SkillsInstalled checks if the pad skill is installed at global or project level. Returns ("global", true), ("project", true), or ("", false).

SoftDeleteAttachment marks the given attachment row deleted (and every variant whose parent_id points at it) so the orphan GC will reclaim the bytes a

SoftDeleteWorkspaceAttachments tombstones every live attachment row (originals AND thumbnail variants) under a workspace in a single bulk UPDATE. Used

StarItem stars an item for the current user.

StartWorkspacePurgeSweeper kicks off the periodic sweep loop. Idempotent — calling twice is a no-op. Must be called AFTER SetAttachments; the sweep no

Stop drains the cleanup goroutine of every limiter in the bundle. Called from Server.Stop() so test cleanup (and graceful shutdown) doesn't leak the f

StopServer sends a stop signal to the background server process.

SubscriberCount delegates to the inner bus.

TestWebhook sends a test payload to a webhook.

ToolSurfaceJSON serializes the package-global Catalog into the tool-surface descriptor JSON — the same blob pad_meta.action: tool-surface emits, plus

TouchUserActivity updates last_active_at for a user, throttled to avoid write amplification. Only writes if the stored value is older than 5 minutes.

UnderItemLock runs fn while the per-item setup lock for itemID is held — the SAME lock Join's addConn+replayTo acquires and the SAME lock PruneAndAppl

UnstarItem removes a star from an item for the current user.

UpdateAgentRole updates an existing agent role.

UpdateAgentRoleOrder batch-updates sort_order for a list of roles.

UpdateAll updates all tracked installations that are outdated. Returns the number of installations updated and any errors encountered.

UpdateComment replaces a comment's body and bumps updated_at. The comments_fts_update trigger re-indexes the new body. Returns sql.ErrNoRows when no l

UpdateRoleSortOrder batch-updates role_sort_order for a list of items. Each updated row also gets a fresh workspace-scoped seq so delta-sync clients s

UpdateSessionIPIfEquals atomically rotates the stored IP on a session from expectedOldIP to newIP. Returns true if a row was updated (i.e. the caller

UpdateWorkspaceSortOrder sets the sort_order for a workspace in a user's membership.

UploadAttachment streams the contents of body to POST /api/v1/workspaces/{wsSlug}/attachments as a multipart file part. filename is what the server st

UserStorageUsage returns the SUM(size_bytes) of all non-deleted attachments across workspaces owned by this user. Matches the per-workspace WorkspaceS

ValidReportWindow reports whether w is an accepted report window (empty is allowed and means the surface default).

ValidateAudienceParam is a one-off helper for sub-PR C's HTTP handlers: validates the incoming `resource` query param shape before fosite's internal v

ValidateShareLink checks if a share link is valid (not expired). Max views enforcement is handled atomically by RecordShareLinkView. Returns nil error

ValidateShareLinkPassword checks a password against the share link's stored hash.

ValidateUnsubscribeToken checks that the token is a valid HMAC for the email.

WipeCredentialsFile removes ~/.pad/credentials.json entirely. Distinct from CredentialStore.Delete (which removes a single server's entry) — used by t

WithAPITokenAuth marks ctx as authenticated via an API token, the same way TokenAuth does on the Bearer-token path. Required when dispatching through

WorkspaceAttachmentBlobs returns every attachment row for a workspace — originals AND thumbnail variants, live AND soft-deleted — so the purge sweeper

WorkspaceAttachmentsForExport returns every original (non-derived, non-deleted) attachment in the workspace so the export bundler can stream them into

WorkspaceItemSlugMap returns slug → id for every live item in a workspace. Used by the bundle import path (TASK-885) to remap an old attachment's item

WriteUpdateConflictError formats an optimistic-concurrency conflict to w in the canonical two-track shape (TASK-2022), mirroring WriteOpenChildrenErro

actionItemBulkUpdate translates the catalog's `refs: array<string>` param into the repeatable positional `ref` that BuildCLIArgs feeds to `pad item bu

actionItemUnlink is the symmetric un-create operation. Same routing rules; uses route.unlinkCmdPath instead of route.linkCmdPath.

actionMetaToolSurface returns the catalog as JSON. Pairs with PLAN-943 TASK-957 (getpad.dev/docs/mcp) — that page can generate docs from this single c

actionMetaVersion returns the same MetaPayload that pad://_meta/version serves as a resource. Two surfaces, one source of truth (BuildMetaPayload).

