Add panel feature updates across API, daemon, and web

apps/api/src/routes/admin/index.ts

@@ -1,12 +1,197 @@
 import type { FastifyInstance } from 'fastify';
-import { eq, desc, count } from 'drizzle-orm';
-import { users, games, nodes, auditLogs } from '@source/database';
+import multipart from '@fastify/multipart';
+import { eq, desc, count, and } from 'drizzle-orm';
+import { Type } from '@sinclair/typebox';
+import { users, games, nodes, auditLogs, plugins, pluginReleases } from '@source/database';
 import { AppError } from '../../lib/errors.js';
 import { requireSuperAdmin } from '../../lib/permissions.js';
 import { paginate, paginatedResponse, PaginationQuerySchema } from '../../lib/pagination.js';
-import { CreateGameSchema, UpdateGameSchema, GameIdParamSchema } from './schemas.js';
+import { uploadPluginArtifact } from '../../lib/cdn.js';
+import * as yazl from 'yazl';
+import {
+  CreateGameSchema,
+  UpdateGameSchema,
+  GameIdParamSchema,
+  PluginIdParamSchema,
+  PluginReleaseIdParamSchema,
+  CreateGlobalPluginSchema,
+  UpdateGlobalPluginSchema,
+  ImportPluginsSchema,
+  CreatePluginReleaseSchema,
+  UpdatePluginReleaseSchema,
+} from './schemas.js';
+
+type ReleaseChannel = 'stable' | 'beta' | 'alpha';
+
+interface UploadArtifactFile {
+  relativePath: string;
+  data: Buffer;
+}
+
+interface UploadJsonFile {
+  filename: string;
+  data: Buffer;
+}
+
+function toSlug(value: string): string {
+  return value
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/(^-|-$)/g, '')
+    .slice(0, 200);
+}
+
+function sanitizeRelativeSegments(path: string): string[] {
+  const segments = path.replace(/\\/g, '/').split('/').filter(Boolean);
+  const normalized: string[] = [];
+
+  for (const segment of segments) {
+    if (segment === '.' || segment === '') continue;
+    if (segment === '..') {
+      throw AppError.badRequest('Invalid artifact path segment');
+    }
+    normalized.push(segment);
+  }
+
+  return normalized;
+}
+
+function normalizeRelativePath(path: string, fallbackName: string): string {
+  const segments = sanitizeRelativeSegments(path);
+  if (segments.length === 0) {
+    return sanitizeRelativeSegments(fallbackName).join('/');
+  }
+  return segments.join('/');
+}
+
+function parseJsonArrayField(rawValue: unknown, fieldName: string): unknown[] {
+  if (rawValue === undefined || rawValue === null || rawValue === '') return [];
+  if (typeof rawValue !== 'string') {
+    throw AppError.badRequest(`${fieldName} must be a JSON string`);
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(rawValue);
+  } catch {
+    throw AppError.badRequest(`${fieldName} is not valid JSON`);
+  }
+
+  if (!Array.isArray(parsed)) {
+    throw AppError.badRequest(`${fieldName} must be a JSON array`);
+  }
+
+  return parsed;
+}
+
+function parseJsonArrayUploadFile(
+  file: UploadJsonFile | null,
+  fieldName: string,
+): unknown[] {
+  if (!file) return [];
+
+  let rawValue = file.data.toString('utf8');
+  if (rawValue.charCodeAt(0) === 0xfeff) {
+    rawValue = rawValue.slice(1);
+  }
+
+  return parseJsonArrayField(rawValue, fieldName);
+}
+
+function parseJsonArrayInput(
+  rawValue: unknown,
+  file: UploadJsonFile | null,
+  fieldName: string,
+): unknown[] {
+  if (file) return parseJsonArrayUploadFile(file, fieldName);
+  return parseJsonArrayField(rawValue, fieldName);
+}
+
+function parseOptionalBoolean(rawValue: unknown): boolean | undefined {
+  if (rawValue === undefined || rawValue === null || rawValue === '') return undefined;
+  if (typeof rawValue === 'boolean') return rawValue;
+  if (typeof rawValue !== 'string') return undefined;
+
+  const normalized = rawValue.trim().toLowerCase();
+  if (normalized === 'true' || normalized === '1' || normalized === 'yes' || normalized === 'on') return true;
+  if (normalized === 'false' || normalized === '0' || normalized === 'no' || normalized === 'off') return false;
+  return undefined;
+}
+
+function parseReleaseChannel(rawValue: unknown): ReleaseChannel {
+  if (rawValue === 'alpha' || rawValue === 'beta' || rawValue === 'stable') return rawValue;
+  if (typeof rawValue === 'string') {
+    const normalized = rawValue.trim().toLowerCase();
+    if (normalized === 'alpha' || normalized === 'beta' || normalized === 'stable') return normalized;
+  }
+  return 'stable';
+}
+
+async function zipArtifacts(files: UploadArtifactFile[]): Promise<Buffer> {
+  return await new Promise<Buffer>((resolve, reject) => {
+    const archive = new yazl.ZipFile();
+    const chunks: Buffer[] = [];
+
+    archive.outputStream.on('data', (chunk: Buffer) => {
+      chunks.push(chunk);
+    });
+    archive.outputStream.on('error', reject);
+    archive.outputStream.on('end', () => {
+      resolve(Buffer.concat(chunks));
+    });
+
+    for (const file of files) {
+      archive.addBuffer(file.data, file.relativePath.replace(/^\/+/g, ''));
+    }
+
+    archive.end();
+  });
+}
+
+async function resolveImportGame(
+  app: FastifyInstance,
+  {
+    gameId,
+    gameSlug,
+  }: {
+    gameId?: string;
+    gameSlug?: string;
+  },
+) {
+  if (gameId) {
+    const game = await app.db.query.games.findFirst({
+      where: eq(games.id, gameId),
+    });
+    if (!game) {
+      throw AppError.notFound(`Game not found: ${gameId}`);
+    }
+    return game;
+  }
+
+  const normalizedSlug = gameSlug?.trim().toLowerCase();
+  if (normalizedSlug) {
+    const game = await app.db.query.games.findFirst({
+      where: eq(games.slug, normalizedSlug),
+    });
+    if (!game) {
+      throw AppError.notFound(`Game not found: ${normalizedSlug}`);
+    }
+    return game;
+  }
+
+  throw AppError.badRequest('gameId or gameSlug is required for each import item');
+}
 
 export default async function adminRoutes(app: FastifyInstance) {
+  await app.register(multipart, {
+    limits: {
+      files: 200,
+      parts: 600,
+      fileSize: 512 * 1024 * 1024,
+    },
+  });
+
   // All admin routes require auth + super admin
   app.addHook('onRequest', app.authenticate);
   app.addHook('onRequest', async (request) => {
@@ -100,6 +285,617 @@ export default async function adminRoutes(app: FastifyInstance) {
 
