* Drop the lease. `released` is false on a repeat call (no-op). `stackEmpty` * reports whether any lease remains AFTER this release — the caller use

testServerWithCollab wires a RoomManager onto a fresh test server so the collab handler answers 200/101 on the happy path. Tests that only assert on a

testServerWithPresence gives a server both the watch bus and the presence registry — the production pairing (cmd_server.go wires them on adjacent line

Tests for the OAuth server constructor + audience strategy + storage adapter (PLAN-943 TASK-951 sub-PR B). Each layer is covered: - NewServer: requir

Add implements SessionPresence. Returns the generated id even when the Redis write fails. That is deliberate and it is the same posture the rest of t

============================================================ Access tokens (handler/oauth2/storage.go AccessTokenStorage) ============================

GetPlatformSetting returns a single platform setting value, or empty string if not set.

NewProcessor returns the Processor compiled into this binary. Pure-Go build → pureGoProcessor. libvips build → vipsProcessor (Phase 2). Constructed o

NewRedisSessionPresence returns a shared registry backed by client. The client is the SAME one the watch bus uses (cmd/pad/cmd_server.go dials once o

SetObserver attaches an Observer. Passing nil detaches. Safe to call after the bus is running; cmd/pad/cmd_server.go calls it at wiring time.

SetSessionPresence attaches the live-session registry read by GET /api/v1/sessions and written by GET /api/v1/events/stream (PLAN-2558 S1). Nil-checke

SetUserPlan updates a user's billing plan.

SetWatchEventsBus attaches the watch/nudge notification bus consumed by GET /api/v1/events/stream (TASK-2533). Nil-checked by every producer and by th

WithTokenAllowedWorkspaces returns ctx decorated with the OAuth token's workspace allow-list set at consent time (TASK-952). The list is either a set

fanOutFromRedis is the receive path: a message that arrived on the subscription identified by gen, carrying the ID space it belongs to. A zero epoch

getAsset issues GET on the asset endpoint. rawQuery is appended verbatim (already URL-formed, no leading '?').

getOnlyAttachmentID returns the ID of the single live attachment row in a workspace — the test infrastructure uploads at most one blob per call, so th

setContent overwrites an item's markdown body.

Add implements SessionPresence.

CreateShareLink creates a new share link and returns it with the raw token. The raw token is only available in this response — it is not stored.

GetItemIncludeDeleted finds an item by id including soft-deleted items. Used by code paths that need to act on records the user already owns even thou

IsConfigured reports whether the client has an explicit global connection configuration, either from config.toml or an environment/flag override.

JSONExtractText returns SQL to extract a text value from a JSON column. SQLite: json_extract(col, '$.key') PostgreSQL: col->>'key'

MigrateFields maps field values from a source schema to a target schema. Fields with matching keys and compatible types are transferred. Incompatible

ParseCollectionTraits decodes a stored traits JSON blob. An empty or "null" blob yields the zero value with no error — a collection that declares no t

RestoreItem un-archives a soft-deleted item and bumps the workspace-scoped seq so delta-sync clients re-materialize the row. Same lock + subquery shap

SeedDefaultCollections rescues a workspace that ended up with zero collections by seeding it with the standard Software-shape Defaults(). It is intent

cycleIfIdle ends this instance's coverage and replaces its subscription when nothing has arrived for the idle timeout. DROP-AND-CYCLE, NOT DROP ALONE

decodePayload parses the "<epoch>|<id>|<json>" wire form publishScript emits, and ALSO accepts a bare JSON body with no prefix. THE BARE FORM IS NOT

postFormWithCookie POSTs an x-www-form-urlencoded body with both a session cookie and the matching CSRF cookie set, plus the session-bound User-Agent.

postOAuthForm POSTs an x-www-form-urlencoded body without any auth (used for /oauth/revoke + /oauth/token, where client_id rides in the form for publi

runAuthCodeFlow drives a full /oauth/authorize/decide → /oauth/token exchange and returns the parsed token JSON. Each invocation needs a unique verifi

seedParentAndChildren creates a plan + N child tasks with the given statuses (one per child), returning the parent and the slice of child refs in crea

waitElectable polls until the room for itemID has at least n conns that pickApplier would actually elect — writable, anchored (replayDone), not frozen

writeOutboxTx appends one canonical event to the outbox on the caller's transaction. Two rejections, both deliberately hard errors that fail the encl

Apply walks doc and stamps EnumSource + resolved Enum values on matching args and flags. Resolution failures are silent: the document continues to adv

CrossWorkspaceWorkspaceOnlyScope requests a WORKSPACE-LEVEL CHECK ONLY, which is almost never sufficient on its own. It answers "does this caller hav

GetItemLinks returns links where the given item is either source or target. Links pointing to or from soft-deleted items are filtered out so callers (

MoveItem moves an item to a different collection within the same workspace. It updates the collection_id and fields JSON. The item_number is preserved

NewStorage wraps a *store.Store as a fosite-compatible adapter. The store must be a fully-initialized pad store (migrations applied); no validation he

SetEventBus attaches an event bus for real-time SSE streaming.

