True when `key` names the live view. A null key never matches.

membersHandler returns an http.Handler that responds to any path with the standard `{members:[...], invitations:[]}` shape using the supplied rows.

BUG-2413: the attachment read path must fail CLOSED on Content-Disposition — a stored MIME that is not explicitly inline-safe is served as an attachme

Move one finger; sends `touchMove` with the full active set.

Connected-apps store tests (PLAN-943 TASK-954). What's covered: - ListUserOAuthConnections deduplicates a chain across multiple access-token rows (r

normalizeStringEncodedJSONFields recursively walks a parsed JSON value, finds string-typed `fields` and `tags` properties, parses them as embedded JSO

packageHTTPResponse turns the recorded handler response into an MCP CallToolResult, mirroring ExecDispatcher's "JSON → structured + text fallback" beh

parseAttachmentFilename extracts the filename from a Content-Disposition header. Mirrors the CLI's helper of the same name (cmd/pad/main.go parseAttac

recordInstallation stores a skill install in the global registry (~/.pad/installations.json).

registerPendingAck creates an entry in the room's pending-acks map keyed on requestID, expecting acks/brackets from `applier`. It seeds the bracket ba

renderItemTable is the testable core of PrintItemTable: it lays the item list out into maxWidth columns and writes to w. Columns are REF/TITLE · STATU

===================================================================== Translation helpers ============================================================

resolveWorkspace resolves a workspace by slug or UUID, scoped to the authenticated user's accessible workspaces when a user context is present. Return

runWorkspacePurgeSweep purges every workspace whose deleted_at is older than cutoff. Blobs are reclaimed BEFORE the DB rows are removed so a failed re

sanitizeFTSQuery wraps each token in double quotes so FTS5 treats special characters (like hyphens) as literals rather than operators. Only used for S

sanitizePGFTSQuery returns a copy of q with hyphens replaced by spaces. Used as the second leg of the OR-combined PG FTS query: postgres' english pars

scanAttachment scans a single row into a models.Attachment, handling nullables via *string / *int.

seedCollabFixture creates the minimum fixture chain needed to test the collab WS endpoint: workspace + collection + item, all in the store, returning

seedStoredRow writes body to the registry and creates a live attachment row with an arbitrary stored MIME + filename attached to itemID. The row shape

seedUser creates a user that subsequent oauth tokens can use as their `subject`.

serve issues a GET (method="GET") or HEAD against a seeded row and returns the recorder. variant, when non-empty, is appended as ?variant=.

startMCPSessionTracker constructs the tracker + spawns the sweep goroutine. Called once at startup from SetMCPTransport (alongside startMCPAuditWriter

testStorePostgres creates an isolated test database on the PostgreSQL server. It connects to the base URL, creates a randomly-named database, runs mig

tokenAllowedWorkspaceMatches reports whether the OAuth token's workspace allow-list (set at consent time, TASK-952) permits the given workspace slug.

uploadChannels drives the real route (no users exist in these tests, so RequireWorkspaceAccess grants implicit owner) with independent control over th

validateSessionCookie validates a session cookie and returns the user if valid, nil otherwise. A User-Agent change is logged but NOT rejected — this m

veErrorCode extracts the JSON error.code from a response, or "" if the body isn't an error envelope.

writeBootstrapToken drops a token file at <dataDir>/.bootstrap-token in the same shape EnsureBootstrapToken would produce — token + trailing newline,

AcquireParentChildrenLocks is the CANONICAL helper for taking `pad:parent-children:<id>` advisory locks. Every call site that needs to serialize again

AsPlanLimit returns the parsed plan-limit details when this APIError carries them, or nil otherwise. Returns nil for any error other than "plan_limit_

BaseURL returns the base URL for the API. If URL is set (via config, --url flag, or PAD_URL), it takes precedence. Otherwise, constructs from host and

CancelCustomer asks pad-cloud to cancel every active Stripe subscription for customerID and then delete the Stripe customer object. Used by handleDele

CapabilityLine returns the single-line capability bit a conforming CLI emits in response to `<cmd> help --capabilities` (or the `--cmdhelp-capabilitie

ConsumeEmailVerification atomically validates and marks a verification token as used, then sets users.email_verified_at to now. Returns the (now-verif

ConsumeTOTPStep atomically records a TOTP time-step as consumed, enforcing single-use semantics for login codes (BUG-2054). It succeeds only if step i

CreatePasswordReset generates a reset token for the given user. Returns the plaintext token (to embed in the reset URL). The token is stored as a SHA-

Crop returns the rectangular sub-image bounded by `rect`. The rectangle is interpreted in the image's coordinate space (origin top-left) and intersect

Detect classifies a fetched document by inspecting its Content-Type header and the leading bytes of its body. It returns TypeOpenAPI when the document

DisableUser soft-disables a user account by setting disabled_at.

