packageJSONResult converts a CLI stdout string into an MCP tool result. JSON bodies surface as structuredContent; non-JSON falls back to text. Top-lev

packageStructuredResponse encodes payload to JSON, then decodes it back to a generic any so the StructuredContent surface matches the shape MCP client

parseExamplesFromLong extracts the indented invocation lines that follow an "Examples:" header in a cobra Long string. Returns nil when no such sectio

pickTemplateInteractive presents a numbered list of visible templates grouped by category and returns the chosen template's Name. Returns the default

postOAuthFormBearer POSTs an x-www-form-urlencoded body with a Bearer Authorization header (used for /oauth/introspect, where fosite v0.49 requires ei

requireCollectionFullyVisible checks that the collection is visible to the requesting user under FULL-collection-access semantics (BUG-1920 — codex R2

requirePostgresForConcurrency skips a test unless a real PostgreSQL backend is configured. The parent-link TOCTOU races (BUG-2073) are Postgres-only:

resolveAssignName rewrites a `--assign <name|email>` input into `assigned_user_id <uuid>` by hitting the workspace-members endpoint and finding a matc

size returns the current entry count. Used by tests and by startMCPSessionTracker's initial gauge prime.

tokenWorkspaceID returns the workspace ID set by the TokenAuth middleware, or an empty string if no token was used.

touch inserts or refreshes an entry. No-op on empty id (defensive: callers pre-filter, but a missing header should never bump anything). Fires onChang

transformAs POSTs a rotate as a specific user + workspace role, bypassing the auth middleware the same way downloadAs does.

uploadItemFixture creates a workspace + collection + item for the item_id-invariant tests, returning the workspace slug and the item.

validateCloudSecret checks the cloud_secret field in a JSON request body against the server's configured cloud secret. Returns true if the secret matc

watchNotificationVisible decides whether a Notification should be delivered to a caller holding the given watch map. Extracted from the handler so the

BrowserURL returns a URL suitable for displaying to humans in CLI prompts (e.g. "Or open the web UI at X"). It behaves like BaseURL except that when t

BuildMetaPayload returns the meta payload for the given pad runtime version. An empty padVersion falls back to FallbackVersion for the same reason ser

CheckSession returns the current auth status.

ConvertOpenAPI converts an OpenAPI 3.x specification into a human-readable markdown document. The output is organized as: - H1 with the API title - I

CountBacklinks returns the total number of same-workspace backlinks the requester would see for a given target, applying the same visibility filter as

CreateEmailVerification generates an email-verification token for the given user. Returns the plaintext token (to embed in the verification URL). The

CreateWebhook registers a new webhook for a workspace.

CurrentUserFromContext returns the user attached by WithCurrentUser (or by the standard auth middleware), and a boolean signalling whether one was pre

Get returns the current session workspace, or empty string when none has been set.

GetChildItems returns all non-deleted child items linked to the given parent via item_links. Returns children from any collection.

IsConnectionWorkspaceAllowed reports whether workspace_id appears in the connection's allow-list. Used internally by GetOAuthConnectionAccess when cal

LastRestoreSeq returns the item.seq of the most recent restore for itemID, or (0, false) when none has been recorded. Join consults it to force_refres

ListMCPAuditByUser returns the user's most recent audit rows in reverse-chronological order. limit caps the page; offset paginates. Caller must enforc

NewSQLite returns a *store.Store backed by a fresh SQLite file in t.TempDir(), fully migrated. See the package doc for the template+copy mechanism. St

Provider returns the fosite.OAuth2Provider that sub-PR C's HTTP handlers will call (NewAuthorizeRequest, NewAccessRequest, WriteAuthorizeResponse, etc

PruneSweep finds every item whose ENTIRE op-log is older than `minAge` and prunes the whole op-log for those items under the per-item lock. Returns a

RecordItemWorkspaceMoveTx inserts one provenance row inside an existing transaction. It is tx-taking by design: the row must be written in the same tr

UpdateItemWithPreCheck is UpdateItem with an optional pre-mutation hook that runs inside the same transaction (and, on Postgres, holds the same worksp

WorkspaceStorageUsage returns the total bytes consumed by non-deleted attachments in the workspace. Includes derived blobs (thumbnails) — those are re

WriteWorkspaceLink writes a .pad.toml in the given directory. serverURL is the base URL of the Pad server hosting this workspace. Pass the empty stri

adminBillingReq fires GET /api/v1/admin/billing-stats with the cookie from a logged-in user. Returns the recorder so callers can inspect status + body

assertBlobDenied pins the shared denial shape: 404, no-store, and the exact body every other denial writes.

