Integrate SCUM real ops workflows

platform_web/api/client.test.ts

@@ -244,61 +244,18 @@ describe("PlatformApiClient AI providers", () => {
           count: 1
         });
       }
-      if (url.endsWith("/api/v1/server-instances/server-1/config")) {
-        return jsonResponse({
-          serverInstanceId: server.id,
-          configVersion: 1,
-          format: "properties",
-          key: "server.properties",
-          content: "server.name=Example Survival #1\n",
-          source: "platform-derived",
-          updatedAt: "2026-07-03T00:00:00Z"
-        });
-      }
-      if (url.endsWith("/api/v1/server-instances/server-1/config/diff") && init?.method === "POST") {
-        expect(JSON.parse(String(init.body))).toEqual({
-          expectedConfigVersion: 1,
-          key: "server.properties",
-          proposedContent: "server.name=Example Survival #2\n"
-        });
-        return jsonResponse({
-          serverInstanceId: server.id,
-          configVersion: 1,
-          key: "server.properties",
-          currentContent: "server.name=Example Survival #1\n",
-          proposedContent: "server.name=Example Survival #2\n",
-          diff: [
-            { kind: "removed", oldNumber: 1, content: "server.name=Example Survival #1" },
-            { kind: "added", newNumber: 1, content: "server.name=Example Survival #2" }
-          ],
-          hasChanges: true,
-          source: "platform-review",
-          reviewedAt: "2026-07-03T00:00:00Z"
-        });
-      }
-      if (url.endsWith("/api/v1/server-instances/server-1/config/approve") && init?.method === "POST") {
-        expect(JSON.parse(String(init.body))).toEqual({
-          expectedConfigVersion: 1,
-          key: "server.properties",
-          proposedContent: "server.name=Example Survival #2\n",
-          idempotencyKey: "idem-config"
-        });
-        return jsonResponse({
-          status: "queued",
-          preview: {
-            serverInstanceId: server.id,
-            configVersion: 1,
-            key: "server.properties",
-            currentContent: "server.name=Example Survival #1\n",
-            proposedContent: "server.name=Example Survival #2\n",
-            diff: [{ kind: "added", newNumber: 1, content: "server.name=Example Survival #2" }],
-            hasChanges: true,
-            source: "platform-review",
-            reviewedAt: "2026-07-03T00:00:00Z"
-          },
-          job: { ...job, id: "job-config-write", capability: "config.write", targetKey: "server.properties", inputRef: "input://server-config/server-1/server.properties/v1" }
-        });
-      }
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/players")) return jsonResponse({ items: [{ id: "scum-player-1", gamePlayerId: "steam-1", displayName: "Prisoner One", online: true }], count: 1 });
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/squads")) return jsonResponse({ items: [{ id: "squad-1", squadId: "squad-1", name: "Alpha" }], count: 1 });
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/squad-members")) return jsonResponse({ items: [{ id: "member-1", squadId: "squad-1", gamePlayerId: "steam-1" }], count: 1 });
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/vehicles")) return jsonResponse({ items: [{ id: "vehicle-1", vehicleId: "vehicle-1", label: "SUV" }], count: 1 });
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/flags")) return jsonResponse({ items: [{ id: "flag-1", flagId: "flag-1", ownerSquadId: "squad-1" }], count: 1 });
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/positions")) return jsonResponse({ items: [{ id: "position-1", subjectType: "player", subjectId: "steam-1", x: 1, y: 2, z: 3 }], count: 1 });
