validateFTSInvariants checks that every trigger in expectedFTSTriggers exists. Missing triggers are logged as structured warnings; this function is in

validateNoReservedFieldKeys rejects a schema that newly introduces a field keyed "parent" or "plan". prevSchema is nil on collection create (nothing t

validateShareLinkOpts checks that share link creation constraints are sane. Returns an error message string (empty if valid).

validationFailedFromBuildErr wraps a BuildCLIArgs error (typically "missing required argument %q" or "flag %q: <type-mismatch>") as a structured valid

--------------------------------------------------------------------- Perimeter 4: collab WebSocket GET-upgrade (persists Yjs edits). ----------------

--------------------------------------------------------------------- Perimeter 5: OAuth-provider authorize + decide (mints auth codes). -------------

waitForAuditRows polls ListMCPAuditByUser until we see the expected count or the deadline expires. The middleware writes async via a buffered channel

wireOAuthMetricsObserver attaches the OAuth metrics that need both the metrics registry AND the OAuth server: the active-tokens callback collector (re

workspaceHintLine returns a concise comma-joined slug list, or an empty string when no hints were resolved (avoids "Available workspaces: " trailing n

writeFlagsTable renders a flag map as a markdown table with sorted keys. Repeatable flags are marked in the type column for visibility.

writeMessage is a tiny helper that holds writeMu while writing one frame. All writes (replay during addConn, writeLoop fan-out) go through here so we

writeOpenChildrenError emits the 409 response with both a human message AND the structured details payload. `parentRef` is the already-formatted paren

writePlanLimitError writes a structured 403 response for plan limit violations. The envelope follows the standard {"error":{"code":...,"message":...,"

ApproveCLIAuthSession marks a pending session as approved, storing the session token and user ID. Returns an error if the session doesn't exist, is ex

AreItemsStarred returns a set of item IDs that are starred by the given user. Pass the item IDs you want to check; the returned map contains only the

AsUpdateConflict returns the parsed conflict details when this APIError carries them, or nil otherwise. Returns nil for any error other than "update_c

AttachmentReferenced returns true when anything in the workspace mentions "pad-attachment:<id>" — either a live item's content/fields JSON or a commen

BackfillEncryptTOTPSecrets encrypts any plaintext TOTP secrets in the database. Idempotent: skips secrets that already have the "enc:" prefix. Called

BackfillUserPlans sets the plan for all users that have an empty or default plan. In cloud mode, call with "free" to ensure all users have a plan set.

BuildAgentBootstrap assembles the bootstrap blob from store queries. This is the single canonical code path; the HTTP handler, the MCP resource handle

BuildWorkspaceContext converts detected project metadata plus the current Pad client configuration into a machine-readable workspace context.

CheckLimit checks whether a workspace operation is allowed under the owner's plan. Resolution order: 1. User plan_overrides[feature] — per-user overri

ClaimWorkspace redeems a 6-digit claim code against the api/v1/oauth/claim endpoint, granting the calling OAuth connection access to the named workspa

CleanExpiredCLIAuthSessions removes all expired CLI auth sessions.

CleanExpiredPasswordResets removes old reset tokens.

CleanupStaleBootstrapToken removes a token file left behind by a previous run that completed bootstrap but failed to delete the file. Called at startu

CloseConn force-closes a single WebSocket connection registered with the manager, sending a close frame with a machine-readable reason first. Used by

CollectionCheckboxProgress returns the per-item checkbox totals for every item in a collection whose content has at least one `- [ ]` / `- [x]` marker

ComputeAdminUserStatusValue is the exported wrapper around computeAdminUserStatus. Used by handlers that compute the status pill for a single-user res

ConsumePasswordReset atomically validates and marks a reset token as used. Returns the user if the token is valid, unused, and not expired. Returns ni

CountActiveOAuthAccessTokens returns the number of access-token rows with active=1. Backs the pad_oauth_active_tokens gauge (TASK-961). Caveat: the s

CountAttachmentsForStorageKeyOutsideWorkspace counts attachment rows in a DIFFERENT workspace that point at the same PHYSICAL blob (storage_key). Atta

CountProtectingAttachmentsForHash returns the number of rows pointing at the given content_hash whose presence requires the on-disk blob to stay. A ro

CountStarredItems returns the number of starred items for a user in a workspace.

CreateAgentRole creates a new agent role in a workspace.

CreateCLIAuthSession generates a new pending CLI auth session with a cryptographically random code and the default TTL. Returns the session including

===================================================================== PKCERequestStorage =============================================================

CreateWebhook registers a new webhook for a workspace.

