runOpenChildrenGuard executes the guard logic inside the store-layer transaction. Returns: - (nil, nil) when the guard doesn't apply (no transition,

schemaHasField returns true if the collection schema defines a field with the given key.

schemaTypeBrief returns a one-line type description for a schema proxy: the declared type, format if present, item type for arrays, or the ref name fo

seedItem creates a collection (idempotent on slug) + an item with the given title, returning the resolved item record.

setCSRFCookie writes a new CSRF token cookie. The cookie is NOT HttpOnly so that JavaScript can read it and send it back as a header.

setupOwnedDeletedWorkspace registers Alice + Bob, has Alice create and then soft-delete a workspace, and returns their tokens plus the workspace. Shar

since returns all buffered events with ID > sinceID, in chronological order. Returns nil if sinceID is older than the oldest buffered event AND the bu

singleLine collapses internal whitespace and newlines for safe inclusion in a markdown table cell.

snapshotBeforeMigrate copies the live SQLite database file to <db>.pre-<VERSION> before any pending migrations run, so a botched upgrade can be rolled

sortedActionNames returns def.Actions' keys in lexical order. Used for both the schema's action enum (so the ordering is stable across builds and repr

tightenPerms sets path to 0600 if it exists. Best-effort: errors only emit a warning to stderr (the user's primary intent — install / no-op — already

tokenScopeAllows checks if the token's scopes permit the given HTTP method and path. Scopes are stored as a JSON array of strings. Supported scopes (

unwrapItems extracts the array from a `{items: [...]}` envelope — the post-BUG-985 shape ExecDispatcher and packageHTTPResponse use for top-level arra

upstreamHTTPErrorResult is the canonical wrapper for "the dispatcher made an HTTP call that returned a non-2xx" cases outside the main executeRequest/

wrapItemNotFound rewrites a bare "not_found" APIError from the item-by-ref endpoints into a message that echoes the failing ref and workspace, so `pad

write performs a single insert with a per-call timeout. DB errors log + drop the row — there's no retry path because the audit log is best-effort by d

writeRateLimitResponse sends a 429 response with Retry-After and X-RateLimit-* headers.

AllToolNames returns all valid names and aliases that can be passed to `pad agent install`.

AsOpenChildren returns the parsed open-children details when this APIError carries them, or nil otherwise. Returns nil for any error other than "open_

AttachmentDownloadURL builds the canonical attachment download URL. Pass an empty variant for the original; otherwise "thumb-sm" / "thumb-md" (the ser

BackfillStatusTransitions populates status_transitions from history in two passes, designed to be called once from server startup after migrations run

CancelCustomer asks pad-cloud to cancel every active Stripe subscription for customerID and then delete the Stripe customer object. Idempotent at the

Capabilities reports what this backend can do. The editor reads these flags via GET /api/v1/server/capabilities and gates rotate/crop UI on per-format

CategoryLabel returns the human-readable label for a category slug. Unknown categories are returned unchanged so the picker can still render a reasona

ColorizedStatus returns a status icon + status text with appropriate color.

===================================================================== AccessTokenStorage =============================================================

CreateOAuthUser creates a user from an OAuth provider with a random unusable password. OAuth users can later set a password via the password reset flo

============================================================ PKCE request sessions (handler/pkce/storage.go PKCERequestStorage) ======================

CreateView adds a new saved view.

DateBucket returns a SQL expression that truncates an RFC3339 UTC timestamp TEXT column to the start of its bucket, as a sortable TEXT label, for GROU

DeleteAccountAtomic deletes a user and all their owned workspaces in a single transaction. If any step fails, the entire operation is rolled back and

DisableTOTP disables 2FA and clears the secret and recovery codes. It also clears the totp_last_step single-use watermark (BUG-2054) so it doesn't out

Dispatch runs `<Binary> <cmdPath...> <cliArgs...>` and packages the output for an MCP client.

EnsureUniqueUsername takes a candidate username and returns a unique variant by appending -2, -3, etc. if the candidate already exists in the database

ExportItemArtifact GETs the single-item artifact export endpoint (GET /workspaces/{ws}/items/{ref}/export) and returns the artifact bytes (Markdown +

Fetch runs `<Binary> <args...>` and returns stdout on success.

FieldKeysForKind returns the frontmatter field keys for the given kind, or ErrUnknownKind if the kind is not recognized. A later phase's server code c

Get / Stat / Delete are convenience helpers that resolve the key first.

GetAccessTokenSession hydrates an access token. Inactive rows surface as fosite.ErrInactiveToken so the introspection / authorization-bearer middlewar

GetAllItemProgress returns child item completion counts for every item in the given collection within a workspace. includeArchived controls whether s

GetBillingMetrics asks pad-cloud for an aggregated Stripe-derived snapshot (active subs, MRR, ARR, churn, cancellations). Auth is the same shared Clou

GetBlocksEdges returns every `blocks` link in the workspace whose source and target items are both live (non-deleted), newest link first. The created_

GetCLIAuthSession retrieves a CLI auth session by code. Returns nil if not found. Expired sessions are returned with status updated to "expired".

GetCollectionAnyState is GetCollection without the `deleted_at IS NULL` filter — used by the open-children guard (IDEA-1494 R3 P3) so a child still at

GetCollectionGrant retrieves a collection grant by ID.

