isolateEnv points HOME and PATH at empty temp directories and chdirs into an empty temp directory, so DetectTools sees none of this machine's real sig

--- artifact export / import ---

itemLinkRoutesKeys returns the registered link_type values in stable sort order, used in error messages so users see the same listing every time.

itemMatchesParentFilter mirrors the CLI's parent-filter matching (cmd/pad/main.go's changelogCmd): case-insensitive comparison against the item's pare

itemMissingHint is the per-error-code hint generator for ErrItemNotFound. References the actual ref + route so the agent can pin the failure without r

itoa is a tiny strconv.Itoa wrapper kept local to avoid an extra import in this single-file test.

joinSorted concatenates ss with ", " between values. Caller is expected to pass a pre-sorted slice (the only call site uses itemLinkRoutesKeys which s

jsonLen marshals v to compact JSON and returns the byte count. Test helper; errors are squashed because they'd indicate a programming error in the tes

jsonStringList encodes a []string as a JSON array string suitable for both SQLite (TEXT column) and Postgres (JSONB column — pgx accepts a JSON-shaped

keys is a tiny helper for deterministic-ish error messages — fmt.Sprintf("%v", map) order isn't stable across Go versions and hides the actual content

keysNotIn returns the entries of want that are not already present in have. Used to detect parent lock keys that appeared on a post-lock re-read (BUG-

kindForCollectionSlug maps a collection slug to the artifact Kind it exports as. Only the playbooks and conventions collections carry the structured f

knownTriggersList returns the accepted-triggers set as a comma-joined string for assertion-failure messages.

listParentChildLockKeys returns every target_id this item is the `source_id` of under a childLinkTypes link — i.e. every parent whose children-set inc

lockedCopyFromSQLiteTemplate builds the template (once) and copies it to dst, holding sqliteTemplateMu for read across both steps so removeSQLiteTempl

lockedCopyFromTemplate builds the template (once) and copies it to dst, holding templateMu for read across both steps so Cleanup (which takes the writ

logBootstrapBanner emits a single multi-line INFO log entry pointing the operator at the /setup#token=<x> URL they need to visit to claim the first ad

logBundleStreamError logs at warn level with structured context. Mid-stream failures can't be turned into a clean HTTP error response (we've already s

logOpenBootstrapBanner is the PAD_BYPASS_SETUP_TOKEN companion to logBootstrapBanner. When the operator opts into the bypass, no token is generated —

loginTestUserAs is a variant of loginTestUser that takes explicit email/name/password so multiple distinct users can coexist within one test (loginTes

* Returns the length of the longest backtick run in `s`. Used by the * markdown serializer to pick a fence length one longer than any run of * backt

looksLikeJSON returns true when the body's first non-whitespace byte is `{` or `[`.

lookupAssigneeID issues an in-handler GET against api/v1/workspaces/{ws}/members and returns the user_id whose name OR email matches `assign`. Case-in

lookupRoleID issues an in-handler GET against api/v1/workspaces/{ws}/agent-roles/{slug} and returns the role's canonical id. The handler accepts eithe

maskPassword replaces the password in a PostgreSQL URL for safe display.

maskWebhookSecret blanks the plaintext HMAC secret before a webhook is returned in a list/get response, so the raw signing secret is never echoed afte

maybeAutoAddCreatorConnection inserts the newly-created workspace into the calling OAuth connection's allow-list when the grant has `may_create_worksp

maybeRebuildOnSchemaMismatch implements the TASK-1268 rebuild flow. Reads the latest persisted op-log row's schema_version for itemID. If a row exist

mcpCmd is the parent of `pad mcp ...` subcommands. - `pad mcp serve` — run the stdio MCP server. - `pad mcp install [agent]` — write a "pad" entry in

mcpInstallCmd implements `pad mcp install [agent]`. With no arguments, prints the install status across supported agents (so the user picks one). Wit

mcpServeCmd implements the stdio MCP server. The cobra command is a thin wrapper around internal/mcp.Server — all transport / handshake behaviour and

mcpStatusCmd implements `pad mcp status` — same as `pad mcp install` with no args, but exposed as a dedicated command for shell scripts.

mcpUninstallCmd implements `pad mcp uninstall <agent>`.

* Apply a single row to a workspace's items map with the per-row * seq guard. Used by `bootstrap` (both warm and cold paths) and * `upsert`/`applyDe

migratePostgres applies PostgreSQL migrations. PostgreSQL supports multi-statement execution natively, so we don't need execMulti.

migrateToWorkspaceNumbering performs a one-time migration from per-collection item numbering to per-workspace item numbering. It detects the old index

migrateV1 reads a v1 single-blob file and returns an in-memory v2 store keyed by the legacy ServerURL. A v1 file with an empty server_url is treated a

migrateValue attempts to convert a value from sourceType to the targetField's type. Returns the migrated value and true if successful, or zero-value a

mimeInPredicate builds a `a.mime_type IN (?,?,...)` fragment with matching args. Helper used by mimePredicateForCategory for the non-prefix categories

mimePredicateForCategory maps an attachments.Category value to a SQL fragment + matching argument list that selects all MIMEs in that bucket. Categori

mintUsedVerificationToken creates an unverified user, mints a verification token, and consumes it — leaving a single used (reaper-eligible) row.

* Fetch mock that returns a scripted sequence of responses. Each entry is * `{ status, body, retryAfter? }`; the last entry repeats for any calls *

--- move ---

mustCreateUserForTest creates a user for tests that need a user row but don't need a session. Counterpart to loginTestUser, which creates BOTH a user

newDynamicResolver constructs a cmdhelp.Resolver bound to the current pad runtime: workspace, configured server URL, and credentials. Returns nil whe

* Crypto-strong-ish placeholder id. crypto.randomUUID is the preferred * source; the Math.random fallback is only hit in environments without * the

newItem creates a fresh item in the given (hidden/visible) collection. Used by tests that mutate the fixture's default hiddenItem/visibleItem (e.g. ar

newJSONRequest is a local helper for tests that need to thread custom headers (Bearer auth, RemoteAddr) through to a request — the package's doRequest

newMCPAuditWriter constructs a writer with a 4096-deep queue. The caller is responsible for kicking the worker via run() and for stopping it via stop(

newPostgresConn opens a raw postgres connection (no migrations).

newSafeTransport returns an *http.Transport whose DialContext resolves each hostname inside the dialer and validates every returned IP. Only IPs that

newTestOAuthServer builds an internal/oauth.Server matched to the test harness's canonical audience (testCanonicalAudience). Used by mcpAndOAuthEnable

newTestWorkspace creates a workspace bound to the test store with the given slug. Helper for store-level tests that don't already use the larger setup

--- next ---

noWorkspaceResult builds the standard ErrNoWorkspace envelope with available_workspaces populated by the supplied lookup. Lookup is best-effort: failu

* Build the node that should replace a placeholder for a given upload * result. Image MIMEs become `attachmentImage`; everything else becomes * `att

normalizeArguments coerces the arguments value into []map[string]any so it serializes as a stable YAML sequence of maps. Accepts []map[string]any or [

normalizeBody trims a trailing run of whitespace/newlines and ensures the body ends with exactly one trailing "\n". An empty body becomes "\n".

normalizeBulkUpdateRefs accepts the JSON shapes the MCP transport can deliver for an array<string> param: []string (canonical), []any (mcp-go's typica