handleMCPPATAuth runs the original TASK-950 PAT validation path. Extracted from MCPBearerAuth so the OAuth branch reads cleanly without a deeply-neste

1 MiB handleUploadAttachment accepts a multipart upload and writes it into the attachments table + the configured AttachmentStore. Flow: 1. Auth: edi

hardcodedLimit returns the hardcoded fallback limit for a feature on a given plan.

hasFieldChanges reports whether the input has any value that should trigger field-merging on update. Mirrors the CLI's check at cmd/pad/main.go itemUp

hasPending reports whether any embedded migration has not yet been applied.

hasUsableBaseURL reports whether s.baseURL is a URL a verification-email recipient on the public internet can actually reach. It supersets the unreach

hashRecoveryCodes returns SHA-256 hex hashes of the given plaintext codes.

hashShareToken computes the SHA-256 hash of a raw share token for lookup.

* djb2-ish 32-bit string hash. Stable, fast, and good enough for * spreading short user-ID strings across the hue circle. Returns a * non-negative 3

hiringSeedItems seeds a single example item in each core collection so users can see the shape of the workspace without having to build it from scratc

hiringStarterConventions is the curated convention seed pack for hiring workspaces. Kept small and universal; workspace owners can add more from the l

hiringStarterPlaybooks is the curated playbook seed pack for hiring workspaces.

hiringTemplate builds the "hiring" workspace template. Company-side hiring: track Requisitions → Candidates → Interview Loops → Feedback. Parent/child

* Convert HSL (h: 0..360, s/l: 0..1) → `#rrggbb`. Standard formula * (CSS Color Module 3, Annex A). Values are clamped at integer-byte * resolution

* Map a MIME type to a category icon. Mirrors the server-side category * enum in `internal/attachments/mime.go`. When MIME is unknown (HEAD * failed

importBundle reads a tar (already gzip-decompressed) from r and orchestrates the two-phase import. Returns the new workspace. Single-pass streaming:

--- import ---

incomingImplementedBy mirrors cmd/pad/query.go's helper. Filters the link list to incoming `implements` links only — outgoing implements describe what

indexClosingFence returns the byte offset within s of the start of the first line equal to "---" (optionally with trailing whitespace), or -1.

indexExists checks whether the named index exists in the database.

indexOfUsageLine returns the byte offset of the line containing "Usage:" (cobra's help-block prefix), or -1 when absent. The match is anchored to a li

--- reset-password ---

inlineCodeRanges returns half-open `[start, end)` byte ranges that cover every inline-code span in `content`, skipping over the fenced regions caller

insertRawWebhook writes a webhook row directly, bypassing CreateWebhook's encryption, to simulate a legacy pre-encryption row.

insertWithPlanAndDate is a test-only helper that inserts a user with a specific plan + created_at timestamp. CreateUser doesn't expose either directly

* Install a fake `window.matchMedia` whose `MediaQueryList` starts at * `initialMatches` and lets the test fire synthetic `change` events. Returns *

interviewingSeedItems seeds one example in each core collection.

interviewingStarterConventions is the curated convention seed pack for candidate-side job-search workspaces.

interviewingStarterPlaybooks is the curated playbook seed pack for the interviewing template.

interviewingTemplate builds the "interviewing" workspace template. Candidate-side job search: track Applications, Interviews per application, plus sib

invocationSlugTaken reports whether an item with the given invocation_slug already exists (non-archived) in the destination collection.

isAccessDenial reports whether the given error from authorizeCollabAccess represents a real authorization decision (member removed, role demoted, item

isActiveStatus returns true if the status indicates work actively in progress. It excludes both initial/queued states and terminal/completed states.

isAllDigits reports whether s is non-empty and entirely ASCII digits. A public TLD is never all-numeric (RFC 3696), so an all-digit final label signal

isAllowedRegisterScope is the v1 allow-list. TASK-953 widens this to include workspace-scoped scopes (pad:workspaces:slug,…).

isAutosaveVersion reports whether an entry is a collab-snapshot version row (the web editor's 5s auto-flush). These are the only versions we collapse

isBlankLineAt returns true if the line starting at byte position `pos` contains only whitespace (space or tab) before its newline, or runs to EOF with

isClosedDone is a non-blocking check for "has rc.done been closed?". Used by the writer's error path to distinguish a real network error from a watchd

isClosingFence checks if line closes a fenced code block opened with `fenceLen` of `fenceChar`. The closing fence must be at least as long as the open

isCollectionSlugVisible reports whether the named collection survived the visibility filter. Used by the bootstrap path to gate convention/playbook qu

isForeignKeysOff reports whether a PRAGMA statement disables foreign keys. Matches the canonical forms used in migrations 022 and 055 plus the common

isInRanges returns true if `pos` falls inside any half-open `[start, end)` interval in `ranges`. `ranges` must be sorted by start (which both fencedCo

isKnownVariant gates the ?variant= query against a closed set so an attacker can't probe arbitrary variant strings. Mirrors the constants in models.At

isLineStart returns true when the character at byte position i is preceded by a newline (with arbitrary leading whitespace allowed between the newline

isMutatingMethod reports whether an HTTP method can mutate server state. The verified-email gate only fires on these; reads pass through so an unverif

isMutatingMethod reports whether an HTTP method can mutate server state. The verified-email gate only fires on these — reads (GET / HEAD / OPTIONS) st

isOpenAPIJSON returns true when the body is a JSON object that declares a top-level `openapi` (3.x) or `swagger` (2.0) key. Other shapes (arrays, prim

isOpenAPIYAML returns true when one of the first ~8 KiB of unindented (top-level) lines starts with `openapi:` or `swagger:`. We don't pull in a YAML

isPublicDNSName reports whether host is a syntactically-valid public FQDN (RFC 1123 labels) whose TLD is neither a special-use reserved name nor all-n

* Returns true when `err` is the distinct 429 server-busy error. Mirrors * the `isPlanLimitError` idiom so call sites can branch on rate limiting *

isSliceFlag is true when a flag should be emitted as repeated `--flag value` pairs rather than a single `--flag value`. Covers both pflag's slice type

isStringType returns true when v is a Go string. Used by the fields-builder to distinguish "real value to pass through" from "empty/missing".

isUniqueViolation checks whether an error is a unique constraint violation. Works for both SQLite (UNIQUE constraint failed) and PostgreSQL (duplicate

isValidDNSLabel reports whether l is a valid RFC 1123 hostname label: 1–63 chars of [a-z0-9-], not starting or ending with a hyphen.

isValidatedBearerAuth reports whether the request was authenticated via a Bearer credential TokenAuth actually validated — a long-lived API token (isA

isValidatedSessionBearerAuth returns true if the request was authenticated via a validated CLI session-bearer token (Authorization: Bearer padsess_...

isZeroDefault returns true when DefValue is the conventional zero for the flag's type. Suppressing zero defaults keeps the emitted document small and