GetAccessToken hydrates an access token by its HMAC signature. Returns ErrOAuthInactiveToken if the row exists but has been revoked / rotated out, Err

GetBillingMetrics fetches an aggregated Stripe-derived snapshot from pad-cloud's /admin/metrics/billing endpoint (active subs, MRR, ARR, churn, cancel

===================================================================== fosite.ClientManager ===========================================================

GetRefreshToken hydrates a refresh token. Returns ErrOAuthInactiveToken when active=false, which fosite uses to trigger family revocation on the match

GuestVisibleResources returns the two-level visibility for a guest: - fullCollectionIDs: collections where the user has a direct collection grant (ful

HasOAuthProvider returns true if the user has linked the given provider.

InstallForTool writes the skill content to the appropriate location for a tool.

IsExpired reports whether an invitation is past its expiration window. Invitations created before the expires_at migration (nil ExpiresAt) are treated

IsItemStarred checks whether a specific item is starred by a user.

ListArchivedItemWorkspaceMovesBySource returns at most `limit` MOVE rows for one source — rows with archived_source true — newest first. It serves th

ListAuditLog returns activities matching the given audit log filters. Supports filtering by action, actor, workspace, and date range.

ListItemVersions returns all versions for an item.

ListItemVersionsResolved returns versions with full content (diffs resolved). Requires the current item content to reconstruct diff-based versions.

ListSystemCollectionIDs returns the IDs of system collections in a workspace. System collections are always visible to members regardless of collectio

ListWatchesForUser returns every watch a user holds, across ALL workspaces they're a member of, newest first — enriched with the watched item's ref/ti

NewRoomManagerWithConfig is the explicit-config form. Empty config fields fall back to package defaults.

NewSender creates a new email sender.

NormalizeSlug maps the common singular / shorthand collection-name forms users actually type ("task", "idea", "doc", etc.) to the canonical plural slu

PlanAttachmentCopy plans the attachment side of a cross-workspace item copy. It writes nothing. DR-11a, restated because it is the whole point of the

PlaybookLibrary returns all pre-defined playbook categories with their playbooks. As of PLAN-1397's invokable-first overhaul (TASK-1403), the library

PromptBody returns the canonical body text for a registered prompt. Exported so tests can assert lockstep with SKILL.md without duplicating the litera

RenderMarkdown writes a Document as markdown matching cmdhelp v0.1 §6. Useful for tests that build a Document manually and want to render it without r

RenewSessionIfStale implements sliding-window expiration. When a session is past its renewal threshold (less than half its renewal window remaining) i

ResolveTool finds an AgentTool by name or alias. Returns nil if not found.

RevokeAccessTokenFamily mirrors RevokeRefreshTokenFamily for access tokens. fosite calls these in pairs when revoking by request_id (the unified Revok

SetEmailSender attaches a transactional email sender. The apiKey is stored separately for deriving the unsubscribe HMAC secret. If the server is alre

SetOpLogGCConfig overrides the default sweep interval (1h) and minimum row age (24h). Pass 0 for either to keep the package default. Must be called be

SetSpawn injects the goroutine spawner used for deliveries. Passing the server's tracked-goroutine helper (Server.goAsync) makes Server.Stop() wait fo

SetUserRole updates a user's role (admin or member). When demoting an admin to member, the update is conditional: it only proceeds if at least one oth

StartOpLogGC kicks off the periodic prune-sweep loop. Idempotent — calling twice silently no-ops. Must be called AFTER SetCollabRoomManager; the loop

Subscribe registers a subscriber for itemID and returns a buffered channel of size subscriberBufSize.

TouchUserWrite updates last_write_at for a user, throttled to avoid write amplification. Only writes if the stored value is older than 5 minutes. Best

UnmarkStripeEventProcessed deletes a row from stripe_processed_events, allowing Stripe retries of the same event ID to be handled again (TASK-736). Us

Unsubscribe removes a subscriber and closes its channel.

UpdateUser updates mutable user fields.

UserHasGrantsInWorkspace checks if a user has any active collection or item grants in a workspace (even though they are not a member). Used to detect

ValidatePartialFields validates ONLY the keys present in `patch` against the schema (TASK-2022, field-level PATCH / IDEA-1480). Unlike ValidateFields

ValidatePassword checks an email/password combination. Returns the user if valid, nil if the credentials are wrong (not an error).