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/operations") && (!init?.method || init.method === "GET")) return jsonResponse({ items: [], count: 0 });
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/operations") && init?.method === "POST") return jsonResponse({ id: "op-1", serverInstanceId: server.id, pluginId: plugin.id, templateKey: "player.fame.set", status: "waiting", approvalLevel: "operator", createdAt: "2026-07-03T00:00:00Z", updatedAt: "2026-07-03T00:00:00Z" });
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/operations/op-1/approve") && init?.method === "POST") return jsonResponse({ id: "op-1", serverInstanceId: server.id, pluginId: plugin.id, templateKey: "player.fame.set", status: "queued", approvalLevel: "operator", createdAt: "2026-07-03T00:00:00Z", updatedAt: "2026-07-03T00:00:00Z" });
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/workflows") && (!init?.method || init.method === "GET")) return jsonResponse({ items: [], count: 0 });
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/workflows") && init?.method === "POST") return jsonResponse({ id: "workflow-1", serverInstanceId: server.id, pluginId: plugin.id, templateKey: "scum.world-refresh", status: "queued", createdAt: "2026-07-03T00:00:00Z", updatedAt: "2026-07-03T00:00:00Z" });
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/workflow-steps?workflowId=workflow-1")) return jsonResponse({ items: [{ id: "step-1", workflowId: "workflow-1", serverInstanceId: server.id, stepKey: "read-positions", status: "queued", createdAt: "2026-07-03T00:00:00Z", updatedAt: "2026-07-03T00:00:00Z" }], count: 1 });
       if (url.endsWith("/api/v1/file-operations/dispatch") && init?.method === "POST") {
         expect(JSON.parse(String(init.body))).toEqual({
           serverInstanceId: server.id,
@@ -536,13 +493,6 @@ describe("PlatformApiClient AI providers", () => {
         expect(JSON.parse(String(init.body))).toEqual({ probeKey: "java-21", installPlanKey: "install-java-linux", planDigest: runtimeDigest, idempotencyKey: "idem-dep-install" });
         return jsonResponse({ ...job, id: "job-dep-install", capability: "dependencies.install", targetKey: "dependencies/install/install-java-linux" });
       }
-      if (url.endsWith("/api/v1/server-instances/server-1/logs/live")) {
-        return jsonResponse({ items: [], count: 0 });
-      }
-      if (url.endsWith("/api/v1/server-instances/server-1/logs/backfill") && init?.method === "POST") {
-        expect(JSON.parse(String(init.body))).toEqual({ sourceKey: "latest-log", checkpointRef: "artifact://logs/checkpoint/1", limit: 200, idempotencyKey: "idem-log-backfill" });
-        return jsonResponse({ ...job, id: "job-log-backfill", capability: "logs.backfill", targetKey: "logs/latest-log", inputRef: "artifact://logs/checkpoint/1" });
-      }
       if (url.endsWith("/api/v1/plugin-bridge/authorize") && init?.method === "POST") {
         return jsonResponse({
           pluginId: plugin.id,
@@ -604,13 +554,18 @@ describe("PlatformApiClient AI providers", () => {
     await expect(client.deleteServerInstance(server.id, { password: "secret-password", force: true, confirmation: "FORCE DELETE" })).resolves.toBeUndefined();
     await expect(client.getPlatformResourceUsage()).resolves.toMatchObject({ source: "platform-derived", cpuPercent: 28 });
     await expect(client.listServerMetrics()).resolves.toMatchObject({ count: 1, items: [{ serverInstanceId: server.id, online: true }] });
-    await expect(client.getServerConfig(server.id)).resolves.toMatchObject({ content: "server.name=Example Survival #1\n" });
-    await expect(
-      client.previewServerConfigDiff(server.id, { expectedConfigVersion: 1, key: "server.properties", proposedContent: "server.name=Example Survival #2\n" })