   // === Nodes (global view) ===
 
+  // === Global Plugins ===
+
+  app.get(
+    '/plugins',
+    {
+      schema: {
+        querystring: Type.Object({
+          gameId: Type.Optional(Type.String({ format: 'uuid' })),
+        }),
+      },
+    },
+    async (request) => {
+      const { gameId } = request.query as { gameId?: string };
+
+      const rows = await app.db
+        .select({
+          id: plugins.id,
+          gameId: plugins.gameId,
+          name: plugins.name,
+          slug: plugins.slug,
+          description: plugins.description,
+          source: plugins.source,
+          isGlobal: plugins.isGlobal,
+          updatedAt: plugins.updatedAt,
+          gameName: games.name,
+          gameSlug: games.slug,
+        })
+        .from(plugins)
+        .innerJoin(games, eq(plugins.gameId, games.id))
+        .where(gameId ? eq(plugins.gameId, gameId) : undefined)
+        .orderBy(plugins.name);
+
+      return { data: rows };
+    },
+  );
+
+  app.post('/plugins', { schema: CreateGlobalPluginSchema }, async (request, reply) => {
+    const body = request.body as {
+      gameId: string;
+      name: string;
+      slug?: string;
+      description?: string;
+      source?: 'manual' | 'spiget';
+    };
+
+    const game = await app.db.query.games.findFirst({
+      where: eq(games.id, body.gameId),
+    });
+    if (!game) throw AppError.notFound('Game not found');
+
+    const slug = toSlug(body.slug ?? body.name);
+    if (!slug) throw AppError.badRequest('Plugin slug is invalid');
+
+    const existing = await app.db.query.plugins.findFirst({
+      where: and(eq(plugins.gameId, body.gameId), eq(plugins.slug, slug)),
+    });
+    if (existing) throw AppError.conflict('Plugin slug already exists for this game');
+
+    const [created] = await app.db
+      .insert(plugins)
+      .values({
+        gameId: body.gameId,
+        name: body.name,
+        slug,
+        description: body.description ?? null,
+        source: body.source ?? 'manual',
+        isGlobal: true,
+      })
+      .returning();
+
+    return reply.code(201).send(created);
+  });
+
+  app.post('/plugins/import', { schema: ImportPluginsSchema }, async (request) => {
+    const body = request.body as {
+      defaultGameId?: string;
+      defaultGameSlug?: string;
+      stopOnError?: boolean;
+      items: Array<{
+        gameId?: string;
+        gameSlug?: string;
+        plugin: {
+          name: string;
+          slug?: string;
+          description?: string;
+          source?: 'manual' | 'spiget';
+          isGlobal?: boolean;
+        };
+        release?: {
+          version: string;
+          channel?: 'stable' | 'beta' | 'alpha';
+          artifactType?: 'file' | 'zip';
+          artifactUrl: string;
+          destination?: string;
+          fileName?: string;
+          changelog?: string;
+          installSchema?: unknown[];
+          configTemplates?: unknown[];
+          isPublished?: boolean;
+        };
+      }>;
+    };
+
+    const results: Array<{
+      index: number;
+      success: boolean;
+      gameId?: string;
+      gameSlug?: string;
+      pluginId?: string;
+      pluginSlug?: string;
+      pluginAction?: 'created' | 'updated';
+      releaseId?: string;
+      releaseVersion?: string;
+      releaseAction?: 'created' | 'updated' | 'skipped';
+      error?: string;
+    }> = [];
+
+    for (const [index, item] of body.items.entries()) {
+      try {
+        const game = await resolveImportGame(app, {
+          gameId: item.gameId ?? body.defaultGameId,
+          gameSlug: item.gameSlug ?? body.defaultGameSlug,
+        });
+
+        const pluginPayload = item.plugin;
+        const pluginSlug = toSlug(pluginPayload.slug ?? pluginPayload.name);
+        if (!pluginSlug) {
+          throw AppError.badRequest('Plugin slug is invalid');
+        }
+
+        const existingPlugin = await app.db.query.plugins.findFirst({
+          where: and(eq(plugins.gameId, game.id), eq(plugins.slug, pluginSlug)),
+        });
+
+        let pluginRecord: typeof plugins.$inferSelect;
+        let pluginAction: 'created' | 'updated';
+
+        if (existingPlugin) {
+          const [updatedPlugin] = await app.db
+            .update(plugins)
+            .set({
+              name: pluginPayload.name,
+              slug: pluginSlug,
+              description:
+                pluginPayload.description !== undefined
+                  ? pluginPayload.description
+                  : existingPlugin.description,
+              source: pluginPayload.source ?? existingPlugin.source,
+              isGlobal: pluginPayload.isGlobal ?? existingPlugin.isGlobal,
+              updatedAt: new Date(),
+            })
+            .where(eq(plugins.id, existingPlugin.id))
+            .returning();
+
+          if (!updatedPlugin) {
+            throw AppError.notFound('Plugin not found');
+          }
+
+          pluginRecord = updatedPlugin;
+          pluginAction = 'updated';
+        } else {
+          const [createdPlugin] = await app.db
+            .insert(plugins)
+            .values({
+              gameId: game.id,
+              name: pluginPayload.name,
+              slug: pluginSlug,
+              description: pluginPayload.description ?? null,
+              source: pluginPayload.source ?? 'manual',
+              isGlobal: pluginPayload.isGlobal ?? true,
+            })
+            .returning();
+
+          if (!createdPlugin) {
+            throw new AppError(500, 'Failed to create plugin');
+          }
+
+          pluginRecord = createdPlugin;
+          pluginAction = 'created';
+        }
+
+        let releaseAction: 'created' | 'updated' | 'skipped' = 'skipped';
+        let releaseRecord: typeof pluginReleases.$inferSelect | null = null;
+
+        if (item.release) {
+          const releasePayload = item.release;
+          const existingRelease = await app.db.query.pluginReleases.findFirst({
+            where: and(
+              eq(pluginReleases.pluginId, pluginRecord.id),
+              eq(pluginReleases.version, releasePayload.version),
+            ),
+          });
+
+          if (existingRelease) {
+            const [updatedRelease] = await app.db
+              .update(pluginReleases)
+              .set({
+                channel: releasePayload.channel ?? existingRelease.channel,
+                artifactType: releasePayload.artifactType ?? existingRelease.artifactType,
+                artifactUrl: releasePayload.artifactUrl,
+                destination:
+                  releasePayload.destination !== undefined
+                    ? releasePayload.destination
+                    : existingRelease.destination,
+                fileName:
+                  releasePayload.fileName !== undefined
+                    ? releasePayload.fileName
+                    : existingRelease.fileName,
+                changelog:
+                  releasePayload.changelog !== undefined
+                    ? releasePayload.changelog
+                    : existingRelease.changelog,
+                installSchema: releasePayload.installSchema ?? existingRelease.installSchema,
+                configTemplates: releasePayload.configTemplates ?? existingRelease.configTemplates,
+                isPublished: releasePayload.isPublished ?? existingRelease.isPublished,
+                updatedAt: new Date(),
+              })
+              .where(eq(pluginReleases.id, existingRelease.id))
+              .returning();
+
+            if (!updatedRelease) {
+              throw AppError.notFound('Plugin release not found');
+            }
+
+            releaseRecord = updatedRelease;
+            releaseAction = 'updated';
+          } else {
+            const [createdRelease] = await app.db
+              .insert(pluginReleases)
+              .values({
+                pluginId: pluginRecord.id,
+                version: releasePayload.version,
+                channel: releasePayload.channel ?? 'stable',
+                artifactType: releasePayload.artifactType ?? 'file',
+                artifactUrl: releasePayload.artifactUrl,
+                destination: releasePayload.destination ?? null,
+                fileName: releasePayload.fileName ?? null,
+                changelog: releasePayload.changelog ?? null,
+                installSchema: releasePayload.installSchema ?? [],
+                configTemplates: releasePayload.configTemplates ?? [],
+                isPublished: releasePayload.isPublished ?? true,
+                createdByUserId: request.user.sub,
+              })
+              .returning();
+
+            if (!createdRelease) {
+              throw new AppError(500, 'Failed to create plugin release');
+            }
+
+            releaseRecord = createdRelease;
+            releaseAction = 'created';
+          }
+        }
+
+        results.push({
+          index,
+          success: true,
+          gameId: game.id,
+          gameSlug: game.slug,
+          pluginId: pluginRecord.id,
+          pluginSlug: pluginRecord.slug,
+          pluginAction,
+          releaseId: releaseRecord?.id,
+          releaseVersion: releaseRecord?.version,
+          releaseAction,
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (body.stopOnError) {
+          throw AppError.badRequest(`Import failed at item ${index}: ${message}`);
+        }
+
+        results.push({
+          index,
+          success: false,
+          error: message,
+        });
+      }
+    }
+
+    const succeeded = results.filter((result) => result.success).length;
+    const failed = results.length - succeeded;
+
+    return {
+      results,
+      summary: {
+        total: results.length,
+        succeeded,
+        failed,
+      },
+    };
+  });
+
+  app.patch('/plugins/:pluginId', { schema: { ...PluginIdParamSchema, ...UpdateGlobalPluginSchema } }, async (request) => {
+    const { pluginId } = request.params as { pluginId: string };
+    const body = request.body as {
+      name?: string;
+      slug?: string;
+      description?: string;
+      source?: 'manual' | 'spiget';
+      isGlobal?: boolean;
+    };
+
+    const existing = await app.db.query.plugins.findFirst({
+      where: eq(plugins.id, pluginId),
+    });
+    if (!existing) throw AppError.notFound('Plugin not found');
+
+    const nextSlug = body.slug !== undefined
+      ? toSlug(body.slug)
+      : (body.name !== undefined ? toSlug(body.name) : existing.slug);
+    if (!nextSlug) throw AppError.badRequest('Plugin slug is invalid');
+
+    const duplicate = await app.db.query.plugins.findFirst({
+      where: and(eq(plugins.gameId, existing.gameId), eq(plugins.slug, nextSlug)),
