* Rebuild the per-workspace MiniSearch index from the current in-RAM * snapshot. Called after the warm-cache hydrate and after the cold-path * /item

receiveMessages reads from a Redis pub/sub channel and fans out to local subscribers.

reclaimWorkspaceBlobs deletes every physical blob owned solely by workspace c, returning true only when the workspace is safe to purge — i.e. every bl

redactURL hides credentials from log/error output. We already reject credential-bearing URLs at validation time, but Go can hand us an already-strippe

refResolverNotFound writes a 404 with no body details. Centralized so all failure paths produce identical responses — preventing oracle-style probes t

* Update each toolbar button's enabled state + tooltip based on the * image's MIME and the processor's supported-formats list. * * - Empty suppor

registerMCPRoutes installs the /mcp + /.well-known endpoints on r, gated by cloud mode. Called from setupRouter at infrastructure- middleware level (N

because it was the 501 stub from TASK-950, and replacing it in place keeps the URL stable for clients that already discovered the chain. The OAuth-ser

registerPendingAck creates an entry in the room's pending-acks map keyed on requestID, with the expected ack source set to expectedConn. Returns the c

registerSetWorkspaceTool installs the built-in workspace tool on srv.

rehydrateAttachment runs the upload-handler's MIME validation, hash, and store.Put for one manifest entry, then inserts a fresh attachments row in the

rejectInvalidBearer writes a 401 with the given code/message UNLESS the request targets a path in isPublicAPIPath, in which case it falls through to t

remapAttachmentRefs replaces "pad-attachment:OLD" with "pad-attachment:NEW" for every (old, new) pair in the map. Pure string operation — kept private

remapFieldIDs replaces old UUIDs in a JSON fields string with their new IDs. This handles relation fields (e.g. parent: "uuid") without needing to par

removeSQLiteTemplate deletes the template directory built by buildSQLiteTemplate, if any. Called from TestMain after m.Run().

renderCommand writes one command's markdown section. Section order matches cmdhelp v0.1 §6 exactly.

renderConsent draws the consent UI. CSRF token comes from the existing __Host-pad_csrf cookie (or is minted here if absent — rare on the post-login pa

renderSynopsis reconstructs a cobra-style usage line from the Document's structured args + flags. Output looks like: pad item create <collection> <t

replaceDBName swaps the database name in a postgres:// URL. e.g. "postgres://pad:pad@localhost:5432/pad?sslmode=disable" becomes "postgres://pad:pad@l

replayTo sends every persisted op-log update for this room with id strictly greater than `since` to the given connection in order. Each row goes out a

repoRoot walks up from this test file to the directory containing go.mod.

--- changelog ---

reportCompletedBuckets returns completion counts keyed by bucket label AND the per-collection completion totals over the whole window. A completion is

reportCompletedItems returns the items that reached a positive terminal in the window (the "what shipped" list, TASK-1641): deduped by item (newest co

reportCreatedBuckets returns created-item counts keyed by bucket label.

reportCycleTime computes created→positive-terminal durations for completions within the window, returning overall median/p90 + per-collection medians.

reportStatusDistribution returns the current per-collection breakdown of items by their done-field value. One small grouped query per collection (the

reportWIP snapshots currently-open items (done field NOT a terminal value), their age (now - created_at), and an age-band distribution. Point-in-time.

* Acquire the workspace-scoped leader lock and, if granted, open * the SSE EventSource. Peer tabs queue on the same lock and only * advance when t

requireCallerCanSetCollectionAccess denies a restricted caller (their own collection_access is "specific") from using this endpoint to escalate beyond

requireViewVisible looks up a view by ID, verifies it belongs to the workspace, and checks that its collection is visible. Returns the view or writes

Reset the per-item dedupe baseline (`lastFlushedContent`). Call on item * swap and after any out-of-band raw save that changed items.content via a

--- members ---

* Resolve the catalog's `role` (slug) and `assign` (user name/email) item * params to the `agent_role_id` / `assigned_user_id` the create/update * e

resolveImport maps a Svelte/TS module specifier to a file path inside the project's source tree, or "" for external packages / unresolvable paths. -

resolveRefTx looks up a (prefix, number) pair to an item ID within a workspace. Returns a NULL sql.NullString if the ref doesn't resolve — broken refs

resolveTitleTx mirrors the renderer's title-resolution logic (web/src/lib/utils/markdown.ts:541–558) inside the parse-time transaction. Two-stage look

resolveWorkspaceSlugTx looks up `slug` against the workspaces table and returns the workspace ID as a sql.NullString. Returns a NULL when the slug doe

resolverItemVisible derives the viewer's workspace role outside the RequireWorkspaceAccess middleware path, then delegates to checkItemVisible. The ro

resolverOwnerUsername returns the workspace owner's username — the only source for the leading path segment of the canonical redirect target (since `/

resolverWorkspaceRole reproduces RequireWorkspaceAccess's role lookup for a (workspace, user) pair without the *http.Request scaffolding. Returns "" w

--- restore ---

rewriteMcpSubdomain best-effort rewrites "mcp.<rest>" to "app.<rest>" so the discovery doc's authorization_servers entry points at the auth vhost when

roleLevel returns a numeric level for role comparison. Higher values indicate more permissions.

roleUpdateCmd updates an existing agent role's name, description, icon, tools, slug, or sort_order. Only flags explicitly set are sent — every AgentRo

routeApplierAck signals the channel waiting on requestID, but only if the ack came from the expected conn (defence in depth). Called by readLoop on re

run drives the periodic sweeper at the given interval. Exits on stop. Tracked via Server.bg so Stop() can drain in-flight sweeps before the process ex

runCLISetup is the legacy in-terminal admin bootstrap, reachable via `pad auth setup --cli-prompt`. Kept verbatim from the pre-TASK-1216 behavior so u

runClient opens one WebSocket, fires synthetic updates at the configured rate, and consumes inbound frames from peers. Exits when `done` closes or the

runConn drives one connection through its full lifecycle: spawn writer (drains the bus subscription concurrently with replay), stream the op-log repla

runMCPAuditSweeper drives the 90-day retention sweep on a 24h ticker. Exits when the audit writer's stop channel closes (i.e. when Server.Stop() runs)

runOpLogGCTick is one tick of the periodic loop. No outer timeout because PruneSweep itself is bounded by the size of the candidate list (one DB query

runOrphanGCTick is one tick of the periodic loop. Wrapped with a 30-minute cap on the sweep so a long-running scan can't pin the goroutine across mult

runWorkspacePurgeTick runs one tick of the periodic loop, wrapped with a 30-minute cap so a large sweep can't pin the goroutine across intervals. Logg

* Encode a value so it's safe to embed in an IDB database name. * Names allow any UTF-16 string per spec, but URL-encoding keeps * the on-disk handl