testStore creates a Store for testing. When PAD_TEST_POSTGRES_URL is set, it creates an isolated PostgreSQL database; otherwise it falls back to a fas

Close shuts down the bus and closes every active subscriber channel. After Close, Subscribe / Publish are undefined; callers must not invoke them.

q rebinds a query to the store's dialect (converts "?" to "$1", "$2", etc. for PostgreSQL).

Now returns the SQL expression for the current UTC timestamp. SQLite: datetime('now') PostgreSQL: NOW() AT TIME ZONE 'UTC'

Run starts the stdio transport on os.Stdin / os.Stdout. It blocks until ctx is cancelled, stdin reaches EOF, or SIGINT / SIGTERM is received. EOF and

Join attaches a freshly-upgraded WebSocket connection to the room for itemID. Replays the op-log to the new peer, spins up an inbound reader and an ou

Add registers a newly-opened stream for userID and returns the session's generated id, which the caller MUST pass to Remove. The identity is whatever

Set replaces the session workspace. Pass an empty string to clear.

--- Collection helpers ---

Get returns a ReadCloser positioned at the start of the blob. Callers MUST close the returned reader. If key is unknown to this store, the returned er

createWSWithCollections creates a workspace and returns its slug. The workspace will have default collections seeded automatically.

CreateUser creates a new user with a hashed password.

writeInternalError logs the real error server-side and sends a generic message to the client. This prevents leaking SQL errors, file paths, and other

AddWorkspaceMember adds a user to a workspace with the given role. Transactional as of TASK-2658 — it was a bare Exec before. The membership row and

testServerWithAttachments returns a fresh test server with the attachment registry wired against an FSStore rooted in t.TempDir(), and (on the pure-Go

doRequestWithCookie is like doRequest but adds a session cookie.

WithDispatchInput returns ctx decorated with the original MCP tool- call JSON input map. Called from the registry's tool handler before invoking Dispa

Encode writes img to w in the given format ("png" / "jpeg"). JPEG is encoded at quality 85 — small enough for thumbnails, high enough that pixel-level

fixedUserResolver is a tiny helper for the unit tests that need a deterministic user without standing up the auth middleware.

Dispatch satisfies the Dispatcher interface. cliArgs are accepted for interface compatibility but ignored — HTTPHandlerDispatcher reads the structured

getWorkspaceID resolves workspace slug/ID from the request. If RequireWorkspaceAccess already resolved the workspace, reads from context. Otherwise fa

Addr returns the host:port listen address.

Stat returns the size in bytes of the blob identified by key. If key is unknown, the returned error wraps ErrNotFound.

ok issues the preflight as the owner and requires a 200.

Name returns the full Redis key or channel name for a suffix. The suffix is the historical name minus the "pad:" root — "event_seq", "watchevents", "e

helper: create an item in a collection and return the parsed Item

Close shuts down the event bus and cleans up resources.

currentUser returns the authenticated user from the request context, or nil if no user is authenticated.

Close shuts the bus down, closing every subscriber channel.

Unsubscribe removes a subscriber and closes its channel.

2 MiB decodeJSON reads and unmarshals the JSON body into v. Wraps the body in http.MaxBytesReader so an attacker can't exhaust memory by POSTing a mul

now reads the bus's clock. The seam is nil in production; tests set it so a 90s threshold can be crossed without sleeping through one.

setupWatchTestUser seeds a workspace + item, mints a real user + user-scoped Bearer token (mirrors handlers_stars_test.go's pattern), and returns ever

PrintJSON prints any value as indented (human-readable) JSON.

Stop waits for all background goroutines started via goAsync to finish AND drains the rate-limiter cleanup goroutines spawned at construction time (BU

GetUser retrieves a user by ID.

Subscribe returns a channel that receives every future Notification, with NO replay. There is exactly one logical stream (unlike internal/events.Event

NewMemoryOpBus returns a ready-to-use in-process bus.

* Soft-delete an attachment by ID. The blob on disk stays put * (content-addressed dedupe means the same hash may still be * referenced) — orpha

Close shuts down the bus. All subscriber channels are closed under the same write-lock that gates Publish/Subscribe so a final inflight Publish can't

Subscribe registers a new subscriber for the given workspace and returns its event channel and its GAP SIGNAL — see SubscribeIfAllowed for what the se

SetCloudMode enables cloud mode with the shared sidecar secret(s). Accepts a comma-separated list of secrets for rotation support: "new-key,old-key" —

loginTestUser creates a user + session, returns the user + the raw session token suitable for AddCookie.

CreateAPIToken generates a new API token owned by a user, optionally scoped to a workspace. The plaintext token is returned in the response and is nev

New creates a new in-memory EventBus with default replay buffer settings.

NewClientFromURL creates a client from a full base URL (e.g., "https://app.getpad.dev").

Publish assigns the Notification a monotonic ID, stores it in the replay buffer, and fans it out to every live Subscribe channel. ID assignment and bu

CreateSession generates a random session token, stores its SHA-256 hash, and returns the plaintext token (prefixed with "padsess_"). The plaintext is

realPNG returns a tiny but real PNG (1x1 transparent) so image.DecodeConfig succeeds.

Driver returns the driver type.

EventsSince returns events for a workspace with IDs greater than sinceID. Used to replay missed events on SSE reconnect (Last-Event-ID). Returns nil

NewRoomManager wires the store + bus together with production defaults.

Publish sends an event to all subscribers for the event's workspace.

textOf returns the text of the first content block, or empty string. Robust to mcp-go's content-type variations (TextContent, ErrorContent).

NewWorkspaceState returns a state pre-seeded with `initial`. Pass an empty string to start with no default — the first tool call will then need an exp