-    ).resolves.toMatchObject({ hasChanges: true, source: "platform-review" });
-    await expect(
-      client.approveServerConfigWrite(server.id, { expectedConfigVersion: 1, key: "server.properties", proposedContent: "server.name=Example Survival #2\n", idempotencyKey: "idem-config" })
-    ).resolves.toMatchObject({ status: "queued", job: { capability: "config.write", targetKey: "server.properties" } });
+    await expect(client.listSCUMPlayers(server.id)).resolves.toMatchObject({ count: 1, items: [{ gamePlayerId: "steam-1" }] });
+    await expect(client.listSCUMSquads(server.id)).resolves.toMatchObject({ count: 1 });
+    await expect(client.listSCUMSquadMembers(server.id)).resolves.toMatchObject({ count: 1 });
+    await expect(client.listSCUMVehicles(server.id)).resolves.toMatchObject({ count: 1 });
+    await expect(client.listSCUMFlags(server.id)).resolves.toMatchObject({ count: 1 });
+    await expect(client.listSCUMPositions(server.id)).resolves.toMatchObject({ count: 1 });
+    await expect(client.listSCUMOperations(server.id)).resolves.toMatchObject({ count: 0 });
+    await expect(client.createSCUMOperation(server.id, { templateKey: "player.fame.set", playerId: "steam-1", payload: { fame: 100 }, reason: "typed correction", idempotencyKey: "idem-scum-op" })).resolves.toMatchObject({ id: "op-1", status: "waiting" });
+    await expect(client.approveSCUMOperation(server.id, "op-1")).resolves.toMatchObject({ id: "op-1", status: "queued" });
+    await expect(client.listSCUMWorkflows(server.id)).resolves.toMatchObject({ count: 0 });
+    await expect(client.createSCUMWorkflow(server.id, { templateKey: "scum.world-refresh", idempotencyKey: "idem-scum-workflow" })).resolves.toMatchObject({ id: "workflow-1", status: "queued" });
+    await expect(client.listSCUMWorkflowSteps(server.id, "workflow-1")).resolves.toMatchObject({ count: 1, items: [{ stepKey: "read-positions" }] });
     await expect(client.dispatchFileOperation({ serverInstanceId: server.id, operation: "read", key: "logs/latest.log", idempotencyKey: "idem-file" })).resolves.toMatchObject({
       status: "queued",
       job: { capability: "files.read", targetKey: "logs/latest.log" }
@@ -665,21 +620,11 @@ describe("PlatformApiClient AI providers", () => {
     await expect(client.installDependencies(server.id, { probeKey: "java-21", installPlanKey: "install-java-linux", planDigest: runtimeDigest, idempotencyKey: "idem-dep-install" })).resolves.toMatchObject({
       capability: "dependencies.install"
     });
-    await expect(client.listServerLiveLogs(server.id)).resolves.toMatchObject({ count: 0 });
-    await expect(client.requestLogBackfill(server.id, { sourceKey: "latest-log", checkpointRef: "artifact://logs/checkpoint/1", limit: 200, idempotencyKey: "idem-log-backfill" })).resolves.toMatchObject({
-      capability: "logs.backfill"
-    });
-    await expect(client.authorizePluginBridge({ pluginId: plugin.id, routeKey: "logs", action: "logs.query" })).resolves.toMatchObject({
-      allowed: true
-    });
-    await expect(
-      client.executePluginBridge({ requestId: "req-bridge", pluginId: plugin.id, routeKey: "logs", serverInstanceId: server.id, action: "logs.query", payload: { logStreamId: "log-1" } })
-    ).resolves.toMatchObject({ status: "ok", result: { entryCount: "0" } });
     await expect(
       client.invokeAI({ requestId: "ai-1", serverInstanceId: server.id, purpose: "config.suggest", prompt: "Tune PVP safely", currentConfig: "server.name=Example Survival #1\n" })
     ).resolves.toMatchObject({ status: "ok", usage: { mocked: true }, configRecommendation: { diffSummary: "review required" } });
 
