assertBlocked asserts the response is a 403 email_not_verified.

auditUser creates a user that subsequent audit rows can FK-reference. The schema requires user_id REFERENCES users(id), so we can't insert audit rows

buildFositeRequest produces a fully-populated *fosite.Request so adapter tests can drive Create*Session methods without depending on fosite's HTTP ent

buildHTMLShell wraps body HTML in the standard transactional-email chrome — header (Pad wordmark) + body + footer note + (Cloud only) marketing footer

createItemTx is the tx-taking form of item creation (PLAN-2357 / DR-9a) and the single implementation behind BOTH CreateItem and the cross-workspace c

Delete-authorization tests for PLAN-2382 / TASK-2384. The item-detail attachment strip offers a delete affordance gated on the UI's grant-aware `canE

dialWSBracket joins as a bracket-capable participant (`?applier_bracket=1`) so the conn can be durably confirmed by a restore's finalization (BUG-2276

dispatch runs one MCP tool call through the in-process HTTP dispatcher against the real server, as the fixture's owner.

doRequestWithCookieFrom is like doRequestWithCookie but lets the caller set the request RemoteAddr so tests can simulate a session jumping to a differ

expandPath substitutes {key} placeholders in template using input. Each placeholder must appear as a non-empty string in input; otherwise expandPath r

getOrCreate returns the existing Room for itemID or, atomically under m.mu, mints a new one. Holding m.mu across the lookup + insertion keeps the grac

getWorkspace returns the full workspace object resolved by middleware. Falls back to direct resolution for routes without RequireWorkspaceAccess.

mapCollectionCreate dispatches `pad collection create <name> [--fields key:type[:opts]; ...] [--icon ...] [--description ...] [--layout ...] [--defaul

maybeInjectWorkspace defaults the `workspace` input from the dispatcher's WorkspaceLister when the caller didn't pass one explicitly (TASK-1076). The

Store-layer tests for the MCP audit log (PLAN-943 TASK-960). What's covered: - InsertMCPAuditEntry validates required fields and round-trips correct

newRootCmd constructs the pad CLI's root cobra command tree. Extracted from main() so tests can use the real tree (golden snapshots, schema validatio

packageStructuredResponse encodes payload to JSON, then decodes it back to a generic any so the StructuredContent surface matches the shape MCP client

parseExamplesFromLong extracts the indented invocation lines that follow an "Examples:" header in a cobra Long string. Returns nil when no such sectio

pickTemplateInteractive presents a numbered list of visible templates grouped by category and returns the chosen template's Name. Returns the default

postOAuthFormBearer POSTs an x-www-form-urlencoded body with a Bearer Authorization header (used for /oauth/introspect, where fosite v0.49 requires ei

remoteHeadlessCfg builds a Config wired to point at the given httptest server URL in Remote mode. Remote mode makes EnsureServer a no-op.

requireCollectionFullyVisible checks that the collection is visible to the requesting user under FULL-collection-access semantics (BUG-1920 — codex R2

requirePostgresForConcurrency skips a test unless a real PostgreSQL backend is configured. The parent-link TOCTOU races (BUG-2073) are Postgres-only:

resolveAssignName rewrites a `--assign <name|email>` input into `assigned_user_id <uuid>` by hitting the workspace-members endpoint and finding a matc

size returns the current entry count. Used by tests and by startMCPSessionTracker's initial gauge prime.

tokenWorkspaceID returns the workspace ID set by the TokenAuth middleware, or an empty string if no token was used.

touch inserts or refreshes an entry. No-op on empty id (defensive: callers pre-filter, but a missing header should never bump anything). Fires onChang

transformAs POSTs a rotate as a specific user + workspace role, bypassing the auth middleware the same way downloadAs does.

uploadItemFixture creates a workspace + collection + item for the item_id-invariant tests, returning the workspace slug and the item.

validateCloudSecret checks the cloud_secret field in a JSON request body against the server's configured cloud secret. Returns true if the secret matc

BrowserURL returns a URL suitable for displaying to humans in CLI prompts (e.g. "Or open the web UI at X"). It behaves like BaseURL except that when t

BuildMetaPayload returns the meta payload for the given pad runtime version. An empty padVersion falls back to FallbackVersion for the same reason ser

CheckSession returns the current auth status.

ConvertOpenAPI converts an OpenAPI 3.x specification into a human-readable markdown document. The output is organized as: - H1 with the API title - I

CountBacklinks returns the total number of same-workspace backlinks the requester would see for a given target, applying the same visibility filter as

CreateEmailVerification generates an email-verification token for the given user. Returns the plaintext token (to embed in the verification URL). The

CreateWebhook registers a new webhook for a workspace.

