playbooksCollection returns a Playbooks collection scoped to the caller's domain. Like conventionsCollection, the trigger and scope select options are

publishItemEventWithName publishes a real-time event for item changes with actor name. `seq` is the item's workspace-scoped monotonic mutation cursor

readAttachment handles pad://workspace/{ws}/attachments/{id}. It requests the existing thumb-md path so authorization, workspace isolation, image proc

runApplierEcho spawns a goroutine that reads all incoming TextMessage frames on conn, looks for applier_request, and immediately responds with applier

seedGrantee creates a throwaway user to be the recipient of a grant, for tests that need a real grant/link ID on a hidden or visible resource (BUG-192

stopMCPSessionTracker signals the sweeper to exit. Called from Server.Stop. Idempotent.

Addr returns the host:port listen address.

AllowedAudience returns the canonical resource URL the server is configured to accept. Sub-PR C's /authorize handler reads this to reject mismatched `

ApplyPatch applies a patch to baseText to produce the target text. Returns an error if the patch cannot be applied cleanly.

Clone overrides DefaultSession.Clone so the returned value is a *Session, not a *DefaultSession. Without this override, fosite's internal Clone() call

CloudMode reports whether the marketing footer is currently enabled. Templates read it through getCloudMode() so they pick up the same snapshot for th

ComputeRef sets the Ref field from CollectionPrefix and ItemNumber. Call this after populating the item from a database query.

ConvertGeneric converts an HTML document into markdown by first running go-readability to strip chrome, navigation, and ads, then piping the cleaned H

DeleteUserSessions destroys all sessions for a user (logout everywhere).

DetectTools returns the tools that appear to be in use, based on any of: a project-local directory, a home-directory install, or a binary on PATH.

EmitJSON walks the command tree below `target`, builds a cmdhelp v0.1 Document, and writes it to w as indented JSON terminated by a newline. `root` M

EnableTOTP atomically enables 2FA for a user and stores hashed recovery codes. The expectedSecret is the plaintext secret — it's compared against the

EnsureBootstrapToken generates a fresh first-run bootstrap token (or loads the existing one if a valid file is already present). Returns the token str

GetAccessToken hydrates an access token by its HMAC signature. Returns ErrOAuthInactiveToken if the row exists but has been revoked / rotated out, Err

GetBillingMetrics fetches an aggregated Stripe-derived snapshot from pad-cloud's /admin/metrics/billing endpoint (active subs, MRR, ARR, churn, cancel

===================================================================== fosite.ClientManager ===========================================================

GetRefreshToken hydrates a refresh token. Returns ErrOAuthInactiveToken when active=false, which fosite uses to trigger family revocation on the match

GuestVisibleResources returns the two-level visibility for a guest: - fullCollectionIDs: collections where the user has a direct collection grant (ful

HasOAuthProvider returns true if the user has linked the given provider.

InstallForTool writes the skill content to the appropriate location for a tool.

IsExpired reports whether an invitation is past its expiration window. Invitations created before the expires_at migration (nil ExpiresAt) are treated

IsItemStarred checks whether a specific item is starred by a user.

ListArchivedItemWorkspaceMovesBySource returns at most `limit` MOVE rows for one source — rows with archived_source true — newest first. It serves th

ListAuditLog returns activities matching the given audit log filters. Supports filtering by action, actor, workspace, and date range.

ListItemVersions returns all versions for an item.

ListItemVersionsResolved returns versions with full content (diffs resolved). Requires the current item content to reconstruct diff-based versions.

ListSystemCollectionIDs returns the IDs of system collections in a workspace. System collections are always visible to members regardless of collectio

ListWatchesForUser returns every watch a user holds, across ALL workspaces they're a member of, newest first — enriched with the watched item's ref/ti

NewMemorySessionPresence returns an empty in-process registry.

NewRoomManagerWithConfig is the explicit-config form. Empty config fields fall back to package defaults.

NewSender creates a new email sender.

NormalizeSlug maps the common singular / shorthand collection-name forms users actually type ("task", "idea", "doc", etc.) to the canonical plural slu

PlanAttachmentCopy plans the attachment side of a cross-workspace item copy. It writes nothing. DR-11a, restated because it is the whole point of the

PlaybookLibrary returns all pre-defined playbook categories with their playbooks. As of PLAN-1397's invokable-first overhaul (TASK-1403), the library

PromptBody returns the canonical body text for a registered prompt. Exported so tests can assert lockstep with SKILL.md without duplicating the litera

RenderMarkdown writes a Document as markdown matching cmdhelp v0.1 §6. Useful for tests that build a Document manually and want to render it without r

RenewSessionIfStale implements sliding-window expiration. When a session is past its renewal threshold (less than half its renewal window remaining) i

ResolveTool finds an AgentTool by name or alias. Returns nil if not found.

