q rebinds a query to the store's dialect (converts "?" to "$1", "$2", etc. for PostgreSQL).

testStore creates a Store for testing. When PAD_TEST_POSTGRES_URL is set, it creates an isolated PostgreSQL database; otherwise it falls back to a fas

Close shuts down the bus and closes every active subscriber channel. After Close, Subscribe / Publish are undefined; callers must not invoke them.

Join attaches a freshly-upgraded WebSocket connection to the room for itemID. Replays the op-log to the new peer, spins up an inbound reader and an ou

Now returns the SQL expression for the current UTC timestamp. SQLite: datetime('now') PostgreSQL: NOW() AT TIME ZONE 'UTC'

Set replaces the session workspace. Pass an empty string to clear.

Run starts the stdio transport on os.Stdin / os.Stdout. It blocks until ctx is cancelled, stdin reaches EOF, or SIGINT / SIGTERM is received. EOF and

Get returns a ReadCloser positioned at the start of the blob. Callers MUST close the returned reader. If key is unknown to this store, the returned er

writeInternalError logs the real error server-side and sends a generic message to the client. This prevents leaking SQL errors, file paths, and other

createWSWithCollections creates a workspace and returns its slug. The workspace will have default collections seeded automatically.

--- Collection helpers ---

CreateUser creates a new user with a hashed password.

doRequestWithCookie is like doRequest but adds a session cookie.

fixedUserResolver is a tiny helper for the unit tests that need a deterministic user without standing up the auth middleware.

getWorkspaceID resolves workspace slug/ID from the request. If RequireWorkspaceAccess already resolved the workspace, reads from context. Otherwise fa

WithDispatchInput returns ctx decorated with the original MCP tool- call JSON input map. Called from the registry's tool handler before invoking Dispa

Dispatch satisfies the Dispatcher interface. cliArgs are accepted for interface compatibility but ignored — HTTPHandlerDispatcher reads the structured

AddWorkspaceMember adds a user to a workspace with the given role.

Encode writes img to w in the given format ("png" / "jpeg"). JPEG is encoded at quality 85 — small enough for thumbnails, high enough that pixel-level

testServerWithAttachments returns a fresh test server with the attachment registry wired against an FSStore rooted in t.TempDir(), and (on the pure-Go

currentUser returns the authenticated user from the request context, or nil if no user is authenticated.

helper: create an item in a collection and return the parsed Item

GetUser retrieves a user by ID.

2 MiB decodeJSON reads and unmarshals the JSON body into v. Wraps the body in http.MaxBytesReader so an attacker can't exhaust memory by POSTing a mul

PrintJSON prints any value as indented (human-readable) JSON.

Stat returns the size in bytes of the blob identified by key. If key is unknown, the returned error wraps ErrNotFound.

loginTestUser creates a user + session, returns the user + the raw session token suitable for AddCookie.

SetCloudMode enables cloud mode with the shared sidecar secret(s). Accepts a comma-separated list of secrets for rotation support: "new-key,old-key" —

CreateSession generates a random session token, stores its SHA-256 hash, and returns the plaintext token (prefixed with "padsess_"). The plaintext is

requireMinRole checks role and writes a 403 if insufficient. Returns true if the request should continue, false if it was rejected.

CreateAPIToken generates a new API token owned by a user, optionally scoped to a workspace. The plaintext token is returned in the response and is nev

NewWorkspaceState returns a state pre-seeded with `initial`. Pass an empty string to start with no default — the first tool call will then need an exp

Stop waits for all background goroutines started via goAsync to finish AND drains the rate-limiter cleanup goroutines spawned at construction time (BU

oauthEnabledTestServer builds a Server with cloud mode + a real internal/oauth.Server backed by the test store. Returns the Server so each test can dr

===================================================================== Helpers ===================================================================== re

GetBacklinks returns the items in `workspaceID` that contain a resolved `[[...]]` reference to `targetItemID`. Phase 1 only returns ref-kind backlinks

* Soft-delete an attachment by ID. The blob on disk stays put * (content-addressed dedupe means the same hash may still be * referenced) — orpha

doRequestWithHeaders is a thin variant of doRequest that lets a test set arbitrary request headers (e.g. Authorization) without spinning up a real aut

NewMemoryOpBus returns a ready-to-use in-process bus.

NewClientFromURL creates a client from a full base URL (e.g., "https://app.getpad.dev").

visibleCollectionIDs returns the set of collection IDs the current user can see in the given workspace. Returns nil if the user has "all" access (no f

Close shuts down the bus. All subscriber channels are closed under the same write-lock that gates Publish/Subscribe so a final inflight Publish can't

GetUserByEmail retrieves a user by email address (case-insensitive).

realPNG returns a tiny but real PNG (1x1 transparent) so image.DecodeConfig succeeds.

currentUserID returns the authenticated user's ID, or empty string.

auditMeta safely marshals a map to a JSON string for audit log metadata. Falls back to "{}" on marshal error so audit calls never break.

textOf returns the text of the first content block, or empty string. Robust to mcp-go's content-type variations (TextContent, ErrorContent).

requireItemVisible checks that the item's collection is visible to the requesting user. For guests with item-level grants, also verifies that the spec

Build returns a cmdhelp Document without serializing it. Callers that need to inspect or further mutate the document (tests, dynamic enum resolvers in

guestResourceFilter returns the full-collection IDs and granted item IDs for the current user if they need item-level grant filtering. Returns nil/nil

s256Challenge computes the base64url(no-padding, SHA256(verifier)) per RFC 7636 §4.2. PKCE clients use this to derive code_challenge from code_verifie

Decode reads bytes from r and returns the decoded image plus the detected format ("png", "jpeg", "gif", "bmp", "tiff", …). The returned format is the

helper: fetch the dashboard and return the parsed response

NewRoomManager wires the store + bus together with production defaults.

readCSRFFromCookie hits any consent-rendering endpoint that sets the CSRF cookie on first visit, returns the token. We use oauth/authorize because it'

ItemRef returns the reference string (e.g. "TASK-5") for an item, or empty string.