GetCurrentUser returns the authenticated user's profile.

GetDeletedWorkspaceBySlug returns a SOFT-DELETED workspace by slug (deleted_at IS NOT NULL), including its owner_id, or nil when no such row exists (l

GetInvitation retrieves an invitation by ID.

GetItemByRef looks up an item by its PREFIX-NUMBER reference (e.g. "IDEA-15"). Since item numbers are workspace-unique, this first tries an exact pref

GetItemGrant retrieves an item grant by ID.

GetItemsByIDsIncludeDeleted fetches items (soft-deleted included) for the given IDs in ONE `WHERE id IN (...)` query, keyed by item ID. It replaces th

GetLibraryConvention finds a convention in the library by its title. Returns nil if no convention with the given title exists.

GetLibraryPlaybook finds a playbook in the library by its title. Returns nil if no playbook with the given title exists.

GetPKCERequest hydrates the PKCE session. Returns ErrOAuthNotFound if the row is missing.

GetParentMap returns a map of item ID -> parent item ID for all parent links in a workspace. Used for efficient batch lookups (e.g., dashboard, list e

Per-user Insights/report layout preferences (PLAN-1628 / TASK-1634). GetReportLayout returns the user's saved layout for a workspace, or nil when they

GetUserMetrics computes the AdminUserMetrics bundle. Cheap by design: - days_since_write reads users.last_write_at directly (one row) - writes_7d is a

GetUserWorkspaceMemberships returns workspace memberships for admin user detail.

GetView returns a single view by ID.

HasPassword returns true if the user has explicitly set a password that they can sign in with. OAuth-only users have a random placeholder hash stored

ImportArtifact POSTs the raw artifact bytes to the workspace import endpoint (POST /workspaces/{ws}/import-artifact) and decodes the {ref, slug, warni

InvalidateAuthorizationCode marks a code inactive (single-use). Idempotent: invalidating an already-invalid or missing row is a no-op (fosite's contra

IsCloudServer reports whether THIS server process should run in cloud-tenant mode (enabling cloud-specific endpoints, requiring PAD_CLOUD_SECRET, wiri

JSONArrayContains returns SQL + the arg to check if a JSON array column contains a given text value. SQLite: "column LIKE ?" with arg `%"value"%` Post

ListMovedOutSince finds items that the main /items-changes delta drops because they moved OUT of the caller's visible scope: their CURRENT collection

--- Cross-cutting queries --- ListUserGrants returns all collection and item grants for a user in a workspace.

ListUsers returns all users.

ListVersionsResolved returns versions with full content (diffs resolved). Requires the current document content to reconstruct diff-based versions.

LoadRegistry reads the installation registry from disk. Returns an empty registry if the file doesn't exist.

MCP returns the underlying mark3labs MCPServer. Use this to register tools / resources / prompts BEFORE Run() takes over the stdio transport — registr

MCPConnectionStatsForUser returns last-used + 30-day-count keyed by (token_kind, token_ref) for every connection the user has any audit-log activity f

MCPConnectionStatsKey is the exported wrapper for callers in other packages (notably internal/server/handlers_connected_apps.go in TASK-954) that need

MCPPropertyName converts a CLI flag or argument name to the snake_case form used inside the dispatch input map. Hyphens become underscores; everything

ManagesLocalServer reports whether this client configuration should auto-manage a local Pad server process.

MarkStripeEventProcessed records a Stripe webhook event ID in stripe_processed_events if it hasn't been seen before. Returns alreadyProcessed=true whe

MinOpLogID powers the resume-cursor / force-refresh check (TASK-1319): when a reconnecting client announces `?since=<id>` and that id is below MIN, ro

MoveItemWithPreCheck is MoveItem with the same precheck escape hatch UpdateItemWithPreCheck offers. Codex round-3 P1: a `pad item move ... --field sta

NewPostgres creates a Store backed by PostgreSQL. The connStr should be a PostgreSQL connection string (e.g. "postgres://user:pass@host/db").

NewSharedWorkspaceState returns a state for a multi-user process (the cloud /mcp transport). It records Set/Get like any other state, but ResolveDefau

NewWithReplay creates a new in-memory EventBus with custom replay settings.

ParseAttachmentHref returns the UUID portion of a `pad-attachment:UUID` reference, or "" if href is not a pad-attachment reference / has an empty UUID

ParsePlaybookCLIArgs splits a sequence of positional args + bareword flags + key=value pairs into a typed map matching the playbook's declared spec. E

PlaybookSummary extracts a short prose hint from a playbook body. Picks the first non-heading non-empty paragraph and caps at ~240 chars so summary pa

PostRaw sends raw bytes to the API and decodes the JSON response.

Publish fans an event out to every subscriber whose itemID matches. Non-blocking: a slow subscriber whose buffer is full has new events dropped (logg

PurgeWorkspaceData hard-deletes every child row of a soft-deleted workspace and the workspace row itself, in a single transaction. Blob bytes are NOT

ReadBootstrapToken reads <DataDir>/.bootstrap-token. The file is created by EnsureBootstrapToken in internal/server/bootstrap.go with mode 0600 and co