testStore creates a Store for testing. When PAD_TEST_POSTGRES_URL is set, it creates an isolated PostgreSQL database; otherwise it falls back to a fas

q rebinds a query to the store's dialect (converts "?" to "$1", "$2", etc. for PostgreSQL).

Close shuts down the bus and closes every active subscriber channel. After Close, Subscribe / Publish are undefined; callers must not invoke them.

Join attaches a freshly-upgraded WebSocket connection to the room for itemID. Replays the op-log to the new peer, spins up an inbound reader and an ou

Now returns the SQL expression for the current UTC timestamp. SQLite: datetime('now') PostgreSQL: NOW() AT TIME ZONE 'UTC'

Set replaces the session workspace. Pass an empty string to clear.

Run starts the stdio transport on os.Stdin / os.Stdout. It blocks until ctx is cancelled, stdin reaches EOF, or SIGINT / SIGTERM is received. EOF and

--- Collection helpers ---

Get returns a ReadCloser positioned at the start of the blob. Callers MUST close the returned reader. If key is unknown to this store, the returned er

createWSWithCollections creates a workspace and returns its slug. The workspace will have default collections seeded automatically.

writeInternalError logs the real error server-side and sends a generic message to the client. This prevents leaking SQL errors, file paths, and other

CreateUser creates a new user with a hashed password.

AddWorkspaceMember adds a user to a workspace with the given role.

doRequestWithCookie is like doRequest but adds a session cookie.

fixedUserResolver is a tiny helper for the unit tests that need a deterministic user without standing up the auth middleware.

testServerWithAttachments returns a fresh test server with the attachment registry wired against an FSStore rooted in t.TempDir(), and (on the pure-Go

getWorkspaceID resolves workspace slug/ID from the request. If RequireWorkspaceAccess already resolved the workspace, reads from context. Otherwise fa

WithDispatchInput returns ctx decorated with the original MCP tool- call JSON input map. Called from the registry's tool handler before invoking Dispa

Dispatch satisfies the Dispatcher interface. cliArgs are accepted for interface compatibility but ignored — HTTPHandlerDispatcher reads the structured

Encode writes img to w in the given format ("png" / "jpeg"). JPEG is encoded at quality 85 — small enough for thumbnails, high enough that pixel-level

helper: create an item in a collection and return the parsed Item

currentUser returns the authenticated user from the request context, or nil if no user is authenticated.

ok issues the preflight as the owner and requires a 200.

GetUser retrieves a user by ID.

NewMemoryOpBus returns a ready-to-use in-process bus.

PrintJSON prints any value as indented (human-readable) JSON.

2 MiB decodeJSON reads and unmarshals the JSON body into v. Wraps the body in http.MaxBytesReader so an attacker can't exhaust memory by POSTing a mul

Close shuts down the bus. All subscriber channels are closed under the same write-lock that gates Publish/Subscribe so a final inflight Publish can't

Stat returns the size in bytes of the blob identified by key. If key is unknown, the returned error wraps ErrNotFound.

Stop waits for all background goroutines started via goAsync to finish AND drains the rate-limiter cleanup goroutines spawned at construction time (BU

loginTestUser creates a user + session, returns the user + the raw session token suitable for AddCookie.

CreateSession generates a random session token, stores its SHA-256 hash, and returns the plaintext token (prefixed with "padsess_"). The plaintext is

SetCloudMode enables cloud mode with the shared sidecar secret(s). Accepts a comma-separated list of secrets for rotation support: "new-key,old-key" —

NewRoomManager wires the store + bus together with production defaults.

CreateAPIToken generates a new API token owned by a user, optionally scoped to a workspace. The plaintext token is returned in the response and is nev

* Soft-delete an attachment by ID. The blob on disk stays put * (content-addressed dedupe means the same hash may still be * referenced) — orpha

* Open the confirmation and resolve when the user answers — the descriptor's * `ctx.confirmDelete`. A no-op that resolves false when the caller may

requireMinRole checks role and writes a 403 if insufficient. Returns true if the request should continue, false if it was rejected.

NewWorkspaceState returns a state pre-seeded with `initial`. Pass an empty string to start with no default — the first tool call will then need an exp

realPNG returns a tiny but real PNG (1x1 transparent) so image.DecodeConfig succeeds.

oauthEnabledTestServer builds a Server with cloud mode + a real internal/oauth.Server backed by the test store. Returns the Server so each test can dr

===================================================================== Helpers ===================================================================== re

GetBacklinks returns the items in `workspaceID` that contain a resolved `[[...]]` reference to `targetItemID`. Phase 1 only returns ref-kind backlinks

SetMemberCollectionAccess updates a member's collection_access mode and replaces their specific collection grants atomically.

--- Item Grants --- CreateItemGrant creates a direct grant on an item for a user.

doRequestWithHeaders is a thin variant of doRequest that lets a test set arbitrary request headers (e.g. Authorization) without spinning up a real aut

NewClientFromURL creates a client from a full base URL (e.g., "https://app.getpad.dev").

newCollabTestServer wires up an httptest server whose only handler upgrades the inbound WS, registers it with the manager, and waits for the session t

visibleCollectionIDs returns the set of collection IDs the current user can see in the given workspace. Returns nil if the user has "all" access (no f

currentUserID returns the authenticated user's ID, or empty string.

DeleteItem soft-deletes the item by stamping deleted_at and bumping the workspace-scoped seq so delta-sync clients see the tombstone. The seq bump use

GetUserByEmail retrieves a user by email address (case-insensitive).

Close stops every active room AND blocks until every in-flight Join goroutine has returned. After Close, Join is undefined — callers must coordinate s

DB returns the underlying *sql.DB (for use in migrations/testing).

req builds a request from A to B with the standard actor.