packageJSONResult converts a CLI stdout string into an MCP tool result. JSON bodies surface as structuredContent; non-JSON falls back to text. Top-lev

packageStructuredResponse encodes payload to JSON, then decodes it back to a generic any so the StructuredContent surface matches the shape MCP client

parseExamplesFromLong extracts the indented invocation lines that follow an "Examples:" header in a cobra Long string. Returns nil when no such sectio

pickTemplateInteractive presents a numbered list of visible templates grouped by category and returns the chosen template's Name. Returns the default

postOAuthFormBearer POSTs an x-www-form-urlencoded body with a Bearer Authorization header (used for /oauth/introspect, where fosite v0.49 requires ei

requireCollectionFullyVisible checks that the collection is visible to the requesting user under FULL-collection-access semantics (BUG-1920 — codex R2

resolveAssignName rewrites a `--assign <name|email>` input into `assigned_user_id <uuid>` by hitting the workspace-members endpoint and finding a matc

size returns the current entry count. Used by tests and by startMCPSessionTracker's initial gauge prime.

touch inserts or refreshes an entry. No-op on empty id (defensive: callers pre-filter, but a missing header should never bump anything). Fires onChang

validateCloudSecret checks the cloud_secret field in a JSON request body against the server's configured cloud secret. Returns true if the secret matc

BrowserURL returns a URL suitable for displaying to humans in CLI prompts (e.g. "Or open the web UI at X"). It behaves like BaseURL except that when t

BuildMetaPayload returns the meta payload for the given pad runtime version. An empty padVersion falls back to FallbackVersion for the same reason ser

CheckSession returns the current auth status.

ConvertOpenAPI converts an OpenAPI 3.x specification into a human-readable markdown document. The output is organized as: - H1 with the API title - I

CountBacklinks returns the total number of same-workspace backlinks the requester would see for a given target, applying the same visibility filter as

CreateEmailVerification generates an email-verification token for the given user. Returns the plaintext token (to embed in the verification URL). The

CurrentUserFromContext returns the user attached by WithCurrentUser (or by the standard auth middleware), and a boolean signalling whether one was pre

Get returns the current session workspace, or empty string when none has been set.

IsConnectionWorkspaceAllowed reports whether workspace_id appears in the connection's allow-list. Used internally by GetOAuthConnectionAccess when cal

IsDisabled returns true if the user account has been disabled.

LastRestoreSeq returns the item.seq of the most recent restore for itemID, or (0, false) when none has been recorded. Join consults it to force_refres

ListMCPAuditByUser returns the user's most recent audit rows in reverse-chronological order. limit caps the page; offset paginates. Caller must enforc

NewSQLite returns a *store.Store backed by a fresh SQLite file in t.TempDir(), fully migrated. See the package doc for the template+copy mechanism. St

Provider returns the fosite.OAuth2Provider that sub-PR C's HTTP handlers will call (NewAuthorizeRequest, NewAccessRequest, WriteAuthorizeResponse, etc

PruneSweep finds every item whose ENTIRE op-log is older than `minAge` and prunes the whole op-log for those items under the per-item lock. Returns a

RelativeTime returns a human-readable relative time string.

adminBillingReq fires GET /api/v1/admin/billing-stats with the cookie from a logged-in user. Returns the recorder so callers can inspect status + body

buildPlainShell builds the plain-text body for transactional emails. Self-hosted output is byte-equivalent to the prior templates. Cloud output adds a

buildQuery returns the URL-encoded query string for the mapping (without the leading '?'). Empty mapping → empty string. Numbers from JSON arrive as

cancelInit is the canonical exit path for both Ctrl+C and explicit "Cancel" actions during pad init / pad workspace init. It prints a brief message to

checkItemVisible is the context-free visibility decision. Returns (true, nil) when the (user, role) pair can see `item` under the same rules `requireI

decodeEnvelope helper extracts the ErrorEnvelope from an MCP error result. Uses textOf (the shared helper in catalog_test.go) to retrieve the JSON bod

dispatchWebhook fires a webhook event if a dispatcher is configured.

doClaim issues a POST /api/v1/oauth/claim with Bearer PAT auth. extraReqID, if non-empty, attaches a WithMCPTokenIdentity context override to simulate

encrypt encrypts plaintext using AES-256-GCM and returns a base64-encoded ciphertext prefixed with "enc:" to distinguish from plaintext values.

enrichItemsWithParent batch-populates parent link info on a slice of items. Used by list endpoints where calling enrichItemForResponse per-item is too

── Shared helpers ──────────────────────────────────────────────────────────── ensureWorkspace checks if the current directory is linked to a workspac

findFieldOptions returns the Options slice for the named field on a collection's schema, or nil if the field is missing.