-    expect(fetchMock).toHaveBeenCalledTimes(43);
+    expect(fetchMock).toHaveBeenCalledTimes(48);
   });
 
   it("calls plugin marketplace endpoints with filter and state contracts", async () => {
@@ -708,11 +653,11 @@ describe("PlatformApiClient AI providers", () => {
     expect(fetchMock).toHaveBeenCalledTimes(3);
   });
 
-  it("surfaces config diff preview failures from the platform", async () => {
+  it("surfaces SCUM typed operation failures from the platform", async () => {
     const fetchMock = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
       const url = String(input);
-      if (url.endsWith("/api/v1/server-instances/server-1/config/diff") && init?.method === "POST") {
-        return new Response(JSON.stringify({ code: "validation", message: "expectedConfigVersion must match server instance" }), {
+      if (url.endsWith("/api/v1/server-instances/server-1/scum/operations") && init?.method === "POST") {
+        return new Response(JSON.stringify({ code: "validation", message: "SCUM operation template is not declared" }), {
           status: 400,
           headers: { "Content-Type": "application/json" }
         });
@@ -723,9 +668,7 @@ describe("PlatformApiClient AI providers", () => {
 
     const client = new PlatformApiClient();
 
-    await expect(client.previewServerConfigDiff(server.id, { expectedConfigVersion: 0, key: "server.properties", proposedContent: "changed=true\n" })).rejects.toThrow(
-      "expectedConfigVersion must match server instance"
-    );
+    await expect(client.createSCUMOperation(server.id, { templateKey: "raw.sql", reason: "unsafe", idempotencyKey: "bad-scum-op" })).rejects.toThrow("SCUM operation template is not declared");
   });
 
   it("keeps raw key and base URL fields out of provider responses", () => {

platform_web/api/client.ts

@@ -36,7 +36,6 @@ import type {
   CurrentUserResponse,
   DependencyCatalogResponse,
   DependencyJobRequest,
-  DeclaredFileReadSnapshotResponse,
   FileOperationDispatchRequest,
   FileOperationDispatchResponse,
   GameClientBridgeCancelRequest,
@@ -55,8 +54,6 @@ import type {
   JobResponse,
   LlmConfigSuggestionRequest,
   LlmConfigSuggestionResponse,
-  LogBackfillRequest,
-  LogStreamEventOptions,
   LogStreamCursorRequest,
   LogStreamCursorResponse,
   LogStreamListResponse,
@@ -84,19 +81,12 @@ import type {
   RunUpdateRequest,
   RuntimeBindingResponse,
   RuntimeBindingUpdateRequest,
-  ServerConfigResponse,
-  ServerConfigDiffPreviewRequest,
-  ServerConfigDiffPreviewResponse,
   ServerLifecycleCommandRequest,
   ServerLifecycleCreateRequest,
   ServerLifecycleResponse,
   ServerDeploymentRequest,
 	ServerDeploymentRevealResponse,
   ServerDeploymentResponse,
-  ServerConfigWriteApprovalRequest,
-  ServerConfigWriteDispatchResponse,
-  SourceRCONCommandRequest,
-  SourceRCONCommandResponse,
   ServerInstanceListResponse,
   ServerDeletionRequest,
   ServerInstanceUpdateRequest,
@@ -110,6 +100,14 @@ import type {
   RemoteAdapterDeclarationListResponse,
   RemoteAdapterRequest,
   RemoteAdapterResponse,
+  SCUMListResponse,
+  SCUMOperationListResponse,
+  SCUMOperationRequest,
+  SCUMOperationResponse,
+  SCUMWorkflowCreateRequest,
+  SCUMWorkflowListResponse,
+  SCUMWorkflowResponse,
+  SCUMWorkflowStepListResponse,
   ServerRuntimeActionsResponse,
   UserCreateRequest,
   UserListResponse,
@@ -444,28 +442,6 @@ export class PlatformApiClient {
     });
   }
 
-  async listServerLiveLogs(id: string): Promise<LogStreamListResponse> {
-    return this.request<LogStreamListResponse>(`/server-instances/${encodeURIComponent(id)}/logs/live`);
-  }
-
-  openServerLogEvents(id: string, options: LogStreamEventOptions = {}): EventSource {
-    return new EventSource(this.serverLogEventsUrl(id, options), { withCredentials: true });
-  }
-
-  serverLogEventsUrl(id: string, options: LogStreamEventOptions = {}): string {
-    const params = new URLSearchParams();
-    if (options.historyLimit !== undefined) params.set("historyLimit", String(options.historyLimit));
-    const query = params.toString();
-    return `${this.baseUrl}/server-instances/${encodeURIComponent(id)}/logs/events${query ? `?${query}` : ""}`;
-  }
-
-  async requestLogBackfill(id: string, request: LogBackfillRequest): Promise<JobResponse> {
-    return this.request<JobResponse>(`/server-instances/${encodeURIComponent(id)}/logs/backfill`, {
-      method: "POST",
-      body: request
-    });
-  }
-
   async createJob(request: JobCreateRequest): Promise<JobResponse> {
     return this.request<JobResponse>("/jobs", { method: "POST", body: request });
   }
@@ -599,26 +575,55 @@ export class PlatformApiClient {
     return this.request<RemoteAdapterResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/remote-adapters`, { method: "POST", body: request });
   }
 
