Driver returns the driver type.

textOf returns the text of the first content block, or empty string. Robust to mcp-go's content-type variations (TextContent, ErrorContent).

auditMeta safely marshals a map to a JSON string for audit log metadata. Falls back to "{}" on marshal error so audit calls never break.

requireItemVisible checks that the item's collection is visible to the requesting user. For guests with item-level grants, also verifies that the spec

CreateAttachment inserts an attachment row. id and created_at are generated by the store. The caller is expected to have already written the blob via

Decode reads bytes from r and returns the decoded image plus the detected format ("png", "jpeg", "gif", "bmp", "tiff", …). The returned format is the

guestResourceFilter returns the full-collection IDs and granted item IDs for the current user if they need item-level grant filtering. Returns nil/nil

Build returns a cmdhelp Document without serializing it. Callers that need to inspect or further mutate the document (tests, dynamic enum resolvers in

Rebind converts a query with "?" placeholders to the dialect's format. For SQLite this is a no-op. For PostgreSQL, "?" becomes "$1", "$2", etc.

runItemCopy is the whole command, minus flag binding. Order of operations is load-bearing: 1. Build the request (the SAME body both endpoints take).

s256Challenge computes the base64url(no-padding, SHA256(verifier)) per RFC 7636 §4.2. PKCE clients use this to derive code_challenge from code_verifie

helper: fetch the dashboard and return the parsed response

ItemRef returns the reference string (e.g. "TASK-5") for an item, or empty string.

Set adds or replaces the credential for the given server URL. The canonical URL is mirrored into the value's ServerURL field so a caller reading the c

isCollectionVisible checks if a collection ID is in the visible set. If visibleIDs is nil, all collections are visible.

readCSRFFromCookie hits any consent-rendering endpoint that sets the CSRF cookie on first visit, returns the token. We use oauth/authorize because it'

liveCmdhelpDoc returns a minimal cmdhelp.Document with every command path the read-only catalog references. Lighter than re-running pad's full cobra e

refOf builds a PREFIX-NUMBER string from a fresh item — used by the integration tests since the canonical ref isn't on the model directly. ItemNumber

GetWorkspaceMember retrieves a single membership record.

errorHandler fails the test if invoked. Used to assert that a code path doesn't hit the handler at all.

--- Item Links ---

--- Phase Links --- SetParentLink sets the parent for an item. Since an item can belong to at most one parent, this deletes any existing parent link f

attach creates an original attachment in ws and returns it.

GetAttachment returns the attachment with the given id, or (nil, nil) if no such row exists. Soft-deleted rows ARE returned (so download handlers can

New creates a new Metrics instance with a custom registry and registers all application metrics plus Go runtime and process collectors.

call issues the preflight exactly as the router would, with the caller's auth surface described by o. The workspace-A role and resolved ID are stashed

resolvableBody is a request the copy can actually satisfy: the two needs_value entries the base fixture leaves open are supplied, so the preflight com

AuthorizeCrossWorkspaceEdit decides whether the caller may WRITE the scoped resource in a workspace OTHER than the request's own. It runs every step

New creates a new in-memory EventBus with default replay buffer settings.

cloudAdminReq is a small helper that builds a request with optional JSON body and the caller-chosen headers.

* Claim what is now on screen. Recording a token whose key is null (an * un-addressable view) correctly claims nothing.

BoolToInt converts a Go bool to a query parameter value. SQLite: 0/1 (integers) PostgreSQL: true/false (native booleans)

--- Collection Grants --- CreateCollectionGrant creates a direct grant on a collection for a user.

New creates a Store backed by SQLite at the given path. The DSN is configured for safe concurrent use under Go's connection pool: - `_pragma=busy_ti

Exported context-key helpers for callers that need to synthesize an authenticated request without going through the auth middleware chain (e.g. the in

actorFromRequest derives actor and source from the request's auth context. Actor is "user" or "agent" (determined by X-Pad-Agent header). Source is "w

doAuthedRequest is like doRequest but with a session cookie + the matching User-Agent attached (SessionAuth UA-binding, see middleware_auth.go:186).

emptyPreflight is the everything-is-zero case. Its whole job is to prove "nothing to report" renders as an explicit zero rather than as silence.

CrossWorkspaceItemScope scopes the check to one already-loaded item. Collection visibility is checked first and item-level grants second, in that orde

Resolve returns the store responsible for key, or an error if no matching backend is registered. The key format is "<prefix>:<rest>".

IsEmailVerified returns true if the user's email address has been verified. Mirrors IsDisabled: a non-empty EmailVerifiedAt timestamp means verified,

classifyHTTPStatus is the legacy entry point preserved for callers that don't know their resource kind. New callers should use classifyHTTPStatusKind

AuthorizeCrossWorkspaceRead decides whether the caller may READ the scoped resource in a workspace OTHER than the request's own. workspaceSlugOrID ma

BuildCLIArgs translates an MCP tool call's JSON arguments into the CLI argument list that should be appended after the command path. Pure function — n

CrossWorkspaceCollectionScope scopes the check to one collection — creating into it, or disclosing its schema. Visibility here is FULL-collection-acc

GetTemplate returns the workspace template with the given name, or nil if no template with that name exists.

NewErrorResult packages an ErrorPayload as an MCP CallToolResult with IsError=true. Both the JSON envelope and a human-readable summary are returned:

buildSyntheticTree returns a small cobra tree exercising the shapes the emitter has to handle: subgroups, leaf commands with positional args, flags of

requireEditPermission checks if the user has edit access to the given item. For regular members (editor/owner), this uses the standard role check. For

BaseURL returns the configured base URL.

Close shuts the bus down, closing every subscriber channel.

CopyItemAcrossWorkspaces copies one item from its workspace into another, atomically. THE LOCK ORDER. Changed only deliberately, and stated here beca

============================================================ Clients (RFC 7591 — Dynamic Client Registration) ========================================

NewSession constructs a Session with the given subject (pad user ID). Returns a non-nil DefaultSession so the embedded methods don't panic on a zero-v

isBearerAuth reports whether the request was authenticated via an Authorization: Bearer header rather than a browser session cookie. True for: PATs on

logAuditEvent logs a non-workspace audit event (e.g. login, logout). Best-effort: errors are silently ignored.

workspaceIDForSlug looks up the internal UUID for a slug — used by tests that synthesize attachment rows directly via the store (bypassing the upload

CreateOAuthConnection inserts a new connection row. Idempotent in the sense that callers should INSERT once per /authorize/decide; if the same request

LoadStore reads the credentials file and returns a usable CredentialStore. Returns an empty (but non-nil) store if the file doesn't exist — that's not

ResolveItem looks up an item by UUID, PREFIX-NUMBER ref (e.g. "IDEA-15"), or slug. UUID is tried first, then ref, then slug.

ResolveItemIncludeDeleted is like ResolveItem but includes soft-deleted items.

UserCount returns the total number of registered users.

ValidateFields checks field values against the collection schema. It validates required fields are present, types are correct, and select values are w

equalSlice is a small helper for stable []string comparison; kept here so test files across the package can share it. catalog_test.go has equalString

setupWatchTestUser seeds a workspace + item, mints a real user + user-scoped Bearer token (mirrors handlers_stars_test.go's pattern), and returns ever

───────────────────────────────────────────────────────────────────── Helpers for non-HTTP error paths (TASK-1077 — replace plain-string NewToolResult