FieldKeysForKind returns the frontmatter field keys for the given kind, or ErrUnknownKind if the kind is not recognized. A later phase's server code c

Get / Stat / Delete are convenience helpers that resolve the key first.

GetAccessTokenSession hydrates an access token. Inactive rows surface as fosite.ErrInactiveToken so the introspection / authorization-bearer middlewar

GetAllItemProgress returns child item completion counts for every item in the given collection within a workspace. includeArchived controls whether s

GetBillingMetrics asks pad-cloud for an aggregated Stripe-derived snapshot (active subs, MRR, ARR, churn, cancellations). Auth is the same shared Clou

GetBlocksEdges returns every `blocks` link in the workspace whose source and target items are both live (non-deleted), newest link first. The created_

GetCLIAuthSession retrieves a CLI auth session by code. Returns nil if not found. Expired sessions are returned with status updated to "expired".

GetCollectionAnyState is GetCollection without the `deleted_at IS NULL` filter — used by the open-children guard (IDEA-1494 R3 P3) so a child still at

GetCollectionGrant retrieves a collection grant by ID.

GetCurrentUser returns the authenticated user's profile.

GetInvitation retrieves an invitation by ID.

GetItemByRef looks up an item by its PREFIX-NUMBER reference (e.g. "IDEA-15"). Since item numbers are workspace-unique, this first tries an exact pref

GetItemGrant retrieves an item grant by ID.

GetItemsByIDsIncludeDeleted fetches items (soft-deleted included) for the given IDs in ONE `WHERE id IN (...)` query, keyed by item ID. It replaces th

GetLibraryConvention finds a convention in the library by its title. Returns nil if no convention with the given title exists.

GetLibraryPlaybook finds a playbook in the library by its title. Returns nil if no playbook with the given title exists.

GetPKCERequest hydrates the PKCE session. Returns ErrOAuthNotFound if the row is missing.

GetParentMap returns a map of item ID -> parent item ID for all parent links in a workspace. Used for efficient batch lookups (e.g., dashboard, list e

Per-user Insights/report layout preferences (PLAN-1628 / TASK-1634). GetReportLayout returns the user's saved layout for a workspace, or nil when they

GetUserMetrics computes the AdminUserMetrics bundle. Cheap by design: - days_since_write reads users.last_write_at directly (one row) - writes_7d is a

GetUserWorkspaceMemberships returns workspace memberships for admin user detail.

HasPassword returns true if the user has explicitly set a password that they can sign in with. OAuth-only users have a random placeholder hash stored

ImportArtifact POSTs the raw artifact bytes to the workspace import endpoint (POST /workspaces/{ws}/import-artifact) and decodes the {ref, slug, warni

InvalidateAuthorizationCode marks a code inactive (single-use). Idempotent: invalidating an already-invalid or missing row is a no-op (fosite's contra

IsCloudServer reports whether THIS server process should run in cloud-tenant mode (enabling cloud-specific endpoints, requiring PAD_CLOUD_SECRET, wiri

ItemLastRestoreSeq returns the DURABLE per-item restore boundary (items.last_restore_seq) — the item.seq of the most recent version restore (BUG-2264)

ItemRestoreBoundaryOpID returns items.restore_boundary_op_id — the DURABLE op-log-id restore boundary (BUG-2264), or (0, false) when the item has neve

JSONArrayContains returns SQL + the arg to check if a JSON array column contains a given text value. SQLite: "column LIKE ?" with arg `%"value"%` Post

ListMovedOutSince finds items that the main /items-changes delta drops because they moved OUT of the caller's visible scope: their CURRENT collection

--- Cross-cutting queries --- ListUserGrants returns all collection and item grants for a user in a workspace.

ListUsers returns all users.

ListVersionsResolved returns versions with full content (diffs resolved). Requires the current document content to reconstruct diff-based versions.

LoadRegistry reads the installation registry from disk. Returns an empty registry if the file doesn't exist.

