Restructure solution layout by module

src/Cli/StellaOps.Cli/Services/Models/AdvisoryObservationsModels.cs

@@ -0,0 +1,117 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed record AdvisoryObservationsQuery(
+    string Tenant,
+    IReadOnlyList<string> ObservationIds,
+    IReadOnlyList<string> Aliases,
+    IReadOnlyList<string> Purls,
+    IReadOnlyList<string> Cpes,
+    int? Limit,
+    string? Cursor);
+
+internal sealed class AdvisoryObservationsResponse
+{
+    [JsonPropertyName("observations")]
+    public IReadOnlyList<AdvisoryObservationDocument> Observations { get; init; } =
+        Array.Empty<AdvisoryObservationDocument>();
+
+    [JsonPropertyName("linkset")]
+    public AdvisoryObservationLinksetAggregate Linkset { get; init; } =
+        new();
+
+    [JsonPropertyName("nextCursor")]
+    public string? NextCursor { get; init; }
+
+    [JsonPropertyName("hasMore")]
+    public bool HasMore { get; init; }
+}
+
+internal sealed class AdvisoryObservationDocument
+{
+    [JsonPropertyName("observationId")]
+    public string ObservationId { get; init; } = string.Empty;
+
+    [JsonPropertyName("tenant")]
+    public string Tenant { get; init; } = string.Empty;
+
+    [JsonPropertyName("source")]
+    public AdvisoryObservationSource Source { get; init; } = new();
+
+    [JsonPropertyName("upstream")]
+    public AdvisoryObservationUpstream Upstream { get; init; } = new();
+
+    [JsonPropertyName("linkset")]
+    public AdvisoryObservationLinkset Linkset { get; init; } = new();
+
+    [JsonPropertyName("createdAt")]
+    public DateTimeOffset CreatedAt { get; init; }
+}
+
+internal sealed class AdvisoryObservationSource
+{
+    [JsonPropertyName("vendor")]
+    public string Vendor { get; init; } = string.Empty;
+
+    [JsonPropertyName("stream")]
+    public string Stream { get; init; } = string.Empty;
+
+    [JsonPropertyName("api")]
+    public string Api { get; init; } = string.Empty;
+
+    [JsonPropertyName("collectorVersion")]
+    public string? CollectorVersion { get; init; }
+}
+
+internal sealed class AdvisoryObservationUpstream
+{
+    [JsonPropertyName("upstreamId")]
+    public string UpstreamId { get; init; } = string.Empty;
+
+    [JsonPropertyName("documentVersion")]
+    public string? DocumentVersion { get; init; }
+}
+
+internal sealed class AdvisoryObservationLinkset
+{
+    [JsonPropertyName("aliases")]
+    public IReadOnlyList<string> Aliases { get; init; } = Array.Empty<string>();
+
+    [JsonPropertyName("purls")]
+    public IReadOnlyList<string> Purls { get; init; } = Array.Empty<string>();
+
+    [JsonPropertyName("cpes")]
+    public IReadOnlyList<string> Cpes { get; init; } = Array.Empty<string>();
+
+    [JsonPropertyName("references")]
+    public IReadOnlyList<AdvisoryObservationReference> References { get; init; } =
+        Array.Empty<AdvisoryObservationReference>();
+}
+
+internal sealed class AdvisoryObservationReference
+{
+    [JsonPropertyName("type")]
+    public string Type { get; init; } = string.Empty;
+
+    [JsonPropertyName("url")]
+    public string Url { get; init; } = string.Empty;
+}
+
+internal sealed class AdvisoryObservationLinksetAggregate
+{
+    [JsonPropertyName("aliases")]
+    public IReadOnlyList<string> Aliases { get; init; } = Array.Empty<string>();
+
+    [JsonPropertyName("purls")]
+    public IReadOnlyList<string> Purls { get; init; } = Array.Empty<string>();
+
+    [JsonPropertyName("cpes")]
+    public IReadOnlyList<string> Cpes { get; init; } = Array.Empty<string>();
+
+    [JsonPropertyName("references")]
+    public IReadOnlyList<AdvisoryObservationReference> References { get; init; } =
+        Array.Empty<AdvisoryObservationReference>();
+}