+    });
+    if (duplicate && duplicate.id !== existing.id) {
+      throw AppError.conflict('Plugin slug already exists for this game');
+    }
+
+    const [updated] = await app.db
+      .update(plugins)
+      .set({
+        name: body.name ?? existing.name,
+        slug: nextSlug,
+        description: body.description ?? existing.description,
+        source: body.source ?? existing.source,
+        isGlobal: body.isGlobal ?? existing.isGlobal,
+        updatedAt: new Date(),
+      })
+      .where(eq(plugins.id, existing.id))
+      .returning();
+
+    if (!updated) throw AppError.notFound('Plugin not found');
+    return updated;
+  });
+
+  app.get('/plugins/:pluginId/releases', { schema: PluginIdParamSchema }, async (request) => {
+    const { pluginId } = request.params as { pluginId: string };
+
+    const plugin = await app.db.query.plugins.findFirst({
+      where: eq(plugins.id, pluginId),
+    });
+    if (!plugin) throw AppError.notFound('Plugin not found');
+
+    const releases = await app.db
+      .select()
+      .from(pluginReleases)
+      .where(eq(pluginReleases.pluginId, pluginId))
+      .orderBy(desc(pluginReleases.createdAt));
+
+    return { plugin, releases };
+  });
+
+  app.post('/plugins/:pluginId/releases/upload', { schema: PluginIdParamSchema }, async (request, reply) => {
+    const { pluginId } = request.params as { pluginId: string };
+
+    const plugin = await app.db.query.plugins.findFirst({
+      where: eq(plugins.id, pluginId),
+    });
+    if (!plugin) throw AppError.notFound('Plugin not found');
+
+    if (!request.isMultipart()) {
+      throw AppError.badRequest('Content-Type must be multipart/form-data');
+    }
+
+    const fields: Record<string, unknown> = {};
+    const files: UploadArtifactFile[] = [];
+    let installSchemaFile: UploadJsonFile | null = null;
+    let configTemplatesFile: UploadJsonFile | null = null;
+    const relativePathQueue: string[] = [];
+
+    for await (const part of request.parts()) {
+      if (part.type === 'file') {
+        if (part.fieldname === 'installSchemaFile') {
+          const data = await part.toBuffer();
+          if (data.length > 0) {
+            installSchemaFile = {
+              filename: part.filename || 'install-schema.json',
+              data,
+            };
+          }
+          continue;
+        }
+
+        if (part.fieldname === 'configTemplatesFile') {
+          const data = await part.toBuffer();
+          if (data.length > 0) {
+            configTemplatesFile = {
+              filename: part.filename || 'config-templates.json',
+              data,
+            };
+          }
+          continue;
+        }
+
+        const fallbackName = `artifact-${files.length + 1}.bin`;
+        const queuedPath = relativePathQueue.shift();
+        const relativePath = normalizeRelativePath(
+          queuedPath ?? part.filename ?? '',
+          fallbackName,
+        );
+        const data = await part.toBuffer();
+        if (data.length === 0) continue;
+        files.push({ relativePath, data });
+      } else {
+        if (part.fieldname === 'relativePath') {
+          const raw = typeof part.value === 'string' ? part.value : '';
+          relativePathQueue.push(raw);
+          continue;
+        }
+
+        fields[part.fieldname] = part.value;
+      }
+    }
+
+    if (files.length === 0) {
+      throw AppError.badRequest('At least one file is required');
+    }
+
+    const version = typeof fields.version === 'string' ? fields.version.trim() : '';
+    if (!version) {
+      throw AppError.badRequest('version is required');
+    }
+
+    const channel = parseReleaseChannel(fields.channel);
+    const destination = typeof fields.destination === 'string' && fields.destination.trim().length > 0
+      ? fields.destination.trim()
+      : null;
+    const changelog = typeof fields.changelog === 'string' && fields.changelog.trim().length > 0
+      ? fields.changelog
+      : null;
+    const isPublished = parseOptionalBoolean(fields.isPublished) ?? true;
+    const installSchema = parseJsonArrayInput(fields.installSchema, installSchemaFile, 'installSchema');
+    const configTemplates = parseJsonArrayInput(
+      fields.configTemplates,
+      configTemplatesFile,
+      'configTemplates',
+    );
+
+    const rawFileName = typeof fields.fileName === 'string' ? fields.fileName.trim() : '';
+    const hasNestedPaths = files.some((entry) => entry.relativePath.includes('/'));
+    const shouldZip = files.length > 1 || hasNestedPaths;
+
+    let artifactType: 'file' | 'zip';
+    let artifactContent: Buffer;
+    let uploadFileName: string;
+    let releaseFileName: string | null;
+
+    if (shouldZip) {
+      artifactType = 'zip';
+      artifactContent = await zipArtifacts(files);
+
+      const suggestedName = rawFileName || `${toSlug(plugin.slug || plugin.name)}-${version}.zip`;
+      uploadFileName = suggestedName.toLowerCase().endsWith('.zip')
+        ? suggestedName
+        : `${suggestedName}.zip`;
+      releaseFileName = null;
+    } else {
+      artifactType = 'file';
+      const [singleFile] = files;
+      if (!singleFile) {
+        throw AppError.badRequest('No artifact file received');
+      }
+
+      artifactContent = singleFile.data;
+      const originalName = singleFile.relativePath.split('/').pop() ?? 'artifact.bin';
+      uploadFileName = rawFileName || originalName;
+      releaseFileName = uploadFileName;
+    }
+
+    const uploaded = await uploadPluginArtifact(artifactContent, uploadFileName, {
+      pluginId: plugin.id,
+      pluginSlug: plugin.slug,
+      releaseVersion: version,
+      uploadedBy: request.user.sub,
+      uploadMode: shouldZip ? 'archive' : 'single',
+      sourceFileCount: files.length,
+    });
+
+    const [created] = await app.db
+      .insert(pluginReleases)
+      .values({
+        pluginId: plugin.id,
+        version,
+        channel,
+        artifactType,
+        artifactUrl: uploaded.artifactPointer,
+        destination,
+        fileName: releaseFileName,
+        changelog,
+        installSchema,
+        configTemplates,
+        isPublished,
+        createdByUserId: request.user.sub,
+      })
+      .returning();
+
+    return reply.code(201).send({
+      release: created,
+      artifact: {
+        bucket: uploaded.bucket,
+        fileId: uploaded.file.id,
+        storedName: uploaded.file.storedName,
+        originalName: uploaded.file.originalName,
+        pointer: uploaded.artifactPointer,
+      },
+    });
+  });
+
+  app.post('/plugins/:pluginId/releases', { schema: { ...PluginIdParamSchema, ...CreatePluginReleaseSchema } }, async (request, reply) => {
+    const { pluginId } = request.params as { pluginId: string };
+    const body = request.body as {
+      version: string;
+      channel?: 'stable' | 'beta' | 'alpha';
+      artifactType?: 'file' | 'zip';
+      artifactUrl: string;
+      destination?: string;
+      fileName?: string;
+      changelog?: string;
+      installSchema?: unknown[];
+      configTemplates?: unknown[];
+      isPublished?: boolean;
+      cloneFromReleaseId?: string;
+    };
+
+    const plugin = await app.db.query.plugins.findFirst({
+      where: eq(plugins.id, pluginId),
+    });
+    if (!plugin) throw AppError.notFound('Plugin not found');
+
+    let baseRelease: typeof pluginReleases.$inferSelect | null = null;
+    if (body.cloneFromReleaseId) {
+      baseRelease = await app.db.query.pluginReleases.findFirst({
+        where: and(
+          eq(pluginReleases.id, body.cloneFromReleaseId),
+          eq(pluginReleases.pluginId, pluginId),
+        ),
+      }) ?? null;
+      if (!baseRelease) {
+        throw AppError.notFound('Clone source release not found');
+      }
+    }
+
+    const [created] = await app.db
+      .insert(pluginReleases)
+      .values({
+        pluginId,
+        version: body.version,
+        channel: body.channel ?? baseRelease?.channel ?? 'stable',
+        artifactType: body.artifactType ?? baseRelease?.artifactType ?? 'file',
+        artifactUrl: body.artifactUrl,
+        destination: body.destination ?? baseRelease?.destination ?? null,
+        fileName: body.fileName ?? baseRelease?.fileName ?? null,
+        changelog: body.changelog ?? baseRelease?.changelog ?? null,
+        installSchema: body.installSchema ?? baseRelease?.installSchema ?? [],
+        configTemplates: body.configTemplates ?? baseRelease?.configTemplates ?? [],
+        isPublished: body.isPublished ?? baseRelease?.isPublished ?? true,
+        createdByUserId: request.user.sub,
+      })
+      .returning();
+
+    return reply.code(201).send(created);
+  });
+
+  app.patch(
+    '/plugins/:pluginId/releases/:releaseId',
+    { schema: { ...PluginReleaseIdParamSchema, ...UpdatePluginReleaseSchema } },
+    async (request) => {
+      const { pluginId, releaseId } = request.params as { pluginId: string; releaseId: string };
+      const body = request.body as {
+        version?: string;
+        channel?: 'stable' | 'beta' | 'alpha';
+        artifactType?: 'file' | 'zip';
+        artifactUrl?: string;
+        destination?: string;
+        fileName?: string;
+        changelog?: string;
+        installSchema?: unknown[];
+        configTemplates?: unknown[];
+        isPublished?: boolean;
+      };
+
+      const release = await app.db.query.pluginReleases.findFirst({
+        where: and(eq(pluginReleases.id, releaseId), eq(pluginReleases.pluginId, pluginId)),
+      });
+      if (!release) throw AppError.notFound('Plugin release not found');
+
+      const [updated] = await app.db
+        .update(pluginReleases)
+        .set({
+          version: body.version ?? release.version,
+          channel: body.channel ?? release.channel,
+          artifactType: body.artifactType ?? release.artifactType,
+          artifactUrl: body.artifactUrl ?? release.artifactUrl,
+          destination: body.destination ?? release.destination,
+          fileName: body.fileName ?? release.fileName,
+          changelog: body.changelog ?? release.changelog,
+          installSchema: body.installSchema ?? release.installSchema,
+          configTemplates: body.configTemplates ?? release.configTemplates,
+          isPublished: body.isPublished ?? release.isPublished,
+          updatedAt: new Date(),
+        })
+        .where(eq(pluginReleases.id, release.id))
+        .returning();
+
+      if (!updated) throw AppError.notFound('Plugin release not found');
+      return updated;
+    },
+  );
+
   // GET /api/admin/nodes
   app.get('/nodes', async () => {
     const nodeList = await app.db