MCP returns the underlying mark3labs MCPServer. Use this to register tools / resources / prompts BEFORE Run() takes over the stdio transport — registr

MCPConnectionStatsForUser returns last-used + 30-day-count keyed by (token_kind, token_ref) for every connection the user has any audit-log activity f

MCPConnectionStatsKey is the exported wrapper for callers in other packages (notably internal/server/handlers_connected_apps.go in TASK-954) that need

MCPPropertyName converts a CLI flag or argument name to the snake_case form used inside the dispatch input map. Hyphens become underscores; everything

ManagesLocalServer reports whether this client configuration should auto-manage a local Pad server process.

MarkStripeEventProcessed records a Stripe webhook event ID in stripe_processed_events if it hasn't been seen before. Returns alreadyProcessed=true whe

MaxOpLogID is consulted ONLY by ForceRefreshRoom (BUG-2264), which reads it under the per-item lock WITH appendMu held (inbound persistence frozen) to

MaxOpLogIDTx is the in-transaction variant of MaxOpLogID. Version-restore (BUG-2264) reads the pre-prune MAX inside the SAME tx as the op-log wipe + c

MinOpLogID powers the resume-cursor / force-refresh check (TASK-1319): when a reconnecting client announces `?since=<id>` and that id is below MIN, ro

MoveItemWithPreCheck is MoveItem with the same precheck escape hatch UpdateItemWithPreCheck offers. Codex round-3 P1: a `pad item move ... --field sta

NewSharedWorkspaceState returns a state for a multi-user process (the cloud /mcp transport). It records Set/Get like any other state, but ResolveDefau

NewWithReplay creates a new in-memory EventBus with custom replay settings.

ParseAttachmentHref returns the UUID portion of a `pad-attachment:UUID` reference, or "" if href is not a pad-attachment reference / has an empty UUID

ParsePlaybookCLIArgs splits a sequence of positional args + bareword flags + key=value pairs into a typed map matching the playbook's declared spec. E

PlaybookSummary extracts a short prose hint from a playbook body. Picks the first non-heading non-empty paragraph and caps at ~240 chars so summary pa

PostRaw sends raw bytes to the API and decodes the JSON response.

PruneAndApply runs applyFn under the per-item setup lock so it is strictly serialised with any in-flight Join's addConn+replayTo for the same itemID.

PruneItemOpLogTx deletes an item's ENTIRE op-log inside the caller's transaction. Used by version-restore (BUG-2264): the restore's canonical items.co

PruneYjsUpdatesBefore deletes every row for itemID whose CreatedAt is strictly less than the cutoff. The schema-mismatch rebuild path passes a far-fut

Publish fans an event out to every subscriber whose itemID matches. Non-blocking: a slow subscriber whose buffer is full has new events dropped (logg

PurgeWorkspaceData hard-deletes every child row of a soft-deleted workspace and the workspace row itself, in a single transaction. Blob bytes are NOT

ReadBootstrapToken reads <DataDir>/.bootstrap-token. The file is created by EnsureBootstrapToken in internal/server/bootstrap.go with mode 0600 and co

Register installs pad's MCP tools on srv: the built-in pad_set_workspace plus every v0.2 catalog tool. Returns the count of registered tools (includin

Register creates a new user account.

RegisterCatalog installs the v0.2 catalog tools on srv. Returns the count of tools registered (excluding pad_set_workspace, which the cmdhelp-walk pat

RegisterOAuthActiveTokensCollector exposes pad_oauth_active_tokens as a callback-driven gauge. Pulled on every scrape — same pattern as the db-stats c

RemoveConnectionWorkspace deletes one (request_id, workspace_id) row. Idempotent: removing a pair that isn't present is a no-op (no error). Phase D's

RenameConnection updates the human-readable name. Touches updated_at. Returns ErrOAuthConnectionNotFound if the row doesn't exist. Trim is the caller

ResolveBacklinksVisibility computes the (fullCollectionIDs, grantedItemIDs) access vectors for `userID` in `workspaceID`, REQUEST-INDEPENDENT. Mirrors

ResolveDefault returns the workspace to inject into a dispatched call that didn't carry an explicit `workspace` — or "" when this state must not be tr

ResolvePath returns the config path for the given agent using the installer's home/cwd + goos overrides. CWDBased agents (Claude Code) resolve against

