feat(adminui): F15.2 batch 4 — closes live-edit forms (Acl/VirtualTag/ScriptedAlarm/Script)

Final batch of F15.2. After this commit every entity surfaced by the
Phase A-D read views has a matching new/edit/delete form.

- AclEdit.razor                /clusters/{id}/acls/{new|aclId}
  - NodePermissions [Flags] enum surfaced as per-bit checkboxes plus
    one-click bundle buttons (ReadOnly / Operator / Engineer / Admin)
  - ScopeKind select + ScopeId free-text target (null = cluster-wide)
- VirtualTagEdit.razor         /virtual-tags/{new|virtualTagId}
  - Trigger validation: enforces at least one of ChangeTriggered or
    TimerIntervalMs is set
- ScriptedAlarmEdit.razor      /scripted-alarms/{new|scriptedAlarmId}
  - AlarmType select with OPC UA Part 9 subtypes
  - MessageTemplate is a textarea (template tokens are server-resolved)
- ScriptEdit.razor             /scripts/{new|scriptId}
  - SHA-256 hash computed from SourceCode on save (operator never sees
    or edits SourceHash directly)
  - InputTextArea now; Monaco syntax editor is a future enhancement

List pages (ClusterAcls / VirtualTags / ScriptedAlarms / Scripts) all
gain New + per-row Edit affordances.

Tally: F15.2 shipped CRUD for 11 entities — Cluster, ClusterNode,
UnsArea, UnsLine, Namespace, DriverInstance, Equipment, Tag, NodeAcl,
VirtualTag, ScriptedAlarm, Script.

All 9 integration tests still green.