apps/api/src/routes/admin/schemas.ts

@@ -32,3 +32,132 @@ export const GameIdParamSchema = {
     gameId: Type.String({ format: 'uuid' }),
   }),
 };
+
+export const PluginIdParamSchema = {
+  params: Type.Object({
+    pluginId: Type.String({ format: 'uuid' }),
+  }),
+};
+
+export const PluginReleaseIdParamSchema = {
+  params: Type.Object({
+    pluginId: Type.String({ format: 'uuid' }),
+    releaseId: Type.String({ format: 'uuid' }),
+  }),
+};
+
+export const CreateGlobalPluginSchema = {
+  body: Type.Object({
+    gameId: Type.String({ format: 'uuid' }),
+    name: Type.String({ minLength: 1, maxLength: 255 }),
+    slug: Type.Optional(Type.String({ minLength: 1, maxLength: 255 })),
+    description: Type.Optional(Type.String()),
+    source: Type.Optional(Type.Union([Type.Literal('manual'), Type.Literal('spiget')])),
+  }),
+};
+
+export const UpdateGlobalPluginSchema = {
+  body: Type.Object({
+    name: Type.Optional(Type.String({ minLength: 1, maxLength: 255 })),
+    slug: Type.Optional(Type.String({ minLength: 1, maxLength: 255 })),
+    description: Type.Optional(Type.String()),
+    source: Type.Optional(Type.Union([Type.Literal('manual'), Type.Literal('spiget')])),
+    isGlobal: Type.Optional(Type.Boolean()),
+  }),
+};
+
+const ImportPluginPayloadSchema = Type.Object({
+  name: Type.String({ minLength: 1, maxLength: 255 }),
+  slug: Type.Optional(Type.String({ minLength: 1, maxLength: 255 })),
+  description: Type.Optional(Type.String()),
+  source: Type.Optional(Type.Union([Type.Literal('manual'), Type.Literal('spiget')])),
+  isGlobal: Type.Optional(Type.Boolean()),
+});
+
+export const ReleaseInstallFieldSchema = Type.Object({
+  key: Type.String({ minLength: 1, maxLength: 120 }),
+  label: Type.String({ minLength: 1, maxLength: 255 }),
+  type: Type.Union([
+    Type.Literal('text'),
+    Type.Literal('number'),
+    Type.Literal('boolean'),
+    Type.Literal('select'),
+  ]),
+  description: Type.Optional(Type.String({ maxLength: 1000 })),
+  required: Type.Optional(Type.Boolean()),
+  defaultValue: Type.Optional(Type.Any()),
+  options: Type.Optional(Type.Array(Type.Object({
+    label: Type.String({ minLength: 1, maxLength: 255 }),
+    value: Type.String({ minLength: 1, maxLength: 255 }),
+  }))),
+  min: Type.Optional(Type.Number()),
+  max: Type.Optional(Type.Number()),
+  pattern: Type.Optional(Type.String({ maxLength: 500 })),
+  secret: Type.Optional(Type.Boolean()),
+});
+
+export const ReleaseTemplateSchema = Type.Object({
+  path: Type.String({ minLength: 1 }),
+  content: Type.String(),
+});
+
+const ImportPluginReleasePayloadSchema = Type.Object({
+  version: Type.String({ minLength: 1, maxLength: 100 }),
+  channel: Type.Optional(Type.Union([Type.Literal('stable'), Type.Literal('beta'), Type.Literal('alpha')])),
+  artifactType: Type.Optional(Type.Union([Type.Literal('file'), Type.Literal('zip')])),
+  artifactUrl: Type.String({ format: 'uri' }),
+  destination: Type.Optional(Type.String({ minLength: 1 })),
+  fileName: Type.Optional(Type.String({ minLength: 1, maxLength: 255 })),
+  changelog: Type.Optional(Type.String()),
+  installSchema: Type.Optional(Type.Array(ReleaseInstallFieldSchema)),
+  configTemplates: Type.Optional(Type.Array(ReleaseTemplateSchema)),
+  isPublished: Type.Optional(Type.Boolean()),
+});
+
+export const ImportPluginsSchema = {
+  body: Type.Object({
+    defaultGameId: Type.Optional(Type.String({ format: 'uuid' })),
+    defaultGameSlug: Type.Optional(Type.String({ minLength: 1, maxLength: 100 })),
+    stopOnError: Type.Optional(Type.Boolean()),
+    items: Type.Array(
+      Type.Object({
+        gameId: Type.Optional(Type.String({ format: 'uuid' })),
+        gameSlug: Type.Optional(Type.String({ minLength: 1, maxLength: 100 })),
+        plugin: ImportPluginPayloadSchema,
+        release: Type.Optional(ImportPluginReleasePayloadSchema),
+      }),
+      { minItems: 1, maxItems: 500 },
+    ),
+  }),
+};
+
+export const CreatePluginReleaseSchema = {
+  body: Type.Object({
+    version: Type.String({ minLength: 1, maxLength: 100 }),
+    channel: Type.Optional(Type.Union([Type.Literal('stable'), Type.Literal('beta'), Type.Literal('alpha')])),
+    artifactType: Type.Optional(Type.Union([Type.Literal('file'), Type.Literal('zip')])),
+    artifactUrl: Type.String({ format: 'uri' }),
+    destination: Type.Optional(Type.String({ minLength: 1 })),
+    fileName: Type.Optional(Type.String({ minLength: 1, maxLength: 255 })),
+    changelog: Type.Optional(Type.String()),
+    installSchema: Type.Optional(Type.Array(ReleaseInstallFieldSchema)),
+    configTemplates: Type.Optional(Type.Array(ReleaseTemplateSchema)),
+    isPublished: Type.Optional(Type.Boolean()),
+    cloneFromReleaseId: Type.Optional(Type.String({ format: 'uuid' })),
+  }),
+};
+
+export const UpdatePluginReleaseSchema = {
+  body: Type.Object({
+    version: Type.Optional(Type.String({ minLength: 1, maxLength: 100 })),
+    channel: Type.Optional(Type.Union([Type.Literal('stable'), Type.Literal('beta'), Type.Literal('alpha')])),
+    artifactType: Type.Optional(Type.Union([Type.Literal('file'), Type.Literal('zip')])),
+    artifactUrl: Type.Optional(Type.String({ format: 'uri' })),
+    destination: Type.Optional(Type.String({ minLength: 1 })),
+    fileName: Type.Optional(Type.String({ minLength: 1, maxLength: 255 })),
+    changelog: Type.Optional(Type.String()),
+    installSchema: Type.Optional(Type.Array(ReleaseInstallFieldSchema)),
+    configTemplates: Type.Optional(Type.Array(ReleaseTemplateSchema)),
+    isPublished: Type.Optional(Type.Boolean()),
+  }),
+};

apps/api/src/routes/internal/index.ts

@@ -12,6 +12,19 @@ function extractBearerToken(authHeader?: string): string | null {
   return token;
 }
 
