NowRFC3339 returns the SQL expression for current UTC time in RFC3339 format. SQLite: strftime('%Y-%m-%dT%H:%M:%SZ', 'now') PostgreSQL: TO_CHAR(NOW()

OldestAccessTokenIssuedAtByRequestID returns the requested_at of the earliest access token in the family identified by requestID. Used by the OAuth re

OnboardPlaybook returns the library entry for the canonical `/pad onboard` playbook. PLAN-1496 / TASK-1499. Title is "Onboard a workspace" — verb-obj

ParseFieldsDSL parses the compact field DSL (key:type[:options];...) into a CollectionSchema. Empty input returns an empty schema with no error. Firs

PostRawWithContentType is the explicit-content-type variant of PostRaw. Used by the bundle import path to send a tar.gz as application/gzip so the ser

PrintCommentTable prints comments in a formatted table.

PrintItemTable prints items in a width-aware, ANSI-safe table. It probes the terminal width (falling back to 120 columns when stdout is piped or the s

Prune removes entries whose skill files no longer exist on disk.

RawGet fetches raw bytes from the API. Buffers the entire response in memory; do NOT use for endpoints that can return arbitrarily large bodies (e.g.

RecordShareLinkView atomically increments the view counter (respecting max_views) and records a view entry inside a single transaction. Returns true i

RegisterDBCollector registers a callback-based collector that exposes database connection pool statistics on each Prometheus scrape. This is preferred

RegisterPrompts installs the four static MCP prompts on srv. Each prompt takes no arguments — `prompts/get` returns a single user-role message contain

ResolveAttachmentImage resolves a `` image reference into rendered HTML. Falls back to a file chip when the attachment exis

ResolveAttachmentLink resolves a `[text](pad-attachment:UUID)` link reference into rendered HTML. Always renders as a file chip — link syntax indicate

ResolveOutboundSecret picks the secret to send on pad → pad-cloud calls given the inbound rotation list and an optional explicit override. Pulled out

RotateRefreshToken matches fosite's reference MemoryStore (storage/memory.go:497-504): revoke the entire grant — both the refresh family AND the acces

SendAs sends an email with a custom from name (address stays the same since email providers require verified sender domains).

SendPasswordReset sends a password reset email with a token link. This is a placeholder — the password reset flow (IDEA-81) will call this once the re

SendTest sends a test email to verify the email configuration.

SetBaseURL sets the public base URL used for generating shareable links. If the supplied URL has an unspecified bind-all host ("0.0.0.0", "::", "[::]

SetCORSOrigins configures allowed CORS origins (comma-separated).

SetClaimSecret wires the HMAC key used to derive + verify stateless 6-digit claim codes for the POST /api/v1/oauth/claim endpoint (PLAN-1519 / TASK-15

SetCollabRoomManager attaches a Yjs collab RoomManager (PLAN-1248). When set, the /api/v1/collab/{itemID} WebSocket endpoint hands new connections to

SetEndpoint overrides the Maileroo API endpoint. Intended for tests that stand up an httptest server mimicking Maileroo's v2 API — production callers

SetEventBus attaches an event bus for real-time SSE streaming.

SetImportArtifactMaxBytes overrides the default 1 MiB cap on a single playbook/convention artifact import. Set to 0 to fall back to the default. Wired

SetMetrics attaches Prometheus metrics to the server. Must be called before the first request is served. Side effect (TASK-961): when both metrics AN

SetMetricsToken configures the static bearer token required to scrape metrics. When empty (the default), /metrics is exposed only to loopback callers

SetOrphanGCConfig overrides the default sweep interval (24h) and grace period (30d). Pass 0 for either to keep the package default. Must be called bef

SetUserEmailVerified marks a user's email as verified (email_verified_at = now) WITHOUT a token — for paths that prove email control by other means, e

ShipPlaybook returns the seeded `ship` playbook for the startup template. PLAN-1377's headline deliverable: gives every fresh `startup` workspace a re

SoftwareStarterConventions returns the curated convention seed pack for software workspaces. Titles are pulled from ConventionLibrary so the text stay

SoftwareStarterPlaybooks returns the curated playbook seed pack for software workspaces.

StartOrphanGC kicks off the periodic sweep loop. Idempotent — calling twice is a no-op (existing loop continues, second call returns silently). Must b

Status walks every global (per-user) agent and reports installation state. CWDBased agents (Claude Code) are omitted — their config is project-local,

Storage returns the storage adapter. Exposed for sub-PR C's oauth/register handler (which calls Storage.store directly to CreateOAuthClient) and for t

StripFrontmatter removes YAML frontmatter (between --- delimiters) from content.

SubscribeIfAllowed atomically checks the global and per-workspace subscriber limits and, only if both are satisfied, subscribes in the same critical s

SubscriberCount returns the number of active local subscribers.

SweepMCPAuditOlderThan deletes audit rows older than cutoff and returns the number of rows removed. Called from a periodic goroutine in Server.Start (

── Back-compat wrappers ──────────────────────────────────────────────── The original API (status-only) stays in place so callers that don't yet have

ToItemSummaries projects a slice of items into summary shape, preserving order. A nil input yields a non-nil empty slice so the JSON encodes as `[]`.