SetSSELimits configures the streaming connection limits. A value of 0 means unlimited for any of them. `global` and `perUser` bound BOTH stream endpo

SubscribeAndReplaySince atomically checks the per-workspace limit, registers the subscriber, and captures the buffered events above sinceID — all in O

append adds an event to the ring buffer, evicting the oldest if full.

copyOK issues the copy as the owner and requires a 201.

dialCollab opens a WebSocket against the test server's collab endpoint with the given itemID. Returns the connection and the HTTP response. The respon

doRequestWithBearer dispatches a request with an Authorization: Bearer header set. The existing test helpers in server_test.go don't take a token para

executeRequest builds + serves + packages a single HTTP request against the wrapped handler. Pulled out of Dispatch so the special-case methods (dispa

getSource performs GET on the source item exactly as the router would and requires a 200. Use rawGetSource when the status is what is under test.

===================================================================== mcp ↔ OAuth integration (sub-PR E, TASK-1027) ==================================

mcpEnabledTestServer builds a Server with cloud mode + a stub streamable-HTTP transport so tests targeting auth / discovery / routing don't need to dr

mustList reads a registry's session list, failing the test if the read itself failed. ListForUser gained an error when an out-of-process implementati

outboxPayloadFor returns the decoded payload of the single event of the given type for an item, failing if there is not exactly one.

requireRole checks if the user's workspace role meets the minimum required level. Role hierarchy: owner > editor > viewer.

runOrphanGCSweep walks the orphaned-attachments query and reclaims rows past the grace period. Two reclamation paths: - DB row only. content_hash is

setupPushTest mirrors setupItemOpenTest (item_open_test.go): points getClient()/getWorkspace() at a fake httptest server via the same urlFlag/workspac

waitFor polls until cond holds or the deadline passes. Delivery crosses a goroutine and a socket, so a bare read after Publish is a race.

wedge simulates the failure this whole unit exists to detect: the outbound probe keeps SUCCEEDING and nothing ever comes back. It has to be simulated

workspaceRole returns the user's role in the current workspace, as set by RequireWorkspaceAccess. Returns empty string if not set.

writeItemResolveError distinguishes a soft-deleted (archived) item from a genuinely-missing one for mutation handlers. An archived item still appears

BackfillOAuthConnections walks every distinct grant chain found in oauth_access_tokens and oauth_refresh_tokens, parses the newest chain row's session

EnsureServer checks if the pad server is running; if not, starts it in the background.

GetCrossWorkspaceBacklinks returns inbound `[[ws::REF]]` backlinks pointing at the queried target (`targetWorkspaceID`, `targetRef`) from EVERY OTHER

InsertMCPAuditEntry persists one audit row. Called from the audit middleware's async writer; the caller owns the buffered channel + the ordering, so t

NewRedisBusWithKeys is NewRedisBus with an explicit key namespace (BUG-2724). cmd/pad/cmd_server.go uses this one, passing the value shared with the w

NewRegistry returns an empty registry.

NormalizeItemLinkType canonicalizes supported link types and returns an error for unknown values.

SetWorkspaceTool returns the (Tool, Handler) pair for the built-in pad_set_workspace tool. The handler updates state in place. Exposed as a construct

Start begins probing in the background. It runs one probe SYNCHRONOUSLY before returning, so a server that has finished starting has a real answer rat

UpdateItemWithParentLink is UpdateItemWithPreCheck plus an OPTIONAL parent-link mutation applied inside the same transaction (BUG-2013). When parentLi

ValidateSession hashes the provided token, looks it up, checks expiry, and returns the session info including the associated user and binding metadata

WithTokenScopes returns ctx decorated with the API token's JSON-encoded scopes string (e.g. `["read"]`, `["*"]`). Stashed by the MCP Bearer middleware

acquireWorkspaceSeqLock takes a Postgres advisory transaction lock keyed on the workspace ID so concurrent seq-bumping mutations serialize. The lock a

bootstrapAccountDeleteUser creates the first admin user, sets a Stripe customer ID on them, and returns (userID, sessionToken). Used by the handleDele

deleteAccountReq issues the delete-account request from a client IP that differs from the loopback address bootstrap ran on. The session-IP-change mid

downloadAs issues GET or HEAD on the blob endpoint as a specific user + workspace role, bypassing the auth middleware the same way deleteAsUser does.

Run a flush immediately for the given `markdown` + `ctx`, applying the * full recovery/dedupe gauntlet before the injected PATCH. Used by the *

goAsync spawns fn in a goroutine that's tracked by s.bg, so Stop() can wait for in-flight background work to finish. Use this for any fire-and-forget

isolateHome redirects HOME to a temp dir and chdirs to a fresh temp project dir so credential writes and .pad.toml detection don't leak into the real

--- reconciliation on the receive path --------------------------------- liveGen subscribes the workspace and returns the generation a real receive lo

mustSeedWorkspaceWithRole is a test helper that creates a workspace + adds the user as a member with the given role. Centralized here because TASK-952

Tests for the OAuth 2.1 storage layer (PLAN-943 TASK-951 sub-PR A). The store layer is fosite-agnostic by design — sub-PR B introduces the fosite impo

passThrough returns an ActionFn that forwards the input verbatim to the given cmdPath via env.Dispatch. The vast majority of catalog actions use this