Health checks if the server is running.

Init2FASecret loads the 2FA challenge signing key from platform_settings. If no key exists (first run), a new random key is generated and persisted. T

InitEmailFromSettings loads email config from platform settings on startup, merging with any env-var-based sender that was already attached.

IntrospectToken validates an opaque OAuth access token without going through the public RFC 7662 HTTP endpoint. Used by sub-PR E's MCPBearerAuth middl

InvalidateAuthorizeCodeSession marks a code's row inactive. Called by fosite once /token successfully exchanges the code; subsequent reads return ErrI

IsReservedUsername checks if a username is in the reserved list.

IsShared reports whether this state is a process-global instance serving multiple users. Callers use it to avoid persisting or trusting a session defa

IsWorkspaceCoveredForUser reports whether the given workspace is already covered by any of the user's active OAuth connections — either by the connect

ItemsModifiedSince returns items in a workspace that were updated after the given timestamp. Used for incremental sync on tab resume. Also returns IDs

JSONArrayElements returns a FROM-clause table-function fragment that unnests a JSON text-array column into one row per element, plus the expression yi

JSONSet returns SQL to set a value at a path in a JSON column. SQLite: json_set(col, '$.key', ?) PostgreSQL: jsonb_set(col::jsonb, '{key}', ?::jsonb)

LatestYjsUpdateSchemaVersion + PruneYjsUpdatesBefore power the schema-mismatch rebuild flow (TASK-1268). The room manager checks the most recent op-lo

ListAPITokens returns all API tokens for a workspace (without secrets).

--- Activity ---

ListAllTemplates returns every registered template, including ones flagged Hidden. Intended for internal tooling (e.g. tests, demo seeding) that needs

ListAttachments returns a page of attachments in the workspace, applying any filters set on params. Empty fields are omitted from the query string so

ListCollectionGrants returns all grants on a collection.

ListComments returns all comments for an item, ordered chronologically.

ListDeletedWorkspaces returns the soft-deleted workspaces the current user owns that are still restorable (not yet past the purge window).

ListDormantOpLogItemsBefore + PruneItemOpLogIfDormantBefore power the periodic prune sweep (TASK-1309). Selects items whose ENTIRE op-log is older tha

ListItemGrants returns all grants on an item.

ListItemsChangesSince returns the skinny-projection of items that have mutated (create / update / soft-delete / restore) since the given seq cursor, i

ListItemsIndex returns the skinny-projection of items in a workspace — every column EXCEPT i.content. Used by the local-first read model (PLAN-1343) s

ListPendingInvitationsAdmin returns all pending invitations across all workspaces with workspace and inviter details for the admin panel.

--- Playbooks --- ListPlaybooks returns the workspace's playbook metadata array (PLAN-1377 / TASK-1382). Same shape as bootstrap.playbooks.

ListShareLinkViews returns view history for a share link.

ListStarredItems returns the current user's starred items in a workspace.

ListTags returns the distinct tags used across a workspace's items with per-tag item counts (ordered by count desc then tag asc).

ListWorkspaceGraphLinks returns every edge for the workspace graph view: all item_links rows (parent / blocks / implements / related) plus resolved sa

ListWorkspaceInvitations returns all invitations for a workspace.

ListWorkspaces returns every non-deleted workspace, unordered by user. This is intended for admin-panel cross-tenant views and the pre-auth/fresh-inst

Login authenticates with email and password.

LoginVerify2FA completes a 2FA login by submitting a TOTP or recovery code.

Logout destroys the current session.

LookupPasswordReset performs a read-only validation of a reset token and returns the associated user WITHOUT consuming the token. Used by the reset ha

MaxItemSeq returns the largest items.seq across the workspace, or 0 if the workspace has no items. This is the cursor floor for the local-first read m

MaxOpLogID returns MAX(id) of the persisted op-log rows for an item. ok is false when no rows exist. Used by the watermark- advancement check on colla

NewRateLimiters creates rate limiters with sensible defaults.

NewRedisBus creates a new Redis-backed EventBus. The provided redis.Client should already be configured and connected.

NewSQLiteUnmanaged behaves like NewSQLite but does NOT register a t.Cleanup to close the store — the caller owns Store.Close() and must call it explic

OnboardSeedPlaybook returns the onboard playbook as a SeedPlaybook ready for SeedCollectionsFromTemplate to insert into a new workspace at init time.

OpenInEditor opens a temp file with content in the user's editor, waits for the editor to close, and returns the (possibly modified) content.

OptOutEmail adds an email address to the opt-out list.

OrphanedAttachments returns rows eligible for orphan GC reclamation (TASK-886). Two cases qualify: - Never-attached uploads: item_id IS NULL AND dele

PlanPlaybook returns the library entry for the generic `plan` playbook. Title is "Plan a new initiative" to read well in the library card and avoid co

PollCLIAuthSession checks the status of a CLI auth session.

PopulateHasChildren sets HasChildren=true on items that have at least one child linked via parent link_type. Operates in-place on the slice.

PostStreamWithContentType POSTs a streaming body (typically an *os.File for a multi-GiB bundle import) without buffering the full payload in memory cl

PrintCollectionTable prints collections in a formatted table.

