unsubscribeSecret derives a stable HMAC key from the Maileroo API key. This avoids needing a separate secret config — if the API key changes, old unsu

validateAgainstSchema runs the compiled schema against the given JSON document and returns the validation error (nil on success).

veDoBearer issues a request authenticated with a Bearer PAT (which skips CSRF). Mirrors the CLI / connector path through TokenAuth.

waitMail blocks for the next captured email or fails on timeout. Emails are sent from a goAsync goroutine, so the caller can't assume synchronous deli

withFastPolling shrinks the helper's tick interval and timeout to millisecond scale for the duration of a test, then restores them. Required for asser

writeEmailNotVerified is the single 403 writer shared by every verified-email enforcement point so the code/message stay identical across perimeters (

writeFileAtomic writes data to a sibling temp file, fsyncs it, then atomically renames it onto path. Unlike os.WriteFile it never truncates an existin

writeMCPUnauthorized emits the spec-shaped 401 every MCP client expects: WWW-Authenticate with realm + resource_metadata, plus a small JSON body so cu

writeSSEEvent writes a single SSE event to the response writer. If eventID > 0, an "id:" field is included for Last-Event-ID support. Returns nil for

AcceptInvitation marks an invitation as accepted.

AddOAuthProvider adds a provider to the user's oauth_providers list. No-op if the provider is already linked.

AddReaction adds an emoji reaction to a comment. Returns the created reaction, or the existing one if the same user+emoji already exists.

BackfillWikiLinks scans every item with non-empty content and re-parses its body to populate `item_wiki_links`. Designed to be called from server star

BootstrapTokenPath returns the on-disk path for the bootstrap token file.

BootstrapWithToken is like Bootstrap but sends token as the X-Bootstrap-Token header when token is non-empty. This is required for self-host deploymen

CanonicalizeRef is the exported alias for canonicalizeRef so the store layer's same-workspace workspace_ref normalization (Codex round 4 P2 of TASK-15

CapturePeerAddr must be installed BEFORE TrustedProxyRealIP in the chain. It snapshots the real TCP peer RemoteAddr into the request context so authen

CleanExpiredEmailVerifications removes expired or already-used verification tokens. Mirrors CleanExpiredPasswordResets; run by the periodic token reap

CleanExpiredSessions removes all sessions past their expiry time.

Configure updates the sender's settings at runtime (e.g. when an admin changes platform settings). Thread-safe.

ConnectionWorkspaceCount returns the raw row count from oauth_connection_workspaces for a given request_id — regardless of the parent connection's all

ConsumeRecoveryCode validates and removes a single recovery code. Recovery codes are stored as SHA-256 hashes. The provided plaintext code is hashed b

ConventionLibrary returns all pre-defined convention categories with their conventions.

CountBillingAggregates returns the per-plan customer counts and the count of new "pro" signups since `since`. Implemented as two scalar SQL queries so

===================================================================== AuthorizeCodeStorage ===========================================================

CreateCLIAuthSession creates a new pending CLI auth session.

===================================================================== RefreshTokenStorage ============================================================

CredentialsPath returns ~/.pad/credentials.json.

Defaults returns the six default collections for a new workspace.

DeleteAccessToken removes a row entirely (fosite uses Delete after successful exchange to prevent reuse). Distinct from RevokeAccessToken which preser

DeleteInvitationAdmin removes a pending invitation by ID (no workspace scoping).

DeleteOAuthClient removes a client AND every dependent row (auth codes, access tokens, refresh tokens, PKCE sessions) atomically. Why explicit cascad

DeleteOAuthConnection removes the row + cascades to oauth_connection_workspaces. Phase D's "Revoke" handler calls this after RevokeRefreshTokenFamily

DeletePKCERequest removes the row after a successful /token exchange (fosite's lifecycle for PKCE is delete-on-use, unlike auth codes which are flagge

DeleteSession destroys a session by its plaintext token.

DeleteSessionIfExists destroys a session by plaintext token and reports whether a row was actually deleted. Used by the IP-change strict-mode path as

DeleteUserAPIToken removes an API token by ID, verifying it belongs to the user.

DerivePrefix generates a short uppercase prefix from a collection name. Single word: first 3-5 chars, removing trailing "s" for plurals Multi-word: fi

DisableUser soft-disables a user account by setting disabled_at.

Dispatch is the helper most fan-out actions use. Looks up cmdInfo in env.Doc, builds CLI args, attaches the dispatch input to ctx, forwards to env.Dis

DownloadAttachment streams the bytes of an attachment into w. Returns the Content-Type the server set and the number of bytes copied so callers can ve

EmitMarkdown walks the command tree below `target`, builds a cmdhelp v0.1 Document, and writes it to w as a markdown document with the predictable sec

FTSSnippet returns SQL for highlighted search result snippets. SQLite: snippet(fts_table, col_idx, '<mark>', '</mark>', '...', 32) — consumes ONE arg.

