Add call graph fixtures for various languages and scenarios

- Introduced `all-edge-reasons.json` to test edge resolution reasons in .NET.
- Added `all-visibility-levels.json` to validate method visibility levels in .NET.
- Created `dotnet-aspnetcore-minimal.json` for a minimal ASP.NET Core application.
- Included `go-gin-api.json` for a Go Gin API application structure.
- Added `java-spring-boot.json` for the Spring PetClinic application in Java.
- Introduced `legacy-no-schema.json` for legacy application structure without schema.
- Created `node-express-api.json` for an Express.js API application structure.

src/Cli/StellaOps.Cli/Services/BackendOperationsClient.cs

@@ -2320,6 +2320,37 @@ internal sealed class BackendOperationsClient : IBackendOperationsClient
         return null;
     }
 
+    private static string? ExtractProblemExtensionString(ProblemDocument? problem, params string[] keys)
+    {
+        if (problem?.Extensions is null || problem.Extensions.Count == 0 || keys.Length == 0)
+        {
+            return null;
+        }
+
+        foreach (var key in keys)
+        {
+            if (!problem.Extensions.TryGetValue(key, out var value) || value is null)
+            {
+                continue;
+            }
+
+            switch (value)
+            {
+                case string text when !string.IsNullOrWhiteSpace(text):
+                    return text;
+                case JsonElement element when element.ValueKind == JsonValueKind.String:
+                    var parsed = element.GetString();
+                    if (!string.IsNullOrWhiteSpace(parsed))
+                    {
+                        return parsed;
+                    }
+                    break;
+            }
+        }
+
+        return null;
+    }
+
     private static string BuildPolicyFindingsQueryString(PolicyFindingsQuery query)
     {
         var parameters = new List<string>();
@@ -2853,6 +2884,7 @@ internal sealed class BackendOperationsClient : IBackendOperationsClient
                             {
                                 // Extract error code from problem type URI
                                 errorCode = ExtractErrorCodeFromProblemType(problem.Type);
+                                errorCode ??= ExtractProblemErrorCode(problem);
 
                                 if (!string.IsNullOrWhiteSpace(problem.Title))
                                 {
@@ -2868,21 +2900,23 @@ internal sealed class BackendOperationsClient : IBackendOperationsClient
                                 // Check for trace_id in extensions
                                 if (problem.Extensions is not null)
                                 {
-                                    if (problem.Extensions.TryGetValue("trace_id", out var tid) && tid is string tidStr)
+                                    var extensionTraceId = ExtractProblemExtensionString(problem, "trace_id", "traceId");
+                                    if (!string.IsNullOrWhiteSpace(extensionTraceId))
                                     {
-                                        traceId ??= tidStr;
+                                        traceId ??= extensionTraceId;
                                     }
-                                    if (problem.Extensions.TryGetValue("traceId", out var tid2) && tid2 is string tid2Str)
+
+                                    var extensionErrorCode = ExtractProblemExtensionString(problem, "error_code", "errorCode");
+                                    if (!string.IsNullOrWhiteSpace(extensionErrorCode))
                                     {
-                                        traceId ??= tid2Str;
+                                        errorCode ??= extensionErrorCode;
                                     }
-                                    if (problem.Extensions.TryGetValue("error_code", out var ec) && ec is string ecStr)
+
+                                    var reasonCode = ExtractProblemExtensionString(problem, "reason_code", "reasonCode");
+                                    if (!string.IsNullOrWhiteSpace(reasonCode))
                                     {
-                                        errorCode ??= ecStr;
-                                    }
-                                    if (problem.Extensions.TryGetValue("errorCode", out var ec2) && ec2 is string ec2Str)
-                                    {
-                                        errorCode ??= ec2Str;
+                                        metadata ??= new Dictionary<string, object?>(StringComparer.Ordinal);
+                                        metadata["reason_code"] = reasonCode;
                                     }
                                 }
                             }