-  async sendSourceRCONCommand(serverInstanceId: string, request: SourceRCONCommandRequest): Promise<SourceRCONCommandResponse> {
-    return this.request<SourceRCONCommandResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/rcon/commands`, { method: "POST", body: request });
+  async listSCUMPlayers(serverInstanceId: string): Promise<SCUMListResponse> {
+    return this.request<SCUMListResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/players`);
   }
 
-  async getServerConfig(id: string): Promise<ServerConfigResponse> {
-    return this.request<ServerConfigResponse>(`/server-instances/${encodeURIComponent(id)}/config`);
+  async listSCUMSquads(serverInstanceId: string): Promise<SCUMListResponse> {
+    return this.request<SCUMListResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/squads`);
   }
 
-  async previewServerConfigDiff(id: string, request: ServerConfigDiffPreviewRequest): Promise<ServerConfigDiffPreviewResponse> {
-    return this.request<ServerConfigDiffPreviewResponse>(`/server-instances/${encodeURIComponent(id)}/config/diff`, {
-      method: "POST",
-      body: request
-    });
+  async listSCUMSquadMembers(serverInstanceId: string): Promise<SCUMListResponse> {
+    return this.request<SCUMListResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/squad-members`);
   }
 
-  async approveServerConfigWrite(id: string, request: ServerConfigWriteApprovalRequest): Promise<ServerConfigWriteDispatchResponse> {
-    return this.request<ServerConfigWriteDispatchResponse>(`/server-instances/${encodeURIComponent(id)}/config/approve`, {
-      method: "POST",
-      body: request
-    });
+  async listSCUMVehicles(serverInstanceId: string): Promise<SCUMListResponse> {
+    return this.request<SCUMListResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/vehicles`);
+  }
+
+  async listSCUMFlags(serverInstanceId: string): Promise<SCUMListResponse> {
+    return this.request<SCUMListResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/flags`);
+  }
+
+  async listSCUMPositions(serverInstanceId: string): Promise<SCUMListResponse> {
+    return this.request<SCUMListResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/positions`);
+  }
+
+  async listSCUMOperations(serverInstanceId: string): Promise<SCUMOperationListResponse> {
+    return this.request<SCUMOperationListResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/operations`);
+  }
+
+  async createSCUMOperation(serverInstanceId: string, request: SCUMOperationRequest): Promise<SCUMOperationResponse> {
+    return this.request<SCUMOperationResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/operations`, { method: "POST", body: request });
+  }
+
+  async approveSCUMOperation(serverInstanceId: string, operationId: string): Promise<SCUMOperationResponse> {
+    return this.request<SCUMOperationResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/operations/${encodeURIComponent(operationId)}/approve`, { method: "POST", body: {} });
+  }
+
+  async listSCUMWorkflows(serverInstanceId: string): Promise<SCUMWorkflowListResponse> {
+    return this.request<SCUMWorkflowListResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/workflows`);
+  }
+
+  async createSCUMWorkflow(serverInstanceId: string, request: SCUMWorkflowCreateRequest): Promise<SCUMWorkflowResponse> {
+    return this.request<SCUMWorkflowResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/workflows`, { method: "POST", body: request });
+  }
+
+  async listSCUMWorkflowSteps(serverInstanceId: string, workflowId?: string): Promise<SCUMWorkflowStepListResponse> {
+    const params = new URLSearchParams();
+    if (workflowId) params.set("workflowId", workflowId);
+    const query = params.toString();
+    return this.request<SCUMWorkflowStepListResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/scum/workflow-steps${query ? `?${query}` : ""}`);
   }
 
   async dispatchFileOperation(request: FileOperationDispatchRequest): Promise<FileOperationDispatchResponse> {
@@ -628,11 +633,6 @@ export class PlatformApiClient {
     });
   }
 
-  async getDeclaredFileReadSnapshot(serverInstanceId: string, fileKey: string): Promise<DeclaredFileReadSnapshotResponse> {
-    const query = new URLSearchParams({ key: fileKey });
-    return this.request<DeclaredFileReadSnapshotResponse>(`/server-instances/${encodeURIComponent(serverInstanceId)}/files/read-snapshot?${query.toString()}`);
-  }
-
   async listLogStreams(): Promise<LogStreamListResponse> {
     return this.request<LogStreamListResponse>("/log-streams");
   }

platform_web/api/contracts.md

@@ -6,12 +6,12 @@ API clients and DTO types live here, not inside page components.
 
