───────────────────────────────────────────────────────────────────── Structured MCP error envelopes (TASK-973) Replaces raw CLI stderr passthrough w

MCP audit log models (PLAN-943 TASK-960). Persistent record of every request that hits the /mcp endpoint — successful tool calls, denied calls, error

MCPAuditResultStatus is the outcome enum for an MCP request.

--- HTTP helpers ---

APIToken represents a stored API token (without the secret).

APITokenCreate is the input for creating a new API token.

APITokenWithSecret is returned only on creation and includes the plaintext token. The token is never stored and cannot be retrieved again.

ActionEnv carries everything an action handler needs to either dispatch to a CLI cmdPath or build a result inline. Wired up once per RegisterCatalog c

ActionFn handles one tool action. Receives the call context, the raw MCP input map, and a per-tool execution environment. Returns the CallToolResult t

AdminBillingStatsResponse is the JSON shape returned by GET /api/v1/admin/billing-stats. It merges Stripe-derived metrics from pad-cloud (active_subsc

AdminInvitation holds enriched invitation data for the admin panel.

AdminUserListEntry is one row returned by SearchUsers: the User model plus the cheap aggregations the admin user table renders at a glance. PLAN-1542

AdminUserMetrics carries the windowed engagement metrics rendered by the admin user modal's Overview tab (T1553). Values are intentionally a small han

AdminUserSearchParams holds parameters for the admin user search query. Filters apply ANDed; nil pointer fields mean "no filter" (distinguished from t

AdminUserSearchResult holds the paginated search results.

AdminUserWorkspace is a lightweight workspace membership for admin views.

AdminUserWorkspaceDetail extends AdminUserWorkspace with per-workspace aggregations rendered in the admin user modal's Workspaces tab. PLAN-1542 / TAS

Agent describes a known MCP-compatible client and how to find its per-user config file.

AgentBootstrap is the single response struct returned by the bootstrap endpoint. It consolidates the four /pad context-loading calls (workspace, colle

AgentBootstrapConvention is a convention item with its body content so agents can read and follow it without a second round-trip. Only always-on, acti

AgentBootstrapConventionMeta is the lightweight, body-less convention projection returned in the bootstrap's convention_index. It mirrors the AgentBoo

AgentBootstrapPlaybookMeta is the lightweight playbook projection returned at bootstrap. Bodies (which can be 5-10KB each) are deliberately excluded;

AgentBootstrapUser is the calling user's projection. Email is included so agents can sign generated commits or reference the human; ID is included so

AgentBootstrapWorkspace is the minimal workspace projection (slug + name + id) the agent needs to address the workspace in subsequent calls. Descripti

AgentRole represents a workspace-scoped capability role for human-agent assignment. Roles describe what kind of work gets done (e.g. "Planner", "Imple

AgentRoleCreate is the input for creating a new agent role.

AgentRoleUpdate is the input for updating an existing agent role.

AgentStatus is one row of Installer.Status output.

AgentTool describes a supported AI coding tool and how to install the Pad skill for it.

Arg is a positional argument.

Artifact is a decoded export of one playbook or convention item.

Attachment models a single uploaded blob in the attachments table. See [[Attachments — architecture & migration design]] (DOC-865). Storage is conten

AttachmentListFilters narrow the WorkspaceAttachments result set. Zero values mean "no filter on this dimension". The handler turns query-string param

AttachmentListItem is a row from WorkspaceAttachments enriched with the parent item's title + slug + collection slug so the UI can render a clickable

AttachmentListParams encodes the query-string filters the `GET /api/v1/workspaces/{slug}/attachments` endpoint accepts. Zero values are skipped — the

AttachmentListResponse mirrors the JSON returned by GET /api/v1/workspaces/{slug}/attachments. Rows are typed as json.RawMessage so the CLI can surfac

AttachmentManifest is the top-level shape of attachments/manifest.json inside an export bundle. Wraps a list of entries plus a small "schema" version

AttachmentManifestEntry describes one attachment blob in the tar-bundle export's attachments/manifest.json. The bundle layout is: pad-export.json

AttachmentMeta is the minimal metadata needed to render a `pad-attachment:UUID` reference. Trimmed from the full models.Attachment row so callers can

AttachmentMetadata mirrors the response headers of HEAD /api/v1/workspaces/{slug}/attachments/{id}. The server doesn't expose a separate JSON metadata

AttachmentResolver looks up an attachment by UUID. Returns nil for missing/deleted attachments — the resolver renders a "missing" placeholder in that

AttachmentStore is the backend abstraction every storage implementation must satisfy. Methods are safe for concurrent use.

--- Attachments --- AttachmentUploadResult mirrors the JSON returned by POST /api/v1/workspaces/{slug}/attachments. It is the API contract callers de

AuditLogParams are query parameters for the audit log endpoint.

One-shot backfill from session.Extra["allowed_workspaces"] into the new per-connection tables (PLAN-1519 / TASK-1522 / IDEA-1517 §2). Phase A (TASK-1

BackfillStatusTransitionsResult reports what the backfill did so the startup hook can log a one-line summary.

BackfillWikiLinksResult reports what the backfill did so cmd/pad/main.go can log a one-line summary at startup. Repeat runs should report ItemsScanned

Backlink is the wire shape returned by `GET /api/v1/workspaces/{ws}/items/{ref}/backlinks` — one inbound `[[...]]` reference to the queried item. The

BacklinksVisibility is the per-call visibility scope GetBacklinks applies in SQL. Mirrors the (fullCollIDs, grantedItemIDs) shape `Server.guestResourc

BillingAggregates is the set of users-table aggregates returned by CountBillingAggregates: per-plan customer counts and the number of new pro signups

BillingMetricsResponse mirrors the JSON pad-cloud returns from GET /admin/metrics/billing. All numeric fields are zero when StripeConfigured is false

BlocksEdge is a skinny projection of a `blocks` link plus the blocker (source) essentials the dashboard needs to decide whether a blocked item should

BootstrapCollection is the lightweight collection projection delivered in the agent bootstrap response. Distinct from models.Collection: drops fields

BootstrapDashboard is the bootstrap-side dashboard projection. It embeds *DashboardResponse so the wire shape stays compatible with the `GET /dashboar

BootstrapFetcher resolves the agent bootstrap blob for a given workspace. Used by pad_set_workspace to embed the blob in its response so an MCP host c

BootstrapRole is the lightweight role projection delivered in the agent bootstrap response. Distinct from models.AgentRole: drops fields the /pad skil

CLIAuthSession represents a pending or approved CLI login session.

CLIAuthSessionResponse is the response from POST /auth/cli/sessions.

CLIAuthSessionStatus is the response from GET /auth/cli/sessions/{code}.

Capabilities describes the static capability profile of a Processor. It's safe to embed in HTTP responses — nothing here changes between requests, so

Connected-apps models (PLAN-943 TASK-954). A "connected app" is one OAuth client (Claude Desktop, Cursor, …) that the user has authorized to act on t

CatalogOptions configures RegisterCatalog. Mirrors RegistryOptions for the cmdhelp-walk path but adds PadVersion (needed by pad_meta).

Category drives the icon shown on file chips and is also used by quota/usage UI to bucket totals (Phase 2 will surface "you have 1.2GB of images and 4

CategoryGroup is an ordered pair of (category, templates-in-that-category).