Register installs pad's MCP tools on srv: the built-in pad_set_workspace plus every v0.2 catalog tool. Returns the count of registered tools (includin

Register creates a new user account.

RegisterCatalog installs the v0.2 catalog tools on srv. Returns the count of tools registered (excluding pad_set_workspace, which the cmdhelp-walk pat

RegisterOAuthActiveTokensCollector exposes pad_oauth_active_tokens as a callback-driven gauge. Pulled on every scrape — same pattern as the db-stats c

RegisterResources installs the four read-only MCP resource templates on srv: - pad://workspace/{ws}/items/{ref} — single item markdown - pad://worksp

RemoveConnectionWorkspace deletes one (request_id, workspace_id) row. Idempotent: removing a pair that isn't present is a no-op (no error). Phase D's

RenameConnection updates the human-readable name. Touches updated_at. Returns ErrOAuthConnectionNotFound if the row doesn't exist. Trim is the caller

ResolveBacklinksVisibility computes the (fullCollectionIDs, grantedItemIDs) access vectors for `userID` in `workspaceID`, REQUEST-INDEPENDENT. Mirrors

ResolveDefault returns the workspace to inject into a dispatched call that didn't carry an explicit `workspace` — or "" when this state must not be tr

ResolvePath returns the config path for the given agent using the installer's home/cwd + goos overrides. CWDBased agents (Claude Code) resolve against

RestoreWorkspace un-soft-deletes a workspace: it clears deleted_at so the workspace (and every item/collection/member/attachment that was only transit

RewriteBracketAt rewrites the wiki-link bracket starting at byte position `position` in `content`, replacing the bracket's title segment with `newTitl

Rotate returns a new image rotated by deg degrees clockwise. Only multiples of 90 (90, 180, 270, plus their negatives) are supported in Phase 1 — that

RunStdio is Run with explicit stdin / stdout streams. Used by tests that drive the server in-process via io.Pipe. The same shutdown semantics as Run

Save writes the registry to disk.

SaveReportLayout upserts the user's layout for a workspace. The caller is responsible for sanitizing the layout (see server handler) before saving.

SearchUsers returns a filtered, paginated list of users for admin management. Each row carries the User model plus two cheap aggregations the admin t

SendEmailVerification sends an email-verification link to a newly registered user. Mirrors SendPasswordReset (buildHTMLShell/buildPlainShell, CloudMod

SendInvitation sends a workspace invitation email. If unsubscribeURL is non-empty, an unsubscribe link is included in the footer.

SetBcryptCostForTesting overrides the bcrypt cost used by CreateUser and UpdateUser for the lifetime of a test binary. It returns a restore function —

SetImageProcessor wires the image processor that the upload handler uses to derive thumbnail variants (TASK-878). Optional — without it uploads still

SetRevocationObserver wires a callback that fires after each access-token family revocation. Optional — leaving it unset is equivalent to wiring a no-

SetScopeFlags updates the three boolean scope flags atomically. All three values are written every call — there's no PATCH semantic at the store layer

SniffMIME detects the MIME type from the leading bytes of a payload using net/http's stdlib detector (the same RFC 6838 algorithm browsers use). The r

Subscribe delegates to the inner bus and increments the SSE connection gauge.

TerminalPlaceholdersForDoneField is a SQL-layer convenience that returns the done-field key plus the placeholder + args pair needed for an IN clause.

ThumbnailExt returns the file extension for a thumbnail encoded in `format`. Used to build a synthetic filename for the derived row (parent's basename

Format-policy helpers — shared between the pure-Go and libvips backends. These are intentionally NOT inside a build-tagged file so they compile under

ThumbnailMime returns the canonical MIME type for a thumbnail encoded in `format` (paired with ThumbnailFormat above).

TokenScopesFromContext returns the JSON-encoded scopes attached by WithTokenScopes, or "" if none. Empty maps to "unrestricted" in TokenScopeAllows (t

ToolSkillPath returns the full path where a tool's skill file would be installed.

Unsubscribe delegates to the inner bus and decrements the SSE connection gauge.

UpdateItemWithPreCheck is UpdateItem with an optional pre-mutation hook that runs inside the same transaction (and, on Postgres, holds the same worksp

UpdateView modifies an existing view.