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/Clusters/AclEdit.razor

@@ -0,0 +1,228 @@
+@page "/clusters/{ClusterId}/acls/new"
+@page "/clusters/{ClusterId}/acls/{NodeAclId}"
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
+@rendermode RenderMode.InteractiveServer
+@using Microsoft.AspNetCore.Components.Forms
+@using Microsoft.EntityFrameworkCore
+@using System.ComponentModel.DataAnnotations
+@using ZB.MOM.WW.OtOpcUa.Configuration
+@using ZB.MOM.WW.OtOpcUa.Configuration.Entities
+@using ZB.MOM.WW.OtOpcUa.Configuration.Enums
+@inject IDbContextFactory<OtOpcUaConfigDbContext> DbFactory
+@inject NavigationManager Nav
+
+<div class="d-flex justify-content-between align-items-center mb-3">
+    <h4 class="mb-0">@(IsNew ? "New ACL grant" : "Edit ACL grant") &middot; <span class="mono">@ClusterId</span></h4>
+    <a href="/clusters/@ClusterId/acls" class="btn btn-outline-secondary btn-sm">Cancel</a>
+</div>
+
+<ClusterNav ClusterId="@ClusterId" ActiveTab="acls" />
+
+@if (!_loaded)
+{
+    <p>Loading…</p>
+}
+else if (!IsNew && _existing is null)
+{
+    <section class="panel notice rise" style="animation-delay:.02s">ACL <span class="mono">@NodeAclId</span> not found.</section>
+}
+else
+{
+    <EditForm Model="_form" OnValidSubmit="SubmitAsync" FormName="aclEdit">
+        <DataAnnotationsValidator />
+        <section class="panel rise" style="animation-delay:.02s">
+            <div class="panel-head">Grant</div>
+            <div style="padding:1rem">
+                <div class="row">
+                    <div class="col-md-6 mb-3">
+                        <label class="form-label" for="aid">NodeAclId</label>
+                        <InputText id="aid" @bind-Value="_form.NodeAclId" disabled="@(!IsNew)" class="form-control form-control-sm mono" />
+                    </div>
+                    <div class="col-md-6 mb-3">
+                        <label class="form-label" for="grp">LDAP group</label>
+                        <InputText id="grp" @bind-Value="_form.LdapGroup" class="form-control form-control-sm mono"
+                                   placeholder="cn=Operators,ou=FleetAdmin,dc=lmxopcua,dc=local" />
+                    </div>
+                </div>
+                <div class="row">
+                    <div class="col-md-6 mb-3">
+                        <label class="form-label" for="scope">Scope kind</label>
+                        <InputSelect id="scope" @bind-Value="_form.ScopeKind" class="form-select form-select-sm">
+                            <option value="@NodeAclScopeKind.Cluster">Cluster</option>
+                            <option value="@NodeAclScopeKind.Namespace">Namespace</option>
+                            <option value="@NodeAclScopeKind.UnsArea">UnsArea</option>
+                            <option value="@NodeAclScopeKind.UnsLine">UnsLine</option>
+                            <option value="@NodeAclScopeKind.Equipment">Equipment</option>
+                            <option value="@NodeAclScopeKind.FolderSegment">FolderSegment</option>
+                            <option value="@NodeAclScopeKind.Tag">Tag</option>
+                        </InputSelect>
+                    </div>
+                    <div class="col-md-6 mb-3">
+                        <label class="form-label" for="target">Scope target ID</label>
+                        <InputText id="target" @bind-Value="_form.ScopeId" class="form-control form-control-sm mono"
+                                   placeholder="Leave blank for cluster-wide" />
+                    </div>
+                </div>
+                <div class="mb-3">
+                    <label class="form-label">Permissions</label>
+                    <div>
+                        @foreach (var bit in PermissionBits)
+                        {
+                            <div class="form-check form-check-inline">
+                                <input type="checkbox" class="form-check-input"
+                                       id="perm-@bit"
+                                       checked="@_form.HasPerm(bit)"
+                                       @onchange="e => _form.SetPerm(bit, (bool)e.Value!)" />
+                                <label class="form-check-label" for="perm-@bit">@bit</label>
+                            </div>
+                        }
+                    </div>
+                    <div class="form-text mt-2">
+                        Bundles:
+                        <button type="button" class="btn btn-sm btn-link p-0 ms-1" @onclick="() => _form.PermissionFlags = NodePermissions.ReadOnly">ReadOnly</button>
+                        &middot;
+                        <button type="button" class="btn btn-sm btn-link p-0" @onclick="() => _form.PermissionFlags = NodePermissions.Operator">Operator</button>
+                        &middot;
+                        <button type="button" class="btn btn-sm btn-link p-0" @onclick="() => _form.PermissionFlags = NodePermissions.Engineer">Engineer</button>
+                        &middot;
+                        <button type="button" class="btn btn-sm btn-link p-0" @onclick="() => _form.PermissionFlags = NodePermissions.Admin">Admin</button>
+                    </div>
+                </div>
+                <div class="mb-3">
+                    <label class="form-label">Notes</label>
+                    <InputTextArea @bind-Value="_form.Notes" class="form-control form-control-sm" rows="3" />
+                </div>
+            </div>
+        </section>
+
+        @if (!string.IsNullOrWhiteSpace(_error)) { <div class="panel notice mt-3" style="border-color:var(--alert)">@_error</div> }
+
+        <div class="mt-3 d-flex gap-2">
+            <button type="submit" class="btn btn-primary" disabled="@_busy">@(IsNew ? "Create" : "Save changes")</button>
