feat(scum): rebuild plugin-owned management data

platform/api/game_gift_handlers.go

@@ -1,141 +0,0 @@
-package api
-
-import (
-	"browser.local/platform/dto"
-	"browser.local/platform/repo"
-	"net/http"
-)
-
-// serverGameGiftCatalogs godoc
-// @Summary List or create SCUM versioned gift catalogs
-// @Description Manages bounded drafts that contain catalog references only, never raw game item commands.
-// @Tags game-gifts
-// @Produce json
-// @Router /api/v1/server-instances/{id}/game-gifts [get,post]
-func (h *coreHandlers) serverGameGiftCatalogs(w http.ResponseWriter, r *http.Request) {
-	switch r.Method {
-	case http.MethodGet:
-		values, err := h.core.ListGameGiftCatalogsForSession(bearerToken(r), r.PathValue("id"))
-		if err != nil {
-			writeServiceError(w, err)
-			return
-		}
-		writeJSON(w, http.StatusOK, dto.GameGiftCatalogsFromDomain(values))
-	case http.MethodPost:
-		request, err := decodeJSON[dto.GameGiftCatalogRequest](r)
-		if err != nil {
-			writeDecodeError(w, err)
-			return
-		}
-		value, err := h.core.SaveGameGiftCatalogForSession(bearerToken(r), r.PathValue("id"), request.ToDomain())
-		if err != nil {
-			writeServiceError(w, err)
-			return
-		}
-		writeJSON(w, http.StatusCreated, dto.GameGiftCatalogFromDomain(value))
-	default:
-		writeMethodNotAllowed(w, "GET, POST")
-	}
-}
-
-// serverGameGiftCatalogPublish godoc
-// @Summary Publish immutable SCUM gift revision
-// @Description Freezes a validated version-fenced gift draft.
-// @Tags game-gifts
-// @Produce json
-// @Router /api/v1/server-instances/{id}/game-gifts/{catalogId}/publish [post]
-func (h *coreHandlers) serverGameGiftCatalogPublish(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		writeMethodNotAllowed(w, http.MethodPost)
-		return
-	}
-	value, err := h.core.PublishGameGiftCatalogForSession(bearerToken(r), r.PathValue("catalogId"))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	if value.ServerInstanceID != r.PathValue("id") {
-		writeServiceError(w, repo.ErrNotFound)
-		return
-	}
-	writeJSON(w, http.StatusCreated, dto.GameGiftRevisionFromDomain(value))
-}
-
-// serverGameGiftCatalogRevisions godoc
-// @Summary List immutable SCUM gift revisions
-// @Tags game-gifts
-// @Produce json
-// @Router /api/v1/server-instances/{id}/game-gifts/{catalogId}/revisions [get]
-func (h *coreHandlers) serverGameGiftCatalogRevisions(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeMethodNotAllowed(w, http.MethodGet)
-		return
-	}
-	values, err := h.core.ListGameGiftRevisionsForSession(bearerToken(r), r.PathValue("catalogId"))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	for _, v := range values {
-		if v.ServerInstanceID != r.PathValue("id") {
-			writeServiceError(w, repo.ErrNotFound)
-			return
-		}
-	}
-	writeJSON(w, http.StatusOK, dto.GameGiftRevisionsFromDomain(values))
-}
-
-// serverGameGiftGrants godoc
-// @Summary List or request directed SCUM gift grants
-// @Description Creates frozen local-player grants for platform-admin approval without raw commands or item codes.
-// @Tags game-gifts
-// @Produce json
-// @Router /api/v1/server-instances/{id}/game-gift-grants [get,post]
-func (h *coreHandlers) serverGameGiftGrants(w http.ResponseWriter, r *http.Request) {
-	switch r.Method {
-	case http.MethodGet:
-		values, err := h.core.ListGameGiftGrantsForSession(bearerToken(r), r.PathValue("id"))
-		if err != nil {
-			writeServiceError(w, err)
-			return
-		}
-		writeJSON(w, http.StatusOK, dto.GameGiftGrantsFromDomain(values))
-	case http.MethodPost:
-		request, err := decodeJSON[dto.GameGiftGrantRequest](r)
-		if err != nil {
-			writeDecodeError(w, err)
-			return
-		}
-		value, err := h.core.RequestGameGiftGrantForSession(bearerToken(r), r.PathValue("id"), request.ToDomain())
-		if err != nil {
-			writeServiceError(w, err)
-			return
-		}
-		writeJSON(w, http.StatusAccepted, dto.GameGiftGrantFromDomain(value))
-	default:
-		writeMethodNotAllowed(w, "GET, POST")
-	}
-}
-
-// serverGameGiftGrantApprove godoc
-// @Summary Approve a frozen directed SCUM gift grant
-// @Description Requires a platform administrator and dispatches only the declared typed reward command.
-// @Tags game-gifts
-// @Produce json
-// @Router /api/v1/server-instances/{id}/game-gift-grants/{grantId}/approve [post]
-func (h *coreHandlers) serverGameGiftGrantApprove(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		writeMethodNotAllowed(w, http.MethodPost)
-		return
-	}
-	value, err := h.core.ApproveGameGiftGrantForSession(bearerToken(r), r.PathValue("grantId"))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	if value.ServerInstanceID != r.PathValue("id") {
-		writeServiceError(w, repo.ErrNotFound)
-		return
-	}
-	writeJSON(w, http.StatusAccepted, dto.GameGiftGrantFromDomain(value))
-}

