forcePlainColor disables ANSI so width/content assertions are deterministic regardless of whether the test binary's stdout happens to be a TTY.

guardSchemaAhead refuses to start when the database contains migrations this binary doesn't ship — i.e. the DB is AHEAD of the binary, the tell-tale o

handleCmdhelpCapabilitiesFallback scans args for the --cmdhelp-capabilities flag (cmdhelp v0.1 §8 fallback form). If found, it writes the capability b

headlessTestServer builds an httptest.Server that speaks the minimal subset of the Pad API that the headless bootstrap path touches: - GET /api/v1/a

============================================================ Helpers — shared by the three "request-row" tables ======================================

isSupportedOAuthProvider reports whether provider is one pad accepts.

itemRefOrSlug formats an item's issue ref (e.g. "TASK-5") when its collection prefix + item number are populated, falling back to its slug. Avoids pul

itoa is strconv.Itoa renamed to keep test bodies readable when they're already heavy on ref-formatting.

mapRoleUpdate dispatches `pad role update <slug> [--name ...] [--slug ...] [--description ...] [--icon ...] [--tools ...] [--sort-order ...]`. PATCH

mkAdminCookieReq is the same shape minus the Authorization header. Simulates the cookie-session path where isBearerAuth must return false and the admi

mustCreatePATForTest creates a real PAT against a fresh user + workspace. Returns the raw token string suitable for the Authorization: Bearer header.

mustWorkspaceID resolves a workspace slug to its internal ID via the store. Tests use it because they don't have access to the request context that ge

normalizeCollectionSlug maps common singular/short forms to actual collection slugs. Thin wrapper around the shared collections.NormalizeSlug so the C

normalizeServerURL canonicalizes a server URL for use as a credential key. Trailing slash and surrounding whitespace are stripped; nothing else is tou

normalizeWebhookEvents canonicalizes a webhook's event filter to the JSON-array string the store + dispatcher expect. Returns (value, true) when a no

nthPositional returns pos[n] or "" when absent.

numericInput pulls an int64 out of a JSON-typed input value. JSON decoders deliver numbers as float64 (or json.Number when UseNumber()); we accept bot

oauthRequestToFositeRequest hydrates a stored row into a fresh fosite.Request, fetching the client by ID and unmarshalling the session bytes into the

Surface an upload failure to the user.

openBootstrapEnabled reports whether open-bootstrap is active for this server: bypass flag is set AND we're not in cloud mode. Cloud mode always wins

parseCollectionFieldsDSL parses the CLI's --fields DSL into a {fields: [...]} map ready for json.Marshal. Empty input returns an empty Fields slice (t

publishCommentEvent publishes a real-time event for comment changes.

queryOAuthRequestRow reads a row by signature from the named table and returns (request, active, err). - For oauth_pkce_requests, active is always tr

rawPeerAddr returns the untampered TCP peer address captured by CapturePeerAddr, falling back to the current r.RemoteAddr if the middleware wasn't ins

readItem handles pad://workspace/{ws}/items/{ref}. Why JSON-then-format instead of `--format markdown`: pad's CLI `--format markdown` for `item show`

readMigrationNames returns sorted .sql filenames from an embedded FS directory.

Helpers ------------------------------------------------------------------

recordMCPAuthzDenial bumps the pad_mcp_authz_denials_total counter when the request originated from the MCP surface. The discriminator is the presence

recordMCPCallMetrics fans the audit-row data out to Prometheus. No-op when metrics aren't wired (selfhost / tests). Kept separate from MCPAuditLog so

recoverSweeper is the panic firewall for the long-running background sweeper loops (orphan GC, op-log GC, token reaper, workspace purge). Each of thos

--- helpers --- registerNonAdmin inserts a member-role user directly into the store and mints a session token for them. Bypasses the admin-registratio

replaceWikiLinks deletes prior wiki-link rows for `sourceItemID` and inserts fresh ones extracted from `content`. Resolution against the workspace's i

requireConnectionOwner is the per-mutation prologue. Returns the (currentUser, requestID, ok) triple. On `ok=false` the response has already been writ

requirePostgresForConcurrency skips a test unless a real PostgreSQL backend is configured. The parent-link TOCTOU races (BUG-2073) are Postgres-only:

respondWithConnection re-fetches + writes the connection DTO post- mutation so the page can re-render without a separate list refresh. Stats lookup is

rootFlagsToArgs converts a startup root-flags map into the pre-formatted CLI token list every fetch should append. Empty values are skipped (matching

runOpenChildrenGuard executes the guard logic inside the store-layer transaction. Returns: - (nil, nil) when the guard doesn't apply (no transition,

schemaHasField returns true if the collection schema defines a field with the given key.