src/Cli/StellaOps.Cli/Services/Models/AocIngestDryRunModels.cs

@@ -0,0 +1,93 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed class AocIngestDryRunRequest
+{
+    [JsonPropertyName("tenant")]
+    public string Tenant { get; init; } = string.Empty;
+
+    [JsonPropertyName("source")]
+    public string Source { get; init; } = string.Empty;
+
+    [JsonPropertyName("document")]
+    public AocIngestDryRunDocument Document { get; init; } = new();
+}
+
+internal sealed class AocIngestDryRunDocument
+{
+    [JsonPropertyName("name")]
+    public string? Name { get; init; }
+
+    [JsonPropertyName("content")]
+    public string Content { get; init; } = string.Empty;
+
+    [JsonPropertyName("contentType")]
+    public string ContentType { get; init; } = "application/json";
+
+    [JsonPropertyName("contentEncoding")]
+    public string? ContentEncoding { get; init; }
+}
+
+internal sealed class AocIngestDryRunResponse
+{
+    [JsonPropertyName("source")]
+    public string? Source { get; init; }
+
+    [JsonPropertyName("tenant")]
+    public string? Tenant { get; init; }
+
+    [JsonPropertyName("guardVersion")]
+    public string? GuardVersion { get; init; }
+
+    [JsonPropertyName("status")]
+    public string? Status { get; init; }
+
+    [JsonPropertyName("document")]
+    public AocIngestDryRunDocumentResult Document { get; init; } = new();
+
+    [JsonPropertyName("violations")]
+    public IReadOnlyList<AocIngestDryRunViolation> Violations { get; init; } =
+        Array.Empty<AocIngestDryRunViolation>();
+}
+
+internal sealed class AocIngestDryRunDocumentResult
+{
+    [JsonPropertyName("contentHash")]
+    public string? ContentHash { get; init; }
+
+    [JsonPropertyName("supersedes")]
+    public string? Supersedes { get; init; }
+
+    [JsonPropertyName("provenance")]
+    public AocIngestDryRunProvenance Provenance { get; init; } = new();
+}
+
+internal sealed class AocIngestDryRunProvenance
+{
+    [JsonPropertyName("signature")]
+    public AocIngestDryRunSignature Signature { get; init; } = new();
+}
+
+internal sealed class AocIngestDryRunSignature
+{
+    [JsonPropertyName("format")]
+    public string? Format { get; init; }
+
+    [JsonPropertyName("present")]
+    public bool Present { get; init; }
+}
+
+internal sealed class AocIngestDryRunViolation
+{
+    [JsonPropertyName("code")]
+    public string Code { get; init; } = string.Empty;
+
+    [JsonPropertyName("message")]
+    public string Message { get; init; } = string.Empty;
+
+    [JsonPropertyName("path")]
+    public string? Path { get; init; }
+}