CurrentUserFromContext returns the user attached by WithCurrentUser (or by the standard auth middleware), and a boolean signalling whether one was pre

Get returns the current session workspace, or empty string when none has been set.

GetChildItems returns all non-deleted child items linked to the given parent via item_links. Returns children from any collection.

IsConnectionWorkspaceAllowed reports whether workspace_id appears in the connection's allow-list. Used internally by GetOAuthConnectionAccess when cal

LastRestoreSeq returns the item.seq of the most recent restore for itemID, or (0, false) when none has been recorded. Join consults it to force_refres

ListMCPAuditByUser returns the user's most recent audit rows in reverse-chronological order. limit caps the page; offset paginates. Caller must enforc

Provider returns the fosite.OAuth2Provider that sub-PR C's HTTP handlers will call (NewAuthorizeRequest, NewAccessRequest, WriteAuthorizeResponse, etc

PruneSweep finds every item whose ENTIRE op-log is older than `minAge` and prunes the whole op-log for those items under the per-item lock. Returns a

RecordItemWorkspaceMoveTx inserts one provenance row inside an existing transaction. It is tx-taking by design: the row must be written in the same tr

Unsubscribe removes a subscriber and closes its channel.

UpdateItemWithPreCheck is UpdateItem with an optional pre-mutation hook that runs inside the same transaction (and, on Postgres, holds the same worksp

WorkspaceStorageUsage returns the total bytes consumed by non-deleted attachments in the workspace. Includes derived blobs (thumbnails) — those are re

WriteWorkspaceLink writes a .pad.toml in the given directory. serverURL is the base URL of the Pad server hosting this workspace. Pass the empty stri

adminBillingReq fires GET /api/v1/admin/billing-stats with the cookie from a logged-in user. Returns the recorder so callers can inspect status + body

assertBlobDenied pins the shared denial shape: 404, no-store, and the exact body every other denial writes.

assertBlobServed checks a 200 whose body is want (GET) or whose headers say so (HEAD — no body on the wire, so Content-Type + the positive cache direc

buildPlainShell builds the plain-text body for transactional emails. Self-hosted output is byte-equivalent to the prior templates. Cloud output adds a

buildQuery returns the URL-encoded query string for the mapping (without the leading '?'). Empty mapping → empty string. Numbers from JSON arrive as

buildToolFromDef compiles a ToolDef into the mcp.Tool shape mcp-go expects. The schema is flat: `action` is required, every other parameter is optiona

cancelInit is the canonical exit path for both Ctrl+C and explicit "Cancel" actions during pad init / pad workspace init. It prints a brief message to

conventionsCollection returns a Conventions collection scoped to the caller's domain. The trigger and scope select options are supplied by the caller

decodeEnvelope helper extracts the ErrorEnvelope from an MCP error result. Uses textOf (the shared helper in catalog_test.go) to retrieve the JSON bod

deriveThumbnails generates thumb-sm and thumb-md variants for the uploaded image identified by parentID. Idempotent and tolerant of every failure mode

Cleanly close the WS, unbind doc/awareness handlers, and * prevent further reconnect attempts. Safe to call more than * once; idempotent.

displayWidth returns the visible column width of s: escape and control sequences are stripped, then the remaining runes are counted. Every rune is app

doClaim issues a POST /api/v1/oauth/claim with Bearer PAT auth. extraReqID, if non-empty, attaches a WithMCPTokenIdentity context override to simulate

encrypt encrypts plaintext using AES-256-GCM and returns a base64-encoded ciphertext prefixed with "enc:" to distinguish from plaintext values.

enrichItemsWithParent batch-populates parent link info on a slice of items. Used by list endpoints where calling enrichItemForResponse per-item is too

── Shared helpers ──────────────────────────────────────────────────────────── ensureWorkspace checks if the current directory is linked to a workspac

* Coerce a possibly-NaN/Infinite measurement to something usable. * * Infinity takes the fallback rather than saturating at a bound: an infinite *

── fixtures ───────────────────────────────────────────────────────────── fullPreflight is a preview where EVERY bucket and EVERY warning is non-trivi

--- helpers ---

headlessTestServer builds an httptest.Server that speaks the minimal subset of the Pad API that the headless bootstrap path touches: - GET /api/v1/a

hopTransitions returns only the "real" status hops — excluding the create-time "entered initial status" seed row (id prefix "create_") that every crea

isCancellation reports whether err represents a user-initiated abort from any interactive init prompt. Init RunEs use this to convert the sentinel int

itemPrefetchHandler routes /api/v1/workspaces/{ws}/items/{ref} GETs to a static map keyed by ref so each link-test can declare just the items it needs

parsePadURI extracts (workspace, kind, arg) from a pad:// URI. arg is empty for list-style resources (no trailing segment). Forms accepted: pad://w