formatItemAsMarkdown turns the JSON body returned by `pad item show --format json` into a self-contained markdown document: heading with ref + title,

gaugeValueOrZero pulls the gauge value or returns 0 when the underlying metric hasn't been touched yet.

grantHiddenItemToOwner gives the fixture's restricted owner an item-level grant on the hidden item, independent of their collection_access restriction

handleControlMessage dispatches a TextMessage frame received from a peer: applier_apply_start / applier_ack (the designated-applier bracket, TASK-1257

handleCopyItemPreflight answers "what would this cross-workspace copy do?" without doing any of it. See the file header for the full contract.

isItemDone reports whether an item is in a terminal state for its collection's configured done field. Falls back to the default-terminal list against

isPublicAPIPath reports whether the given request path is an API endpoint that bypasses authentication entirely. These handlers must work even when th

itemCopyLine makes a server-supplied string safe to drop into a table row. Schema keys, labels, option values, link types and validator messages are a

itemLock returns the lazily-allocated mutex guarding setup-phase operations on itemID. Locks live in the manager for the lifetime of the process — for

* Latch the permanent placeholder for a row the server says is * gone. Same end state as the deletion broadcast, reached by a * different rout

maskAPIKey returns the display form of a sensitive setting value. Keys longer than 8 chars show their first and last 4 chars (abcd...wxyz); shorter no

mintOAuthTokenForTest drives the consent → token exchange and returns the access token. Lightly customizable via the form arg so callers can vary the

BUG-1616 extended coverage — admin-via-bearer gate at the SSE and WebSocket-collab entry points that sit OUTSIDE RequireWorkspaceAccess. These endpoin

newRootCmd constructs the pad CLI's root cobra command tree. Extracted from main() so tests can use the real tree (golden snapshots, schema validatio

newWebhookTestWorkspace creates a user + workspace so webhook FK constraints are satisfied, and returns the workspace ID.

normalizeCollectionSlug maps common singular/short forms to actual collection slugs. Thin wrapper around the shared collections.NormalizeSlug so the C

observeOAuthFlowDuration records the elapsed time since `start` for the given stage. Designed to be `defer`'d at the top of each OAuth flow handler so

* Open the workspace's IDB database for the given user, creating * object stores on first run. Cached so subsequent calls reuse the * connection. Re

parseFieldKVP normalizes the --field flag's various wire shapes (single string, []string, []any) into a `key→value` map. Empty / invalid entries are s

pathFor returns the full on-disk path for a given hash. Callers MUST have already validated the hash via validHash — this function does not re-check,

percentile returns the linearly-interpolated p-quantile (p in [0,1]) of vals, rounded to 1 decimal. 0 for an empty sample. Computed in Go so the same

postOAuthLogin fires a cloud-secret-authenticated oauth-login request and returns the recorder. The cloud secret rides the JSON body (the same channel

publishEventWithName publishes a real-time event with actor name.

* Recompute and apply the desired inert set from scratch. This is the ONLY * mutator: release doesn't undo its own writes, it re-derives the truth fr

recordMCPAuthzDenial bumps the pad_mcp_authz_denials_total counter when the request originated from the MCP surface. The discriminator is the presence

remoteCfg builds a Config wired to point at the given test server URL.

remoteHeadlessCfg builds a Config wired to point at the given httptest server URL in Remote mode. Remote mode makes EnsureServer a no-op.

renderItemsGroupedByCollectionMarkdown is the markdown counterpart of printItemsGroupedByCollection (#898): one `## Icon Name (N)` heading per collect

requireCommentVisible checks that a comment's underlying item is in a visible collection. Writes a 404 and returns false if not.

resolveAttachmentParentItem loads and validates the parent item of an attachment row that has ALREADY been established as live and belonging to the re

resolveRoleSlug rewrites a `--role <slug>` input into `agent_role_id <uuid>` by hitting the agent-roles endpoint and finding a matching role. Mirrors

retryOnParentSetChanged runs fn, retrying (up to maxParentLockRetries) while it returns errParentSetChanged. fn MUST open and own its own transaction

scanUser scans a user row into a User struct. Note: does NOT decrypt the TOTP secret — call store.decryptUserTOTP() after scanning if you need the pla

seedAccess inserts an access-token row in the chain identified by requestID. ts is the requested_at timestamp; sessionData + scopes land on the row. R

seedClient creates an oauth_clients row so chains have something to FK against. Returns the client ID.