src/Cli/StellaOps.Cli/Services/Models/AocVerifyModels.cs

@@ -0,0 +1,100 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed class AocVerifyRequest
+{
+    [JsonPropertyName("tenant")]
+    public string Tenant { get; init; } = string.Empty;
+
+    [JsonPropertyName("since")]
+    public string? Since { get; init; }
+
+    [JsonPropertyName("limit")]
+    public int? Limit { get; init; }
+
+    [JsonPropertyName("sources")]
+    public IReadOnlyList<string>? Sources { get; init; }
+
+    [JsonPropertyName("codes")]
+    public IReadOnlyList<string>? Codes { get; init; }
+}
+
+internal sealed class AocVerifyResponse
+{
+    [JsonPropertyName("tenant")]
+    public string? Tenant { get; init; }
+
+    [JsonPropertyName("window")]
+    public AocVerifyWindow Window { get; init; } = new();
+
+    [JsonPropertyName("checked")]
+    public AocVerifyChecked Checked { get; init; } = new();
+
+    [JsonPropertyName("violations")]
+    public IReadOnlyList<AocVerifyViolation> Violations { get; init; } =
+        Array.Empty<AocVerifyViolation>();
+
+    [JsonPropertyName("metrics")]
+    public AocVerifyMetrics Metrics { get; init; } = new();
+
+    [JsonPropertyName("truncated")]
+    public bool? Truncated { get; init; }
+}
+
+internal sealed class AocVerifyWindow
+{
+    [JsonPropertyName("from")]
+    public DateTimeOffset? From { get; init; }
+
+    [JsonPropertyName("to")]
+    public DateTimeOffset? To { get; init; }
+}
+
+internal sealed class AocVerifyChecked
+{
+    [JsonPropertyName("advisories")]
+    public int Advisories { get; init; }
+
+    [JsonPropertyName("vex")]
+    public int Vex { get; init; }
+}
+
+internal sealed class AocVerifyViolation
+{
+    [JsonPropertyName("code")]
+    public string Code { get; init; } = string.Empty;
+
+    [JsonPropertyName("count")]
+    public int Count { get; init; }
+
+    [JsonPropertyName("examples")]
+    public IReadOnlyList<AocVerifyViolationExample> Examples { get; init; } =
+        Array.Empty<AocVerifyViolationExample>();
+}
+
+internal sealed class AocVerifyViolationExample
+{
+    [JsonPropertyName("source")]
+    public string? Source { get; init; }
+
+    [JsonPropertyName("documentId")]
+    public string? DocumentId { get; init; }
+
+    [JsonPropertyName("contentHash")]
+    public string? ContentHash { get; init; }
+
+    [JsonPropertyName("path")]
+    public string? Path { get; init; }
+}
+
+internal sealed class AocVerifyMetrics
+{
+    [JsonPropertyName("ingestion_write_total")]
+    public int? IngestionWriteTotal { get; init; }
+
+    [JsonPropertyName("aoc_violation_total")]
+    public int? AocViolationTotal { get; init; }
+}

src/Cli/StellaOps.Cli/Services/Models/AuthorityRevocationExportResult.cs

@@ -0,0 +1,20 @@
+using System;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed class AuthorityRevocationExportResult
+{
+    public required byte[] BundleBytes { get; init; }
+
+    public required string Signature { get; init; }
+
+    public required string Digest { get; init; }
+
+    public required long Sequence { get; init; }
+
+    public required DateTimeOffset IssuedAt { get; init; }
+
+    public string? SigningKeyId { get; init; }
+
+    public string? SigningProvider { get; init; }
+}

src/Cli/StellaOps.Cli/Services/Models/ExcititorExportDownloadResult.cs

@@ -0,0 +1,6 @@
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed record ExcititorExportDownloadResult(
+    string Path,
+    long SizeBytes,
+    bool FromCache);

src/Cli/StellaOps.Cli/Services/Models/ExcititorOperationResult.cs

@@ -0,0 +1,9 @@
+using System.Text.Json;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed record ExcititorOperationResult(
+    bool Success,
+    string Message,
+    string? Location,
+    JsonElement? Payload);

src/Cli/StellaOps.Cli/Services/Models/ExcititorProviderSummary.cs

@@ -0,0 +1,11 @@
+using System;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed record ExcititorProviderSummary(
+    string Id,
+    string Kind,
+    string DisplayName,
+    string TrustTier,
+    bool Enabled,
+    DateTimeOffset? LastIngestedAt);

src/Cli/StellaOps.Cli/Services/Models/JobTriggerResult.cs

@@ -0,0 +1,9 @@
+using StellaOps.Cli.Services.Models.Transport;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed record JobTriggerResult(
+    bool Success,
+    string Message,
+    string? Location,
+    JobRunResponse? Run);

