testStore creates a Store for testing. When PAD_TEST_POSTGRES_URL is set, it creates an isolated PostgreSQL database; otherwise it falls back to a fas

Close shuts down the bus and closes every active subscriber channel. After Close, Subscribe / Publish are undefined; callers must not invoke them.

q rebinds a query to the store's dialect (converts "?" to "$1", "$2", etc. for PostgreSQL).

Run starts the stdio transport on os.Stdin / os.Stdout. It blocks until ctx is cancelled, stdin reaches EOF, or SIGINT / SIGTERM is received. EOF and

Join attaches a freshly-upgraded WebSocket connection to the room for itemID. Replays the op-log to the new peer, spins up an inbound reader and an ou

Now returns the SQL expression for the current UTC timestamp. SQLite: datetime('now') PostgreSQL: NOW() AT TIME ZONE 'UTC'

Add registers a newly-opened stream for userID and returns the session's generated id, which the caller MUST pass to Remove. The identity is whatever

Set replaces the session workspace. Pass an empty string to clear.

--- Collection helpers ---

createWSWithCollections creates a workspace and returns its slug. The workspace will have default collections seeded automatically.

Get returns a ReadCloser positioned at the start of the blob. Callers MUST close the returned reader. If key is unknown to this store, the returned er

CreateUser creates a new user with a hashed password.

AddWorkspaceMember adds a user to a workspace with the given role. Transactional as of TASK-2658 — it was a bare Exec before. The membership row and

writeInternalError logs the real error server-side and sends a generic message to the client. This prevents leaking SQL errors, file paths, and other

CreateWorkspace mints a workspace against the pool. Callers already inside a transaction want createWorkspaceQ instead.

String renders a suspect the way the CLI reports it.

doRequestWithCookie is like doRequest but adds a session cookie.

Encode writes img to w in the given format ("png" / "jpeg"). JPEG is encoded at quality 85 — small enough for thumbnails, high enough that pixel-level

testServerWithAttachments returns a fresh test server with the attachment registry wired against an FSStore rooted in t.TempDir(), and (on the pure-Go

WithDispatchInput returns ctx decorated with the original MCP tool- call JSON input map. Called from the registry's tool handler before invoking Dispa

fixedUserResolver is a tiny helper for the unit tests that need a deterministic user without standing up the auth middleware.

ok issues the preflight as the owner and requires a 200.

Dispatch satisfies the Dispatcher interface. cliArgs are accepted for interface compatibility but ignored — HTTPHandlerDispatcher reads the structured

getWorkspaceID resolves workspace slug/ID from the request. If RequireWorkspaceAccess already resolved the workspace, reads from context. Otherwise fa

Addr returns the host:port listen address.

helper: create an item in a collection and return the parsed Item

Stat returns the size in bytes of the blob identified by key. If key is unknown, the returned error wraps ErrNotFound.

Driver returns the driver type.

Name returns the full Redis key or channel name for a suffix. The suffix is the historical name minus the "pad:" root — "event_seq", "watchevents", "e

currentUser returns the authenticated user from the request context, or nil if no user is authenticated.

Close shuts down the event bus and cleans up resources.

now reads the bus's clock. The seam is nil in production; tests set it so a 90s threshold can be crossed without sleeping through one.

Close shuts the bus down, closing every subscriber channel.

PrintJSON prints any value as indented (human-readable) JSON.

NewMemoryOpBus returns a ready-to-use in-process bus.

2 MiB decodeJSON reads and unmarshals the JSON body into v. Wraps the body in http.MaxBytesReader so an attacker can't exhaust memory by POSTing a mul

* Soft-delete an attachment by ID. The blob on disk stays put * (content-addressed dedupe means the same hash may still be * referenced) — orpha

Stop waits for all background goroutines started via goAsync to finish AND drains the rate-limiter cleanup goroutines spawned at construction time (BU

Unsubscribe removes a subscriber and closes its channel.

setupWatchTestUser seeds a workspace + item, mints a real user + user-scoped Bearer token (mirrors handlers_stars_test.go's pattern), and returns ever

Close shuts down the bus. All subscriber channels are closed under the same write-lock that gates Publish/Subscribe so a final inflight Publish can't

GetUser retrieves a user by ID.

CreateSession generates a random session token, stores its SHA-256 hash, and returns the plaintext token (prefixed with "padsess_"). The plaintext is

Subscribe returns a channel that receives every future Notification, with NO replay. There is exactly one logical stream (unlike internal/events.Event

SetMemberCollectionAccess updates a member's collection_access mode and replaces their specific collection grants atomically.

NewRoomManager wires the store + bus together with production defaults.

DB returns the underlying *sql.DB (for use in migrations/testing).

dispatchPadItem runs one pad_item call through the fan-out handler and returns the fake dispatcher plus the tool result.

New creates a new in-memory EventBus with default replay buffer settings.

CreateAPIToken generates a new API token owned by a user, optionally scoped to a workspace. The plaintext token is returned in the response and is nev

Subscribe registers a new subscriber for the given workspace and returns its event channel and its GAP SIGNAL — see SubscribeIfAllowed for what the se

relationFixture builds the Cars/Colors shape from IDEA-2856 and returns the workspace, the two collections and one live colour.

SetCloudMode enables cloud mode with the shared sidecar secret(s). Accepts a comma-separated list of secrets for rotation support: "new-key,old-key" —

loginTestUser creates a user + session, returns the user + the raw session token suitable for AddCookie.

NewClientFromURL creates a client from a full base URL (e.g., "https://app.getpad.dev").