EventsSince returns buffered notifications with ID > sinceID, for Last-Event-ID resume. Returns nil if sinceID has been evicted from the buffer (gap t

ExportWorkspace exports all data for a workspace into a portable format.

FTSMatch returns the full-text search WHERE clause fragment. SQLite: "table MATCH ?" — consumes ONE arg. PostgreSQL: an OR-combined plainto_tsquery ma

GetAuthorizationCode hydrates the code's session. Returns ErrOAuthInvalidatedCode if the row exists but active=false (fosite triggers grant-family rev

--- Dashboard --- GetDashboard returns the workspace dashboard as raw JSON. The DashboardResponse type lives in the server package, so we use json.Raw

GetItemContentFlushedOpLogID returns the per-item flush watermark (TASK-1309). Returns (0, false) for items with NULL watermark or no row.

--- Child Item Progress --- GetItemProgress counts total and done child items linked to a parent via item_links. "Done" means the child item's done fi

GetOAuthProviders parses the JSON oauth_providers field into a string slice.

GetShareLink retrieves a share link by ID.

GetWatchByUserItem returns the (at most one) watch a user holds on a specific item, or (nil, nil) if none exists.

ImportWorkspace imports a workspace from an exported data structure. It creates a new workspace with regenerated IDs, remapping all references. If new

IsTerminalItem reports whether an item's fields map indicates the item is in a terminal state for its collection. This is the canonical Go-side "is do

IsTerminalStatusDefault checks using the default fallback list (for cases where no collection schema is available).

--- Collections ---

ListCommentsBeforeTime returns comments for an item created before the given time, ordered newest-first, limited to `limit` results. Used for cursor-b

ListForUser implements SessionPresence, oldest connection first with the session id as a tiebreaker so the order is deterministic even for two connect

ListStarredItems returns all items starred by a user in a workspace, enriched with collection and assignment info. Only non-deleted items are returned

ListTemplates returns all workspace templates that should be shown in pickers. Templates flagged Hidden are excluded.

LookupMIME returns the entry for a MIME type if it is on the allowlist, or (zero, false) if rejected.

NewCloudClient constructs a client pointed at the given pad-cloud base URL (e.g. "http://pad-cloud:7778") authenticated with cloudSecret. Both values

NewServer constructs a pad MCP server. Call Run(ctx) to start it. The returned Server is wired with tool capabilities advertised but no tools registe

NormalizeMIME strips parameters and lowercases the type/subtype. We match strictly against the allowlist after normalization so callers can pass an ht

PriorityColor returns a *color.Color appropriate for the given priority string.

PurgeWorkspaceData hard-deletes every child row of a soft-deleted workspace and the workspace row itself, in a single transaction. Blob bytes are NOT

RegisterResources installs the read-only MCP resource templates on srv: - pad://workspace/{ws}/items/{ref} — single item markdown - pad://workspace/{

RegisterSession writes a SessionRegistration for the CURRENT process (os.Getpid()) to ~/.pad/sessions/<pid>.json, mode 0600 — mirroring credentials.js

RenderAttachmentChip builds a Notion-style file-chip anchor for a non-image attachment. `target=_blank` + `rel=noopener noreferrer` matches the existi

RenderAttachmentImage builds an inline `<img>` element for an image attachment. Width/height attributes are emitted when both are known and positive s

RenderAttachmentMissing builds a placeholder span for a missing/deleted attachment. Keeps the document layout intact and tells the user *why* there's

============================================================ Token revocation (handler/oauth2/revocation_storage.go) =================================

SetAllowedWorkspaces is the symmetric writer used by oauth/authorize/decide (TASK-952). Centralizing the key string here keeps producers + consumers i

SetAuthToken sets the authorization token for API requests.

SetBootstrapToken wires the in-memory token + on-disk path into the Server. Called once at startup from cmd/pad/main.go after EnsureBootstrapToken suc

SetEventBus attaches an event bus for real-time SSE streaming.

SetUserStripeCustomerID stores the Stripe customer ID for a user.

SoftDeleteAttachment marks the given attachment row deleted (and every variant whose parent_id points at it) so the orphan GC will reclaim the bytes a

Status checks each tracked installation and returns its current state. embeddedContent is the raw embedded skill bytes, used for freshness comparison.

TokenAllowedWorkspaceSet returns the token's allow-list as a slug-set for filtering a multi-workspace result, or nil when no per-slug gate applies. It

TokenAllowedWorkspacesFromContext returns the token's workspace allow-list, or nil if none was attached. Three return shapes matter to callers: - nil

ToolInstalled checks if the skill file exists for the given tool.

ToolSkillPath returns the full path where a tool's skill file would be installed.

ValidateFieldsDetailed is ValidateFields with per-field attribution: it returns one FieldIssue per failure instead of a joined error, and applies sche

WithTokenWorkspaceID returns ctx decorated with a workspace-scope hint, mirroring TokenAuth's behaviour for workspace-scoped API tokens. Pass an empty