RestoreWorkspace un-soft-deletes a workspace: it clears deleted_at so the workspace (and every item/collection/member/attachment that was only transit

RewriteBracketAt rewrites the wiki-link bracket starting at byte position `position` in `content`, replacing the bracket's title segment with `newTitl

Rotate returns a new image rotated by deg degrees clockwise. Only multiples of 90 (90, 180, 270, plus their negatives) are supported in Phase 1 — that

RunStdio is Run with explicit stdin / stdout streams. Used by tests that drive the server in-process via io.Pipe. The same shutdown semantics as Run

Save writes the registry to disk.

SaveReportLayout upserts the user's layout for a workspace. The caller is responsible for sanitizing the layout (see server handler) before saving.

SearchUsers returns a filtered, paginated list of users for admin management. Each row carries the User model plus two cheap aggregations the admin t

SendEmailVerification sends an email-verification link to a newly registered user. Mirrors SendPasswordReset (buildHTMLShell/buildPlainShell, CloudMod

SendInvitation sends a workspace invitation email. If unsubscribeURL is non-empty, an unsubscribe link is included in the footer.

SetBcryptCostForTesting overrides the bcrypt cost used by CreateUser and UpdateUser for the lifetime of a test binary. It returns a restore function —

SetCollabRoomManager attaches a Yjs collab RoomManager (PLAN-1248). When set, the /api/v1/collab/{itemID} WebSocket endpoint hands new connections to

SetImageProcessor wires the image processor that the upload handler uses to derive thumbnail variants (TASK-878). Optional — without it uploads still

SetRevocationObserver wires a callback that fires after each access-token family revocation. Optional — leaving it unset is equivalent to wiring a no-

SetScopeFlags updates the three boolean scope flags atomically. All three values are written every call — there's no PATCH semantic at the store layer

SniffMIME detects the MIME type from the leading bytes of a payload using net/http's stdlib detector (the same RFC 6838 algorithm browsers use). The r

StampRestoreBoundaryOpIDTx sets items.restore_boundary_op_id INSIDE the caller's transaction (BUG-2264) — the DURABLE counterpart of the in-memory Roo

Subscribe delegates to the inner bus and increments the SSE connection gauge.

TerminalPlaceholdersForDoneField is a SQL-layer convenience that returns the done-field key plus the placeholder + args pair needed for an IN clause.

ThumbnailExt returns the file extension for a thumbnail encoded in `format`. Used to build a synthetic filename for the derived row (parent's basename

Format-policy helpers — shared between the pure-Go and libvips backends. These are intentionally NOT inside a build-tagged file so they compile under

ThumbnailMime returns the canonical MIME type for a thumbnail encoded in `format` (paired with ThumbnailFormat above).

ToItemSummaries projects a slice of items into summary shape, preserving order. A nil input yields a non-nil empty slice so the JSON encodes as `[]`.

ToolSkillPath returns the full path where a tool's skill file would be installed.

Unsubscribe delegates to the inner bus and decrements the SSE connection gauge.

UpdateView modifies an existing view.

UpdateWorkspaceMemberRole changes a member's role in a workspace.

UserID returns the pad user ID this session was issued to. Equivalent to GetSubject() under our model where Subject is always the user ID; kept as a t

ValidateBoolArity asserts that every bool-typed flag in doc obeys spec §5.3: bool flags MUST be presence switches. They MUST NOT appear in `--flag=val

ValidateURL is the pre-flight SSRF guard: it rejects non-http(s) schemes, URLs with embedded credentials, missing hostnames, and IP-literal hosts in p

ValidateUsername checks a username for format, length, and reserved word violations. It does NOT check uniqueness (that requires a store call).

WorkspaceHasAgentActivity reports whether any non-deleted item VISIBLE to the caller was created via an agent surface — direct CLI invocation or the R

WorkspaceSubscriberCount returns the number of active subscribers for a specific workspace.

acquireParentChildrenLocksForUpdate is the in-tx helper UpdateItem uses to serialize itself against the open-children guard (IDEA-1494 R2 / R4). It ac