+            <a href="/clusters/@ClusterId/acls" class="btn btn-outline-secondary">Cancel</a>
+            @if (!IsNew) { <button type="button" class="btn btn-outline-danger ms-auto" @onclick="DeleteAsync" disabled="@_busy">Delete</button> }
+        </div>
+    </EditForm>
+}
+
+@code {
+    private static readonly NodePermissions[] PermissionBits =
+    [
+        NodePermissions.Browse, NodePermissions.Read, NodePermissions.Subscribe, NodePermissions.HistoryRead,
+        NodePermissions.WriteOperate, NodePermissions.WriteTune, NodePermissions.WriteConfigure,
+        NodePermissions.AlarmRead, NodePermissions.AlarmAcknowledge, NodePermissions.AlarmConfirm, NodePermissions.AlarmShelve,
+        NodePermissions.MethodCall,
+    ];
+
+    [Parameter] public string ClusterId { get; set; } = "";
+    [Parameter] public string? NodeAclId { get; set; }
+
+    private bool IsNew => string.IsNullOrEmpty(NodeAclId);
+
+    private FormModel _form = new();
+    private NodeAcl? _existing;
+    private bool _loaded;
+    private bool _busy;
+    private string? _error;
+
+    protected override async Task OnInitializedAsync()
+    {
+        if (!IsNew)
+        {
+            await using var db = await DbFactory.CreateDbContextAsync();
+            _existing = await db.NodeAcls.AsNoTracking().FirstOrDefaultAsync(
+                a => a.ClusterId == ClusterId && a.NodeAclId == NodeAclId);
+            if (_existing is not null)
+            {
+                _form = new FormModel
+                {
+                    NodeAclId = _existing.NodeAclId,
+                    LdapGroup = _existing.LdapGroup,
+                    ScopeKind = _existing.ScopeKind,
+                    ScopeId = _existing.ScopeId,
+                    PermissionFlags = _existing.PermissionFlags,
+                    Notes = _existing.Notes,
+                    RowVersion = _existing.RowVersion,
+                };
+            }
+        }
+        _loaded = true;
+    }
+
+    private async Task SubmitAsync()
+    {
+        _busy = true; _error = null;
+        try
+        {
+            await using var db = await DbFactory.CreateDbContextAsync();
+            if (IsNew)
+            {
+                if (await db.NodeAcls.AnyAsync(a => a.NodeAclId == _form.NodeAclId))
+                { _error = $"ACL '{_form.NodeAclId}' already exists."; return; }
+                db.NodeAcls.Add(new NodeAcl
+                {
+                    NodeAclId = _form.NodeAclId,
+                    ClusterId = ClusterId,
+                    LdapGroup = _form.LdapGroup,
+                    ScopeKind = _form.ScopeKind,
+                    ScopeId = string.IsNullOrWhiteSpace(_form.ScopeId) ? null : _form.ScopeId,
+                    PermissionFlags = _form.PermissionFlags,
+                    Notes = string.IsNullOrWhiteSpace(_form.Notes) ? null : _form.Notes,
+                });
+            }
+            else
+            {
+                var entity = await db.NodeAcls.FirstOrDefaultAsync(a => a.ClusterId == ClusterId && a.NodeAclId == NodeAclId);
+                if (entity is null) { _error = "Row no longer exists."; return; }
+                db.Entry(entity).Property(e => e.RowVersion).OriginalValue = _form.RowVersion;
+                entity.LdapGroup = _form.LdapGroup;
+                entity.ScopeKind = _form.ScopeKind;
+                entity.ScopeId = string.IsNullOrWhiteSpace(_form.ScopeId) ? null : _form.ScopeId;
+                entity.PermissionFlags = _form.PermissionFlags;
+                entity.Notes = string.IsNullOrWhiteSpace(_form.Notes) ? null : _form.Notes;
+            }
+            await db.SaveChangesAsync();
+            Nav.NavigateTo($"/clusters/{ClusterId}/acls");
+        }
+        catch (DbUpdateConcurrencyException) { _error = "Another user changed this ACL while you were editing."; }
+        catch (Exception ex) { _error = ex.Message; }
+        finally { _busy = false; }
+    }
+
+    private async Task DeleteAsync()
+    {
+        if (IsNew) return;
+        _busy = true; _error = null;
+        try
+        {
+            await using var db = await DbFactory.CreateDbContextAsync();
+            var entity = await db.NodeAcls.FirstOrDefaultAsync(a => a.ClusterId == ClusterId && a.NodeAclId == NodeAclId);
+            if (entity is null) { Nav.NavigateTo($"/clusters/{ClusterId}/acls"); return; }
+            db.Entry(entity).Property(e => e.RowVersion).OriginalValue = _form.RowVersion;
+            db.NodeAcls.Remove(entity);
+            await db.SaveChangesAsync();
+            Nav.NavigateTo($"/clusters/{ClusterId}/acls");
+        }
+        catch (DbUpdateConcurrencyException) { _error = "Another user changed this ACL while you were viewing it."; }
+        catch (Exception ex) { _error = ex.Message; }
+        finally { _busy = false; }
+    }
+
+    private sealed class FormModel
+    {
+        [Required, RegularExpression("^[A-Za-z0-9_-]+$")] public string NodeAclId { get; set; } = "";
+        [Required] public string LdapGroup { get; set; } = "";
+        public NodeAclScopeKind ScopeKind { get; set; } = NodeAclScopeKind.Cluster;
+        public string? ScopeId { get; set; }
+        public NodePermissions PermissionFlags { get; set; } = NodePermissions.None;
+        public string? Notes { get; set; }
+        public byte[] RowVersion { get; set; } = [];
+
+        public bool HasPerm(NodePermissions bit) => PermissionFlags.HasFlag(bit);
+        public void SetPerm(NodePermissions bit, bool on)
+        {
+            if (on) PermissionFlags |= bit;
+            else PermissionFlags &= ~bit;
+        }
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/Clusters/ClusterAcls.razor