src/Cli/StellaOps.Cli/Services/FileBundleVersionStore.cs

@@ -0,0 +1,120 @@
+using System.Text.Json;
+using Microsoft.Extensions.Logging;
+using StellaOps.AirGap.Importer.Versioning;
+
+namespace StellaOps.Cli.Services;
+
+internal sealed class FileBundleVersionStore : IBundleVersionStore
+{
+    private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web)
+    {
+        WriteIndented = true
+    };
+
+    private readonly string _stateDirectory;
+    private readonly ILogger<FileBundleVersionStore> _logger;
+
+    public FileBundleVersionStore(string stateDirectory, ILogger<FileBundleVersionStore> logger)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(stateDirectory);
+        _stateDirectory = stateDirectory;
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+    }
+
+    public async Task<BundleVersionRecord?> GetCurrentAsync(
+        string tenantId,
+        string bundleType,
+        CancellationToken ct = default)
+    {
+        var history = await GetHistoryInternalAsync(tenantId, bundleType, ct).ConfigureAwait(false);
+        return history
+            .OrderByDescending(record => record.ActivatedAt)
+            .ThenByDescending(record => record.VersionString, StringComparer.Ordinal)
+            .FirstOrDefault();
+    }
+
+    public async Task UpsertAsync(BundleVersionRecord record, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(record);
+
+        Directory.CreateDirectory(_stateDirectory);
+
+        var path = GetStatePath(record.TenantId, record.BundleType);
+        var history = await GetHistoryInternalAsync(record.TenantId, record.BundleType, ct).ConfigureAwait(false);
+
+        history.Add(record);
+
+        var ordered = history
+            .OrderBy(r => r.ActivatedAt)
+            .ThenBy(r => r.VersionString, StringComparer.Ordinal)
+            .ToList();
+
+        var tempPath = path + ".tmp";
+        await using (var stream = File.Create(tempPath))
+        {
+            await JsonSerializer.SerializeAsync(stream, ordered, JsonOptions, ct).ConfigureAwait(false);
+        }
+
+        File.Copy(tempPath, path, overwrite: true);
+        File.Delete(tempPath);
+    }
+
+    public async Task<IReadOnlyList<BundleVersionRecord>> GetHistoryAsync(
+        string tenantId,
+        string bundleType,
+        int limit = 10,
+        CancellationToken ct = default)
+    {
+        var history = await GetHistoryInternalAsync(tenantId, bundleType, ct).ConfigureAwait(false);
+        return history
+            .OrderByDescending(r => r.ActivatedAt)
+            .ThenByDescending(r => r.VersionString, StringComparer.Ordinal)
+            .Take(Math.Max(0, limit))
+            .ToArray();
+    }
+
+    private async Task<List<BundleVersionRecord>> GetHistoryInternalAsync(
+        string tenantId,
+        string bundleType,
+        CancellationToken ct)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(tenantId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(bundleType);
+
+        var path = GetStatePath(tenantId, bundleType);
+        if (!File.Exists(path))
+        {
+            return new List<BundleVersionRecord>();
+        }
+
+        try
+        {
+            await using var stream = File.OpenRead(path);
+            var records = await JsonSerializer.DeserializeAsync<List<BundleVersionRecord>>(stream, JsonOptions, ct).ConfigureAwait(false);
+            return records ?? new List<BundleVersionRecord>();
+        }
+        catch (Exception ex) when (ex is IOException or JsonException)
+        {
+            _logger.LogWarning(ex, "Failed to read bundle version history from {Path}", path);
+            return new List<BundleVersionRecord>();
+        }
+    }
+
+    private string GetStatePath(string tenantId, string bundleType)
+    {
+        var safeTenant = SanitizePathSegment(tenantId);
+        var safeBundleType = SanitizePathSegment(bundleType);
+        return Path.Combine(_stateDirectory, $"bundle-versions__{safeTenant}__{safeBundleType}.json");
+    }
+
+    private static string SanitizePathSegment(string value)
+    {
+        var trimmed = value.Trim().ToLowerInvariant();
+        var invalid = Path.GetInvalidFileNameChars();
+        var chars = trimmed
+            .Select(c => invalid.Contains(c) || c == '/' || c == '\\' || char.IsWhiteSpace(c) ? '_' : c)
+            .ToArray();
+        return new string(chars);
+    }
+}
+

src/Cli/StellaOps.Cli/Services/MirrorBundleImportService.cs

@@ -23,7 +23,6 @@ public sealed class MirrorBundleImportService : IMirrorBundleImportService
 {
     private readonly IBundleCatalogRepository _catalogRepository;
     private readonly IBundleItemRepository _itemRepository;
-    private readonly ImportValidator _validator;
     private readonly ILogger<MirrorBundleImportService> _logger;
 
     public MirrorBundleImportService(
@@ -34,7 +33,6 @@ public sealed class MirrorBundleImportService : IMirrorBundleImportService
         _catalogRepository = catalogRepository ?? throw new ArgumentNullException(nameof(catalogRepository));
         _itemRepository = itemRepository ?? throw new ArgumentNullException(nameof(itemRepository));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
-        _validator = new ImportValidator();
     }
 
     public async Task<MirrorImportResult> ImportAsync(MirrorImportRequest request, CancellationToken cancellationToken)