platform/api/game_map_trajectory_handlers.go

@@ -1,66 +0,0 @@
-package api
-
-import (
-	"net/http"
-	"strings"
-	"time"
-
-	"browser.local/platform/domain"
-	"browser.local/platform/dto"
-)
-
-// serverGameMapTrajectories godoc
-// @Summary Read bounded SCUM map trajectories
-// @Description Returns only authorized safe map projections, never raw logs, world coordinates, paths, or Companion connection material.
-// @Tags game-map-trajectories
-// @Produce json
-// @Param id path string true "Server instance ID"
-// @Param from query string false "RFC3339 window start"
-// @Param to query string false "RFC3339 window end"
-// @Param playerId query string false "Comma-separated game player record IDs"
-// @Param vehicleId query string false "Comma-separated vehicle IDs"
-// @Success 200 {object} dto.GameMapTrajectoryResponse
-// @Failure 401 {object} dto.ErrorResponse
-// @Failure 403 {object} dto.ErrorResponse
-// @Failure 400 {object} dto.ErrorResponse
-// @Router /api/v1/server-instances/{id}/game-map-trajectories [get]
-func (h *coreHandlers) serverGameMapTrajectories(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeMethodNotAllowed(w, http.MethodGet)
-		return
-	}
-	from, err := mapTrajectoryTime(r.URL.Query().Get("from"))
-	if err != nil {
-		writeAPIError(w, http.StatusBadRequest, errorCodeBadRequest, "invalid map trajectory from time", nil)
-		return
-	}
-	to, err := mapTrajectoryTime(r.URL.Query().Get("to"))
-	if err != nil {
-		writeAPIError(w, http.StatusBadRequest, errorCodeBadRequest, "invalid map trajectory to time", nil)
-		return
-	}
-	value, err := h.core.GetGameMapTrajectoriesForSession(bearerToken(r), domain.GameMapTrajectoryQuery{ServerInstanceID: r.PathValue("id"), From: from, To: to, PlayerRecordIDs: mapTrajectoryIDs(r.URL.Query().Get("playerId")), VehicleIDs: mapTrajectoryIDs(r.URL.Query().Get("vehicleId"))})
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	writeJSON(w, http.StatusOK, dto.GameMapTrajectoryFromDomain(value))
-}
-func mapTrajectoryTime(value string) (time.Time, error) {
-	if strings.TrimSpace(value) == "" {
-		return time.Time{}, nil
-	}
-	return time.Parse(time.RFC3339, value)
-}
-func mapTrajectoryIDs(value string) []string {
-	if strings.TrimSpace(value) == "" {
-		return nil
-	}
-	result := []string{}
-	for _, item := range strings.Split(value, ",") {
-		if item = strings.TrimSpace(item); item != "" {
-			result = append(result, item)
-		}
-	}
-	return result
-}

platform/api/game_player_handlers.go

@@ -1,139 +0,0 @@
-package api
-
-import (
-	"browser.local/platform/domain"
-	"browser.local/platform/dto"
-	"browser.local/platform/repo"
-	"net/http"
-	"strconv"
-)
-
-// serverGamePlayerState godoc
-// @Summary Get current SCUM player state
-// @Description Returns a version-scoped, browser-safe player-state snapshot; it never exposes a game database or raw storage fields.
-// @Tags game-players
-// @Produce json
-// @Success 200 {object} dto.GamePlayerStateResponse
-// @Router /api/v1/server-instances/{id}/game-players/{playerId}/state [get]
-func (h *coreHandlers) serverGamePlayerState(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeMethodNotAllowed(w, http.MethodGet)
-		return
-	}
-	state, err := h.core.GetGamePlayerStateForSession(bearerToken(r), r.PathValue("playerId"))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	if state.ServerInstanceID != r.PathValue("id") {
-		writeServiceError(w, repo.ErrNotFound)
-		return
-	}
-	writeJSON(w, http.StatusOK, dto.GamePlayerStateFromDomain(state))
-}
-
-// serverGamePlayerStatePatches godoc
-// @Summary Request or list controlled SCUM player state patches
-// @Description Creates reviewable skill/attribute patch requests only through the typed game-client bridge channel.
-// @Tags game-players
-// @Accept json
-// @Produce json
-// @Success 202 {object} dto.GamePlayerStatePatchResponse
-// @Router /api/v1/server-instances/{id}/game-players/{playerId}/state-patches [get,post]
-func (h *coreHandlers) serverGamePlayerStatePatches(w http.ResponseWriter, r *http.Request) {
-	switch r.Method {
-	case http.MethodGet:
-		patches, err := h.core.ListGamePlayerStatePatchesForSession(bearerToken(r), r.PathValue("playerId"))
-		if err != nil {
-			writeServiceError(w, err)
-			return
-		}
-		writeJSON(w, http.StatusOK, dto.GamePlayerStatePatchesFromDomain(patches))
-	case http.MethodPost:
-		request, err := decodeJSON[dto.GamePlayerStatePatchRequest](r)
-		if err != nil {
-			writeDecodeError(w, err)
-			return
-		}
-		patch, err := h.core.RequestGamePlayerStatePatchForSession(bearerToken(r), r.PathValue("playerId"), request.ToDomain())
-		if err != nil {
-			writeServiceError(w, err)
-			return
-		}
-		writeJSON(w, http.StatusAccepted, dto.GamePlayerStatePatchFromDomain(patch))
-	default:
-		writeAPIError(w, http.StatusMethodNotAllowed, errorCodeMethodNotAllowed, "method not allowed", nil)
-	}
-}
-
-// serverGamePlayerStatePatchApprove godoc
-// @Summary Approve a controlled SCUM player state patch
-// @Description Requires a platform administrator with access to the target server and dispatches only the declared typed bridge command.
-// @Tags game-players
-// @Produce json
-// @Success 202 {object} dto.GamePlayerStatePatchResponse
-// @Router /api/v1/server-instances/{id}/game-players/{playerId}/state-patches/{patchId}/approve [post]
-func (h *coreHandlers) serverGamePlayerStatePatchApprove(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		writeMethodNotAllowed(w, http.MethodPost)
-		return
-	}
-	patch, err := h.core.ApproveGamePlayerStatePatchForSession(bearerToken(r), r.PathValue("patchId"))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	if patch.ServerInstanceID != r.PathValue("id") || patch.GamePlayerRecordID != r.PathValue("playerId") {
-		writeServiceError(w, repo.ErrNotFound)
-		return
-	}
-	writeJSON(w, http.StatusAccepted, dto.GamePlayerStatePatchFromDomain(patch))
-}
-
-// serverGamePlayers godoc
-// @Summary List server-local game players
-// @Description Returns privacy-safe SCUM game player records visible to the current server operator.
-// @Tags game-players
-// @Produce json
-// @Success 200 {object} dto.GamePlayerListResponse
-// @Failure 401 {object} dto.ErrorResponse
-// @Failure 403 {object} dto.ErrorResponse
-// @Router /api/v1/server-instances/{id}/game-players [get]
-func (h *coreHandlers) serverGamePlayers(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeMethodNotAllowed(w, http.MethodGet)
-		return
-	}
-	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
-	values, err := h.core.ListGamePlayersForSession(bearerToken(r), domain.GamePlayerFilter{ServerInstanceID: r.PathValue("id"), Search: r.URL.Query().Get("search"), Limit: limit})
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	writeJSON(w, http.StatusOK, dto.GamePlayerListFromDomain(values))
-}
-
-// serverGamePlayerDetail godoc
-// @Summary Get server-local game player profile
-// @Description Returns aliases, session trajectory, access attempts, and manual-review signals without network identifiers.
-// @Tags game-players
-// @Produce json
-// @Success 200 {object} dto.GamePlayerProfileResponse
-// @Failure 404 {object} dto.ErrorResponse
-// @Router /api/v1/server-instances/{id}/game-players/{playerId} [get]
-func (h *coreHandlers) serverGamePlayerDetail(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeMethodNotAllowed(w, http.MethodGet)
-		return
-	}
-	value, err := h.core.GetGamePlayerProfileForSession(bearerToken(r), r.PathValue("playerId"))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	if value.Player.ServerInstanceID != r.PathValue("id") {
-		writeServiceError(w, repo.ErrNotFound)
-		return
-	}
-	writeJSON(w, http.StatusOK, dto.GamePlayerProfileFromDomain(value))
-}

