doHeadlessBootstrap is the shared core of the non-interactive (agent) admin bootstrap introduced by BUG-988. Both setupCmd and padInitCmd funnel throu

docsCollection returns the standard Docs collection shared across templates.

Press a finger down at (x, y); sends `touchStart` with the full active set.

drainSSE collects everything published to a workspace's channel, giving stragglers a short window to arrive.

drainWebhooks collects deliveries over one quiet window. The window is a wait for something that must NOT arrive in half these assertions, so it is ge

emailUnverifiedBlocked is the central predicate for PLAN-1933 DR-4's email-verification gate. It reports whether a request carrying `user` must be rej

--- Plan Limit Enforcement --- enforcePlanLimit checks a workspace-scoped plan limit and writes a 403 error if the limit is exceeded. Returns true if

ensureRouter lazily initializes the router on first use, so all Set* configuration is applied before the middleware chain is built.

escapeMarkdownCell makes an arbitrary string safe INSIDE a table cell: it sanitizes as above, then escapes backslashes and pipes. Order matters. Esca

evict removes an entry. No-op on empty id or unknown id. Fires onChange only when an entry was actually removed. See touch's comment for why onChange

forcePlainColor disables ANSI so width/content assertions are deterministic regardless of whether the test binary's stdout happens to be a TTY.

getItemTx is the in-transaction variant of GetItem. Used by UpdateItemWithPreCheck to re-read the parent under the workspace + parent-children locks s

guardSchemaAhead refuses to start when the database contains migrations this binary doesn't ship — i.e. the DB is AHEAD of the binary, the tell-tale o

handleCmdhelpCapabilitiesFallback scans args for the --cmdhelp-capabilities flag (cmdhelp v0.1 §8 fallback form). If found, it writes the capability b

handleCopyItem copies one item into another workspace, optionally archiving the source. See the file header for the full contract.

============================================================ Helpers — shared by the three "request-row" tables ======================================

isDeadlockError reports whether err is a genuine deadlock — Postgres' SQLSTATE 40P01. It deliberately does NOT match SQLite's "database is locked"; se

isReadOnlyAction reports whether (toolName, action) performs no mutation. Defaults to false (write) for any pair not in the allowlist — the conservati

isSupportedOAuthProvider reports whether provider is one pad accepts.

itemCopyList renders a list of server-supplied strings. Every element is quoted, unconditionally — unlike itemCopyLine, which quotes only when it mus

itemRefOrSlug formats an item's issue ref (e.g. "TASK-5") when its collection prefix + item number are populated, falling back to its slug. Avoids pul

itoa is strconv.Itoa renamed to keep test bodies readable when they're already heavy on ref-formatting.

liveAttachmentCount counts the workspace's live, non-derived attachment rows — the quota-counted surface a refused transform must not grow.

mapRoleUpdate dispatches `pad role update <slug> [--name ...] [--slug ...] [--description ...] [--icon ...] [--tools ...] [--sort-order ...]`. PATCH

mkAdminCookieReq is the same shape minus the Authorization header. Simulates the cookie-session path where isBearerAuth must return false and the admi

mustCreatePATForTest creates a real PAT against a fresh user + workspace. Returns the raw token string suitable for the Authorization: Bearer header.

--- TASK-2369: the ACL filter must be visible, and must not leak ------- mustLegacyPlanLink writes an item_links row carrying the pre-rename "plan" li

mustWorkspaceID resolves a workspace slug to its internal ID via the store. Tests use it because they don't have access to the request context that ge

noBearerRequest returns a bare request with no Authorization header — isBearerAuth(r) reports false for it, matching a cookie-session-style caller. No

normalizeServerURL canonicalizes a server URL for use as a credential key. Trailing slash and surrounding whitespace are stripped; nothing else is tou

normalizeWebhookEvents canonicalizes a webhook's event filter to the JSON-array string the store + dispatcher expect. Returns (value, true) when a no

nthPositional returns pos[n] or "" when absent.

numericInput pulls an int64 out of a JSON-typed input value. JSON decoders deliver numbers as float64 (or json.Number when UseNumber()); we accept bot

oauthRequestToFositeRequest hydrates a stored row into a fresh fosite.Request, fetching the client by ID and unmarshalling the session bytes into the

Surface an upload failure to the user.

openBootstrapEnabled reports whether open-bootstrap is active for this server: bypass flag is set AND we're not in cloud mode. Cloud mode always wins

parseCollectionFieldsDSL parses the CLI's --fields DSL into a {fields: [...]} map ready for json.Marshal. Empty input returns an empty Fields slice (t

parseSessionIdentity reads the self-declared session identity off a stream request. It never fails: every malformed input degrades to the S1 behaviour

preflightAsAttacker runs the dry run as the restricted editor and returns both the parsed response and the RAW bytes, because one of the assertions be

publishCommentEvent publishes a real-time event for comment changes.

pushCmd is `pad push <ref> -m "message"` (IDEA-2544 Phase 1) — the "push this to my agent" verb: an explicit, user-authored instruction bound to an it

queryOAuthRequestRow reads a row by signature from the named table and returns (request, active, err). - For oauth_pkce_requests, active is always tr

rawPeerAddr returns the untampered TCP peer address captured by CapturePeerAddr, falling back to the current r.RemoteAddr if the middleware wasn't ins

readItem handles pad://workspace/{ws}/items/{ref}. Why JSON-then-format instead of `--format markdown`: pad's CLI `--format markdown` for `item show`

readMigrationNames returns sorted .sql filenames from an embedded FS directory.

Helpers ------------------------------------------------------------------

recordMCPCallMetrics fans the audit-row data out to Prometheus. No-op when metrics aren't wired (selfhost / tests). Kept separate from MCPAuditLog so

recoverSweeper is the panic firewall for the long-running background sweeper loops (orphan GC, op-log GC, token reaper, workspace purge). Each of thos

--- helpers --- registerNonAdmin inserts a member-role user directly into the store and mints a session token for them. Bypasses the admin-registratio

renderCommentsMarkdown is the markdown counterpart of cli.PrintCommentTable. Comments are not tabular — the terminal form prints an attribution line t

renderItemCopyResult writes the outcome of a completed copy.

replaceWikiLinks deletes prior wiki-link rows for `sourceItemID` and inserts fresh ones extracted from `content`. Resolution against the workspace's i

requireConnectionOwner is the per-mutation prologue. Returns the (currentUser, requestID, ok) triple. On `ok=false` the response has already been writ

respondWithConnection re-fetches + writes the connection DTO post- mutation so the page can re-render without a separate list refresh. Stats lookup is

rootFlagsToArgs converts a startup root-flags map into the pre-formatted CLI token list every fetch should append. Empty values are skipped (matching

runOpenChildrenGuard executes the guard logic inside the store-layer transaction. Returns: - (nil, nil) when the guard doesn't apply (no transition,