RevokeAccessTokenFamily mirrors RevokeRefreshTokenFamily for access tokens. fosite calls these in pairs when revoking by request_id (the unified Revok

Markdown list rendering (#898). The `--format markdown` branch of the list commands writes a GitHub-flavored markdown table. Two rules separate it fr

SetEmailSender attaches a transactional email sender. The apiKey is stored separately for deriving the unsubscribe HMAC secret. If the server is alre

SetOpLogGCConfig overrides the default sweep interval (1h) and minimum row age (24h). Pass 0 for either to keep the package default. Must be called be

SetSpawn injects the goroutine spawner used for deliveries. Passing the server's tracked-goroutine helper (Server.goAsync) makes Server.Stop() wait fo

SetUserRole updates a user's role (admin or member). When demoting an admin to member, the update is conditional: it only proceeds if at least one oth

StartOpLogGC kicks off the periodic prune-sweep loop. Idempotent — calling twice silently no-ops. Must be called AFTER SetCollabRoomManager; the loop

Subscribe returns a channel that receives every future Notification, with NO replay. There is exactly one logical stream (unlike internal/events.Event

Subscribe registers a subscriber for itemID and returns a buffered channel of size subscriberBufSize.

TouchUserWrite updates last_write_at for a user, throttled to avoid write amplification. Only writes if the stored value is older than 5 minutes. Best

UnmarkStripeEventProcessed deletes a row from stripe_processed_events, allowing Stripe retries of the same event ID to be handled again (TASK-736). Us

UpdateItemWithParentLink is UpdateItemWithPreCheck plus an OPTIONAL parent-link mutation applied inside the same transaction (BUG-2013). When parentLi

UpdateUser updates mutable user fields.

UserHasGrantsInWorkspace checks if a user has any active collection or item grants in a workspace (even though they are not a member). Used to detect

ValidatePartialFields validates ONLY the keys present in `patch` against the schema (TASK-2022, field-level PATCH / IDEA-1480). Unlike ValidateFields

ValidatePassword checks an email/password combination. Returns the user if valid, nil if the credentials are wrong (not an error).

ValidateToken hashes the provided plaintext token, looks it up in the database, checks expiry, and updates last_used_at. Returns nil if the token is i

VerifyClaimCode returns true if code matches the derived code for (userID, workspaceID) at the current OR previous time bucket — the sliding 5–10 minu

apiRequest makes a JSON API request to the test server.

assertTransformDenied pins the shared denial: 404 with the exact body every other attachment denial writes.

countIPChangeEvents returns the number of session_ip_changed rows in the audit log.

decryptUserTOTP decrypts the TOTP secret on a User struct in place.

distinctPNG returns a valid PNG whose bytes differ per seed, so an assertion on served content can tell one blob from another. The download handler ne

enrichItemForResponse populates derived closure and parent info on a single item. An optional visibleIDs slice filters related items so hidden-collect

errStructured wraps a Go error into the standard MCP tool-error envelope (TASK-1077) with a stable identifier prefix (e.g. "pad_item.link"). Local hel

escapeTableCell escapes characters that would break a markdown table row: `|` becomes `\|`, and existing backslashes are doubled so the escape stays v

extractCommandBlock returns the substring of `md` covering one command's section, identified by its full path (e.g. "item create"). Used to scope asse

extractFieldValue pulls a named string field out of an item's fields JSON blob. Returns "" when the blob is empty, unparseable, or carries no string v

===================================================================== Helpers ===================================================================== fa

filterWatchesByCurrentAccess re-checks each watch's CURRENT visibility (workspace membership / role / collection access / item grants) before it is us

flexJSONToString accepts a raw JSON value and returns it as a canonical JSON-encoded string. Acceptable inbound shapes: - absent / empty / null → nil

isUUID is defined in handlers_items.go getWorkspaceDocument resolves workspace slug and document ID from URL params.

hasBootstrapToken reports whether a bootstrap token is currently configured. Lock-aware — safe to call without holding s.bootstrapMu. Used by handleSe

isAPITokenAuth returns true if the request was authenticated via an API token (not a session cookie or CLI session). Use this to gate sensitive operat

listTransitions returns all status_transitions rows for an item, oldest first.

Store-level tests for CreateAttachmentForLiveItem — PLAN-2391 DR-14 / TASK-2402. The handler-level coverage lives in internal/server; these pin the in

markUploadInFlight increments the in-flight counter for a content hash. Returns a release func the caller MUST defer; the release decrements and remov