publishReactionEvent publishes a real-time event for reaction changes.

rawJSONOrNil returns s as json.RawMessage when it is a non-empty, non-empty- container JSON value, else nil (so the field is omitted). Guards against

readBundle decompresses + extracts a gzipped tar bundle into a map[name]bytes. Test helper kept here so both export and (later) import tests can read

readDashboard handles pad://workspace/{ws}/dashboard.

readParentLinkTarget returns the target_id of an item's `parent` link, or "" when it has none. Parameterized over rowQueryer so it can read either unl

readRepoFile reads a file relative to the repo root. Go runs tests with the package directory as the working directory, so the repo root is two levels

readResourceJSON drives a resources/read request through the server for uri and returns the text body. Fails the test on protocol errors, missing cont

---------- Helper ---------- rebindQuery converts "?" placeholders to PostgreSQL's "$1", "$2", etc. Respects string literals (single quotes) and does

rebuildFTSForWorkspace rebuilds the FTS index for all items in a workspace. This is needed after import because direct INSERTs bypass the FTS triggers

redactQueryString replaces sensitive query-key values with REDACTED while leaving the rest of the query string intact for diagnostics. Operates on the

registryPath returns ~/.pad/installations.json.

relatedEntryFromLink projects a link's source-side or target-side metadata into a relatedEntry. Mirrors cmd/pad/query.go's helper.

removeConn unsubscribes the connection from the bus and, if it was the last subscriber, schedules a graceTTL grace timer. The caller is responsible fo

reportVisibleCollections computes the collection-visibility scope for the aggregate report. Aggregate counts have no item-level filtering, so a collec

requireShareLinkTargetVisible resolves a share link's target (item or collection) and gates on the appropriate visibility check (BUG-1923). Item-scope

requireUnrestrictedExportAccess denies workspace export (both the JSON and tar.gz bundle forms) to a caller whose workspace access is scoped to specif

requireViewEditable is like requireViewVisible but also checks edit permission on the view's collection (grant-aware for guests/restricted members).

resolveBrokenTitleLinks flips item_wiki_links rows in the workspace that have target_kind='title' and a target_title matching the given (collSlug, tit

resolveItemLink reads link_type/ref/target from input and returns the dispatch tuple for action=link (creating=true) or action=unlink (creating=false)

resolveParentFilter extracts a "parent" (or "plan") key from the field filters and converts it to a ParentLinkID filter (which uses item_links instead

resolvePlaybook finds a playbook by either its invocation_slug, its item slug, or its issue ref. invocation_slug takes precedence — that's the user-fa

resolveSQLiteDBPath returns the SQLite database path using the SAME precedence the server uses (PAD_DB_PATH > PAD_DATA_DIR/pad.db > ~/.pad/pad.db), vi

resolveShareWithPassword issues an anonymous GET /api/v1/s/{token} from the given source IP with the password supplied via the X-Share-Password header

* Resolve a same-workspace wiki-link body against the in-memory items list. * Callers handle the cross-workspace `[[ws::REF]]` form first; this cover

run is the worker goroutine. Drains queue → InsertMCPAuditEntry, logs (but doesn't crash on) DB errors, exits on stop. Tracked via Server.bg so Stop()

runTokenReaperTick runs one sweep. Each cleaner is independent — a failure in one is logged and does not skip the others. Quiet on success (operators

sanitizeHeaderFilename strips characters that can't safely appear in a Content-Disposition filename header — quotes, CR, LF, and any control byte. The

scanAPIToken scans an API token from a row scanner.