ToItemSummary projects a single models.Item into the summary shape.

TokenScopeAllows is the exported wrapper around the package-private tokenScopeAllows: returns true iff the scopes JSON permits the given HTTP method a

UnstarItem removes a star from an item for a user. Returns sql.ErrNoRows if not starred.

Unsubscribe removes a subscriber and closes its channel. No-op when the channel is unknown — a double-Unsubscribe (e.g. handler defer firing after Clo

UnsubscribeURL generates an HMAC-signed unsubscribe link for the given email. The secret should be a stable server-side key (e.g. derived from the API

UpdateWorkspaceMemberRole changes a member's role in a workspace.

ValidateCloudSecureCookies returns an error if this server process is opted into cloud-tenant mode (see IsCloudServer) without secure cookies enabled.

WorkspaceHasUserCreatedItems reports whether ANY non-deleted item in the workspace was created by something other than template seeding. Used by the a

WorkspaceStorageLimit returns the effective storage limit (bytes) for the workspace owner's plan, or -1 if the plan is unlimited. Thin wrapper around

WriteOpenChildrenError formats an open-children rejection to w in the canonical two-track shape the project guarantees (IDEA-1494 R2): 1. A single `p

acquireWorkspaceParentLinkLock takes a Postgres advisory transaction lock that serializes ALL parent-edge-ADDING transactions within a workspace (BUG-

actionMetaServerInfo returns the minimal {name, version} pair. Roughly equivalent to what the MCP handshake exposes, but available post-handshake with

actionWorkspaceAuditLog reshapes the input for `pad workspace audit-log`'s `--action` filter flag. The CLI flag name `action` would normally be reacha

agingBuckets distributes open-item ages (hours) into fixed bands. Always returns all four bands in order (zero counts included) for a stable shape.

appendSearchFilters adds workspace, collection, and field filter clauses to a query. Used to keep count and results queries in sync.

appliedMigrations returns the set of migration version strings recorded in schema_migrations (the full filename, e.g. "073_workspace_deleted_at_idx.sq

applyPadTomlOverride layers the per-directory .pad.toml `url` field on top of cfg when present and Mode is not already explicitly set by --url. The ov

applyPostgresMigration applies a single Postgres migration file atomically. IDEA-1485: even though Postgres wraps each DDL statement in an implicit t

assertRowAffected returns notFound if the statement didn't touch any rows, the underlying RowsAffected error if the driver can't report, and nil other

atoiSafe returns the decimal value of s, or 0 if s is not a positive decimal integer. Used by promptForMode where 0 (no match) is always an invalid mo

attachmentURL returns the canonical download URL for an attachment. Uses the workspace slug from the request — the same shape every other API endpoint

autoPopulateDates auto-fills start_date/end_date when status changes to active/completed. Only sets dates if the schema defines those date fields and

backfillItemNumbers assigns prefixes to collections that lack them and sequential item_number values to items that don't have one yet. On first run a

backfillUsernames generates usernames for existing users that don't have one. Idempotent: skips users who already have a non-empty username.

backfillWorkspaceOwners ensures every workspace has at least one owner. For workspaces with no members, the first admin user is added as owner. This h

Hot-path benchmark for GetOAuthConnectionAccess (PLAN-1519 Phase A acceptance: "Hot-path benchmark: dual-read overhead measured and documented"). The

bestEffortWorkspaceHints calls lookup.ListWorkspaces and swallows errors. The error envelope is more valuable than nothing even when the listing faile

boolToString converts a Go bool to the string representation used in audit metadata. Kept local to this file because audit metadata is string-typed (J

* Editor / collab persistence e2e (TASK-2058 under TASK-733). * * The editor path is the subsystem with the strictest cross-component * invariants

buildCollectionDoneContextMap loads schema + settings for every collection in a workspace. Used to evaluate "is terminal?" for a batch of items from p

buildHTTPRequest constructs the in-process request, attaching the user via the exported server.WithCurrentUser helper so the handler chain treats the

buildTestRoot returns a minimal cobra tree that mirrors `pad`'s structure closely enough to exercise the help routing layer: root ├── item (group)

buildToolSurfacePayload assembles the full tool-surface document (version + rollout status + tools) from a catalog slice. The payload shape is identic

canonicalIP returns the semantic (canonical text) form of an IP address string. For IPv6 this collapses different valid spellings (compressed vs expan

canonicalMediaType returns the lower-cased media type stripped of parameters (charset, boundary, etc.).

canonicalizeRef uppercases the prefix portion of a "PREFIX-N" ref so the index has a single canonical shape per (workspace, prefix, number) regardless

checkMCPRateLimit applies the per-token bucket on /mcp requests (PLAN-943 TASK-959). Returns true if the request is allowed through; false if rate-lim

classifyCapabilityTier maps a fosite-style space-separated scope string into a coarse user-readable bucket. Currently three tiers: - read_only: on

classifyMCPResult maps an HTTP status to (audit_status, error_kind). JSON-RPC quirk: tool errors come back as 200 OK with an `error` field in the res

clearParentLinkTx removes the item's parent link within the caller's transaction. Shared by the public ClearParentLink (own tx) and UpdateItemWithPare