src/Cli/StellaOps.Cli/Services/Models/OfflineKitModels.cs

@@ -0,0 +1,111 @@
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed record OfflineKitBundleDescriptor(
+    string BundleId,
+    string BundleName,
+    string BundleSha256,
+    long BundleSize,
+    Uri BundleDownloadUri,
+    string ManifestName,
+    string ManifestSha256,
+    Uri ManifestDownloadUri,
+    DateTimeOffset CapturedAt,
+    string? Channel,
+    string? Kind,
+    bool IsDelta,
+    string? BaseBundleId,
+    string? BundleSignatureName,
+    Uri? BundleSignatureDownloadUri,
+    string? ManifestSignatureName,
+    Uri? ManifestSignatureDownloadUri,
+    long? ManifestSize);
+
+internal sealed record OfflineKitDownloadResult(
+    OfflineKitBundleDescriptor Descriptor,
+    string BundlePath,
+    string ManifestPath,
+    string? BundleSignaturePath,
+    string? ManifestSignaturePath,
+    string MetadataPath,
+    bool FromCache);
+
+internal sealed record OfflineKitImportRequest(
+    string BundlePath,
+    string? ManifestPath,
+    string? BundleSignaturePath,
+    string? ManifestSignaturePath,
+    string? BundleId,
+    string? BundleSha256,
+    long? BundleSize,
+    DateTimeOffset? CapturedAt,
+    string? Channel,
+    string? Kind,
+    bool? IsDelta,
+    string? BaseBundleId,
+    string? ManifestSha256,
+    long? ManifestSize);
+
+internal sealed record OfflineKitImportResult(
+    string? ImportId,
+    string? Status,
+    DateTimeOffset SubmittedAt,
+    string? Message);
+
+internal sealed record OfflineKitStatus(
+    string? BundleId,
+    string? Channel,
+    string? Kind,
+    bool IsDelta,
+    string? BaseBundleId,
+    DateTimeOffset? CapturedAt,
+    DateTimeOffset? ImportedAt,
+    string? BundleSha256,
+    long? BundleSize,
+    IReadOnlyList<OfflineKitComponentStatus> Components);
+
+internal sealed record OfflineKitComponentStatus(
+    string Name,
+    string? Version,
+    string? Digest,
+    DateTimeOffset? CapturedAt,
+    long? SizeBytes);
+
+internal sealed record OfflineKitMetadataDocument
+{
+    public string? BundleId { get; init; }
+
+    public string BundleName { get; init; } = string.Empty;
+
+    public string BundleSha256 { get; init; } = string.Empty;
+
+    public long BundleSize { get; init; }
+
+    public string BundlePath { get; init; } = string.Empty;
+
+    public DateTimeOffset CapturedAt { get; init; }
+
+    public DateTimeOffset DownloadedAt { get; init; }
+
+    public string? Channel { get; init; }
+
+    public string? Kind { get; init; }
+
+    public bool IsDelta { get; init; }
+
+    public string? BaseBundleId { get; init; }
+
+    public string ManifestName { get; init; } = string.Empty;
+
+    public string ManifestSha256 { get; init; } = string.Empty;
+
+    public long? ManifestSize { get; init; }
+
+    public string ManifestPath { get; init; } = string.Empty;
+
+    public string? BundleSignaturePath { get; init; }
+
+    public string? ManifestSignaturePath { get; init; }
+}

src/Cli/StellaOps.Cli/Services/Models/PolicyActivationModels.cs

@@ -0,0 +1,30 @@
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed record PolicyActivationRequest(
+    bool RunNow,
+    DateTimeOffset? ScheduledAt,
+    string? Priority,
+    bool Rollback,
+    string? IncidentId,
+    string? Comment);
+
+internal sealed record PolicyActivationResult(
+    string Status,
+    PolicyActivationRevision Revision);
+
+internal sealed record PolicyActivationRevision(
+    string PolicyId,
+    int Version,
+    string Status,
+    bool RequiresTwoPersonApproval,
+    DateTimeOffset CreatedAt,
+    DateTimeOffset? ActivatedAt,
+    IReadOnlyList<PolicyActivationApproval> Approvals);
+
+internal sealed record PolicyActivationApproval(
+    string ActorId,
+    DateTimeOffset ApprovedAt,
+    string? Comment);