--- helpers ---

getWorkspace returns the full workspace object resolved by middleware. Falls back to direct resolution for routes without RequireWorkspaceAccess.

hopTransitions returns only the "real" status hops — excluding the create-time "entered initial status" seed row (id prefix "create_") that every crea

isCancellation reports whether err represents a user-initiated abort from any interactive init prompt. Init RunEs use this to convert the sentinel int

isolateHome redirects HOME to a temp dir and chdirs to a fresh temp project dir so credential writes and .pad.toml detection don't leak into the real

itemPrefetchHandler routes /api/v1/workspaces/{ws}/items/{ref} GETs to a static map keyed by ref so each link-test can declare just the items it needs

parsePadURI extracts (workspace, kind, arg) from a pad:// URI. arg is empty for list-style resources (no trailing segment). Forms accepted: pad://w

readAttachment handles pad://workspace/{ws}/attachments/{id}. It requests the existing thumb-md path so authorization, workspace isolation, image proc

runApplierEcho spawns a goroutine that reads all incoming TextMessage frames on conn, looks for applier_request, and immediately responds with applier

seedGrantee creates a throwaway user to be the recipient of a grant, for tests that need a real grant/link ID on a hidden or visible resource (BUG-192

stopMCPSessionTracker signals the sweeper to exit. Called from Server.Stop. Idempotent.

tokenWorkspaceID returns the workspace ID set by the TokenAuth middleware, or an empty string if no token was used.

AllowedAudience returns the canonical resource URL the server is configured to accept. Sub-PR C's /authorize handler reads this to reject mismatched `

ApplyPatch applies a patch to baseText to produce the target text. Returns an error if the patch cannot be applied cleanly.

CloudMode reports whether the marketing footer is currently enabled. Templates read it through getCloudMode() so they pick up the same snapshot for th

ComputeRef sets the Ref field from CollectionPrefix and ItemNumber. Call this after populating the item from a database query.

ConvertGeneric converts an HTML document into markdown by first running go-readability to strip chrome, navigation, and ads, then piping the cleaned H

D returns the store's dialect for building backend-specific SQL.

DeleteCollection soft-deletes a collection by id. When expectedUpdatedAt is non-empty it opts into optimistic-concurrency control (BUG-2265): the row'

DeleteUserSessions destroys all sessions for a user (logout everywhere).

DetectTools returns the tools that appear to be in use, based on any of: a project-local directory, a home-directory install, or a binary on PATH.

EmitJSON walks the command tree below `target`, builds a cmdhelp v0.1 Document, and writes it to w as indented JSON terminated by a newline. `root` M

EnableTOTP atomically enables 2FA for a user and stores hashed recovery codes. The expectedSecret is the plaintext secret — it's compared against the

EnsureBootstrapToken generates a fresh first-run bootstrap token (or loads the existing one if a valid file is already present). Returns the token str

GetAccessToken hydrates an access token by its HMAC signature. Returns ErrOAuthInactiveToken if the row exists but has been revoked / rotated out, Err

GetBillingMetrics fetches an aggregated Stripe-derived snapshot from pad-cloud's /admin/metrics/billing endpoint (active subs, MRR, ARR, churn, cancel

===================================================================== fosite.ClientManager ===========================================================

GetRefreshToken hydrates a refresh token. Returns ErrOAuthInactiveToken when active=false, which fosite uses to trigger family revocation on the match

HasOAuthProvider returns true if the user has linked the given provider.

InstallForTool writes the skill content to the appropriate location for a tool.

IsExpired reports whether an invitation is past its expiration window. Invitations created before the expires_at migration (nil ExpiresAt) are treated

IsItemStarred checks whether a specific item is starred by a user.

ListAuditLog returns activities matching the given audit log filters. Supports filtering by action, actor, workspace, and date range.

ListItemVersions returns all versions for an item.

ListItemVersionsResolved returns versions with full content (diffs resolved). Requires the current item content to reconstruct diff-based versions.

NewRoomManagerWithConfig is the explicit-config form. Empty config fields fall back to package defaults.

NewSender creates a new email sender.

NormalizeSlug maps the common singular / shorthand collection-name forms users actually type ("task", "idea", "doc", etc.) to the canonical plural slu

PlaybookLibrary returns all pre-defined playbook categories with their playbooks. As of PLAN-1397's invokable-first overhaul (TASK-1403), the library

PromptBody returns the canonical body text for a registered prompt. Exported so tests can assert lockstep with SKILL.md without duplicating the litera

Register installs store under prefix (e.g. "fs", "s3"). The prefix MUST NOT contain a colon — Resolve splits keys on the first colon, so a prefix with

RemoveWorkspaceMember removes a user from a workspace.

RenderMarkdown writes a Document as markdown matching cmdhelp v0.1 §6. Useful for tests that build a Document manually and want to render it without r