errCatalogMissing keeps the validation error messages in one place so the surface is consistent across the three required fields.

errMissingAction is the structured result returned when the input has no `action` field. Lists the valid actions inline so agents can retry with a cor

errUnknownAction is the structured result returned when `action` is set but not in the tool's action table. Same listing as errMissingAction so agents

Escape `[` and `]` in alt text so the markdown serializer's brackets stay balanced.

* Escape the characters that would break out of a markdown link/image * label (`[label](...)`). Backslash first so we don't double-escape the * esca

* Exact item_number lookup. Used by the `#N` / `item:N` / bare-digit * paths in `search()`. MiniSearch's tokenized search would surface * every doc

execMulti executes multiple SQL statements by iteratively using database/sql's Exec which processes one statement at a time, then advancing past it us

experimentalCapabilities returns the map advertised at capabilities.experimental in the initialize handshake's result envelope. Lets clients discover

--- completion ---

extensionForMIME returns a leading-dot extension for a MIME type, or "" if the MIME isn't on our known list. Used as a last-resort fallback when the C

extractAllowDraft removes any `allow-draft` / `allow_draft` bareword token from the raw CLI args and reports whether one was present. The returned boo

extractAroundSubstring returns body[match-radius:match+radius] when substr is present, or a "(not found)" sentinel. Helper for the error message above

extractBearer parses an Authorization header value. Returns the token and true on success. Anything that isn't "Bearer <token>" (case-insensitive sche

extractEnumStrings normalizes the schema's enum representation to a string set, accepting either []string or []any (mcp-go's exact shape has flipped h

extractFieldString reads a top-level scalar string from a JSON-encoded fields map. Returns "" when the JSON is empty, malformed, the key is missing, o

extractFrontmatterRegion returns the YAML text between the leading "---\n" fence and the next line equal to "---". Returns ("", false) when the openin

extractHiddenFormValue pulls the value of a hidden <input name="..."> out of rendered consent HTML, mirroring what a browser would submit. Values are

extractImportSpecifiers pulls the module specifiers out of every import shape we know about: static `import ... from '...'`, side-effect `import '...'

checkUniqueFields enforces FieldDef.UniqueScope == "workspace_collection" for the given collection. For each schema field with that scope, any non-emp

extractStructuredCLIError scans stderr for the `pad-structured-error/v1: {json}\n` marker line and lifts the structured error envelope into an MCP res

extractValidationField pulls the field name out of a BuildCLIArgs error message, returning empty string when no match is found.

fanOutLocally distributes an event to all local subscribers for the event's workspace and stores it in the replay buffer.

featureCount returns the current count for a workspace-scoped feature.

fencedCodeRanges returns half-open `[start, end)` byte ranges that cover every fenced (triple-backtick) code block in `content`, including the opening

fetchGitHubPR fetches PR data for the current branch using the gh CLI.

fetchLibraryEndpoint GETs one of the library endpoints and decodes the JSON body into a generic any so the caller can stuff it into the composed respo

Same idea for drop events — covers the dataTransfer.files surface.

* Extract file payloads from a paste event. Falls back to the empty * array when the clipboard has no files (regular text paste, etc.) so * the call

filterAgentAttention mirrors cmd/pad/query.go's helper of the same name — keeps only the attention types agents care about (stalled, blocked, overdue,

filterUserGrantsForCaller narrows collGrants/itemGrants — the TARGET user's grants, already loaded by the caller — down to what the CALLER can see. On

findFenceCloser scans forward from `start` looking for a line that begins with at least `tickCount` consecutive `fenceChar` characters (after up to th

findStatementEnd finds the index of the semicolon that ends the next complete SQL statement, correctly handling BEGIN...END blocks.

flagExists reports whether `name` is a known flag on cmd or any of its ancestors (covers persistent / inherited flags). Both long and short forms are

flagSource looks up the enum_source for a flag on the given command path. Returns ("", false) when no binding applies.

Run a flush immediately for the given `markdown` + `ctx`, applying the * full recovery/dedupe gauntlet before the injected PATCH. Used by the *

* Fire the pending save immediately, cancelling any queued debounce so it * can't fire a second, older-content PATCH. No-op (returns false) when *

Cancel the debounce, read the live editor markdown, and flush it now. * Returns false (no-op) when the editor is unavailable. Used by editor * t

* Cancel any pending backoff timer, tear down any existing * socket (including an apparently-OPEN one), and try connecting * fresh. Idempotent. Sa

Format a byte count as a human-readable string ("832 B", "1.2 MB", "5 GB").

freeInvocationSlug returns an invocation_slug that's free in the destination collection. If the requested slug is already taken it appends -2, -3, … u

generateShareToken creates a cryptographically random URL-safe token with at least 128 bits of entropy and returns both the raw token and its SHA-256

generateTwoFAChallenge creates a short-lived, HMAC-signed challenge token that proves the user already passed password verification. The token is boun

generateTwoFASecret creates a random 32-byte secret for signing 2FA challenge tokens.

getAuthedSession issues a GET as a logged-in user via a session cookie (GET needs no CSRF). The UA + IP match CreateSession so the session-binding mid

getCollectionSlugTx reads collections.slug for a collection_id inside the supplied tx. Tiny helper used by the wiki-link cascade hooks that need the s

getCurrentBranch returns the current git branch name.

getGaugeValue extracts the current value from a Prometheus Gauge.

getOrCreate returns the existing Room for itemID or, atomically under m.mu, mints a new one. Holding m.mu across the lookup + insertion keeps the grac

Read the current textarea value.

graphEdgeType maps a stored item_links.link_type to the hyphenated edge vocabulary the graph API advertises. Stored values are first canonicalized thr

guardArtifactFrontmatter extracts the leading "---\n...\n---" frontmatter region from the artifact bytes and walks it as a yaml.Node tree to enforce t

guestResourceFilterIncludeDeletedItems is the delta-sync variant of guestResourceFilter. It uses GuestVisibleResourcesIncludeDeleted under the hood so

handleControlMessage dispatches a TextMessage frame received from a peer. Today the only valid type is applier_ack (TASK-1257); any other type is drop

handleExportWorkspaceBundle streams a tar.gz containing the workspace JSON export plus every original (non-thumbnail) attachment blob and a manifest.

handleGetWorkspaceStorageUsage returns the consolidated quota summary for the workspace: used bytes, effective limit, the owner's plan, and whether a

handleImportWorkspaceBundle accepts a tar.gz bundle produced by the export endpoint and rebuilds the workspace including all attachment blobs. The ha

handleMCPOAuthAuth runs introspection against the OAuth server for any non-PAT bearer. Validates: - Token is recognized (storage lookup) and active.