 - `users`: user and role APIs.
 - `serverPlugins`: plugin marketplace and installed plugin APIs.
-- `serverInstances`: create server, lifecycle, config read, config diff/approval, scoped files, logs, and detail APIs.
+- `serverInstances`: create server, lifecycle, deployment/member/detail APIs, and SCUM typed projection/workflow APIs.
 - `aiProviders`: provider CRUD, test, and model APIs.
 - `jobs`: job status and operation APIs.
 - `runEndpoints`: run endpoint status, lifecycle capabilities, and capacity APIs.
 - `artifacts`: artifact upload/download APIs.
-- `logs`: historical query and tail APIs.
+- `logs`: internal historical cursor APIs used for maintenance/debug views, not server-detail raw log products.
 - `pluginPageBridge`: safe bridge APIs for hosted plugin page.
 
 Every API client must use named request and response types.
@@ -26,8 +26,8 @@ Normal browser login uses the platform's HttpOnly SameSite cookie and `credentia
 - `getServerRuntimeBinding` reads `/server-instances/{id}/runtime-binding`; `updateServerRuntimeBinding` patches the selected profile and logical refs for internal/advanced logical transports. Server detail must not expose a manual runtime-binding tab or require these fields before normal start/stop when plugin-declared deployment/lifecycle data is sufficient. Responses contain only profile metadata, logical key names, configured/secret-backed flags, missing keys, and safe reasons. They never contain stored refs or secret values.
 - `startServerInstance` and `stopServerInstance` post `ServerLifecycleCommandRequest` with the current config version and receive the lifecycle job response.
 - `listServerAdministratorCandidates`, `addServerAdministrator`, and `removeServerAdministrator` call server membership endpoints so server owners can invite or remove active non-platform-admin server administrators.
-- `getServerConfig`, `previewServerConfigDiff`, and `approveServerConfigWrite` call platform-mediated config routes. ServerDetailPage must preview the platform diff first, keep the explicit confirmation step, and dispatch writes only through the approval API.
-- `dispatchFileOperation` posts `FileOperationDispatchRequest` to `/file-operations/dispatch` using logical file keys and scoped refs rather than raw host paths.
+- SCUM projection reads use `listSCUMPlayers`, `listSCUMSquads`, `listSCUMSquadMembers`, `listSCUMVehicles`, `listSCUMFlags`, and `listSCUMPositions`; SCUM writes use `createSCUMOperation`, `approveSCUMOperation`, `createSCUMWorkflow`, and workflow/step list APIs. These APIs expose only projection rows, typed template keys, status, and safe summaries, never SQL text, RCON text, DSNs, host paths, or protected payloads.
+- `dispatchFileOperation` posts `FileOperationDispatchRequest` to `/file-operations/dispatch` using logical file keys and scoped refs rather than raw host paths; it is not wired into SCUM server-detail/plugin pages as a raw file workbench.
 - `listArtifacts`, `openArtifactDownload`, and `readArtifactContent` use platform artifact routes for available job/server artifacts. Browser reads are chunked through `/artifacts/{id}/content` and must render only safe filenames, checksums, progress, and platform storage behavior.
 - `authorizePluginBridge` posts `PluginBridgeAuthorizeRequest` to `/plugin-bridge/authorize` for preflight decisions.