+function extractCdnWebhookSecret(request: FastifyRequest): string | null {
+  const byHeader = request.headers['x-cdn-webhook-secret'] ?? request.headers['x-webhook-secret'];
+  if (typeof byHeader === 'string' && byHeader.trim().length > 0) {
+    return byHeader.trim();
+  }
+
+  const authHeader = typeof request.headers.authorization === 'string'
+    ? request.headers.authorization
+    : undefined;
+
+  return extractBearerToken(authHeader);
+}
+
 async function requireDaemonToken(
   app: FastifyInstance,
   request: FastifyRequest,
@@ -39,6 +52,36 @@ async function requireDaemonToken(
 }
 
 export default async function internalRoutes(app: FastifyInstance) {
+  app.post(
+    '/cdn/webhook/plugins',
+    {
+      schema: {
+        body: Type.Optional(Type.Unknown()),
+      },
+    },
+    async (request, reply) => {
+      const configuredSecret = process.env.CDN_WEBHOOK_SECRET?.trim();
+      if (configuredSecret) {
+        const providedSecret = extractCdnWebhookSecret(request);
+        if (!providedSecret || providedSecret !== configuredSecret) {
+          throw AppError.unauthorized('Invalid CDN webhook secret', 'CDN_WEBHOOK_AUTH_INVALID');
+        }
+      }
+
+      const body = request.body as Record<string, unknown> | undefined;
+      const eventType = typeof body?.eventType === 'string'
+        ? body.eventType
+        : (typeof body?.type === 'string' ? body.type : 'unknown');
+
+      request.log.info(
+        { eventType, payload: body },
+        'Received CDN plugin webhook event',
+      );
+
+      return reply.code(202).send({ accepted: true });
+    },
+  );
+
   app.get('/schedules/due', async (request) => {
     const node = await requireDaemonToken(app, request);
     const now = new Date();

apps/api/src/routes/servers/config.ts

@@ -7,6 +7,11 @@ import { AppError } from '../../lib/errors.js';
 import { requirePermission } from '../../lib/permissions.js';
 import { parseConfig, serializeConfig } from '../../lib/config-parsers.js';
 import { daemonReadFile, daemonWriteFile, type DaemonNodeConnection } from '../../lib/daemon.js';
+import {
+  isManagedCs2ServerConfigPath,
+  readManagedCs2ServerConfig,
+  writeManagedCs2ServerConfig,
+} from '../../lib/cs2-server-config.js';
 
 const ParamSchema = {
   params: Type.Object({
@@ -61,12 +66,16 @@ export default async function configRoutes(app: FastifyInstance) {
     };
     await requirePermission(request, orgId, 'config.read');
 
-    const { server, node, configFile } = await getServerConfig(app, orgId, serverId, configIndex);
+    const { game, server, node, configFile } = await getServerConfig(app, orgId, serverId, configIndex);
 
     let raw = '';
     try {
-      const file = await daemonReadFile(node, server.uuid, configFile.path);
-      raw = file.data.toString('utf8');
+      if (isManagedCs2ServerConfigPath(game.slug, configFile.path)) {
+        raw = await readManagedCs2ServerConfig(node, server.uuid);
+      } else {
+        const file = await daemonReadFile(node, server.uuid, configFile.path);
+        raw = file.data.toString('utf8');
+      }
     } catch (error) {
       if (!isMissingConfigFileError(error)) {
         app.log.error({ error, serverId, path: configFile.path }, 'Failed to read config file from daemon');
@@ -109,13 +118,19 @@ export default async function configRoutes(app: FastifyInstance) {
       const { entries } = request.body as { entries: { key: string; value: string }[] };
       await requirePermission(request, orgId, 'config.write');
 
-      const { server, node, configFile } = await getServerConfig(app, orgId, serverId, configIndex);
+      const { game, server, node, configFile } = await getServerConfig(app, orgId, serverId, configIndex);
+
+      const isManagedCs2Config = isManagedCs2ServerConfigPath(game.slug, configFile.path);
 
       let originalContent: string | undefined;
       let originalEntries: { key: string; value: string }[] = [];
       try {
-        const current = await daemonReadFile(node, server.uuid, configFile.path);
-        originalContent = current.data.toString('utf8');
+        if (isManagedCs2Config) {
+          originalContent = await readManagedCs2ServerConfig(node, server.uuid);
+        } else {
+          const current = await daemonReadFile(node, server.uuid, configFile.path);
+          originalContent = current.data.toString('utf8');
+        }
         originalEntries = parseConfig(originalContent, configFile.parser as ConfigParser);
       } catch (error) {
         if (!isMissingConfigFileError(error)) {
@@ -146,7 +161,11 @@ export default async function configRoutes(app: FastifyInstance) {
         originalContent,
       );
 
-      await daemonWriteFile(node, server.uuid, configFile.path, content);
+      if (isManagedCs2Config) {
+        await writeManagedCs2ServerConfig(node, server.uuid, content);
+      } else {
+        await daemonWriteFile(node, server.uuid, configFile.path, content);
+      }
       return { success: true, path: configFile.path, content };
     },
   );

