writeItemResolveError distinguishes a soft-deleted (archived) item from a genuinely-missing one for mutation handlers. An archived item still appears

AddConnectionWorkspace inserts a (request_id, workspace_id) row in the allow-list join table. Idempotent: re-adding an existing pair is a no-op (INSER

EnsureServer checks if the pad server is running; if not, starts it in the background.

ExtractWikiLinks scans `content` for [[...]] occurrences OUTSIDE any fenced or inline code region, parses each into a WikiLinkRef, and returns them in

ForceRefreshRoom makes items.content the canonical source for an item's collab state: it runs `commit` under the per-item lock (so the caller can atom

GetOAuthConnectionAccess is the hot-path projection used by the MCP introspection middleware. Runs at most two cheap indexed queries (one PK lookup, o

MoveItem moves an item to a different collection within the same workspace. It updates the collection_id and fields JSON. The item_number is preserved

NewRegistry returns an empty registry.

SetWorkspaceTool returns the (Tool, Handler) pair for the built-in pad_set_workspace tool. The handler updates state in place. Exposed as a construct

Subscribe registers a new subscriber for the given workspace. Returns a buffered channel that will receive events for that workspace.

SubscriberCount returns the number of active subscribers whose itemID matches. Used by the room manager to decide when the active peer count has dropp

ValidateUpload combines the sniff result, the client-supplied MIME header, and the filename's extension to produce one of: - (entry, "", nil) — accep

WithTokenScopes returns ctx decorated with the API token's JSON-encoded scopes string (e.g. `["read"]`, `["*"]`). Stashed by the MCP Bearer middleware

checkItemVisible is the context-free visibility decision. Returns (true, nil) when the (user, role) pair can see `item` under the same rules `requireI

childLinkTypeSQL returns a SQL IN clause fragment like "'parent','implements'" for filtering item_links by child relationship types.

collectionSchemaJSONFromFlags resolves the --schema and --fields flags into a marshaled CollectionSchema JSON string. Exactly one of schemaInput or f

Mutation-endpoint tests for /api/v1/connected-apps/{id}/... routes (PLAN-1519 / TASK-1524 / IDEA-1517 §3). What's covered (per endpoint): - PATCH /n

getOnlyAttachmentID returns the ID of the single live attachment row in a workspace — the test infrastructure uploads at most one blob per call, so th

mcpEnabledTestServer builds a Server with cloud mode + a stub streamable-HTTP transport so tests targeting auth / discovery / routing don't need to dr

movedTo parses the response and returns the moved_to block. It also asserts the disclosure rule's negative half: when the block is absent the KEY must

newTestConfig points DataDir at a fresh tmp dir and BrowserURL at the given test server. Most tests want both wired up together.

runHelp invokes the help command with the given args and returns (stdout, stderr, error).

CopyItem performs the MUTATING cross-workspace copy. NEVER RETRY THIS CALL (DR-13). See the file header for the four mechanisms that enforce it. On f

CreateActivityDebounced creates a new activity or updates an existing one if a matching activity (same document, same user, same action) was recorded

DeriveClaimCode produces the 6-digit code for the given (user, workspace) at the given wall-clock time. Exported so the Phase E "Connect project" moda

GetOAuthClient looks up a registered client by ID. Returns ErrOAuthNotFound if no row matches.

MigrateFields maps field values from a source schema to a target schema. Fields with matching keys and compatible types are transferred. Incompatible

New creates a MemoryBus with the default replay buffer size.

NewFetcher returns a Fetcher with production defaults applied.

RestoreItem un-archives a soft-deleted item and bumps the workspace-scoped seq so delta-sync clients re-materialize the row. Same lock + subquery shap

Save writes the persisted Pad config to disk.

SetEncryptionKey configures the store's AES-256 encryption key for encrypting sensitive fields (e.g., TOTP secrets) at rest. The key must be exactly 3

--- TOTP 2FA --- SetTOTPSecret stores the TOTP secret for a user (before 2FA is verified). The secret is encrypted at rest if an encryption key is con

StarItem stars an item for a user. Idempotent — re-starring is a no-op.

Unsubscribe removes a subscriber and closes its channel.

