WorkspaceStorageInfo returns the consolidated quota summary for a workspace (used + limit + plan + override flag) in a single call. Used by the storag

WriteHidden writes the non-disclosing denial: an identical 404 for every failure mode, so absence and forbidden-ness are indistinguishable. This is th

WritePlanLimitError formats a plan-limit rejection to w in the canonical two-track shape (TASK-788): 1. A single `pad-structured-error/v1: {json}\n`

actionItemLink dispatches pad_item.action=link to the appropriate CLI cmdPath based on link_type. Renames the schema's uniform `ref` and `target` to t

actionItemList handles pad_item.action=list. It forwards to `item list` but first applies a default limit (when the agent didn't ask for one) and clam

assertNotEmailBlocked asserts the response is NOT a verified-email 403 (it may legitimately be a 2xx, or a 4xx for an unrelated reason).

attachIn creates an original attachment in the given workspace.

attachTo writes a real 2000x1500 PNG — big enough that BOTH specs must scale down, so a skip is unambiguous — and returns the new row's id. Width/Heig

authorizeCollabAccess mirrors RequireWorkspaceAccess but keyed on the item's workspace ID (the WS URL path doesn't carry a workspace slug). It checks:

captureStdout runs fn with os.Stdout redirected and returns what it wrote. The list commands print through fmt/os.Stdout rather than cmd.OutOrStdout,

classifyHTTPStatusKind turns an HTTP error response into a structured envelope, using the dispatcher's known resource context to emit the right error

This file pins BUG-1925: handleSetMemberCollectionAccess gated only on requireRole(r, "owner"), with zero validation of the CALLER's own visibility. A

These tests cover BUG-2102: the OAuth consent allow-list was enforced only by RequireWorkspaceAccess, which fires solely for /{slug} path-param routes

createUnverifiedUser makes a user whose email starts UNVERIFIED, so a consume can be observed flipping it verified. CreateUser's safe default is verif

decodeFields is a small test helper: parse an item's fields JSON into a map.

fakeYjsRow constructs a single row for the fakeOpLog seeding helpers. The store assigns ids in production; tests don't depend on them.

fetchAsResource is the shared shell-out + wrap path. padArgs is the leading argument list (without root flags); rootArgs are appended so --url etc. su

fixtureDoc returns a small cmdhelp.Document with the items the catalog tests need most often. Catalog actions only require their own cmdPath to be pre

formatItemAsMarkdown turns the JSON body returned by `pad item show --format json` into a self-contained markdown document: heading with ref + title,

gaugeValueOrZero pulls the gauge value or returns 0 when the underlying metric hasn't been touched yet.

grantHiddenItemToOwner gives the fixture's restricted owner an item-level grant on the hidden item, independent of their collection_access restriction

handleControlMessage dispatches a TextMessage frame received from a peer: applier_apply_start / applier_ack (the designated-applier bracket, TASK-1257

handleCopyItemPreflight answers "what would this cross-workspace copy do?" without doing any of it. See the file header for the full contract.

isItemDone reports whether an item is in a terminal state for its collection's configured done field. Falls back to the default-terminal list against

isPublicAPIPath reports whether the given request path is an API endpoint that bypasses authentication entirely. These handlers must work even when th

itemCopyLine makes a server-supplied string safe to drop into a table row. Schema keys, labels, option values, link types and validator messages are a

itemLock returns the lazily-allocated mutex guarding setup-phase operations on itemID. Locks live in the manager for the lifetime of the process — for

* Latch the permanent placeholder for a row the server says is * gone. Same end state as the deletion broadcast, reached by a * different rout

liftColumnFields removes columnFieldKeys entries from `fields` and returns them as column writes. Mutates `fields`. Without this, `--field assigned_u

maskAPIKey returns the display form of a sensitive setting value. Keys longer than 8 chars show their first and last 4 chars (abcd...wxyz); shorter no

mintOAuthTokenForTest drives the consent → token exchange and returns the access token. Lightly customizable via the form arg so callers can vary the