platform/api/plugin_data_handlers.go

@@ -2,7 +2,6 @@ package api
 
 import (
 	"net/http"
-	"strconv"
 
 	"browser.local/platform/domain"
 	"browser.local/platform/dto"
@@ -41,10 +40,38 @@ func (h *coreHandlers) serverPluginDataCollection(w http.ResponseWriter, r *http
 			return
 		}
 		writeJSON(w, http.StatusOK, dto.PluginDataRecordFromDomain(value))
+	case http.MethodDelete:
+		if err := h.core.DeletePluginDataForSession(bearerToken(r), instance.PluginID, instance.ID, collection, r.URL.Query().Get("key")); err != nil {
+			writeServiceError(w, err)
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
 	default:
-		w.Header().Set("Allow", http.MethodGet+", "+http.MethodPut)
+		w.Header().Set("Allow", http.MethodGet+", "+http.MethodPut+", "+http.MethodDelete)
 		writeAPIError(w, http.StatusMethodNotAllowed, errorCodeMethodNotAllowed, "method not allowed", nil)
 	}
 }
 
-var _ = strconv.IntSize
+func (h *coreHandlers) serverPluginDataTransaction(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		w.Header().Set("Allow", http.MethodPost)
+		writeAPIError(w, http.StatusMethodNotAllowed, errorCodeMethodNotAllowed, "method not allowed", nil)
+		return
+	}
+	instance, err := h.core.GetServerInstanceForSession(bearerToken(r), r.PathValue("id"))
+	if err != nil {
+		writeServiceError(w, err)
+		return
+	}
+	request, err := decodeJSON[dto.PluginDataTransactionRequest](r)
+	if err != nil {
+		writeDecodeError(w, err)
+		return
+	}
+	values, err := h.core.ApplyPluginDataTransactionForSession(bearerToken(r), request.ToDomain(instance.PluginID, instance.ID, r.PathValue("collection")))
+	if err != nil {
+		writeServiceError(w, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, dto.PluginDataRecordsFromDomain(values))
+}

