liveAttachmentCount counts the workspace's live, non-derived attachment rows — the quota-counted surface a refused transform must not grow.

mapRoleUpdate dispatches `pad role update <slug> [--name ...] [--slug ...] [--description ...] [--icon ...] [--tools ...] [--sort-order ...]`. PATCH

mkAdminCookieReq is the same shape minus the Authorization header. Simulates the cookie-session path where isBearerAuth must return false and the admi

mustCreatePATForTest creates a real PAT against a fresh user + workspace. Returns the raw token string suitable for the Authorization: Bearer header.

--- TASK-2369: the ACL filter must be visible, and must not leak ------- mustLegacyPlanLink writes an item_links row carrying the pre-rename "plan" li

mustWorkspaceID resolves a workspace slug to its internal ID via the store. Tests use it because they don't have access to the request context that ge

noBearerRequest returns a bare request with no Authorization header — isBearerAuth(r) reports false for it, matching a cookie-session-style caller. No

normalizeServerURL canonicalizes a server URL for use as a credential key. Trailing slash and surrounding whitespace are stripped; nothing else is tou

normalizeWebhookEvents canonicalizes a webhook's event filter to the JSON-array string the store + dispatcher expect. Returns (value, true) when a no

nthPositional returns pos[n] or "" when absent.

numericInput pulls an int64 out of a JSON-typed input value. JSON decoders deliver numbers as float64 (or json.Number when UseNumber()); we accept bot

oauthRequestToFositeRequest hydrates a stored row into a fresh fosite.Request, fetching the client by ID and unmarshalling the session bytes into the

Surface an upload failure to the user.

openBootstrapEnabled reports whether open-bootstrap is active for this server: bypass flag is set AND we're not in cloud mode. Cloud mode always wins

parseCollectionFieldsDSL parses the CLI's --fields DSL into a {fields: [...]} map ready for json.Marshal. Empty input returns an empty Fields slice (t

preflightAsAttacker runs the dry run as the restricted editor and returns both the parsed response and the RAW bytes, because one of the assertions be

publishCommentEvent publishes a real-time event for comment changes.

queryOAuthRequestRow reads a row by signature from the named table and returns (request, active, err). - For oauth_pkce_requests, active is always tr

rawPeerAddr returns the untampered TCP peer address captured by CapturePeerAddr, falling back to the current r.RemoteAddr if the middleware wasn't ins

readItem handles pad://workspace/{ws}/items/{ref}. Why JSON-then-format instead of `--format markdown`: pad's CLI `--format markdown` for `item show`

readMigrationNames returns sorted .sql filenames from an embedded FS directory.

Helpers ------------------------------------------------------------------

recordMCPCallMetrics fans the audit-row data out to Prometheus. No-op when metrics aren't wired (selfhost / tests). Kept separate from MCPAuditLog so

recoverSweeper is the panic firewall for the long-running background sweeper loops (orphan GC, op-log GC, token reaper, workspace purge). Each of thos

--- helpers --- registerNonAdmin inserts a member-role user directly into the store and mints a session token for them. Bypasses the admin-registratio

renderItemCopyResult writes the outcome of a completed copy.

replaceWikiLinks deletes prior wiki-link rows for `sourceItemID` and inserts fresh ones extracted from `content`. Resolution against the workspace's i

requireConnectionOwner is the per-mutation prologue. Returns the (currentUser, requestID, ok) triple. On `ok=false` the response has already been writ

respondWithConnection re-fetches + writes the connection DTO post- mutation so the page can re-render without a separate list refresh. Stats lookup is

rootFlagsToArgs converts a startup root-flags map into the pre-formatted CLI token list every fetch should append. Empty values are skipped (matching

runOpenChildrenGuard executes the guard logic inside the store-layer transaction. Returns: - (nil, nil) when the guard doesn't apply (no transition,

schemaHasField returns true if the collection schema defines a field with the given key.

schemaTypeBrief returns a one-line type description for a schema proxy: the declared type, format if present, item type for arrays, or the ref name fo

seedItem creates a collection (idempotent on slug) + an item with the given title, returning the resolved item record.

setCSRFCookie writes a new CSRF token cookie. The cookie is NOT HttpOnly so that JavaScript can read it and send it back as a header.

setupOwnedDeletedWorkspace registers Alice + Bob, has Alice create and then soft-delete a workspace, and returns their tokens plus the workspace. Shar

since returns all buffered events with ID > sinceID, in chronological order. Returns nil if sinceID is older than the oldest buffered event AND the bu

singleLine collapses internal whitespace and newlines for safe inclusion in a markdown table cell.

snapshotBeforeMigrate copies the live SQLite database file to <db>.pre-<VERSION> before any pending migrations run, so a botched upgrade can be rolled

sortedActionNames returns def.Actions' keys in lexical order. Used for both the schema's action enum (so the ordering is stable across builds and repr

streamWatchEvents reads SSE lines from an open connection, printing formatMonitorLine for each "notification" event, until the body is exhausted (conn

tightenPerms sets path to 0600 if it exists. Best-effort: errors only emit a warning to stderr (the user's primary intent — install / no-op — already

* Strip a row down to the skinny shape. Defensive: discard `content` * if a caller passed a full `Item` rather than an `ItemIndexRow`. The * destruc

The `transform` inline style on the viewer's image (empty before it mounts).

uniqueSlug generates a unique slug within a scope by appending -2, -3, etc.

unwrapItems extracts the array from a `{items: [...]}` envelope — the post-BUG-985 shape ExecDispatcher and packageHTTPResponse use for top-level arra

uploadedAttachmentID pulls the new attachment's id out of a 201 upload response body.

upstreamHTTPErrorResult is the canonical wrapper for "the dispatcher made an HTTP call that returned a non-2xx" cases outside the main executeRequest/

* The URL for one variant. `original` is the CANONICAL, no-`?variant` download — * that is what "the original" IS on the server (it serves the origin

wrapItemNotFound rewrites a bare "not_found" APIError from the item-by-ref endpoints into a message that echoes the failing ref and workspace, so `pad

write performs a single insert with a per-call timeout. DB errors log + drop the row — there's no retry path because the audit log is best-effort by d

writeAttachmentNotFound is the single denial writer for the blob read path. Every authorization-dependent refusal — attachment missing, wrong workspac

writeRateLimitResponse sends a 429 response with Retry-After and X-RateLimit-* headers.

writeSSEEvent writes a single SSE event to the response writer. If eventID > 0, an "id:" field is included for Last-Event-ID support. Returns nil for

AllToolNames returns all valid names and aliases that can be passed to `pad agent install`.

AsOpenChildren returns the parsed open-children details when this APIError carries them, or nil otherwise. Returns nil for any error other than "open_

AttachmentDownloadURL builds the canonical attachment download URL. Pass an empty variant for the original; otherwise "thumb-sm" / "thumb-md" (the ser

BackfillStatusTransitions populates status_transitions from history in two passes, designed to be called once from server startup after migrations run

CancelCustomer asks pad-cloud to cancel every active Stripe subscription for customerID and then delete the Stripe customer object. Idempotent at the

Capabilities reports what this backend can do. The editor reads these flags via GET /api/v1/server/capabilities and gates rotate/crop UI on per-format

CategoryLabel returns the human-readable label for a category slug. Unknown categories are returned unchanged so the picker can still render a reasona

ChildLinkTypes is the exported, read-only view of childLinkTypes (items.go) — the link types GetChildItems walks to find an item's children. It exist