parseCollectionFieldsDSL parses the CLI's --fields DSL into a {fields: [...]} map ready for json.Marshal. Empty input returns an empty Fields slice (t

preflightAsAttacker runs the dry run as the restricted editor and returns both the parsed response and the RAW bytes, because one of the assertions be

publishCommentEvent publishes a real-time event for comment changes.

queryOAuthRequestRow reads a row by signature from the named table and returns (request, active, err). - For oauth_pkce_requests, active is always tr

rawPeerAddr returns the untampered TCP peer address captured by CapturePeerAddr, falling back to the current r.RemoteAddr if the middleware wasn't ins

readItem handles pad://workspace/{ws}/items/{ref}. Why JSON-then-format instead of `--format markdown`: pad's CLI `--format markdown` for `item show`

readMigrationNames returns sorted .sql filenames from an embedded FS directory.

Helpers ------------------------------------------------------------------

recordMCPCallMetrics fans the audit-row data out to Prometheus. No-op when metrics aren't wired (selfhost / tests). Kept separate from MCPAuditLog so

recoverSweeper is the panic firewall for the long-running background sweeper loops (orphan GC, op-log GC, token reaper, workspace purge). Each of thos

--- helpers --- registerNonAdmin inserts a member-role user directly into the store and mints a session token for them. Bypasses the admin-registratio

renderItemCopyResult writes the outcome of a completed copy.

replaceWikiLinks deletes prior wiki-link rows for `sourceItemID` and inserts fresh ones extracted from `content`. Resolution against the workspace's i

requireConnectionOwner is the per-mutation prologue. Returns the (currentUser, requestID, ok) triple. On `ok=false` the response has already been writ

respondWithConnection re-fetches + writes the connection DTO post- mutation so the page can re-render without a separate list refresh. Stats lookup is

rootFlagsToArgs converts a startup root-flags map into the pre-formatted CLI token list every fetch should append. Empty values are skipped (matching

runOpenChildrenGuard executes the guard logic inside the store-layer transaction. Returns: - (nil, nil) when the guard doesn't apply (no transition,

schemaHasField returns true if the collection schema defines a field with the given key.

schemaTypeBrief returns a one-line type description for a schema proxy: the declared type, format if present, item type for arrays, or the ref name fo

seedItem creates a collection (idempotent on slug) + an item with the given title, returning the resolved item record.

setCSRFCookie writes a new CSRF token cookie. The cookie is NOT HttpOnly so that JavaScript can read it and send it back as a header.

setupOwnedDeletedWorkspace registers Alice + Bob, has Alice create and then soft-delete a workspace, and returns their tokens plus the workspace. Shar

since returns all buffered events with ID > sinceID, in chronological order. Returns nil if sinceID is older than the oldest buffered event AND the bu

singleLine collapses internal whitespace and newlines for safe inclusion in a markdown table cell.

snapshotBeforeMigrate copies the live SQLite database file to <db>.pre-<VERSION> before any pending migrations run, so a botched upgrade can be rolled

sortedActionNames returns def.Actions' keys in lexical order. Used for both the schema's action enum (so the ordering is stable across builds and repr

tightenPerms sets path to 0600 if it exists. Best-effort: errors only emit a warning to stderr (the user's primary intent — install / no-op — already

* Strip a row down to the skinny shape. Defensive: discard `content` * if a caller passed a full `Item` rather than an `ItemIndexRow`. The * destruc

The `transform` inline style on the viewer's image (empty before it mounts).

uniqueSlug generates a unique slug within a scope by appending -2, -3, etc.

unwrapItems extracts the array from a `{items: [...]}` envelope — the post-BUG-985 shape ExecDispatcher and packageHTTPResponse use for top-level arra

uploadedAttachmentID pulls the new attachment's id out of a 201 upload response body.

upstreamHTTPErrorResult is the canonical wrapper for "the dispatcher made an HTTP call that returned a non-2xx" cases outside the main executeRequest/

* The URL for one variant. `original` is the CANONICAL, no-`?variant` download — * that is what "the original" IS on the server (it serves the origin

wrapItemNotFound rewrites a bare "not_found" APIError from the item-by-ref endpoints into a message that echoes the failing ref and workspace, so `pad

write performs a single insert with a per-call timeout. DB errors log + drop the row — there's no retry path because the audit log is best-effort by d

writeAttachmentNotFound is the single denial writer for the blob read path. Every authorization-dependent refusal — attachment missing, wrong workspac

writeRateLimitResponse sends a 429 response with Retry-After and X-RateLimit-* headers.