apps/api/src/routes/servers/databases.ts

@@ -0,0 +1,343 @@
+import type { FastifyInstance } from 'fastify';
+import { Type } from '@sinclair/typebox';
+import { and, eq } from 'drizzle-orm';
+import { nodes, serverDatabases, servers } from '@source/database';
+import { AppError } from '../../lib/errors.js';
+import { requirePermission } from '../../lib/permissions.js';
+import { createAuditLog } from '../../lib/audit.js';
+import {
+  daemonCreateDatabase,
+  daemonDeleteDatabase,
+  daemonUpdateDatabasePassword,
+  type DaemonNodeConnection,
+} from '../../lib/daemon.js';
+
+const ServerDatabaseParamSchema = {
+  params: Type.Object({
+    orgId: Type.String({ format: 'uuid' }),
+    serverId: Type.String({ format: 'uuid' }),
+    databaseId: Type.String({ format: 'uuid' }),
+  }),
+};
+
+const ServerScopeSchema = {
+  params: Type.Object({
+    orgId: Type.String({ format: 'uuid' }),
+    serverId: Type.String({ format: 'uuid' }),
+  }),
+};
+
+const CreateServerDatabaseSchema = {
+  body: Type.Object({
+    name: Type.String({ minLength: 1, maxLength: 255 }),
+    password: Type.Optional(Type.String({ minLength: 8, maxLength: 255 })),
+  }),
+};
+
+const UpdateServerDatabaseSchema = {
+  body: Type.Object({
+    name: Type.Optional(Type.String({ minLength: 1, maxLength: 255 })),
+    password: Type.Optional(Type.String({ minLength: 8, maxLength: 255 })),
+  }),
+};
+
+async function getServerContext(app: FastifyInstance, orgId: string, serverId: string) {
+  const [server] = await app.db
+    .select({
+      id: servers.id,
+      name: servers.name,
+      uuid: servers.uuid,
+      nodeFqdn: nodes.fqdn,
+      nodeGrpcPort: nodes.grpcPort,
+      nodeDaemonToken: nodes.daemonToken,
+    })
+    .from(servers)
+    .innerJoin(nodes, eq(servers.nodeId, nodes.id))
+    .where(and(eq(servers.id, serverId), eq(servers.organizationId, orgId)));
+
+  if (!server) {
+    throw AppError.notFound('Server not found');
+  }
+
+  return server;
+}
+
+function buildNodeConnection(server: {
+  nodeDaemonToken: string;
+  nodeFqdn: string;
+  nodeGrpcPort: number;
+}): DaemonNodeConnection {
+  return {
+    fqdn: server.nodeFqdn,
+    grpcPort: server.nodeGrpcPort,
+    daemonToken: server.nodeDaemonToken,
+  };
+}
+
+function daemonErrorMessage(error: unknown, fallback: string): string {
+  if (error instanceof Error && error.message.trim()) {
+    return error.message;
+  }
+
+  return fallback;
+}
+
+export default async function databaseRoutes(app: FastifyInstance) {
+  app.addHook('onRequest', app.authenticate);
+
+  app.get('/', { schema: ServerScopeSchema }, async (request) => {
+    const { orgId, serverId } = request.params as { orgId: string; serverId: string };
+    await requirePermission(request, orgId, 'server.read');
+    await getServerContext(app, orgId, serverId);
+
+    const databases = await app.db
+      .select()
+      .from(serverDatabases)
+      .where(eq(serverDatabases.serverId, serverId))
+      .orderBy(serverDatabases.createdAt);
+
+    return { data: databases };
+  });
+
+  app.post('/', { schema: { ...ServerScopeSchema, ...CreateServerDatabaseSchema } }, async (request, reply) => {
+    const { orgId, serverId } = request.params as { orgId: string; serverId: string };
+    await requirePermission(request, orgId, 'server.update');
+
+    const body = request.body as { name: string; password?: string };
+    const name = body.name.trim();
+    if (!name) {
+      throw AppError.badRequest('Database name is required');
+    }
+
+    const server = await getServerContext(app, orgId, serverId);
+
+    let managedDatabase;
+    try {
+      managedDatabase = await daemonCreateDatabase(buildNodeConnection(server), {
+        name,
+        password: body.password,
+        serverUuid: server.uuid,
+      });
+    } catch (error) {
+      request.log.error(
+        { error, orgId, serverId, serverUuid: server.uuid },
+        'Failed to provision node-local MySQL database',
+      );
+      throw new AppError(
+        502,
+        daemonErrorMessage(error, 'Failed to provision node-local MySQL database'),
+        'MANAGED_MYSQL_CREATE_FAILED',
+      );
+    }
+
+    try {
+      const [created] = await app.db
+        .insert(serverDatabases)
+        .values({
+          serverId,
+          name,
+          databaseName: managedDatabase.databaseName,
+          username: managedDatabase.username,
+          password: managedDatabase.password,
+          host: managedDatabase.host,
+          port: managedDatabase.port,
+          phpMyAdminUrl: managedDatabase.phpMyAdminUrl,
+        })
+        .returning();
+
+      await createAuditLog(app.db, request, {
+        organizationId: orgId,
+        serverId,
+        action: 'server.database.create',
+        metadata: {
+          name: created!.name,
+          databaseName: created!.databaseName,
+          username: created!.username,
+        },
+      });
+
+      return reply.code(201).send(created);
+    } catch (error) {
+      try {
+        await daemonDeleteDatabase(buildNodeConnection(server), {
+          databaseName: managedDatabase.databaseName,
+          username: managedDatabase.username,
+        });
+      } catch (cleanupError) {
+        request.log.error(
+          { cleanupError, orgId, serverId, databaseName: managedDatabase.databaseName },
+          'Failed to roll back node-local MySQL database after panel insert failure',
+        );
+      }
+
+      request.log.error(
+        { error, orgId, serverId, databaseName: managedDatabase.databaseName },
+        'Failed to persist managed MySQL database metadata',
+      );
+      throw new AppError(500, 'Failed to save database metadata', 'SERVER_DATABASE_SAVE_FAILED');
+    }
+  });
+
+  app.patch('/:databaseId', { schema: { ...ServerDatabaseParamSchema, ...UpdateServerDatabaseSchema } }, async (request) => {
+    const { orgId, serverId, databaseId } = request.params as {
+      databaseId: string;
+      orgId: string;
+      serverId: string;
+    };
+    await requirePermission(request, orgId, 'server.update');
+
+    const body = request.body as { name?: string; password?: string };
+
+    const [current] = await app.db
+      .select({
+        id: serverDatabases.id,
+        name: serverDatabases.name,
+        databaseName: serverDatabases.databaseName,
+        username: serverDatabases.username,
+        password: serverDatabases.password,
+        host: serverDatabases.host,
+        port: serverDatabases.port,
+        phpMyAdminUrl: serverDatabases.phpMyAdminUrl,
+        createdAt: serverDatabases.createdAt,
+        updatedAt: serverDatabases.updatedAt,
+        nodeFqdn: nodes.fqdn,
+        nodeGrpcPort: nodes.grpcPort,
+        nodeDaemonToken: nodes.daemonToken,
+      })
+      .from(serverDatabases)
+      .innerJoin(servers, eq(serverDatabases.serverId, servers.id))
+      .innerJoin(nodes, eq(servers.nodeId, nodes.id))
+      .where(
+        and(
+          eq(serverDatabases.id, databaseId),
+          eq(serverDatabases.serverId, serverId),
+          eq(servers.organizationId, orgId),
+        ),
+      );
+
+    if (!current) {
+      throw AppError.notFound('Database not found');
+    }
+
+    const nextName = body.name === undefined ? undefined : body.name.trim();
+    if (body.name !== undefined && !nextName) {
+      throw AppError.badRequest('Database name is required');
+    }
+
+    const nextPassword = body.password?.trim();
+    if (!nextName && !nextPassword) {
+      return current;
+    }
+
+    if (nextPassword) {
+      try {
+        await daemonUpdateDatabasePassword(buildNodeConnection(current), {
+          password: nextPassword,
+          username: current.username,
+        });
+      } catch (error) {
+        request.log.error(
+          { error, orgId, serverId, databaseId, username: current.username },
+          'Failed to rotate node-local MySQL password',
+        );
+        throw new AppError(
+          502,
+          daemonErrorMessage(error, 'Failed to rotate database password'),
+          'MANAGED_MYSQL_PASSWORD_UPDATE_FAILED',
+        );
+      }
+    }
+
+    const patch: Record<string, unknown> = {
+      updatedAt: new Date(),
+    };
+    if (nextName) patch.name = nextName;
+    if (nextPassword) patch.password = nextPassword;
+
+    const [updated] = await app.db
+      .update(serverDatabases)
+      .set(patch)
+      .where(eq(serverDatabases.id, databaseId))
+      .returning();
+
+    await createAuditLog(app.db, request, {
+      organizationId: orgId,
+      serverId,
+      action: 'server.database.update',
+      metadata: {
+        databaseId,
+        updatedName: nextName ?? undefined,
+        passwordRotated: Boolean(nextPassword),
+      },
+    });
+
+    return updated;
+  });
+
+  app.delete('/:databaseId', { schema: ServerDatabaseParamSchema }, async (request, reply) => {
+    const { orgId, serverId, databaseId } = request.params as {
+      databaseId: string;
+      orgId: string;
+      serverId: string;
+    };
+    await requirePermission(request, orgId, 'server.update');
+
+    const [current] = await app.db
+      .select({
+        id: serverDatabases.id,
+        name: serverDatabases.name,
+        databaseName: serverDatabases.databaseName,
+        username: serverDatabases.username,
+        nodeFqdn: nodes.fqdn,
+        nodeGrpcPort: nodes.grpcPort,
+        nodeDaemonToken: nodes.daemonToken,
+      })
+      .from(serverDatabases)
+      .innerJoin(servers, eq(serverDatabases.serverId, servers.id))
+      .innerJoin(nodes, eq(servers.nodeId, nodes.id))
+      .where(
+        and(
+          eq(serverDatabases.id, databaseId),
+          eq(serverDatabases.serverId, serverId),
+          eq(servers.organizationId, orgId),
+        ),
+      );
+
+    if (!current) {
+      throw AppError.notFound('Database not found');
+    }
+
+    try {
+      await daemonDeleteDatabase(buildNodeConnection(current), {
+        databaseName: current.databaseName,
+        username: current.username,
+      });
+    } catch (error) {
+      request.log.error(
+        { error, orgId, serverId, databaseId, databaseName: current.databaseName },
+        'Failed to delete node-local MySQL database',
+      );
+      throw new AppError(
+        502,
+        daemonErrorMessage(error, 'Failed to delete node-local MySQL database'),
+        'MANAGED_MYSQL_DELETE_FAILED',
+      );
+    }
+
+    await app.db.delete(serverDatabases).where(eq(serverDatabases.id, databaseId));
+
+    await createAuditLog(app.db, request, {
+      organizationId: orgId,
+      serverId,
+      action: 'server.database.delete',
+      metadata: {
+        databaseId,
+        name: current.name,
+        databaseName: current.databaseName,
+        username: current.username,
+      },
+    });
+
+    return reply.code(204).send();
+  });
+}

apps/api/src/routes/servers/files.ts

@@ -11,6 +11,13 @@ import {
   daemonWriteFile,
   type DaemonNodeConnection,
 } from '../../lib/daemon.js';
+import {
+  CS2_PERSISTED_SERVER_CFG_PATH,
+  CS2_PERSISTED_SERVER_CFG_FILE,
+  isManagedCs2ServerConfigPath,
+  readManagedCs2ServerConfig,
+  writeManagedCs2ServerConfig,
+} from '../../lib/cs2-server-config.js';
 
 const FileParamSchema = {
   params: Type.Object({
@@ -21,6 +28,7 @@ const FileParamSchema = {
 
 function shouldHideFileForGame(gameSlug: string, fileName: string, isDirectory: boolean): boolean {
   if (gameSlug !== 'cs2') return false;
+  if (fileName.trim() === CS2_PERSISTED_SERVER_CFG_FILE) return true;
   if (isDirectory) return false;
 
   const normalizedName = fileName.trim().toLowerCase();
@@ -96,16 +104,28 @@ export default async function fileRoutes(app: FastifyInstance) {
       await requirePermission(request, orgId, 'files.read');
       const serverContext = await getServerContext(app, orgId, serverId);
 