actorIDFromRequest returns a non-empty identity string for the caller when one is available — user id, token id, or empty. Used in slog calls where we

addConn registers a freshly-built roomConn with the room. Cancels any pending grace timer (a reconnect within the window keeps the Room alive) and ret

--- format dispatch ------------------------------------------------------ Install/Uninstall/Status route through these so each agent's config is rea

adminOpenItemsCountClause returns a SQL fragment (no leading AND) that excludes terminal-status items. Single-sourced from models.DefaultTerminalStatu

adminUserSortClause maps the public sort key + order into a safe ORDER BY expression. Hard-coded allow-list to avoid SQL injection; an unknown key fal

ageHours returns hours from an RFC3339 created timestamp to now, clamped at 0.

agentMeta returns metadata JSON with the agent name if X-Pad-Agent is set, merged with any existing metadata. Returns empty string if no agent.

allowlistedAuthorizeParams returns a copy of in containing ONLY the keys an OAuth /authorize request is allowed to round-trip through the consent form

appendChange adds a change description to existing metadata JSON.

* Snap a rectangle to a target aspect ratio while preserving its * center. `aspect == null` is a no-op (free crop). The result is * clamped to `boun

applyBulkOp dispatches one verb against one item, reusing the same store paths as the single-item handlers. Returns the post-mutation item (for seq) o

applyImageTransform dispatches on the operation discriminator. Each branch validates its own params and returns a clear error — the handler turns thos

Apply pending toggles on top of a base set.

archivedPlaybooks holds the pre-PLAN-1377 library playbook bodies that were retired from the active library surface as part of PLAN-1397's invokable-f

argSource looks up the enum_source for a positional arg on the given command path. Returns ("", false) when no binding applies.

* Push the global rate-limit cooldown out to `now + backoffMs`, never * pulling it in. Called on EVERY 429 (including the one that then triggers * t

artifactExportFilename builds the download filename for an exported item: "<slug>.pad.md".

artifactProvenanceFooter renders an optional Markdown footer recording where an imported artifact came from. Returns "" when there's nothing useful to

asUpdateConflictError reports whether err is (or wraps) a store.UpdateConflictError and returns it. Handlers use it to branch the generic upstream-err

assertExperimentalNamespace fails the test if exp[key] doesn't carry the expected version + a tool_surface_stable=true flag. Shared by the padCmdhelp

assertLen and assertOverflow are tiny helpers used by TestCapBootstrapDashboard to keep the per-array assertion noise from drowning the actual contrac

assertLinks compares two WikiLinkRef slices for the fields Phase 1 + Phase 2a care about. WorkspaceSlug is excluded because Phase 2b (TASK-1597) is th

attachmentCmd is the root for `pad attachment ...` operations. Phase 1 ships upload + download — the endpoints TASK-871 and TASK-872 added. List + de

attemptDeliver performs a single HTTP POST to the webhook URL and classifies the outcome. It does NOT record the result — deliver owns the single term

audienceContains reports whether haystack contains needle, treating scheme-equivalent forms as equal via oauth.NormalizeAudience. Why normalize: real

audienceForNewClient is what sub-PR C's DCR handler will use to populate a freshly-registered client's audience list. Centralized here so the policy (

audienceListContainsNormalized reports whether haystack contains an element that compares equal to needleNorm after trailing-slash normalization. Call

--- watch ---

authHintFor generates the actionable hint for ErrAuthRequired. Distinct from the upstream body — agents see "fix your auth", not the literal upstream

===================================================================== Helpers shared with handlers_well_known.go for the discovery doc ===============

TestCollapseAutosaveBursts guards the BUG-1612 clutter fix: the web editor flushes a collab-snapshot version every ~5s while typing, so an uninterrupt

── standup ────────────────────────────────────────────────────────────────── backdateItemUpdatedAt directly rewrites an item's updated_at column so c

backfillNullItemNumbers assigns the next workspace-global item_number to any items that have a NULL item_number (e.g. from interrupted inserts or pre-

backfillOneChain seeds the oauth_connections + (when applicable) oauth_connection_workspaces rows for a single grant chain. Returns: - created

backlinksCmd serves `pad item backlinks <ref>` — the CLI surface for PLAN-1593's reverse `[[...]]` index. Lists items that contain a `[[<ref>]]` refer