UserID returns the pad user ID this session was issued to. Equivalent to GetSubject() under our model where Subject is always the user ID; kept as a t

ValidateBoolArity asserts that every bool-typed flag in doc obeys spec §5.3: bool flags MUST be presence switches. They MUST NOT appear in `--flag=val

ValidateURL is the pre-flight SSRF guard: it rejects non-http(s) schemes, URLs with embedded credentials, missing hostnames, and IP-literal hosts in p

ValidateUsername checks a username for format, length, and reserved word violations. It does NOT check uniqueness (that requires a store call).

WorkspaceHasAgentActivity reports whether any non-deleted item VISIBLE to the caller was created via an agent surface — direct CLI invocation or the R

WorkspaceSubscriberCount returns the number of active subscribers for a specific workspace.

acquireParentChildrenLocksForUpdate is the in-tx helper UpdateItem uses to serialize itself against the open-children guard (IDEA-1494 R2 / R4). It ac

actionItemExport handles pad_item.action=export. The CLI's `pad item export <ref>` defaults to WRITING A FILE (<slug>.pad.md), which is useless to an

actionItemImport handles pad_item.action=import. The CLI's `pad item import <file>` reads the artifact from a file (or stdin when the positional is `-

actionItemList handles pad_item.action=list. It forwards to `item list` but first applies a default limit (when the agent didn't ask for one) and clam

asText extracts the text payload from any content type that has one. mcp-go's Content interface is implemented by TextContent, etc.; we only care abou

authorizeCollabAccess mirrors RequireWorkspaceAccess but keyed on the item's workspace ID (the WS URL path doesn't carry a workspace slug). It checks:

buildDoneContextMap builds a map of collection ID → (schema, settings) for quick lookups during dashboard / lineage traversals.

bulkUpdateRefs canonicalizes the `ref` input — accepts repeatable shapes the cmdhelp registry generates (string for a single value, []any from JSON ar

bundleAttachmentPath builds the tar entry name for an attachment. Exported as a function (not a const helper) so the import path can import it and res

Cancel the pending debounce without saving. Leaves the dirty flag set.

capBootstrapDashboard wraps a DashboardResponse with the bootstrap's per-section caps. The underlying *DashboardResponse is shallow-copied before the

checkBootstrapToken validates the X-Bootstrap-Token header on r against the in-memory token using a constant-time comparison. Returns false if no toke

Clamp a rectangle to fit within `bounds`, integer coords throughout.

cloneStringMap returns a shallow copy of m. Used by mappers that need to normalize a single value before handing the map to a downstream helper, witho

codeOrBlank wraps t in backticks unless t is empty. Any stray backtick characters inside t are stripped first so the resulting cell always carries exa

computeAdminUserStatus derives the at-a-glance status pill from the underlying fields. Precedence is intentional: a disabled user with no workspace is

countParentLinks returns how many `parent` link rows an item is the source of. The invariant is that a well-behaved item has at most one — the DELETE-

countUAChangeEvents returns the number of session_ua_changed rows in the audit log.

credentialsPath is retained for internal call sites.

* Cursors are decimal-encoded `seq` values as opaque strings — but * "monotonic forward" needs a numeric compare, not lexicographic. * Treat empty /

decodeJSONWithLimit is the size-configurable variant. Use this for endpoints that accept large payloads (e.g. bulk-import) where the default cap is to

decodeUserGrantsResponse requires a 200 and decodes the body, failing the test otherwise.

doBrowserLogin implements the browser-based CLI auth flow. It creates a pending session, prints the auth URL, and polls until approved.

docsCollection returns the standard Docs collection shared across templates.

doneFieldKey resolves the select field whose value represents a collection's workflow/done state (CollectionSettings.BoardGroupBy, else "status"). Use

durationsByCollection turns per-collection samples into median+count entries, ordered by count desc then slug.

emailConfigured reports whether this instance can actually SEND an emailed link — a sender is wired AND the public base URL is usable. This is the DR-

emitRealPadJSON builds the real pad cobra tree and emits its JSON representation with a static (no-resolver, no live-workspace) configuration. Tests t

enableTOTPForDeleteUser turns on 2FA for a bootstrapped delete-test user using a known secret, mirroring the real SetTOTPSecret → EnableTOTP flow, and

enqueue tries to push one entry without blocking. Returns true on success; on a full queue, increments the drop counter and returns false. The MCP mid

envelopeFrom reads the ErrorEnvelope back out of an MCP error result's structured content. Used by classifyHTTPStatus's 404 workspace path so we can l

* Escape HTML-significant characters so user-controlled strings can be * safely interpolated into attribute values and text nodes. Local copy so * t

escapeTable replaces newlines and pipes so a value can sit in a markdown table cell without breaking the table grid.