schemaHasField returns true if the collection schema defines a field with the given key.

schemaTypeBrief returns a one-line type description for a schema proxy: the declared type, format if present, item type for arrays, or the ref name fo

seedItem creates a collection (idempotent on slug) + an item with the given title, returning the resolved item record.

setCSRFCookie writes a new CSRF token cookie. The cookie is NOT HttpOnly so that JavaScript can read it and send it back as a header.

End-to-end coverage of the --format routing itself, not just the render helpers: the command is executed through cobra against an httptest server, so

setupOwnedDeletedWorkspace registers Alice + Bob, has Alice create and then soft-delete a workspace, and returns their tokens plus the workspace. Shar

since returns all buffered events with ID > sinceID, in chronological order. Returns nil if sinceID is older than the oldest buffered event AND the bu

singleLine collapses internal whitespace and newlines for safe inclusion in a markdown table cell.

snapshotBeforeMigrate copies the live SQLite database file to <db>.pre-<VERSION> before any pending migrations run, so a botched upgrade can be rolled

sortedActionNames returns def.Actions' keys in lexical order. Used for both the schema's action enum (so the ordering is stable across builds and repr

streamWatchEvents reads SSE lines from an open connection, printing formatMonitorLine for each "notification" event, until the body is exhausted (conn

stray C0 controls + DEL (includes bare ESC) stripANSI removes escape and control sequences from s, leaving the visible text. TAB, LF, and CR are prese

tightenPerms sets path to 0600 if it exists. Best-effort: errors only emit a warning to stderr (the user's primary intent — install / no-op — already

* Strip a row down to the skinny shape. Defensive: discard `content` * if a caller passed a full `Item` rather than an `ItemIndexRow`. The * destruc

The `transform` inline style on the viewer's image (empty before it mounts).

uniqueSlug generates a unique slug within a scope by appending -2, -3, etc.

unwrapItems extracts the array from a `{items: [...]}` envelope — the post-BUG-985 shape ExecDispatcher and packageHTTPResponse use for top-level arra

uploadedAttachmentID pulls the new attachment's id out of a 201 upload response body.

upstreamHTTPErrorResult is the canonical wrapper for "the dispatcher made an HTTP call that returned a non-2xx" cases outside the main executeRequest/

* The URL for one variant. `original` is the CANONICAL, no-`?variant` download — * that is what "the original" IS on the server (it serves the origin

wrapItemNotFound rewrites a bare "not_found" APIError from the item-by-ref endpoints into a message that echoes the failing ref and workspace, so `pad

write performs a single insert with a per-call timeout. DB errors log + drop the row — there's no retry path because the audit log is best-effort by d

writeAttachmentNotFound is the single denial writer for the blob read path. Every authorization-dependent refusal — attachment missing, wrong workspac

writeMarkdownRow writes one pipe-delimited row. Cells are expected to be pre-escaped.

writeRateLimitResponse sends a 429 response with Retry-After and X-RateLimit-* headers.

writeSSEEvent writes a single SSE event to the response writer. If eventID > 0, an "id:" field is included for Last-Event-ID support. Returns nil for

ActorKind is the writer role — "agent" or "user" — as this process can best describe itself. Same self-declared signal as ResolveAgentName, just reduc

AllToolNames returns all valid names and aliases that can be passed to `pad agent install`.

AsOpenChildren returns the parsed open-children details when this APIError carries them, or nil otherwise. Returns nil for any error other than "open_

AttachmentDownloadURL builds the canonical attachment download URL. Pass an empty variant for the original; otherwise "thumb-sm" / "thumb-md" (the ser

BackfillStatusTransitions populates status_transitions from history in two passes, designed to be called once from server startup after migrations run

CancelCustomer asks pad-cloud to cancel every active Stripe subscription for customerID and then delete the Stripe customer object. Idempotent at the

Capabilities reports what this backend can do. The editor reads these flags via GET /api/v1/server/capabilities and gates rotate/crop UI on per-format

CategoryLabel returns the human-readable label for a category slug. Unknown categories are returned unchanged so the picker can still render a reasona

ChildLinkTypes is the exported, read-only view of childLinkTypes (items.go) — the link types GetChildItems walks to find an item's children. It exist

ColorizedStatus returns a status icon + status text with appropriate color.

===================================================================== AccessTokenStorage =============================================================

CreateOAuthUser creates a user from an OAuth provider with a random unusable password. OAuth users can later set a password via the password reset flo

============================================================ PKCE request sessions (handler/pkce/storage.go PKCERequestStorage) ======================

DateBucket returns a SQL expression that truncates an RFC3339 UTC timestamp TEXT column to the start of its bucket, as a sortable TEXT label, for GROU

DeleteAccountAtomic deletes a user and all their owned workspaces in a single transaction. If any step fails, the entire operation is rolled back and

DeleteWatch removes a user's watch on an item. Returns sql.ErrNoRows if no such watch exists — mirrors UnstarItem's contract.