BUG-1616 extended coverage — admin-via-bearer gate at the SSE and WebSocket-collab entry points that sit OUTSIDE RequireWorkspaceAccess. These endpoin

newWebhookTestWorkspace creates a user + workspace so webhook FK constraints are satisfied, and returns the workspace ID.

normalizeCollectionSlug maps common singular/short forms to actual collection slugs. Thin wrapper around the shared collections.NormalizeSlug so the C

observeOAuthFlowDuration records the elapsed time since `start` for the given stage. Designed to be `defer`'d at the top of each OAuth flow handler so

* Open the workspace's IDB database for the given user, creating * object stores on first run. Cached so subsequent calls reuse the * connection. Re

parseFieldKVP normalizes the --field flag's various wire shapes (single string, []string, []any) into a `key→value` map. Empty / invalid entries are s

pathFor returns the full on-disk path for a given hash. Callers MUST have already validated the hash via validHash — this function does not re-check,

percentile returns the linearly-interpolated p-quantile (p in [0,1]) of vals, rounded to 1 decimal. 0 for an empty sample. Computed in Go so the same

pollAndSaveCLIAuth polls a pending CLI auth session until it is approved, then persists the issued token as credentials for cfg.BaseURL(). It is the s

postOAuthLogin fires a cloud-secret-authenticated oauth-login request and returns the recorder. The cloud secret rides the JSON body (the same channel

publishEventWithName publishes a real-time event with actor name.

* Recompute and apply the desired inert set from scratch. This is the ONLY * mutator: release doesn't undo its own writes, it re-derives the truth fr

recordMCPAuthzDenial bumps the pad_mcp_authz_denials_total counter when the request originated from the MCP surface. The discriminator is the presence

remoteCfg builds a Config wired to point at the given test server URL.

renderItemsGroupedByCollectionMarkdown is the markdown counterpart of printItemsGroupedByCollection (#898): one `## Icon Name (N)` heading per collect

requireCommentVisible checks that a comment's underlying item is in a visible collection. Writes a 404 and returns false if not.

resolveAttachmentParentItem loads and validates the parent item of an attachment row that has ALREADY been established as live and belonging to the re

resolveRoleSlug rewrites a `--role <slug>` input into `agent_role_id <uuid>` by hitting the agent-roles endpoint and finding a matching role. Mirrors

retryOnParentSetChanged runs fn, retrying (up to maxParentLockRetries) while it returns errParentSetChanged. fn MUST open and own its own transaction

scanUser scans a user row into a User struct. Note: does NOT decrypt the TOTP secret — call store.decryptUserTOTP() after scanning if you need the pla

seedAccess inserts an access-token row in the chain identified by requestID. ts is the requested_at timestamp; sessionData + scopes land on the row. R

seedClient creates an oauth_clients row so chains have something to FK against. Returns the client ID.

seedGrantChain inserts one access-token row in a chain. Returns the request_id so tests can revoke / list / audit by it.

seedWorkspaceForConn creates a workspace and returns its ID — the join table stores workspace IDs, so tests need a real row.

setSourceContent rewrites the source item's body — the attacker's own legitimate edit of an item they hold, which is the whole vector.

setupEnsureWorkspaceTest produces a clean tempdir, points HOME at a tempdir (so credential/config writes don't leak), chdirs into the project so cli.D

softDeleteWorkspaceAt stamps a workspace's deleted_at to a specific time so the sweep's age cutoff can be exercised deterministically — there's no API

sseSubscriberStillHasAccess re-runs the workspace access check for an already-subscribed SSE client. Returns false when the caller can no longer see t

tokenScopeAllows checks if the token's scopes permit the given HTTP method and path. Scopes are stored as a JSON array of strings. Supported scopes (

A touch pointer event, dispatched on the IMAGE by default (the painted-image hit).

variantRow looks up a derived variant of parentID. GetAttachmentVariant is workspace-scoped (PLAN-2391 DR-16), so the scope is read back off the paren

withClosedStdin replaces os.Stdin with a pipe whose write end is already closed, so term.IsTerminal(stdin) is false and any read hits EOF immediately

withLocalFetcher replaces the package-level fetcher with one that allows loopback dials so httptest.NewServer addresses (127.0.0.1) can be reached. Re

Add implements SessionPresence.