platform/api/resource_handlers.go

@@ -93,27 +93,7 @@ func (h *coreHandlers) register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/server-instances/{id}/game-client-bridge/commands/{commandId}", h.serverGameClientBridgeCommandDetail)
 	mux.HandleFunc("/api/v1/server-instances/{id}/game-client-bridge/snapshots", h.serverGameClientBridgeSnapshots)
 	mux.HandleFunc("/api/v1/server-instances/{id}/plugin-data/{collection}", h.serverPluginDataCollection)
-	mux.HandleFunc("/api/v1/server-instances/{id}/game-players", h.serverGamePlayers)
-	mux.HandleFunc("/api/v1/server-instances/{id}/game-players/{playerId}", h.serverGamePlayerDetail)
-	mux.HandleFunc("/api/v1/server-instances/{id}/game-players/{playerId}/state", h.serverGamePlayerState)
-	mux.HandleFunc("/api/v1/server-instances/{id}/game-players/{playerId}/state-patches", h.serverGamePlayerStatePatches)
-	mux.HandleFunc("/api/v1/server-instances/{id}/game-players/{playerId}/state-patches/{patchId}/approve", h.serverGamePlayerStatePatchApprove)
-	mux.HandleFunc("/api/v1/server-instances/{id}/game-map-trajectories", h.serverGameMapTrajectories)
-	mux.HandleFunc("/api/v1/server-instances/{id}/game-gifts", h.serverGameGiftCatalogs)
-	mux.HandleFunc("/api/v1/server-instances/{id}/game-gifts/{catalogId}/publish", h.serverGameGiftCatalogPublish)
-	mux.HandleFunc("/api/v1/server-instances/{id}/game-gifts/{catalogId}/revisions", h.serverGameGiftCatalogRevisions)
-	mux.HandleFunc("/api/v1/server-instances/{id}/game-gift-grants", h.serverGameGiftGrants)
-	mux.HandleFunc("/api/v1/server-instances/{id}/game-gift-grants/{grantId}/approve", h.serverGameGiftGrantApprove)
-	mux.HandleFunc("/api/v1/server-instances/{id}/scum/players", h.serverSCUMPlayers)
-	mux.HandleFunc("/api/v1/server-instances/{id}/scum/squads", h.serverSCUMSquads)
-	mux.HandleFunc("/api/v1/server-instances/{id}/scum/squad-members", h.serverSCUMSquadMembers)
-	mux.HandleFunc("/api/v1/server-instances/{id}/scum/vehicles", h.serverSCUMVehicles)
-	mux.HandleFunc("/api/v1/server-instances/{id}/scum/flags", h.serverSCUMFlags)
-	mux.HandleFunc("/api/v1/server-instances/{id}/scum/positions", h.serverSCUMPositions)
-	mux.HandleFunc("/api/v1/server-instances/{id}/scum/operations", h.serverSCUMOperations)
-	mux.HandleFunc("/api/v1/server-instances/{id}/scum/operations/{operationId}/approve", h.serverSCUMOperationApprove)
-	mux.HandleFunc("/api/v1/server-instances/{id}/scum/workflows", h.serverSCUMWorkflows)
-	mux.HandleFunc("/api/v1/server-instances/{id}/scum/workflow-steps", h.serverSCUMWorkflowSteps)
+	mux.HandleFunc("/api/v1/server-instances/{id}/plugin-data/{collection}/transaction", h.serverPluginDataTransaction)
 	mux.HandleFunc("/api/v1/server-instances/{id}/dependencies/check", h.serverDependenciesCheck)
 	mux.HandleFunc("/api/v1/server-instances/{id}/dependencies/install", h.serverDependenciesInstall)
 	mux.HandleFunc("/api/v1/server-instances/{id}/dependencies", h.serverDependencies)

platform/api/routes.md

@@ -17,7 +17,7 @@ All routes use JSON request and response bodies. Collection routes support `GET`
 | Server runtime distribution | n/a | `GET /api/v1/server-instances/{id}/runtime/actions`, `POST /api/v1/server-instances/{id}/run/generate`, `POST /api/v1/server-instances/{id}/run/download`, `POST /api/v1/server-instances/{id}/run/key/reset`, `POST /api/v1/server-instances/{id}/run/update`, `GET /api/v1/server-instances/{id}/run/update`, `POST /api/v1/server-instances/{id}/client-managers/generate`, `POST /api/v1/server-instances/{id}/client-managers/download`, `POST /api/v1/server-instances/{id}/client-managers/key/reset`, `GET /api/v1/server-instances/{id}/dependencies`, `POST /api/v1/server-instances/{id}/dependencies/check`, `POST /api/v1/server-instances/{id}/dependencies/install` | `ServerRuntimeActionsResponse`, `RunDistributionGenerateRequest`, `RunDistributionResponse`, `RunUpdateRequest`, `RunUpdateJobResponse`/`RunUpdateJobListResponse`, `ClientManagerBuildRequest`, `ClientManagerDistributionResponse`, `ClientManagerDownloadRequest`, `ComponentKeyResetRequest`, `ComponentKeyResponse`, `DependencyCatalogResponse`, `DependencyJobRequest` |
 | Metrics | `GET /api/v1/metrics/platform`, `GET /api/v1/metrics/server-instances` | n/a | `PlatformResourceUsageResponse`, `ServerMetricsResponse`, `ServerMetricsListResponse` |
 | File operations | `POST /api/v1/file-operations/dispatch` | n/a | `FileOperationDispatchRequest`, `FileOperationDispatchResponse` |
-| SCUM projections and workflows | n/a | `GET /api/v1/server-instances/{id}/scum/players`, `GET .../scum/squads`, `GET .../scum/squad-members`, `GET .../scum/vehicles`, `GET .../scum/flags`, `GET .../scum/positions`, `GET/POST .../scum/operations`, `POST .../scum/operations/{operationId}/approve`, `GET/POST .../scum/workflows`, `GET .../scum/workflow-steps` | `SCUM*Response`, `SCUMOperationRequestBody`, `SCUMWorkflowCreateRequest`, safe operation/workflow summaries |
+| Plugin-owned data | n/a | `GET/PUT/DELETE /api/v1/server-instances/{id}/plugin-data/{collection}`, `POST .../plugin-data/{collection}/transaction` | `PluginDataPutRequest`, `PluginDataTransactionRequest`, `PluginDataRecordResponse`, `PluginDataListResponse` |
 | Server administrators | `GET /api/v1/server-instances/{id}/administrators/candidates`, `POST /api/v1/server-instances/{id}/administrators` | `DELETE /api/v1/server-instances/{id}/administrators/{userId}` | `ServerMemberRequest`, `ServerMemberResponse`, `ServerMemberListResponse`, `ServerInstanceResponse` |
 | Run endpoints | `GET /api/v1/run/endpoints`, `POST /api/v1/run/endpoints` | `GET /api/v1/run/endpoints/{id}` | `RunEndpointCreateRequest`, `RunEndpointResponse`, `RunEndpointListResponse` |
 | Jobs | `GET /api/v1/jobs`, `POST /api/v1/jobs` | `GET /api/v1/jobs/{id}` | `JobCreateRequest`, `JobResponse`, `JobListResponse` |