@@ -8,6 +8,7 @@
 
 <div class="d-flex justify-content-between align-items-center mb-3">
     <h4 class="mb-0">ACLs &middot; <span class="mono">@ClusterId</span></h4>
+    <a href="/clusters/@ClusterId/acls/new" class="btn btn-primary btn-sm">New ACL grant</a>
 </div>
 
 <ClusterNav ClusterId="@ClusterId" ActiveTab="acls" />
@@ -43,6 +44,7 @@ else
                             <th>Scope target</th>
                             <th>Permissions</th>
                             <th>Notes</th>
+                            <th></th>
                         </tr>
                     </thead>
                     <tbody>
@@ -60,6 +62,7 @@ else
                                     }
                                 </td>
                                 <td class="text-muted small">@(a.Notes ?? "")</td>
+                                <td><a href="/clusters/@ClusterId/acls/@a.NodeAclId" class="btn btn-sm btn-outline-primary">Edit</a></td>
                             </tr>
                         }
                     </tbody>

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ScriptEdit.razor

@@ -0,0 +1,175 @@
+@page "/scripts/new"
+@page "/scripts/{ScriptId}"
+@* Script CRUD. SourceHash is computed automatically from SourceCode on save so the
+   integrity check in v2's deployment pipeline doesn't require operator action. *@
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
+@rendermode RenderMode.InteractiveServer
+@using Microsoft.AspNetCore.Components.Forms
+@using Microsoft.EntityFrameworkCore
+@using System.ComponentModel.DataAnnotations
+@using System.Security.Cryptography
+@using System.Text
+@using ZB.MOM.WW.OtOpcUa.Configuration
+@using ZB.MOM.WW.OtOpcUa.Configuration.Entities
+@inject IDbContextFactory<OtOpcUaConfigDbContext> DbFactory
+@inject NavigationManager Nav
+
+<div class="d-flex justify-content-between align-items-center mb-3">
+    <h4 class="mb-0">@(IsNew ? "New script" : "Edit script")</h4>
+    <a href="/scripts" class="btn btn-outline-secondary btn-sm">Cancel</a>
+</div>
+
+@if (!_loaded)
+{
+    <p>Loading…</p>
+}
+else if (!IsNew && _existing is null)
+{
+    <section class="panel notice rise"><span class="mono">@ScriptId</span> not found.</section>
+}
+else
+{
+    <EditForm Model="_form" OnValidSubmit="SubmitAsync" FormName="scriptEdit">
+        <DataAnnotationsValidator />
+        <section class="panel rise">
+            <div class="panel-head">Identity</div>
+            <div style="padding:1rem">
+                <div class="row">
+                    <div class="col-md-6 mb-3">
+                        <label class="form-label">ScriptId</label>
+                        <InputText @bind-Value="_form.ScriptId" disabled="@(!IsNew)" class="form-control form-control-sm mono" />
+                    </div>
+                    <div class="col-md-4 mb-3">
+                        <label class="form-label">Name</label>
+                        <InputText @bind-Value="_form.Name" class="form-control form-control-sm" />
+                    </div>
+                    <div class="col-md-2 mb-3">
+                        <label class="form-label">Language</label>
+                        <InputSelect @bind-Value="_form.Language" class="form-select form-select-sm">
+                            <option value="CSharp">CSharp</option>
+                        </InputSelect>
+                    </div>
+                </div>
+            </div>
+        </section>
+
+        <section class="panel rise mt-3">
+            <div class="panel-head">Source</div>
+            <div style="padding:1rem">
+                <InputTextArea @bind-Value="_form.SourceCode" class="form-control form-control-sm mono"
+                               rows="20"
+                               placeholder="// C# expression body — Monaco editor lands in a follow-up." />
+                <div class="form-text">SHA-256 hash is computed automatically on save.</div>
+            </div>
+        </section>
+
+        @if (!string.IsNullOrWhiteSpace(_error)) { <div class="panel notice mt-3" style="border-color:var(--alert)">@_error</div> }
+
+        <div class="mt-3 d-flex gap-2">
+            <button type="submit" class="btn btn-primary" disabled="@_busy">@(IsNew ? "Create" : "Save changes")</button>
+            <a href="/scripts" class="btn btn-outline-secondary">Cancel</a>
+            @if (!IsNew) { <button type="button" class="btn btn-outline-danger ms-auto" @onclick="DeleteAsync" disabled="@_busy">Delete</button> }
+        </div>
+    </EditForm>
+}
+
+@code {
+    [Parameter] public string? ScriptId { get; set; }
+    private bool IsNew => string.IsNullOrEmpty(ScriptId);
+
+    private FormModel _form = new();
+    private Script? _existing;
+    private bool _loaded;
+    private bool _busy;
+    private string? _error;
+
+    protected override async Task OnInitializedAsync()
+    {
+        if (!IsNew)
+        {
+            await using var db = await DbFactory.CreateDbContextAsync();
+            _existing = await db.Scripts.AsNoTracking().FirstOrDefaultAsync(s => s.ScriptId == ScriptId);
+            if (_existing is not null)
+            {
+                _form = new FormModel
+                {
+                    ScriptId = _existing.ScriptId,
+                    Name = _existing.Name,
+                    Language = _existing.Language,
+                    SourceCode = _existing.SourceCode,
+                    RowVersion = _existing.RowVersion,
+                };
+            }
+        }
+        _loaded = true;
+    }
+
+    private async Task SubmitAsync()
+    {
+        _busy = true; _error = null;
+        try
+        {
+            var sourceHash = HashSource(_form.SourceCode);
+            await using var db = await DbFactory.CreateDbContextAsync();
+            if (IsNew)
+            {
+                if (await db.Scripts.AnyAsync(s => s.ScriptId == _form.ScriptId))
+                { _error = $"Script '{_form.ScriptId}' already exists."; return; }
+                db.Scripts.Add(new Script
+                {
+                    ScriptId = _form.ScriptId,
+                    Name = _form.Name,
+                    Language = _form.Language,
+                    SourceCode = _form.SourceCode,
+                    SourceHash = sourceHash,
+                });
+            }
+            else
+            {
+                var entity = await db.Scripts.FirstOrDefaultAsync(s => s.ScriptId == ScriptId);
+                if (entity is null) { _error = "Row no longer exists."; return; }
+                db.Entry(entity).Property(e => e.RowVersion).OriginalValue = _form.RowVersion;
+                entity.Name = _form.Name;
+                entity.Language = _form.Language;
+                entity.SourceCode = _form.SourceCode;
+                entity.SourceHash = sourceHash;
+            }
+            await db.SaveChangesAsync();
+            Nav.NavigateTo("/scripts");
+        }
+        catch (DbUpdateConcurrencyException) { _error = "Another user changed this script while you were editing."; }
+        catch (Exception ex) { _error = ex.Message; }
+        finally { _busy = false; }
+    }
+
+    private async Task DeleteAsync()
+    {
+        if (IsNew) return;
+        _busy = true; _error = null;
+        try
+        {
+            await using var db = await DbFactory.CreateDbContextAsync();
+            var entity = await db.Scripts.FirstOrDefaultAsync(s => s.ScriptId == ScriptId);
+            if (entity is null) { Nav.NavigateTo("/scripts"); return; }
+            db.Entry(entity).Property(e => e.RowVersion).OriginalValue = _form.RowVersion;
+            db.Scripts.Remove(entity);
+            await db.SaveChangesAsync();
+            Nav.NavigateTo("/scripts");
+        }
+        catch (DbUpdateConcurrencyException) { _error = "Another user changed this script while you were viewing it."; }
+        catch (Exception ex) { _error = $"Delete failed: {ex.Message}. Likely because virtual tags or scripted alarms still reference this script — remove them first."; }
+        finally { _busy = false; }
+    }
+
+    private static string HashSource(string source) =>
+        Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(source)));
+
+    private sealed class FormModel
+    {
+        [Required, RegularExpression("^[A-Za-z0-9_-]+$")] public string ScriptId { get; set; } = "";
+        [Required] public string Name { get; set; } = "";
+        [Required] public string Language { get; set; } = "CSharp";
+        [Required] public string SourceCode { get; set; } = "";
+        public byte[] RowVersion { get; set; } = [];
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ScriptedAlarmEdit.razor