schemaTypeBrief returns a one-line type description for a schema proxy: the declared type, format if present, item type for arrays, or the ref name fo

seedItem creates a collection (idempotent on slug) + an item with the given title, returning the resolved item record.

setCSRFCookie writes a new CSRF token cookie. The cookie is NOT HttpOnly so that JavaScript can read it and send it back as a header.

setupOwnedDeletedWorkspace registers Alice + Bob, has Alice create and then soft-delete a workspace, and returns their tokens plus the workspace. Shar

since returns all buffered events with ID > sinceID, in chronological order. Returns nil if sinceID is older than the oldest buffered event AND the bu

singleLine collapses internal whitespace and newlines for safe inclusion in a markdown table cell.

snapshotBeforeMigrate copies the live SQLite database file to <db>.pre-<VERSION> before any pending migrations run, so a botched upgrade can be rolled

sortedActionNames returns def.Actions' keys in lexical order. Used for both the schema's action enum (so the ordering is stable across builds and repr

tightenPerms sets path to 0600 if it exists. Best-effort: errors only emit a warning to stderr (the user's primary intent — install / no-op — already

* Strip a row down to the skinny shape. Defensive: discard `content` * if a caller passed a full `Item` rather than an `ItemIndexRow`. The * destruc

unwrapItems extracts the array from a `{items: [...]}` envelope — the post-BUG-985 shape ExecDispatcher and packageHTTPResponse use for top-level arra

upstreamHTTPErrorResult is the canonical wrapper for "the dispatcher made an HTTP call that returned a non-2xx" cases outside the main executeRequest/

wrapItemNotFound rewrites a bare "not_found" APIError from the item-by-ref endpoints into a message that echoes the failing ref and workspace, so `pad

write performs a single insert with a per-call timeout. DB errors log + drop the row — there's no retry path because the audit log is best-effort by d

writeRateLimitResponse sends a 429 response with Retry-After and X-RateLimit-* headers.

AllToolNames returns all valid names and aliases that can be passed to `pad agent install`.

AsOpenChildren returns the parsed open-children details when this APIError carries them, or nil otherwise. Returns nil for any error other than "open_

AttachmentDownloadURL builds the canonical attachment download URL. Pass an empty variant for the original; otherwise "thumb-sm" / "thumb-md" (the ser

BackfillStatusTransitions populates status_transitions from history in two passes, designed to be called once from server startup after migrations run

CancelCustomer asks pad-cloud to cancel every active Stripe subscription for customerID and then delete the Stripe customer object. Idempotent at the

Capabilities reports what this backend can do. The editor reads these flags via GET /api/v1/server/capabilities and gates rotate/crop UI on per-format

CategoryLabel returns the human-readable label for a category slug. Unknown categories are returned unchanged so the picker can still render a reasona

ColorizedStatus returns a status icon + status text with appropriate color.

===================================================================== AccessTokenStorage =============================================================

CreateOAuthUser creates a user from an OAuth provider with a random unusable password. OAuth users can later set a password via the password reset flo

============================================================ PKCE request sessions (handler/pkce/storage.go PKCERequestStorage) ======================

DateBucket returns a SQL expression that truncates an RFC3339 UTC timestamp TEXT column to the start of its bucket, as a sortable TEXT label, for GROU

DeleteAccountAtomic deletes a user and all their owned workspaces in a single transaction. If any step fails, the entire operation is rolled back and

DisableTOTP disables 2FA and clears the secret and recovery codes. It also clears the totp_last_step single-use watermark (BUG-2054) so it doesn't out

Dispatch runs `<Binary> <cmdPath...> <cliArgs...>` and packages the output for an MCP client.

EnsureUniqueUsername takes a candidate username and returns a unique variant by appending -2, -3, etc. if the candidate already exists in the database

ExportItemArtifact GETs the single-item artifact export endpoint (GET /workspaces/{ws}/items/{ref}/export) and returns the artifact bytes (Markdown +

Fetch runs `<Binary> <args...>` and returns stdout on success.