-      const content = await daemonReadFile(serverContext.node, serverContext.serverUuid, path);
       const requestedEncoding = encoding === 'base64' ? 'base64' : 'utf8';
+      let payload: Buffer;
+      let mimeType = 'text/plain';
+
+      if (isManagedCs2ServerConfigPath(serverContext.gameSlug, path)) {
+        payload = Buffer.from(
+          await readManagedCs2ServerConfig(serverContext.node, serverContext.serverUuid),
+          'utf8',
+        );
+      } else {
+        const content = await daemonReadFile(serverContext.node, serverContext.serverUuid, path);
+        payload = content.data;
+        mimeType = content.mimeType;
+      }
 
       return {
         data:
           requestedEncoding === 'base64'
-            ? content.data.toString('base64')
-            : content.data.toString('utf8'),
+            ? payload.toString('base64')
+            : payload.toString('utf8'),
         encoding: requestedEncoding,
-        mimeType: content.mimeType,
+        mimeType,
       };
     },
   );
@@ -136,7 +156,11 @@ export default async function fileRoutes(app: FastifyInstance) {
 
       const payload = encoding === 'base64' ? decodeBase64Payload(data) : data;
 
-      await daemonWriteFile(serverContext.node, serverContext.serverUuid, path, payload);
+      if (isManagedCs2ServerConfigPath(serverContext.gameSlug, path)) {
+        await writeManagedCs2ServerConfig(serverContext.node, serverContext.serverUuid, payload);
+      } else {
+        await daemonWriteFile(serverContext.node, serverContext.serverUuid, path, payload);
+      }
       return { success: true, path };
     },
   );
@@ -158,7 +182,18 @@ export default async function fileRoutes(app: FastifyInstance) {
       await requirePermission(request, orgId, 'files.delete');
       const serverContext = await getServerContext(app, orgId, serverId);
 
-      await daemonDeleteFiles(serverContext.node, serverContext.serverUuid, paths);
+      const resolvedPaths = paths.flatMap((path) =>
+        isManagedCs2ServerConfigPath(serverContext.gameSlug, path)
+          ? [
+              path,
+              path.trim().startsWith('/')
+                ? `/${CS2_PERSISTED_SERVER_CFG_PATH}`
+                : CS2_PERSISTED_SERVER_CFG_PATH,
+            ]
+          : [path],
+      );
+
+      await daemonDeleteFiles(serverContext.node, serverContext.serverUuid, resolvedPaths);
       return { success: true, paths };
     },
   );

apps/api/src/routes/servers/index.ts

@@ -3,7 +3,7 @@ import { Type } from '@sinclair/typebox';
 import { eq, and, count } from 'drizzle-orm';
 import { randomUUID } from 'crypto';
 import { setTimeout as sleep } from 'timers/promises';
-import { servers, allocations, nodes, games } from '@source/database';
+import { servers, allocations, nodes, games, serverDatabases } from '@source/database';
 import type { GameAutomationRule, PowerAction, ServerAutomationEvent } from '@source/shared';
 import { AppError } from '../../lib/errors.js';
 import { requirePermission } from '../../lib/permissions.js';
@@ -15,9 +15,11 @@ import {
   daemonDeleteServer,
   daemonGetServerStatus,
   daemonSetPowerState,
+  daemonUpdateServer,
   type DaemonNodeConnection,
   type DaemonPortMapping,
 } from '../../lib/daemon.js';
+import { reapplyManagedCs2ServerConfig } from '../../lib/cs2-server-config.js';
 import {
   ServerParamSchema,
   CreateServerSchema,
@@ -30,8 +32,10 @@ import pluginRoutes from './plugins.js';
 import playerRoutes from './players.js';
 import scheduleRoutes from './schedules.js';
 import backupRoutes from './backups.js';
+import databaseRoutes from './databases.js';
 
 type MutableServerStatus = 'installing' | 'running' | 'stopped' | 'error';
+type RuntimeServerStatus = MutableServerStatus | 'starting' | 'stopping' | 'suspended';
 
 function mapDaemonStatus(rawStatus: string): MutableServerStatus | null {
   switch (rawStatus.toLowerCase()) {
@@ -52,6 +56,27 @@ function mapDaemonStatus(rawStatus: string): MutableServerStatus | null {
   }
 }
 
+function normalizeRuntimeServerStatus(rawStatus: string): RuntimeServerStatus | null {
+  switch (rawStatus.toLowerCase()) {
+    case 'installing':
+      return 'installing';
+    case 'running':
+      return 'running';
+    case 'stopped':
+      return 'stopped';
+    case 'starting':
+      return 'starting';
+    case 'stopping':
+      return 'stopping';
+    case 'error':
+      return 'error';
+    case 'suspended':
+      return 'suspended';
+    default:
+      return null;
+  }
+}
+
 function buildDaemonEnvironment(
   gameEnvVarsRaw: unknown,
   overrides: Record<string, string> | undefined,
@@ -63,6 +88,7 @@ function buildDaemonEnvironment(
     for (const item of gameEnvVarsRaw) {
       if (!item || typeof item !== 'object') continue;
       const record = item as Record<string, unknown>;
+      if (typeof record.composeInto === 'string' && record.composeInto.trim()) continue;
       const key = typeof record.key === 'string' ? record.key.trim() : '';
       if (!key) continue;
 
@@ -99,6 +125,34 @@ function buildDaemonPorts(gameSlug: string, allocationPort: number, containerPor
   return [{ host_port: allocationPort, container_port: containerPort, protocol: 'tcp' }];
 }
 
+function normalizeEnvironmentOverrides(raw: unknown): Record<string, string> {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {};
+
+  const normalized: Record<string, string> = {};
+  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {
+    const normalizedKey = key.trim();
+    if (!normalizedKey) continue;
+    normalized[normalizedKey] = String(value ?? '');
+  }
+
+  return normalized;
+}
+
+function sameEnvironmentOverrides(
+  left: Record<string, string>,
+  right: Record<string, string>,
+): boolean {
+  const leftEntries = Object.entries(left);
+  const rightEntries = Object.entries(right);
+  if (leftEntries.length !== rightEntries.length) return false;
+
+  for (const [key, value] of leftEntries) {
+    if (right[key] !== value) return false;
+  }
+
+  return true;
+}
+
 async function syncServerInstallStatus(
   app: FastifyInstance,
   node: DaemonNodeConnection,
@@ -162,6 +216,32 @@ async function syncServerInstallStatus(
   );
 }
 
+async function sustainCs2ServerConfigAfterPowerStart(
+  app: FastifyInstance,
+  node: DaemonNodeConnection,
+  serverId: string,
+  serverUuid: string,
+  gameSlug: string,
+): Promise<void> {
+  if (gameSlug.trim().toLowerCase() !== 'cs2') return;
+
+  const attempts = 6;
+  const intervalMs = 10_000;
+
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    await sleep(intervalMs);
+
+    try {
+      await reapplyManagedCs2ServerConfig(node, serverUuid);
+    } catch (error) {
+      app.log.warn(
+        { error, serverId, serverUuid, attempt },
+        'Failed to reapply managed CS2 server.cfg after power start',
+      );
+    }
+  }
+}
+
 export default async function serverRoutes(app: FastifyInstance) {
   app.addHook('onRequest', app.authenticate);
 
@@ -172,6 +252,7 @@ export default async function serverRoutes(app: FastifyInstance) {
   await app.register(playerRoutes, { prefix: '/:serverId/players' });
   await app.register(scheduleRoutes, { prefix: '/:serverId/schedules' });
   await app.register(backupRoutes, { prefix: '/:serverId/backups' });
+  await app.register(databaseRoutes, { prefix: '/:serverId/databases' });
 
