalogTool returns the ToolDef with the given name, or a failed test.

findGaugeValue is a small lookup helper for the OAuth active-tokens test. Returns -1 when the metric isn't present so callers can spot "missing" disti

findToolLine returns the first line of doc whose trimmed form starts with prefix (the tool's documentation-line marker), or "" if none matches. Scopin

flatJSONBody serializes selected input keys into a JSON object. Empty-string values are skipped; nil values are skipped. For more complex shapes (nes

formatChangeValue renders a JSON-decoded field value as a human-readable string for the activity-feed `changes` summary. Primitives use Go's default f

formatRef rebuilds "PREFIX-NUMBER" from its parts. Kept inline rather than reaching for a models package helper to avoid an import cycle from store→mo

generateCSPNonce generates a cryptographically random nonce for Content-Security-Policy headers. Returns a 16-byte base64-encoded string.

generateCSRFToken returns a cryptographically random hex string.

generateRecoveryCodes produces n random recovery codes. Each code is 10 bytes (80 bits) of cryptographic randomness encoded as unpadded base32 — 16 vi

generateTempPassword returns a random hex temporary password for an operator-initiated reset (16 bytes → 32 hex chars). Shared by the admin reset endp

getItemLink is the unfiltered post-insert readback used by CreateItemLink to hydrate the freshly-inserted row with collection/source/target metadata.

getItemTx is the in-transaction variant of GetItem. Used by UpdateItemWithPreCheck to re-read the parent under the workspace + parent-children locks s

getLatestVersionRaw returns the most recent version without resolving diffs.

guestResourceFilterCore is the request-scoped wrapper around Store.ResolveBacklinksVisibility. Delegates the role-determination + merge logic to the s

handleSessionIPChange compares the client IP on this request to the IP recorded when the session was created. Behavior: - Session has no recorded IP

handleSessionUAChange compares the User-Agent hash on this request to the hash recorded when the session was created, and enforces the same opt-in pol

hasCloudSecretMarker returns true if the request carries a sidecar- style auth marker: X-Cloud-Secret header or a cloud_secret field in the JSON body

hasPadEntryTOML reports whether mcp_servers.pad is present plus its current `command` value. Missing files are "not installed", no error.

hashCanonicalJSON returns a SHA-256 hex of a canonicalized form of the input JSON. "Canonical" here means: round-trip through encoding/json to sort ob

hashTokenForLimiter returns a SHA-256 hex digest of the bearer token, suitable for use as a rate-limiter map key. The hash means the limiter's in-memo

helpCmd returns a custom `pad help` subcommand that replaces cobra's built-in help. It implements the cmdhelp v0.1 mandatory surface (https://getpad.d

humanSize formats a byte count in a compact human-readable form (1.2 MB, 340 KB). Used by attachment list / show; not exported because the formatting

insertLegacyUnverifiedUser inserts a user row with email_verified_at = NULL, simulating an account that existed BEFORE migration 070 added + backfille

insertVerificationToken writes a token row directly with a caller-chosen expires_at / used_at so tests can craft expired and already-used rows.

installInitCancelHandler installs a SIGINT/SIGTERM handler for the duration of an interactive init run. On signal receipt it calls cancelInit() — but