PrintItemMeta prints item metadata header with colors.

PrintJSONCompact prints any value as compact (no-indent) JSON — a single line plus trailing newline. Preferred for machine-consumed payloads where pre

PruneAndApply runs applyFn under the per-item setup lock so it is strictly serialised with any in-flight Join's addConn+replayTo for the same itemID.

PruneStripeProcessedEvents deletes stripe_processed_events rows older than maxAge. Returns the number of rows removed. Intended to be called on a sche

Publish delegates to the inner bus and increments the publish counter.

RawStream issues a GET and copies the response body into w as it arrives. Returns the number of bytes written and a *http.Response pointer the caller

Record adds or updates an installation entry.

RecordMCPTierMismatch bumps the pad_mcp_authz_denials_total counter with reason="tier_mismatch" (TASK-1119). Wired from internal/mcp/dispatch_http.go'

RegisterMeta installs the pad://_meta/version static resource on srv so MCP clients can discover pad's tool-surface stability tier without parsing the

RemapAttachmentReferencesInWorkspace rewrites every "pad-attachment:OLD" reference in items.content + items.fields to "pad-attachment:NEW" for every (

RemoveOAuthProvider removes a provider from the user's oauth_providers list.

RemoveReaction removes a specific emoji reaction by a user from a comment.

RemoveWorkspaceMemberAndRevokeGrants atomically removes a user from a workspace and revokes all their grants in a single transaction. This prevents th

ReplaceTitle replaces all [[oldTitle]] with [[newTitle]] in content. LEGACY helper used by the document-rename path; case-sensitive, no-pipe forms onl

RequireVerifiedEmail is the /api/v1 method-gated enforcement point for DR-4. Mounted immediately after RequireAuth in setupRouter, it rejects mutating

ResolveUserPermission resolves the effective permission for a user on a specific item, following the permission resolution order from DOC-406: 1. Owne

RestoreWorkspace un-soft-deletes a workspace by slug via the restore endpoint (owner-only server-side). Returns the now-live workspace.

RewriteWikiTitle rewrites the four title-form wiki-link shapes that resolve to an item titled `oldTitle` in collection `collSlug`, substituting `newTi

RotateRefreshToken revokes the entire grant — both the refresh family AND the paired access family for the given requestID — then fosite immediately i

RunPlaybook binds the supplied args to the playbook's declared spec and returns the body + bound args + any unsatisfied required args. Side-effect-fre

Save writes the store to disk in v2 format with mode 0600. Always writes the current version constant — even if the store was loaded from v1, this is

SchemaVersion exposes the version this manager stamps on persisted op-log rows. The HTTP collab handler uses it to validate incoming `?schema_version=

SeedPlanLimits writes the default plan limits to platform_settings if they don't already exist. Called on server startup. Idempotent — existing values

SendPaymentFailed notifies a user that a Stripe invoice attempt failed. Called by the sidecar (via POST /api/v1/admin/payment-failed) after it handles

SendWelcome sends a welcome email after registration. If unsubscribeURL is non-empty, an unsubscribe link is included in the footer.

SetBillingAvailable marks this deployment as having Stripe Checkout wired up. Called from cmd/pad/main.go when PAD_BILLING_AVAILABLE=true is set. When

SetCloudMode toggles the getpad.dev marketing footer on outgoing transactional emails. Server callers flip it on after Server.SetCloudMode fires (see

SetImportBundleMaxBytes overrides the default 2 GiB cap on a single workspace import bundle. Set to 0 to fall back to the default. Wired from PAD_IMPO

SetMCPSessionTrackerConfig stashes ttl + sweep-interval overrides for the session tracker before it's started. Either may be 0 to keep the package def

SetSecureCookies enables the Secure flag on all cookies.

SetTrustedProxies configures which direct TCP peers are allowed to set X-Real-IP / X-Forwarded-For on incoming requests. Accepts a comma- separated li

SetVersion stores the build version info for the health endpoint.

SetWebUI sets the embedded web UI filesystem for serving the SPA.

SetWebhookDispatcher attaches a webhook dispatcher for outgoing notifications. Delivery goroutines are routed through s.goAsync so they're tracked on

SetWorkspacePurgeConfig overrides the default sweep interval (24h) and retention window (30d). Pass 0 for either to keep the package default. Must be

Setup configures the default slog logger. - level: "debug", "info", "warn", "error" (default "info") - format: "json" or "text" (default "text") Aft

SetupWriter is like Setup but writes to w instead of stderr (useful for tests).

ShouldCreateVersion determines whether a new version snapshot should be created, based on time since last version, actor/source changes, and content t

ShouldPruneStripeEvents returns true with a ~1% chance, using crypto/rand. Used to opportunistically prune stripe_processed_events without a dedicated

ShowPlaybook returns the full playbook item identified by ref, slug, or invocation_slug.

Shutdown gracefully drains in-flight requests and stops the HTTP server. The provided context controls how long to wait for active connections.

SkillPath returns the full path to the installed skill file, or "" if not installed.