src/Cli/StellaOps.Cli/Services/Models/PolicyFindingsModels.cs

@@ -0,0 +1,50 @@
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed record PolicyFindingsQuery(
+    string PolicyId,
+    IReadOnlyList<string> SbomIds,
+    IReadOnlyList<string> Statuses,
+    IReadOnlyList<string> Severities,
+    string? Cursor,
+    int? Page,
+    int? PageSize,
+    DateTimeOffset? Since);
+
+internal sealed record PolicyFindingsPage(
+    IReadOnlyList<PolicyFindingDocument> Items,
+    string? NextCursor,
+    int? TotalCount);
+
+internal sealed record PolicyFindingDocument(
+    string FindingId,
+    string Status,
+    PolicyFindingSeverity Severity,
+    string SbomId,
+    IReadOnlyList<string> AdvisoryIds,
+    PolicyFindingVexMetadata? Vex,
+    int PolicyVersion,
+    DateTimeOffset UpdatedAt,
+    string? RunId);
+
+internal sealed record PolicyFindingSeverity(string Normalized, double? Score);
+
+internal sealed record PolicyFindingVexMetadata(string? WinningStatementId, string? Source, string? Status);
+
+internal sealed record PolicyFindingExplainResult(
+    string FindingId,
+    int PolicyVersion,
+    IReadOnlyList<PolicyFindingExplainStep> Steps,
+    IReadOnlyList<PolicyFindingExplainHint> SealedHints);
+
+internal sealed record PolicyFindingExplainStep(
+    string Rule,
+    string? Status,
+    string? Action,
+    double? Score,
+    IReadOnlyDictionary<string, string> Inputs,
+    IReadOnlyDictionary<string, string>? Evidence);
+
+internal sealed record PolicyFindingExplainHint(string Message);

src/Cli/StellaOps.Cli/Services/Models/PolicySimulationModels.cs

@@ -0,0 +1,26 @@
+using System.Collections.Generic;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed record PolicySimulationInput(
+    int? BaseVersion,
+    int? CandidateVersion,
+    IReadOnlyList<string> SbomSet,
+    IReadOnlyDictionary<string, object?> Environment,
+    bool Explain);
+
+internal sealed record PolicySimulationResult(
+    PolicySimulationDiff Diff,
+    string? ExplainUri);
+
+internal sealed record PolicySimulationDiff(
+    string? SchemaVersion,
+    int Added,
+    int Removed,
+    int Unchanged,
+    IReadOnlyDictionary<string, PolicySimulationSeverityDelta> BySeverity,
+    IReadOnlyList<PolicySimulationRuleDelta> RuleHits);
+
+internal sealed record PolicySimulationSeverityDelta(int? Up, int? Down);
+
+internal sealed record PolicySimulationRuleDelta(string RuleId, string RuleName, int? Up, int? Down);

src/Cli/StellaOps.Cli/Services/Models/RuntimePolicyEvaluationModels.cs

@@ -0,0 +1,25 @@
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed record RuntimePolicyEvaluationRequest(
+    string? Namespace,
+    IReadOnlyDictionary<string, string> Labels,
+    IReadOnlyList<string> Images);
+
+internal sealed record RuntimePolicyEvaluationResult(
+    int TtlSeconds,
+    DateTimeOffset? ExpiresAtUtc,
+    string? PolicyRevision,
+    IReadOnlyDictionary<string, RuntimePolicyImageDecision> Decisions);
+
+internal sealed record RuntimePolicyImageDecision(
+    string PolicyVerdict,
+    bool? Signed,
+    bool? HasSbomReferrers,
+    IReadOnlyList<string> Reasons,
+    RuntimePolicyRekorReference? Rekor,
+    IReadOnlyDictionary<string, object?> AdditionalProperties);
+
+internal sealed record RuntimePolicyRekorReference(string? Uuid, string? Url, bool? Verified);

src/Cli/StellaOps.Cli/Services/Models/ScannerArtifactResult.cs

@@ -0,0 +1,3 @@
+namespace StellaOps.Cli.Services.Models;
+
+internal sealed record ScannerArtifactResult(string Path, long SizeBytes, bool FromCache);