seedGrantChain inserts one access-token row in a chain. Returns the request_id so tests can revoke / list / audit by it.

seedWorkspaceForConn creates a workspace and returns its ID — the join table stores workspace IDs, so tests need a real row.

setSourceContent rewrites the source item's body — the attacker's own legitimate edit of an item they hold, which is the whole vector.

setupEnsureWorkspaceTest produces a clean tempdir, points HOME at a tempdir (so credential/config writes don't leak), chdirs into the project so cli.D

softDeleteWorkspaceAt stamps a workspace's deleted_at to a specific time so the sweep's age cutoff can be exercised deterministically — there's no API

sseSubscriberStillHasAccess re-runs the workspace access check for an already-subscribed SSE client. Returns false when the caller can no longer see t

tokenScopeAllows checks if the token's scopes permit the given HTTP method and path. Scopes are stored as a JSON array of strings. Supported scopes (

A touch pointer event, dispatched on the IMAGE by default (the painted-image hit).

variantRow looks up a derived variant of parentID. GetAttachmentVariant is workspace-scoped (PLAN-2391 DR-16), so the scope is read back off the paren

withLocalFetcher replaces the package-level fetcher with one that allows loopback dials so httptest.NewServer addresses (127.0.0.1) can be reached. Re

CheckUserLimit checks a user-level limit (not workspace-scoped), such as total workspace count or total API tokens.

Cleanup removes the process-wide template database, if one was built. Call it from TestMain after m.Run() so a lazily-built template file doesn't ling

CopyCommitted reports whether err is a post-commit reporting failure — the copy happened, only its result was lost. Callers must not present these as

CopyItemPreflight runs the DRY RUN. It mutates nothing in the copy's own domain, so it is safe to call repeatedly and safe to retry. Returns the deco

============================================================ Authorization codes (handler/oauth2/storage.go AuthorizeCodeStorage) ====================

CreatePatch computes a compact patch that transforms oldText into newText. The patch can be applied with ApplyPatch to recover newText from oldText.

CreateReversePatch computes a patch that transforms newText back into oldText. Used for reverse-diff version storage: current doc has latest content,

CreateView adds a new saved view.

EncryptWebhookSecretsAtRest encrypts plaintext webhook HMAC secrets (BUG-2057). Called on startup when an encryption key is configured. It handles two

FTSRank returns the column/expression for full-text relevance ranking. SQLite: rank (built-in FTS5 column) — consumes ZERO args. PostgreSQL: ts_rank b

FindAgent returns the matching Agent for a name or alias. Names are case-insensitive (Claude / claude / CLAUDE all resolve).

--- Username backfill --- GenerateUsername derives a URL-safe username from a display name. Falls back to the email local part if the name produces an

GetChildItemsForParents returns the live child items for each of the given parent item IDs, grouped by parent ID, in ONE query — collapsing the per-pa

GetCollectionAnyState is GetCollection without the `deleted_at IS NULL` filter — used by the open-children guard (IDEA-1494 R3 P3) so a child still at

GetDeletedWorkspaceBySlug returns a SOFT-DELETED workspace by slug (deleted_at IS NOT NULL), including its owner_id, or nil when no such row exists (l

GetInvitationByCode retrieves a pending invitation by its join code. Looks up by SHA-256 hash first (new invitations), then falls back to plaintext lo

GetLibraryPlaybook finds a playbook in the library by its title. Returns nil if no playbook with the given title exists.

GetUserByUsername retrieves a user by username (case-insensitive).

GetView returns a single view by ID.

GetWebhook retrieves a single webhook by ID.

GroupTemplatesByCategory returns the visible workspace templates grouped by category in the canonical CategoryOrder. Categories with no visible templa

HasEncryptionKey reports whether an encryption key is configured.

IsDiffSmaller returns true if storing a diff would be meaningfully smaller than storing the full content. Returns false for near-complete rewrites whe

--- Agent Roles --- ListAgentRoles returns all agent roles for a workspace.

ListCollectionsMinimal returns collection rows populated with just the fields needed for done-detection context and slug lookups: ID, Slug, Schema, Se