---- helpers ---- scanBool normalizes the dialect-specific bool encoding (SQLite INTEGER 0/1; Postgres BOOLEAN true/false) into a Go bool. Mirrors the

scanBucketCounts runs a "SELECT <bucket>, COUNT(*) ... GROUP BY <bucket>" query and returns a label→count map.

screenDialAddr rejects a dial to a private/reserved IP. The dialer calls this with the resolved connection address (ip:port), so it validates the exac

seedActiveAccessTokenForChain inserts one active access-token row in the chain identified by requestID for subject userID. Lets the IsWorkspaceCovered

MCP audit handler tests (PLAN-943 TASK-960). Two endpoints: - GET /api/v1/connected-apps/{id}/audit — owner-scoped per-connection. - GET /api/v1/ad

seedFullWorkspace inserts one row into every workspace-scoped child table so a purge can be proven exhaustive. Raw inserts deliberately omit columns t

32 hex chars, never issued seedOwnerWorkspace bootstraps the first admin (so RequireAuth is active and users exist) and returns the owner plus a fresh

seedUser inserts a user directly with the given plan + created_at so tests can deterministically populate the customers_by_plan and new_signups_30d ag

sendWith is the internal send implementation.

setParentLinkTx performs the lock acquisition, cycle check, and the DELETE-then-INSERT of the parent link entirely within the caller's transaction, re

setTokenExpiryWarning adds an X-Token-Expires-Soon header if the API token used for this request is within the warning threshold of its expiry. Called

sha256Hex returns the hex-encoded sha256 of b. The FS storage backend keys blobs by this exact form, so the value also serves as the storage_key suffi

sha256hex returns the SHA-256 hex digest of a string.

snippetAround returns roughly `snippetRadius*2` bytes of `content` centered on `position` (the start of the `[[`). Caller doesn't need the snippet to

splitCodeFences partitions markdown source into alternating fenced / non-fenced spans. The fence detector recognizes the CommonMark form: at least thr

splitOnUnescapedPipe scans `body` for the first `|` that isn't preceded by an unescaped `\`, splitting the body into (key, display, found). Mirrors sp

sseVisibility is the per-connection event-filter state. All four fields are rebuilt atomically on each revalidation tick so that permission-tightening

startRedisSubscription begins listening on a Redis channel for a workspace. Must be called with b.mu held.

* Coerce an array<string> param (the MCP transport may also deliver a single * string). Returns undefined when absent/empty. Throws on a non-string e

stripCobraUsageBlock removes cobra's auto-appended "Usage: ..." help block from a stderr string. cobra emits this block on any runtime error from a Ru

stripDuplicatedFieldsKeys removes implementation_notes and decision_log from a parsed fields object. The server hydrates both onto items as top-level

stripErrorPrefix removes the leading "Error:" prefix that the CLI (and many of its dependencies) emit on stderr lines. Cosmetic — the envelope's error

throttleTime returns a timestamp 5 minutes before the given RFC3339 time string.

titleCaseLabel converts a snake_case key into a Title Case label the same way the CLI does ("due_date" → "Due Date"). Avoids pulling in golang.org/x/t

totalChildRows sums every seeded child row for a workspace, checking item-scoped tables against the original parent IDs so a leaked row is detectable

trimRedundantSchemaLabels parses the schema JSON, drops field labels equal to TitleCase(key), and re-marshals. Returns the original bytes verbatim on

truncateTitle limits an uncolorized, SGR-free title to maxRunes visible columns, appending an ellipsis when it had to cut. Callers strip SGR escapes f

unescapeMarkdownText reverses CommonMark escape sequences in a captured label. Marked's tokenizer drops the backslash and emits the literal character,

unescapeWikiBody undoes the editor's body-escape sequences: `\]` → `]`, `\|` → `|`, `\\` → `\`. Other backslash sequences are left as-is (the renderer

unknownWorkspaceResult wraps a "workspace X doesn't exist" failure. Same available_workspaces enrichment as no_workspace. Empty slug emits a generic m

unwrapErrorEnvelope extracts the structured ErrorEnvelope from a CallToolResult. Test helper — fails fast if the result isn't shaped like a structured

userActorLabel produces a stable string label for the actor that created a structured entry. Mirrors the CLI's "user" label for CLI-driven entries; fo

validHash returns true if h looks like a hex-encoded sha256 — 64 lowercase hex characters. We only accept this canonical form so on-disk paths are sta

validTOTPCode mints the current valid TOTP code for a secret, using the same library the handler validates against.

validateAssignmentScope checks that the assigned user and agent role belong to the same workspace as the item. This prevents cross-workspace assignmen