── test helpers ── callToolRequest builds an mcp.CallToolRequest with the given input arguments — the public constructor isn't exposed by mcp-go so we

containsToolText looks for substr in any TextContent block of res. MCP results can carry multiple content blocks; checking all of them keeps the asser

contextWithWorkspaceRoleForTest / contextWithResolvedWorkspaceIDForTest stash the two values RequireWorkspaceAccess populates for the REQUEST's worksp

helper: create a "blocks" link from source to target

dest creates a destination item in ws and returns it.

makeFanOutHandler returns the ToolHandlerFunc that mcp-go invokes when the tool is called. Reads `action` from the input, looks up the handler, and fo

makeTestImage returns a freshly-allocated NRGBA image filled with a distinguishable pattern so transformation tests can assert on specific pixels. Wid

mustParseQueryFromPath extracts the query-string portion of path and parses it. Test-only — fails the test on malformed input.

newCopyTestClient points a Client at ts with a HOME that has no saved credentials, so the test never picks up the developer's real token.

newHTTPResourceFetcher wires an HTTPResourceFetcher over a test mux with a fixed authenticated user, mirroring the dispatch_http_*_test.go setup. The

newPadServer stands up the same *server.Server that production uses, wired to a fast fixture SQLite store (storetest.NewSQLite, IDEA-1914). Mirrors te

AddPadEntry reads (or creates) the JSON config at path, ensures mcpServers.pad points to `binary`, and writes the file back. Existing entries outside

Decode parses an artifact's portable on-disk form back into an Artifact. It splits a leading "---\n ... \n---" frontmatter block from the body, unmar

Delete removes the blob identified by key. Deleting a missing key is NOT an error — callers (e.g. the orphan GC) treat it as the success case.

DeleteCollection soft-deletes a collection by id. When expectedUpdatedAt is non-empty it opts into optimistic-concurrency control (BUG-2265): the row'

DetectWorkspace walks up the directory tree from cwd looking for .pad.toml.

Dispatch sends the event payload to all matching active webhooks for the workspace. Each delivery runs in its own goroutine so the caller is never blo

EventsSince returns events for a workspace with IDs greater than sinceID. Used to replay missed events on SSE reconnect (Last-Event-ID). Returns nil i

ListUserOAuthConnections returns every OAuth connection the user has active. "Active" means at least one access OR refresh token in the chain still ha

Register installs store under prefix (e.g. "fs", "s3"). The prefix MUST NOT contain a colon — Resolve splits keys on the first colon, so a prefix with

RunBrowserBootstrap walks the operator through the browser-based first- admin bootstrap. Returns nil on success (server has flipped to setup_required:

SetPlatformSetting upserts a platform setting.

WorkspaceAttachments lists original (non-derived) attachments in a workspace, with optional filtering + sorting + pagination. Returns the page rows an

appendToCatalog inserts def into Catalog. Called from catalog_<resource>.go init() functions. Keep this small + simple; validation happens at Register

configureBootstrapToken seeds a known token on the server so tests don't depend on the random generator. The on-disk file is created in a temp dir so

connectSSE connects to the SSE endpoint on a real test server and returns a channel of parsed events. Cancel the context to disconnect.

createBulkTestItem creates a task and returns it.

createTestWorkspace creates a workspace via API and returns its slug.

decrypt decrypts a value that was encrypted with encrypt(). If the value doesn't have the "enc:" prefix, it's treated as plaintext (backward compatibi

dispatchWebhook fires a webhook event if a dispatcher is configured.

doArtifactRequest posts a raw (non-JSON) body to an artifact-import endpoint.

filterAttention returns attention items of a given type.

helper: fetch the workspace graph and return the parsed response

Supersede every outstanding token without taking a new one.

mapItemCreate translates an `item create` MCP call into a POST to api/v1/workspaces/{ws}/collections/{coll}/items. The MCP tool schema (auto-generate

BackfillOAuthConnections tests (PLAN-1519 / TASK-1522 / IDEA-1517 §2). What's covered: - Pre-TASK-952 session (no key) → all_current=1, no

OAuth connection store tests (PLAN-1519 / TASK-1520 — Phase A foundation). What's covered: - CreateOAuthConnection + GetOAuthConnection round-trip w

newTestRequest builds an OAuthRequest with sensible defaults; tests override fields they care about. signature uniqueness is the caller's responsibili

Blob-read authorization tests for PLAN-2391 / TASK-2401 (BUG-2386). handleGetAttachment used to open with a flat requireMinRole("viewer"). roleLevel(

renderMD is a small test helper that builds + renders the synthetic tree with a fixed clock and returns the markdown output as a string.