assertBlobServed checks a 200 whose body is want (GET) or whose headers say so (HEAD — no body on the wire, so Content-Type + the positive cache direc

buildPlainShell builds the plain-text body for transactional emails. Self-hosted output is byte-equivalent to the prior templates. Cloud output adds a

buildQuery returns the URL-encoded query string for the mapping (without the leading '?'). Empty mapping → empty string. Numbers from JSON arrive as

cancelInit is the canonical exit path for both Ctrl+C and explicit "Cancel" actions during pad init / pad workspace init. It prints a brief message to

conventionsCollection returns a Conventions collection scoped to the caller's domain. The trigger and scope select options are supplied by the caller

decodeEnvelope helper extracts the ErrorEnvelope from an MCP error result. Uses textOf (the shared helper in catalog_test.go) to retrieve the JSON bod

deriveThumbnails generates thumb-sm and thumb-md variants for the uploaded image identified by parentID. Idempotent and tolerant of every failure mode

Cleanly close the WS, unbind doc/awareness handlers, and * prevent further reconnect attempts. Safe to call more than * once; idempotent.

doClaim issues a POST /api/v1/oauth/claim with Bearer PAT auth. extraReqID, if non-empty, attaches a WithMCPTokenIdentity context override to simulate

encrypt encrypts plaintext using AES-256-GCM and returns a base64-encoded ciphertext prefixed with "enc:" to distinguish from plaintext values.

enrichItemsWithParent batch-populates parent link info on a slice of items. Used by list endpoints where calling enrichItemForResponse per-item is too

── Shared helpers ──────────────────────────────────────────────────────────── ensureWorkspace checks if the current directory is linked to a workspac

* Coerce a possibly-NaN/Infinite measurement to something usable. * * Infinity takes the fallback rather than saturating at a bound: an infinite *

── fixtures ───────────────────────────────────────────────────────────── fullPreflight is a preview where EVERY bucket and EVERY warning is non-trivi

--- helpers ---

getWorkspace returns the full workspace object resolved by middleware. Falls back to direct resolution for routes without RequireWorkspaceAccess.

hopTransitions returns only the "real" status hops — excluding the create-time "entered initial status" seed row (id prefix "create_") that every crea

isCancellation reports whether err represents a user-initiated abort from any interactive init prompt. Init RunEs use this to convert the sentinel int

isolateHome redirects HOME to a temp dir and chdirs to a fresh temp project dir so credential writes and .pad.toml detection don't leak into the real

itemPrefetchHandler routes /api/v1/workspaces/{ws}/items/{ref} GETs to a static map keyed by ref so each link-test can declare just the items it needs

parsePadURI extracts (workspace, kind, arg) from a pad:// URI. arg is empty for list-style resources (no trailing segment). Forms accepted: pad://w

playbooksCollection returns a Playbooks collection scoped to the caller's domain. Like conventionsCollection, the trigger and scope select options are

publishItemEventWithName publishes a real-time event for item changes with actor name. `seq` is the item's workspace-scoped monotonic mutation cursor

readAttachment handles pad://workspace/{ws}/attachments/{id}. It requests the existing thumb-md path so authorization, workspace isolation, image proc

runApplierEcho spawns a goroutine that reads all incoming TextMessage frames on conn, looks for applier_request, and immediately responds with applier

seedGrantee creates a throwaway user to be the recipient of a grant, for tests that need a real grant/link ID on a hidden or visible resource (BUG-192

stopMCPSessionTracker signals the sweeper to exit. Called from Server.Stop. Idempotent.

AllowedAudience returns the canonical resource URL the server is configured to accept. Sub-PR C's /authorize handler reads this to reject mismatched `

ApplyPatch applies a patch to baseText to produce the target text. Returns an error if the patch cannot be applied cleanly.

Clone overrides DefaultSession.Clone so the returned value is a *Session, not a *DefaultSession. Without this override, fosite's internal Clone() call

CloudMode reports whether the marketing footer is currently enabled. Templates read it through getCloudMode() so they pick up the same snapshot for th

ComputeRef sets the Ref field from CollectionPrefix and ItemNumber. Call this after populating the item from a database query.

ConvertGeneric converts an HTML document into markdown by first running go-readability to strip chrome, navigation, and ads, then piping the cleaned H

DeleteUserSessions destroys all sessions for a user (logout everywhere).

DetectTools returns the tools that appear to be in use, based on any of: a project-local directory, a home-directory install, or a binary on PATH.

EmitJSON walks the command tree below `target`, builds a cmdhelp v0.1 Document, and writes it to w as indented JSON terminated by a newline. `root` M

EnableTOTP atomically enables 2FA for a user and stores hashed recovery codes. The expectedSecret is the plaintext secret — it's compared against the

EnsureBootstrapToken generates a fresh first-run bootstrap token (or loads the existing one if a valid file is already present). Returns the token str