───────────────────────────────────────────────────────────────────── Structured MCP error envelopes (TASK-973) Replaces raw CLI stderr passthrough w

MCP audit log models (PLAN-943 TASK-960). Persistent record of every request that hits the /mcp endpoint — successful tool calls, denied calls, error

MCPAuditResultStatus is the outcome enum for an MCP request.

--- HTTP helpers ---

APIToken represents a stored API token (without the secret).

APITokenCreate is the input for creating a new API token.

APITokenWithSecret is returned only on creation and includes the plaintext token. The token is never stored and cannot be retrieved again.

ActionEnv carries everything an action handler needs to either dispatch to a CLI cmdPath or build a result inline. Wired up once per RegisterCatalog c

ActionFn handles one tool action. Receives the call context, the raw MCP input map, and a per-tool execution environment. Returns the CallToolResult t

AdminBillingStatsResponse is the JSON shape returned by GET /api/v1/admin/billing-stats. It merges Stripe-derived metrics from pad-cloud (active_subsc

AdminInvitation holds enriched invitation data for the admin panel.

AdminUserListEntry is one row returned by SearchUsers: the User model plus the cheap aggregations the admin user table renders at a glance. PLAN-1542

AdminUserMetrics carries the windowed engagement metrics rendered by the admin user modal's Overview tab (T1553). Values are intentionally a small han

AdminUserSearchParams holds parameters for the admin user search query. Filters apply ANDed; nil pointer fields mean "no filter" (distinguished from t

AdminUserSearchResult holds the paginated search results.

AdminUserWorkspace is a lightweight workspace membership for admin views.

AdminUserWorkspaceDetail extends AdminUserWorkspace with per-workspace aggregations rendered in the admin user modal's Workspaces tab. PLAN-1542 / TAS

Agent describes a known MCP-compatible client and how to find its per-user config file.

AgentBootstrap is the single response struct returned by the bootstrap endpoint. It consolidates the four /pad context-loading calls (workspace, colle

AgentBootstrapConvention is a convention item with its body content so agents can read and follow it without a second round-trip. Only always-on, acti

AgentBootstrapConventionMeta is the lightweight, body-less convention projection returned in the bootstrap's convention_index. It mirrors the AgentBoo

AgentBootstrapPlaybookMeta is the lightweight playbook projection returned at bootstrap. Bodies (which can be 5-10KB each) are deliberately excluded;

AgentBootstrapUser is the calling user's projection. Email is included so agents can sign generated commits or reference the human; ID is included so

AgentBootstrapWorkspace is the minimal workspace projection (slug + name + id) the agent needs to address the workspace in subsequent calls. Descripti

AgentRole represents a workspace-scoped capability role for human-agent assignment. Roles describe what kind of work gets done (e.g. "Planner", "Imple

AgentRoleCreate is the input for creating a new agent role.

AgentRoleUpdate is the input for updating an existing agent role.

AgentStatus is one row of Installer.Status output.

AgentTool describes a supported AI coding tool and how to install the Pad skill for it.

Arg is a positional argument.

Artifact is a decoded export of one playbook or convention item.

Attachment models a single uploaded blob in the attachments table. See [[Attachments — architecture & migration design]] (DOC-865). Storage is conten

AttachmentAuthorizer answers one question about one already-scoped attachment row: may the caller who asked for this copy see it? It exists because D

AttachmentCopyPlan is what the planner returns. Nothing in it has been written; the caller decides whether to act on it.

AttachmentCopyRequest is the planner's complete input. Content and Fields are the payloads that will actually be written to workspace B: the copied c

AttachmentCopyRow is one attachment row to create in workspace B, plus the source-side facts the caller needs in order to move bytes if it has to.

AttachmentListFilters narrow the WorkspaceAttachments result set. Zero values mean "no filter on this dimension". The handler turns query-string param

AttachmentListItem is a row from WorkspaceAttachments enriched with the parent item's title + slug + collection slug so the UI can render a clickable

AttachmentListParams encodes the query-string filters the `GET /api/v1/workspaces/{slug}/attachments` endpoint accepts. Zero values are skipped — the

AttachmentListResponse mirrors the JSON returned by GET /api/v1/workspaces/{slug}/attachments. Rows are typed as json.RawMessage so the CLI can surfac

AttachmentManifest is the top-level shape of attachments/manifest.json inside an export bundle. Wraps a list of entries plus a small "schema" version

AttachmentManifestEntry describes one attachment blob in the tar-bundle export's attachments/manifest.json. The bundle layout is: pad-export.json

AttachmentMeta is the minimal metadata needed to render a `pad-attachment:UUID` reference. Trimmed from the full models.Attachment row so callers can

AttachmentMetadata mirrors the response headers of HEAD /api/v1/workspaces/{slug}/attachments/{id}. The server doesn't expose a separate JSON metadata

AttachmentResolver looks up an attachment by UUID. Returns nil for missing/deleted attachments — the resolver renders a "missing" placeholder in that

AttachmentStore is the backend abstraction every storage implementation must satisfy. Methods are safe for concurrent use.

--- Attachments --- AttachmentUploadResult mirrors the JSON returned by POST /api/v1/workspaces/{slug}/attachments. It is the API contract callers de

AuditLogParams are query parameters for the audit log endpoint.

One-shot backfill from session.Extra["allowed_workspaces"] into the new per-connection tables (PLAN-1519 / TASK-1522 / IDEA-1517 §2). Phase A (TASK-1

BackfillStatusTransitionsResult reports what the backfill did so the startup hook can log a one-line summary.

BackfillWikiLinksResult reports what the backfill did so cmd/pad/main.go can log a one-line summary at startup. Repeat runs should report ItemsScanned

Backlink is the wire shape returned by `GET /api/v1/workspaces/{ws}/items/{ref}/backlinks` — one inbound `[[...]]` reference to the queried item. The

BacklinksVisibility is the per-call visibility scope GetBacklinks applies in SQL. Mirrors the (fullCollIDs, grantedItemIDs) shape `Server.guestResourc