@@ -0,0 +1,236 @@
+@page "/scripted-alarms/new"
+@page "/scripted-alarms/{ScriptedAlarmId}"
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
+@rendermode RenderMode.InteractiveServer
+@using Microsoft.AspNetCore.Components.Forms
+@using Microsoft.EntityFrameworkCore
+@using System.ComponentModel.DataAnnotations
+@using ZB.MOM.WW.OtOpcUa.Configuration
+@using ZB.MOM.WW.OtOpcUa.Configuration.Entities
+@inject IDbContextFactory<OtOpcUaConfigDbContext> DbFactory
+@inject NavigationManager Nav
+
+<div class="d-flex justify-content-between align-items-center mb-3">
+    <h4 class="mb-0">@(IsNew ? "New scripted alarm" : "Edit scripted alarm")</h4>
+    <a href="/scripted-alarms" class="btn btn-outline-secondary btn-sm">Cancel</a>
+</div>
+
+@if (!_loaded)
+{
+    <p>Loading…</p>
+}
+else if (!IsNew && _existing is null)
+{
+    <section class="panel notice rise"><span class="mono">@ScriptedAlarmId</span> not found.</section>
+}
+else
+{
+    <EditForm Model="_form" OnValidSubmit="SubmitAsync" FormName="scriptedAlarmEdit">
+        <DataAnnotationsValidator />
+        <section class="panel rise">
+            <div class="panel-head">Identity</div>
+            <div style="padding:1rem">
+                <div class="row">
+                    <div class="col-md-6 mb-3">
+                        <label class="form-label">ScriptedAlarmId</label>
+                        <InputText @bind-Value="_form.ScriptedAlarmId" disabled="@(!IsNew)" class="form-control form-control-sm mono" />
+                    </div>
+                    <div class="col-md-6 mb-3">
+                        <label class="form-label">Name</label>
+                        <InputText @bind-Value="_form.Name" class="form-control form-control-sm" />
+                    </div>
+                </div>
+                <div class="row">
+                    <div class="col-md-6 mb-3">
+                        <label class="form-label">Equipment</label>
+                        <InputSelect @bind-Value="_form.EquipmentId" class="form-select form-select-sm">
+                            <option value="">— pick equipment —</option>
+                            @foreach (var e in _equipment) { <option value="@e.EquipmentId">@e.MachineCode &mdash; @e.Name</option> }
+                        </InputSelect>
+                    </div>
+                    <div class="col-md-3 mb-3">
+                        <label class="form-label">AlarmType</label>
+                        <InputSelect @bind-Value="_form.AlarmType" class="form-select form-select-sm">
+                            <option value="LimitAlarm">LimitAlarm</option>
+                            <option value="DiscreteAlarm">DiscreteAlarm</option>
+                            <option value="OffNormalAlarm">OffNormalAlarm</option>
+                            <option value="AlarmCondition">AlarmCondition</option>
+                        </InputSelect>
+                    </div>
+                    <div class="col-md-3 mb-3">
+                        <label class="form-label">Severity (1-1000)</label>
+                        <InputNumber @bind-Value="_form.Severity" class="form-control form-control-sm" />
+                    </div>
+                </div>
+                <div class="row">
+                    <div class="col-md-12 mb-3">
+                        <label class="form-label">Predicate script</label>
+                        <InputSelect @bind-Value="_form.PredicateScriptId" class="form-select form-select-sm">
+                            <option value="">— pick script —</option>
+                            @foreach (var s in _scripts) { <option value="@s.ScriptId">@s.Name</option> }
+                        </InputSelect>
+                    </div>
+                </div>
+                <div class="mb-3">
+                    <label class="form-label">Message template</label>
+                    <InputTextArea @bind-Value="_form.MessageTemplate" class="form-control form-control-sm" rows="3"
+                                   placeholder="{equipment.MachineCode} temperature out of range: {value}°C" />
+                </div>
+                <div class="row">
+                    <div class="col-md-4 mb-3">
+                        <label class="form-label">HistorizeToAveva</label>
+                        <div class="form-check form-switch">
+                            <InputCheckbox @bind-Value="_form.HistorizeToAveva" class="form-check-input" />
+                            <label class="form-check-label">Route to Wonderware sidecar</label>
+                        </div>
+                    </div>
+                    <div class="col-md-4 mb-3">
+                        <label class="form-label">Retain</label>
+                        <div class="form-check form-switch">
+                            <InputCheckbox @bind-Value="_form.Retain" class="form-check-input" />
+                            <label class="form-check-label">Retain active alarms on restart</label>
+                        </div>
+                    </div>
+                    <div class="col-md-4 mb-3">
+                        <label class="form-label">Enabled</label>
+                        <div class="form-check form-switch">
+                            <InputCheckbox @bind-Value="_form.Enabled" class="form-check-input" />
+                            <label class="form-check-label">Spawn this alarm in deployments</label>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </section>
+
+        @if (!string.IsNullOrWhiteSpace(_error)) { <div class="panel notice mt-3" style="border-color:var(--alert)">@_error</div> }
+
+        <div class="mt-3 d-flex gap-2">
+            <button type="submit" class="btn btn-primary" disabled="@_busy">@(IsNew ? "Create" : "Save changes")</button>
+            <a href="/scripted-alarms" class="btn btn-outline-secondary">Cancel</a>
+            @if (!IsNew) { <button type="button" class="btn btn-outline-danger ms-auto" @onclick="DeleteAsync" disabled="@_busy">Delete</button> }
+        </div>
+    </EditForm>
+}
+
+@code {
+    [Parameter] public string? ScriptedAlarmId { get; set; }
+    private bool IsNew => string.IsNullOrEmpty(ScriptedAlarmId);
+
+    private FormModel _form = new();
+    private ScriptedAlarm? _existing;
+    private List<Equipment> _equipment = new();
+    private List<Script> _scripts = new();
+    private bool _loaded;
+    private bool _busy;
+    private string? _error;
+
+    protected override async Task OnInitializedAsync()
+    {
+        await using var db = await DbFactory.CreateDbContextAsync();
+        _equipment = await db.Equipment.AsNoTracking().OrderBy(e => e.MachineCode).ToListAsync();
+        _scripts = await db.Scripts.AsNoTracking().OrderBy(s => s.Name).ToListAsync();
+        if (!IsNew)
+        {
+            _existing = await db.ScriptedAlarms.AsNoTracking().FirstOrDefaultAsync(a => a.ScriptedAlarmId == ScriptedAlarmId);
+            if (_existing is not null)
+            {
+                _form = new FormModel
+                {
+                    ScriptedAlarmId = _existing.ScriptedAlarmId,
+                    Name = _existing.Name,
+                    EquipmentId = _existing.EquipmentId,
+                    AlarmType = _existing.AlarmType,
+                    Severity = _existing.Severity,
+                    PredicateScriptId = _existing.PredicateScriptId,
+                    MessageTemplate = _existing.MessageTemplate,
+                    HistorizeToAveva = _existing.HistorizeToAveva,
+                    Retain = _existing.Retain,
+                    Enabled = _existing.Enabled,
+                    RowVersion = _existing.RowVersion,
+                };
+            }
+        }
+        _loaded = true;
+    }
+
+    private async Task SubmitAsync()
+    {
+        _busy = true; _error = null;
+        try
+        {
+            await using var db = await DbFactory.CreateDbContextAsync();
+            if (IsNew)
+            {
+                if (await db.ScriptedAlarms.AnyAsync(a => a.ScriptedAlarmId == _form.ScriptedAlarmId))
+                { _error = $"ScriptedAlarm '{_form.ScriptedAlarmId}' already exists."; return; }
+                db.ScriptedAlarms.Add(new ScriptedAlarm
+                {
+                    ScriptedAlarmId = _form.ScriptedAlarmId,
+                    EquipmentId = _form.EquipmentId,
+                    Name = _form.Name,
+                    AlarmType = _form.AlarmType,
+                    Severity = _form.Severity,
+                    MessageTemplate = _form.MessageTemplate,
+                    PredicateScriptId = _form.PredicateScriptId,
+                    HistorizeToAveva = _form.HistorizeToAveva,
+                    Retain = _form.Retain,
+                    Enabled = _form.Enabled,
+                });
+            }
+            else
+            {
+                var entity = await db.ScriptedAlarms.FirstOrDefaultAsync(a => a.ScriptedAlarmId == ScriptedAlarmId);
+                if (entity is null) { _error = "Row no longer exists."; return; }
+                db.Entry(entity).Property(e => e.RowVersion).OriginalValue = _form.RowVersion;
+                entity.EquipmentId = _form.EquipmentId;
+                entity.Name = _form.Name;
+                entity.AlarmType = _form.AlarmType;
+                entity.Severity = _form.Severity;
+                entity.MessageTemplate = _form.MessageTemplate;
+                entity.PredicateScriptId = _form.PredicateScriptId;
+                entity.HistorizeToAveva = _form.HistorizeToAveva;
+                entity.Retain = _form.Retain;
+                entity.Enabled = _form.Enabled;
+            }
+            await db.SaveChangesAsync();
+            Nav.NavigateTo("/scripted-alarms");
+        }
+        catch (DbUpdateConcurrencyException) { _error = "Another user changed this scripted alarm while you were editing."; }
+        catch (Exception ex) { _error = ex.Message; }
+        finally { _busy = false; }
+    }
+
+    private async Task DeleteAsync()
+    {
+        if (IsNew) return;
+        _busy = true; _error = null;
+        try
+        {
+            await using var db = await DbFactory.CreateDbContextAsync();
+            var entity = await db.ScriptedAlarms.FirstOrDefaultAsync(a => a.ScriptedAlarmId == ScriptedAlarmId);
+            if (entity is null) { Nav.NavigateTo("/scripted-alarms"); return; }
+            db.Entry(entity).Property(e => e.RowVersion).OriginalValue = _form.RowVersion;
+            db.ScriptedAlarms.Remove(entity);
+            await db.SaveChangesAsync();
+            Nav.NavigateTo("/scripted-alarms");
+        }
+        catch (DbUpdateConcurrencyException) { _error = "Another user changed this alarm while you were viewing it."; }
+        catch (Exception ex) { _error = ex.Message; }
+        finally { _busy = false; }
+    }
+
+    private sealed class FormModel
+    {
+        [Required, RegularExpression("^[A-Za-z0-9_-]+$")] public string ScriptedAlarmId { get; set; } = "";
+        [Required] public string Name { get; set; } = "";
+        [Required] public string EquipmentId { get; set; } = "";
+        [Required] public string AlarmType { get; set; } = "LimitAlarm";
+        [Range(1, 1000)] public int Severity { get; set; } = 500;
+        [Required] public string PredicateScriptId { get; set; } = "";
+        [Required] public string MessageTemplate { get; set; } = "";
+        public bool HistorizeToAveva { get; set; } = true;
+        public bool Retain { get; set; } = true;
+        public bool Enabled { get; set; } = true;
+        public byte[] RowVersion { get; set; } = [];
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ScriptedAlarms.razor