platform/api/scum_handlers.go

@@ -1,201 +0,0 @@
-package api
-
-import (
-	"net/http"
-	"strconv"
-
-	"browser.local/platform/domain"
-	"browser.local/platform/dto"
-)
-
-func (h *coreHandlers) serverSCUMPlayers(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeMethodNotAllowed(w, http.MethodGet)
-		return
-	}
-	items, err := h.core.ListSCUMPlayerLiveStatesForSession(bearerToken(r), scumProjectionFilterFromRequest(r, r.PathValue("id")))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	writeJSON(w, http.StatusOK, dto.SCUMPlayerLiveStatesFromDomain(items))
-}
-
-func (h *coreHandlers) serverSCUMSquads(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeMethodNotAllowed(w, http.MethodGet)
-		return
-	}
-	items, err := h.core.ListSCUMSquadsForSession(bearerToken(r), scumProjectionFilterFromRequest(r, r.PathValue("id")))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	writeJSON(w, http.StatusOK, dto.SCUMSquadsFromDomain(items))
-}
-
-func (h *coreHandlers) serverSCUMSquadMembers(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeMethodNotAllowed(w, http.MethodGet)
-		return
-	}
-	items, err := h.core.ListSCUMSquadMembersForSession(bearerToken(r), scumProjectionFilterFromRequest(r, r.PathValue("id")))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	writeJSON(w, http.StatusOK, dto.SCUMSquadMembersFromDomain(items))
-}
-
-func (h *coreHandlers) serverSCUMVehicles(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeMethodNotAllowed(w, http.MethodGet)
-		return
-	}
-	items, err := h.core.ListSCUMVehiclesForSession(bearerToken(r), scumProjectionFilterFromRequest(r, r.PathValue("id")))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	writeJSON(w, http.StatusOK, dto.SCUMVehiclesFromDomain(items))
-}
-
-func (h *coreHandlers) serverSCUMFlags(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeMethodNotAllowed(w, http.MethodGet)
-		return
-	}
-	items, err := h.core.ListSCUMFlagsForSession(bearerToken(r), scumProjectionFilterFromRequest(r, r.PathValue("id")))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	writeJSON(w, http.StatusOK, dto.SCUMFlagsFromDomain(items))
-}
-
-func (h *coreHandlers) serverSCUMPositions(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeMethodNotAllowed(w, http.MethodGet)
-		return
-	}
-	items, err := h.core.ListSCUMCurrentPositionsForSession(bearerToken(r), scumProjectionFilterFromRequest(r, r.PathValue("id")))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	writeJSON(w, http.StatusOK, dto.SCUMCurrentPositionsFromDomain(items))
-}
-
-func (h *coreHandlers) serverSCUMOperations(w http.ResponseWriter, r *http.Request) {
-	serverID := r.PathValue("id")
-	switch r.Method {
-	case http.MethodGet:
-		items, err := h.core.ListSCUMOperationsForSession(bearerToken(r), scumOperationFilterFromRequest(r, serverID))
-		if err != nil {
-			writeServiceError(w, err)
-			return
-		}
-		writeJSON(w, http.StatusOK, dto.SCUMOperationsFromDomain(items))
-	case http.MethodPost:
-		request, err := decodeJSON[dto.SCUMOperationRequestBody](r)
-		if err != nil {
-			writeDecodeError(w, err)
-			return
-		}
-		operation, err := h.core.RequestSCUMOperationForSession(bearerToken(r), serverID, dto.SCUMOperationRequestBodyToDomain(request))
-		if err != nil {
-			writeServiceError(w, err)
-			return
-		}
-		writeJSON(w, http.StatusCreated, dto.SCUMOperationFromDomain(operation))
-	default:
-		writeMethodNotAllowed(w, "GET, POST")
-	}
-}
-
-func (h *coreHandlers) serverSCUMOperationApprove(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		writeMethodNotAllowed(w, http.MethodPost)
-		return
-	}
-	operation, err := h.core.ApproveSCUMOperationForSession(bearerToken(r), r.PathValue("operationId"))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	writeJSON(w, http.StatusOK, dto.SCUMOperationFromDomain(operation))
-}
-
-func (h *coreHandlers) serverSCUMWorkflows(w http.ResponseWriter, r *http.Request) {
-	serverID := r.PathValue("id")
-	switch r.Method {
-	case http.MethodGet:
-		items, err := h.core.ListSCUMWorkflowsForSession(bearerToken(r), scumWorkflowFilterFromRequest(r, serverID))
-		if err != nil {
-			writeServiceError(w, err)
-			return
-		}
-		writeJSON(w, http.StatusOK, dto.SCUMWorkflowsFromDomain(items))
-	case http.MethodPost:
-		request, err := decodeJSON[dto.SCUMWorkflowCreateRequest](r)
-		if err != nil {
-			writeDecodeError(w, err)
-			return
-		}
-		workflow, err := h.core.CreateSCUMWorkflowForSession(bearerToken(r), serverID, dto.SCUMWorkflowCreateRequestToDomain(request))
-		if err != nil {
-			writeServiceError(w, err)
-			return
-		}
-		writeJSON(w, http.StatusCreated, dto.SCUMWorkflowFromDomain(workflow))
-	default:
-		writeMethodNotAllowed(w, "GET, POST")
-	}
-}
-
-func (h *coreHandlers) serverSCUMWorkflowSteps(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		writeMethodNotAllowed(w, http.MethodGet)
-		return
-	}
-	items, err := h.core.ListSCUMWorkflowStepsForSession(bearerToken(r), scumWorkflowStepFilterFromRequest(r, r.PathValue("id")))
-	if err != nil {
-		writeServiceError(w, err)
-		return
-	}
-	writeJSON(w, http.StatusOK, dto.SCUMWorkflowStepsFromDomain(items))
-}
-
-func scumProjectionFilterFromRequest(r *http.Request, serverID string) domain.SCUMProjectionFilter {
-	query := r.URL.Query()
-	return domain.SCUMProjectionFilter{ServerInstanceID: serverID, GamePlayerID: query.Get("gamePlayerId"), GamePlayerRecordID: query.Get("gamePlayerRecordId"), UserProfileID: query.Get("userProfileId"), SteamID: query.Get("steamId"), SquadID: query.Get("squadId"), VehicleID: query.Get("vehicleId"), FlagID: query.Get("flagId"), SubjectType: domain.SCUMProjectionSubject(query.Get("subjectType")), QueryKey: query.Get("queryKey"), Freshness: domain.SCUMProjectionFreshness(query.Get("freshness")), Search: query.Get("search"), Limit: boundedQueryLimit(query.Get("limit"), 200)}
-}
-
-func scumOperationFilterFromRequest(r *http.Request, serverID string) domain.SCUMOperationRequestFilter {
-	query := r.URL.Query()
-	return domain.SCUMOperationRequestFilter{ServerInstanceID: serverID, TemplateKey: query.Get("templateKey"), PlayerID: query.Get("playerId"), RequesterID: query.Get("requesterId"), Status: domain.SCUMWorkflowStepStatus(query.Get("status")), IdempotencyKey: query.Get("idempotencyKey"), Limit: boundedQueryLimit(query.Get("limit"), 100)}
-}
-
-func scumWorkflowFilterFromRequest(r *http.Request, serverID string) domain.SCUMWorkflowInstanceFilter {
-	query := r.URL.Query()
-	return domain.SCUMWorkflowInstanceFilter{ServerInstanceID: serverID, TemplateKey: query.Get("templateKey"), RequestedBy: query.Get("requestedBy"), Status: domain.SCUMWorkflowStatus(query.Get("status")), IdempotencyKey: query.Get("idempotencyKey"), Limit: boundedQueryLimit(query.Get("limit"), 100)}
-}
-
-func scumWorkflowStepFilterFromRequest(r *http.Request, serverID string) domain.SCUMWorkflowStepFilter {
-	query := r.URL.Query()
-	return domain.SCUMWorkflowStepFilter{ServerInstanceID: serverID, WorkflowID: query.Get("workflowId"), StepKey: query.Get("stepKey"), Status: domain.SCUMWorkflowStepStatus(query.Get("status")), Limit: boundedQueryLimit(query.Get("limit"), 200)}
-}
-
-func boundedQueryLimit(raw string, fallback int) int {
-	if raw == "" {
-		return fallback
-	}
-	parsed, err := strconv.Atoi(raw)
-	if err != nil || parsed < 1 {
-		return fallback
-	}
-	if parsed > 500 {
-		return 500
-	}
-	return parsed
-}