src/Cli/StellaOps.Cli/Services/OfflineKitStateStore.cs

@@ -0,0 +1,92 @@
+using System.Text.Json;
+using Microsoft.Extensions.Logging;
+
+namespace StellaOps.Cli.Services;
+
+internal sealed class OfflineKitStateStore
+{
+    private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web)
+    {
+        WriteIndented = true
+    };
+
+    private readonly string _stateDirectory;
+    private readonly ILogger<OfflineKitStateStore> _logger;
+
+    public OfflineKitStateStore(string stateDirectory, ILogger<OfflineKitStateStore> logger)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(stateDirectory);
+        _stateDirectory = stateDirectory;
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+    }
+
+    public async Task SaveActiveAsync(OfflineKitActiveState state, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(state);
+        Directory.CreateDirectory(_stateDirectory);
+
+        var path = GetActiveStatePath(state.TenantId);
+        var temp = path + ".tmp";
+
+        await using (var stream = File.Create(temp))
+        {
+            await JsonSerializer.SerializeAsync(stream, state, JsonOptions, cancellationToken).ConfigureAwait(false);
+        }
+
+        File.Copy(temp, path, overwrite: true);
+        File.Delete(temp);
+    }
+
+    public async Task<OfflineKitActiveState?> LoadActiveAsync(string tenantId, CancellationToken cancellationToken)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(tenantId);
+
+        var path = GetActiveStatePath(tenantId);
+        if (!File.Exists(path))
+        {
+            return null;
+        }
+
+        try
+        {
+            await using var stream = File.OpenRead(path);
+            return await JsonSerializer.DeserializeAsync<OfflineKitActiveState>(stream, JsonOptions, cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception ex) when (ex is IOException or JsonException)
+        {
+            _logger.LogWarning(ex, "Failed to read offline kit state from {Path}", path);
+            return null;
+        }
+    }
+
+    private string GetActiveStatePath(string tenantId)
+    {
+        var safeTenant = SanitizePathSegment(tenantId);
+        return Path.Combine(_stateDirectory, $"offline-kit-active__{safeTenant}.json");
+    }
+
+    private static string SanitizePathSegment(string value)
+    {
+        var trimmed = value.Trim().ToLowerInvariant();
+        var invalid = Path.GetInvalidFileNameChars();
+        var chars = trimmed
+            .Select(c => invalid.Contains(c) || c == '/' || c == '\\' || char.IsWhiteSpace(c) ? '_' : c)
+            .ToArray();
+        return new string(chars);
+    }
+}
+
+internal sealed record OfflineKitActiveState(
+    string TenantId,
+    string BundlePath,
+    string ManifestPath,
+    string Version,
+    DateTimeOffset ManifestCreatedAt,
+    string PayloadSha256,
+    string BundleDigest,
+    DateTimeOffset ActivatedAt,
+    bool DsseVerified,
+    bool RekorVerified,
+    bool WasForceActivated,
+    string? ForceActivateReason);
+

src/Cli/StellaOps.Cli/Services/Transport/StellaOpsClientBase.cs

@@ -237,10 +237,29 @@ public abstract class StellaOpsClientBase : IDisposable
                 var problem = JsonSerializer.Deserialize<ProblemDocument>(content, JsonOptions);
                 if (problem is not null)
                 {
+                    var code = ExtractErrorCodeFromProblemType(problem.Type)
+                        ?? ExtractProblemExtensionString(problem, "error_code", "errorCode")
+                        ?? ExtractProblemExtensionString(problem, "code")
+                        ?? $"ERR_HTTP_{statusCode}";
+
+                    var traceId = ExtractProblemExtensionString(problem, "trace_id", "traceId");
+                    Dictionary<string, string>? metadata = null;
+
+                    var reasonCode = ExtractProblemExtensionString(problem, "reason_code", "reasonCode");
+                    if (!string.IsNullOrWhiteSpace(reasonCode))
+                    {
+                        metadata = new Dictionary<string, string>(StringComparer.Ordinal)
+                        {
+                            ["reason_code"] = reasonCode
+                        };
+                    }
+
                     return new CliError(
-                        Code: problem.Type ?? $"ERR_HTTP_{statusCode}",
+                        Code: code,
                         Message: problem.Title ?? $"HTTP error {statusCode}",
-                        Detail: problem.Detail);
+                        TraceId: traceId,
+                        Detail: problem.Detail,
+                        Metadata: metadata);
                 }
             }
             catch (JsonException)
@@ -253,6 +272,63 @@ public abstract class StellaOpsClientBase : IDisposable
         return CliError.FromHttpStatus(statusCode, content);
     }
 
+    private static string? ExtractErrorCodeFromProblemType(string? type)
+    {
+        if (string.IsNullOrWhiteSpace(type))
+        {
+            return null;
+        }
+
+        if (type.StartsWith("urn:stellaops:error:", StringComparison.OrdinalIgnoreCase))
+        {
+            return type[20..];
+        }
+
+        if (type.Contains("/errors/", StringComparison.OrdinalIgnoreCase))
+        {
+            var idx = type.LastIndexOf("/errors/", StringComparison.OrdinalIgnoreCase);
+            return idx < 0 ? null : type[(idx + 8)..];
+        }
+
+        if (type.StartsWith("ERR_", StringComparison.OrdinalIgnoreCase))
+        {
+            return type;
+        }
+
+        return null;
+    }
+
+    private static string? ExtractProblemExtensionString(ProblemDocument? problem, params string[] keys)
+    {
+        if (problem?.Extensions is null || problem.Extensions.Count == 0 || keys.Length == 0)
+        {
+            return null;
+        }
+
+        foreach (var key in keys)
+        {
+            if (!problem.Extensions.TryGetValue(key, out var value) || value is null)
+            {
+                continue;
+            }
+
+            switch (value)
+            {
+                case string text when !string.IsNullOrWhiteSpace(text):
+                    return text;
+                case JsonElement element when element.ValueKind == JsonValueKind.String:
+                    var parsed = element.GetString();
+                    if (!string.IsNullOrWhiteSpace(parsed))
+                    {
+                        return parsed;
+                    }
+                    break;
+            }
+        }
+
+        return null;
+    }
+
     public void Dispose()
     {
         if (_disposed)