 - `executePluginBridge` posts `PluginBridgeExecuteRequest` to `/plugin-bridge/execute` from host-owned bridge dispatch utilities only. Plugin pages receive typed `PluginBridgeExecuteResponse` envelopes and never receive the platform API client, bearer token, raw provider key, run socket, host path, or storage credential.
@@ -52,15 +52,14 @@ Existing platform APIs already cover server lifecycle, jobs, log stream metadata
 - `PUT /api/v1/users/current/theme` (`UserThemePreferenceRequest`/`UserThemePreferenceResponse`): implemented per-user theme preferences, including selected palette IDs such as `mecha-black` or `magical-girl`, uploaded background reference or safe persisted data URL metadata, and readable overlay preference.
 - `GET /api/v1/metrics/platform` (`PlatformResourceUsageResponse`): implemented platform-level CPU/memory/disk usage and LLM connectivity summary for the overview first screen.
 - `GET /api/v1/metrics/server-instances` (`ServerMetricsListResponse`): implemented per-server online state, player count, TPS, latency, CPU/memory/disk for server cards and the server detail header.
-- `GET /api/v1/server-instances/{id}/config` (`ServerConfigResponse`): implemented readable configuration content for diff-based editing.
-- `POST /api/v1/server-instances/{id}/config/diff` (`ServerConfigDiffPreviewRequest`/`ServerConfigDiffPreviewResponse`) and `POST /api/v1/server-instances/{id}/config/approve` (`ServerConfigWriteApprovalRequest`/`ServerConfigWriteDispatchResponse`): implemented platform-mediated config write review and approval. Manual config edits and AI suggestion applies must not create generic `config.write` jobs through `POST /api/v1/jobs`.
+- Server-scoped raw config routes (`GET /api/v1/server-instances/{id}/config`, `POST .../config/diff`, `POST .../config/approve`) are removed from the product API. AI configuration assistance uses `/api/v1/ai/invocations` plus reviewable AI config-diff approval APIs; plugin pages do not receive raw config text.
 - `POST /api/v1/file-operations/dispatch` (`FileOperationDispatchRequest`/`FileOperationDispatchResponse`): implemented scoped file operation dispatch using logical keys and refs only.
 - `POST /api/v1/ai/config-suggestions` (`LlmConfigSuggestionRequest`/`LlmConfigSuggestionResponse`) and `POST /api/v1/ai/invocations` (`AIInvocationRequest`/`AIInvocationResponse`): platform-mediated AI recommendation or diff scoped to one server. Provider keys stay in `platform/`; responses carry only recommendation text, usage metadata, and reviewable suggestions, never keys or provider secrets.
 - Per-server plugin controls are rendered from installed plugin manifests (`bridgeActions`, `lifecycleActions`, `pages`, `declaredPermissions`); a richer declared-control schema remains a future plugin contract. Hosted bridge execution uses `POST /api/v1/plugin-bridge/execute` for server context, scoped file, log, job, artifact reference, and AI action envelopes instead of direct plugin fetches to platform internals.
 - Operation/job traceability reuses `GET /api/v1/jobs`, `GET /api/v1/jobs/{id}`, `POST /api/v1/jobs/{id}/cancel`, and `GET /api/v1/audit-events`; the frontend wraps these in one visible operation lifecycle per user intent.
 
