backupSQLite writes an online-safe, self-contained copy of the SQLite database at srcPath to outPath using `VACUUM INTO`. Unlike an io.Copy of the pad

binaryPresent reports whether any of the given executable names is found on PATH.

bindPlaybookArgs walks the declared arg specs and binds the caller's supplied values. Unsupplied required args land in the `unbound` list so the agent

--- dependencies ---

bodyHasCloudSecret peeks at the request body (capped at 64 KB) to see whether it's a JSON object with a "cloud_secret" field. Restores the body afterw

* Read a boolean param. Absent (undefined/null) returns undefined. Accepts * the literal strings "true"/"false" (transport leniency). Any other prese

boolToInt is the trivial converter used in test failure messages where formatting "n params + 0 workspace" reads cleaner than a branching message.

bootstrapCmd returns the agent bootstrap blob — the consolidated workspace + user + collections + always-on conventions + roles + playbook metadata +

bootstrapSectionBytes returns a per-section byte breakdown of a bootstrap blob. Marshalled with the same encoder behavior as the real handler (compact

bucketEndTime returns the Unix timestamp at which the CURRENT 5-minute claim-code bucket rolls over to the next one. Used as the `expires_at` value in

* Roll the catalog's flat item params (status / priority / category / parent * plus arbitrary `field` key=value entries) into the `fields` JSON strin

buildFrame builds a synthetic sync frame. Layout (offsets into the returned []byte, NOT into the user-facing frameBytes parameter): [0]: yMess

knownPlaybookTriggers is the set of trigger values the software playbook schema accepts, sourced directly from SoftwarePlaybookTriggers in templates.g

Build the placeholder DOM. Kept tiny — purely visual, ignored by ProseMirror's selection model.

buildRefCell assembles the flexible REF/TITLE cell within a visible budget. Only the title is truncated — the pin marker, ref, and "(archived)" suffix

buildRelatedGroups mirrors cmd/pad/query.go's function of the same name. Reproduced here because the CLI version is in package main. Groups every link

* Build the image-edit toolbar — rotate trio (left 90°, 180°, right * 90°) plus a crop button. Each button delegates to the supplied * callback; the

buildSQLiteTemplate runs the full migration chain once into a process-wide temp file. The template is checkpointed and left in DELETE journal mode (no

Tags: the catalog passes a JSON array of strings; ItemCreate/ItemUpdate * store the canonical JSON-encoded string form.

buildTemplate runs the full migration chain once into a process-wide temp file and returns its path. The template is checkpointed and left in DELETE j

buildTimeline merges comments, activities, and versions into a single chronological stream, applying deduplication and collapsing logic.

buildToolSurfaceTools projects a catalog slice into the serialized per-tool summaries. Shared by ToolSurfaceJSON (the REST/browser path) and actionMet

bulkFieldUpdate merges field changes into the item's existing fields, validates against the collection schema, runs the open-children guard (unless fo

bulkMoveCollection moves one item into req.Collection, migrating its fields between schemas — the same core as handleMoveItem, applied per row. A stat

bulkTagUpdate adds (add=true) or removes (add=false) the given tags from the item's tag set, preserving existing order and de-duplicating.

--- utility ---

Build a button with consistent typing on the modal.

canEditComment reports whether the requester may edit the given comment: the authenticated author (matching user_id) or a platform admin. A comment wi

canPromptForTemplate returns true when stdin and stdout are both TTYs — i.e. we can interactively prompt the user for a template choice.

Cancel the pending debounce without flushing. Leaves dedupe state intact.

cancelPendingAck removes a request from the pending-acks map. Used after a timeout / write failure to free the slot before retrying.

captureHelpCmdCapabilities runs helpCmd via a synthetic root and returns its --capabilities output as a string. Mirrors the runHelp pattern in help_cm

cascadeTitleRename keeps title-form backlinks consistent when an item's title changes. Two effects to maintain inside the rename tx: 1. Sources that

chainTasks creates n open tasks linked in a blocks chain t0 -> t1 -> ... -> t(n-1) and returns them in order.

checkParentCycleQ walks the ancestor chain from parentID and returns an error if itemID is found (which would create a cycle). Parameterized over the

checkRedirect re-validates every redirect hop against the SSRF guard and caps the redirect chain length. Without it, an allowed public endpoint could

childrenDoneFiltersForCollection is the batch version: it gathers one filter per distinct child-item collection across all parent→child links for pare

childrenDoneFiltersForParent returns a filter per distinct child-item collection under the given parent. Each filter carries the child collection's re

classify404 splits HTTP 404 by ResourceKind into the right code + hint. Called from classifyHTTPStatusKind only — extracted so the 404-shaped logic do

Clear the pending (dirty) markdown — call once a save has landed.

cloneStringSlice returns a copy of in so callers holding the returned model can't mutate the input the caller still owns. nil → nil so the model's sli

closeAll closes every active connection on this room and waits for the readers to drain. Used by RoomManager.Close on server shutdown. Holds r.mu only

* coerceDefaultForType applies type-aware coercion to a default value * collected from the UI. Mirrors the parsing rules in * `coerceDefaultValue` (

coerceJSONForImport normalizes an imported JSON column value to a well-formed default of the expected shape. Used at the import boundary (ImportWorksp

collabRevalidationLoop ticks every collabMembershipRevalInterval while the WebSocket is open and re-runs authorizeCollabAccess. On access loss it send

collectAlwaysOnConventions returns the active, always-on conventions for a workspace, projected into the bootstrap-friendly shape. Sorted by priority

collectConventionIndex returns the metadata-only catalog of EVERY active convention in the workspace (all triggers, always-on included), projected int

collectGrantChainsForBackfill returns a map keyed by request_id with the newest session_data + the subject (user_id) per chain. Walks both oauth_acces

collectionDefaultIcon returns a default icon for known collection slugs.

* Resolve the collection `schema` param to the JSON string the create/update * endpoints persist. The catalog's `schema` is a structured CollectionSc

* Roll the collection settings params (layout / default_view / board_group_by) * into the JSON `settings` string the endpoint persists — the browser

collectionSlugForKind maps an artifact Kind to the destination collection slug in a workspace.

--- collections ---

collectionsDeleteCmd soft-deletes a collection. Server-side (store/collections.go::DeleteCollection) sets collections.deleted_at on the collection row

collectionsUpdateCmd updates an existing collection's name, icon, description, prefix, schema, or sort order. Only flags the caller explicitly sets ar

--- comments ---

--- serve ---

computeHMAC returns the hex-encoded HMAC-SHA256 of the body using the secret.

conflictHintFor generates the actionable hint for ErrConflict.

* Compute the URL to connect to on this attempt. The base URL * is the (immutable) collab endpoint with `schema_version` * already encoded; we add

Connection mutation endpoints (PLAN-1519 / TASK-1524 / IDEA-1517 §3). All four mutations follow the same shape: 1. Resolve current user from context