src/Cli/StellaOps.Cli/Services/Models/Transport/JobRunResponse.cs

@@ -0,0 +1,27 @@
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Cli.Services.Models.Transport;
+
+internal sealed class JobRunResponse
+{
+    public Guid RunId { get; set; }
+
+    public string Kind { get; set; } = string.Empty;
+
+    public string Status { get; set; } = string.Empty;
+
+    public string Trigger { get; set; } = string.Empty;
+
+    public DateTimeOffset CreatedAt { get; set; }
+
+    public DateTimeOffset? StartedAt { get; set; }
+
+    public DateTimeOffset? CompletedAt { get; set; }
+
+    public string? Error { get; set; }
+
+    public TimeSpan? Duration { get; set; }
+
+    public IReadOnlyDictionary<string, object?> Parameters { get; set; } = new Dictionary<string, object?>(StringComparer.Ordinal);
+}

src/Cli/StellaOps.Cli/Services/Models/Transport/JobTriggerRequest.cs

@@ -0,0 +1,10 @@
+using System.Collections.Generic;
+
+namespace StellaOps.Cli.Services.Models.Transport;
+
+internal sealed class JobTriggerRequest
+{
+    public string Trigger { get; set; } = "cli";
+
+    public Dictionary<string, object?> Parameters { get; set; } = new(StringComparer.Ordinal);
+}

src/Cli/StellaOps.Cli/Services/Models/Transport/OfflineKitTransport.cs

@@ -0,0 +1,103 @@
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Cli.Services.Models.Transport;
+
+internal sealed class OfflineKitBundleDescriptorTransport
+{
+    public string? BundleId { get; set; }
+
+    public string? BundleName { get; set; }
+
+    public string? BundleSha256 { get; set; }
+
+    public long BundleSize { get; set; }
+
+    public string? BundleUrl { get; set; }
+
+    public string? BundlePath { get; set; }
+
+    public string? BundleSignatureName { get; set; }
+
+    public string? BundleSignatureUrl { get; set; }
+
+    public string? BundleSignaturePath { get; set; }
+
+    public string? ManifestName { get; set; }
+
+    public string? ManifestSha256 { get; set; }
+
+    public long? ManifestSize { get; set; }
+
+    public string? ManifestUrl { get; set; }
+
+    public string? ManifestPath { get; set; }
+
+    public string? ManifestSignatureName { get; set; }
+
+    public string? ManifestSignatureUrl { get; set; }
+
+    public string? ManifestSignaturePath { get; set; }
+
+    public DateTimeOffset? CapturedAt { get; set; }
+
+    public string? Channel { get; set; }
+
+    public string? Kind { get; set; }
+
+    public bool? IsDelta { get; set; }
+
+    public string? BaseBundleId { get; set; }
+}
+
+internal sealed class OfflineKitStatusBundleTransport
+{
+    public string? BundleId { get; set; }
+
+    public string? Channel { get; set; }
+
+    public string? Kind { get; set; }
+
+    public bool? IsDelta { get; set; }
+
+    public string? BaseBundleId { get; set; }
+
+    public string? BundleSha256 { get; set; }
+
+    public long? BundleSize { get; set; }
+
+    public DateTimeOffset? CapturedAt { get; set; }
+
+    public DateTimeOffset? ImportedAt { get; set; }
+}
+
+internal sealed class OfflineKitStatusTransport
+{
+    public OfflineKitStatusBundleTransport? Current { get; set; }
+
+    public List<OfflineKitComponentStatusTransport>? Components { get; set; }
+}
+
+internal sealed class OfflineKitComponentStatusTransport
+{
+    public string? Name { get; set; }
+
+    public string? Version { get; set; }
+
+    public string? Digest { get; set; }
+
+    public DateTimeOffset? CapturedAt { get; set; }
+
+    public long? SizeBytes { get; set; }
+}
+
+internal sealed class OfflineKitImportResponseTransport
+{
+    public string? ImportId { get; set; }
+
+    public string? Status { get; set; }
+
+    public DateTimeOffset? SubmittedAt { get; set; }
+
+    public string? Message { get; set; }
+}