 Browser Job contracts explicitly exclude raw or hashed lease tokens, Run session tokens/generations, secret refs, host paths, sockets, and credentials. The safe schema rejects those keys, and existing API client 401/403 behavior remains authoritative for expired sessions and cross-owner access.
-- Live log and management-terminal output uses `GET /api/v1/server-instances/{id}/logs/events` as a single `EventSource`/SSE stream with bounded initial history. `POST /api/v1/log-streams/query` remains available for explicit historical cursor reads and reconnect repair, not periodic browser polling.
+- Server-scoped raw log routes (`GET /api/v1/server-instances/{id}/logs/live`, `GET .../logs/events`, `POST .../logs/backfill`) and management-terminal/RCON input routes are removed from product clients. Internal log ingest and cursor query remain available to platform services and maintenance/debug flows.
 # Client Manager API projection
 
 `PlatformApiClient` exposes list/detail and typed deploy, control, update, retry, revoke-session, and uninstall methods. `schemas/clientManagerLifecycle.ts` validates status/action/job/health fields and rejects forbidden machine or credential fields before rendering. Lifecycle commands carry profile, distribution, expected deployment generation, approval/confirmation, and idempotency only. Artifact bytes remain in the platform-owned artifact transfer client.

platform_web/api/sourceRcon.test.ts

@@ -1,44 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-import { PlatformApiClient } from "./client";
-import type { SourceRCONCommandRequest } from "./types";
-
-describe("PlatformApiClient Source RCON command dispatch", () => {
-  afterEach(() => vi.unstubAllGlobals());
-
-  it("posts the typed server-scoped request and projects only safe queue state", async () => {
-    const request: SourceRCONCommandRequest = {
-      kind: "chat",
-      chatType: 4,
-      message: "Maintenance complete",
-      targetSteamId: "76561198000000001",
-      idempotencyKey: "web:source-rcon:chat:server-1:12"
-    };
-    const calls: Array<{ url: string; method: string; body?: unknown; authorization: string | null }> = [];
-    vi.stubGlobal("fetch", vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
-      calls.push({
-        url: String(input),
-        method: init?.method ?? "GET",
-        body: init?.body ? JSON.parse(String(init.body)) : undefined,
-        authorization: new Headers(init?.headers).get("Authorization")
-      });
-      return new Response(JSON.stringify({ jobId: "job-source-rcon", serverInstanceId: "server-1", status: "queued", message: "SCUM RCON command queued" }), {
-        status: 202,
-        headers: { "Content-Type": "application/json" }
-      });
-    }));
-
-    const response = await new PlatformApiClient("/api/v1", () => "operator-session").sendSourceRCONCommand("server/1", request);
-
-    expect(calls).toEqual([{
-      url: "/api/v1/server-instances/server%2F1/rcon/commands",
-      method: "POST",
-      body: request,
-      authorization: "Bearer operator-session"
-    }]);
-    expect(response).toEqual({ jobId: "job-source-rcon", serverInstanceId: "server-1", status: "queued", message: "SCUM RCON command queued" });
-    for (const forbidden of ["command", "password", "host", "configRef", "response"]) {
-      expect(Object.keys(response)).not.toContain(forbidden);
-    }
-  });
-});

platform_web/api/types.ts

@@ -1373,6 +1373,17 @@ export interface RemoteAdapterResponse {
   completedAt?: string;
 }
 
+export type SCUMJsonRecord = Record<string, unknown>;
+export interface SCUMListResponse<T = SCUMJsonRecord> { items: T[]; count: number; }
+export interface SCUMWorkflowCreateRequest { templateKey: string; idempotencyKey: string; input?: SCUMJsonRecord; }
+export interface SCUMOperationRequest { templateKey: string; playerId?: string; payload?: SCUMJsonRecord; guard?: SCUMJsonRecord; reason: string; idempotencyKey: string; }
+export interface SCUMWorkflowResponse { id: string; serverInstanceId: string; pluginId: string; templateKey: string; requestedBy?: string; idempotencyKey?: string; status: string; currentStepKey?: string; input?: SCUMJsonRecord; safeSummary?: SCUMJsonRecord; blockerReason?: string; auditReferences?: string[]; createdAt: string; updatedAt: string; completedAt?: string; }
+export interface SCUMWorkflowStepResponse { id: string; workflowId: string; serverInstanceId: string; stepKey: string; dependsOn?: string[]; status: string; operationKey?: string; queryTemplateKey?: string; capability?: string; targetKey?: string; jobId?: string; attempt?: number; maxAttempts?: number; mutatesState?: boolean; confirmation?: SCUMJsonRecord; safeSummary?: SCUMJsonRecord; blockerReason?: string; auditReferences?: string[]; createdAt: string; updatedAt: string; completedAt?: string; }
+export interface SCUMOperationResponse { id: string; serverInstanceId: string; pluginId: string; templateKey: string; playerId?: string; requesterId?: string; approverId?: string; approvalLevel: string; payload?: SCUMJsonRecord; guard?: SCUMJsonRecord; confirmation?: SCUMJsonRecord; status: string; reason?: string; runJobId?: string; safeSummary?: SCUMJsonRecord; auditReferences?: string[]; createdAt: string; approvedAt?: string; completedAt?: string; updatedAt: string; }
+export type SCUMWorkflowListResponse = SCUMListResponse<SCUMWorkflowResponse>;
+export type SCUMWorkflowStepListResponse = SCUMListResponse<SCUMWorkflowStepResponse>;
+export type SCUMOperationListResponse = SCUMListResponse<SCUMOperationResponse>;
+
 export interface ServerConfigResponse {
   serverInstanceId: string;
   configVersion: number;