DisableTOTP disables 2FA and clears the secret and recovery codes. It also clears the totp_last_step single-use watermark (BUG-2054) so it doesn't out

Dispatch runs `<Binary> <cmdPath...> <cliArgs...>` and packages the output for an MCP client.

EnsureUniqueUsername takes a candidate username and returns a unique variant by appending -2, -3, etc. if the candidate already exists in the database

ExportItemArtifact GETs the single-item artifact export endpoint (GET /workspaces/{ws}/items/{ref}/export) and returns the artifact bytes (Markdown +

Fetch runs `<Binary> <args...>` and returns stdout on success.

FieldKeysForKind returns the frontmatter field keys for the given kind, or ErrUnknownKind if the kind is not recognized. A later phase's server code c

Get / Stat / Delete are convenience helpers that resolve the key first.

GetAccessTokenSession hydrates an access token. Inactive rows surface as fosite.ErrInactiveToken so the introspection / authorization-bearer middlewar

GetAllItemProgress returns child item completion counts for every item in the given collection within a workspace. includeArchived controls whether s

GetAttachmentVariant returns the derived attachment row for parentID with the given variant key (e.g. "thumb-sm"), or (nil, nil) if no such row exists

GetBillingMetrics asks pad-cloud for an aggregated Stripe-derived snapshot (active subs, MRR, ARR, churn, cancellations). Auth is the same shared Clou

GetBlocksEdges returns every `blocks` link in the workspace whose source and target items are both live (non-deleted), newest link first. The created_

GetCLIAuthSession retrieves a CLI auth session by code. Returns nil if not found. Expired sessions are returned with status updated to "expired".

GetCollectionGrant retrieves a collection grant by ID.

GetCurrentUser returns the authenticated user's profile.

GetInvitation retrieves an invitation by ID.

GetItemByRef looks up an item by its PREFIX-NUMBER reference (e.g. "IDEA-15"). Since item numbers are workspace-unique, this first tries an exact pref

GetItemGrant retrieves an item grant by ID.

GetItemsByIDsIncludeDeleted fetches items (soft-deleted included) for the given IDs in ONE `WHERE id IN (...)` query, keyed by item ID. It replaces th

GetLibraryConvention finds a convention in the library by its title. Returns nil if no convention with the given title exists.

GetPKCERequest hydrates the PKCE session. Returns ErrOAuthNotFound if the row is missing.

GetParentMap returns a map of item ID -> parent item ID for all parent links in a workspace. Used for efficient batch lookups (e.g., dashboard, list e

Per-user Insights/report layout preferences (PLAN-1628 / TASK-1634). GetReportLayout returns the user's saved layout for a workspace, or nil when they

GetUserMetrics computes the AdminUserMetrics bundle. Cheap by design: - days_since_write reads users.last_write_at directly (one row) - writes_7d is a

GetUserWorkspaceMemberships returns workspace memberships for admin user detail.

HasPassword returns true if the user has explicitly set a password that they can sign in with. OAuth-only users have a random placeholder hash stored

ImportArtifact POSTs the raw artifact bytes to the workspace import endpoint (POST /workspaces/{ws}/import-artifact) and decodes the {ref, slug, warni

InvalidateAuthorizationCode marks a code inactive (single-use). Idempotent: invalidating an already-invalid or missing row is a no-op (fosite's contra

IsCloudServer reports whether THIS server process should run in cloud-tenant mode (enabling cloud-specific endpoints, requiring PAD_CLOUD_SECRET, wiri

IsWorkspaceMember checks if a user is a member of a workspace.

ItemLastRestoreSeq returns the DURABLE per-item restore boundary (items.last_restore_seq) — the item.seq of the most recent version restore (BUG-2264)

ItemRestoreBoundaryOpID returns items.restore_boundary_op_id — the DURABLE op-log-id restore boundary (BUG-2264), or (0, false) when the item has neve

JSONArrayContains returns SQL + the arg to check if a JSON array column contains a given text value. SQLite: "column LIKE ?" with arg `%"value"%` Post

ListMovedOutSince finds items that the main /items-changes delta drops because they moved OUT of the caller's visible scope: their CURRENT collection

--- Cross-cutting queries --- ListUserGrants returns all collection and item grants for a user in a workspace.

ListUsers returns all users.

ListVersionsResolved returns versions with full content (diffs resolved). Requires the current document content to reconstruct diff-based versions.

LoadPadToml finds and reads the nearest .pad.toml by walking up from cwd. Returns nil if no .pad.toml is found (not an error).

LoadRegistry reads the installation registry from disk. Returns an empty registry if the file doesn't exist.

MCP returns the underlying mark3labs MCPServer. Use this to register tools / resources / prompts BEFORE Run() takes over the stdio transport — registr

MCPConnectionStatsForUser returns last-used + 30-day-count keyed by (token_kind, token_ref) for every connection the user has any audit-log activity f

MCPConnectionStatsKey is the exported wrapper for callers in other packages (notably internal/server/handlers_connected_apps.go in TASK-954) that need