notFoundHintFor generates the actionable hint for ErrNotFound. References the route + ref/slug + suggests verification of the path the caller passed.

notFoundMessageFor returns a kind-aware short message for the not_found code. Falls back to a generic "Resource not found" when the kind doesn't match

* Fire the registered access-revoked handler for a 403 response. The * handler is called best-effort — its failures are swallowed so the * caller st

* Best-effort fire of the registered rate-limit handler. Swallows handler * failures so a broken UI hook can't corrupt the API error path. TASK-2080.

* Read a number param. Absent (undefined/null) returns undefined. Accepts a * numeric string (the MCP transport may deliver numbers as strings) — an

+1 when an upload starts, -1 when it settles — drives the busy gate.

Called when the tab becomes visible again.

openChildrenGuardChildVisible mirrors the visibility check used by the per-parent progress endpoint (handlers_items.go around `progVisIDs` / `isCollec

--- open ---

* Open a centered <dialog> showing the full-resolution attachment. * Closes on backdrop click, the close button, or the Esc key.

openOriginalForThumbnail resolves the parent row's storage key against the registry and returns a stream positioned at the start of the blob. The call

* Two-client convergence: text typed in one browser context appears in * a second context viewing the same item — no reload. This exercises * the li

openingFence checks if line starts a CommonMark fenced code block. Returns the fence character (' ` ' or '~'), the length, and ok.

optionAllowed reports whether val is among options. An empty options list means the field is unconstrained (any value allowed).

padCell left-aligns s in a column of the given visible width by appending spaces. If s is already at least that wide the string is returned unchanged

paramDefToToolOption maps a ParamDef to the matching mcp-go helper. Unknown Type strings fall through to WithString — same defensive default the cmdhe

* Parse a URL path and decide whether a 403 on it indicates that the * caller's READ access to the workspace's item set has been revoked. * Returns

parseArtifactRequest is the guarded HTTP-boundary parse used by the import handler. It applies three checks IN ORDER: 1. Byte cap on the raw body (ht

parseBody decodes the inside of a `[[...]]`. Returns nil if the body doesn't match any of the five recognized forms. Mirrors the editor's body-parsing

parseConsentPayload extracts and validates the user's tier choice + workspace access mode + creation flag + per-workspace selection from the consent f

* Pull the filename out of a Content-Disposition header value. Handles both * the RFC 5987 extended `filename*=charset'lang'value` form (preferred wh

humanBytes formats a byte count with the smallest IEC unit that keeps the value under 1024 — matches the convention used across the web UI's storage b

parseFieldsDSL is the cmd/pad-local alias for the canonical parser at collections.ParseFieldsDSL. Moved up to internal/collections so the MCP HTTP rou

parseJSONStringList decodes a JSON array string back to []string. Empty / null inputs produce an empty (non-nil) slice so callers can range without ni

* Parse a CSS length declaration like `12px`, `0`, `-9999px`, `1.5em` * into a number when the unit is bare (`0`) or px. Returns `null` for * percen

parsePlaybookArguments pulls the `arguments` field out of the playbook item's fields JSON and decodes it into a list of PlaybookArgumentSpec entries.

parseRefForRedirect splits a validated ref (the regex caller already confirmed `[A-Za-z][A-Za-z0-9]*-\d+`) into its uppercase prefix and number. GetIt

parseStructured pulls the JSON body out of a structured tool result and unmarshals it. mcp-go's NewToolResultStructured serializes the Go value as tex

parseV2 unmarshals a v2 file. Tolerates a missing or zero version field and a nil credentials map by normalizing both — anything else (malformed JSON,

permissionHintFor generates the actionable hint for ErrPermissionDenied. References the route + the inner backend message (which often names the missi

permissionLevel returns a numeric level for grant permission comparison.

persistThumbnail encodes the resized image, hashes the bytes, writes through the content-addressed storage backend, and inserts the derived attachment

pickApplier returns the longest-connected roomConn that hasn't already been tried, or nil if there are no candidates left. The stable ordering (sort b

planLimitDefault returns the hardcoded default for a plan+feature pair.

planLimitHintFor generates the actionable hint for ErrPlanLimitExceeded. The upgrade_url is already in the Details blob; the hint surfaces it in prose

planLimitMessage returns a human-readable statement-of-fact sentence for a plan limit violation. Each surface (web toast, CLI, MCP hint) appends its o

playbookCmd is the `pad playbook` command group for the first-class invokable-procedure surface introduced in PLAN-1377 / TASK-1382. Three subcommands

pollUntilSetupDone tickets every bootstrapPollInterval and returns nil the first time CheckSession reports setup_required: false. Returns ctx.Err() on

postLibraryItem POSTs an ItemCreate body into the named collection's items endpoint. Shared between conventions / playbooks branches of dispatchLibrar

prefixColumns rewrites a comma-separated SELECT list with the given prefix, e.g. "id, email" with "u." → "u.id, u.email". Small helper to keep userCol

preprocessArtifactFields applies the forgiving import coercions, mutating fields in place and returning the accumulated warnings: - Any select field

printAvailableCollections fetches collections from the API and prints them with their descriptions and valid status values. Used by create --help. Fai

printBootstrapMarkdown renders a human-friendly summary of the bootstrap blob. Intended for quick inspection from the terminal; the canonical machine

printInitStatus prints a clean status summary when everything is already configured.

Blocked-item resolution (both the attention-blocked section and the suggested_next blocked-filter) is driven by the firstActiveBlocker map computed on

projectBootstrapCollection converts a models.Collection into the slim bootstrap projection. The `schema` field is emitted as a nested JSON object when

projectBootstrapRole converts a models.AgentRole into the slim bootstrap projection. Stateless — the role count recompute for restricted callers happe

publishBulkItemsEvent emits one ItemsBulkUpdated SSE event for the slice of a batch mutation that landed in `collection` (TASK-1668). Collection is se

queryCrossWorkspaceBacklinksForWorkspace fetches up to `cap` rows from a single source workspace whose item_wiki_links point at the target via target_

* Queue a save for the given markdown: records it as the pending (dirty) * content and (re)arms the debounce. Rapid successive calls coalesce — *

rateLimitHintFor generates the actionable hint for ErrRateLimited. 429s are recoverable with backoff — the hint encodes that bias and points at the Re

rateLimitKey returns a key for rate limiting: user ID if authenticated, IP otherwise.

readCollections handles pad://workspace/{ws}/collections.

readCredsFile returns the on-disk JSON of credentials.json. Used to assert post-Save behavior — confirms the v2 format actually lands on disk rather t

readEntry reads exactly size bytes from a tar reader (the rest of the current entry) into a buffer, validating that the read length matches the header

readItems handles pad://workspace/{ws}/items.

readLoop is the inbound side: pull frames off the WebSocket, route sync frames through the op-log + broadcast, awareness frames to broadcast only. Ret

readOrSetConsentCSRF reads the current __Host-pad_csrf cookie or mints a new one if absent. The cookie's value is what gets rendered into the consent

readParentRef returns the ref of the item's current `parent` link target, or "" if there is no parent link. Used by the PATCH-atomic test to assert th

readSchemaInputBytes resolves the --schema flag value into raw JSON bytes, honoring the "-" (stdin), "@path" (file), and inline-literal modes.

readSendTimestamp extracts the embedded ts from a frame produced by buildFrame. Returns zero time if the frame is too short or its header byte doesn't

readWorkspaces handles pad://workspaces — the top-level workspace list (TASK-974). Shells out to `pad workspace list --format json` so the resource sh