isChildLinkType reports whether the given link type is one the open-children guard counts toward the children-set (i.e. matches the inclusion rule bak

isCloudAdminPath returns true if the request targets one of the three cloud-sidecar-only admin endpoints. Kept separate from the credential check so t

requestIsLoopback reports whether the request came from a local CLI running on the same machine as the Pad server. The check is intentionally strict:

isPrivateIP returns true for any IP we refuse to fetch from. This includes loopback, RFC1918, IPv4/IPv6 link-local (catches the AWS/GCP/ Azure cloud-m

isReadOnlyAction reports whether (toolName, action) performs no mutation. Defaults to false (write) for any pair not in the allowlist — the conservati

isReservedCollectionSlug checks whether a slug would collide with a workspace-level UI route.

isSafeBundleEntryName rejects tar entry names that look like a path-traversal attempt. The bundle path is already hash-keyed at the storage layer (see

isTerminalWithContext reports whether an item is in a terminal state given its collection's done-context. When the collection isn't in the map (e.g. d

isUUID checks if a string looks like a UUID (8-4-4-4-12 hex).

isValidFieldKey checks that a field name contains only safe characters (alphanumeric, underscore, hyphen). This prevents SQL injection when field keys

itemFieldsAsMap reads the parsed `fields` value off an item-shape structuredContent map. After BUG-991 path A's normalization the MCP boundary returns

--- open ---

itemRefString returns "TASK-5"-style refs for non-nil items, or the empty string when the collection prefix or item number is missing. Mirrors cli.Ite

itemStatusPriority pulls the "status" and "priority" string values out of an item's fields JSON blob. Missing keys, non-string values, or malformed JS

jsonEqual compares two parsed-JSON maps for value equality. Cheaper than reflect.DeepEqual and accepts the float/string nuances of json.Unmarshal outp

liftFieldsToColumns scans fields for keys that map 1:1 to columns on the item record and moves them into payload at the top level. Mutates both maps.

linkBlocks wires blocker -> blocked via a `blocks` link.

listTerminalItemsSince fetches items in each of models.DefaultTerminalStatuses (one ListItems call per status — mirrors the CLI's loop rather than OR-

mapPflagType translates pflag Value.Type() strings to the cmdhelp v0.1 type vocabulary (spec §5.1) and reports whether the flag is repeatable. pflag

mapWorkspaceClaim dispatches `pad workspace claim <code> --workspace <slug>`. POST /api/v1/oauth/claim with body {workspace, code} — see internal/ser

matchesEvent checks whether a webhook's event filter (JSON array) includes the given event name, or the wildcard "*".

maybeWarnStorageQuota emits a slog warning if the workspace's usage has crossed the owner-plan storage limit. Phase 1 is observational only — see DOC-

mcpAuditDroppedSnapshot returns the cumulative number of audit entries dropped due to buffer-full backpressure. Exported as a method on Server so admi

mcpConnectionStatsKey is the canonical map key for the result of MCPConnectionStatsForUser. Exposed via a helper so callers constructing lookup keys d

mergeDispatchInput returns a copy of the user-supplied MCP input augmented with the same default injections BuildCLIArgs applies — session workspace,

mergeFieldsPatch applies a shallow JSON-merge-patch (RFC 7396 semantics, one level deep) of `patch` onto the item's current fields JSON (IDEA-1480 TAS

mergeParameters combines path-item-level parameters with operation-level ones, deduping on the (name, in) tuple. Operation- level parameters win on co

mockMailerooEndpoint stands up an httptest server that speaks enough of Maileroo's v2 JSON API to satisfy email.Sender. Returning 500 exercises the se

modelClientToFosite turns a stored client row into the fosite.DefaultClient fosite expects. Public clients only — Secret stays empty; PKCE is the only

mustCreate is a small helper for the deadlock test's seeding — keeps the test body focused on the race itself rather than boilerplate response parsing

newFromTemplate builds (once) and copies the template DB, then opens the copy via store.New. Shared by NewSQLite and NewSQLiteUnmanaged; the only diff

newMetricsTestServer builds a Server with metrics enabled and the given static token, via storetest.NewSQLite (IDEA-1914) — see testServer in server_t

newSeedID is a stable test-only ID derived from the email. Used as both the user.id AND the unique-per-row component of user.username, so collisions a

newStructuredEntryID mirrors the CLI's helper for note/decision IDs (cmd/pad/notes.go). The actual collision-avoidance is handled by combining the pre

nonTerminalFilter builds a WHERE fragment (plus ordered args) that keeps only items whose resolved done-field value is NOT one of their collection's t

normalizeRecoveryCode prepares a user-entered recovery code for hashed comparison against stored codes: strip ASCII whitespace and dashes, then upperc

oauthScopesToJSON serializes fosite's granted-scope slice to the JSON array form tokenScopeAllows expects. Crucial fail-closed: nil / empty granted s

observeRevocation looks up the oldest active-token issuance time for the family and fires the configured observer. Always called AFTER the family has

openPostgresDB opens and configures a PostgreSQL connection pool.

parentChainCycles walks the `parent` edges up from startID and reports whether the chain revisits a node (a cycle) within a bounded number of hops. Th

parseAttachmentFilename pulls the filename parameter out of a Content-Disposition header. Returns "" when the header is absent or unparseable so the c

parseCORSOrigins parses a comma-separated list of origins into a slice. Returns default localhost origins if the input is empty. The '*' wildcard is

This file implements the browser/REST surface for the "project intelligence" reads (PLAN-1888 / TASK-1894): next, standup, changelog. KEEP IN SYNC —

parseExamples turns cobra's Example field (a single multiline string) into individual Example entries. Each non-empty, non-comment line is taken as on

parseFieldChange extracts the from/to value for a given field out of a single activities.metadata `changes` string. The string is built by handlers_do

parseFieldFlag parses a --field key=value flag value according to the field's declared schema type. JSON-typed and multi_select fields receive parsed

* Parse the catalog's `field` param (array of "key=value" strings for * schema-declared custom fields) into a key→value object. Throws on a * malfor

parseItemListParams extracts item list parameters from the request query string.

parseItemNumber parses a bare numeric string (e.g. "843") into a positive item number. Returns false for empty strings, non-digit input, zero, or valu

parseQuery is a thin wrapper around url.ParseQuery that returns the values directly. Convenience for the route tests where the function signature is t

parseWorkspaceListJSON decodes the JSON shape `pad workspace list --format json` emits into the WorkspaceHint slice. Lenient about optional fields — o

peerAddr extracts the IP from a RemoteAddr string, which may be either "host:port" (the stdlib default) or a bare "host" (what some middleware leaves

pgDbnameFromURL extracts just the database name from a PostgreSQL DSN for display purposes. Handles both the URI form (postgres://.../dbname) and the

placeholders returns a comma-separated string of SQL placeholders: "?, ?, ?"

playbookStatus reads the `status` value out of a playbook item's fields JSON. Status lives in the typed fields blob, not as a top-level Item column, s

pollAndSaveCLIAuth polls a pending CLI auth session until it is approved, then persists the issued token as credentials for cfg.BaseURL(). It is the s

prefetchItemFields GETs the item at itemPath and returns its `fields` JSON string. Surfaces 404s and parse errors as IsError-flagged tool results so t

projectIntelVisibility computes the (collectionIDs, itemIDs) visibility-scoping pair for the item-list calls the standup/changelog handlers make direc

publishEvent publishes a real-time event if the event bus is available (best-effort).