AllToolNames returns all valid names and aliases that can be passed to `pad agent install`.

AsOpenChildren returns the parsed open-children details when this APIError carries them, or nil otherwise. Returns nil for any error other than "open_

AttachmentDownloadURL builds the canonical attachment download URL. Pass an empty variant for the original; otherwise "thumb-sm" / "thumb-md" (the ser

BackfillStatusTransitions populates status_transitions from history in two passes, designed to be called once from server startup after migrations run

CancelCustomer asks pad-cloud to cancel every active Stripe subscription for customerID and then delete the Stripe customer object. Idempotent at the

Capabilities reports what this backend can do. The editor reads these flags via GET /api/v1/server/capabilities and gates rotate/crop UI on per-format

CategoryLabel returns the human-readable label for a category slug. Unknown categories are returned unchanged so the picker can still render a reasona

ChildLinkTypes is the exported, read-only view of childLinkTypes (items.go) — the link types GetChildItems walks to find an item's children. It exist

ColorizedStatus returns a status icon + status text with appropriate color.

===================================================================== AccessTokenStorage =============================================================

CreateOAuthUser creates a user from an OAuth provider with a random unusable password. OAuth users can later set a password via the password reset flo

============================================================ PKCE request sessions (handler/pkce/storage.go PKCERequestStorage) ======================

DateBucket returns a SQL expression that truncates an RFC3339 UTC timestamp TEXT column to the start of its bucket, as a sortable TEXT label, for GROU

DeleteAccountAtomic deletes a user and all their owned workspaces in a single transaction. If any step fails, the entire operation is rolled back and

DisableTOTP disables 2FA and clears the secret and recovery codes. It also clears the totp_last_step single-use watermark (BUG-2054) so it doesn't out

Dispatch runs `<Binary> <cmdPath...> <cliArgs...>` and packages the output for an MCP client.

EnsureUniqueUsername takes a candidate username and returns a unique variant by appending -2, -3, etc. if the candidate already exists in the database

ExportItemArtifact GETs the single-item artifact export endpoint (GET /workspaces/{ws}/items/{ref}/export) and returns the artifact bytes (Markdown +

Fetch runs `<Binary> <args...>` and returns stdout on success.

FieldKeysForKind returns the frontmatter field keys for the given kind, or ErrUnknownKind if the kind is not recognized. A later phase's server code c

Get / Stat / Delete are convenience helpers that resolve the key first.

GetAccessTokenSession hydrates an access token. Inactive rows surface as fosite.ErrInactiveToken so the introspection / authorization-bearer middlewar

GetAllItemProgress returns child item completion counts for every item in the given collection within a workspace. includeArchived controls whether s

GetAttachmentVariant returns the derived attachment row for parentID with the given variant key (e.g. "thumb-sm"), or (nil, nil) if no such row exists

GetBillingMetrics asks pad-cloud for an aggregated Stripe-derived snapshot (active subs, MRR, ARR, churn, cancellations). Auth is the same shared Clou

GetBlocksEdges returns every `blocks` link in the workspace whose source and target items are both live (non-deleted), newest link first. The created_

GetCLIAuthSession retrieves a CLI auth session by code. Returns nil if not found. Expired sessions are returned with status updated to "expired".

GetCollectionGrant retrieves a collection grant by ID.

GetCurrentUser returns the authenticated user's profile.

GetInvitation retrieves an invitation by ID.