@@ -8,6 +8,7 @@
 
 <div class="d-flex justify-content-between align-items-center mb-3">
     <h4 class="mb-0">Scripted alarms</h4>
+    <a href="/scripted-alarms/new" class="btn btn-primary btn-sm">New scripted alarm</a>
 </div>
 
 @if (_rows is null)
@@ -42,6 +43,7 @@ else
                             <th>Predicate</th>
                             <th>Flags</th>
                             <th>Status</th>
+                            <th></th>
                         </tr>
                     </thead>
                     <tbody>
@@ -62,6 +64,7 @@ else
                                     @if (a.Enabled) { <span class="chip chip-ok">Enabled</span> }
                                     else { <span class="chip chip-idle">Disabled</span> }
                                 </td>
+                                <td><a href="/scripted-alarms/@a.ScriptedAlarmId" class="btn btn-sm btn-outline-primary">Edit</a></td>
                             </tr>
                         }
                     </tbody>

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/Scripts.razor

@@ -8,6 +8,7 @@
 
 <div class="d-flex justify-content-between align-items-center mb-3">
     <h4 class="mb-0">Scripts</h4>
+    <a href="/scripts/new" class="btn btn-primary btn-sm">New script</a>
 </div>
 
 @if (_rows is null)
@@ -40,6 +41,9 @@ else
                         <span class="text-muted small ms-2 mono">hash=@s.SourceHash[..12]…</span>
                     </summary>
                     <div style="padding:0 1rem 1rem">
+                        <div class="d-flex mb-2">
+                            <a href="/scripts/@s.ScriptId" class="btn btn-sm btn-outline-primary">Edit</a>
+                        </div>
                         <pre class="mono small" style="background:var(--surface-2);padding:1rem;border-radius:4px;overflow:auto">@s.SourceCode</pre>
                     </div>
                 </details>

