CheckUserLimit checks a user-level limit (not workspace-scoped), such as total workspace count or total API tokens.

Cleanup removes the process-wide template database, if one was built. Call it from TestMain after m.Run() so a lazily-built template file doesn't ling

CopyCommitted reports whether err is a post-commit reporting failure — the copy happened, only its result was lost. Callers must not present these as

CopyItemPreflight runs the DRY RUN. It mutates nothing in the copy's own domain, so it is safe to call repeatedly and safe to retry. Returns the deco

============================================================ Authorization codes (handler/oauth2/storage.go AuthorizeCodeStorage) ====================

CreatePatch computes a compact patch that transforms oldText into newText. The patch can be applied with ApplyPatch to recover newText from oldText.

CreateReversePatch computes a patch that transforms newText back into oldText. Used for reverse-diff version storage: current doc has latest content,

CreateView adds a new saved view.

EncryptWebhookSecretsAtRest encrypts plaintext webhook HMAC secrets (BUG-2057). Called on startup when an encryption key is configured. It handles two

FTSRank returns the column/expression for full-text relevance ranking. SQLite: rank (built-in FTS5 column) — consumes ZERO args. PostgreSQL: ts_rank b

FindAgent returns the matching Agent for a name or alias. Names are case-insensitive (Claude / claude / CLAUDE all resolve).

--- Username backfill --- GenerateUsername derives a URL-safe username from a display name. Falls back to the email local part if the name produces an

GetChildItemsForParents returns the live child items for each of the given parent item IDs, grouped by parent ID, in ONE query — collapsing the per-pa

GetCollectionAnyState is GetCollection without the `deleted_at IS NULL` filter — used by the open-children guard (IDEA-1494 R3 P3) so a child still at

GetDeletedWorkspaceBySlug returns a SOFT-DELETED workspace by slug (deleted_at IS NOT NULL), including its owner_id, or nil when no such row exists (l

GetInvitationByCode retrieves a pending invitation by its join code. Looks up by SHA-256 hash first (new invitations), then falls back to plaintext lo

GetLibraryPlaybook finds a playbook in the library by its title. Returns nil if no playbook with the given title exists.

GetUserByUsername retrieves a user by username (case-insensitive).

GetView returns a single view by ID.

GetWebhook retrieves a single webhook by ID.

GroupTemplatesByCategory returns the visible workspace templates grouped by category in the canonical CategoryOrder. Categories with no visible templa

HasEncryptionKey reports whether an encryption key is configured.

IsDiffSmaller returns true if storing a diff would be meaningfully smaller than storing the full content. Returns false for near-complete rewrites whe

--- Agent Roles --- ListAgentRoles returns all agent roles for a workspace.

ListCollectionsMinimal returns collection rows populated with just the fields needed for done-detection context and slug lookups: ID, Slug, Schema, Se

ListItemsChangesSince returns the skinny-projection of items that have mutated (create / update / soft-delete / restore) since the given seq cursor, i

--- Workspace Members --- ListWorkspaceMembers returns all members of a workspace.

LookupEmailVerification performs a read-only validation of a verification token and returns the associated user WITHOUT consuming the token. Mirrors L

MCPTokenIdentityFromContext returns (kind, ref) attached by WithMCPTokenIdentity, or ("", "") if none was set. The audit middleware uses this to popul

MetricsMiddleware returns a chi middleware that records Prometheus metrics for every HTTP request: count, duration, and response size. Path labels us

NewInstrumentedBus wraps an EventBus with Prometheus instrumentation.

NewPostgres creates a Store backed by PostgreSQL. The connStr should be a PostgreSQL connection string (e.g. "postgres://user:pass@host/db").

NewSharedWorkspaceState returns a state for a multi-user process (the cloud /mcp transport). It records Set/Get like any other state, but ResolveDefau

NewWatchEventsStreamRequest builds an authenticated GET request for GET /api/v1/events/stream (TASK-2533), used by `pad watch --stream --for-session`.

RFC 8707 ("Resource Indicators for OAuth 2.0") audience-binding hook for pad's authorization server (PLAN-943 TASK-951 sub-PR B). fosite has no nativ

Ping verifies the database connection is alive.

PublicLinkBaseURL returns the URL the server should embed in emailed links (password reset, invites, share links, admin invitations). Resolution order

RemovePadEntry deletes mcpServers.pad while leaving other servers + top-level keys intact. Returns (true, nil) when an entry was removed, (false, nil)

Resize returns a new image with the longer edge fitted to maxLong, preserving aspect ratio. Images already within maxLong are returned unchanged so ca

ResolveUserPermission resolves the effective permission for a user on a specific item, following the permission resolution order from DOC-406: 1. Owne

RevokeAccessToken mirrors RevokeRefreshToken for access tokens. fosite calls these in pairs when revoking a grant (the unified "revoke the whole famil

RevokeUserOAuthConnection invalidates every token in the OAuth grant chain identified by requestID, after verifying the chain belongs to userID. Impl

RotateAPIToken generates a new secret for an existing token, preserving all metadata (name, scopes, workspace, user, expiry). The old token is invalid

SetImageProcessor wires the image processor that the upload handler uses to derive thumbnail variants (TASK-878). Optional — without it uploads still

OAuth 2.1 authorization-server HTTP handlers (PLAN-943 TASK-951). Sub-PR C built the /register, /authorize, /authorize/decide and token endpoints + th

SetRestoreBoundary records a restore boundary for itemID, keeping the stored value monotonically non-decreasing (a later restore always has a higher o

SetSSELimits configures global and per-workspace SSE connection limits. A value of 0 means unlimited.

