escapeTableCell escapes characters that would break a markdown table row: `|` becomes `\|`, and existing backslashes are doubled so the escape stays v

extractCommandBlock returns the substring of `md` covering one command's section, identified by its full path (e.g. "item create"). Used to scope asse

extractFieldValue pulls a named string field out of an item's fields JSON blob. Returns "" when the blob is empty, unparseable, or carries no string v

===================================================================== Helpers ===================================================================== fa

flexJSONToString accepts a raw JSON value and returns it as a canonical JSON-encoded string. Acceptable inbound shapes: - absent / empty / null → nil

isUUID is defined in handlers_items.go getWorkspaceDocument resolves workspace slug and document ID from URL params.

hasBootstrapToken reports whether a bootstrap token is currently configured. Lock-aware — safe to call without holding s.bootstrapMu. Used by handleSe

invalidate clears the cached entry for a workspace. Call after any mutation that changes used_bytes (uploads, deletes, transforms) so the next GET see

isAPITokenAuth returns true if the request was authenticated via an API token (not a session cookie or CLI session). Use this to gate sensitive operat

listTransitions returns all status_transitions rows for an item, oldest first.

markUploadInFlight increments the in-flight counter for a content hash. Returns a release func the caller MUST defer; the release decrements and remov

membersHandler returns an http.Handler that responds to any path with the standard `{members:[...], invitations:[]}` shape using the supplied rows.

Connected-apps store tests (PLAN-943 TASK-954). What's covered: - ListUserOAuthConnections deduplicates a chain across multiple access-token rows (r

normalizeStringEncodedJSONFields recursively walks a parsed JSON value, finds string-typed `fields` and `tags` properties, parses them as embedded JSO

packageHTTPResponse turns the recorded handler response into an MCP CallToolResult, mirroring ExecDispatcher's "JSON → structured + text fallback" beh

parseAttachmentFilename extracts the filename from a Content-Disposition header. Mirrors the CLI's helper of the same name (cmd/pad/main.go parseAttac

parsePadURI extracts (workspace, kind, arg) from a pad:// URI. arg is empty for list-style resources (no trailing segment). Forms accepted: pad://w

playbooksCollection returns a Playbooks collection scoped to the caller's domain. Like conventionsCollection, the trigger and scope select options are

recordInstallation stores a skill install in the global registry (~/.pad/installations.json).

renderItemTable is the testable core of PrintItemTable: it lays the item list out into maxWidth columns and writes to w. Columns are REF/TITLE · STATU

===================================================================== Translation helpers ============================================================

runWorkspacePurgeSweep purges every workspace whose deleted_at is older than cutoff. Blobs are reclaimed BEFORE the DB rows are removed so a failed re

sanitizeFTSQuery wraps each token in double quotes so FTS5 treats special characters (like hyphens) as literals rather than operators. Only used for S

sanitizePGFTSQuery returns a copy of q with hyphens replaced by spaces. Used as the second leg of the OR-combined PG FTS query: postgres' english pars

seedCollabFixture creates the minimum fixture chain needed to test the collab WS endpoint: workspace + collection + item, all in the store, returning

seedUser creates a user that subsequent oauth tokens can use as their `subject`.

startMCPSessionTracker constructs the tracker + spawns the sweep goroutine. Called once at startup from SetMCPTransport (alongside startMCPAuditWriter

validateSessionCookie validates a session cookie and returns the user if valid, nil otherwise. A User-Agent change is logged but NOT rejected — this m

veErrorCode extracts the JSON error.code from a response, or "" if the body isn't an error envelope.

writeBootstrapToken drops a token file at <dataDir>/.bootstrap-token in the same shape EnsureBootstrapToken would produce — token + trailing newline,

AcquireParentChildrenLocks is the CANONICAL helper for taking `pad:parent-children:<id>` advisory locks. Every call site that needs to serialize again

Addr returns the host:port listen address.

AsPlanLimit returns the parsed plan-limit details when this APIError carries them, or nil otherwise. Returns nil for any error other than "plan_limit_

BaseURL returns the base URL for the API. If URL is set (via config, --url flag, or PAD_URL), it takes precedence. Otherwise, constructs from host and

CancelCustomer asks pad-cloud to cancel every active Stripe subscription for customerID and then delete the Stripe customer object. Used by handleDele

CapabilityLine returns the single-line capability bit a conforming CLI emits in response to `<cmd> help --capabilities` (or the `--cmdhelp-capabilitie

Clone overrides DefaultSession.Clone so the returned value is a *Session, not a *DefaultSession. Without this override, fosite's internal Clone() call

ConsumeEmailVerification atomically validates and marks a verification token as used, then sets users.email_verified_at to now. Returns the (now-verif

ConsumeTOTPStep atomically records a TOTP time-step as consumed, enforcing single-use semantics for login codes (BUG-2054). It succeeds only if step i

CreatePasswordReset generates a reset token for the given user. Returns the plaintext token (to embed in the reset URL). The token is stored as a SHA-

CreateWebhook registers a new webhook for a workspace.