src/Cli/StellaOps.Cli/Services/Models/Transport/PolicyActivationTransport.cs

@@ -0,0 +1,52 @@
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Cli.Services.Models.Transport;
+
+internal sealed class PolicyActivationRequestDocument
+{
+    public string? Comment { get; set; }
+
+    public bool? RunNow { get; set; }
+
+    public DateTimeOffset? ScheduledAt { get; set; }
+
+    public string? Priority { get; set; }
+
+    public bool? Rollback { get; set; }
+
+    public string? IncidentId { get; set; }
+}
+
+internal sealed class PolicyActivationResponseDocument
+{
+    public string? Status { get; set; }
+
+    public PolicyActivationRevisionDocument? Revision { get; set; }
+}
+
+internal sealed class PolicyActivationRevisionDocument
+{
+    public string? PackId { get; set; }
+
+    public int? Version { get; set; }
+
+    public string? Status { get; set; }
+
+    public bool? RequiresTwoPersonApproval { get; set; }
+
+    public DateTimeOffset? CreatedAt { get; set; }
+
+    public DateTimeOffset? ActivatedAt { get; set; }
+
+    public List<PolicyActivationApprovalDocument>? Approvals { get; set; }
+}
+
+internal sealed class PolicyActivationApprovalDocument
+{
+    public string? ActorId { get; set; }
+
+    public DateTimeOffset? ApprovedAt { get; set; }
+
+    public string? Comment { get; set; }
+}

src/Cli/StellaOps.Cli/Services/Models/Transport/PolicyFindingsTransport.cs

@@ -0,0 +1,82 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+
+namespace StellaOps.Cli.Services.Models.Transport;
+
+internal sealed class PolicyFindingsResponseDocument
+{
+    public List<PolicyFindingDocumentDocument>? Items { get; set; }
+
+    public string? NextCursor { get; set; }
+
+    public int? TotalCount { get; set; }
+}
+
+internal sealed class PolicyFindingDocumentDocument
+{
+    public string? FindingId { get; set; }
+
+    public string? Status { get; set; }
+
+    public PolicyFindingSeverityDocument? Severity { get; set; }
+
+    public string? SbomId { get; set; }
+
+    public List<string>? AdvisoryIds { get; set; }
+
+    public PolicyFindingVexDocument? Vex { get; set; }
+
+    public int? PolicyVersion { get; set; }
+
+    public DateTimeOffset? UpdatedAt { get; set; }
+
+    public string? RunId { get; set; }
+}
+
+internal sealed class PolicyFindingSeverityDocument
+{
+    public string? Normalized { get; set; }
+
+    public double? Score { get; set; }
+}
+
+internal sealed class PolicyFindingVexDocument
+{
+    public string? WinningStatementId { get; set; }
+
+    public string? Source { get; set; }
+
+    public string? Status { get; set; }
+}
+
+internal sealed class PolicyFindingExplainResponseDocument
+{
+    public string? FindingId { get; set; }
+
+    public int? PolicyVersion { get; set; }
+
+    public List<PolicyFindingExplainStepDocument>? Steps { get; set; }
+
+    public List<PolicyFindingExplainHintDocument>? SealedHints { get; set; }
+}
+
+internal sealed class PolicyFindingExplainStepDocument
+{
+    public string? Rule { get; set; }
+
+    public string? Status { get; set; }
+
+    public string? Action { get; set; }
+
+    public double? Score { get; set; }
+
+    public Dictionary<string, JsonElement>? Inputs { get; set; }
+
+    public Dictionary<string, JsonElement>? Evidence { get; set; }
+}
+
+internal sealed class PolicyFindingExplainHintDocument
+{
+    public string? Message { get; set; }
+}