   // GET /api/organizations/:orgId/servers
   app.get('/', { schema: { querystring: PaginationQuerySchema } }, async (request) => {
@@ -463,6 +544,8 @@ export default async function serverRoutes(app: FastifyInstance) {
         nodeId: nodes.id,
         nodeName: nodes.name,
         nodeFqdn: nodes.fqdn,
+        nodeGrpcPort: nodes.grpcPort,
+        nodeDaemonToken: nodes.daemonToken,
         gameId: games.id,
         gameName: games.name,
         gameSlug: games.slug,
@@ -474,7 +557,55 @@ export default async function serverRoutes(app: FastifyInstance) {
 
     if (!server) throw AppError.notFound('Server not found');
 
-    return server;
+    let liveStatus: RuntimeServerStatus = server.status;
+
+    if (server.status !== 'suspended') {
+      try {
+        const daemonStatus = await daemonGetServerStatus(
+          {
+            fqdn: server.nodeFqdn,
+            grpcPort: server.nodeGrpcPort,
+            daemonToken: server.nodeDaemonToken,
+          },
+          server.uuid,
+          {
+            connectTimeoutMs: 1_500,
+            rpcTimeoutMs: 2_500,
+          },
+        );
+        const normalized = normalizeRuntimeServerStatus(daemonStatus.state);
+        if (normalized) {
+          liveStatus = normalized;
+
+          if (normalized !== 'starting' && normalized !== 'stopping') {
+            const persistedStatus = mapDaemonStatus(normalized);
+            if (persistedStatus && persistedStatus !== server.status) {
+              await app.db
+                .update(servers)
+                .set({
+                  status: persistedStatus,
+                  installedAt: persistedStatus === 'running' || persistedStatus === 'stopped'
+                    ? (server.installedAt ?? new Date())
+                    : server.installedAt,
+                  updatedAt: new Date(),
+                })
+                .where(eq(servers.id, server.id));
+            }
+          }
+        }
+      } catch (error) {
+        app.log.warn(
+          { error, serverId: server.id, serverUuid: server.uuid },
+          'Failed to fetch live daemon status for server detail',
+        );
+      }
+    }
+
+    const { nodeGrpcPort: _nodeGrpcPort, nodeDaemonToken: _nodeDaemonToken, ...response } = server;
+    return {
+      ...response,
+      status: liveStatus,
+    };
   });
 
   // PATCH /api/organizations/:orgId/servers/:serverId
@@ -482,21 +613,121 @@ export default async function serverRoutes(app: FastifyInstance) {
     const { orgId, serverId } = request.params as { orgId: string; serverId: string };
     await requirePermission(request, orgId, 'server.update');
 
-    const body = request.body as Record<string, unknown>;
+    const body = request.body as {
+      name?: string;
+      description?: string;
+      memoryLimit?: number;
+      diskLimit?: number;
+      cpuLimit?: number;
+      environment?: Record<string, string>;
+      startupOverride?: string;
+    };
+
+    const [current] = await app.db
+      .select({
+        id: servers.id,
+        uuid: servers.uuid,
+        organizationId: servers.organizationId,
+        name: servers.name,
+        description: servers.description,
+        status: servers.status,
+        memoryLimit: servers.memoryLimit,
+        diskLimit: servers.diskLimit,
+        cpuLimit: servers.cpuLimit,
+        port: servers.port,
+        environment: servers.environment,
+        startupOverride: servers.startupOverride,
+        nodeFqdn: nodes.fqdn,
+        nodeGrpcPort: nodes.grpcPort,
+        nodeDaemonToken: nodes.daemonToken,
+        gameDockerImage: games.dockerImage,
+        gameDefaultPort: games.defaultPort,
+        gameSlug: games.slug,
+        gameStartupCommand: games.startupCommand,
+        gameEnvironmentVars: games.environmentVars,
+      })
+      .from(servers)
+      .innerJoin(nodes, eq(servers.nodeId, nodes.id))
+      .innerJoin(games, eq(servers.gameId, games.id))
+      .where(and(eq(servers.id, serverId), eq(servers.organizationId, orgId)));
+
+    if (!current) throw AppError.notFound('Server not found');
+
+    const nextMemoryLimit = body.memoryLimit ?? current.memoryLimit;
+    const nextDiskLimit = body.diskLimit ?? current.diskLimit;
+    const nextCpuLimit = body.cpuLimit ?? current.cpuLimit;
+    const currentEnvironment = normalizeEnvironmentOverrides(current.environment);
+    const nextEnvironment = body.environment !== undefined
+      ? normalizeEnvironmentOverrides(body.environment)
+      : currentEnvironment;
+    const nextStartupOverride = body.startupOverride !== undefined
+      ? (body.startupOverride.trim() || null)
+      : (current.startupOverride ?? null);
+
+    const needsRuntimeRecreate =
+      nextMemoryLimit !== current.memoryLimit ||
+      nextDiskLimit !== current.diskLimit ||
+      nextCpuLimit !== current.cpuLimit ||
+      !sameEnvironmentOverrides(nextEnvironment, currentEnvironment) ||
+      nextStartupOverride !== (current.startupOverride ?? null);
+
+    let nextStatus: MutableServerStatus | null = null;
+    if (needsRuntimeRecreate) {
+      try {
+        const response = await daemonUpdateServer(
+          {
+            fqdn: current.nodeFqdn,
+            grpcPort: current.nodeGrpcPort,
+            daemonToken: current.nodeDaemonToken,
+          },
+          {
+            uuid: current.uuid,
+            docker_image: current.gameDockerImage,
+            memory_limit: nextMemoryLimit,
+            disk_limit: nextDiskLimit,
+            cpu_limit: nextCpuLimit,
+            startup_command: nextStartupOverride ?? current.gameStartupCommand,
+            environment: buildDaemonEnvironment(
+              current.gameEnvironmentVars,
+              nextEnvironment,
+              nextMemoryLimit,
+            ),
+            ports: buildDaemonPorts(current.gameSlug, current.port, current.gameDefaultPort),
+          },
+        );
+        nextStatus = mapDaemonStatus(response.status);
+      } catch (error) {
+        app.log.error(
+          { error, serverId: current.id, serverUuid: current.uuid },
+          'Failed to update server on daemon',
+        );
+        throw new AppError(502, 'Failed to apply runtime changes on daemon', 'DAEMON_UPDATE_FAILED');
+      }
+    }
+
+    const patch: Record<string, unknown> = {
+      updatedAt: new Date(),
+    };
+    if (body.name !== undefined) patch.name = body.name;
+    if (body.description !== undefined) patch.description = body.description;
+    if (body.memoryLimit !== undefined) patch.memoryLimit = nextMemoryLimit;
+    if (body.diskLimit !== undefined) patch.diskLimit = nextDiskLimit;
+    if (body.cpuLimit !== undefined) patch.cpuLimit = nextCpuLimit;
+    if (body.environment !== undefined) patch.environment = nextEnvironment;
+    if (body.startupOverride !== undefined) patch.startupOverride = nextStartupOverride;
+    if (nextStatus) patch.status = nextStatus;
 
     const [updated] = await app.db
       .update(servers)
-      .set({ ...body, updatedAt: new Date() })
+      .set(patch)
       .where(and(eq(servers.id, serverId), eq(servers.organizationId, orgId)))
       .returning();
 
-    if (!updated) throw AppError.notFound('Server not found');
-
     await createAuditLog(app.db, request, {
       organizationId: orgId,
       serverId,
       action: 'server.update',
-      metadata: body,
+      metadata: patch,
     });
 
     return updated;
@@ -507,6 +738,15 @@ export default async function serverRoutes(app: FastifyInstance) {
     const { orgId, serverId } = request.params as { orgId: string; serverId: string };
     await requirePermission(request, orgId, 'server.delete');
 
+    const [databaseUsage] = await app.db
+      .select({ count: count() })
+      .from(serverDatabases)
+      .where(eq(serverDatabases.serverId, serverId));
+
+    if ((databaseUsage?.count ?? 0) > 0) {
+      throw AppError.conflict('Delete server databases before deleting the server');
+    }
+
     const [server] = await app.db
       .select({
         id: servers.id,
@@ -633,6 +873,18 @@ export default async function serverRoutes(app: FastifyInstance) {
         .where(eq(servers.id, serverId));
 
       if (serverWithGame) {
+        void sustainCs2ServerConfigAfterPowerStart(
+          app,
+          {
+            fqdn: server.nodeFqdn,
+            grpcPort: server.nodeGrpcPort,
+            daemonToken: server.nodeDaemonToken,
+          },
+          serverId,
+          server.uuid,
+          serverWithGame.gameSlug,
+        );
+
         void runServerAutomationEvent(app, {
           serverId,
           serverUuid: server.uuid,