Insert a minimal server row to satisfy the FK constraint on `unlock_result` and related tables. FK enforcement is enabled by default in sqlx-sqlite.

Build a CreateMaintenance with a window relative to `now`.

Send a `Welcome` frame from the server side, advertising the given report interval (seconds).

Reconcile running tasks with the new config list. Stops tasks no longer in the list, starts new ones, restarts changed ones.

Connect a mock agent, drain the welcome frame, and complete the SystemInfo handshake advertising the given capability bitmask.

Parse the output of a `ping -c N` invocation into a [`BatchIcmpResult`]. This is public so callers (and tests) can parse pre-captured output directly

Remove a cap's grant; returns whether a record existed. Prunes expired.

Insert a widget_module row directly with explicit fields for branch coverage of the read paths.

Reconcile running tasks with the new target list. Targets are filtered by current capability flags. Tasks that are no longer in the list are stopped;

Dispatch a response from the agent to a pending HTTP request. Returns true if the response was delivered, false if no pending request was found.

Helper: perform the standard server-side handshake — receive the agent's first `SystemInfo`, then send an `Ack` for it. Returns the SystemInfo frame f

Open a new terminal session with the given dimensions.

Send a single agent frame as a JSON text message.

Check an HTTP endpoint for status code and keyword presence. Config options: - `method`: "GET" or "POST" (default "GET") - `keyword`: string to searc

Connect a mock agent, drain the welcome frame, and complete the SystemInfo handshake advertising the given capability bitmask. Returns the split socke

Enable foreign keys for test DB (needed for CASCADE behavior).

A minimal-but-complete JSON skeleton that deserializes into `Stats`. Every required (non-Option, non-defaulted) field is present.

Check DNS resolution for `target` (a domain name). Config options: - `record_type`: "A", "AAAA", "CNAME", "MX", "TXT" (default "A") - `expected_value

Atomic write: temp file → rename, mode 0600.

Register a pending request for HTTP→WS relay with a default 60s TTL. Returns a oneshot receiver that will receive the agent's response.

Complete the SystemInfo handshake reporting the `docker` runtime feature and a given capability bitmask. The shared `send_system_info` helper always r

A minimal local HTTP/1.1 mock. It accepts up to `responses.len()` connections (one request each) and replies with the queued raw response bytes in ord

Build a fully-populated `Stats` value from JSON for use in tests. `extra` lets individual tests override the default skeleton.

Validate that the given path is within an allowed root and does not match deny patterns.

Check SSL/TLS certificate for `target` (domain name, optionally with ":port"). Config options: - `port`: port to connect to (default 443) - `warning_

Helper to build LoginParams with test defaults; override only what matters.

Record an inbound connection attempt and possibly emit a PortScan event.

Try multiple date formats to parse a date string.

Split a probe target of the form `host`, `host:port`, `[::1]`, or `[::1]:443` into its host and port components, defaulting the port to `default_port`

Build a single-file widget JS source with the given id baked into the JSDoc manifest so the extractor accepts it.

All recorded messages decoded into `AgentMessage` (text frames only).

Check TCP connectivity to `target` (expected format: "host:port"). Config options: - `timeout`: connection timeout in seconds (default 10)

Parse an expiry date from WHOIS response text.

Read at most `max_bytes` from the response body, streaming chunk-by-chunk. Reading stops as soon as `max_bytes` is reached, so a malicious endpoint r

Helper: issue a single-URL probe and classify with a pure function.

Split a log line into (timestamp, message) if timestamps are enabled. Docker log timestamps look like: "2026-03-18T10:00:00.000000000Z rest of message

Build an in-memory zip from `(path, bytes)` pairs.

Build an OAuthConfig with the requested providers enabled.

Drive `run_connect_once` to completion in the background and join the server task, both bounded. Returns the server task's value.

Fixed wall-clock instant used so scheduling math is deterministic.

Seed a single ping record and return the inserted row id.

Check if a server is currently connected.