FindAndCompileSchema locates and compiles the cmdhelp v0.1 JSON Schema by walking up from `startDir` until it finds a directory containing `schema/cmd

FormatAttachmentSize returns a human-readable byte count ("832 B", "1.2 MB", "5 GB"). Negative sizes return "" — that's a corrupt-row signal, not some

FormatFieldSummary returns a formatted summary of item fields. Example output: "status: open | priority: high | category: platform"

GetAgentRole gets a single agent role by ID or slug.

GetAuthorizeCodeSession hydrates the session for an auth code. The caller supplies an empty fosite.Session (typically &Session{}); we JSON-unmarshal t

GetBacklinks fetches the items that contain a `[[<itemRef>]]` reference to the queried item. Phase 1 returns ref-form backlinks only — title and cross

GetConventionLibrary fetches the convention library from the server. category — when non-empty, server-side filter against LibraryCategory.Name (case

GetItemCollectionRefs returns minimal item info (ID + CollectionID) for the given item IDs, scoped to the workspace. State-agnostic: the query has no

GetItemLineageByIDs fetches skinny parent-lineage projections for the given item IDs in a single `WHERE id IN (...)` query. Soft-deleted items are exc

GetPlaybookLibrary fetches the playbook library from the server. category — when non-empty, server-side filter against PlaybookCategory.Name (case-se

GetRefreshTokenSession hydrates a refresh token. Inactive rows surface as fosite.ErrInactiveToken — fosite's refresh-flow handler (handler/oauth2/flow

GetRoleBreakdown returns item counts and assigned users grouped by agent role. Includes an entry for unassigned items (role_id = nil).

GetUserByStripeCustomerID retrieves a user by their Stripe customer ID. Returns nil if no user is found with the given customer ID.

GetUserWorkspacesDetailed returns each workspace this user is a member of with the per-workspace aggregations the admin modal's Workspaces tab renders

GuestVisibleCollectionIDs returns the collection IDs a guest (non-member with grants) can see. Includes collections with direct collection_grants and

GuestVisibleResourcesIncludeDeleted is the delta-sync variant of GuestVisibleResources: it does NOT filter out soft-deleted items or collections. /ite

HasPadEntry returns whether mcpServers.pad is present, plus the current `command` value (empty string when missing). Missing files are reported as not

HeadAttachment issues a HEAD request and returns the headers as structured metadata. Variant is forwarded the same way as DownloadAttachment — empty s

IsAPITokenFromContext reports whether the request was authenticated via an API token (vs. a session cookie or CLI session token). Mirrors the package-

IsAttachmentHref reports whether href is a `pad-attachment:UUID` reference.

IsCloud reports whether the configured connection mode is Cloud (i.e. cfg.Mode == ModeCloud). This is a CLIENT-side signal: the CLI is configured to t

IsEmailOptedOut returns true if the given email address has unsubscribed.

IsImageMime reports whether the MIME type renders inline as an image. Mirrors `image/*` from the server-side allowlist (image/png, image/jpeg, image/g

IsServerRunning checks if the server is currently running.

IsTerminal returns true if stdin is a terminal (not piped/redirected).

ListAllMCPAudit is the admin-only full-table view used by the console/admin/mcp-audit page. limit + offset paginate; caller must restrict access at th

ListCollectionItems returns items within a specific collection.

--- Comments ---

ListConnectionWorkspaceSlugs returns the join table's slug list for requestID, regardless of the parent connection's wildcard flag. Companion to Conne

ListDeletedWorkspaces returns the soft-deleted workspaces the given user OWNS that are still inside the restore window — deleted_at set, newer than cu

ListDocumentActivityBeforeTime returns activities for a document created before the given time, ordered newest-first, limited to `limit` results. Used

ListItemVersionsBeforeTime returns versions for an item created before the given time, ordered newest-first, limited to `limit` results. Used for curs

ListMCPAuditByConnection returns the audit rows for one OAuth connection (or one PAT). Used by the per-connection drilldown the connected-apps page ex

ListPurgeableWorkspaces returns workspaces whose deleted_at is set and older than cutoff — i.e. soft-deleted long enough ago to hard-purge. Live works

ListReactionsByComments loads all reactions for a set of comment IDs, keyed by comment ID.

ListShareLinks returns all share links for a target (item or collection).

ListUserAPITokens returns all API tokens owned by a user (without secrets).

ListUserActivity returns activities originated by the given user, in reverse-chronological order. Powers the Activity tab of the admin user modal (T15

ListViews returns all views for a collection within a workspace.

ListWorkspaceMembers returns all members of a workspace, enriched with user name and email from a join.

ListWorkspaceTags returns the distinct tags used across a workspace's items with the number of (non-archived) items carrying each, ordered by count de

LoadPadToml finds and reads the nearest .pad.toml by walking up from cwd. Returns nil if no .pad.toml is found (not an error).

MCPBearerAuth is the auth gate for the /mcp Streamable HTTP endpoint. Behaviour, in order: 1. No Authorization header, or one that doesn't start wit

MigrateItemFieldValues bulk-updates items in a collection when select options are renamed. Each entry in renames maps old_value → new_value for the gi

MoveItemWithForce is the open-children-guard-aware variant of MoveItem (IDEA-1494 R3 P1). When `force` is true, the URL gets a `?force=true` query so

Normalize sets pagination and sorting defaults on SearchParams.