CapabilityLine returns the single-line capability bit a conforming CLI emits in response to `<cmd> help --capabilities` (or the `--cmdhelp-capabilitie

ConsumeEmailVerification atomically validates and marks a verification token as used, then sets users.email_verified_at to now. Returns the (now-verif

ConsumeTOTPStep atomically records a TOTP time-step as consumed, enforcing single-use semantics for login codes (BUG-2054). It succeeds only if step i

CreatePasswordReset generates a reset token for the given user. Returns the plaintext token (to embed in the reset URL). The token is stored as a SHA-

Crop returns the rectangular sub-image bounded by `rect`. The rectangle is interpreted in the image's coordinate space (origin top-left) and intersect

Detect classifies a fetched document by inspecting its Content-Type header and the leading bytes of its body. It returns TypeOpenAPI when the document

ExportWorkspace exports all data for a workspace into a portable format.

FTSMatch returns the full-text search WHERE clause fragment. SQLite: "table MATCH ?" — consumes ONE arg. PostgreSQL: an OR-combined plainto_tsquery ma

GetAuthorizationCode hydrates the code's session. Returns ErrOAuthInvalidatedCode if the row exists but active=false (fosite triggers grant-family rev

--- Dashboard --- GetDashboard returns the workspace dashboard as raw JSON. The DashboardResponse type lives in the server package, so we use json.Raw

GetItemContentFlushedOpLogID returns the per-item flush watermark (TASK-1309). Returns (0, false) for items with NULL watermark or no row.

--- Child Item Progress --- GetItemProgress counts total and done child items linked to a parent via item_links. "Done" means the child item's done fi

GetOAuthProviders parses the JSON oauth_providers field into a string slice.

GetShareLink retrieves a share link by ID.

GuestVisibleResources returns the two-level visibility for a guest: - fullCollectionIDs: collections where the user has a direct collection grant (ful

ImportWorkspace imports a workspace from an exported data structure. It creates a new workspace with regenerated IDs, remapping all references. If new

IsTerminalItem reports whether an item's fields map indicates the item is in a terminal state for its collection. This is the canonical Go-side "is do

IsTerminalStatusDefault checks using the default fallback list (for cases where no collection schema is available).

--- Collections ---

ListCommentsBeforeTime returns comments for an item created before the given time, ordered newest-first, limited to `limit` results. Used for cursor-b

ListStarredItems returns all items starred by a user in a workspace, enriched with collection and assignment info. Only non-deleted items are returned

ListSystemCollectionIDs returns the IDs of system collections in a workspace. System collections are always visible to members regardless of collectio

ListTemplates returns all workspace templates that should be shown in pickers. Templates flagged Hidden are excluded.

LookupMIME returns the entry for a MIME type if it is on the allowlist, or (zero, false) if rejected.

NewCloudClient constructs a client pointed at the given pad-cloud base URL (e.g. "http://pad-cloud:7778") authenticated with cloudSecret. Both values

NewServer constructs a pad MCP server. Call Run(ctx) to start it. The returned Server is wired with tool capabilities advertised but no tools registe

NormalizeMIME strips parameters and lowercases the type/subtype. We match strictly against the allowlist after normalization so callers can pass an ht

PriorityColor returns a *color.Color appropriate for the given priority string.

RegisterResources installs the read-only MCP resource templates on srv: - pad://workspace/{ws}/items/{ref} — single item markdown - pad://workspace/{

RenderAttachmentChip builds a Notion-style file-chip anchor for a non-image attachment. `target=_blank` + `rel=noopener noreferrer` matches the existi

RenderAttachmentImage builds an inline `<img>` element for an image attachment. Width/height attributes are emitted when both are known and positive s

RenderAttachmentMissing builds a placeholder span for a missing/deleted attachment. Keeps the document layout intact and tells the user *why* there's

============================================================ Token revocation (handler/oauth2/revocation_storage.go) =================================

SetAllowedWorkspaces is the symmetric writer used by oauth/authorize/decide (TASK-952). Centralizing the key string here keeps producers + consumers i

SetAuthToken sets the authorization token for API requests.

SetBootstrapToken wires the in-memory token + on-disk path into the Server. Called once at startup from cmd/pad/main.go after EnsureBootstrapToken suc

SetEventBus attaches an event bus for real-time SSE streaming.

SetUserRole updates a user's role (admin or member). When demoting an admin to member, the update is conditional: it only proceeds if at least one oth

SetUserStripeCustomerID stores the Stripe customer ID for a user.