platform/api/scum_handlers_test.go

@@ -1,148 +0,0 @@
-package api
-
-import (
-	"encoding/json"
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-
-	"browser.local/platform/domain"
-	"browser.local/platform/dto"
-	"browser.local/platform/repo"
-	"browser.local/platform/service"
-)
-
-func TestSCUMProjectionOperationAndWorkflowAPIsExposeSafeTypedSurfaces(t *testing.T) {
-	store := repo.NewMemoryStore()
-	core := service.NewCoreService(store)
-	if _, err := core.CreateUser(domain.User{ID: "scum-api-owner", DisplayName: "SCUM API Owner", Email: "scum-api-owner@example.test", Status: domain.UserStatusActive, Roles: []string{"server-owner"}, PasswordHash: "secret-password"}); err != nil {
-		t.Fatalf("create owner: %v", err)
-	}
-	plugin := validGamePluginRequest().ToDomain()
-	plugin.DeclaredPermissions = append(plugin.DeclaredPermissions, "server.game-client.command", "server.game-client.read")
-	plugin.RequiredRunCapabilities = append(plugin.RequiredRunCapabilities, domain.JobCapabilityRemoteRunRCONCommand, domain.JobCapabilityRemoteRunProtectedRCON)
-	plugin.RuntimeProfiles.TransportProfiles = []domain.RuntimeTransportProfile{{Key: "scum-management", Kind: "rcon", TargetKey: "scum-management", Capabilities: []string{domain.JobCapabilityRemoteRunRCONCommand, domain.JobCapabilityRemoteRunProtectedRCON}}}
-	plugin.GameClientBridge.OperationTemplates = []domain.GameClientBridgeOperationTemplateDeclaration{{Key: "player.fame.set", Title: "Set fame", Permission: "server.game-client.command", ApprovalLevel: domain.GameClientBridgeApprovalLevelOperator, Kind: domain.GameClientBridgeOperationKindRCON, TransportKey: "scum-management", TargetKey: "scum-management", PayloadSchemaRef: "schemas/bridge/player-fame-set.payload.schema.json", TimeoutSeconds: 60, MaxPayloadBytes: 2048, Safety: domain.GameClientBridgeOperationSafety{RequiresApproval: true, RequiresConfirmation: true}}}
-	plugin.GameClientBridge.Retention = domain.GameClientBridgeRetention{KeepForSeconds: 86400, MaxRecords: 1000}
-	if _, err := core.CreateGamePlugin(plugin); err != nil {
-		t.Fatalf("create plugin: %v", err)
-	}
-	endpoint := validRunEndpointRequest().ToDomain()
-	endpoint.Capabilities = append(endpoint.Capabilities, domain.JobCapabilityRemoteRunDBSQLiteQuery, domain.JobCapabilityRemoteRunLogsTransfer, domain.JobCapabilityRemoteRunRCONCommand, domain.JobCapabilityRemoteRunProtectedRCON)
-	endpoint.LastHeartbeatAt = time.Now().UTC()
-	if _, err := core.CreateRunEndpoint(endpoint); err != nil {
-		t.Fatalf("create endpoint: %v", err)
-	}
-	if _, err := core.CreateServerInstance(domain.ServerInstance{ID: "server-scum-api", PluginID: plugin.ID, RunEndpointID: endpoint.ID, Name: "SCUM API", OwnerUserID: "scum-api-owner", State: domain.ServerInstanceStateRunning, ConfigVersion: 1}); err != nil {
-		t.Fatalf("create server: %v", err)
-	}
-	if _, err := core.ApplySCUMObservationResult(domain.SCUMObservationResult{ServerInstanceID: "server-scum-api", PluginID: plugin.ID, Source: "run.sqlite.read", QueryKey: "scum.player.profile", Sequence: 1, Checksum: "sha256:api-profile", ObservedAt: time.Now().UTC(), Rows: []map[string]any{{"gamePlayerId": "steam-api", "displayName": "API Player", "normalBalance": 25, "x": 1, "y": 2, "z": 3}}}); err != nil {
-		t.Fatalf("seed projection: %v", err)
-	}
-	auth, err := core.LoginUser(domain.UserLogin{Account: "scum-api-owner@example.test", Password: "secret-password"})
-	if err != nil {
-		t.Fatalf("login: %v", err)
-	}
-	router := NewAuthorizedRouterWithCore(core)
-	players := getJSONWithAuth[dto.SCUMPlayerLiveStateListResponse](t, router, "/api/v1/server-instances/server-scum-api/scum/players", auth.SessionID)
-	if players.Count != 1 || players.Items[0].GamePlayerID != "steam-api" || players.Items[0].Position.X != 1 {
-		t.Fatalf("unexpected SCUM players response: %+v", players)
-	}
-	operation := postJSONWithAuth[dto.SCUMOperationResponse](t, router, "/api/v1/server-instances/server-scum-api/scum/operations", dto.SCUMOperationRequestBody{TemplateKey: "player.fame.set", PlayerID: "steam-api", Payload: map[string]any{"fame": 12}, Reason: "api typed op", IdempotencyKey: "api-fame-1"}, auth.SessionID)