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/VirtualTagEdit.razor

@@ -0,0 +1,231 @@
+@page "/virtual-tags/new"
+@page "/virtual-tags/{VirtualTagId}"
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
+@rendermode RenderMode.InteractiveServer
+@using Microsoft.AspNetCore.Components.Forms
+@using Microsoft.EntityFrameworkCore
+@using System.ComponentModel.DataAnnotations
+@using ZB.MOM.WW.OtOpcUa.Configuration
+@using ZB.MOM.WW.OtOpcUa.Configuration.Entities
+@inject IDbContextFactory<OtOpcUaConfigDbContext> DbFactory
+@inject NavigationManager Nav
+
+<div class="d-flex justify-content-between align-items-center mb-3">
+    <h4 class="mb-0">@(IsNew ? "New virtual tag" : "Edit virtual tag")</h4>
+    <a href="/virtual-tags" class="btn btn-outline-secondary btn-sm">Cancel</a>
+</div>
+
+@if (!_loaded)
+{
+    <p>Loading…</p>
+}
+else if (!IsNew && _existing is null)
+{
+    <section class="panel notice rise"><span class="mono">@VirtualTagId</span> not found.</section>
+}
+else
+{
+    <EditForm Model="_form" OnValidSubmit="SubmitAsync" FormName="vtagEdit">
+        <DataAnnotationsValidator />
+        <section class="panel rise">
+            <div class="panel-head">Identity</div>
+            <div style="padding:1rem">
+                <div class="row">
+                    <div class="col-md-6 mb-3">
+                        <label class="form-label">VirtualTagId</label>
+                        <InputText @bind-Value="_form.VirtualTagId" disabled="@(!IsNew)" class="form-control form-control-sm mono" />
+                    </div>
+                    <div class="col-md-6 mb-3">
+                        <label class="form-label">Name</label>
+                        <InputText @bind-Value="_form.Name" class="form-control form-control-sm" />
+                    </div>
+                </div>
+                <div class="row">
+                    <div class="col-md-6 mb-3">
+                        <label class="form-label">Equipment</label>
+                        <InputSelect @bind-Value="_form.EquipmentId" class="form-select form-select-sm">
+                            <option value="">— pick equipment —</option>
+                            @foreach (var e in _equipment) { <option value="@e.EquipmentId">@e.MachineCode &mdash; @e.Name</option> }
+                        </InputSelect>
+                    </div>
+                    <div class="col-md-3 mb-3">
+                        <label class="form-label">DataType</label>
+                        <InputText @bind-Value="_form.DataType" class="form-control form-control-sm mono" placeholder="Double" />
+                    </div>
+                    <div class="col-md-3 mb-3">
+                        <label class="form-label">Script</label>
+                        <InputSelect @bind-Value="_form.ScriptId" class="form-select form-select-sm">
+                            <option value="">— pick script —</option>
+                            @foreach (var s in _scripts) { <option value="@s.ScriptId">@s.Name (@s.Language)</option> }
+                        </InputSelect>
+                    </div>
+                </div>
+                <div class="row">
+                    <div class="col-md-4 mb-3">
+                        <label class="form-label">Change-triggered</label>
+                        <div class="form-check form-switch">
+                            <InputCheckbox @bind-Value="_form.ChangeTriggered" class="form-check-input" />
+                            <label class="form-check-label">Re-evaluate on dependency change</label>
+                        </div>
+                    </div>
+                    <div class="col-md-4 mb-3">
+                        <label class="form-label">TimerIntervalMs (optional)</label>
+                        <InputNumber @bind-Value="_form.TimerIntervalMs" class="form-control form-control-sm" />
+                        <div class="form-text">Periodic re-evaluation. Null = change-trigger only.</div>
+                    </div>
+                    <div class="col-md-4 mb-3">
+                        <label class="form-label">Historize</label>
+                        <div class="form-check form-switch">
+                            <InputCheckbox @bind-Value="_form.Historize" class="form-check-input" />
+                            <label class="form-check-label">Send to Wonderware historian</label>
+                        </div>
+                    </div>
+                </div>
+                <div class="mb-3">
+                    <label class="form-label">Enabled</label>
+                    <div class="form-check form-switch">
+                        <InputCheckbox @bind-Value="_form.Enabled" class="form-check-input" />
+                        <label class="form-check-label">Spawn this virtual tag in deployments</label>
+                    </div>
+                </div>
+            </div>
+        </section>
+
+        @if (!string.IsNullOrWhiteSpace(_error)) { <div class="panel notice mt-3" style="border-color:var(--alert)">@_error</div> }
+
+        <div class="mt-3 d-flex gap-2">
+            <button type="submit" class="btn btn-primary" disabled="@_busy">@(IsNew ? "Create" : "Save changes")</button>
+            <a href="/virtual-tags" class="btn btn-outline-secondary">Cancel</a>
+            @if (!IsNew) { <button type="button" class="btn btn-outline-danger ms-auto" @onclick="DeleteAsync" disabled="@_busy">Delete</button> }
+        </div>
+    </EditForm>
+}
+
+@code {
+    [Parameter] public string? VirtualTagId { get; set; }
+    private bool IsNew => string.IsNullOrEmpty(VirtualTagId);
+
+    private FormModel _form = new();
+    private VirtualTag? _existing;
+    private List<Equipment> _equipment = new();
+    private List<Script> _scripts = new();
+    private bool _loaded;
+    private bool _busy;
+    private string? _error;
+
+    protected override async Task OnInitializedAsync()
+    {
+        await using var db = await DbFactory.CreateDbContextAsync();
+        _equipment = await db.Equipment.AsNoTracking().OrderBy(e => e.MachineCode).ToListAsync();