ValidateToken hashes the provided plaintext token, looks it up in the database, checks expiry, and updates last_used_at. Returns nil if the token is i

VerifyClaimCode returns true if code matches the derived code for (userID, workspaceID) at the current OR previous time bucket — the sliding 5–10 minu

apiRequest makes a JSON API request to the test server.

assertTransformDenied pins the shared denial: 404 with the exact body every other attachment denial writes.

buildToolFromDef compiles a ToolDef into the mcp.Tool shape mcp-go expects. The schema is flat: `action` is required, every other parameter is optiona

countIPChangeEvents returns the number of session_ip_changed rows in the audit log.

decryptUserTOTP decrypts the TOTP secret on a User struct in place.

displayWidth returns the visible column width of s: ANSI SGR escape sequences are stripped, then the remaining runes are counted. Every rune is approx

distinctPNG returns a valid PNG whose bytes differ per seed, so an assertion on served content can tell one blob from another. The download handler ne

enrichItemForResponse populates derived closure and parent info on a single item. An optional visibleIDs slice filters related items so hidden-collect

errStructured wraps a Go error into the standard MCP tool-error envelope (TASK-1077) with a stable identifier prefix (e.g. "pad_item.link"). Local hel

escapeTableCell escapes characters that would break a markdown table row: `|` becomes `\|`, and existing backslashes are doubled so the escape stays v

extractCommandBlock returns the substring of `md` covering one command's section, identified by its full path (e.g. "item create"). Used to scope asse

extractFieldValue pulls a named string field out of an item's fields JSON blob. Returns "" when the blob is empty, unparseable, or carries no string v

===================================================================== Helpers ===================================================================== fa

filterWatchesByCurrentAccess re-checks each watch's CURRENT visibility (workspace membership / role / collection access / item grants) before it is us

flexJSONToString accepts a raw JSON value and returns it as a canonical JSON-encoded string. Acceptable inbound shapes: - absent / empty / null → nil

isUUID is defined in handlers_items.go getWorkspaceDocument resolves workspace slug and document ID from URL params.

hasBootstrapToken reports whether a bootstrap token is currently configured. Lock-aware — safe to call without holding s.bootstrapMu. Used by handleSe

isAPITokenAuth returns true if the request was authenticated via an API token (not a session cookie or CLI session). Use this to gate sensitive operat

listTransitions returns all status_transitions rows for an item, oldest first.

Store-level tests for CreateAttachmentForLiveItem — PLAN-2391 DR-14 / TASK-2402. The handler-level coverage lives in internal/server; these pin the in

markUploadInFlight increments the in-flight counter for a content hash. Returns a release func the caller MUST defer; the release decrements and remov

True when `key` names the live view. A null key never matches.

membersHandler returns an http.Handler that responds to any path with the standard `{members:[...], invitations:[]}` shape using the supplied rows.

BUG-2413: the attachment read path must fail CLOSED on Content-Disposition — a stored MIME that is not explicitly inline-safe is served as an attachme

Move one finger; sends `touchMove` with the full active set.

Connected-apps store tests (PLAN-943 TASK-954). What's covered: - ListUserOAuthConnections deduplicates a chain across multiple access-token rows (r

normalizeStringEncodedJSONFields recursively walks a parsed JSON value, finds string-typed `fields` and `tags` properties, parses them as embedded JSO

packageHTTPResponse turns the recorded handler response into an MCP CallToolResult, mirroring ExecDispatcher's "JSON → structured + text fallback" beh

parseAttachmentFilename extracts the filename from a Content-Disposition header. Mirrors the CLI's helper of the same name (cmd/pad/main.go parseAttac

recordInstallation stores a skill install in the global registry (~/.pad/installations.json).

registerPendingAck creates an entry in the room's pending-acks map keyed on requestID, expecting acks/brackets from `applier`. It seeds the bracket ba

renderItemTable is the testable core of PrintItemTable: it lays the item list out into maxWidth columns and writes to w. Columns are REF/TITLE · STATU

===================================================================== Translation helpers ============================================================

resolveWorkspace resolves a workspace by slug or UUID, scoped to the authenticated user's accessible workspaces when a user context is present. Return

runWorkspacePurgeSweep purges every workspace whose deleted_at is older than cutoff. Blobs are reclaimed BEFORE the DB rows are removed so a failed re

sanitizeFTSQuery wraps each token in double quotes so FTS5 treats special characters (like hyphens) as literals rather than operators. Only used for S

sanitizePGFTSQuery returns a copy of q with hyphens replaced by spaces. Used as the second leg of the OR-combined PG FTS query: postgres' english pars

scanAttachment scans a single row into a models.Attachment, handling nullables via *string / *int.

seedCollabFixture creates the minimum fixture chain needed to test the collab WS endpoint: workspace + collection + item, all in the store, returning