diff --git a/src/api/contracts/models.ts b/src/api/contracts/models.ts
new file mode 100644
index 0000000..74ef10c
--- /dev/null
+++ b/src/api/contracts/models.ts
@@ -0,0 +1,243 @@
+import type { Permission } from "@/lib/permissions";
+
+export type Status = "healthy" | "warning" | "critical" | "maintenance" | "disabled";
+
+export type User = {
+  id: string;
+  name: string;
+  email: string;
+  role: string;
+  permissions: Permission[];
+  lastLogin: string;
+  avatarInitials: string;
+  twoFactorEnabled: boolean;
+};
+
+export type HostingAccount = {
+  id: string;
+  username: string;
+  primaryDomain: string;
+  homeDirectory: string;
+  sharedIp: string;
+  dedicatedIp?: string;
+  theme: "system" | "light" | "dark";
+};
+
+export type Server = {
+  id: string;
+  name: string;
+  hostname: string;
+  os: string;
+  panelVersion: string;
+  load: [number, number, number];
+  ipAddress: string;
+  status: Status;
+  location: string;
+};
+
+export type Website = {
+  id: string;
+  name: string;
+  domain: string;
+  runtime:
+    | "Static"
+    | "PHP"
+    | "Node.js"
+    | "Python"
+    | "Ruby"
+    | "Docker"
+    | "Reverse proxy"
+    | "Custom service";
+  status: Status;
+  ssl: Status;
+  repository?: string;
+  environment: "production" | "staging";
+  cpuLimit: string;
+  memoryLimit: string;
+  lastDeployment: string;
+};
+
+export type Domain = {
+  id: string;
+  name: string;
+  type: "primary" | "addon" | "alias" | "subdomain" | "parked";
+  documentRoot: string;
+  sslStatus: Status;
+  dnssec: boolean;
+  propagation: number;
+};
+
+export type DnsRecord = {
+  id: string;
+  name: string;
+  ttl: number;
+  class: "IN";
+  type: "A" | "AAAA" | "CNAME" | "MX" | "TXT" | "SRV" | "CAA" | "NS" | "PTR";
+  record: string;
+  priority?: number;
+  warning?: string;
+};
+
+export type FileEntry = {
+  id: string;
+  name: string;
+  path: string;
+  type: "directory" | "file";
+  size: number;
+  modifiedAt: string;
+  owner: string;
+  permissions: string;
+  mime: string;
+  hidden?: boolean;
+};
+
+export type Database = {
+  id: string;
+  name: string;
+  engine: "MySQL" | "MariaDB" | "PostgreSQL";
+  size: number;
+  users: string[];
+  tables: number;
+  connections: number;
+  lastBackup: string;
+};
+
+export type Mailbox = {
+  id: string;
+  address: string;
+  domain: string;
+  used: number;
+  quota: number;
+  lastLogin: string;
+  forwarding: boolean;
+  spamScore: number;
+  authStatus: Status;
+};
+
+export type ResourceUsage = {
+  key: string;
+  label: string;
+  used: number;
+  limit: number;
+  unit: string;
+  status: Status;
+};
+
+export type ServiceStatus = {
+  name: string;
+  status: Status;
+  uptime: string;
+  detail: string;
+};
+
+export type MetricPoint = {
+  timestamp: string;
+  cpu: number;
+  memory: number;
+  disk: number;
+  bandwidth: number;
+  requests: number;
+};
+
+export type SecurityFinding = {
+  id: string;
+  severity: "critical" | "high" | "medium" | "low";
+  title: string;
+  target: string;
+  status: "open" | "acknowledged" | "resolved";
+  recommendation: string;
+};
+
+export type Backup = {
+  id: string;
+  name: string;
+  scope: "full" | "website" | "database" | "email" | "configuration" | "snapshot";
+  destination: string;
+  size: number;
+  status: Status;
+  encrypted: boolean;
+  createdAt: string;
+};
+
+export type Automation = {
+  id: string;
+  name: string;
+  trigger: string;
+  status: Status;
+  lastRun: string;
+  successRate: number;
+};
+
+export type Notification = {
+  id: string;
+  title: string;
+  category: "security" | "backup" | "resource" | "ssl" | "deployment" | "system";
+  read: boolean;
+  createdAt: string;
+  body: string;
+};
+
+export type AuditEntry = {
+  id: string;
+  actor: string;
+  action: string;
+  target: string;
+  ipAddress: string;
+  createdAt: string;
+  requestId: string;
+};
+
+export type RuntimeDefinition = {
+  id: string;
+  name: string;
+  versions: string[];
+  extensions: string[];
+  processManagers: string[];
+  environmentSchema: string[];
+};
+
+export type DatabaseAdminTool = {
+  id: "phpmyadmin" | "adminer" | "pgadmin";
+  name: string;
+  engine: string;
+  status: "available" | "planned" | "disabled";
+  launchUrl: string | null;
+  sso: boolean;
+  note: string;
+};
+
+export type NginxSite = {
+  id: string;
+  serverNames: string[];
+  listens: string[];
+  root: string | null;
+  proxyPasses: string[];
+  tls: boolean;
+  source: string;
+};
+
+export type DockerContainer = {
+  id: string;
+  name: string;
+  image: string;
+  status: string;
+  ports: string;
+};
+
+export type SystemDiscovery = {
+  detectedAt: string;
+  nginx: {
+    available: boolean;
+    sites: NginxSite[];
+    proxiedSites: NginxSite[];
+  };
+  docker: {
+    available: boolean;
+    containers: DockerContainer[];
+  };
+  currentPanel: {
+    hostname: string;
+    frontend: string;
+    backend: string;
+  };
+};