+        _scripts = await db.Scripts.AsNoTracking().OrderBy(s => s.Name).ToListAsync();
+        if (!IsNew)
+        {
+            _existing = await db.VirtualTags.AsNoTracking().FirstOrDefaultAsync(v => v.VirtualTagId == VirtualTagId);
+            if (_existing is not null)
+            {
+                _form = new FormModel
+                {
+                    VirtualTagId = _existing.VirtualTagId,
+                    Name = _existing.Name,
+                    EquipmentId = _existing.EquipmentId,
+                    DataType = _existing.DataType,
+                    ScriptId = _existing.ScriptId,
+                    ChangeTriggered = _existing.ChangeTriggered,
+                    TimerIntervalMs = _existing.TimerIntervalMs,
+                    Historize = _existing.Historize,
+                    Enabled = _existing.Enabled,
+                    RowVersion = _existing.RowVersion,
+                };
+            }
+        }
+        else
+        {
+            _form.DataType = "Double";
+            _form.ChangeTriggered = true;
+        }
+        _loaded = true;
+    }
+
+    private async Task SubmitAsync()
+    {
+        _busy = true; _error = null;
+        try
+        {
+            if (string.IsNullOrEmpty(_form.EquipmentId)) { _error = "Pick equipment."; return; }
+            if (string.IsNullOrEmpty(_form.ScriptId)) { _error = "Pick a script."; return; }
+            if (!_form.ChangeTriggered && _form.TimerIntervalMs is null)
+            { _error = "Pick at least one trigger — change or timer."; return; }
+
+            await using var db = await DbFactory.CreateDbContextAsync();
+            if (IsNew)
+            {
+                if (await db.VirtualTags.AnyAsync(v => v.VirtualTagId == _form.VirtualTagId))
+                { _error = $"VirtualTag '{_form.VirtualTagId}' already exists."; return; }
+                db.VirtualTags.Add(new VirtualTag
+                {
+                    VirtualTagId = _form.VirtualTagId,
+                    EquipmentId = _form.EquipmentId,
+                    Name = _form.Name,
+                    DataType = _form.DataType,
+                    ScriptId = _form.ScriptId,
+                    ChangeTriggered = _form.ChangeTriggered,
+                    TimerIntervalMs = _form.TimerIntervalMs,
+                    Historize = _form.Historize,
+                    Enabled = _form.Enabled,
+                });
+            }
+            else
+            {
+                var entity = await db.VirtualTags.FirstOrDefaultAsync(v => v.VirtualTagId == VirtualTagId);
+                if (entity is null) { _error = "Row no longer exists."; return; }
+                db.Entry(entity).Property(e => e.RowVersion).OriginalValue = _form.RowVersion;
+                entity.EquipmentId = _form.EquipmentId;
+                entity.Name = _form.Name;
+                entity.DataType = _form.DataType;
+                entity.ScriptId = _form.ScriptId;
+                entity.ChangeTriggered = _form.ChangeTriggered;
+                entity.TimerIntervalMs = _form.TimerIntervalMs;
+                entity.Historize = _form.Historize;
+                entity.Enabled = _form.Enabled;
+            }
+            await db.SaveChangesAsync();
+            Nav.NavigateTo("/virtual-tags");
+        }
+        catch (DbUpdateConcurrencyException) { _error = "Another user changed this virtual tag while you were editing."; }
+        catch (Exception ex) { _error = ex.Message; }
+        finally { _busy = false; }
+    }
+
+    private async Task DeleteAsync()
+    {
+        if (IsNew) return;
+        _busy = true; _error = null;
+        try
+        {
+            await using var db = await DbFactory.CreateDbContextAsync();
+            var entity = await db.VirtualTags.FirstOrDefaultAsync(v => v.VirtualTagId == VirtualTagId);
+            if (entity is null) { Nav.NavigateTo("/virtual-tags"); return; }
+            db.Entry(entity).Property(e => e.RowVersion).OriginalValue = _form.RowVersion;
+            db.VirtualTags.Remove(entity);
+            await db.SaveChangesAsync();
+            Nav.NavigateTo("/virtual-tags");
+        }
+        catch (DbUpdateConcurrencyException) { _error = "Another user changed this virtual tag while you were viewing it."; }
+        catch (Exception ex) { _error = ex.Message; }
+        finally { _busy = false; }
+    }
+
+    private sealed class FormModel
+    {
+        [Required, RegularExpression("^[A-Za-z0-9_-]+$")] public string VirtualTagId { get; set; } = "";
+        [Required] public string Name { get; set; } = "";
+        [Required] public string EquipmentId { get; set; } = "";
+        [Required] public string DataType { get; set; } = "Double";
+        [Required] public string ScriptId { get; set; } = "";
+        public bool ChangeTriggered { get; set; } = true;
+        public int? TimerIntervalMs { get; set; }
+        public bool Historize { get; set; }
+        public bool Enabled { get; set; } = true;
+        public byte[] RowVersion { get; set; } = [];
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/VirtualTags.razor

@@ -8,6 +8,7 @@
 
 <div class="d-flex justify-content-between align-items-center mb-3">
     <h4 class="mb-0">Virtual tags</h4>
+    <a href="/virtual-tags/new" class="btn btn-primary btn-sm">New virtual tag</a>
 </div>
 
 @if (_rows is null)
@@ -41,6 +42,7 @@ else
                             <th>Script</th>
                             <th>Trigger</th>
                             <th>Status</th>
+                            <th></th>
                         </tr>
                     </thead>
                     <tbody>
@@ -60,6 +62,7 @@ else
                                     @if (v.Enabled) { <span class="chip chip-ok">Enabled</span> }
                                     else { <span class="chip chip-idle">Disabled</span> }
                                 </td>
+                                <td><a href="/virtual-tags/@v.VirtualTagId" class="btn btn-sm btn-outline-primary">Edit</a></td>
                             </tr>
                         }
                     </tbody>