SoftDeleteAttachment marks the given attachment row deleted (and every variant whose parent_id points at it) so the orphan GC will reclaim the bytes a

Status checks each tracked installation and returns its current state. embeddedContent is the raw embedded skill bytes, used for freshness comparison.

TokenAllowedWorkspaceSet returns the token's allow-list as a slug-set for filtering a multi-workspace result, or nil when no per-slug gate applies. It

TokenAllowedWorkspacesFromContext returns the token's workspace allow-list, or nil if none was attached. Three return shapes matter to callers: - nil

ToolInstalled checks if the skill file exists for the given tool.

ValidateFieldsDetailed is ValidateFields with per-field attribution: it returns one FieldIssue per failure instead of a joined error, and applies sche

WithTokenWorkspaceID returns ctx decorated with a workspace-scope hint, mirroring TokenAuth's behaviour for workspace-scoped API tokens. Pass an empty

WorkspaceStorageInfo returns the consolidated quota summary for a workspace (used + limit + plan + override flag) in a single call. Used by the storag

WriteHidden writes the non-disclosing denial: an identical 404 for every failure mode, so absence and forbidden-ness are indistinguishable. This is th

WritePlanLimitError formats a plan-limit rejection to w in the canonical two-track shape (TASK-788): 1. A single `pad-structured-error/v1: {json}\n`

actionItemLink dispatches pad_item.action=link to the appropriate CLI cmdPath based on link_type. Renames the schema's uniform `ref` and `target` to t

actionItemList handles pad_item.action=list. It forwards to `item list` but first applies a default limit (when the agent didn't ask for one) and clam

assertNotEmailBlocked asserts the response is NOT a verified-email 403 (it may legitimately be a 2xx, or a 4xx for an unrelated reason).

attachIn creates an original attachment in the given workspace.

attachTo writes a real 2000x1500 PNG — big enough that BOTH specs must scale down, so a skip is unambiguous — and returns the new row's id. Width/Heig

authorizeCollabAccess mirrors RequireWorkspaceAccess but keyed on the item's workspace ID (the WS URL path doesn't carry a workspace slug). It checks:

classifyHTTPStatusKind turns an HTTP error response into a structured envelope, using the dispatcher's known resource context to emit the right error

This file pins BUG-1925: handleSetMemberCollectionAccess gated only on requireRole(r, "owner"), with zero validation of the CALLER's own visibility. A

These tests cover BUG-2102: the OAuth consent allow-list was enforced only by RequireWorkspaceAccess, which fires solely for /{slug} path-param routes

createUnverifiedUser makes a user whose email starts UNVERIFIED, so a consume can be observed flipping it verified. CreateUser's safe default is verif

decodeFields is a small test helper: parse an item's fields JSON into a map.

fakeYjsRow constructs a single row for the fakeOpLog seeding helpers. The store assigns ids in production; tests don't depend on them.

fetchAsResource is the shared shell-out + wrap path. padArgs is the leading argument list (without root flags); rootArgs are appended so --url etc. su

fixtureDoc returns a small cmdhelp.Document with the items the catalog tests need most often. Catalog actions only require their own cmdPath to be pre

formatItemAsMarkdown turns the JSON body returned by `pad item show --format json` into a self-contained markdown document: heading with ref + title,

gaugeValueOrZero pulls the gauge value or returns 0 when the underlying metric hasn't been touched yet.

grantHiddenItemToOwner gives the fixture's restricted owner an item-level grant on the hidden item, independent of their collection_access restriction

handleControlMessage dispatches a TextMessage frame received from a peer: applier_apply_start / applier_ack (the designated-applier bracket, TASK-1257

handleCopyItemPreflight answers "what would this cross-workspace copy do?" without doing any of it. See the file header for the full contract.

isItemDone reports whether an item is in a terminal state for its collection's configured done field. Falls back to the default-terminal list against

isPublicAPIPath reports whether the given request path is an API endpoint that bypasses authentication entirely. These handlers must work even when th

itemCopyLine makes a server-supplied string safe to drop into a table row. Schema keys, labels, option values, link types and validator messages are a

itemLock returns the lazily-allocated mutex guarding setup-phase operations on itemID. Locks live in the manager for the lifetime of the process — for

maskAPIKey returns the display form of a sensitive setting value. Keys longer than 8 chars show their first and last 4 chars (abcd...wxyz); shorter no

mintOAuthTokenForTest drives the consent → token exchange and returns the access token. Lightly customizable via the form arg so callers can vary the

BUG-1616 extended coverage — admin-via-bearer gate at the SSE and WebSocket-collab entry points that sit OUTSIDE RequireWorkspaceAccess. These endpoin