src/Cli/StellaOps.Cli/Services/Models/Transport/PolicySimulationTransport.cs

@@ -0,0 +1,57 @@
+using System.Collections.Generic;
+using System.Text.Json;
+
+namespace StellaOps.Cli.Services.Models.Transport;
+
+internal sealed class PolicySimulationRequestDocument
+{
+    public int? BaseVersion { get; set; }
+
+    public int? CandidateVersion { get; set; }
+
+    public IReadOnlyList<string>? SbomSet { get; set; }
+
+    public Dictionary<string, JsonElement>? Env { get; set; }
+
+    public bool? Explain { get; set; }
+}
+
+internal sealed class PolicySimulationResponseDocument
+{
+    public PolicySimulationDiffDocument? Diff { get; set; }
+
+    public string? ExplainUri { get; set; }
+}
+
+internal sealed class PolicySimulationDiffDocument
+{
+    public string? SchemaVersion { get; set; }
+
+    public int? Added { get; set; }
+
+    public int? Removed { get; set; }
+
+    public int? Unchanged { get; set; }
+
+    public Dictionary<string, PolicySimulationSeverityDeltaDocument>? BySeverity { get; set; }
+
+    public List<PolicySimulationRuleDeltaDocument>? RuleHits { get; set; }
+}
+
+internal sealed class PolicySimulationSeverityDeltaDocument
+{
+    public int? Up { get; set; }
+
+    public int? Down { get; set; }
+}
+
+internal sealed class PolicySimulationRuleDeltaDocument
+{
+    public string? RuleId { get; set; }
+
+    public string? RuleName { get; set; }
+
+    public int? Up { get; set; }
+
+    public int? Down { get; set; }
+}

src/Cli/StellaOps.Cli/Services/Models/Transport/ProblemDocument.cs

@@ -0,0 +1,18 @@
+using System.Collections.Generic;
+
+namespace StellaOps.Cli.Services.Models.Transport;
+
+internal sealed class ProblemDocument
+{
+    public string? Type { get; set; }
+
+    public string? Title { get; set; }
+
+    public string? Detail { get; set; }
+
+    public int? Status { get; set; }
+
+    public string? Instance { get; set; }
+
+    public Dictionary<string, object?>? Extensions { get; set; }
+}

src/Cli/StellaOps.Cli/Services/Models/Transport/RuntimePolicyEvaluationTransport.cs

@@ -0,0 +1,72 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Cli.Services.Models.Transport;
+
+internal sealed class RuntimePolicyEvaluationRequestDocument
+{
+    [JsonPropertyName("namespace")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    public string? Namespace { get; set; }
+
+    [JsonPropertyName("labels")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    public Dictionary<string, string>? Labels { get; set; }
+
+    [JsonPropertyName("images")]
+    public List<string> Images { get; set; } = new();
+}
+
+internal sealed class RuntimePolicyEvaluationResponseDocument
+{
+    [JsonPropertyName("ttlSeconds")]
+    public int? TtlSeconds { get; set; }
+
+    [JsonPropertyName("expiresAtUtc")]
+    public DateTimeOffset? ExpiresAtUtc { get; set; }
+
+    [JsonPropertyName("policyRevision")]
+    public string? PolicyRevision { get; set; }
+
+    [JsonPropertyName("results")]
+    public Dictionary<string, RuntimePolicyEvaluationImageDocument>? Results { get; set; }
+}
+
+internal sealed class RuntimePolicyEvaluationImageDocument
+{
+    [JsonPropertyName("policyVerdict")]
+    public string? PolicyVerdict { get; set; }
+
+    [JsonPropertyName("signed")]
+    public bool? Signed { get; set; }
+
+    [JsonPropertyName("hasSbomReferrers")]
+    public bool? HasSbomReferrers { get; set; }
+
+    // Legacy field kept for pre-contract-sync services.
+    [JsonPropertyName("hasSbom")]
+    public bool? HasSbomLegacy { get; set; }
+
+    [JsonPropertyName("reasons")]
+    public List<string>? Reasons { get; set; }
+
+    [JsonPropertyName("rekor")]
+    public RuntimePolicyRekorDocument? Rekor { get; set; }
+
+    [JsonExtensionData]
+    public Dictionary<string, JsonElement>? ExtensionData { get; set; }
+}
+
+internal sealed class RuntimePolicyRekorDocument
+{
+    [JsonPropertyName("uuid")]
+    public string? Uuid { get; set; }
+
+    [JsonPropertyName("url")]
+    public string? Url { get; set; }
+
+    [JsonPropertyName("verified")]
+    public bool? Verified { get; set; }
+}