SetTokenReaperConfig overrides the default sweep interval (1h). Pass 0 to keep the package default. Must be called before StartTokenReaper; calling af

SetToolSurfaceHandler wires the MCP catalog→JSON serializer onto the server (PLAN-1888 / TASK-1891). Called once at startup by cmd/pad/main.go with mc

StartTokenReaper kicks off the periodic sweep that deletes expired/used email-verification tokens, password-reset tokens, sessions, and CLI-auth sessi

StatusColor returns a *color.Color appropriate for the given status string.

ToItemSummaries projects a slice of items into summary shape, preserving order. A nil input yields a non-nil empty slice so the JSON encodes as `[]`.

TokenScopesFromContext returns the JSON-encoded scopes attached by WithTokenScopes, or "" if none. Empty maps to "unrestricted" in TokenScopeAllows (t

Uninstall removes the pad entry from the named agent's config. Idempotent: a missing file or missing entry is not an error and returns (path, false, n

ValidateWebhookURL checks that a webhook URL is safe to call. It rejects non-HTTP(S) schemes, URLs with credentials, private/reserved IPs (loopback, l

WithMCPTokenIdentity stashes the bearer-token identity so the MCP audit middleware can record which connection drove the call. kind is the discrimina

WorkspaceID is a nil-safe accessor for the resolved workspace's ID.

WorkspaceSlug is a nil-safe accessor for the resolved workspace's canonical slug — the value the token allow-list was tested against.

addConn registers a freshly-built roomConn with the room. Cancels any pending grace timer (a reconnect within the window keeps the Room alive) and ret

asOpenChildrenGuardError unwraps a store-layer error that may carry an openChildrenGuardError sentinel. Returns the sanitized details and true when th

assertDisclosesNothing checks a refusal body for anything that would confirm the source item exists or reveal the destination schema.

assertNoWatchEvent drains ch for `d` and fails if a "notification" event with the given item_ref shows up — used to assert an unwatched item's mutatio

attachmentCallerIsRestricted reports whether the caller's access to the workspace is narrowed to specific collections or items rather than being full

attachmentItemID reads back the persisted item_id for an attachment, returning "" for a NULL association.

MCP audit middleware tests (PLAN-943 TASK-960). What's covered: - A successful tool call writes one audit row with the right tool_name + args_hash +

--- Auto-create Workspace (TASK-432) --- autoCreateWorkspace creates a default workspace for a new user in cloud mode. Called after user creation in r

buildBootstrapURL constructs the /setup URL the operator should open. setup_method dispatch (kept in sync with handleSessionCheck in internal/server/

buildChildrenDoneExpr compiles a set of per-collection done filters into a single SQL boolean expression plus ordered args. `itemAlias` is the item-ta

buildDashboardResponse is the canonical dashboard-assembly path. The HTTP handler (handleGetDashboard) is now a thin wrapper around it, and the bootst

buildReconcileFindings returns the reconcile findings for the given item. The item argument MUST be non-nil — the production caller (reconcileItem) an

bumpStructuralLinkSourceTx advances the source row whenever a parent or implements edge changes. Callers must already hold the workspace seq lock on P

===================================================================== Helpers ===================================================================== by

callWorkspaceViaOAuth simulates an MCP-driven workspace API call by going through MCPBearerAuth's OAuth path. The MCP transport stub the test harness

clearCSRFCookie removes the CSRF cookie (e.g. on logout). Must clear both prefixed and unprefixed names to handle upgrades cleanly.

computeSSEVisibility resolves the caller's current visibility snapshot. Safe to call repeatedly on a live SSE connection — each call fetches the lates

counterValue is a tiny helper that pulls the float value out of a Prometheus counter.

createChildItem creates a test item and wires it as a child of parentID via SetParentLink — the same path the HTTP handler takes in production (handle

--- create ---

Current pane depth+ownership, read from SvelteKit `page.state`.

* Cursors are decimal-encoded `seq` values as opaque strings — but * "monotonic forward" needs a numeric compare, not lexicographic. * Treat empty /

dialWSSince is the resume-cursor variant: appends `?since=<id>` to the WS URL so the test exercises the TASK-1319 force_refresh path.

doAuthedDeleteWithCSRF issues a DELETE with both the session cookie + the CSRF double-submit pair. The session-cookie code path requires CSRF on every