Implement SCUM direct data plane

platform/validator/resources.go

@@ -578,6 +578,22 @@ func validateGameClientBridgeManifest(field string, bridge domain.GameClientBrid
 		if template.TimeoutSeconds < 1 || template.TimeoutSeconds > 60 {
 			violations = append(violations, prefix+".timeoutSeconds is invalid")
 		}
+		if template.RowTarget != nil {
+			rowTarget := template.RowTarget
+			if !validSCUMTargetTable(rowTarget.TargetTable) || len(rowTarget.UpsertKeys) == 0 {
+				violations = append(violations, prefix+".rowTarget must declare an allowed scum_* table and upsert keys")
+			}
+			for _, key := range rowTarget.UpsertKeys {
+				if !clientManagerIdentifierPattern.MatchString(key) {
+					violations = append(violations, prefix+".rowTarget upsert key is invalid")
+				}
+			}
+			for destination, source := range rowTarget.ColumnMappings {
+				if !clientManagerIdentifierPattern.MatchString(destination) || !clientManagerIdentifierPattern.MatchString(source) {
+					violations = append(violations, prefix+".rowTarget column mapping is invalid")
+				}
+			}
+		}
 		transport, exists := transports[template.TransportKey]
 		if !exists {
 			violations = append(violations, prefix+".transportKey must reference a declared runtime transport profile")
@@ -764,6 +780,15 @@ func validateGameClientBridgeManifest(field string, bridge domain.GameClientBrid
 	return violations
 }
 
+func validSCUMTargetTable(value string) bool {
+	switch value {
+	case "scum_users", "scum_squads", "scum_activity_events", "scum_gift_catalogs", "scum_map_points":
+		return true
+	default:
+		return false
+	}
+}
+
 func validCompanionProofEnvironment(value string) bool {
 	if len(value) < 3 || len(value) > 64 || value[0] < 'A' || value[0] > 'Z' {
 		return false