Crop returns the rectangular sub-image bounded by `rect`. The rectangle is interpreted in the image's coordinate space (origin top-left) and intersect

Detect classifies a fetched document by inspecting its Content-Type header and the leading bytes of its body. It returns TypeOpenAPI when the document

FTSMatch returns the full-text search WHERE clause fragment. SQLite: "table MATCH ?" — consumes ONE arg. PostgreSQL: an OR-combined plainto_tsquery ma

GetAttachmentVariant returns the derived attachment row for parentID with the given variant key (e.g. "thumb-sm"), or (nil, nil) if no such row exists

GetAuthorizationCode hydrates the code's session. Returns ErrOAuthInvalidatedCode if the row exists but active=false (fosite triggers grant-family rev

GetChildItems returns all non-deleted child items linked to the given parent via item_links. Returns children from any collection.

--- Dashboard --- GetDashboard returns the workspace dashboard as raw JSON. The DashboardResponse type lives in the server package, so we use json.Raw

GetItemContentFlushedOpLogID returns the per-item flush watermark (TASK-1309). Returns (0, false) for items with NULL watermark or no row.

--- Child Item Progress --- GetItemProgress counts total and done child items linked to a parent via item_links. "Done" means the child item's done fi

GetOAuthProviders parses the JSON oauth_providers field into a string slice.

GetShareLink retrieves a share link by ID.

GetWebhook retrieves a single webhook by ID.

GuestVisibleResources returns the two-level visibility for a guest: - fullCollectionIDs: collections where the user has a direct collection grant (ful

ImportWorkspace imports a workspace from an exported data structure. It creates a new workspace with regenerated IDs, remapping all references. If new

IsTerminalItem reports whether an item's fields map indicates the item is in a terminal state for its collection. This is the canonical Go-side "is do

IsTerminalStatusDefault checks using the default fallback list (for cases where no collection schema is available).

--- Collections ---

ListCommentsBeforeTime returns comments for an item created before the given time, ordered newest-first, limited to `limit` results. Used for cursor-b

ListStarredItems returns all items starred by a user in a workspace, enriched with collection and assignment info. Only non-deleted items are returned

ListSystemCollectionIDs returns the IDs of system collections in a workspace. System collections are always visible to members regardless of collectio

ListTemplates returns all workspace templates that should be shown in pickers. Templates flagged Hidden are excluded.

NewCloudClient constructs a client pointed at the given pad-cloud base URL (e.g. "http://pad-cloud:7778") authenticated with cloudSecret. Both values

NewFSStore returns a store rooted at baseDir, creating the directory if it does not exist. baseDir is typically <DataDir>/attachments.

NewServer constructs a pad MCP server. Call Run(ctx) to start it. The returned Server is wired with tool capabilities advertised but no tools registe

PriorityColor returns a *color.Color appropriate for the given priority string.

RenderAttachmentChip builds a Notion-style file-chip anchor for a non-image attachment. `target=_blank` + `rel=noopener noreferrer` matches the existi

RenderAttachmentImage builds an inline `<img>` element for an image attachment. Width/height attributes are emitted when both are known and positive s

RenderAttachmentMissing builds a placeholder span for a missing/deleted attachment. Keeps the document layout intact and tells the user *why* there's

============================================================ Token revocation (handler/oauth2/revocation_storage.go) =================================

RoomCount is a test/debug accessor. Production code shouldn't make decisions based on this — the count is racy with grace-timer expirations.

SetAllowedWorkspaces is the symmetric writer used by oauth/authorize/decide (TASK-952). Centralizing the key string here keeps producers + consumers i

SetAuthToken sets the authorization token for API requests.

SetBootstrapToken wires the in-memory token + on-disk path into the Server. Called once at startup from cmd/pad/main.go after EnsureBootstrapToken suc

SetUserStripeCustomerID stores the Stripe customer ID for a user.

Status checks each tracked installation and returns its current state. embeddedContent is the raw embedded skill bytes, used for freshness comparison.

TokenAllowedWorkspacesFromContext returns the token's workspace allow-list, or nil if none was attached. Three return shapes matter to callers: - nil

ToolInstalled checks if the skill file exists for the given tool.

WorkspaceAttachments lists original (non-derived) attachments in a workspace, with optional filtering + sorting + pagination. Returns the page rows an

WorkspaceStorageInfo returns the consolidated quota summary for a workspace (used + limit + plan + override flag) in a single call. Used by the storag

WritePlanLimitError formats a plan-limit rejection to w in the canonical two-track shape (TASK-788): 1. A single `pad-structured-error/v1: {json}\n`

actionItemLink dispatches pad_item.action=link to the appropriate CLI cmdPath based on link_type. Renames the schema's uniform `ref` and `target` to t