-	if operation.Status != string(domain.SCUMWorkflowStepWaiting) || operation.TemplateKey != "player.fame.set" {
-		t.Fatalf("unexpected SCUM operation response: %+v", operation)
-	}
-	operations := getJSONWithAuth[dto.SCUMOperationListResponse](t, router, "/api/v1/server-instances/server-scum-api/scum/operations", auth.SessionID)
-	if operations.Count != 1 || operations.Items[0].ID != operation.ID {
-		t.Fatalf("unexpected SCUM operation list: %+v", operations)
-	}
-	workflow := postJSONWithAuth[dto.SCUMWorkflowResponse](t, router, "/api/v1/server-instances/server-scum-api/scum/workflows", dto.SCUMWorkflowCreateRequest{TemplateKey: "scum.world-refresh", IdempotencyKey: "api-world-1"}, auth.SessionID)
-	if workflow.Status != string(domain.SCUMWorkflowQueued) || workflow.TemplateKey != "scum.world-refresh" {
-		t.Fatalf("unexpected SCUM workflow response: %+v", workflow)
-	}
-	steps := getJSONWithAuth[dto.SCUMWorkflowStepListResponse](t, router, "/api/v1/server-instances/server-scum-api/scum/workflow-steps?workflowId="+workflow.ID, auth.SessionID)
-	if steps.Count == 0 {
-		t.Fatalf("expected workflow steps: %+v", steps)
-	}
-	body, err := json.Marshal([]any{players, operation, operations, workflow, steps})
-	if err != nil {
-		t.Fatalf("marshal responses: %v", err)
-	}
-	for _, forbidden := range []string{"#SetFamePoints", "requestText", "SELECT ", "UPDATE ", "SCUM.db", "password", "run token", "hostPath"} {
-		if strings.Contains(strings.ToUpper(string(body)), strings.ToUpper(forbidden)) {
-			t.Fatalf("SCUM safe API leaked %q: %s", forbidden, body)
-		}
-	}
-	for _, legacy := range []struct{ method, path string }{
-		{http.MethodPost, "/api/v1/server-instances/server-scum-api/rcon/commands"},
-		{http.MethodGet, "/api/v1/server-instances/server-scum-api/logs/live"},
-		{http.MethodPost, "/api/v1/server-instances/server-scum-api/logs/backfill"},
-		{http.MethodGet, "/api/v1/server-instances/server-scum-api/files/read-snapshot?key=scum-server-log"},
-		{http.MethodGet, "/api/v1/server-instances/server-scum-api/config"},
-		{http.MethodPost, "/api/v1/server-instances/server-scum-api/config/diff"},
-		{http.MethodPost, "/api/v1/server-instances/server-scum-api/config/approve"},
-	} {
-		recorder := requestWithAuth(t, router, legacy.method, legacy.path, `{}`, auth.SessionID)
-		assertStatus(t, recorder, http.StatusNotFound)
-	}
-}
-
-func TestSCUMAPIsEnforceServerAuthorization(t *testing.T) {
-	store := repo.NewMemoryStore()
-	core := service.NewCoreService(store)
-	if _, err := core.CreateUser(domain.User{ID: "scum-api-owner", DisplayName: "SCUM API Owner", Email: "scum-api-owner-authz@example.test", Status: domain.UserStatusActive, Roles: []string{"server-owner"}, PasswordHash: "secret-password"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := core.CreateUser(domain.User{ID: "scum-api-other", DisplayName: "SCUM API Other", Email: "scum-api-other-authz@example.test", Status: domain.UserStatusActive, Roles: []string{"server-owner"}, PasswordHash: "secret-password"}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := core.CreateGamePlugin(validGamePluginRequest().ToDomain()); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := core.CreateRunEndpoint(validRunEndpointRequest().ToDomain()); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := core.CreateServerInstance(domain.ServerInstance{ID: "server-scum-authz", PluginID: "server.scum", RunEndpointID: "run-local", Name: "SCUM Authz", OwnerUserID: "scum-api-owner", State: domain.ServerInstanceStateRunning}); err != nil {
-		t.Fatal(err)
-	}
-	auth, err := core.LoginUser(domain.UserLogin{Account: "scum-api-other-authz@example.test", Password: "secret-password"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	router := NewAuthorizedRouterWithCore(core)
-	assertErrorResponse(t, requestWithAuth(t, router, http.MethodGet, "/api/v1/server-instances/server-scum-authz/scum/players", "", auth.SessionID), http.StatusForbidden, errorCodeForbidden)
-}
-
-func TestSCUMAPIsRequirePlatformAdminForDBMutationApproval(t *testing.T) {
-	store := repo.NewMemoryStore()
-	core := service.NewCoreService(store)