DecomposePlaybook returns the library entry for the generic `decompose` playbook. Title is "Decompose a plan into tasks" to read well in the library c

DefaultTerminalStatusPlaceholders returns placeholders and args for the default terminal statuses list.

Delete removes the credential for the given server URL. No-op if the entry isn't present, or if the receiver is nil.

DeleteAPIToken removes an API token by ID.

DeleteAgentRole removes an agent role from a workspace.

DeleteCLIAuthSession removes a CLI auth session by code.

DeleteCollection soft-deletes a collection by setting collections.deleted_at. Items in the collection are NOT cascaded; they remain in the database wi

DeleteCollectionGrant revokes a collection grant by ID, scoped to a workspace.

DeleteComment removes a comment by ID.

DeleteInvitation removes a pending invitation.

DeleteItemGrant revokes an item grant by ID, scoped to a workspace.

DeletePKCERequestSession removes the row after a successful /token exchange. fosite's PKCE lifecycle is delete-on-use, distinct from auth codes (which

DeleteRefreshToken removes a refresh row entirely. Used by the rotation flow to drop the previous-step's refresh after the new one is in place.

DeleteShareLink deletes a share link by ID, scoped to a workspace.

DeleteStarsForItem removes all stars for a given item (used when deleting an item).

DeleteUser permanently deletes a user by ID.

DeleteView removes a view by ID.

DeleteWebhook removes a webhook by ID.

DeleteWebhook removes a webhook by ID.

DetectProject analyzes the current directory to determine project type, build system, test runner, CI, and other metadata.

DispatchInputFromContext returns the original MCP tool-call JSON input attached by WithDispatchInput, or nil if none. Safe to call on any context.

EnableUser re-enables a disabled user account by clearing disabled_at.

ErrManagerClosed exposes the manager's internal closed-flag error to callers via a public sentinel they can wrap. The internal errManagerClosed (in ma

FieldsDSLToSchemaJSON parses the DSL and returns the marshaled CollectionSchema JSON string. Empty input returns "{}" — an empty schema. Convenience w

Get returns the credential for the given server URL, or nil if none exists. URL is canonicalized (trailing slash + whitespace stripped) before lookup.

--- Bootstrap --- GetAgentBootstrap returns the consolidated bootstrap blob — workspace + user + collections + always-on conventions + roles + playboo

--- Audit Log --- GetAuditLog fetches the global audit log (admin-only).

GetChildItemsTx is the in-transaction variant of GetChildItems. The underlying query is the same as GetChildItems; using a *sql.Tx ties the read to th

GetDeletedItemsWithCollection returns minimal item info (ID + CollectionID) for soft-deleted items, used to filter deleted item IDs by collection visi

GetItemBySlugIncludeDeleted finds an item by slug including soft-deleted items. Used for restore operations where the item is archived.

GetItemLinkByID returns a single item link by its ID, or nil if not found.

GetItemVersionResolved returns a single version with its diff resolved to full content. Reverse-patch versions can only be reconstructed by walking th

GetLibraryEntry fetches one library entry by exact title match. Conventions- first precedence — a title that resolves to a convention is returned as o

GetPKCERequestSession hydrates the PKCE session. Returns fosite.ErrNotFound when missing (e.g. someone replayed an old auth code that's already been d

GetPlatformSettings returns all platform settings as a map.

GetReport returns the windowed project report JSON (PLAN-1628 / TASK-1630). window is one of day|week|2wk|month (empty = server default "week"); colle

GetRoleBoardItems returns non-terminal items across all collections, grouped by role.

GetShareLinkByToken looks up a share link by its raw token (hashes it first).

GetUserMemberWorkspaces returns only workspaces where the user has a workspace_members row — NO guest-grant fallback. Mirrors the first half of GetUse

GetUserWorkspaces returns all workspaces a user has access to, sorted by the user's custom sort order (then name as tiebreaker).

GetVersionResolved returns a version with full content reconstructed. For diff-based versions, this requires walking the version chain.

GetWorkspacesBySlugForUser finds workspaces matching a slug that are accessible to the given user (owned, member, or guest with grants).

GroupConcat returns SQL for string aggregation with a separator. SQLite: GROUP_CONCAT(DISTINCT expr) PostgreSQL: STRING_AGG(DISTINCT expr, ',')

Handler returns the configured HTTP handler (router). Useful for testing with httptest.NewServer.

HardDeleteAttachment removes the attachments row outright. Used by orphan GC after the grace period; never call from a request handler — soft-delete i

HasActiveConnectionForUser reports whether the user has ANY active OAuth connection at all, regardless of which workspaces it covers. The claim-code