actionItemExport handles pad_item.action=export. The CLI's `pad item export <ref>` defaults to WRITING A FILE (<slug>.pad.md), which is useless to an

actionItemImport handles pad_item.action=import. The CLI's `pad item import <file>` reads the artifact from a file (or stdin when the positional is `-

asText extracts the text payload from any content type that has one. mcp-go's Content interface is implemented by TextContent, etc.; we only care abou

assertGotForceRefresh drains conn until it either receives a force_refresh control frame (pass) or the conn closes without one (fail).

buildDoneContextMap builds a map of collection ID → (schema, settings) for quick lookups during dashboard / lineage traversals.

bulkUpdateRefs canonicalizes the `ref` input — accepts repeatable shapes the cmdhelp registry generates (string for a single value, []any from JSON ar

bundleAttachmentPath builds the tar entry name for an attachment. Exported as a function (not a const helper) so the import path can import it and res

Cancel the pending debounce without saving. Leaves the dirty flag set.

capBootstrapDashboard wraps a DashboardResponse with the bootstrap's per-section caps. The underlying *DashboardResponse is shallow-copied before the

checkBootstrapToken validates the X-Bootstrap-Token header on r against the in-memory token using a constant-time comparison. Returns false if no toke

Clamp a rectangle to fit within `bounds`, integer coords throughout.

cloneStringMap returns a shallow copy of m. Used by mappers that need to normalize a single value before handing the map to a downstream helper, witho

codeOrBlank wraps t in backticks unless t is empty. Any stray backtick characters inside t are stripped first so the resulting cell always carries exa

computeAdminUserStatus derives the at-a-glance status pill from the underlying fields. Precedence is intentional: a disabled user with no workspace is

countParentLinks returns how many `parent` link rows an item is the source of. The invariant is that a well-behaved item has at most one — the DELETE-

countUAChangeEvents returns the number of session_ua_changed rows in the audit log.

credentialsPath is retained for internal call sites.

decodeJSONWithLimit is the size-configurable variant. Use this for endpoints that accept large payloads (e.g. bulk-import) where the default cap is to

decodeUserGrantsResponse requires a 200 and decodes the body, failing the test otherwise.

Cleanly close the WS, unbind doc/awareness handlers, and * prevent further reconnect attempts. Safe to call more than * once; idempotent.

dialWSContentSeq appends `?content_seq=<seq>` so the test exercises the BUG-2264 stale-seed force_refresh fence.

doBrowserLogin implements the browser-based CLI auth flow. It creates a pending session, prints the auth URL, and polls until approved.

docsCollection returns the standard Docs collection shared across templates.

doneFieldKey resolves the select field whose value represents a collection's workflow/done state (CollectionSettings.BoardGroupBy, else "status"). Use

durationsByCollection turns per-collection samples into median+count entries, ordered by count desc then slug.

emailConfigured reports whether this instance can actually SEND an emailed link — a sender is wired AND the public base URL is usable. This is the DR-

emitRealPadJSON builds the real pad cobra tree and emits its JSON representation with a static (no-resolver, no live-workspace) configuration. Tests t

enableTOTPForDeleteUser turns on 2FA for a bootstrapped delete-test user using a known secret, mirroring the real SetTOTPSecret → EnableTOTP flow, and

enqueue tries to push one entry without blocking. Returns true on success; on a full queue, increments the drop counter and returns false. The MCP mid

envelopeFrom reads the ErrorEnvelope back out of an MCP error result's structured content. Used by classifyHTTPStatus's 404 workspace path so we can l

* Escape HTML-significant characters so user-controlled strings can be * safely interpolated into attribute values and text nodes. Local copy so * t

escapeTable replaces newlines and pipes so a value can sit in a markdown table cell without breaking the table grid.

extractFieldValue extracts a string value from a JSON fields string.

extractHash pulls the hash component out of an "fs:<hash>" key and validates it. We require the canonical 64-char lowercase-hex sha256 form on every p

extractUnknownWorkspaceSlug pulls the slug from a CLI stderr like "workspace 'foo' does not exist" so the envelope can name it. Returns empty string i

fieldString parses an item's fields JSON and returns the string value at key (or "" if absent).

filterWorkspacesByTokenAllowlist returns the subset of wss the request's OAuth consent allow-list permits, or wss unchanged when no per-slug gate appl

firstLine returns the first line of s with surrounding whitespace trimmed. Useful for collapsing a multi-line Long string into a Summary.

getAPIToken retrieves a single API token by ID.

---- helpers ----

getJSON serves a GET in-process and returns the response body, mapping any 4xx/5xx to a Go error (the resource protocol surfaces these as JSON-RPC err

getTokenExpirySettings reads platform settings for token expiry policy.

globalAgents returns the agents that target a stable per-user config file — i.e. everything except CWDBased (project-local) agents. It's the iteration

True when `href` is (or resolves to) the cross-workspace resolver route.

isPrivateIP returns true if the IP is in a private, reserved, or otherwise non-routable range. It covers loopback (127.0.0.0/8, ::1), RFC1918 (10/8, 1

jsonEqualString compares two JSON strings tolerantly of insignificant whitespace differences that emerge from JSONB ↔ TEXT round-trips.

linkChild wires child -> parent via a `parent` link (the shape GetChildItems / GetChildItemsForParents walk).

listItemLinks issues an in-handler GET against api/v1/workspaces/{ws}/items/{slug}/links and decodes the response into models.ItemLink so the un-* dis

loadJSONConfig reads path as a JSON object. A missing or whitespace-only file is treated as an empty config (so AddPadEntry can populate from scratch

loadSchemaForTest is a test-only wrapper around FindAndCompileSchema that fails the test on error and starts the walk from the test's CWD.

loadTOMLConfig reads path as a TOML document into a map. A missing or whitespace-only file is an empty config. Parse errors on a non-empty file propag

logActivityWithMeta logs activity with optional JSON metadata. For "updated" actions, uses debouncing to coalesce rapid successive saves (e.g., autosa

logActivityWithMetaReturningID is like logActivityWithMeta but returns the activity ID. The ID is either newly created or the coalesced existing activ

logWorkspaceAuditEvent logs a workspace-scoped audit event (e.g. member invited). Best-effort: errors are silently ignored.

mapItemStarred dispatches `pad item starred [--all]`. GET /api/v1/workspaces/{ws}/starred?include_terminal=true when --all is set. Without --all the

mapKeys returns the keys of m, in arbitrary order. Used only by test failure messages where order doesn't matter.

mapRoleCreate dispatches `pad role create <name> [--description ...] [--icon ...] [--tools ...]`. POST /api/v1/workspaces/{ws}/agent-roles with body

mapWebhookCreate dispatches `pad webhook create <url> [--events ...] [--secret ...]`. POST /api/v1/workspaces/{ws}/webhooks with body matching models

mapWorkspaceAuditLog dispatches `pad workspace audit-log [--days N] [--actor X] [--action X] [--limit N]`. GET /api/v1/audit-log (NOT workspace-scope

mapWorkspaceCreate dispatches `pad workspace create <name> [--slug X] [--template X]`. POST /api/v1/workspaces with body {name, slug?, template?} — m

mapWorkspaceInvite dispatches `pad workspace invite <email> [--role X]`. POST /api/v1/workspaces/{ws}/members/invite with body {email, role?}. Defaul