-	if _, err := core.CreateUser(domain.User{ID: "scum-api-owner", DisplayName: "SCUM API Owner", Email: "scum-api-owner-mutation@example.test", Status: domain.UserStatusActive, Roles: []string{"server-owner"}, PasswordHash: "secret-password"}); err != nil {
-		t.Fatal(err)
-	}
-	plugin := validGamePluginRequest().ToDomain()
-	plugin.DeclaredPermissions = append(plugin.DeclaredPermissions, "server.game-client.read", "server.game-client.maintenance")
-	plugin.RequiredRunCapabilities = append(plugin.RequiredRunCapabilities, domain.JobCapabilityRemoteRunDBSQLiteQuery, domain.JobCapabilityRemoteRunProtectedSQL)
-	plugin.RuntimeProfiles.TransportProfiles = []domain.RuntimeTransportProfile{{Key: "scum-database", Kind: "sqlite", TargetKey: "scum-database", Capabilities: []string{domain.JobCapabilityRemoteRunDBSQLiteQuery, domain.JobCapabilityRemoteRunProtectedSQL}}}
-	plugin.GameClientBridge.QueryTemplates = []domain.GameClientBridgeQueryTemplateDeclaration{{Key: "scum.player.profile", Title: "Read player profile", Permission: "server.game-client.read", Engine: "sqlite", TransportKey: "scum-database", TargetKey: "scum-database", ParameterSchemaRef: "schemas/bridge/queries/scum-player-profile.parameters.schema.json", ResultSchemaRef: "schemas/bridge/queries/scum-player-profile.result.schema.json", MaxRows: 10, TimeoutSeconds: 15}}
-	plugin.GameClientBridge.OperationTemplates = []domain.GameClientBridgeOperationTemplateDeclaration{{Key: "player.attribute.855.set", Title: "Set attribute 855", Permission: "server.game-client.maintenance", ApprovalLevel: domain.GameClientBridgeApprovalLevelPlatformAdmin, Kind: domain.GameClientBridgeOperationKindSQLiteMutation, TransportKey: "scum-database", TargetKey: "scum-database", PayloadSchemaRef: "schemas/bridge/player-attribute-855-set.payload.schema.json", ResultSchemaRef: "schemas/bridge/player-attribute-855-set.result.schema.json", ConfirmationSchemaRef: "schemas/bridge/player-attribute-855-set.confirmation.schema.json", TimeoutSeconds: 120, MaxPayloadBytes: 4096, MaxRowsAffected: 1, Mutation: domain.GameClientBridgeOperationMutationDeclaration{FieldKey: "855", TableKey: "prisoner", IdentityKey: "user_profile_id", ValueKey: "value", ConfirmationQueryKey: "scum.player.profile", AllowedValueType: "integer", MinValue: 0, MaxValue: 100000}, Safety: domain.GameClientBridgeOperationSafety{RequiresApproval: true, RequiresOfflinePlayer: true, RequiresMaintenanceWindow: true, RequiresBeforeValue: true, RequiresConfirmation: true, BackupRequired: true}}}
-	plugin.GameClientBridge.Retention = domain.GameClientBridgeRetention{KeepForSeconds: 86400, MaxRecords: 1000}
-	if _, err := core.CreateGamePlugin(plugin); err != nil {
-		t.Fatal(err)
-	}
-	endpoint := validRunEndpointRequest().ToDomain()
-	endpoint.Capabilities = append(endpoint.Capabilities, domain.JobCapabilityRemoteRunDBSQLiteQuery, domain.JobCapabilityRemoteRunProtectedSQL)
-	if _, err := core.CreateRunEndpoint(endpoint); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := core.CreateServerInstance(domain.ServerInstance{ID: "server-scum-mutation-authz", PluginID: plugin.ID, RunEndpointID: endpoint.ID, Name: "SCUM Mutation Authz", OwnerUserID: "scum-api-owner", State: domain.ServerInstanceStateStopped}); err != nil {
-		t.Fatal(err)
-	}
-	auth, err := core.LoginUser(domain.UserLogin{Account: "scum-api-owner-mutation@example.test", Password: "secret-password"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	router := NewAuthorizedRouterWithCore(core)
-	operation := postJSONWithAuth[dto.SCUMOperationResponse](t, router, "/api/v1/server-instances/server-scum-mutation-authz/scum/operations", dto.SCUMOperationRequestBody{TemplateKey: "player.attribute.855.set", PlayerID: "steam-api", Payload: map[string]any{"fieldKey": "855", "before": 10, "after": 12, "safetyWindow": "maintenance-2026-08-10", "backupRef": "backup://scum/1"}, Reason: "api typed db op", IdempotencyKey: "api-855-1"}, auth.SessionID)
-	assertErrorResponse(t, requestJSONWithAuth(t, router, http.MethodPost, "/api/v1/server-instances/server-scum-mutation-authz/scum/operations/"+operation.ID+"/approve", map[string]string{}, auth.SessionID), http.StatusForbidden, errorCodeForbidden)
-}